From 46dc5904a9a6b0f1dcdb2511cc3f09671ef54b2a Mon Sep 17 00:00:00 2001

From: Sergio Correia <scorreia@redhat.com>

Date: Wed, 20 May 2020 21:09:15 -0300

Subject: [PATCH] Add clevis luks edit command

---

 src/luks/clevis-luks-common-functions    |  65 ++++--

 src/luks/clevis-luks-edit                | 242 +++++++++++++++++++++++

 src/luks/clevis-luks-edit.1.adoc         |  69 +++++++

 src/luks/clevis-luks-regen               | 125 ++----------

 src/luks/meson.build                     |   3 +

 src/luks/tests/edit-tang-luks1           | 106 ++++++++++

 src/luks/tests/edit-tang-luks2           | 106 ++++++++++

 src/luks/tests/meson.build               |  28 ++-

 src/luks/tests/regen-inplace-luks1       |   2 +-

 src/luks/tests/regen-inplace-luks2       |   2 +-

 src/luks/tests/regen-not-inplace-luks1   |   2 +-

 src/luks/tests/regen-not-inplace-luks2   |   2 +-

 src/luks/tests/tests-common-functions.in |  26 ---

 src/luks/tests/unlock-tang-luks1         |   7 +-

 src/luks/tests/unlock-tang-luks2         |   8 +-

 15 files changed, 606 insertions(+), 187 deletions(-)

 create mode 100755 src/luks/clevis-luks-edit

 create mode 100644 src/luks/clevis-luks-edit.1.adoc

 create mode 100755 src/luks/tests/edit-tang-luks1

 create mode 100755 src/luks/tests/edit-tang-luks2

diff --git a/src/luks/clevis-luks-common-functions b/src/luks/clevis-luks-common-functions

index c9d712a..f3a875c 100644

--- a/src/luks/clevis-luks-common-functions

+++ b/src/luks/clevis-luks-common-functions

@@ -141,11 +141,7 @@ clevis_luks_decode_jwe() {

     local jwe="${1}"

     local coded

-    if ! coded=$(jose jwe fmt -i- <<< "${jwe}"); then

-        return 1

-    fi

-

-    coded=$(jose fmt -j- -g protected -u- <<< "${coded}" | tr -d '"')

+    read -r -d . coded <<< "${jwe}"

     jose b64 dec -i- <<< "${coded}"

 }

@@ -291,6 +287,46 @@ clevis_luks_read_pins_from_slot() {

     printf "%s: %s\n" "${SLOT}" "${cfg}"

 }

+# clevis_luks_is_key_valid() checks whether the given key is valid to unlock

+# the given device.

+clevis_luks_is_key_valid() {

+    local DEV="${1}"

+    local KEY="${2}"

+

+    if ! cryptsetup open --test-passphrase "${DEV}" \

+                         --key-file <(echo -n "${KEY}") 2>/dev/null; then

+        return 1

+    fi

+    return 0

+}

+

+# clevis_luks_unlock_device_by_slot() does the unlock of the device and slot

+# passed as parameters and returns the decoded passphrase.

+clevis_luks_unlock_device_by_slot() {

+    local DEV="${1}"

+    local SLT="${2}"

+

+    [ -z "${DEV}" ] && return 1

+    [ -z "${SLT}" ] && return 1

+

+    local jwe passphrase

+    if ! jwe="$(clevis_luks_read_slot "${DEV}" "${SLT}" 2>/dev/null)" \

+                || [ -z "${jwe}" ]; then

+        return 1

+    fi

+

+    if ! passphrase="$(clevis decrypt < <(echo -n "${jwe}") 2>/dev/null)" \

+                       || [ -z "${passphrase}" ]; then

+        return 1

+    fi

+

+    if ! clevis_luks_is_key_valid "${DEV}" "${passphrase}"; then

+        return 1

+    fi

+    echo -n "${passphrase}"

+    return 0

+}

+

 # clevis_luks_unlock_device() does the unlock of the device passed as

 # parameter and returns the decoded passphrase.

 clevis_luks_unlock_device() {

@@ -303,26 +339,15 @@ clevis_luks_unlock_device() {

         return 1

     fi

-    local slt jwe passphrase

+    local slt pt

     for slt in ${used_slots}; do

-        if ! jwe="$(clevis_luks_read_slot "${DEV}" "${slt}" 2>/dev/null)" \

-                   || [ -z "${jwe}" ]; then

-            continue

-        fi

-

-        if ! passphrase="$(clevis decrypt < <(echo -n "${jwe}"))" \

-                           || [ -z "${passphrase}" ]; then

+        if ! pt=$(clevis_luks_unlock_device_by_slot "${DEV}" "${slt}") \

+                  || [ -z "${pt}" ]; then

             continue

         fi

-

-        if ! cryptsetup luksOpen --test-passphrase "${DEV}" \

-             --key-file <(echo -n "${passphrase}"); then

-            continue

-        fi

-        echo -n "${passphrase}"

