Blame SOURCES/0002-Fix-clevis-luks-unlock-and-add-related-tests.patch

95204d
From e5f6d87d5c71f3faf0c0dbe38534fd3eab30f43e Mon Sep 17 00:00:00 2001
95204d
From: Sergio Correia <scorreia@redhat.com>
95204d
Date: Wed, 13 May 2020 23:51:04 -0300
95204d
Subject: [PATCH 2/8] Fix clevis luks unlock and add related tests
95204d
95204d
---
95204d
 src/luks/clevis-luks-common-functions    |  35 ++++++
95204d
 src/luks/clevis-luks-unlock              |  68 ++++++++++++
95204d
 src/luks/clevis-luks-unlock.in           | 130 ----------------------
95204d
 src/luks/meson.build                     |  10 +-
95204d
 src/luks/tests/meson.build               |  40 +++++++
95204d
 src/luks/tests/tests-common-functions.in | 134 +++++++++++++++++++++--
95204d
 src/luks/tests/unlock-tang-luks1         |  83 ++++++++++++++
95204d
 src/luks/tests/unlock-tang-luks2         |  83 ++++++++++++++
95204d
 8 files changed, 439 insertions(+), 144 deletions(-)
95204d
 create mode 100755 src/luks/clevis-luks-unlock
95204d
 delete mode 100755 src/luks/clevis-luks-unlock.in
95204d
 create mode 100755 src/luks/tests/unlock-tang-luks1
95204d
 create mode 100755 src/luks/tests/unlock-tang-luks2
95204d
95204d
diff --git a/src/luks/clevis-luks-common-functions b/src/luks/clevis-luks-common-functions
95204d
index e27c444..d04fdb5 100644
95204d
--- a/src/luks/clevis-luks-common-functions
95204d
+++ b/src/luks/clevis-luks-common-functions
95204d
@@ -281,3 +281,38 @@ clevis_luks_read_pins_from_slot() {
95204d
     fi
95204d
     printf "%s: %s\n" "${SLOT}" "${cfg}"
95204d
 }
95204d
+
95204d
+# clevis_luks_unlock_device() does the unlock of the device passed as
95204d
+# parameter and returns the decoded passphrase.
95204d
+clevis_luks_unlock_device() {
95204d
+    local DEV="${1}"
95204d
+    [ -z "${DEV}" ] && return 1
95204d
+
95204d
+    local used_slots
95204d
+    if ! used_slots=$(clevis_luks_used_slots "${DEV}") \
95204d
+                      || [ -z "${used_slots}" ]; then
95204d
+        return 1
95204d
+    fi
95204d
+
95204d
+    local slt jwe passphrase
95204d
+    for slt in ${used_slots}; do
95204d
+        if ! jwe="$(clevis_luks_read_slot "${DEV}" "${slt}" 2>/dev/null)" \
95204d
+                   || [ -z "${jwe}" ]; then
95204d
+            continue
95204d
+        fi
95204d
+
95204d
+        if ! passphrase="$(clevis decrypt < <(echo -n "${jwe}"))" \
95204d
+                           || [ -z "${passphrase}" ]; then
95204d
+            continue
95204d
+        fi
95204d
+
95204d
+        if ! cryptsetup luksOpen --test-passphrase "${DEV}" \
95204d
+             --key-file <(echo -n "${passphrase}"); then
95204d
+            continue
95204d
+        fi
95204d
+        echo -n "${passphrase}"
95204d
+        return 0
95204d
+    done
95204d
+
95204d
+    return 1
95204d
+}
95204d
diff --git a/src/luks/clevis-luks-unlock b/src/luks/clevis-luks-unlock
95204d
new file mode 100755
95204d
index 0000000..580fde8
95204d
--- /dev/null
95204d
+++ b/src/luks/clevis-luks-unlock
95204d
@@ -0,0 +1,68 @@
95204d
+#!/bin/bash -e
95204d
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
95204d
+#
95204d
+# Copyright (c) 2016 Red Hat, Inc.
95204d
+# Author: Nathaniel McCallum <npmccallum@redhat.com>
95204d
+#
95204d
+# This program is free software: you can redistribute it and/or modify
95204d
+# it under the terms of the GNU General Public License as published by
95204d
+# the Free Software Foundation, either version 3 of the License, or
95204d
+# (at your option) any later version.
95204d
+#
95204d
+# This program is distributed in the hope that it will be useful,
95204d
