Blame SOURCES/0005-Add-the-option-to-extract-luks-passphrase-used-for-b.patch

95204d
From e3641a7193adac1cea525c093f39679c2cfa22c9 Mon Sep 17 00:00:00 2001
566fbd
From: Sergio Correia <scorreia@redhat.com>
95204d
Date: Wed, 13 May 2020 23:53:38 -0300
95204d
Subject: [PATCH 5/8] Add the option to extract luks passphrase used for
95204d
 binding
566fbd
566fbd
Usage:
566fbd
566fbd
clevis luks pass -d /dev/sda1 -s 1
566fbd
<passphrase here="">
566fbd
---
566fbd
 src/luks/clevis-luks-pass        | 69 +++++++++++++++++++++++++++++
566fbd
 src/luks/clevis-luks-pass.1.adoc | 43 ++++++++++++++++++
566fbd
 src/luks/meson.build             |  3 ++
566fbd
 src/luks/tests/meson.build       | 11 +++++
566fbd
 src/luks/tests/pass-tang-luks1   | 75 ++++++++++++++++++++++++++++++++
566fbd
 src/luks/tests/pass-tang-luks2   | 75 ++++++++++++++++++++++++++++++++
566fbd
 6 files changed, 276 insertions(+)
566fbd
 create mode 100755 src/luks/clevis-luks-pass
566fbd
 create mode 100644 src/luks/clevis-luks-pass.1.adoc
566fbd
 create mode 100755 src/luks/tests/pass-tang-luks1
566fbd
 create mode 100755 src/luks/tests/pass-tang-luks2
566fbd
566fbd
diff --git a/src/luks/clevis-luks-pass b/src/luks/clevis-luks-pass
566fbd
new file mode 100755
566fbd
index 0000000..1ce8c4c
566fbd
--- /dev/null
566fbd
+++ b/src/luks/clevis-luks-pass
566fbd
@@ -0,0 +1,69 @@
566fbd
+#!/bin/bash -e
566fbd
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
566fbd
+#
566fbd
+# Copyright (c) 2019 Red Hat, Inc.
566fbd
+# Author: Sergio Correia <scorreia@redhat.com> - LUKS2 support.
566fbd
+#
566fbd
+# This program is free software: you can redistribute it and/or modify
566fbd
+# it under the terms of the GNU General Public License as published by
566fbd
+# the Free Software Foundation, either version 3 of the License, or
566fbd
+# (at your option) any later version.
566fbd
+#
566fbd
+# This program is distributed in the hope that it will be useful,
566fbd
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
566fbd
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
566fbd
+# GNU General Public License for more details.
566fbd
+#
566fbd
+# You should have received a copy of the GNU General Public License
566fbd
+# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
566fbd
+#
566fbd
+
566fbd
+. clevis-luks-common-functions
566fbd
+
566fbd
+SUMMARY="Returns the LUKS passphrase used for binding a particular slot."
566fbd
+
566fbd
+function usage() {
566fbd
+    echo >&2
566fbd
+    echo "Usage: clevis luks pass -d DEV -s SLT" >&2
566fbd
+    echo >&2
566fbd
+    echo "$SUMMARY": >&2
566fbd
+    echo >&2
566fbd
+    echo "  -d DEV  The LUKS device to extract the LUKS passphrase used for binding" >&2
566fbd
+    echo >&2
566fbd
+    echo "  -s SLOT The slot number to extract the LUKS passphrase" >&2
566fbd
+    echo >&2
566fbd
+    exit 1
566fbd
+}
566fbd
+
566fbd
+if [ ${#} -eq 1 ] && [ "${1}" = "--summary" ]; then
566fbd
+    echo "${SUMMARY}"
566fbd
+    exit 0
566fbd
+fi
566fbd
+
566fbd
+while getopts ":d:s:" o; do
566fbd
+    case "$o" in
566fbd
+    d) DEV=${OPTARG};;
566fbd
+    s) SLT=${OPTARG};;
566fbd
+    *) usage;;
566fbd
+    esac
566fbd
+done
566fbd
+
566fbd
+if [ -z "${DEV}" ]; then
566fbd