+        echo -n "${pt}"

         return 0

     done

-

     return 1

 }

diff --git a/src/luks/clevis-luks-edit b/src/luks/clevis-luks-edit

new file mode 100755

index 0000000..fc95f75

--- /dev/null

+++ b/src/luks/clevis-luks-edit

@@ -0,0 +1,242 @@

+#!/bin/bash -e

+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:

+#

+# Copyright (c) 2020 Red Hat, Inc.

+# Author: Sergio Correia <scorreia@redhat.com>

+#

+# This program is free software: you can redistribute it and/or modify

+# it under the terms of the GNU General Public License as published by

+# the Free Software Foundation, either version 3 of the License, or

+# (at your option) any later version.

+#

+# This program is distributed in the hope that it will be useful,

+# but WITHOUT ANY WARRANTY; without even the implied warranty of

+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+# GNU General Public License for more details.

+#

+# You should have received a copy of the GNU General Public License

+# along with this program.  If not, see <http://www.gnu.org/licenses/>.

+#

+

+. clevis-luks-common-functions

+

+SUMMARY="Edit a binding from a clevis-bound slot in a LUKS device"

+

+usage() {

+    echo >&2

+    echo "Usage: clevis luks edit [-f] -d DEV -s SLT [-c CONFIG]" >&2

+    echo >&2

+    echo "$SUMMARY": >&2

+    echo >&2

+    echo "  -d DEV     The LUKS device to edit clevis-bound pins" >&2

+    echo >&2

+    echo "  -s SLOT    The slot to use when editing the clevis binding" >&2

+    echo >&2

+    echo "  -f         Proceed with the edit operation even if the configuration is the same" >&2

+    echo >&2

+    echo "  -c CONFIG  The updated config to use" >&2

+    echo >&2

+    exit 1

+}

+

+on_exit() {

+    [ -d "$TMP" ] && rm -rf "${TMP}"

+}

+

+validate_cfg() {

+    local json="${1}"

+    jose fmt -j- -O <<< "${json}" 2>/dev/null

+}

+

+edit_cfg() {

+    local cfg_file="${1}"

+    local editor="${EDITOR:-vi}"

+

+    "${editor}" "${cfg_file}" || true

+    if ! validate_cfg "$(<"${cfg_file}")"; then

+        local ans=

+        while true; do

+            read -r -p \

+              "Malformed configuration. Would you like to edit again? [ynYN] " \

+             ans < /dev/tty

+

+            [[ "${ans}" =~ ^[nN]$ ]] && return 1

+            [[ "${ans}" =~ ^[yY]$ ]] && break

+        done

+        edit_cfg "${cfg_file}"

+    fi

+    return 0

+}

+

+if [ "${#}" -eq 1 ] && [ "${1}" = "--summary" ]; then

+    echo "${SUMMARY}"

+    exit 0

+fi

+

+CFG=

+FRC=

+while getopts ":fd:s:c:" o; do

+    case "$o" in

+    d) DEV=${OPTARG};;

+    s) SLT=${OPTARG};;

+    c) CFG=${OPTARG};;

+    f) FRC=-f;;

+    *) usage;;

+    esac

+done

+

+if [ -z "${DEV}" ]; then

+    echo "Did not specify a device!" >&2

+    usage

+fi

+

+if [ -z "${SLT}" ]; then

+    echo "Did not specify a slot!" >&2

+    usage

+fi

+

+if ! binding="$(clevis luks list -d "${DEV}" -s "${SLT}" 2>/dev/null)" \

+                || [ -z "${binding}" ]; then

+    echo "Error retrieving current configuration from ${DEV}:${SLT}" >&2

+    exit 1

+fi

+

+read -r _ pin cfg <<< "${binding}"

+# Remove single quotes.