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
95204d
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
95204d
+# GNU General Public License for more details.
95204d
+#
95204d
+# You should have received a copy of the GNU General Public License
95204d
+# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
95204d
+#
95204d
+. clevis-luks-common-functions
95204d
+
95204d
+SUMMARY="Unlocks a LUKS volume"
95204d
+
95204d
+function usage() {
95204d
+    exec >&2
95204d
+    echo
95204d
+    echo "Usage: clevis luks unlock -d DEV [-n NAME]"
95204d
+    echo
95204d
+    echo "$SUMMARY":
95204d
+    echo
95204d
+    echo "  -d DEV  The LUKS device on which to perform unlocking"
95204d
+    echo
95204d
+    echo "  -n NAME The name of the unlocked device node"
95204d
+    echo
95204d
+    exit 2
95204d
+}
95204d
+
95204d
+if [ $# -eq 1 ] && [ "$1" == "--summary" ]; then
95204d
+    echo "$SUMMARY"
95204d
+    exit 0
95204d
+fi
95204d
+
95204d
+while getopts ":d:n:" o; do
95204d
+    case "$o" in
95204d
+    d) DEV="$OPTARG";;
95204d
+    n) NAME="$OPTARG";;
95204d
+    *) usage;;
95204d
+    esac
95204d
+done
95204d
+
95204d
+if [ -z "$DEV" ]; then
95204d
+    echo "Did not specify a device!" >&2
95204d
+    usage
95204d
+fi
95204d
+
95204d
+if ! cryptsetup isLuks "$DEV"; then
95204d
+    echo "$DEV is not a LUKS device!" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+NAME="${NAME:-luks-"$(cryptsetup luksUUID "$DEV")"}"
95204d
+
95204d
+if ! pt=$(clevis_luks_unlock_device "${DEV}"); then
95204d
+    echo "${DEV} could not be opened." >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+cryptsetup open -d- "${DEV}" "${NAME}" < <(echo -n "${pt}")
95204d
diff --git a/src/luks/clevis-luks-unlock.in b/src/luks/clevis-luks-unlock.in
95204d
deleted file mode 100755
95204d
index aa3134b..0000000
95204d
--- a/src/luks/clevis-luks-unlock.in
95204d
+++ /dev/null
95204d
@@ -1,130 +0,0 @@
95204d
-#!/bin/bash -e
95204d
-# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
95204d
-#
95204d
-# Copyright (c) 2016 Red Hat, Inc.
95204d
-# Author: Nathaniel McCallum <npmccallum@redhat.com>
95204d
-#
95204d
-# This program is free software: you can redistribute it and/or modify
95204d
-# it under the terms of the GNU General Public License as published by
95204d
-# the Free Software Foundation, either version 3 of the License, or
95204d
-# (at your option) any later version.
95204d
-#
95204d
-# This program is distributed in the hope that it will be useful,
95204d
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
95204d
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
95204d
-# GNU General Public License for more details.
95204d
-#
95204d
-# You should have received a copy of the GNU General Public License
95204d
-# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
95204d
-#
95204d
-
95204d
-SUMMARY="Unlocks a LUKS volume"
95204d
-UUID=cb6e8904-81ff-40da-a84a-07ab9ab5715e
95204d
-
95204d
-# We require cryptsetup >= 2.0.4 to fully support LUKSv2.
95204d
-# Support is determined at build time.
95204d
-function luks2_supported() {
95204d
-    return @OLD_CRYPTSETUP@
95204d
-}
95204d
-
95204d
-function usage() {
95204d
-    exec >&2
95204d
-    echo
95204d
-    echo "Usage: clevis luks unlock -d DEV [-n NAME]"
95204d
-    echo
95204d
-    echo "$SUMMARY":
95204d
-    echo
95204d
-    echo "  -d DEV  The LUKS device on which to perform unlocking"
95204d
-    echo
95204d
-    echo "  -n NAME The name of the unlocked device node"
95204d
-    echo
95204d
-    exit 2
95204d
-}
95204d
-
95204d
-if [ $# -eq 1 ] && [ "$1" == "--summary" ]; then
