Blame SOURCES/0007-Add-clevis-luks-report.patch

95204d
From a85f50f789d69d9ca0a4096a64ac912f5967f97f Mon Sep 17 00:00:00 2001
95204d
From: Sergio Correia <scorreia@redhat.com>
95204d
Date: Sun, 10 May 2020 15:32:50 -0300
95204d
Subject: [PATCH 7/8] Add clevis luks report
95204d
95204d
---
95204d
 src/luks/clevis-luks-report         | 95 +++++++++++++++++++++++++++++
95204d
 src/luks/clevis-luks-report-compare | 71 +++++++++++++++++++++
95204d
 src/luks/clevis-luks-report-decode  | 59 ++++++++++++++++++
95204d
 src/luks/clevis-luks-report-sss     | 53 ++++++++++++++++
95204d
 src/luks/clevis-luks-report-tang    | 67 ++++++++++++++++++++
95204d
 src/luks/clevis-luks-report.1.adoc  | 41 +++++++++++++
95204d
 src/luks/meson.build                |  7 +++
95204d
 7 files changed, 393 insertions(+)
95204d
 create mode 100755 src/luks/clevis-luks-report
95204d
 create mode 100755 src/luks/clevis-luks-report-compare
95204d
 create mode 100755 src/luks/clevis-luks-report-decode
95204d
 create mode 100755 src/luks/clevis-luks-report-sss
95204d
 create mode 100755 src/luks/clevis-luks-report-tang
95204d
 create mode 100644 src/luks/clevis-luks-report.1.adoc
95204d
95204d
diff --git a/src/luks/clevis-luks-report b/src/luks/clevis-luks-report
95204d
new file mode 100755
95204d
index 0000000..f047256
95204d
--- /dev/null
95204d
+++ b/src/luks/clevis-luks-report
95204d
@@ -0,0 +1,95 @@
95204d
+#!/usr/bin/bash -e
95204d
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
95204d
+#
95204d
+# Copyright (c) 2018 Red Hat, Inc.
95204d
+# Author: Radovan Sroka <rsroka@redhat.com>
95204d
+#
95204d
+# This program is free software: you can redistribute it and/or modify
95204d
+# it under the terms of the GNU General Public License as published by
95204d
+# the Free Software Foundation, either version 3 of the License, or
95204d
+# (at your option) any later version.
95204d
+#
95204d
+# This program is distributed in the hope that it will be useful,
95204d
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
95204d
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
95204d
+# GNU General Public License for more details.
95204d
+#
95204d
+# You should have received a copy of the GNU General Public License
95204d
+# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
95204d
+#
95204d
+
95204d
+. clevis-luks-common-functions
95204d
+
95204d
+SUMMARY="Report any key rotation on the server side"
95204d
+
95204d
+if [ "$1" == "--summary" ]; then
95204d
+    echo "$SUMMARY"
95204d
+    exit 0
95204d
+fi
95204d
+
95204d
+function usage_and_exit () {
95204d
+    echo >&2
95204d
+    echo "Usage: clevis luks report [-qr] -d DEV -s SLOT" >&2
95204d
+    echo >&2
95204d
+    echo -e "  -q\t Quiet mode" >&2
95204d
+    echo -e "  -r\t Regenerate luks metadata with \"clevis luks regen -d DEV -s SLOT\"" >&2
95204d
+    echo >&2
95204d
+    echo "$SUMMARY" >&2
95204d
+    echo >&2
95204d
+    exit "$1"
95204d
+}
95204d
+
95204d
+while getopts "hd:s:rq" o; do
95204d
+    case "$o" in
95204d
+    d) DEV="$OPTARG";;
95204d
+    h) usage_and_exit 0;;
95204d
+    r) ROPT="regen";;
95204d
+    s) SLT="$OPTARG";;
95204d
+    q) QOPT="quiet";;
95204d
+    *) usage_and_exit 1;;
95204d
+    esac
95204d
+done
95204d
+
95204d
+### get luks metadata
95204d
+
95204d
+if [ -z "$DEV" ]; then
95204d
+    echo "Did not specify a device!" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+if [ -z "$SLT" ]; then
95204d
+    echo "Did not specify a slot!" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+if ! DATA_CODED=$(clevis_luks_read_slot "${DEV}" "${SLT}"); then
95204d
+    # Error message was already displayed by clevis_luks_read_slot(),
95204d
+    # at this point.
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+EXE="$(findexe clevis-luks-report-decode)"
95204d
+RESULT="$($EXE "${DATA_CODED}")"
95204d
+
95204d
+if [ -n "$RESULT" ]; then
95204d
+    echo "$RESULT"
95204d
+    echo "Report detected that some keys were rotated."