+cfg=${cfg//\'}

+if ! pretty_cfg="$(jq . <<< "${cfg}")" || [ -z "${pretty_cfg}" ]; then

+    echo "Error reading the configuration from ${DEV}:${SLT}" >&2

+    exit 1

+fi

+

+if ! TMP="$(mktemp -d)" || [ -z "${TMP}" ]; then

+    echo "Creating a temporary dir for editing binding failed" >&2

+    exit 1

+fi

+

+trap 'on_exit' EXIT

+trap 'on_exit' ERR

+

+if [ -z "${CFG}" ]; then

+   CFG_FILE="${TMP}/cfg"

+    echo "${pretty_cfg}" > "${CFG_FILE}"

+    if ! edit_cfg "${CFG_FILE}"; then

+        exit 1

+    fi

+

+    if ! new_cfg="$(jq . -S < "${CFG_FILE}")" || [ -z "${new_cfg}" ]; then

+        echo "Error reading the updated config for ${DEV}:${SLT}" >&2

+        exit 1

+    fi

+else

+    if ! validate_cfg "${CFG}"; then

+        echo "Invalid configuration given as parameter with -c" >&2

+        exit 1

+    fi

+    new_cfg="$(jq . -S <<< "${CFG}")"

+fi

+

+if [ "${new_cfg}" = "$(jq -S . <<< "${pretty_cfg}")" ] && [ -z "${FRC}" ]; then

+    echo "No changes detected; exiting" >&2

+    exit 1

+fi

+

+if ! jcfg="$(jose fmt -j- -Oo- <<< "${new_cfg}" 2>/dev/null)" \

+             || [ -z "${jcfg}" ]; then

+    echo "Error preparing the configuration for the binding update" >&2

+    exit 1

+fi

+

+if [ -z "${CFG}" ]; then

+    printf "Pin: %s\nNew config:\n%s\n" "${pin}" "${new_cfg}"

+    while true; do

+        read -r -p \

+          "Would you like to proceed with the updated configuration? [ynYN] " \

+         ans < /dev/tty

+        [[ "${ans}" =~ ^[nN]$ ]] && exit 0

+        [[ "${ans}" =~ ^[yY]$ ]] && break

+    done

+fi

+

+echo "Updating binding..."

+

+# Create new key.

+if ! new_pass=$(generate_key "${DEV}"); then

+    echo "Error generating new key for device ${DEV}" >&2

+    exit 1

+fi

+

+# Reencrypt the new password.

+if ! jwe="$(clevis encrypt "${pin}" "${jcfg}" -y <<< "${new_pass}")"; then

+    echo "Error using pin '${pin}' with config '${jcfg}'" >&2

+    exit 1

+fi

+

+# Backup LUKS header.

+if ! clevis_luks_backup_dev "${DEV}" "${TMP}"; then

+    echo "Error while trying to back up LUKS header from ${DEV}" >&2

+    exit 1

+fi

+

+# Get passphrase.

+if ! pt="$(clevis_luks_unlock_device "${DEV}")" \

+           || [ -z "${pt}" ]; then

+    # Unable to retrieve a passphrase from the bindings, so let's query

+    # the user.

+    read -r -s -p "Enter existing LUKS password: " pt; echo

+    # Check if the key is valid.

+    if ! clevis_luks_is_key_valid "${DEV}" "${pt}"; then

+        echo "The key provided is not valid for ${DEV}" >&2

+        exit 1

+    fi

+fi

+

+# Check if we can do the update in-place, i.e., if the key we got is the one

+# for the slot we are interested in.

+in_place=

+if cryptsetup open --test-passphrase --key-slot "${SLT}" "${DEV}" \

+        <<< "${pt}"; then

+    in_place=true

+fi

+

+# Update the key slot with the new key. If we have the key for this slot,

+# the change happens in-place. Otherwise, we kill the slot and re-add it.

+if [ -n "${in_place}" ]; then

+    if ! cryptsetup luksChangeKey "${DEV}" --key-slot "${SLT}" \

+            <(echo -n "${new_pass}") <<< "${pt}"; then

+        echo "Error updating LUKS passphrase in ${DEV}:${SLT}" >&2

+        clevis_luks_restore_dev "${DEV}" "${TMP}"

+        exit 1

+    fi

+else

+    if ! cryptsetup luksKillSlot --batch-mode "${DEV}" "${SLT}"; then

+        echo "Error wiping slot ${SLT} from ${DEV}" >&2

+        clevis_luks_restore_dev "${DEV}" "${TMP}"

+        exit 1

+    fi

+

+    if ! echo -n "${new_pass}" \

+            | cryptsetup luksAddKey --key-slot "${SLT}" \

+                         --key-file <(echo -n "${pt}") "${DEV}"; then

+        echo "Error updating LUKS passphrase in ${DEV}:${SLT}." >&2

+        clevis_luks_restore_dev "${DEV}" "${TMP}"

+        exit 1

+    fi

+fi

+

+# Update the metadata.

