Compare commits
No commits in common. 'i8c' and 'c9' have entirely different histories.
@ -1 +1 @@
|
|||||||
ce825a10c5aa885e001c963be4cc4a8dea2137b0 SOURCES/clevis-15.tar.xz
|
dc2e95d0c0ce9118bc01b3872869657b0d43f1bc SOURCES/clevis-18.tar.xz
|
||||||
|
|||||||
@ -1 +1 @@
|
|||||||
SOURCES/clevis-15.tar.xz
|
SOURCES/clevis-18.tar.xz
|
||||||
|
|||||||
@ -1,176 +0,0 @@
|
|||||||
From 16f667d9f3d649e33ca762afa1a8a7f909b953a8 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Sergio Correia <scorreia@redhat.com>
|
|
||||||
Date: Sun, 25 Oct 2020 11:15:46 -0300
|
|
||||||
Subject: [PATCH] Fixes for dealing with newer tang without tangd-update
|
|
||||||
|
|
||||||
---
|
|
||||||
src/luks/tests/meson.build | 11 +----------
|
|
||||||
src/luks/tests/tests-common-functions.in | 19 +++++++++++--------
|
|
||||||
src/pins/tang/meson.build | 11 +----------
|
|
||||||
src/pins/tang/pin-tang | 11 ++++++++---
|
|
||||||
4 files changed, 21 insertions(+), 31 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/src/luks/tests/meson.build b/src/luks/tests/meson.build
|
|
||||||
index ba5f6a2..c0f9dc3 100644
|
|
||||||
--- a/src/luks/tests/meson.build
|
|
||||||
+++ b/src/luks/tests/meson.build
|
|
||||||
@@ -17,14 +17,6 @@ kgen = find_program(
|
|
||||||
join_paths('/', 'usr', get_option('libexecdir'), 'tangd-keygen'),
|
|
||||||
required: false
|
|
||||||
)
|
|
||||||
-updt = find_program(
|
|
||||||
- join_paths(libexecdir, 'tangd-update'),
|
|
||||||
- join_paths(get_option('prefix'), get_option('libdir'), 'tangd-update'),
|
|
||||||
- join_paths(get_option('prefix'), get_option('libexecdir'), 'tangd-update'),
|
|
||||||
- join_paths('/', 'usr', get_option('libdir'), 'tangd-update'),
|
|
||||||
- join_paths('/', 'usr', get_option('libexecdir'), 'tangd-update'),
|
|
||||||
- required: false
|
|
||||||
-)
|
|
||||||
tang = find_program(
|
|
||||||
join_paths(libexecdir, 'tangd'),
|
|
||||||
join_paths(get_option('prefix'), get_option('libdir'), 'tangd'),
|
|
||||||
@@ -58,11 +50,10 @@ env.prepend('PATH',
|
|
||||||
)
|
|
||||||
|
|
||||||
has_tang = false
|
|
||||||
-if actv.found() and kgen.found() and updt.found() and tang.found()
|
|
||||||
+if actv.found() and kgen.found() and tang.found()
|
|
||||||
has_tang = true
|
|
||||||
env.set('SD_ACTIVATE', actv.path())
|
|
||||||
env.set('TANGD_KEYGEN', kgen.path())
|
|
||||||
- env.set('TANGD_UPDATE', updt.path())
|
|
||||||
env.set('TANGD', tang.path())
|
|
||||||
endif
|
|
||||||
|
|
||||||
diff --git a/src/luks/tests/tests-common-functions.in b/src/luks/tests/tests-common-functions.in
|
|
||||||
index 8520715..318d007 100755
|
|
||||||
--- a/src/luks/tests/tests-common-functions.in
|
|
||||||
+++ b/src/luks/tests/tests-common-functions.in
|
|
||||||
@@ -251,18 +251,19 @@ tang_remove_rotated_keys() {
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
- [ -z "${TANGD_UPDATE}" ] && skip_test "WARNING: TANGD_UPDATE is not defined."
|
|
||||||
-
|
|
||||||
local db="${basedir}/db"
|
|
||||||
- local cache="${basedir}/cache"
|
|
||||||
mkdir -p "${db}"
|
|
||||||
- mkdir -p "${cache}"
|
|
||||||
+
|
|
||||||
+ if [ -n "${TANGD_UPDATE}" ]; then
|
|
||||||
+ local cache="${basedir}/cache"
|
|
||||||
+ mkdir -p "${cache}"
|
|
||||||
+ fi
|
|
||||||
|
|
||||||
pushd "${db}"
|
|
||||||
find . -name ".*.jwk" -exec rm -f {} \;
|
|
||||||
popd
|
|
||||||
|
|
||||||
- "${TANGD_UPDATE}" "${db}" "${cache}"
|
|
||||||
+ [ -n "${TANGD_UPDATE}" ] && "${TANGD_UPDATE}" "${db}" "${cache}"
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -277,12 +278,12 @@ tang_new_keys() {
|
|
||||||
fi
|
|
||||||
|
|
||||||
[ -z "${TANGD_KEYGEN}" ] && skip_test "WARNING: TANGD_KEYGEN is not defined."
|
|
||||||
- [ -z "${TANGD_UPDATE}" ] && skip_test "WARNING: TANGD_UPDATE is not defined."
|
|
||||||
|
|
||||||
local db="${basedir}/db"
|
|
||||||
- local cache="${basedir}/cache"
|
|
||||||
mkdir -p "${db}"
|
|
||||||
|
|
||||||
+ [ -n "${TANGD_UPDATE}" ] && local cache="${basedir}/cache"
|
|
||||||
+
|
|
||||||
if [ -n "${rotate}" ]; then
|
|
||||||
pushd "${db}"
|
|
||||||
local k
|
|
||||||
@@ -296,7 +297,7 @@ tang_new_keys() {
|
|
||||||
fi
|
|
||||||
|
|
||||||
"${TANGD_KEYGEN}" "${db}"
|
|
||||||
- "${TANGD_UPDATE}" "${db}" "${cache}"
|
|
||||||
+ [ -n "${TANGD_UPDATE}" ] && "${TANGD_UPDATE}" "${db}" "${cache}"
|
|
||||||
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
@@ -322,6 +323,8 @@ tang_run() {
|
|
||||||
fi
|
|
||||||
|
|
||||||
local KEYS="${basedir}/cache"
|
|
||||||
+ [ -z "${TANGD_UPDATE}" ] && KEYS="${basedir}/db"
|
|
||||||
+
|
|
||||||
local inetd='--inetd'
|
|
||||||
[ "${SD_ACTIVATE##*/}" = "systemd-activate" ] && inetd=
|
|
||||||
|
|
||||||
diff --git a/src/pins/tang/meson.build b/src/pins/tang/meson.build
|
|
||||||
index f7d8226..ebcdd4a 100644
|
|
||||||
--- a/src/pins/tang/meson.build
|
|
||||||
+++ b/src/pins/tang/meson.build
|
|
||||||
@@ -12,14 +12,6 @@ kgen = find_program(
|
|
||||||
join_paths('/', 'usr', get_option('libexecdir'), 'tangd-keygen'),
|
|
||||||
required: false
|
|
||||||
)
|
|
||||||
-updt = find_program(
|
|
||||||
- join_paths(libexecdir, 'tangd-update'),
|
|
||||||
- join_paths(get_option('prefix'), get_option('libdir'), 'tangd-update'),
|
|
||||||
- join_paths(get_option('prefix'), get_option('libexecdir'), 'tangd-update'),
|
|
||||||
- join_paths('/', 'usr', get_option('libdir'), 'tangd-update'),
|
|
||||||
- join_paths('/', 'usr', get_option('libexecdir'), 'tangd-update'),
|
|
||||||
- required: false
|
|
||||||
-)
|
|
||||||
tang = find_program(
|
|
||||||
join_paths(libexecdir, 'tangd'),
|
|
||||||
join_paths(get_option('prefix'), get_option('libdir'), 'tangd'),
|
|
||||||
@@ -35,11 +27,10 @@ if curl.found()
|
|
||||||
bins += join_paths(meson.current_source_dir(), 'clevis-encrypt-tang')
|
|
||||||
mans += join_paths(meson.current_source_dir(), 'clevis-encrypt-tang.1')
|
|
||||||
|
|
||||||
- if actv.found() and kgen.found() and updt.found() and tang.found()
|
|
||||||
+ if actv.found() and kgen.found() and tang.found()
|
|
||||||
env = environment()
|
|
||||||
env.set('SD_ACTIVATE', actv.path())
|
|
||||||
env.set('TANGD_KEYGEN', kgen.path())
|
|
||||||
- env.set('TANGD_UPDATE', updt.path())
|
|
||||||
env.set('TANGD', tang.path())
|
|
||||||
env.prepend('PATH',
|
|
||||||
join_paths(meson.source_root(), 'src'),
|
|
||||||
diff --git a/src/pins/tang/pin-tang b/src/pins/tang/pin-tang
|
|
||||||
index 98e5e4d..a63d0a2 100755
|
|
||||||
--- a/src/pins/tang/pin-tang
|
|
||||||
+++ b/src/pins/tang/pin-tang
|
|
||||||
@@ -31,8 +31,12 @@ mkdir -p "$TMP"/db
|
|
||||||
mkdir -p "$TMP"/cache
|
|
||||||
|
|
||||||
# Generate the server keys
|
|
||||||
+KEYS="$TMP"/db
|
|
||||||
"${TANGD_KEYGEN}" "$TMP"/db sig exc
|
|
||||||
-"${TANGD_UPDATE}" "$TMP"/db "$TMP"/cache
|
|
||||||
+if which tangd-update; then
|
|
||||||
+ tangd-update "$TMP"/db "$TMP"/cache
|
|
||||||
+ KEYS="$TMP"/cache
|
|
||||||
+fi
|
|
||||||
|
|
||||||
# Start the server
|
|
||||||
port="$(shuf -i 1024-65536 -n 1)"
|
|
||||||
@@ -40,13 +44,14 @@ port="$(shuf -i 1024-65536 -n 1)"
|
|
||||||
inetd='--inetd'
|
|
||||||
[ "${SD_ACTIVATE##*/}" = "systemd-activate" ] && inetd=
|
|
||||||
|
|
||||||
-"$SD_ACTIVATE" $inetd -l 127.0.0.1:"$port" -a "$TANGD" "$TMP"/cache &
|
|
||||||
+"$SD_ACTIVATE" $inetd -l 127.0.0.1:"$port" -a "$TANGD" "$KEYS" &
|
|
||||||
PID=$!
|
|
||||||
sleep 0.25
|
|
||||||
|
|
||||||
thp="$(jose jwk thp -i "$TMP/db/sig.jwk")"
|
|
||||||
-adv="$TMP/cache/default.jws"
|
|
||||||
url="http://localhost:${port}"
|
|
||||||
+adv="$TMP/adv"
|
|
||||||
+curl "$url/adv" -o "$adv"
|
|
||||||
|
|
||||||
cfg="$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv")"
|
|
||||||
enc="$(echo -n "hi" | clevis encrypt tang "$cfg")"
|
|
||||||
--
|
|
||||||
2.18.4
|
|
||||||
|
|
||||||
@ -0,0 +1,47 @@
|
|||||||
|
From 95f25c355fc13727410ccacaa618caf6af5d5eba Mon Sep 17 00:00:00 2001
|
||||||
|
From: Sergio Correia <scorreia@redhat.com>
|
||||||
|
Date: Mon, 3 May 2021 22:36:36 -0300
|
||||||
|
Subject: [PATCH] sss: use BN_set_word(x, 0) instead of BN_zero()
|
||||||
|
|
||||||
|
Different OpenSSL versions define BN_zero() differently -- sometimes
|
||||||
|
returning an integer, sometimes as void --, so let's use instead
|
||||||
|
BN_set_word() instead, not to have issues when building with these
|
||||||
|
different versions.