95204d
+    if [ -z "$QOPT" ]; then
95204d
+        if [ -z "$ROPT" ]; then
95204d
+            read -r -p "Do you want to regenerate luks metadata with \"clevis luks regen -d $DEV -s $SLT\"? [ynYN] " ans < /dev/tty
95204d
+            [[ "$ans" =~ ^[yY]$ ]] && ROPT="regen"
95204d
+        fi
95204d
+    fi
95204d
+else
95204d
+    exit 0
95204d
+fi
95204d
+
95204d
+if [ "$ROPT" = "regen" ]; then
95204d
+    EXE="$(findexe clevis-luks-regen)"
95204d
+    exec "$EXE" -d "$DEV" -s "$SLT"
95204d
+else
95204d
+    if [ -n "${RESULT}" ]; then
95204d
+        # Keys were rotated.
95204d
+        exit 1
95204d
+    fi
95204d
+fi
95204d
diff --git a/src/luks/clevis-luks-report-compare b/src/luks/clevis-luks-report-compare
95204d
new file mode 100755
95204d
index 0000000..2ba5132
95204d
--- /dev/null
95204d
+++ b/src/luks/clevis-luks-report-compare
95204d
@@ -0,0 +1,71 @@
95204d
+#!/usr/bin/bash -e
95204d
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
95204d
+#
95204d
+# Copyright (c) 2018 Red Hat, Inc.
95204d
+# Author: Radovan Sroka <rsroka@redhat.com>
95204d
+#
95204d
+# This program is free software: you can redistribute it and/or modify
95204d
+# it under the terms of the GNU General Public License as published by
95204d
+# the Free Software Foundation, either version 3 of the License, or
95204d
+# (at your option) any later version.
95204d
+#
95204d
+# This program is distributed in the hope that it will be useful,
95204d
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
95204d
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
95204d
+# GNU General Public License for more details.
95204d
+#
95204d
+# You should have received a copy of the GNU General Public License
95204d
+# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
95204d
+#
95204d
+
95204d
+SUMMARY="Compare two sets of keys"
95204d
+
95204d
+if [ "$1" == "--summary" ]; then
95204d
+    echo "$SUMMARY"
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+if [ -z "$1" ]; then
95204d
+    echo "$0 missing the first argument!"
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+if [ -z "$2" ]; then
95204d
+    echo "$0 missing the second argument!"
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+ADV_KEYS="$1" # keys from advertisement
95204d
+LUKS_KEYS="$2" # keys from luks metadata
95204d
+
95204d
+### iterate over adv keys and make thumbprints
95204d
+CNT=0
95204d
+declare -a ADV_KEYS_ARRAY
95204d
+while res="$(jose fmt -j- -g keys -g"$CNT" -o- <<< "$ADV_KEYS")"; do
95204d
+    thp="$(echo "$res" | jose jwk thp -i-)"
95204d
+    ADV_KEYS_ARRAY["$CNT"]="$thp"
95204d
+    CNT=$(( CNT + 1 ))
95204d
+done
95204d
+
95204d
+CNT=0
95204d
+while key="$(jose fmt -j- -g keys -g"$CNT" -o- <<< "$LUKS_KEYS")"; do
95204d
+    thp="$(echo "$key" | jose jwk thp -i-)"
95204d
+
95204d
+    FOUND=0
95204d
+    for k in "${ADV_KEYS_ARRAY[@]}"
95204d
+    do
95204d
+        if [ "$k" = "$thp" ]; then
95204d
+            FOUND=1
95204d
+            break
95204d
+        fi
95204d
+    done
95204d
+
95204d
+    if [ "$FOUND" -eq "0" ]; then
95204d
+        echo "Key \"$thp\" is not in the advertisement and was probably rotated!"
95204d
+        echo "$key"
95204d
+        echo
95204d
+    fi
95204d
+    CNT=$(( CNT + 1 ))
95204d
+done
95204d
+
95204d
+exit 0
95204d
diff --git a/src/luks/clevis-luks-report-decode b/src/luks/clevis-luks-report-decode
95204d
new file mode 100755
95204d
index 0000000..f39d1e9
95204d
--- /dev/null
95204d
+++ b/src/luks/clevis-luks-report-decode
95204d
@@ -0,0 +1,59 @@
95204d
+#!/usr/bin/bash -e
95204d
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
95204d
+#
95204d
+# Copyright (c) 2018 Red Hat, Inc.
95204d
+# Author: Radovan Sroka <rsroka@redhat.com>
95204d
+#
95204d
+# This program is free software: you can redistribute it and/or modify
95204d
+# it under the terms of the GNU General Public License as published by
95204d
+# the Free Software Foundation, either version 3 of the License, or
95204d
+# (at your option) any later version.
95204d
+#
95204d
+# This program is distributed in the hope that it will be useful,
95204d
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
95204d
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
95204d
+# GNU General Public License for more details.