95204d
-    echo "$SUMMARY"
95204d
-    exit 0
95204d
-fi
95204d
-
95204d
-while getopts ":d:n:" o; do
95204d
-    case "$o" in
95204d
-    d) DEV="$OPTARG";;
95204d
-    n) NAME="$OPTARG";;
95204d
-    *) usage;;
95204d
-    esac
95204d
-done
95204d
-
95204d
-if [ -z "$DEV" ]; then
95204d
-    echo "Did not specify a device!" >&2
95204d
-    usage
95204d
-fi
95204d
-
95204d
-if ! cryptsetup isLuks "$DEV"; then
95204d
-    echo "$DEV is not a LUKS device!" >&2
95204d
-    exit 1
95204d
-fi
95204d
-
95204d
-if luks2_supported; then
95204d
-    if cryptsetup isLuks --type luks1 "$DEV"; then
95204d
-        luks_type="luks1"
95204d
-    elif cryptsetup isLuks --type luks2 "$DEV";then
95204d
-        luks_type="luks2"
95204d
-    else
95204d
-        echo "$DEV is not a supported LUKS device!" >&2
95204d
-        exit 1
95204d
-    fi
95204d
-else
95204d
-    luks_type="luks1"
95204d
-fi
95204d
-NAME="${NAME:-luks-"$(cryptsetup luksUUID "$DEV")"}"
95204d
-
95204d
-luks1_decrypt() {
95204d
-    luksmeta load "$@" \
95204d
-        | clevis decrypt
95204d
-
95204d
-    local rc
95204d
-    for rc in "${PIPESTATUS[@]}"; do
95204d
-        [ $rc -eq 0 ] || return $rc
95204d
-    done
95204d
-    return 0
95204d
-}
95204d
-
95204d
-luks2_decrypt() {
95204d
-    # jose jwe fmt -c outputs extra \n, so clean it up
95204d
-    cryptsetup token export "$@" \
95204d
-        | jose fmt -j- -Og jwe -o- \
95204d
-        | jose jwe fmt -i- -c \
95204d
-        | tr -d '\n' \
95204d
-        | clevis decrypt
95204d
-
95204d
-    local rc
95204d
-    for rc in "${PIPESTATUS[@]}"; do
95204d
-        [ $rc -eq 0 ] || return $rc
95204d
-    done
95204d
-    return 0
95204d
-}
95204d
-
95204d
-if [ "$luks_type" == "luks1" ]; then
95204d
-    while read -r slot state uuid; do
95204d
-        [ "$state" == "active" ] || continue
95204d
-        [ "$uuid" == "$UUID" ] || continue
95204d
-
95204d
-        pt="$(luks1_decrypt -d $DEV -s $slot -u $UUID)" \
95204d
-            || continue
95204d
-        exec cryptsetup open -d- "$DEV" "$NAME" < <(
95204d
-            echo -n "$pt"
95204d
-        )
95204d
-    done < <(luksmeta show -d "$DEV")
95204d
-
95204d
-elif [ "$luks_type" == "luks2" ]; then
95204d
-    while read -r id; do
95204d
-        pt="$(luks2_decrypt --token-id "$id" "$DEV")" \
95204d
-            || continue
95204d
-        exec cryptsetup open -d- "$DEV" "$NAME" < <(
95204d
-            echo -n "$pt"
95204d
-        )
95204d
-    done < <(cryptsetup luksDump "$DEV" | sed -rn 's|^\s+([0-9]+): clevis|\1|p')
95204d
-fi
95204d
-
95204d
-echo "$DEV could not be opened." >&2
95204d
-exit 1
95204d
diff --git a/src/luks/meson.build b/src/luks/meson.build
95204d
index bbba63f..0d24f8d 100644
95204d
--- a/src/luks/meson.build
95204d
+++ b/src/luks/meson.build
95204d
@@ -21,9 +21,7 @@ clevis_luks_bind = configure_file(input: 'clevis-luks-bind.in',
95204d
 clevis_luks_unbind = configure_file(input: 'clevis-luks-unbind.in',
95204d
                output: 'clevis-luks-unbind',
95204d
                configuration: luksmeta_data)
95204d
-clevis_luks_unlock = configure_file(input: 'clevis-luks-unlock.in',
95204d
-               output: 'clevis-luks-unlock',
95204d
-               configuration: luksmeta_data)
95204d
+
95204d
 if libcryptsetup.found() and luksmeta.found() and pwmake.found()
95204d
   subdir('systemd')
95204d
   subdir('udisks2')
95204d
@@ -31,18 +29,18 @@ if libcryptsetup.found() and luksmeta.found() and pwmake.found()
95204d
   bins += clevis_luks_unbind
95204d
   mans += join_paths(meson.current_source_dir(), 'clevis-luks-unbind.1')
95204d
 