|
||||||
|
---
|
||||||
|
src/pins/sss/sss.c | 6 +++---
|
||||||
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/pins/sss/sss.c b/src/pins/sss/sss.c
|
||||||
|
index a37215d..7486d6c 100644
|
||||||
|
--- a/src/pins/sss/sss.c
|
||||||
|
+++ b/src/pins/sss/sss.c
|
||||||
|
@@ -214,7 +214,7 @@ sss_point(const json_t *sss, size_t *len)
|
||||||
|
if (BN_rand_range(xx, pp) <= 0)
|
||||||
|
return NULL;
|
||||||
|
|
||||||
|
- if (BN_zero(yy) <= 0)
|
||||||
|
+ if (BN_set_word(yy, 0) <= 0)
|
||||||
|
return NULL;
|
||||||
|
|
||||||
|
for (size_t i = 0; i < json_array_size(e); i++) {
|
||||||
|
@@ -272,7 +272,7 @@ sss_recover(const json_t *p, size_t npnts, const uint8_t *pnts[])
|
||||||
|
if (!ctx || !pp || !acc || !tmp || !k)
|
||||||
|
return NULL;
|
||||||
|
|
||||||
|
- if (BN_zero(k) <= 0)
|
||||||
|
+ if (BN_set_word(k, 0) <= 0)
|
||||||
|
return NULL;
|
||||||
|
|
||||||
|
len = jose_b64_dec(p, NULL, 0);
|
||||||
|
@@ -303,7 +303,7 @@ sss_recover(const json_t *p, size_t npnts, const uint8_t *pnts[])
|
||||||
|
|
||||||
|
/* acc *= (0 - xi) / (xo - xi) */
|
||||||
|
|
||||||
|
- if (BN_zero(tmp) <= 0)
|
||||||
|
+ if (BN_set_word(tmp, 0) <= 0)
|
||||||
|
return NULL;
|
||||||
|
|
||||||
|
if (BN_mod_sub(tmp, tmp, xi, pp, ctx) <= 0)
|
||||||
|
--
|
||||||
|
2.31.1
|
||||||
|
|
||||||
@ -1,309 +0,0 @@
|
|||||||
From aa52396c35e76aabd085a819b08167d559042a20 Mon Sep 17 00:00:00 2001
|
|
||||||
From: rpm-build <rpm-build>
|
|
||||||
Date: Tue, 3 Nov 2020 08:42:48 -0300
|
|
||||||
Subject: [PATCH 2/2] Add the option to extract luks passphrase used for
|
|
||||||
binding
|
|
||||||
|
|
||||||
Usage:
|
|
||||||
|
|
||||||
clevis luks pass -d /dev/sda1 -s 1
|
|
||||||
<passphrase here>
|
|
||||||
---
|
|
||||||
src/luks/clevis-luks-pass | 64 ++++++++++++++++++++++++++++++++
|
|
||||||
src/luks/clevis-luks-pass.1.adoc | 43 +++++++++++++++++++++
|
|
||||||
src/luks/meson.build | 3 ++
|
|
||||||
src/luks/tests/meson.build | 2 +
|
|
||||||
src/luks/tests/pass-tang-luks1 | 59 +++++++++++++++++++++++++++++
|
|
||||||
src/luks/tests/pass-tang-luks2 | 59 +++++++++++++++++++++++++++++
|
|
||||||
6 files changed, 230 insertions(+)
|
|
||||||
create mode 100755 src/luks/clevis-luks-pass
|
|
||||||
create mode 100644 src/luks/clevis-luks-pass.1.adoc
|
|
||||||
create mode 100755 src/luks/tests/pass-tang-luks1
|
|
||||||
create mode 100755 src/luks/tests/pass-tang-luks2
|
|
||||||
|
|
||||||
diff --git a/src/luks/clevis-luks-pass b/src/luks/clevis-luks-pass
|
|
||||||
new file mode 100755
|
|
||||||
index 0000000..1f59b39
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/src/luks/clevis-luks-pass
|
|
||||||
@@ -0,0 +1,64 @@
|
|
||||||
+#!/bin/bash -e
|
|
||||||
+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
||||||
+#
|
|
||||||
+# Copyright (c) 2019 Red Hat, Inc.
|
|
||||||
+# Author: Sergio Correia <scorreia@redhat.com> - LUKS2 support.
|
|
||||||
+#
|
|
||||||
+# This program is free software: you can redistribute it and/or modify
|
|
||||||
+# it under the terms of the GNU General Public License as published by
|
|
||||||
+# the Free Software Foundation, either version 3 of the License, or
|
|
||||||
+# (at your option) any later version.
|
|
||||||
+#
|
|
||||||
+# This program is distributed in the hope that it will be useful,
|
|
||||||
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
+# GNU General Public License for more details.
|
|
||||||
+#
|
|
||||||
+# You should have received a copy of the GNU General Public License
|
|
||||||
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
+#
|
|
||||||
+
|
|
||||||
+. clevis-luks-common-functions
|
|
||||||
+
|
|
||||||
+SUMMARY="Returns the LUKS passphrase used for binding a particular slot."
|
|
||||||
+
|
|
||||||
+usage() {
|
|
||||||
+ exec >&2
|
|
||||||
+ echo "Usage: clevis luks pass -d DEV -s SLT"
|
|
||||||
+ echo
|
|
||||||
+ echo "$SUMMARY"
|
|
||||||
+ echo
|
|
||||||
+ echo " -d DEV The LUKS device to extract the LUKS passphrase used for binding"
|
|
||||||
+ echo
|
|
||||||
+ echo " -s SLOT The slot number to extract the LUKS passphrase"
|
|
||||||
+ echo
|
|
||||||
+ exit 1
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+if [ ${#} -eq 1 ] && [ "${1}" = "--summary" ]; then
|
|
||||||
+ echo "${SUMMARY}"
|
|
||||||
+ exit 0
|
|
||||||
+fi
|
|
||||||
+
|
|
||||||
+while getopts ":d:s:" o; do
|
|
||||||
+ case "$o" in
|
|
||||||
+ d) DEV=${OPTARG};;
|
|
||||||
+ s) SLT=${OPTARG};;
|
|
||||||
+ *) usage;;
|
|
||||||
+ esac
|
|
||||||
+done
|
|
||||||
+
|
|
||||||
+if [ -z "${DEV}" ]; then
|
|
||||||
+ echo "Did not specify a device!" >&2
|
|
||||||
+ usage
|
|
||||||
+fi
|
|
||||||
+
|
|
||||||
+if [ -z "${SLT}" ]; then
|
|
||||||
+ echo "Did not specify a slot!" >&2
|
|
||||||
+ usage
|
|
||||||
+fi
|
|
||||||
+
|
|
||||||
+if ! clevis_luks_unlock_device_by_slot "${DEV}" "${SLT}"; then
|
|
||||||
+ echo "It was not possible to decrypt the passphrase associated to slot ${SLT} in ${DEV}!" >&2
|
|
||||||
+ exit 1
|
|
||||||
+fi
|
|
||||||
diff --git a/src/luks/clevis-luks-pass.1.adoc b/src/luks/clevis-luks-pass.1.adoc
|
|
||||||
new file mode 100644
|
|
||||||
index 0000000..fa9526a
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/src/luks/clevis-luks-pass.1.adoc
|
|
||||||
@@ -0,0 +1,43 @@
|
|
||||||
+CLEVIS-LUKS-PASS(1)
|
|
||||||
+===================
|
|
||||||
+:doctype: manpage
|
|
||||||
+
|
|
||||||
+
|
|
||||||
+== NAME
|
|
||||||
+
|
|
||||||
+clevis-luks-pass - Extracts the passphrase used for binding a particular slot in a LUKS device
|
|
||||||
+
|
|
||||||
+== SYNOPSIS
|
|
||||||
+
|
|
||||||
+*clevis luks pass* -d DEV -s SLT
|
|
||||||
+
|
|
||||||
+== OVERVIEW
|
|
||||||
+
|
|
||||||
+The *clevis luks pass* command extracts the passphrase used for binding a particular slot in a LUKS device.
|
|
||||||
+For example:
|
|
||||||
+
|
|
||||||
+ clevis luks pass -d /dev/sda1 -s 1
|
|
||||||
+
|
|
||||||
+== OPTIONS
|
|
||||||
+
|
|
||||||
+* *-d* _DEV_ :
|
|
||||||
+ The LUKS device on which to extract a passphrase from
|
|
||||||
+
|
|
||||||
+* *-s* _SLT_ :
|
|
||||||
+ The slot to use for extracting the passphrase
|
|
||||||
+
|
|
||||||
+== EXAMPLE
|
|
||||||
+
|
|
||||||
+ clevis luks pass -d /dev/sda1 -s 1
|
|
||||||
+ <passphrase here>
|
|
||||||
+
|
|
||||||
+Note that the output of *clevis luks pass* might be non-printable, in which case it would be better to redirect its output to a file and use it as a key
|
|
||||||
+file together with cryptsetup. For instance:
|
|
||||||
+
|
|
||||||
+ clevis luks pass -d /dev/sda1 -s 1 > slot1-passphrase
|
|
||||||
+
|
|
||||||
+And the file slot1-passphrase will contain the passphrase associated with slot #1 in /dev/sda1.
|
|
||||||
+
|
|
||||||
+== SEE ALSO
|
|
||||||
+
|
|
||||||
+link:clevis-luks-unlock.1.adoc[*clevis-luks-unlock*(1)],
|
|
||||||
diff --git a/src/luks/meson.build b/src/luks/meson.build
|
|
||||||
index 12f5a0d..008736e 100644
|
|
||||||
--- a/src/luks/meson.build
|
|
||||||
+++ b/src/luks/meson.build
|
|
||||||
@@ -50,6 +50,9 @@ if libcryptsetup.found() and luksmeta.found() and pwmake.found()
|
|
||||||
|
|
||||||
bins += join_paths(meson.current_source_dir(), 'clevis-luks-edit')
|
|
||||||
mans += join_paths(meson.current_source_dir(), 'clevis-luks-edit.1')
|
|
||||||
+
|
|
||||||
+ bins += join_paths(meson.current_source_dir(), 'clevis-luks-pass')
|
|
||||||
+ mans += join_paths(meson.current_source_dir(), 'clevis-luks-pass.1')
|
|
||||||
else
|
|
||||||
warning('Will not install LUKS support due to missing dependencies!')
|
|
||||||
endif
|
|
||||||
diff --git a/src/luks/tests/meson.build b/src/luks/tests/meson.build
|
|
||||||
index c22a069..f4584aa 100644
|
|
||||||
--- a/src/luks/tests/meson.build
|
|
||||||
+++ b/src/luks/tests/meson.build
|
|
||||||
@@ -84,6 +84,7 @@ if has_tang
|
|
||||||
test('report-tang-luks1', find_program('report-tang-luks1'), env: env, timeout: 90)
|
|
||||||
test('report-sss-luks1', find_program('report-sss-luks1'), env: env, timeout: 90)
|
|
||||||
test('edit-tang-luks1', find_program('edit-tang-luks1'), env: env, timeout: 150)
|
|
||||||
+ test('pass-tang-luks1', find_program('pass-tang-luks1'), env: env, timeout: 60)
|
|
||||||
endif
|
|
||||||
|
|
||||||
test('backup-restore-luks1', find_program('backup-restore-luks1'), env: env, timeout: 60)
|
|
||||||
@@ -111,6 +112,7 @@ if luksmeta_data.get('OLD_CRYPTSETUP') == '0'
|
|
||||||
test('report-tang-luks2', find_program('report-tang-luks2'), env: env, timeout: 120)
|
|
||||||
test('report-sss-luks2', find_program('report-sss-luks2'), env: env, timeout: 120)
|
|
||||||
test('edit-tang-luks2', find_program('edit-tang-luks2'), env: env, timeout: 210)
|
|
||||||
+ test('pass-tang-luks2', find_program('pass-tang-luks2'), env: env, timeout: 60)
|
|
||||||
endif
|
|
||||||
|
|
||||||
test('backup-restore-luks2', find_program('backup-restore-luks2'), env: env, timeout: 120)
|
|
||||||
diff --git a/src/luks/tests/pass-tang-luks1 b/src/luks/tests/pass-tang-luks1
|
|
||||||
new file mode 100755
|
|
||||||
index 0000000..0d91e6c
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/src/luks/tests/pass-tang-luks1
|
|
||||||
@@ -0,0 +1,59 @@
|
|
||||||
+#!/bin/bash -x
|
|
||||||
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
||||||
+#
|
|
||||||
+# Copyright (c) 2019 Red Hat, Inc.
|
|
||||||
+# Author: Sergio Correia <scorreia@redhat.com>
|
|
||||||
+#
|
|
||||||
+# This program is free software: you can redistribute it and/or modify
|
|
||||||
+# it under the terms of the GNU General Public License as published by
|
|
||||||
+# the Free Software Foundation, either version 3 of the License, or
|
|
||||||
+# (at your option) any later version.
|
|
||||||
+#
|
|
||||||
+# This program is distributed in the hope that it will be useful,
|
|
||||||
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
+# GNU General Public License for more details.