+if ! clevis_luks_save_slot "${DEV}" "${SLT}" "${jwe}" "overwrite"; then

+    echo "Error updating metadata in ${DEV}:${SLT}" >&2

+    clevis_luks_restore_dev "${DEV}" "${TMP}"

+    exit 1

+fi

+

+# Make sure we can unlock the device with this keyslot.

+if ! clevis_luks_unlock_device_by_slot "${DEV}" "${SLT}" >/dev/null \

+                                       2>/dev/null; then

+    echo "Invalid configuration detected. Reverting changes." >&2

+    clevis_luks_restore_dev "${DEV}" "${TMP}"

+    exit 1

+fi

+

+echo "Binding edited successfully."

diff --git a/src/luks/clevis-luks-edit.1.adoc b/src/luks/clevis-luks-edit.1.adoc

new file mode 100644

index 0000000..454de89

--- /dev/null

+++ b/src/luks/clevis-luks-edit.1.adoc

@@ -0,0 +1,69 @@

+CLEVIS-LUKS-EDIT(1)

+===================

+:doctype: manpage

+

+

+== NAME

+

+clevis-luks-edit - Edit a binding from a clevis-bound slot in a LUKS device

+

+== SYNOPSIS

+

+*clevis luks edit* -d DEV -s SLT [-c CONFIG]

+

+== OVERVIEW

+

+The *clevis luks edit* command edits clevis bindings from a LUKS device.

+For example:

+

+    clevis luks edit -d /dev/sda1 -s 1

+

+== OPTIONS

+

+* *-d* _DEV_ :

+  The LUKS device to edit clevis-bound pins

+

+* *-s* _SLT_ :

+  The slot to use when editing the clevis binding

+

+* *-f* :

+  Proceed with the edit operation even if the config is the same as the current one

+

+* *-c* _CONFIG_ :

+  The updated config to use

+

+

+== EXAMPLES

+

+    clevis luks list -d /dev/sda1

+    1: tang '{"url":"addr"}'

+

+As we can see in the example above, */dev/sda1* has one slots bound, in this case, to a _tang_ pin.

+

+We can edit this binding by issuing the following command:

+

+    clevis luks edit -d /dev/sda1 -s 1

+

+This will open a text editor -- the one set in the $EDITOR environment variable, or _vi_, as a fallback -- with the current

+configuration of this binding to be edited. In this case, we should have the following:

+

+    {

+        "url": "addr"

+    }

+

+Once at the editor, we can edit the pin configuration. For _tang_, we could edit the _url_, for instance. After completing the change,

+save the file and exit. The updated configuration will be validated for JSON, and if there are no errors, you will be shown the

+updated configuration and prompted whether to proceed.

+

+By proceeding, the binding will be updated. There may be required to provide a valid LUKS passphrase for the device.

+

+In the second example, we will update the same device and slot, but we will be providing the updated configuration as well:

+

+    clevis luks edit -d /dev/sda1 -s 1 -c '{"url":"new-addr-here"}'

+

+In this case, the binding update will be done in non-interactive mode, however it also may be required to provide a valud LUKS

+passphrase for the device.

+

+== SEE ALSO

+

+link:clevis-luks-list.1.adoc[*clevis-luks-list*(1)],

diff --git a/src/luks/clevis-luks-regen b/src/luks/clevis-luks-regen

index 6071d85..8f32e08 100755

--- a/src/luks/clevis-luks-regen

+++ b/src/luks/clevis-luks-regen

@@ -41,15 +41,7 @@ function usage_and_exit () {

     exit "${1}"

 }

-on_exit() {

-    if [ ! -d "${TMP}" ] || ! rm -rf "${TMP}"; then

-        echo "Delete temporary files failed!" >&2

-        echo "You need to clean up: ${TMP}" >&2

-        exit 1

-    fi

-}

-

-while getopts ":hfd:s:" o; do

+while getopts ":hd:s:" o; do

     case "$o" in

     d) DEV="$OPTARG";;

     h) usage_and_exit 0;;