95204d
+#
95204d
+# You should have received a copy of the GNU General Public License
95204d
+# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
95204d
+#
95204d
+
95204d
+. clevis-luks-common-functions
95204d
+
95204d
+SUMMARY="Decode luks header"
95204d
+
95204d
+if [ "$1" == "--summary" ]; then
95204d
+    echo "$SUMMARY"
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+if [ -z "$1" ]; then
95204d
+    echo "$0 missing the first argument!"
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+DATA_CODED="$1"
95204d
+
95204d
+if DATA_CODED="$(jose jwe fmt -i- <<< "$DATA_CODED")"; then
95204d
+    DATA_CODED="$(jose fmt -j- -g protected -u- <<< "$DATA_CODED")"
95204d
+    DATA_DECODED="$(jose b64 dec -i- <<< "$DATA_CODED")"
95204d
+else
95204d
+    echo "Error decoding JWE protected header!" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+### get pin and url
95204d
+
95204d
+if ! PIN="$(jose fmt -j- -g clevis -g pin -u- <<< "$DATA_DECODED")" || [ -z "$PIN" ]; then
95204d
+    echo "Pin wasn't found in luks metadata!" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+if ! CONTENT="$(jose fmt -j- -g clevis -g "$PIN" -o- <<< "$DATA_DECODED")" || [ -z "$CONTENT" ]; then
95204d
+    echo "Content wasn't found!" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+EXE="$(findexe clevis-luks-report-"$PIN")"
95204d
+
95204d
+exec "$EXE" "$CONTENT"
95204d
diff --git a/src/luks/clevis-luks-report-sss b/src/luks/clevis-luks-report-sss
95204d
new file mode 100755
95204d
index 0000000..1dba4c1
95204d
--- /dev/null
95204d
+++ b/src/luks/clevis-luks-report-sss
95204d
@@ -0,0 +1,53 @@
95204d
+#!/bin/bash -e
95204d
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
95204d
+#
95204d
+# Copyright (c) 2018 Red Hat, Inc.
95204d
+# Author: Radovan Sroka <rsroka@redhat.com>
95204d
+#
95204d
+# This program is free software: you can redistribute it and/or modify
95204d
+# it under the terms of the GNU General Public License as published by
95204d
+# the Free Software Foundation, either version 3 of the License, or
95204d
+# (at your option) any later version.
95204d
+#
95204d
+# This program is distributed in the hope that it will be useful,
95204d
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
95204d
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
95204d
+# GNU General Public License for more details.
95204d
+#
95204d
+# You should have received a copy of the GNU General Public License
95204d
+# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
95204d
+#
95204d
+
95204d
+. clevis-luks-common-functions
95204d
+
95204d
+SUMMARY="SSS report plugin"
95204d
+
95204d
+if [ "$1" == "--summary" ]; then
95204d
+    echo "$SUMMARY"
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+if [ -z "$1" ]; then
95204d
+    echo "$0 missing the first argument!" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+CONTENT="$1" # sss content
95204d
+
95204d
+CNT=0
95204d
+while DATA_CODED="$(jose fmt -j- -g jwe -g"$CNT" -u- <<< "$CONTENT")"; do
95204d
+    if [ -z "$DATA_CODED" ]; then
95204d
+        CNT=$(( CNT + 1 ))
95204d
+        continue # in some cases it can be empty string
95204d
+    fi
95204d
+
95204d
+    EXE="$(findexe clevis-luks-report-decode)"
95204d
+    if ! $EXE "$DATA_CODED"; then
95204d
+        echo "Failed" >&2
95204d
+        exit 1
95204d
+    fi
95204d
+
95204d
+    CNT=$(( CNT + 1 ))
95204d
+done
95204d
+
95204d
+exit 0
95204d
diff --git a/src/luks/clevis-luks-report-tang b/src/luks/clevis-luks-report-tang
95204d
new file mode 100755
95204d
index 0000000..07f2a72
95204d
--- /dev/null
95204d
+++ b/src/luks/clevis-luks-report-tang
95204d
@@ -0,0 +1,67 @@
95204d
+#!/usr/bin/bash -e
95204d
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
95204d
+#
95204d
+# Copyright (c) 2018 Red Hat, Inc.
95204d
+# Author: Radovan Sroka <rsroka@redhat.com>
95204d
+#
95204d
+# This program is free software: you can redistribute it and/or modify
95204d
+# it under the terms of the GNU General Public License as published by
95204d
+# the Free Software Foundation, either version 3 of the License, or
95204d
+# (at your option) any later version.
95204d
+#
95204d
+# This program is distributed in the hope that it will be useful,
95204d
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
95204d
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
95204d
+# GNU General Public License for more details.