|
|
||||||
+#
|
|
||||||
+# You should have received a copy of the GNU General Public License
|
|
||||||
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
+#
|
|
||||||
+
|
|
||||||
+TEST="${0}"
|
|
||||||
+. tests-common-functions
|
|
||||||
+. clevis-luks-common-functions
|
|
||||||
+
|
|
||||||
+function on_exit() {
|
|
||||||
+ [ ! -d "${TMP}" ] && return 0
|
|
||||||
+ tang_stop "${TMP}"
|
|
||||||
+ rm -rf "${TMP}"
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+trap 'on_exit' EXIT
|
|
||||||
+
|
|
||||||
+TMP=$(mktemp -d)
|
|
||||||
+
|
|
||||||
+port=$(get_random_port)
|
|
||||||
+tang_run "${TMP}" "${port}" &
|
|
||||||
+tang_wait_until_ready "${port}"
|
|
||||||
+
|
|
||||||
+url="http://localhost:${port}"
|
|
||||||
+adv="${TMP}/adv"
|
|
||||||
+tang_get_adv "${port}" "${adv}"
|
|
||||||
+
|
|
||||||
+cfg=$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv")
|
|
||||||
+
|
|
||||||
+# LUKS1.
|
|
||||||
+DEV="${TMP}/luks1-device"
|
|
||||||
+new_device "luks1" "${DEV}"
|
|
||||||
+
|
|
||||||
+if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
|
|
||||||
+ error "${TEST}: Bind should have succeeded."
|
|
||||||
+fi
|
|
||||||
+
|
|
||||||
+# Now let's test the passphrase.
|
|
||||||
+SLT=1
|
|
||||||
+PASS=$(clevis luks pass -d "${DEV}" -s "${SLT}")
|
|
||||||
+echo $PASS >&2
|
|
||||||
+if ! clevis_luks_check_valid_key_or_keyfile "${DEV}" "${PASS}" "" "${SLT}"; then
|
|
||||||
+ error "Passphrase obtained from clevis luks pass failed."
|
|
||||||
+fi
|
|
||||||
diff --git a/src/luks/tests/pass-tang-luks2 b/src/luks/tests/pass-tang-luks2
|
|
||||||
new file mode 100755
|
|
||||||
index 0000000..2d50413
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/src/luks/tests/pass-tang-luks2
|
|
||||||
@@ -0,0 +1,59 @@
|
|
||||||
+#!/bin/bash -x
|
|
||||||
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
||||||
+#
|
|
||||||
+# Copyright (c) 2019 Red Hat, Inc.
|
|
||||||
+# Author: Sergio Correia <scorreia@redhat.com>
|
|
||||||
+#
|
|
||||||
+# This program is free software: you can redistribute it and/or modify
|
|
||||||
+# it under the terms of the GNU General Public License as published by
|
|
||||||
+# the Free Software Foundation, either version 3 of the License, or
|
|
||||||
+# (at your option) any later version.
|
|
||||||
+#
|
|
||||||
+# This program is distributed in the hope that it will be useful,
|
|
||||||
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
+# GNU General Public License for more details.
|
|
||||||
+#
|
|
||||||
+# You should have received a copy of the GNU General Public License
|
|
||||||
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
+#
|
|
||||||
+
|
|
||||||
+TEST="${0}"
|
|
||||||
+. tests-common-functions
|
|
||||||
+. clevis-luks-common-functions
|
|
||||||
+
|
|
||||||
+function on_exit() {
|
|
||||||
+ [ ! -d "${TMP}" ] && return 0
|
|
||||||
+ tang_stop "${TMP}"
|
|
||||||
+ rm -rf "${TMP}"
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+trap 'on_exit' EXIT
|
|
||||||
+
|
|
||||||
+TMP=$(mktemp -d)
|
|
||||||
+
|
|
||||||
+port=$(get_random_port)
|
|
||||||
+tang_run "${TMP}" "${port}" &
|
|
||||||
+tang_wait_until_ready "${port}"
|
|
||||||
+
|
|
||||||
+url="http://localhost:${port}"
|
|
||||||
+adv="${TMP}/adv"
|
|
||||||
+tang_get_adv "${port}" "${adv}"
|
|
||||||
+
|
|
||||||
+cfg=$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv")
|
|
||||||
+
|
|
||||||
+# LUKS2.
|
|
||||||
+DEV="${TMP}/luks2-device"
|
|
||||||
+new_device "luks2" "${DEV}"
|
|
||||||
+
|
|
||||||
+if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
|
|
||||||
+ error "${TEST}: Bind should have succeeded."
|
|
||||||
+fi
|
|
||||||
+
|
|
||||||
+# Now let's test the passphrase.
|
|
||||||
+SLT=1
|
|
||||||
+PASS=$(clevis luks pass -d "${DEV}" -s "${SLT}")
|
|
||||||
+echo $PASS >&2
|
|
||||||
+if ! clevis_luks_check_valid_key_or_keyfile "${DEV}" "${PASS}" "" "${SLT}"; then
|
|
||||||
+ error "Passphrase obtained from clevis luks pass failed."
|
|
||||||
+fi
|
|
||||||
--
|
|
||||||
2.29.2
|
|
||||||
|
|
||||||
@ -0,0 +1,49 @@
|
|||||||
|
From 76ad9b21b61627a728bc9499821cf8e09446725d Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
|
||||||
|
Date: Thu, 21 Oct 2021 13:58:52 +0200
|
||||||
|
Subject: [PATCH 4/4] luks: explicitly specify pbkdf iterations to cryptsetup
|
||||||
|
|
||||||
|
This fixes an Out of memory error when the system has not much memory,
|
||||||
|
such as a VM configured with 2GB currently being installed through the
|
||||||
|
network (hence having ~1GB free memory only).
|
||||||
|
See RHBZ #1979256 (https://bugzilla.redhat.com/show_bug.cgi?id=1979256).
|
||||||
|
---
|
||||||
|
src/luks/clevis-luks-common-functions.in | 7 ++++++-
|
||||||
|
1 file changed, 6 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/src/luks/clevis-luks-common-functions.in b/src/luks/clevis-luks-common-functions.in
|
||||||
|
index d53d2ab..360eb7e 100644
|
||||||
|
--- a/src/luks/clevis-luks-common-functions.in
|
||||||
|
+++ b/src/luks/clevis-luks-common-functions.in
|
||||||
|
@@ -760,10 +760,12 @@ clevis_luks_add_key() {
|
||||||
|
extra_args="$(printf -- '--key-file %s' "${KEYFILE}")"
|
||||||
|
input="$(printf '%s' "${NEWKEY}")"
|
||||||
|
fi
|
||||||
|
+ local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
||||||
|
|
||||||
|
printf '%s' "${input}" | cryptsetup luksAddKey --batch-mode \
|
||||||
|
--key-slot "${SLT}" \
|
||||||
|
"${DEV}" \
|
||||||
|
+ ${pbkdf_args} \
|
||||||
|
${extra_args}
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -792,11 +794,14 @@ clevis_luks_update_key() {
|
||||||
|
extra_args="$(printf -- '--key-file %s' "${KEYFILE}")"
|
||||||
|
input="$(printf '%s' "${NEWKEY}")"
|
||||||
|
fi
|
||||||
|
+ local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
||||||
|
|
||||||
|
if [ -n "${in_place}" ]; then
|
||||||
|
printf '%s' "${input}" | cryptsetup luksChangeKey "${DEV}" \
|
||||||
|
--key-slot "${SLT}" \
|
||||||
|
- --batch-mode ${extra_args}
|
||||||
|
+ --batch-mode \
|
||||||
|
+ ${pbkdf_args} \
|
||||||
|
+ ${extra_args}
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
--
|
||||||
|
2.33.1
|
||||||
|
|
||||||
@ -1,101 +0,0 @@
|
|||||||
From 8f0fcf2e7384ad757042e7e6a0850f655eb70b7e Mon Sep 17 00:00:00 2001
|
|
||||||
From: Sergio Correia <scorreia@redhat.com>
|
|
||||||
Date: Thu, 18 Nov 2021 16:45:58 -0300
|
|
||||||
Subject: [PATCH 4/4] systemd: drop ncat dependency
|
|
||||||
|
|
||||||
When using systemd, i.e., clevis-luks-askpass, we use ncat to send
|
|
||||||
the decrypted password to the systemd socket as per systemd's password
|
|
||||||
agents specification [1].
|
|
||||||
|
|
||||||
However, systemd itself has a utility that does exactly that,
|
|
||||||
systemd-reply-password.
|
|
||||||
|
|
||||||
In this commit we drop the ncat dependency and instead use
|
|
||||||
systemd-reply-password in clevis-luks-askpass.
|
|
||||||
|
|
||||||
[1] https://systemd.io/PASSWORD_AGENTS/
|
|
||||||
---
|
|
||||||
...is-luks-askpass => clevis-luks-askpass.in} | 2 +-
|
|
||||||
.../systemd/dracut/clevis/module-setup.sh.in | 4 ++--
|
|
||||||
src/luks/systemd/meson.build | 19 +++++++++++++++++--
|
|
||||||
3 files changed, 20 insertions(+), 5 deletions(-)
|
|
||||||
rename src/luks/systemd/{clevis-luks-askpass => clevis-luks-askpass.in} (97%)
|
|
||||||
|
|
||||||
diff --git a/src/luks/systemd/clevis-luks-askpass b/src/luks/systemd/clevis-luks-askpass.in
|
|
||||||
similarity index 97%
|
|
||||||
rename from src/luks/systemd/clevis-luks-askpass
|
|
||||||
rename to src/luks/systemd/clevis-luks-askpass.in
|
|
||||||
index f19671f..a6699c9 100755
|
|
||||||
--- a/src/luks/systemd/clevis-luks-askpass
|
|
||||||
+++ b/src/luks/systemd/clevis-luks-askpass.in
|
|
||||||
@@ -58,7 +58,7 @@ while true; do
|
|
||||||
fi
|
|
||||||
|
|
||||||
uuid="$(cryptsetup luksUUID "${d}")"
|
|
||||||
- if ! printf '+%s' "${pt}" | ncat -U -u --send-only "${s}"; then
|
|
||||||
+ if ! printf '%s' "${pt}" | @SYSTEMD_REPLY_PASS@ 1 "${s}"; then
|
|
||||||
echo "Unable to unlock ${d} (UUID=${uuid}) with recovered passphrase" >&2
|
|
||||||
continue
|
|
||||||
fi
|
|
||||||
diff --git a/src/luks/systemd/dracut/clevis/module-setup.sh.in b/src/luks/systemd/dracut/clevis/module-setup.sh.in
|
|
||||||
index ebf969f..d46c6e2 100755
|
|
||||||
--- a/src/luks/systemd/dracut/clevis/module-setup.sh.in
|
|
||||||
+++ b/src/luks/systemd/dracut/clevis/module-setup.sh.in
|
|
||||||
@@ -36,6 +36,7 @@ install() {
|
|
||||||
|
|
||||||
inst_multiple \
|
|
||||||
/etc/services \
|
|
||||||
+ @SYSTEMD_REPLY_PASS@ \
|
|
||||||
@libexecdir@/clevis-luks-askpass \
|
|
||||||
clevis-luks-common-functions \
|
|
||||||
grep sed cut \
|
|
||||||
@@ -45,8 +46,7 @@ install() {
|
|
||||||
luksmeta \
|
|
||||||
clevis \
|
|
||||||
mktemp \
|
|
||||||
- jose \
|
|
||||||
- ncat
|
|
||||||
+ jose
|
|
||||||
|
|
||||||
dracut_need_initqueue
|
|
||||||
}
|
|
||||||
diff --git a/src/luks/systemd/meson.build b/src/luks/systemd/meson.build
|
|
||||||
index 369e7f7..e3b3d91 100644
|
|
||||||
--- a/src/luks/systemd/meson.build
|
|
||||||
+++ b/src/luks/systemd/meson.build
|
|
||||||
@@ -1,6 +1,15 @@
|
|
||||||
systemd = dependency('systemd', required: false)
|
|
||||||
|
|
||||||
-if systemd.found()
|
|
||||||
+sd_reply_pass = find_program(
|
|
||||||
+ join_paths(get_option('prefix'), get_option('libdir'), 'systemd', 'systemd-reply-password'),
|
|
||||||
+ join_paths(get_option('prefix'), 'lib', 'systemd', 'systemd-reply-password'),
|
|
||||||
+ join_paths('/', 'usr', get_option('libdir'), 'systemd', 'systemd-reply-password'),
|
|
||||||
+ join_paths('/', 'usr', 'lib', 'systemd', 'systemd-reply-password'),
|
|
||||||
+ required: false
|
|
||||||
+)
|
|
||||||
+
|
|
||||||
+if systemd.found() and sd_reply_pass.found()
|
|
||||||
+ data.set('SYSTEMD_REPLY_PASS', sd_reply_pass.path())
|
|
||||||
subdir('dracut')
|
|
||||||
|
|
||||||
unitdir = systemd.get_pkgconfig_variable('systemdsystemunitdir')
|
|
||||||
@@ -12,8 +21,14 @@ if systemd.found()
|
|
||||||
configuration: data,
|
|
||||||
)
|
|
||||||
|
|
||||||
+ configure_file(
|
|
||||||
+ input: 'clevis-luks-askpass.in',
|
|
||||||
+ output: 'clevis-luks-askpass',
|
|
||||||
+ install_dir: libexecdir,
|
|
||||||
+ configuration: data
|
|
||||||
+ )
|
|
||||||
+
|
|
||||||
install_data('clevis-luks-askpass.path', install_dir: unitdir)
|
|
||||||
- install_data('clevis-luks-askpass', install_dir: libexecdir)
|
|
||||||
else
|
|
||||||
warning('Will not install systemd support due to missing dependencies!')