95204d
-  bins += clevis_luks_unlock
95204d
-  mans += join_paths(meson.current_source_dir(), 'clevis-luks-unlock.1')
95204d
-
95204d
   bins += clevis_luks_bind
95204d
   mans += join_paths(meson.current_source_dir(), 'clevis-luks-bind.1')
95204d
 
95204d
   mans += join_paths(meson.current_source_dir(), 'clevis-luks-unlockers.7')
95204d
 
95204d
   bins += join_paths(meson.current_source_dir(), 'clevis-luks-common-functions')
95204d
+
95204d
   bins += join_paths(meson.current_source_dir(), 'clevis-luks-list')
95204d
   mans += join_paths(meson.current_source_dir(), 'clevis-luks-list.1')
95204d
 
95204d
+  bins += join_paths(meson.current_source_dir(), 'clevis-luks-unlock')
95204d
+  mans += join_paths(meson.current_source_dir(), 'clevis-luks-unlock.1')
95204d
 else
95204d
   warning('Will not install LUKS support due to missing dependencies!')
95204d
 endif
95204d
diff --git a/src/luks/tests/meson.build b/src/luks/tests/meson.build
95204d
index 2e0fb92..9a16b42 100644
95204d
--- a/src/luks/tests/meson.build
95204d
+++ b/src/luks/tests/meson.build
95204d
@@ -1,6 +1,30 @@
95204d
 # We use jq for comparing the pin config in the clevis luks list tests.
95204d
 jq = find_program('jq', required: false)
95204d
 
95204d
+# we use systemd-socket-activate for running test tang servers.
95204d
+actv = find_program(
95204d
+  'systemd-socket-activate',
95204d
+  'systemd-activate',
95204d
+  required: false
95204d
+)
95204d
+
95204d
+kgen = find_program(
95204d
+  join_paths(libexecdir, 'tangd-keygen'),
95204d
+  join_paths(get_option('prefix'), get_option('libdir'), 'tangd-keygen'),
95204d
+  join_paths(get_option('prefix'), get_option('libexecdir'), 'tangd-keygen'),
95204d
+  join_paths('/', 'usr', get_option('libdir'), 'tangd-keygen'),
95204d
+  join_paths('/', 'usr', get_option('libexecdir'), 'tangd-keygen'),
95204d
+  required: false
95204d
+)
95204d
+tang = find_program(
95204d
+  join_paths(libexecdir, 'tangd'),
95204d
+  join_paths(get_option('prefix'), get_option('libdir'), 'tangd'),
95204d
+  join_paths(get_option('prefix'), get_option('libexecdir'), 'tangd'),
95204d
+  join_paths('/', 'usr', get_option('libdir'), 'tangd'),
95204d
+  join_paths('/', 'usr', get_option('libexecdir'), 'tangd'),
95204d
+  required: false
95204d
+)
95204d
+
95204d
 common_functions = configure_file(input: 'tests-common-functions.in',
95204d
   output: 'tests-common-functions',
95204d
   configuration: luksmeta_data,
95204d
@@ -24,6 +48,14 @@ env.prepend('PATH',
95204d
   separator: ':'
95204d
 )
95204d
 