+    echo "Did not specify a device!" >&2
566fbd
+    usage
566fbd
+fi
566fbd
+
566fbd
+if [ -z "${SLT}" ]; then
566fbd
+    echo "Did not specify a slot!" >&2
566fbd
+    usage
566fbd
+fi
566fbd
+
566fbd
+if ! jwe=$(clevis_luks_read_slot "${DEV}" "${SLT}" 2>/dev/null); then
566fbd
+    echo "It was not possible to read slot ${SLT} from ${DEV}!" >&2
566fbd
+    exit 1
566fbd
+fi
566fbd
+
566fbd
+if ! clevis decrypt < <(echo -n "${jwe}"); then
566fbd
+    echo "It was not possible to decrypt the passphrase associated to slot ${SLT} in {DEV}!" >&2
566fbd
+    exit 1
566fbd
+fi
566fbd
diff --git a/src/luks/clevis-luks-pass.1.adoc b/src/luks/clevis-luks-pass.1.adoc
566fbd
new file mode 100644
566fbd
index 0000000..fa9526a
566fbd
--- /dev/null
566fbd
+++ b/src/luks/clevis-luks-pass.1.adoc
566fbd
@@ -0,0 +1,43 @@
566fbd
+CLEVIS-LUKS-PASS(1)
566fbd
+===================
566fbd
+:doctype: manpage
566fbd
+
566fbd
+
566fbd
+== NAME
566fbd
+
566fbd
+clevis-luks-pass - Extracts the passphrase used for binding a particular slot in a LUKS device
566fbd
+
566fbd
+== SYNOPSIS
566fbd
+
566fbd
+*clevis luks pass* -d DEV -s SLT
566fbd
+
566fbd
+== OVERVIEW
566fbd
+
566fbd
+The *clevis luks pass* command extracts the passphrase used for binding a particular slot in a LUKS device.
566fbd
+For example:
566fbd
+
566fbd
+    clevis luks pass -d /dev/sda1 -s 1
566fbd
+
566fbd
+== OPTIONS
566fbd
+
566fbd
+* *-d* _DEV_ :
566fbd
+  The LUKS device on which to extract a passphrase from
566fbd
+
566fbd
+* *-s* _SLT_ :
566fbd
+  The slot to use for extracting the passphrase
566fbd
+
566fbd
+== EXAMPLE
566fbd
+
566fbd
+    clevis luks pass -d /dev/sda1 -s 1
566fbd
+    <passphrase here="">
566fbd
+
566fbd
+Note that the output of *clevis luks pass* might be non-printable, in which case it would be better to redirect its output to a file and use it as a key
566fbd
+file together with cryptsetup. For instance:
566fbd
+
566fbd
+    clevis luks pass -d /dev/sda1 -s 1 > slot1-passphrase
566fbd
+
566fbd
+And the file slot1-passphrase will contain the passphrase associated with slot #1 in /dev/sda1.
566fbd
+
566fbd
+== SEE ALSO
566fbd
+
566fbd
+link:clevis-luks-unlock.1.adoc[*clevis-luks-unlock*(1)],
566fbd
diff --git a/src/luks/meson.build b/src/luks/meson.build
95204d
index 0d24f8d..fda2ca8 100644
566fbd
--- a/src/luks/meson.build
566fbd
+++ b/src/luks/meson.build
95204d
@@ -41,6 +41,9 @@ if libcryptsetup.found() and luksmeta.found() and pwmake.found()
566fbd
 
95204d
   bins += join_paths(meson.current_source_dir(), 'clevis-luks-unlock')
95204d
   mans += join_paths(meson.current_source_dir(), 'clevis-luks-unlock.1')
95204d
+
566fbd
+  bins += join_paths(meson.current_source_dir(), 'clevis-luks-pass')
566fbd
+  mans += join_paths(meson.current_source_dir(), 'clevis-luks-pass.1')
95204d
 else
95204d
   warning('Will not install LUKS support due to missing dependencies!')
95204d
 endif
566fbd
diff --git a/src/luks/tests/meson.build b/src/luks/tests/meson.build
95204d
index 9a16b42..4757c4b 100644
566fbd
--- a/src/luks/tests/meson.build
566fbd
+++ b/src/luks/tests/meson.build
566fbd
@@ -1,3 +1,9 @@
566fbd
+actv = find_program(
566fbd
+  'systemd-socket-activate',
566fbd
+  'systemd-activate',
566fbd
+  required: false
566fbd
+)