|
|
||||||
endif
|
|
||||||
--
|
|
||||||
2.33.1
|
|
||||||
|
|
||||||
@ -1,26 +0,0 @@
|
|||||||
From da17589f0706b27690a11484165fd58dea1a5eb1 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Sergio Correia <scorreia@redhat.com>
|
|
||||||
Date: Thu, 25 Nov 2021 19:18:03 -0300
|
|
||||||
Subject: [PATCH 5/5] Stop sending stderr to the void when decryption doesn't
|
|
||||||
happen
|
|
||||||
|
|
||||||
---
|
|
||||||
src/luks/clevis-luks-common-functions | 2 +-
|
|
||||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/src/luks/clevis-luks-common-functions b/src/luks/clevis-luks-common-functions
|
|
||||||
index 879ca4c..df8e16d 100644
|
|
||||||
--- a/src/luks/clevis-luks-common-functions
|
|
||||||
+++ b/src/luks/clevis-luks-common-functions
|
|
||||||
@@ -323,7 +323,7 @@ clevis_luks_unlock_device_by_slot() {
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
- if ! passphrase="$(printf '%s' "${jwe}" | clevis decrypt 2>/dev/null)" \
|
|
||||||
+ if ! passphrase="$(printf '%s' "${jwe}" | clevis decrypt)" \
|
|
||||||
|| [ -z "${passphrase}" ]; then
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
--
|
|
||||||
2.33.1
|
|
||||||
|
|
||||||
@ -1,6 +1,6 @@
|
|||||||
--- clevis-15-ori/src/pins/tang/clevis-decrypt-tang 2020-10-28 19:55:47.673228700 +0100
|
--- clevis-18.ori/src/pins/tang/clevis-decrypt-tang 2021-04-15 13:00:19.969067600 +0200
|
||||||
+++ clevis-15/src/pins/tang/clevis-decrypt-tang 2022-01-21 10:37:40.327825491 +0100
|
+++ clevis-18/src/pins/tang/clevis-decrypt-tang 2022-01-20 17:29:21.859897964 +0100
|
||||||
@@ -73,10 +73,10 @@
|
@@ -99,10 +99,10 @@
|
||||||
|
|
||||||
xfr="$(jose jwk exc -i '{"alg":"ECMR"}' -l- -r- <<< "$clt$eph")"
|
xfr="$(jose jwk exc -i '{"alg":"ECMR"}' -l- -r- <<< "$clt$eph")"
|
||||||
|
|
||||||
@ -1,14 +1,15 @@
|
|||||||
--- clevis-15.ori/src/clevis 2020-10-28 19:55:47.663228800 +0100
|
--- clevis-18.ori/src/clevis 2021-04-15 13:00:19.965065700 +0200
|
||||||
+++ clevis-15/src/clevis 2022-06-22 11:06:27.061230653 +0200
|
+++ clevis-18/src/clevis 2022-06-20 14:29:50.148261656 +0200
|
||||||
@@ -27,6 +27,7 @@
|
@@ -27,6 +27,8 @@
|
||||||
}
|
}
|
||||||
|
|
||||||
cmd=clevis
|
cmd=clevis
|
||||||
+input_commands="$cmd $@"
|
+input_commands="$cmd $@"
|
||||||
|
+
|
||||||
while [ $# -gt 0 ]; do
|
while [ $# -gt 0 ]; do
|
||||||
[[ "$1" =~ ^- ]] && break
|
[[ "$1" =~ ^- ]] && break
|
||||||
cmd="$cmd-$1"
|
cmd="$cmd-$1"
|
||||||
@@ -36,8 +37,11 @@
|
@@ -36,8 +38,11 @@
|
||||||
done
|
done
|
||||||
|
|
||||||
exec >&2
|
exec >&2
|
||||||
@ -1,83 +0,0 @@
|
|||||||
From ea5db9fdfaa92d2a3ec2446313dcaa00db57a0cc Mon Sep 17 00:00:00 2001
|
|
||||||
From: Renaud Metrich <rmetrich@redhat.com>
|
|
||||||
Date: Fri, 7 Jan 2022 12:13:03 -0300
|
|
||||||
Subject: [PATCH 7/7] luks: explicitly specify pbkdf iterations to cryptsetup
|
|
||||||
|
|
||||||
This fixes an Out of memory error when the system has not much memory,
|
|
||||||
such as a VM configured with 2GB currently being installed through the
|
|
||||||
network (hence having ~1GB free memory only).
|
|
||||||
See RHBZ #1979256 (https://bugzilla.redhat.com/show_bug.cgi?id=1979256).
|
|
||||||
---
|
|
||||||
src/luks/clevis-luks-bind.in | 7 +++++--
|
|
||||||
src/luks/clevis-luks-common-functions | 7 ++++++-
|
|
||||||
2 files changed, 11 insertions(+), 3 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/src/luks/clevis-luks-bind.in b/src/luks/clevis-luks-bind.in
|
|
||||||
index 4748c08..017f762 100755
|
|
||||||
--- a/src/luks/clevis-luks-bind.in
|
|
||||||
+++ b/src/luks/clevis-luks-bind.in
|
|
||||||
@@ -169,7 +169,9 @@ if ! cryptsetup luksOpen --test-passphrase "${DEV}" \
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
+pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
|
||||||
if [ "$luks_type" == "luks1" ]; then
|
|
||||||
+ pbkdf_args=
|
|
||||||
# In certain circumstances, we may have LUKSMeta slots "not in sync" with
|
|
||||||
# cryptsetup, which means we will try to save LUKSMeta metadata over an
|
|
||||||
# already used or partially used slot -- github issue #70.
|
|
||||||
@@ -184,7 +186,7 @@ fi
|
|
||||||
|
|
||||||
# Add the new key.
|
|
||||||
if [ -n "$SLT" ]; then
|
|
||||||
- cryptsetup luksAddKey --key-slot "$SLT" --key-file \
|
|
||||||
+ cryptsetup luksAddKey ${pbkdf_args} --key-slot "$SLT" --key-file \
|
|
||||||
<(echo -n "$existing_key") "$DEV"
|
|
||||||
else
|
|
||||||
if [ $luks_type == "luks2" ]; then
|
|
||||||
@@ -194,7 +196,8 @@ else
|
|
||||||
readarray -t usedSlotsBeforeAddKey < <(cryptsetup luksDump "${DEV}" \
|
|
||||||
| sed -rn 's|^Key Slot ([0-7]): ENABLED$|\1|p')
|
|
||||||
fi
|
|
||||||
- cryptsetup luksAddKey --key-file <(echo -n "${existing_key}") "$DEV"
|
|
||||||
+ cryptsetup luksAddKey ${pbkdf_args} \
|
|
||||||
+ --key-file <(echo -n "${existing_key}") "$DEV"
|
|
||||||
fi < <(echo -n "${key}")
|
|
||||||
if [ $? -ne 0 ]; then
|
|
||||||
echo "Error while adding new key to LUKS header!" >&2
|
|
||||||
diff --git a/src/luks/clevis-luks-common-functions b/src/luks/clevis-luks-common-functions
|
|
||||||
index 67ece72..038cc37 100644
|
|
||||||
--- a/src/luks/clevis-luks-common-functions
|
|
||||||
+++ b/src/luks/clevis-luks-common-functions
|
|
||||||
@@ -760,10 +760,12 @@ clevis_luks_add_key() {
|
|
||||||
extra_args="$(printf -- '--key-file %s' "${KEYFILE}")"
|
|
||||||
input="$(printf '%s' "${NEWKEY}")"
|
|
||||||
fi
|
|
||||||
+ local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
|
||||||
|
|
||||||
printf '%s' "${input}" | cryptsetup luksAddKey --batch-mode \
|
|
||||||
--key-slot "${SLT}" \
|
|
||||||
"${DEV}" \
|
|
||||||
+ ${pbkdf_args} \
|
|
||||||
${extra_args}
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -792,11 +794,14 @@ clevis_luks_update_key() {
|
|
||||||
extra_args="$(printf -- '--key-file %s' "${KEYFILE}")"
|
|
||||||
input="$(printf '%s' "${NEWKEY}")"
|
|
||||||
fi
|
|
||||||
+ local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
|
||||||
|
|
||||||
if [ -n "${in_place}" ]; then
|
|
||||||
printf '%s' "${input}" | cryptsetup luksChangeKey "${DEV}" \
|
|
||||||
--key-slot "${SLT}" \
|
|
||||||
- --batch-mode ${extra_args}
|
|
||||||
+ --batch-mode \
|
|
||||||
+ ${pbkdf_args} \
|
|
||||||
+ ${extra_args}
|
|
||||||
return
|
|
||||||
fi
|
|
||||||
|
|
||||||
--
|
|
||||||
2.33.1
|
|
||||||
|
|
||||||
@ -0,0 +1,385 @@
|
|||||||
|
--- clevis-18.ori/src/luks/clevis-luks-bind 2021-04-15 13:00:19.965065700 +0200
|
||||||
|
+++ clevis-18/src/luks/clevis-luks-bind 2022-11-24 12:53:59.613676320 +0100
|
||||||
|
@@ -25,7 +25,7 @@
|
||||||
|
usage() {
|
||||||
|
exec >&2
|
||||||
|
echo
|
||||||
|
- echo "Usage: clevis luks bind [-y] [-f] [-s SLT] [-k KEY] [-t TOKEN_ID] -d DEV PIN CFG"
|
||||||
|
+ echo "Usage: clevis luks bind [-y] [-f] [-s SLT] [-k KEY] [-t TOKEN_ID] [-e EXISTING_TOKEN_ID] -d DEV PIN CFG"
|
||||||
|
echo
|
||||||
|
echo "$SUMMARY":
|
||||||
|
echo
|
||||||
|
@@ -42,6 +42,8 @@
|
||||||
|
echo " -k KEY Non-interactively read LUKS password from KEY file"
|
||||||
|
echo " -k - Non-interactively read LUKS password from standard input"
|
||||||
|
echo
|
||||||
|
+ echo " -e E_TKN_ID Existing LUKS token ID for existing passphrase; only available for LUKS2"
|
||||||
|
+ echo
|
||||||
|
exit 2
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -52,13 +54,14 @@
|
||||||
|
|
||||||
|
FRC=
|
||||||
|
YES=
|
||||||
|
-while getopts ":hfyd:s:k:t:" o; do
|
||||||
|
+while getopts ":hfyd:s:k:t:e:" o; do
|
||||||
|
case "$o" in
|
||||||
|
f) FRC='-f';;
|
||||||
|
d) DEV="$OPTARG";;
|
||||||
|
s) SLT="$OPTARG";;
|
||||||
|
k) KEY="$OPTARG";;
|
||||||
|
t) TOKEN_ID="$OPTARG";;
|
||||||
|
+ e) EXISTING_TOKEN_ID="$OPTARG";;
|
||||||
|
y) FRC='-f'
|
||||||
|
YES='-y';;
|
||||||
|
*) usage;;
|
||||||
|
@@ -99,11 +102,20 @@
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
+if [ -n "${EXISTING_TOKEN_ID}" ] && ! clevis_luks_luks2_existing_token_id_supported; then
|
||||||
|
+ echo "Existing token ID not supported in this cryptsetup version" >&2
|
||||||
|
+ exit 1
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
# Get the existing passphrase/keyfile.
|
||||||
|
existing_key=
|
||||||
|
keyfile=
|
||||||
|
case "${KEY}" in
|
||||||
|
-"") IFS= read -r -s -p "Enter existing LUKS password: " existing_key; echo >&2;;
|
||||||
|
+ "")
|
||||||
|
+ if [ -z "${EXISTING_TOKEN_ID}" ] ; then
|
||||||
|
+ IFS= read -r -s -p "Enter existing LUKS password: " existing_key; echo >&2
|
||||||
|
+ fi
|
||||||
|
+ ;;
|
||||||
|
-) IFS= read -r -s -p "" existing_key ||:
|
||||||
|
if [ "${luks_type}" = "luks1" ] && ! luksmeta test -d "${DEV}" \
|
||||||
|
&& [ -z "${FRC}" ]; then
|
||||||
|
@@ -119,6 +131,13 @@
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
+# Check if existing token id for keyring read is provided
|
||||||
|
+# If so, keyfile is not allowed
|
||||||
|
+if [ -n "${EXISTING_TOKEN_ID}" ] && [ -n "${keyfile}" ] ; then
|
||||||
|
+ echo "Cannot specify kernel keyring description together with key file" >&2
|
||||||
|
+ exit 1
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
# If necessary, initialize the LUKS volume.
|
||||||
|
if [ "${luks_type}" = "luks1" ] && ! luksmeta test -d "${DEV}"; then
|
||||||
|
luksmeta init -d "${DEV}" ${FRC}
|
||||||
|
@@ -127,7 +146,7 @@
|
||||||
|
if ! clevis_luks_do_bind "${DEV}" "${SLT}" "${TOKEN_ID}" \
|
||||||
|
"${PIN}" "${CFG}" \
|
||||||
|
"${YES}" "" \
|
||||||
|
- "${existing_key}" "${keyfile}"; then
|
||||||
|
+ "${existing_key}" "${keyfile}" "${EXISTING_TOKEN_ID}"; then
|
||||||
|
echo "Error adding new binding to ${DEV}" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
--- clevis-18.ori/src/luks/clevis-luks-bind.1.adoc 2021-04-15 13:00:19.965065700 +0200
|
||||||
|
+++ clevis-18/src/luks/clevis-luks-bind.1.adoc 2022-11-24 12:54:48.476829197 +0100
|
||||||
|
@@ -9,7 +9,7 @@
|
||||||
|
|
||||||
|
== SYNOPSIS
|
||||||
|
|
||||||
|
-*clevis luks bind* [-f] [-y] -d DEV [-t TKN_ID] [-s SLT] [-k KEY] PIN CFG
|
||||||
|
+*clevis luks bind* [-f] [-y] -d DEV [-t TKN_ID] [-s SLT] [-k KEY] [-e EXISTING_TOKEN_ID] PIN CFG
|
||||||
|
|
||||||
|
== OVERVIEW
|
||||||
|
|
||||||
|
@@ -54,6 +54,12 @@
|
||||||
|
* *-k* - :
|
||||||
|
Non-interactively read LUKS password from standard input
|
||||||
|
|
||||||
|
+* *-e* _E_TKN_ID_ :
|
||||||
|
+ LUKS token ID for existing passphrase; only available for LUKS2.
|
||||||
|
+ This parameter allows providing a configured token ID in LUKS2
|
||||||
|
+ containing the existing passphrase for this device, so that
|
||||||
|
+ existing passphrase is not prompted by clevis
|
||||||
|
+
|
||||||
|
== CAVEATS
|
||||||
|
|
||||||
|
This command does not change the LUKS master key. This implies that if you
|
||||||
|
--- clevis-18.ori/src/luks/clevis-luks-common-functions.in 2022-11-24 12:46:09.130204312 +0100
|
||||||
|
+++ clevis-18/src/luks/clevis-luks-common-functions.in 2022-11-24 13:01:57.087170193 +0100
|
||||||
|
@@ -307,9 +307,10 @@
|
||||||
|
local KEY="${2:-}"
|
||||||
|
local KEYFILE="${3:-}"
|
||||||
|
local SLT="${4:-}"
|
||||||
|
+ local EXISTING_TOKEN_ID="${5:-}"
|
||||||
|
|
||||||
|
[ -z "${DEV}" ] && return 1
|
||||||
|
- [ -z "${KEYFILE}" ] && [ -z "${KEY}" ] && return 1
|
||||||
|
+ [ -z "${EXISTING_TOKEN_ID}" ] && [ -z "${KEYFILE}" ] && [ -z "${KEY}" ] && return 1
|
||||||
|
|
||||||
|
local extra_args
|
||||||
|
extra_args="$([ -n "${SLT}" ] && printf -- '--key-slot %s' "${SLT}")"
|
||||||
|
@@ -318,6 +319,11 @@
|
||||||
|
${extra_args}
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
+ if [ -n "${EXISTING_TOKEN_ID}" ]; then
|
||||||
|
+ cryptsetup open --test-passphrase "${DEV}" --token-id "${EXISTING_TOKEN_ID}" \
|
||||||
|
+ ${extra_args}
|
||||||
|
+ return
|
||||||
|
+ fi
|
||||||
|
|
||||||
|
printf '%s' "${KEY}" | cryptsetup open --test-passphrase "${DEV}" \
|
||||||
|
${extra_args}
|
||||||
|
@@ -753,10 +759,11 @@
|
||||||
|
local NEWKEY="${3}"
|
||||||
|
local KEY="${4}"
|
||||||
|
local KEYFILE="${5:-}"
|
||||||
|
+ local EXISTING_TOKEN_ID="${6:-}"
|
||||||
|
|
||||||
|
[ -z "${DEV}" ] && return 1
|
||||||
|
[ -z "${NEWKEY}" ] && return 1
|
||||||
|
- [ -z "${KEY}" ] && [ -z "${KEYFILE}" ] && return 1
|
||||||
|
+ [ -z "${EXISTING_TOKEN_ID}" ] && [ -z "${KEY}" ] && [ -z "${KEYFILE}" ] && return 1
|
||||||
|
|
||||||
|
local extra_args='' input
|
||||||
|
input="$(printf '%s\n%s' "${KEY}" "${NEWKEY}")"
|
||||||
|
@@ -764,6 +771,10 @@
|
||||||
|
extra_args="$(printf -- '--key-file %s' "${KEYFILE}")"
|
||||||
|
input="$(printf '%s' "${NEWKEY}")"
|
||||||
|
fi
|
||||||
|
+ if [ -n "${EXISTING_TOKEN_ID}" ]; then
|
||||||
|
+ extra_args="$(printf -- '--token-id %s' "${EXISTING_TOKEN_ID}")"
|
||||||
|
+ input="$(printf '%s' "${NEWKEY}")"
|
||||||
|
+ fi
|
||||||
|
local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
||||||
|
|
||||||
|
printf '%s' "${input}" | cryptsetup luksAddKey --batch-mode \
|
||||||
|
@@ -780,6 +791,7 @@
|
||||||
|
local NEWKEY="${3}"
|
||||||
|
local KEY="${4}"
|
||||||
|
local KEYFILE="${5:-}"
|
||||||
|
+ local EXISTING_TOKEN_ID="${6:-}"
|
||||||
|
|
||||||
|
[ -z "${DEV}" ] && return 1
|
||||||
|
[ -z "${NEWKEY}" ] && return 1
|
||||||
|
@@ -789,7 +801,7 @@
|
||||||
|
local in_place
|
||||||
|
clevis_luks_check_valid_key_or_keyfile "${DEV}" \
|
||||||
|
"${KEY}" "${KEYFILE}" \
|
||||||
|
- "${SLT}" 2>/dev/null \
|
||||||
|
+ "${SLT}" "${EXISTING_TOKEN_ID}" 2>/dev/null \
|
||||||
|
&& in_place=true
|
||||||
|
|
||||||
|
local input extra_args=
|
||||||
|
@@ -798,6 +810,10 @@
|
||||||
|
extra_args="$(printf -- '--key-file %s' "${KEYFILE}")"
|
||||||
|
input="$(printf '%s' "${NEWKEY}")"
|
||||||
|
fi
|
||||||
|
+ if [ -n "${EXISTING_TOKEN_ID}" ]; then
|
||||||
|
+ extra_args="$(printf -- '--token-id %s' "${EXISTING_TOKEN_ID}")"
|
||||||
|
+ input="$(printf '%s' "${NEWKEY}")"
|
||||||
|
+ fi
|
||||||
|
local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
||||||
|
|
||||||
|
if [ -n "${in_place}" ]; then
|
||||||
|
@@ -844,13 +860,13 @@
|
||||||
|
[ -n "${OVERWRITE}" ] || return 1
|
||||||
|
|
||||||
|
clevis_luks_update_key "${DEV}" "${SLT}" \
|
||||||
|
- "${NEWKEY}" "${KEY}" "${KEYFILE}"
|
||||||
|
+ "${NEWKEY}" "${KEY}" "${KEYFILE}" "${EXISTING_TOKEN_ID}"
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Add a new key.
|
||||||
|
clevis_luks_add_key "${DEV}" "${SLT}" \
|
||||||
|
- "${NEWKEY}" "${KEY}" "${KEYFILE}"
|
||||||
|
+ "${NEWKEY}" "${KEY}" "${KEYFILE}" "${EXISTING_TOKEN_ID}"
|
||||||
|
}
|
||||||
|
|
||||||
|
# clevis_luks_generate_key() generates a new key for use with clevis.
|
||||||
|
@@ -942,6 +958,7 @@
|
||||||
|
local OVERWRITE="${7:-}"
|
||||||
|
local KEY="${8:-}"
|
||||||
|
local KEYFILE="${9:-}"
|
||||||
|
+ local EXISTING_TOKEN_ID="${10:-}"
|
||||||
|
|
||||||
|
[ -z "${DEV}" ] && return 1
|
||||||
|
[ -z "${PIN}" ] && return 1
|
||||||
|
@@ -951,6 +968,8 @@
|
||||||
|
if ! clevis_luks_check_valid_key_or_keyfile "${DEV}" \
|
||||||
|
"${KEY}" \
|
||||||
|
"${KEYFILE}" \
|
||||||
|
+ "" \
|
||||||
|
+ "${EXISTING_TOKEN_ID}" \
|
||||||
|
&& ! KEY="$(clevis_luks_get_existing_key "${DEV}" \
|
||||||
|
"Enter existing LUKS password: " \
|
||||||
|
"recover")"; then
|
||||||
|
@@ -995,7 +1014,7 @@
|
||||||
|
|
||||||
|
if ! clevis_luks_save_key_to_slot "${DEV}" "${SLT}" \
|
||||||
|
"${newkey}" "${KEY}" "${KEYFILE}" \
|
||||||
|
- "${OVERWRITE}"; then
|
||||||
|
+ "${OVERWRITE}" "${EXISTING_TOKEN_ID}"; then
|
||||||
|
echo "Unable to save/update key slot; operation cancelled" >&2
|
||||||
|
clevis_luks_restore_dev "${CLEVIS_TMP_DIR}" || :
|
||||||
|
rm -rf "${CLEVIS_TMP_DIR}"
|
||||||
|
@@ -1016,12 +1035,19 @@
|
||||||
|
}
|
||||||
|
|
||||||
|
# clevis_luks_luks2_supported() indicates whether we support LUKS2 devices.
|
||||||
|
-# Suppor is determined at build time.
|
||||||
|
+# Support is determined at build time.
|
||||||
|
function clevis_luks_luks2_supported() {
|
||||||
|
# We require cryptsetup >= 2.0.4 to fully support LUKSv2.
|
||||||
|
return @OLD_CRYPTSETUP@
|
||||||
|
}
|
||||||
|
|
||||||
|
+# clevis_luks_luks2_existing_token_id_supported() indicates whether
|
||||||
|
+# cryptsetup allows token id for passphrase providing
|
||||||
|
+function clevis_luks_luks2_existing_token_id_supported() {
|
||||||
|
+ # We require cryptsetup >= 2.6.0 to fully support LUKSv2 addkey/open by token ID
|
||||||
|
+ return @OLD_CRYPTSETUP_EXISTING_TOKEN_ID@
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
# clevis_luks_type() returns the LUKS type of a device, e.g. "luks1".
|
||||||
|
clevis_luks_type() {
|
||||||
|
local DEV="${1}"
|
||||||
|
--- clevis-18.ori/src/luks/meson.build 2021-04-15 13:00:19.965065700 +0200
|
||||||
|
+++ clevis-18/src/luks/meson.build 2022-11-24 13:02:39.118301695 +0100
|
||||||
|
@@ -14,6 +14,15 @@
|
||||||
|
endif
|
||||||
|
endif
|
||||||
|
|
||||||
|
+libcryptsetup_ext_token_id = dependency('libcryptsetup', version: '>=2.6.0', required: false)
|
||||||
|
+if libcryptsetup_ext_token_id.found()
|
||||||
|
+ luksmeta_data.set('OLD_CRYPTSETUP_EXISTING_TOKEN_ID', '0')
|
||||||
|
+ message('cryptsetup version supports existing token id')
|
||||||
|
+else
|
||||||
|
+ luksmeta_data.set('OLD_CRYPTSETUP_EXISTING_TOKEN_ID', '1')
|
||||||
|
+ warning('cryptsetup version does not support existing token id')
|
||||||
|
+endif
|
||||||
|
+
|
||||||
|
clevis_luks_common_functions = configure_file(
|
||||||
|
input: 'clevis-luks-common-functions.in',
|
||||||
|
output: 'clevis-luks-common-functions',
|
||||||
|
--- clevis-18.ori/src/luks/tests/bind-luks2-ext-token 1970-01-01 01:00:00.000000000 +0100
|
||||||
|
+++ clevis-18/src/luks/tests/bind-luks2-ext-token 2022-11-24 13:04:30.742650939 +0100
|
||||||
|
@@ -0,0 +1,74 @@
|
||||||
|
+#!/bin/bash -ex
|
||||||
|
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
||||||
|
+#
|
||||||
|
+# Copyright (c) 2022 Red Hat, Inc.