@@ -68,117 +60,22 @@ if [ -z "$SLT" ]; then

     exit 1

 fi

-### ----------------------------------------------------------------------

-if ! pin_cfg=$(clevis luks list -d "${DEV}" -s "${SLT}" 2>/dev/null); then

-    echo "Error obtaining current configuration of device ${DEV}:${SLT}" >&2

+if ! binding="$(clevis luks list -d "${DEV}" -s "${SLT}" 2>/dev/null)" \

+                || [ -z "${binding}" ]; then

+    echo "Error retrieving current configuration from ${DEV}:${SLT}" >&2

     exit 1

 fi

-PIN=$(echo "${pin_cfg}" | awk '{ print $2 }')

-CFG=$(echo "${pin_cfg}" | awk '{ print $3 }' | tr -d "'")

+read -r _ pin cfg <<< "${binding}"

 echo "Regenerating with:"

-echo "PIN: $PIN"

-echo "CONFIG: $CFG"

-

-trap 'echo "Ignoring CONTROL-C!"' INT TERM

-

-# Get the existing key.

-if ! existing_key=$(clevis luks pass -d "${DEV}" -s "${SLT}" 2>/dev/null); then

-    # We failed to obtain the passphrase for the slot -- perhaps

-    # it was rotated? --, so let's request user input.

-    read -r -s -p "Enter existing LUKS password: " existing_key; echo

-fi

-

-# Check if the key is valid.

-if ! cryptsetup open --test-passphrase "${DEV}" <<< "${existing_key}"; then

-    exit 1

-fi

-

-# Check if we can do the update in-place, i.e., if the key we got is the one

-# for the slot we are interested in.

-in_place=

-if cryptsetup open --test-passphrase --key-slot "${SLT}" "${DEV}" \

-        <<< "${existing_key}"; then

-    in_place=true

-fi

-

-# Create new key.

-if ! new_passphrase=$(generate_key "${DEV}"); then

-    echo "Error generating new key for device ${DEV}" >&2

-    exit 1

-fi

-

-# Reencrypt the new password.

-if ! jwe="$(clevis encrypt "${PIN}" "${CFG}" <<< "${new_passphrase}")"; then

-    echo "Error using pin '${PIN}' with config '${CFG}'" >&2

-    exit 1

-fi

-

-# Updating the metadata and the actual passphrase are destructive operations,

-# hence we will do a backup of the LUKS header and restore it later in case

-# we have issues performing these operations.

-if ! TMP="$(mktemp -d)"; then

-    echo "Creating a temporary dir for device backup/restore failed!" >&2

-    exit 1

-fi

-trap 'on_exit' EXIT

-

-# Backup LUKS header.

-if ! clevis_luks_backup_dev "${DEV}" "${TMP}"; then

-    echo "Error while trying to back up LUKS header from ${DEV}" >&2

-    exit 1

-fi

-

-restore_device() {

-    local DEV="${1}"

-    local TMP="${2}"

-

-    if ! clevis_luks_restore_dev "${DEV}" "${TMP}"; then

-        echo "Error while trying to restore LUKS header from ${DEV}." >&2

-    else

-        echo "LUKS header restored successfully." >&2

-    fi

-}

-

-# Update the key slot with the new key. If we have the key for this slot,

-# the change happens in-place. Otherwise, we kill the slot and re-add it.

-if [ -n "${in_place}" ]; then

-    if ! cryptsetup luksChangeKey "${DEV}" --key-slot "${SLT}" \

-            <(echo -n "${new_passphrase}") <<< "${existing_key}"; then

-        echo "Error updating LUKS passphrase in ${DEV}:${SLT}" >&2

-        restore_device "${DEV}" "${TMP}"

-        exit 1

-    fi

-else

-    if ! cryptsetup luksKillSlot --batch-mode "${DEV}" "${SLT}"; then

-        echo "Error wiping slot ${SLT} from ${DEV}" >&2

-        restore_device "${DEV}" "${TMP}"

-        exit 1

-    fi

-

-    if ! echo -n "${new_passphrase}" \

-            | cryptsetup luksAddKey --key-slot "${SLT}" \

-                         --key-file <(echo -n "${existing_key}") "${DEV}"; then

-        echo "Error updating LUKS passphrase in ${DEV}:${SLT}." >&2

-        restore_device "${DEV}" "${TMP}"

-        exit 1

-    fi

-fi

-

-# Update the metadata.

-if ! clevis_luks_save_slot "${DEV}" "${SLT}" "${jwe}" "overwrite"; then

-    echo "Error updating metadata in ${DEV}:${SLT}" >&2

-    restore_device "${DEV}" "${TMP}"

-    exit 1

-fi

+echo "PIN: ${pin}"

+echo "CONFIG: ${cfg}"

-# Now make sure that we can unlock this device after the change.