95204d
+has_tang = false
95204d
+if actv.found() and kgen.found() and tang.found()
95204d
+  has_tang = true
95204d
+  env.set('SD_ACTIVATE', actv.path())
95204d
+  env.set('TANGD_KEYGEN', kgen.path())
95204d
+  env.set('TANGD', tang.path())
95204d
+endif
95204d
+
95204d
 test('bind-wrong-pass-luks1', find_program('bind-wrong-pass-luks1'), env: env)
95204d
 test('bind-luks1', find_program('bind-luks1'), env: env)
95204d
 test('unbind-unbound-slot-luks1', find_program('unbind-unbound-slot-luks1'), env: env)
95204d
@@ -42,6 +74,10 @@ else
95204d
   warning('Will not run "clevis luks list" tests due to missing jq dependency')
95204d
 endif
95204d
 
95204d
+if has_tang
95204d
+  test('unlock-tang-luks1', find_program('unlock-tang-luks1'), env: env, timeout: 90)
95204d
+endif
95204d
+
95204d
 # LUKS2 tests go here, and they get included if we get support for it, based
95204d
 # on the cryptsetup version.
95204d
 # Binding LUKS2 takes longer, so timeout is increased for a few tests.
95204d
@@ -56,4 +92,8 @@ if luksmeta_data.get('OLD_CRYPTSETUP') == '0'
95204d
     test('list-tang-luks2', find_program('list-tang-luks2'), env: env, timeout: 60)
95204d
     test('list-sss-tang-luks2', find_program('list-sss-tang-luks2'), env: env, timeout: 60)
95204d
   endif
95204d
+
95204d
+  if has_tang
95204d
+    test('unlock-tang-luks2', find_program('unlock-tang-luks2'), env: env, timeout: 120)
95204d
+  endif
95204d
 endif
95204d
diff --git a/src/luks/tests/tests-common-functions.in b/src/luks/tests/tests-common-functions.in
95204d
index 90420d1..7b3fdad 100755
95204d
--- a/src/luks/tests/tests-common-functions.in
95204d
+++ b/src/luks/tests/tests-common-functions.in
95204d
@@ -56,7 +56,7 @@ new_device() {
95204d
 
95204d
     # Some builders fail if the cryptsetup steps are not ran as root, so let's
95204d
     # skip the test now if not running as root.
95204d
-    if [ $(id -u) != 0 ]; then
95204d
+    if [ "$(id -u)" != 0 ]; then
95204d
         skip_test "WARNING: You must be root to run this test; test skipped."
95204d
     fi
95204d
 
95204d
@@ -74,9 +74,9 @@ new_device() {
95204d
         return 0
95204d
     fi
95204d
 
95204d
-    fallocate -l16M "${DEV}"
95204d
-    local extra_options='--pbkdf pbkdf2 --pbkdf-force-iterations 1000'
95204d
-    cryptsetup luksFormat --type "${LUKS}" ${extra_options} --batch-mode \
95204d
+    fallocate -l64M "${DEV}"
95204d
+    cryptsetup luksFormat --type "${LUKS}" --pbkdf pbkdf2 \
95204d
+        --pbkdf-force-iterations 1000 --batch-mode \
95204d
         --force-password "${DEV}" <<< "${PASS}"
95204d
     # Caching the just-formatted device for possible reuse.
95204d
     cp -f "${DEV}" "${DEV_CACHED}"
95204d
@@ -90,7 +90,7 @@ new_device_keyfile() {
95204d
 
95204d
     # Some builders fail if the cryptsetup steps are not ran as root, so let's
95204d
     # skip the test now if not running as root.
95204d
-    if [ $(id -u) != 0 ]; then
95204d
+    if [ "$(id -u)" != 0 ]; then
95204d
         skip_test "WARNING: You must be root to run this test; test skipped."
95204d
     fi
95204d
 
95204d
@@ -98,9 +98,9 @@ new_device_keyfile() {
95204d
         error "Invalid keyfile (${KEYFILE})."
95204d
     fi
95204d
 
95204d
-    fallocate -l16M "${DEV}"
95204d
-    local extra_options='--pbkdf pbkdf2 --pbkdf-force-iterations 1000'
95204d
-    cryptsetup luksFormat --type "${LUKS}"  ${extra_options} --batch-mode \
95204d
+    fallocate -l64M "${DEV}"
95204d
+    cryptsetup luksFormat --type "${LUKS}" --pbkdf pbkdf2 \
95204d
+        --pbkdf-force-iterations 1000 --batch-mode \
95204d
         "${DEV}" "${KEYFILE}"
95204d
 }
95204d
 