|
||||||
|
+# Author: Sergio Arroutbi <sarroutb@redhat.com>
|
||||||
|
+#
|
||||||
|
+# This program is free software: you can redistribute it and/or modify
|
||||||
|
+# it under the terms of the GNU General Public License as published by
|
||||||
|
+# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
+# (at your option) any later version.
|
||||||
|
+#
|
||||||
|
+# This program is distributed in the hope that it will be useful,
|
||||||
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
+# GNU General Public License for more details.
|
||||||
|
+#
|
||||||
|
+# You should have received a copy of the GNU General Public License
|
||||||
|
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+TEST=$(basename "${0}")
|
||||||
|
+. tests-common-functions
|
||||||
|
+
|
||||||
|
+on_exit() {
|
||||||
|
+ [ -d "${TMP}" ] && rm -rf "${TMP}"
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+create_existing_token_id_from_keyring() {
|
||||||
|
+ local DEV="${1}"
|
||||||
|
+ local KEYDESC="${2}"
|
||||||
|
+ local TOKEN_ID="${3}"
|
||||||
|
+ local PASS="${4}"
|
||||||
|
+ if [[ -z "${DEV}" ]] || [[ -z "${KEYDESC}" ]] || [[ -z "${TOKEN_ID}" ]]; then
|
||||||
|
+ return 1
|
||||||
|
+ fi
|
||||||
|
+ KEYRING_ID=$(keyctl add user "${KEYDESC}" "${PASS}" @s)
|
||||||
|
+ keyctl print "${KEYRING_ID}" 2>/dev/null 1>/dev/null
|
||||||
|
+ cryptsetup token add --token-id "${TOKEN_ID}" --key-description "${KEYDESC}" "${DEV}"
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+if ! luks2_supported; then
|
||||||
|
+ skip_test "${TEST}: LUKS2 is not supported."
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
+if ! luks2_existing_token_id_supported; then
|
||||||
|
+ skip_test "${TEST}: Existing token ID not supported"
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
+trap 'on_exit' EXIT
|
||||||
|
+trap 'exit' ERR
|
||||||
|
+
|
||||||
|
+TMP="$(mktemp -d)"
|
||||||
|
+
|
||||||
|
+ADV="${TMP}/adv.jws"
|
||||||
|
+tang_create_adv "${TMP}" "${ADV}"
|
||||||
|
+CFG="$(printf '{"url":"foobar","adv":"%s"}' "$ADV")"
|
||||||
|
+
|
||||||
|
+EXISTING_TOKEN_ID=5
|
||||||
|
+KEYDESC="testkey"
|
||||||
|
+PASS="123exttokenid_"
|
||||||
|
+DEV="${TMP}/luks2-device-ext-token"
|
||||||
|
+new_device "luks2" "${DEV}" "${PASS}"
|
||||||
|
+
|
||||||
|
+create_existing_token_id_from_keyring "${DEV}" "${KEYDESC}" "${EXISTING_TOKEN_ID}" "${PASS}"
|
||||||
|
+
|
||||||
|
+if ! clevis luks bind -y -d "${DEV}" -e "${EXISTING_TOKEN_ID}" tang "${CFG}"; then
|
||||||
|
+ error "${TEST}: Binding expected to succeed with existing token id:${EXISTING_TOKEN_ID}" >&2
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
+KEYFILE="${TMP}/keyfile.txt"
|
||||||
|
+touch "${KEYFILE}"
|
||||||
|
+if clevis luks bind -y -d "${DEV}" -e "${EXISTING_TOKEN_ID}" -k "${KEYFILE}" tang "${CFG}"; then
|
||||||
|
+ error "${TEST}: Using existing token id and keyfile should dump an error" >&2
|
||||||
|
+fi
|
||||||
|
--- clevis-18.ori/src/luks/tests/meson.build 2021-04-15 13:00:19.967066500 +0200
|
||||||
|
+++ clevis-18/src/luks/tests/meson.build 2022-11-24 13:06:36.096043131 +0100
|
||||||
|
@@ -5,6 +5,15 @@
|
||||||
|
# given token slot.
|
||||||
|
cryptsetup = find_program('cryptsetup', required: true)
|
||||||
|
|
||||||
|
+# Use keyctl to check an existing token id can be created from
|
||||||
|
+# kernel keyring password
|
||||||
|
+keyutils = find_program('keyctl', required: false)
|
||||||
|
+if keyutils.found()
|
||||||
|
+ message('keyutils installed')
|
||||||
|
+else
|
||||||
|
+ warning('keyutils not installed, unable to test existing token id binding')
|
||||||
|
+endif
|
||||||
|
+
|
||||||
|
common_functions = configure_file(input: 'tests-common-functions.in',
|
||||||
|
output: 'tests-common-functions',
|
||||||
|
configuration: luksmeta_data,
|
||||||
|
@@ -69,6 +78,10 @@
|
||||||
|
test('unbind-unbound-slot-luks2', find_program('unbind-unbound-slot-luks2'), env: env)
|
||||||
|
test('unbind-luks2', find_program('unbind-luks2'), env: env, timeout: 60)
|
||||||
|
|
||||||
|
+ if keyutils.found() and luksmeta_data.get('OLD_CRYPTSETUP_EXISTING_TOKEN_ID') == '0'
|
||||||
|
+ test('bind-luks2-ext-token', find_program('bind-luks2-ext-token'), env: env, timeout: 60)
|
||||||
|
+ endif
|
||||||
|
+
|
||||||
|
if jq.found()
|
||||||
|
test('list-recursive-luks2', find_program('list-recursive-luks2'), env: env, timeout: 60)
|
||||||
|
test('list-tang-luks2', find_program('list-tang-luks2'), env: env, timeout: 60)
|
||||||
|
--- clevis-18.ori/src/luks/tests/tests-common-functions.in 2021-04-15 13:00:19.967066500 +0200
|
||||||
|
+++ clevis-18/src/luks/tests/tests-common-functions.in 2022-11-24 13:06:24.376006462 +0100
|
||||||
|
@@ -36,6 +36,12 @@
|
||||||
|
return @OLD_CRYPTSETUP@
|
||||||
|
}
|
||||||
|
|
||||||
|
+# We require cryptsetup >= 2.6.0 to fully support LUKSv2 addkey/open by token ID
|
||||||
|
+# Support is determined at build time.
|
||||||
|
+luks2_existing_token_id_supported() {
|
||||||
|
+ return @OLD_CRYPTSETUP_EXISTING_TOKEN_ID@
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
# Creates a new LUKS1 or LUKS2 device to be used.
|
||||||
|
new_device() {
|
||||||
|
local LUKS="${1}"
|
||||||
@ -1,6 +1,6 @@
|
|||||||
--- clevis-15.ori/src/luks/clevis-luks-common-functions 2023-01-11 11:11:03.050262054 +0100
|
--- clevis-18.ori/src/luks/clevis-luks-common-functions.in 2023-01-12 11:00:00.927790464 +0100
|
||||||
+++ clevis-15/src/luks/clevis-luks-common-functions 2023-01-11 11:19:16.004358405 +0100
|
+++ clevis-18/src/luks/clevis-luks-common-functions.in 2023-01-12 11:05:53.528590215 +0100
|
||||||
@@ -413,7 +413,12 @@
|
@@ -418,7 +418,12 @@
|
||||||
clevis_devices=
|
clevis_devices=
|
||||||
|
|
||||||
# Build list of devices to unlock.
|
# Build list of devices to unlock.
|
||||||
@ -0,0 +1,42 @@
|
|||||||
|
--- clevis-18.ori/src/clevis.1.adoc 2021-04-15 13:00:19.965065700 +0200
|
||||||
|
+++ clevis-18/src/clevis.1.adoc 2023-01-13 12:08:31.162012856 +0100
|
||||||
|
@@ -101,7 +101,7 @@
|
||||||
|
|
||||||
|
This command performs four steps:
|
||||||
|
|
||||||
|
-1. Creates a new key with the same entropy as the LUKS master key.
|
||||||
|
+1. Creates a new key with the same entropy as the LUKS master key -- maximum entropy bits is 256.
|
||||||
|
2. Encrypts the new key with Clevis.
|
||||||
|
3. Stores the Clevis JWE in the LUKS header.
|
||||||
|
4. Enables the new key for use with LUKS.
|
||||||
|
--- clevis-18.ori/src/luks/clevis-luks-bind.1.adoc 2023-01-13 12:02:52.005243591 +0100
|
||||||
|
+++ clevis-18/src/luks/clevis-luks-bind.1.adoc 2023-01-13 12:08:05.873955501 +0100
|
||||||
|
@@ -20,7 +20,7 @@
|
||||||
|
|
||||||
|
This command performs four steps:
|
||||||
|
|
||||||
|
-1. Creates a new key with the same entropy as the LUKS master key.
|
||||||
|
+1. Creates a new key with the same entropy as the LUKS master key -- maximum entropy bits is 256.
|
||||||
|
2. Encrypts the new key with Clevis.
|
||||||
|
3. Stores the Clevis JWE in the LUKS header.
|
||||||
|
4. Enables the new key for use with LUKS.
|
||||||
|
--- clevis-18.ori/src/luks/clevis-luks-common-functions.in 2023-01-13 12:02:52.005243591 +0100
|
||||||
|
+++ clevis-18/src/luks/clevis-luks-common-functions.in 2023-01-13 12:06:29.233736316 +0100
|
||||||
|
@@ -875,6 +875,7 @@
|
||||||
|
[ -z "${DEV}" ] && return 1
|
||||||
|
|
||||||
|
local dump filter bits
|
||||||
|
+ local MAX_ENTROPY_BITS=256 # Maximum allowed by pwmake.
|
||||||
|
dump=$(cryptsetup luksDump "${DEV}")
|
||||||
|
if cryptsetup isLuks --type luks1 "${DEV}"; then
|
||||||
|
filter="$(echo "${dump}" | sed -rn 's|MK bits:[ \t]*([0-9]+)|\1|p')"
|
||||||
|
@@ -886,6 +887,9 @@
|
||||||
|
fi
|
||||||
|
|
||||||
|
bits="$(echo -n "${filter}" | sort -n | tail -n 1)"
|
||||||
|
+ if [ "${bits}" -gt "${MAX_ENTROPY_BITS}" ]; then
|
||||||
|
+ bits="${MAX_ENTROPY_BITS}"
|
||||||
|
+ fi
|
||||||
|
pwmake "${bits}"
|
||||||
|
}
|
||||||
|
|
||||||
@ -1,73 +0,0 @@
|
|||||||
--- clevis-15.ori/src/clevis.1.adoc 2020-10-28 19:55:47.663228800 +0100
|
|
||||||
+++ clevis-15/src/clevis.1.adoc 2023-01-11 17:18:29.967295005 +0100
|
|
||||||
@@ -101,7 +101,7 @@
|
|
||||||
|
|
||||||
This command performs four steps:
|
|
||||||
|
|
||||||
-1. Creates a new key with the same entropy as the LUKS master key.
|
|
||||||
+1. Creates a new key with the same entropy as the LUKS master key -- maximum entropy bits is 256.
|
|
||||||
2. Encrypts the new key with Clevis.
|
|
||||||
3. Stores the Clevis JWE in the LUKS header.
|
|
||||||
4. Enables the new key for use with LUKS.
|
|
||||||
--- clevis-15.ori/src/luks/clevis-luks-bind.1.adoc 2020-10-28 19:55:47.663228800 +0100
|
|
||||||
+++ clevis-15/src/luks/clevis-luks-bind.1.adoc 2023-01-11 17:18:55.239351209 +0100
|
|
||||||
@@ -20,7 +20,7 @@
|
|
||||||
|
|
||||||
This command performs four steps:
|
|
||||||
|
|
||||||
-1. Creates a new key with the same entropy as the LUKS master key.
|
|
||||||
+1. Creates a new key with the same entropy as the LUKS master key -- maximum entropy bits is 256.