566fbd
+
566fbd
 # We use jq for comparing the pin config in the clevis luks list tests.
566fbd
 jq = find_program('jq', required: false)
566fbd
 
95204d
@@ -45,8 +51,11 @@ env.prepend('PATH',
566fbd
   join_paths(meson.build_root(), 'src', 'pins', 'sss'),
566fbd
   join_paths(meson.build_root(), 'src', 'pins', 'tang'),
566fbd
   join_paths(meson.build_root(), 'src', 'pins', 'tpm2'),
566fbd
+  libexecdir,
566fbd
+  '/usr/libexec',
566fbd
   separator: ':'
566fbd
 )
566fbd
+env.set('SD_ACTIVATE', actv.path())
566fbd
 
95204d
 has_tang = false
95204d
 if actv.found() and kgen.found() and tang.found()
95204d
@@ -77,6 +86,7 @@ endif
95204d
 if has_tang
95204d
   test('unlock-tang-luks1', find_program('unlock-tang-luks1'), env: env, timeout: 90)
566fbd
 endif
566fbd
+test('pass-tang-luks1', find_program('pass-tang-luks1'), env: env)
566fbd
 
566fbd
 # LUKS2 tests go here, and they get included if we get support for it, based
566fbd
 # on the cryptsetup version.
95204d
@@ -96,4 +106,5 @@ if luksmeta_data.get('OLD_CRYPTSETUP') == '0'
95204d
   if has_tang
95204d
     test('unlock-tang-luks2', find_program('unlock-tang-luks2'), env: env, timeout: 120)
95204d
   endif
95204d
+  test('pass-tang-luks2', find_program('pass-tang-luks2'), env: env, timeout: 60)
566fbd
 endif
566fbd
diff --git a/src/luks/tests/pass-tang-luks1 b/src/luks/tests/pass-tang-luks1
566fbd
new file mode 100755
566fbd
index 0000000..05cdb3e
566fbd
--- /dev/null
566fbd
+++ b/src/luks/tests/pass-tang-luks1
566fbd
@@ -0,0 +1,75 @@
566fbd
+#!/bin/bash -x
566fbd
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
566fbd
+#
566fbd
+# Copyright (c) 2019 Red Hat, Inc.
566fbd
+# Author: Sergio Correia <scorreia@redhat.com>
566fbd
+#
566fbd
+# This program is free software: you can redistribute it and/or modify
566fbd
+# it under the terms of the GNU General Public License as published by
566fbd
+# the Free Software Foundation, either version 3 of the License, or
566fbd
+# (at your option) any later version.
566fbd
+#
566fbd
+# This program is distributed in the hope that it will be useful,
566fbd
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
566fbd
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
566fbd
+# GNU General Public License for more details.
566fbd
+#
566fbd
+# You should have received a copy of the GNU General Public License
566fbd
+# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
566fbd
+#
566fbd
+
566fbd
+TEST="${0}"
566fbd
+. tests-common-functions
566fbd
+
566fbd
+function on_exit() {
566fbd
+    if [ "$PID" ]; then kill $PID; wait $PID || true; fi
566fbd
+    [ -d "$TMP" ] && rm -rf $TMP
566fbd
+}
566fbd
+
566fbd
+trap 'on_exit' EXIT
566fbd
+trap 'exit' ERR
566fbd
+
566fbd
+export TMP=$(mktemp -d)
566fbd
+mkdir -p "${TMP}/db"
566fbd
+
566fbd
+# Generate the server keys
566fbd
+KEYS="$TMP/db"
566fbd
+tangd-keygen $TMP/db sig exc
566fbd
+if which tangd-update; then
566fbd
+    mkdir -p "${TMP}/cache"
566fbd
+    tangd-update "${TMP}/db" "${TMP}/cache"
566fbd
+    KEYS="${TMP}/cache"
566fbd
+fi
566fbd
+
566fbd
+# Start the server.
566fbd
+port=$(shuf -i 1024-65536 -n 1)
566fbd
+"${SD_ACTIVATE}" --inetd -l 127.0.0.1:"${port}" -a tangd "${KEYS}" &
566fbd
+export PID=$!
566fbd
+sleep 0.25
566fbd
+
566fbd
+url="http://localhost:${port}"
566fbd
+adv="${TMP}/adv"
566fbd
+curl "${url}/adv" -o "${adv}"
566fbd
+
566fbd
+cfg=$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv")
566fbd
+
566fbd
+# LUKS1.
566fbd
+DEV="${TMP}/luks1-device"
566fbd
+new_device "luks1" "${DEV}"
566fbd
+
566fbd
+if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
566fbd
+    error "${TEST}: Bind should have succeeded."