95204d
+#
95204d
+# You should have received a copy of the GNU General Public License
95204d
+# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
95204d
+#
95204d
+
95204d
+. clevis-luks-common-functions
95204d
+
95204d
+SUMMARY="Tang report plugin"
95204d
+
95204d
+if [ "$1" == "--summary" ]; then
95204d
+    echo "$SUMMARY"
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+if [ -z "$1" ]; then
95204d
+    echo "$0 missing the first argument!"
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+CONTENT="$1"
95204d
+
95204d
+### Get the advertisement
95204d
+if ! URL="$(jose fmt -j- -g url -u- <<< "$CONTENT")" || [ -z "$URL" ]; then
95204d
+    echo "URL was not found!" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+if ! jws="$(curl -sfg "$URL/adv")"; then
95204d
+    echo "Unable to fetch advertisement: $URL/adv!" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+if ! TANG_KEYS="$(jose fmt -j- -Og payload -SyOg keys -AUo- <<< "$jws")"; then
95204d
+    echo "Advertisement is malformed!" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+### Check advertisement validity
95204d
+ver="$(jose jwk use -i- -r -u verify -o- <<< "$TANG_KEYS")"
95204d
+if ! jose jws ver -i "$jws" -k- -a <<< "$ver"; then
95204d
+    echo "Advertisement is missing signatures!" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+if ! LUKS_KEYS="$(jose fmt -j- -g adv -o- <<< "$CONTENT")" || [ -z "$LUKS_KEYS" ]; then
95204d
+    echo "LUKS keys from LUKS metadata were not found!" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+EXE="$(findexe clevis-luks-report-compare)"
95204d
+
95204d
+exec "$EXE" "$TANG_KEYS" "$LUKS_KEYS"
95204d
diff --git a/src/luks/clevis-luks-report.1.adoc b/src/luks/clevis-luks-report.1.adoc
95204d
new file mode 100644
95204d
index 0000000..cf42afe
95204d
--- /dev/null
95204d
+++ b/src/luks/clevis-luks-report.1.adoc
95204d
@@ -0,0 +1,41 @@
95204d
+CLEVIS-LUKS-REPORT(1)
95204d
+=====================
95204d
+:doctype: manpage
95204d
+
95204d
+
95204d
+== NAME
95204d
+
95204d
+clevis-luks-report - Reports whether a pin bound to a LUKS1 or LUKS2 volume has been rotated
95204d
+
95204d
+== SYNOPSIS
95204d
+
95204d
+*clevis luks report* -d DEV -s SLT
95204d
+
95204d
+== OVERVIEW
95204d
+
95204d
+The *clevis luks report* command checks a given slot of a LUKS device and reports whether the pin bound to it
95204d
+-- if any -- has been rotated.
95204d
+
95204d
+== OPTIONS
95204d
+
95204d
+* *-d* _DEV_ :
95204d
+  The bound LUKS device
95204d
+
95204d
+* *-s* _SLT_ :
95204d
+  The slot or key slot number for the pin to be verified
95204d
+
95204d
+* *-q* :
95204d
+  Quiet mode. If used, we will not prompt whether to regenerate data with *clevis luks regen*
95204d
+
95204d
+* *-r* :
95204d
+  Regenerates LUKS metadata with *clevis luks regen -d DEV -s SLOT*
95204d
+
95204d
+== EXAMPLE
95204d
+
95204d
+    Check whether the pin bound to slot 1 in /dev/sda1 has been rotated:
95204d
+
95204d
+    # clevis luks report -d /dev/sda1 -s 1
95204d
+
95204d
+== SEE ALSO
95204d
+
95204d
+link:clevis-luks-regen.1.adoc[*clevis-luks-regen*(1)]
95204d
diff --git a/src/luks/meson.build b/src/luks/meson.build
95204d
index f21388d..ee588c3 100644
95204d
--- a/src/luks/meson.build
95204d
+++ b/src/luks/meson.build
95204d
@@ -47,6 +47,13 @@ if libcryptsetup.found() and luksmeta.found() and pwmake.found()
95204d
 
95204d
   bins += join_paths(meson.current_source_dir(), 'clevis-luks-regen')
95204d
   mans += join_paths(meson.current_source_dir(), 'clevis-luks-regen.1')
95204d
+
95204d
+  bins += join_paths(meson.current_source_dir(), 'clevis-luks-report')
95204d
+  bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-compare')
95204d
+  bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-decode')
95204d
+  bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-sss')
95204d
+  bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-tang')
95204d
+  mans += join_paths(meson.current_source_dir(), 'clevis-luks-report.1')
95204d
 else
95204d
   warning('Will not install LUKS support due to missing dependencies!')
95204d
 endif
95204d
-- 
95204d
2.18.4
95204d