|
|
||||||
2. Encrypts the new key with Clevis.
|
|
||||||
3. Stores the Clevis JWE in the LUKS header.
|
|
||||||
4. Enables the new key for use with LUKS.
|
|
||||||
--- clevis-15.ori/src/luks/clevis-luks-common-functions 2023-01-11 17:15:44.984928070 +0100
|
|
||||||
+++ clevis-15/src/luks/clevis-luks-common-functions 2023-01-11 17:20:53.238613637 +0100
|
|
||||||
@@ -865,6 +865,7 @@
|
|
||||||
[ -z "${DEV}" ] && return 1
|
|
||||||
|
|
||||||
local dump filter bits
|
|
||||||
+ local MAX_ENTROPY_BITS=256
|
|
||||||
dump=$(cryptsetup luksDump "${DEV}")
|
|
||||||
if cryptsetup isLuks --type luks1 "${DEV}"; then
|
|
||||||
filter="$(echo "${dump}" | sed -rn 's|MK bits:[ \t]*([0-9]+)|\1|p')"
|
|
||||||
@@ -876,6 +877,9 @@
|
|
||||||
fi
|
|
||||||
|
|
||||||
bits="$(echo -n "${filter}" | sort -n | tail -n 1)"
|
|
||||||
+ if [ "${bits}" -gt "${MAX_ENTROPY_BITS}" ]; then
|
|
||||||
+ bits="${MAX_ENTROPY_BITS}"
|
|
||||||
+ fi
|
|
||||||
pwmake "${bits}"
|
|
||||||
}
|
|
||||||
|
|
||||||
--- clevis-15.ori/src/luks/clevis-luks-bind.in 2023-01-11 17:15:44.815927694 +0100
|
|
||||||
+++ clevis-15/src/luks/clevis-luks-bind.in 2023-01-12 16:20:30.266404993 +0100
|
|
||||||
@@ -19,6 +19,8 @@
|
|
||||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
#
|
|
||||||
|
|
||||||
+. clevis-luks-common-functions
|
|
||||||
+
|
|
||||||
SUMMARY="Binds a LUKS device using the specified policy"
|
|
||||||
UUID=cb6e8904-81ff-40da-a84a-07ab9ab5715e
|
|
||||||
|
|
||||||
@@ -139,14 +141,11 @@
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Generate a key with the same entropy as the LUKS Master Key
|
|
||||||
-key="$(pwmake "$(
|
|
||||||
-cryptsetup luksDump "$DEV" \
|
|
||||||
- | if [ "$luks_type" == "luks1" ]; then
|
|
||||||
- sed -rn 's|MK bits:[ \t]*([0-9]+)|\1|p'
|
|
||||||
- else
|
|
||||||
- sed -rn 's|^\s+Key:\s+([0-9]+) bits\s*$|\1|p'
|
|
||||||
- fi | sort -n | tail -n 1
|
|
||||||
-)")"
|
|
||||||
+if ! key="$(clevis_luks_generate_key "${DEV}")" \
|
|
||||||
+ || [ -z "${key}" ]; then
|
|
||||||
+ echo "Unable to generate key for ${DEV}" >&2
|
|
||||||
+ return 1
|
|
||||||
+fi
|
|
||||||
|
|
||||||
# Encrypt the new key
|
|
||||||
jwe="$(echo -n "$key" | clevis encrypt "$PIN" "$CFG" "${YES}")"
|
|
||||||
@ -1,5 +1,5 @@
|
|||||||
--- clevis-15.ori/src/luks/clevis-luks-edit 2020-10-28 19:55:47.663228800 +0100
|
--- clevis-18.ori/src/luks/clevis-luks-edit 2021-04-15 13:00:19.965065700 +0200
|
||||||
+++ clevis-15/src/luks/clevis-luks-edit 2023-01-16 12:03:14.006998399 +0100
|
+++ clevis-18/src/luks/clevis-luks-edit 2023-01-16 10:24:18.555971552 +0100
|
||||||
@@ -173,7 +173,7 @@
|
@@ -173,7 +173,7 @@
|
||||||
|
|
||||||
echo "Updating binding..."
|
echo "Updating binding..."
|
||||||
@ -0,0 +1,98 @@
|
|||||||
|
--- clevis-18.ori/src/luks/meson.build 2023-06-01 15:28:51.615436832 +0200
|
||||||
|
+++ clevis-18/src/luks/meson.build 2023-06-01 15:31:02.420366592 +0200
|
||||||
|
@@ -1,7 +1,6 @@
|
||||||
|
|
||||||
|
luksmeta_data = configuration_data()
|
||||||
|
luksmeta = dependency('luksmeta', version: '>=8', required: false)
|
||||||
|
-pwmake = find_program('pwmake', required: false)
|
||||||
|
|
||||||
|
libcryptsetup = dependency('libcryptsetup', version: '>=2.0.4', required: false)
|
||||||
|
if libcryptsetup.found()
|
||||||
|
@@ -33,7 +32,7 @@
|
||||||
|
output: 'clevis-luks-unbind',
|
||||||
|
configuration: luksmeta_data)
|
||||||
|
|
||||||
|
-if libcryptsetup.found() and luksmeta.found() and pwmake.found()
|
||||||
|
+if libcryptsetup.found() and luksmeta.found()
|
||||||
|
subdir('systemd')
|
||||||
|
subdir('udisks2')
|
||||||
|
|
||||||
|
--- clevis-18.ori/src/luks/clevis-luks-common-functions.in 2023-06-01 15:28:51.656437123 +0200
|
||||||
|
+++ clevis-18/src/luks/clevis-luks-common-functions.in 2023-06-02 17:31:52.430534483 +0200
|
||||||
|
@@ -20,6 +20,11 @@
|
||||||
|
|
||||||
|
CLEVIS_UUID="cb6e8904-81ff-40da-a84a-07ab9ab5715e"
|
||||||
|
|
||||||
|
+# Length, in bytes, used for password generated for LUKS key
|
||||||
|
+# This value corresponds to an entropy of 256 bits if the password
|
||||||
|
+# was generated by pwmake or similar tool
|
||||||
|
+JOSE_PASSWORD_LENGTH=40
|
||||||
|
+
|
||||||
|
enable_debugging() {
|
||||||
|
# Automatically enable debugging if in initramfs phase and rd.debug
|
||||||
|
if [ -e /usr/lib/dracut-lib.sh ]; then
|
||||||
|
@@ -782,7 +787,7 @@
|
||||||
|
fi
|
||||||
|
local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
||||||
|
|
||||||
|
- printf '%s' "${input}" | cryptsetup luksAddKey --batch-mode \
|
||||||
|
+ printf '%s' "${input}" | cryptsetup luksAddKey --force-password --batch-mode \
|
||||||
|
--key-slot "${SLT}" \
|
||||||
|
"${DEV}" \
|
||||||
|
${pbkdf_args} \
|
||||||
|
@@ -812,11 +817,11 @@
|
||||||
|
local input extra_args=
|
||||||
|
input="$(printf '%s\n%s' "${KEY}" "${NEWKEY}")"
|
||||||
|
if [ -n "${KEYFILE}" ]; then
|
||||||
|
- extra_args="$(printf -- '--key-file %s' "${KEYFILE}")"
|
||||||
|
+ extra_args="$(printf -- '--key-file %s --force-password' "${KEYFILE}")"
|
||||||
|
input="$(printf '%s' "${NEWKEY}")"
|
||||||
|
fi
|
||||||
|
if [ -n "${EXISTING_TOKEN_ID}" ]; then
|
||||||
|
- extra_args="$(printf -- '--token-id %s' "${EXISTING_TOKEN_ID}")"
|
||||||
|
+ extra_args="$(printf -- '--token-id %s --force-password' "${EXISTING_TOKEN_ID}")"
|
||||||
|
input="$(printf '%s' "${NEWKEY}")"
|
||||||
|
fi
|
||||||
|
local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
||||||
|
@@ -876,26 +881,10 @@
|
||||||
|
|
||||||
|
# clevis_luks_generate_key() generates a new key for use with clevis.
|
||||||
|
clevis_luks_generate_key() {
|
||||||
|
- local DEV="${1}"
|
||||||
|
- [ -z "${DEV}" ] && return 1
|
||||||
|
-
|
||||||
|
- local dump filter bits
|
||||||
|
- local MAX_ENTROPY_BITS=256 # Maximum allowed by pwmake.
|
||||||
|
- dump=$(cryptsetup luksDump "${DEV}")
|
||||||
|
- if cryptsetup isLuks --type luks1 "${DEV}"; then
|
||||||
|
- filter="$(echo "${dump}" | sed -rn 's|MK bits:[ \t]*([0-9]+)|\1|p')"
|
||||||
|
- elif cryptsetup isLuks --type luks2 "${DEV}"; then
|
||||||
|
- filter="$(echo -n "${dump}" | \
|
||||||
|
- sed -rn 's|^\s+Key:\s+([0-9]+) bits\s*$|\1|p')"
|
||||||
|
- else
|
||||||
|
- return 1
|
||||||
|
- fi
|
||||||
|
-
|
||||||
|
- bits="$(echo -n "${filter}" | sort -n | tail -n 1)"
|
||||||
|
- if [ "${bits}" -gt "${MAX_ENTROPY_BITS}" ]; then
|
||||||
|
- bits="${MAX_ENTROPY_BITS}"
|
||||||
|
- fi
|
||||||
|
- pwmake "${bits}"
|
||||||
|
+ local input
|
||||||
|
+ input=$(printf '{"kty":"oct","bytes":%s}' "${JOSE_PASSWORD_LENGTH}")
|
||||||
|
+ jose jwk gen --input="${input}" --output=- \
|
||||||
|
+ | jose fmt --json=- --object --get k --unquote=-
|
||||||
|
}
|
||||||
|
|
||||||
|
# clevis_luks_token_id_by_slot() returns the token ID linked to a
|
||||||
|
@@ -986,8 +975,8 @@
|
||||||
|
fi
|
||||||
|
|
||||||
|
local newkey jwe
|
||||||
|
- if ! newkey="$(clevis_luks_generate_key "${DEV}")" \
|
||||||
|
- || [ -z "${newkey}" ]; then
|
||||||
|
+
|
||||||
|
+ if ! newkey="$(clevis_luks_generate_key)" || [ -z "${newkey}" ]; then
|
||||||
|
echo "Unable to generate a new key" >&2
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
@ -1,219 +0,0 @@
|
|||||||
--- clevis-15.ori/src/pins/tang/clevis-decrypt-tang 2023-05-23 11:29:59.717465656 +0200
|
|
||||||
+++ clevis-15/src/pins/tang/clevis-decrypt-tang 2023-05-23 11:49:02.950511503 +0200
|
|
||||||
@@ -50,12 +50,30 @@
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
-if ! srv="$(jose fmt -j- -Og clevis -g tang -g adv -Oo- <<< "$jhd" \
|
|
||||||
- | jose jwk thp -i- -f "$kid")"; then
|
|
||||||
+if ! keys="$(jose fmt -j- -Og clevis -g tang -g adv -Oo- <<< "${jhd}")"; then
|
|
||||||
echo "JWE missing required 'clevis.tang.adv' header parameter!" >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
+# Check if the thumbprint we have in `kid' is in the advertised keys.
|
|
||||||
+CLEVIS_DEFAULT_THP_ALG=S1 # SHA-1
|
|
||||||
+CLEVIS_ALTERNATIVE_THP_ALGS=S256 # SHA-256
|
|
||||||
+
|
|
||||||
+if ! srv="$(jose jwk thp -i- -f "${kid}" -a "${CLEVIS_DEFAULT_THP_ALG}" \
|
|
||||||
+ <<< "${keys}")"; then
|
|
||||||
+ # `kid' thumprint not in the advertised keys, but it's possible it was
|
|
||||||
+ # generated using a different algorithm than the default one.
|
|
||||||
+ # Let us try the alternative supported algorithms to make sure `kid'
|
|
||||||
+ # really is not part of the advertised keys.