95204d
@@ -112,4 +112,122 @@ pin_cfg_equal() {
95204d
          <(jq -S . < <(echo -n "${cfg2}"))
95204d
 }
95204d
 
95204d
+# Get a random port to be used with a test tang server.
95204d
+get_random_port() {
95204d
+    shuf -i 1024-65535 -n 1
95204d
+}
95204d
+
95204d
+# Removes tang rotated keys from the test server.
95204d
+tang_remove_rotated_keys() {
95204d
+    local basedir="${1}"
95204d
+
95204d
+    if [ -z "${basedir}" ]; then
95204d
+        echo "Please pass a valid base directory for tang"
95204d
+        return 1
95204d
+    fi
95204d
+
95204d
+    local db="${basedir}/db"
95204d
+    mkdir -p "${db}"
95204d
+
95204d
+    pushd "${db}"
95204d
+        find . -name ".*.jwk" -exec rm -f {} \;
95204d
+    popd
95204d
+}
95204d
+
95204d
+# Creates new keys for the test tang server.
95204d
+tang_new_keys() {
95204d
+    local basedir="${1}"
95204d
+    local rotate="${2}"
95204d
+
95204d
+    if [ -z "${basedir}" ]; then
95204d
+        echo "Please pass a valid base directory for tang"
95204d
+        return 1
95204d
+    fi
95204d
+
95204d
+    [ -z "${TANGD_KEYGEN}" ] && skip_test "WARNING: TANGD_KEYGEN is not defined."
95204d
+
95204d
+    local db="${basedir}/db"
95204d
+    mkdir -p "${db}"
95204d
+
95204d
+    if [ -n "${rotate}" ]; then
95204d
+        pushd "${db}"
95204d
+            local k
95204d
+            k=$(find . -name "*.jwk" | wc -l)
95204d
+            if [ "${k}" -gt 0 ]; then
95204d
+                for k in *.jwk; do
95204d
+                    mv -f -- "${k}" ".${k}"
95204d
+                done
95204d
+            fi
95204d
+        popd
95204d
+    fi
95204d
+
95204d
+    "${TANGD_KEYGEN}" "${db}"
95204d
+
95204d
+    return 0
95204d
+}
95204d
+
95204d
+# Start a test tang server.
95204d
+tang_run() {
95204d
+    local basedir="${1}"
95204d
+    local port="${2}"
95204d
+
95204d
+    if [ -z "${basedir}" ]; then
95204d
+        echo "Please pass a valid base directory for tang" >&2
95204d
+        return 1
95204d
+    fi
95204d
+
95204d
+    if [ -z "${port}" ]; then
95204d
+        echo "Please pass a valid port for tang" >&2
95204d
+        return 1
95204d
+    fi
95204d
+
95204d
+    if ! tang_new_keys "${basedir}"; then
95204d
+        echo "Error creating new keys for tang server" >&2
95204d
+        return 1
95204d
+    fi
95204d
+
95204d
+    local KEYS="${basedir}/db"
95204d
+
95204d
+    local inetd='--inetd'
95204d
+    [ "${SD_ACTIVATE##*/}" = "systemd-activate" ] && inetd=
95204d
+
95204d
+    local pid pidfile
95204d
+    pidfile="${basedir}/tang.pid"
95204d
+
95204d
+    "${SD_ACTIVATE}" ${inetd} -l "${TANG_HOST}":"${port}" \
95204d
+            -a "${TANGD}" "${KEYS}" &
95204d
+    pid=$!
95204d
+    echo "${pid}" > "${pidfile}"
95204d
+}
95204d
+
95204d
+# Stop tang server.
95204d
+tang_stop() {
95204d
+    local basedir="${1}"
95204d
+    local pidfile="${basedir}/tang.pid"
95204d
+    [ -f "${pidfile}" ] || return 0
95204d
+
95204d
+    local pid
95204d
+    pid=$(<"${pidfile}")
95204d
+    kill "${pid}"
95204d
+}
95204d
+
95204d
+# Wait for the tang server to be operational.
95204d
+tang_wait_until_ready() {
95204d
+   local port="${1}"
95204d
+   while ! curl --output /dev/null --silent --fail \
95204d
+                http://"${TANG_HOST}":"${port}"/adv; do
95204d
+       sleep 0.1
95204d
+       echo -n . >&2
95204d
+   done
95204d
+}
95204d
+
95204d
+# Get tang advertisement.
95204d