566fbd
+fi
566fbd
+
566fbd
+#Now let's test the passphrase.
566fbd
+SLT=1
566fbd
+PASS=$(clevis luks pass -d "${DEV}" -s "${SLT}")
566fbd
+echo $PASS >&2
566fbd
+if ! cryptsetup luksOpen --test-passphrase ""${DEV} \
566fbd
+        --key-file <(clevis luks pass -d "${DEV}" -s "${SLT}"); then
566fbd
+    error "Passphrase obtained from clevis luks pass failed."
566fbd
+fi
566fbd
+
566fbd
+kill -9 "${PID}"
566fbd
+! wait "${PID}"
566fbd
+unset PID
566fbd
diff --git a/src/luks/tests/pass-tang-luks2 b/src/luks/tests/pass-tang-luks2
566fbd
new file mode 100755
566fbd
index 0000000..9123aa0
566fbd
--- /dev/null
566fbd
+++ b/src/luks/tests/pass-tang-luks2
566fbd
@@ -0,0 +1,75 @@
566fbd
+#!/bin/bash -x
566fbd
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
566fbd
+#
566fbd
+# Copyright (c) 2019 Red Hat, Inc.
566fbd
+# Author: Sergio Correia <scorreia@redhat.com>
566fbd
+#
566fbd
+# This program is free software: you can redistribute it and/or modify
566fbd
+# it under the terms of the GNU General Public License as published by
566fbd
+# the Free Software Foundation, either version 3 of the License, or
566fbd
+# (at your option) any later version.
566fbd
+#
566fbd
+# This program is distributed in the hope that it will be useful,
566fbd
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
566fbd
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
566fbd
+# GNU General Public License for more details.
566fbd
+#
566fbd
+# You should have received a copy of the GNU General Public License
566fbd
+# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
566fbd
+#
566fbd
+
566fbd
+TEST="${0}"
566fbd
+. tests-common-functions
566fbd
+
566fbd
+function on_exit() {
566fbd
+    if [ "$PID" ]; then kill $PID; wait $PID || true; fi
566fbd
+    [ -d "$TMP" ] && rm -rf $TMP
566fbd
+}
566fbd
+
566fbd
+trap 'on_exit' EXIT
566fbd
+trap 'exit' ERR
566fbd
+
566fbd
+export TMP=$(mktemp -d)
566fbd
+mkdir -p "${TMP}/db"
566fbd
+
566fbd
+# Generate the server keys
566fbd
+KEYS="$TMP/db"
566fbd
+tangd-keygen $TMP/db sig exc
566fbd
+if which tangd-update; then
566fbd
+    mkdir -p "${TMP}/cache"
566fbd
+    tangd-update "${TMP}/db" "${TMP}/cache"
566fbd
+    KEYS="${TMP}/cache"
566fbd
+fi
566fbd
+
566fbd
+# Start the server.
566fbd
+port=$(shuf -i 1024-65536 -n 1)
566fbd
+"${SD_ACTIVATE}" --inetd -l 127.0.0.1:"${port}" -a tangd "${KEYS}" &
566fbd
+export PID=$!
566fbd
+sleep 0.25
566fbd
+
566fbd
+url="http://localhost:${port}"
566fbd
+adv="${TMP}/adv"
566fbd
+curl "${url}/adv" -o "${adv}"
566fbd
+
566fbd
+cfg=$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv")
566fbd
+
566fbd
+# LUKS2.
566fbd
+DEV="${TMP}/luks2-device"
566fbd
+new_device "luks2" "${DEV}"
566fbd
+
566fbd
+if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
566fbd
+    error "${TEST}: Bind should have succeeded."
566fbd
+fi
566fbd
+
566fbd
+#Now let's test the passphrase.
566fbd
+SLT=1
566fbd
+PASS=$(clevis luks pass -d "${DEV}" -s "${SLT}")
566fbd
+echo $PASS >&2
566fbd
+if ! cryptsetup luksOpen --test-passphrase ""${DEV} \
566fbd
+        --key-file <(clevis luks pass -d "${DEV}" -s "${SLT}"); then
566fbd
+    error "Passphrase obtained from clevis luks pass failed."
566fbd
+fi
566fbd
+
566fbd
+kill -9 "${PID}"
566fbd
+! wait "${PID}"
566fbd
+unset PID
566fbd
-- 
95204d
2.18.4
566fbd