|
|
||||||
+ for alg in ${CLEVIS_ALTERNATIVE_THP_ALGS}; do
|
|
||||||
+ srv="$(jose jwk thp -i- -f "$kid" -a "${alg}" <<< "${keys}")" && break
|
|
||||||
+ done
|
|
||||||
+ if [ -z "${srv}" ]; then
|
|
||||||
+ echo "JWE header validation of 'clevis.tang.adv' failed: key thumbprint does not match" >&2
|
|
||||||
+ exit 1
|
|
||||||
+ fi
|
|
||||||
+fi
|
|
||||||
+
|
|
||||||
if ! url="$(jose fmt -j- -Og clevis -g tang -g url -Su- <<< "$jhd")"; then
|
|
||||||
echo "JWE missing required 'clevis.tang.url' header parameter!" >&2
|
|
||||||
exit 1
|
|
||||||
--- clevis-15.ori/src/pins/tang/clevis-encrypt-tang 2020-10-28 19:55:47.673228700 +0100
|
|
||||||
+++ clevis-15/src/pins/tang/clevis-encrypt-tang 2023-05-23 15:15:18.440099403 +0200
|
|
||||||
@@ -64,6 +64,9 @@
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
+CLEVIS_DEFAULT_THP_ALG=S1 # SHA-1
|
|
||||||
+CLEVIS_ALTERNATIVE_THP_ALGS=S256 # SHA-256
|
|
||||||
+
|
|
||||||
trust=
|
|
||||||
[ -n "${2}" ] && [ "${2}" == "-y" ] && trust=yes
|
|
||||||
|
|
||||||
@@ -111,15 +114,24 @@
|
|
||||||
if [ -z "$thp" ]; then
|
|
||||||
echo "The advertisement contains the following signing keys:" >&2
|
|
||||||
echo >&2
|
|
||||||
- jose jwk thp -i- <<< "$ver" >&2
|
|
||||||
+ jose jwk thp -i- -a "${CLEVIS_DEFAULT_THP_ALG}" <<< "$ver" >&2
|
|
||||||
echo >&2
|
|
||||||
read -r -p "Do you wish to trust these keys? [ynYN] " ans < /dev/tty
|
|
||||||
[[ "$ans" =~ ^[yY]$ ]] || exit 1
|
|
||||||
-
|
|
||||||
elif [ "$thp" != "any" ] && \
|
|
||||||
- ! jose jwk thp -i- -f "$thp" -o /dev/null <<< "$ver"; then
|
|
||||||
- echo "Trusted JWK '$thp' did not sign the advertisement!" >&2
|
|
||||||
- exit 1
|
|
||||||
+ ! jose jwk thp -i- -f "${thp}" -o /dev/null -a "${CLEVIS_DEFAULT_THP_ALG}" \
|
|
||||||
+ <<< "$ver"; then
|
|
||||||
+ # Thumbprint of trusted JWK did not match the signature. Let's check
|
|
||||||
+ # alternative thumbprints generated with clevis supported hash
|
|
||||||
+ # algorithms to be sure.
|
|
||||||
+ for alg in ${CLEVIS_ALTERNATIVE_THP_ALGS}; do
|
|
||||||
+ srv="$(jose jwk thp -i- -f "${thp}" -a "${alg}" <<< "${ver}")" \
|
|
||||||
+ && break
|
|
||||||
+ done
|
|
||||||
+ if [ -z "${srv}" ]; then
|
|
||||||
+ echo "Trusted JWK '$thp' did not sign the advertisement!" >&2
|
|
||||||
+ exit 1
|
|
||||||
+ fi
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
@@ -138,7 +150,7 @@
|
|
||||||
|
|
||||||
jwk="$(jose fmt -j- -Od key_ops -o- <<< "$jwk")"
|
|
||||||
jwk="$(jose fmt -j- -Od alg -o- <<< "$jwk")"
|
|
||||||
-kid="$(jose jwk thp -i- <<< "$jwk")"
|
|
||||||
+kid="$(jose jwk thp -i- -a "${CLEVIS_DEFAULT_THP_ALG}" <<< "$jwk")"
|
|
||||||
jwe='{"protected":{"alg":"ECDH-ES","enc":"A256GCM","clevis":{"pin":"tang","tang":{}}}}'
|
|
||||||
jwe="$(jose fmt -j "$jwe" -g protected -q "$kid" -s kid -UUo-)"
|
|
||||||
jwe="$(jose fmt -j "$jwe" -g protected -g clevis -g tang -q "$url" -s url -UUUUo-)"
|
|
||||||
--- clevis-15.ori/src/luks/tests/meson.build 2023-05-23 11:29:59.594464890 +0200
|
|
||||||
+++ clevis-15/src/luks/tests/meson.build 2023-05-23 12:00:10.811482757 +0200
|
|
||||||
@@ -113,6 +113,7 @@
|
|
||||||
test('report-sss-luks2', find_program('report-sss-luks2'), env: env, timeout: 120)
|
|
||||||
test('edit-tang-luks2', find_program('edit-tang-luks2'), env: env, timeout: 210)
|
|
||||||
test('pass-tang-luks2', find_program('pass-tang-luks2'), env: env, timeout: 60)
|
|
||||||
+ test('default-thp-alg', find_program('default-thp-alg'), env: env)
|
|
||||||
endif
|
|
||||||
|
|
||||||
test('backup-restore-luks2', find_program('backup-restore-luks2'), env: env, timeout: 120)
|
|
||||||
--- clevis-15.ori/src/luks/tests/default-thp-alg 1970-01-01 01:00:00.000000000 +0100
|
|
||||||
+++ clevis-15/src/luks/tests/default-thp-alg 2023-05-23 16:09:21.920385994 +0200
|
|
||||||
@@ -0,0 +1,120 @@
|
|
||||||
+#!/bin/bash
|
|
||||||
+set -exo pipefail
|
|
||||||
+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
||||||
+#
|
|
||||||
+# Copyright (c) 2020 Red Hat, Inc.
|
|
||||||
+# Author: Sergio Correia <scorreia@redhat.com>
|
|
||||||
+#
|
|
||||||
+# This program is free software: you can redistribute it and/or modify
|
|
||||||
+# it under the terms of the GNU General Public License as published by
|
|
||||||
+# the Free Software Foundation, either version 3 of the License, or
|
|
||||||
+# (at your option) any later version.
|
|
||||||
+#
|
|
||||||
+# This program is distributed in the hope that it will be useful,
|
|
||||||
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
+# GNU General Public License for more details.
|
|
||||||
+#
|
|
||||||
+# You should have received a copy of the GNU General Public License
|
|
||||||
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
+
|
|
||||||
+
|
|
||||||
+. tests-common-functions
|
|
||||||
+
|
|
||||||
+TEST=$(basename "${0}")
|
|
||||||
+
|
|
||||||
+on_exit() {
|
|
||||||
+ exit_status=$?
|
|
||||||
+ tang_stop "${TMP}"
|
|
||||||
+ [ -d "${TMP}" ] && rm -rf "${TMP}"
|
|
||||||
+ exit "${exit_status}"
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+trap 'on_exit' EXIT
|
|
||||||
+
|
|
||||||
+TMP="$(mktemp -d)"
|
|
||||||
+
|
|
||||||
+port=$(get_random_port)
|
|
||||||
+tang_run "${TMP}" "${port}"
|
|
||||||
+
|
|
||||||
+url="http://localhost:${port}"
|
|
||||||
+data="just a sample text"
|
|
||||||
+
|
|
||||||
+adv="${TMP}/adv"
|
|
||||||
+# Get the advertisement and extract the keys.
|
|
||||||
+tang_get_adv "${port}" "${adv}"
|
|
||||||
+
|
|
||||||
+jwks="$(jose fmt --json="${adv}" --get payload --b64load --output=-)"
|
|
||||||
+enc="$(printf '%s' "${jwks}" | jose jwk use --input=- --required \
|
|
||||||
+ --use deriveKey --output=-)"
|
|
||||||
+
|
|
||||||
+jose fmt --json="${enc}" --get keys --array \
|
|
||||||
+ || enc="$(printf '{"keys": [%s]}' "${enc}")"
|
|
||||||
+
|
|
||||||
+jwk="$(jose fmt --json="${enc}" --get keys --array --foreach=- \
|
|
||||||
+ | jose fmt --json=- --delete key_ops --delete alg --output=-)"
|
|
||||||
+
|
|
||||||
+jwe_t='{"protected":{"alg":"ECDH-ES","enc":"A256GCM","clevis":{"pin":"tang","tang":{}}}}'
|
|
||||||
+jwe_t="$(jose fmt --json="${jwe_t}" --get protected --get clevis --get tang --quote "${url}" --set url -UUUUo-)"
|
|
||||||
+jwe_t="$(printf '%s' "${jwks}" | jose fmt --json="${jwe_t}" --get protected --get clevis --get tang --json=- --set adv -UUUUo-)"
|
|
||||||
+
|
|
||||||
+# We currently support SHA-1 (legacy) and SHA-256.
|
|
||||||
+CLEVIS_SUPPORTED_THP_ALGS="S1 S256"
|
|
||||||
+# Now we will use every hash algorithm supported by jose to create a thumbprint
|
|
||||||
+# for `kid', then we do the encoding and verify clevis decrypt can decode it
|
|
||||||
+# correctly.
|
|
||||||
+for alg in ${CLEVIS_SUPPORTED_THP_ALGS}; do
|
|
||||||
+ kid="$(printf '%s' "${jwk}" | jose jwk thp -a "${alg}" --input=-)"
|
|
||||||
+ jwe="$(jose fmt --json="${jwe_t}" --get protected --quote "${kid}" -s kid -UUo-)"
|
|
||||||
+
|
|
||||||
+ encoded=$(printf '%s%s' "${jwk}" "${data}" \
|
|
||||||
+ | jose jwe enc --input="${jwe}" --key=- --detached=- --compact)
|
|
||||||
+
|
|
||||||
+ if ! decoded="$(printf '%s' "${encoded}" | clevis decrypt)"; then
|
|
||||||
+ tang_error "${TEST}: decoding is expected to work (alg = ${alg})"
|
|
||||||
+ fi
|
|
||||||
+
|
|
||||||
+ if [ "${decoded}" != "${data}" ]; then
|
|
||||||
+ tang_error "${TEST}: tang decrypt should have succeeded decoded[${decoded}] data[${data}] (alg = ${alg})"
|
|
||||||
+ fi
|
|
||||||
+done
|
|
||||||
+
|
|
||||||
+# Now let's test encryption providing the thp in the configuration.
|
|
||||||
+data="just another test"
|
|
||||||
+for alg in ${CLEVIS_SUPPORTED_THP_ALGS}; do
|
|
||||||
+ thp="$(jose fmt --json="${adv}" -g payload -y -o- \
|
|
||||||
+ | jose jwk use -i- -r -u verify -o- \
|
|
||||||
+ | jose jwk thp -i- -a "${alg}")"
|
|
||||||
+ cfg="$(printf '{"url":"%s", "thp":"%s"}' "${url}" "${thp}")"
|
|
||||||
+ if ! encoded=$(printf '%s' "${data}" | clevis encrypt tang "${cfg}"); then
|
|
||||||
+ tang_error "${TEST}: tang encryption should have succeeded when providing the thp (${thp}) with any supported algorithm (${alg})"
|
|
||||||
+ fi
|
|
||||||
+
|
|
||||||
+ if ! decoded="$(printf '%s' "${encoded}" | clevis decrypt)"; then
|
|
||||||
+ tang_error "${TEST}: decoding is expected to work (thp alg = ${alg})"
|
|
||||||
+ fi
|
|
||||||
+
|
|
||||||
+ if [ "${decoded}" != "${data}" ]; then
|
|
||||||
+ tang_error "${TEST}: tang decrypt should have succeeded decoded[${decoded}] data[${data}] (alg = ${alg})"
|
|
||||||
+ fi
|
|
||||||
+done
|
|
||||||
+
|
|
||||||
+# Let's also try some unsupported thp hash algorithms.
|
|
||||||
+UNSUPPORTED="S224 S384 S512" # SHA-224, SHA-384, SHA-512.
|
|
||||||
+for alg in ${UNSUPPORTED}; do
|
|
||||||
+ thp="$(jose fmt --json="${adv}" -g payload -y -o- \
|
|
||||||
+ | jose jwk use -i- -r -u verify -o- \
|
|
||||||
+ | jose jwk thp -i- -a "${alg}")"
|
|
||||||
+ cfg="$(printf '{"url":"%s", "thp":"%s"}' "${url}" "${thp}")"
|
|
||||||
+ if echo foo | clevis encrypt tang "${cfg}" >/dev/null; then
|
|
||||||
+ tang_error "${TEST}: tang encryption should have failed when providing the thp (${thp}) with an unsupported algorithm (${alg})"
|
|
||||||
+ fi
|
|
||||||
+done
|
|
||||||
+
|
|
||||||
+# Now let's try some bad values for thp.
|
|
||||||
+for thp in "" "foo" "invalid"; do
|
|
||||||
+ cfg="$(printf '{"url":"%s", "thp":"%s"}' "${url}" "${thp}")"
|
|
||||||
+ if echo foo | clevis encrypt tang "${cfg}" >/dev/null; then
|
|
||||||
+ tang_error "${TEST}: tang encryption expected to fail when providing a bad thp"
|
|
||||||
+ fi
|
|
||||||
+done
|
|
||||||
@ -0,0 +1 @@
|
|||||||
|
u clevis - "Clevis Decryption Framework unprivileged user" /var/cache/clevis /usr/sbin/nologin
|
||||||
Loading…
Reference in new issue