+tang_get_adv() {
95204d
+    local port="${1}"
95204d
+    local adv="${2}"
95204d
+
95204d
+    curl -o "${adv}" http://"${TANG_HOST}":"${port}"/adv
95204d
+}
95204d
+
95204d
+export TANG_HOST=127.0.0.1
95204d
 export DEFAULT_PASS='just-some-test-password-here'
95204d
diff --git a/src/luks/tests/unlock-tang-luks1 b/src/luks/tests/unlock-tang-luks1
95204d
new file mode 100755
95204d
index 0000000..841ba01
95204d
--- /dev/null
95204d
+++ b/src/luks/tests/unlock-tang-luks1
95204d
@@ -0,0 +1,83 @@
95204d
+#!/bin/bash -ex
95204d
+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
95204d
+#
95204d
+# Copyright (c) 2020 Red Hat, Inc.
95204d
+# Author: Sergio Correia <scorreia@redhat.com>
95204d
+#
95204d
+# This program is free software: you can redistribute it and/or modify
95204d
+# it under the terms of the GNU General Public License as published by
95204d
+# the Free Software Foundation, either version 3 of the License, or
95204d
+# (at your option) any later version.
95204d
+#
95204d
+# This program is distributed in the hope that it will be useful,
95204d
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
95204d
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
95204d
+# GNU General Public License for more details.
95204d
+#
95204d
+# You should have received a copy of the GNU General Public License
95204d
+# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
95204d
+
95204d
+TEST=$(basename "${0}")
95204d
+. tests-common-functions
95204d
+
95204d
+. clevis-luks-common-functions
95204d
+
95204d
+on_exit() {
95204d
+    [ ! -d "${TMP}" ] && return 0
95204d
+    tang_stop "${TMP}"
95204d
+    rm -rf "${TMP}"
95204d
+}
95204d
+
95204d
+trap 'on_exit' EXIT
95204d
+trap 'on_exit' ERR
95204d
+
95204d
+TMP="$(mktemp -d)"
95204d
+
95204d
+port=$(get_random_port)
95204d
+tang_run "${TMP}" "${port}" &
95204d
+tang_wait_until_ready "${port}"
95204d
+
95204d
+url="http://${TANG_HOST}:${port}"
95204d
+adv="${TMP}/adv"
95204d
+tang_get_adv "${port}" "${adv}"
95204d
+
95204d
+cfg=$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv")
95204d
+
95204d
+# LUKS1.
95204d
+DEV="${TMP}/luks1-device"
95204d
+new_device "luks1" "${DEV}"
95204d
+
95204d
+if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
95204d
+    error "${TEST}: Bind should have succeeded."
95204d
+fi
95204d
+
95204d
+if ! clevis_luks_unlock_device "${DEV}"; then
95204d
+    error "${TEST}: we were unable to unlock ${DEV}."
95204d
+fi
95204d
+
95204d
+# Let's rotate the tang keys and add another binding with the new key.
95204d
+tang_new_keys "${TMP}" "rotate-keys"
95204d
+
95204d
+# Unlock should still work now.
95204d
+if ! clevis_luks_unlock_device "${DEV}"; then
95204d
+    error "${TEST}: we should still be able to unlock ${DEV}"
95204d
+fi
95204d
+
95204d
+# Now let's remove the rotated keys.
95204d
+tang_remove_rotated_keys "${TMP}"
95204d
+
95204d
+# Unlock should not work anymore.
95204d
+if clevis_luks_unlock_device "${DEV}"; then
95204d
+    error "${TEST}: we should not be able to unlock ${DEV}"
95204d
+fi
95204d
+
95204d
+# Now let's add another binding with the new keys.
95204d
+tang_get_adv "${port}" "${adv}" # Updating the advertisement.
95204d
+if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
95204d
+    error "${TEST}: Bind should have succeeded."
95204d
+fi
95204d
+
95204d
+# Unlock should work again, using the new keys.
95204d
+if ! clevis_luks_unlock_device "${DEV}"; then
95204d
+    error "${TEST}: we should be able to unlock ${DEV} with the new keys"
95204d
+fi
95204d
diff --git a/src/luks/tests/unlock-tang-luks2 b/src/luks/tests/unlock-tang-luks2
95204d
new file mode 100755
95204d
index 0000000..81822fb
95204d
--- /dev/null
95204d
+++ b/src/luks/tests/unlock-tang-luks2
95204d
@@ -0,0 +1,83 @@
95204d
+#!/bin/bash -ex
95204d
+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
95204d
+#
95204d
+# Copyright (c) 2020 Red Hat, Inc.
95204d
+# Author: Sergio Correia <scorreia@redhat.com>
95204d
+#
95204d
+# This program is free software: you can redistribute it and/or modify
95204d
+# it under the terms of the GNU General Public License as published by
95204d
+# the Free Software Foundation, either version 3 of the License, or
95204d
+# (at your option) any later version.
95204d
+#
95204d
+# This program is distributed in the hope that it will be useful,
95204d
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
95204d
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
95204d
+# GNU General Public License for more details.
95204d
+#
95204d
+# You should have received a copy of the GNU General Public License
95204d
+# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
95204d
+
95204d
+TEST=$(basename "${0}")
95204d
+. tests-common-functions
95204d
+
95204d
+. clevis-luks-common-functions
95204d
+
95204d
+on_exit() {
95204d
+    [ ! -d "${TMP}" ] && return 0
95204d
+    tang_stop "${TMP}"
95204d
+    rm -rf "${TMP}"
95204d
+}
95204d
+
95204d
+trap 'on_exit' EXIT
95204d
+trap 'on_exit' ERR
95204d
+
95204d
+TMP="$(mktemp -d)"
95204d
+
95204d
+port=$(get_random_port)
95204d
+tang_run "${TMP}" "${port}" &
95204d
+tang_wait_until_ready "${port}"
95204d
+
95204d
+url="http://${TANG_HOST}:${port}"
95204d
+adv="${TMP}/adv"
95204d
+tang_get_adv "${port}" "${adv}"
95204d
+
95204d
+cfg=$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv")
95204d
+
95204d
+# LUKS2.
95204d
+DEV="${TMP}/luks2-device"
95204d
+new_device "luks2" "${DEV}"
95204d
+
95204d
+if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
95204d
+    error "${TEST}: Bind should have succeeded."
95204d
+fi
95204d
+
95204d
+if ! clevis_luks_unlock_device "${DEV}"; then
95204d
+    error "${TEST}: we were unable to unlock ${DEV}."
95204d
+fi
95204d
+
95204d
+# Let's rotate the tang keys and add another binding with the new key.
95204d
+tang_new_keys "${TMP}" "rotate-keys"
95204d
+
95204d
+# Unlock should still work now.
95204d
+if ! clevis_luks_unlock_device "${DEV}"; then
95204d
+    error "${TEST}: we should still be able to unlock ${DEV}"
95204d
+fi
95204d
+
95204d
+# Now let's remove the rotated keys.
95204d
+tang_remove_rotated_keys "${TMP}"
95204d
+
95204d
+# Unlock should not work anymore.
95204d
+if clevis_luks_unlock_device "${DEV}"; then
95204d
+    error "${TEST}: we should not be able to unlock ${DEV}"
95204d
+fi
95204d
+
95204d
+# Now let's add another binding with the new keys.
95204d
+tang_get_adv "${port}" "${adv}" # Updating the advertisement.
95204d
+if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
95204d
+    error "${TEST}: Bind should have succeeded."
95204d
+fi
95204d
+
95204d
+# Unlock should work again, using the new keys.
95204d
+if ! clevis_luks_unlock_device "${DEV}"; then
95204d
+    error "${TEST}: we should be able to unlock ${DEV} with the new keys"
95204d
+fi
95204d
-- 
95204d
2.18.4
95204d