-# If we can't, undo the changes.

-if ! cryptsetup open --test-passphrase --key-slot "${SLT}" "${DEV}" 2>/dev/null \

-        <<< "$(clevis luks pass -d "${DEV}" -s "${SLT}" 2>/dev/null)"; then

-    echo "Invalid configuration detected after rebinding. Reverting changes."

-    restore_device "${DEV}" "${TMP}"

+# Remove single quotes.

+cfg=${cfg//\'}

+if ! clevis luks edit -f -d "${DEV}" -s "${SLT}" -c "${cfg}" >/dev/null; then

+    echo "Error rotating keys in ${DEV}:${SLT}" >&2

     exit 1

 fi

diff --git a/src/luks/meson.build b/src/luks/meson.build

index ee588c3..ba02bd9 100644

--- a/src/luks/meson.build

+++ b/src/luks/meson.build

@@ -54,6 +54,9 @@ if libcryptsetup.found() and luksmeta.found() and pwmake.found()

   bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-sss')

   bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-tang')

   mans += join_paths(meson.current_source_dir(), 'clevis-luks-report.1')

+

+  bins += join_paths(meson.current_source_dir(), 'clevis-luks-edit')

+  mans += join_paths(meson.current_source_dir(), 'clevis-luks-edit.1')

 else

   warning('Will not install LUKS support due to missing dependencies!')

 endif

diff --git a/src/luks/tests/edit-tang-luks1 b/src/luks/tests/edit-tang-luks1

new file mode 100755

index 0000000..3d42d68

--- /dev/null

+++ b/src/luks/tests/edit-tang-luks1

@@ -0,0 +1,106 @@

+#!/bin/bash -ex

+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:

+#

+# Copyright (c) 2020 Red Hat, Inc.

+# Author: Sergio Correia <scorreia@redhat.com>

+#

+# This program is free software: you can redistribute it and/or modify

+# it under the terms of the GNU General Public License as published by

+# the Free Software Foundation, either version 3 of the License, or

+# (at your option) any later version.

+#

+# This program is distributed in the hope that it will be useful,

+# but WITHOUT ANY WARRANTY; without even the implied warranty of

+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+# GNU General Public License for more details.

+#

+# You should have received a copy of the GNU General Public License

+# along with this program.  If not, see <http://www.gnu.org/licenses/>.

+

+TEST=$(basename "${0}")

+. tests-common-functions

+

+. clevis-luks-common-functions

+

+on_exit() {

+    local d

+    for d in "${TMP}" "${TMP2}"; do

+        [ ! -d "${d}" ] && continue

+        tang_stop "${d}"

+        rm -rf "${d}"

+    done

+}

+

+trap 'on_exit' EXIT

+trap 'on_exit' ERR

+

+TMP="$(mktemp -d)"

+

+port=$(get_random_port)

+tang_run "${TMP}" "${port}" &

+tang_wait_until_ready "${port}"

+

+url="http://${TANG_HOST}:${port}"

+

+cfg=$(printf '{"url":"%s"}' "${url}")

+

+# LUKS1.

+DEV="${TMP}/luks1-device"

+new_device "luks1" "${DEV}"

+

+if ! clevis luks bind -y -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then

+    error "${TEST}: Bind should have succeeded."

+fi

+

+# Now let's try to change the config but using the same one we already have.

+if clevis luks edit -d "${DEV}" -s 1 -c "${cfg}"; then

+    error "${TEST}: edit should not have succeeded because the config is the same."

+fi

+

+# And now, just a broken config.

+new_cfg=$(printf '{"url&:"%s"}' "${url}")

+if clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then

+    error "${TEST}: edit should have failed because of invalid JSON"

+fi

+

+# Now let's have another tang instance running and change the config to use

+# the new one.

+port2=$(get_random_port)

+TMP2="$(mktemp -d)"

+tang_run "${TMP2}" "${port2}" &

+tang_wait_until_ready "${port2}"

+new_url="http://${TANG_HOST}:${port2}"

+new_cfg=$(printf '{"url":"%s"}' "${new_url}")

+

+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then

+    error "${TEST}: edit should have succeeded."

+fi

+

+# And now let's use sss and start with a single tang server, then add a second

+# one.

+new_device "luks1" "${DEV}"

+cfg=$(printf '{"t":1,"pins":{"tang":[{"url":"%s"}]}}' "${url}")

+if ! clevis luks bind -y -d "${DEV}" sss "${cfg}" <<< "${DEFAULT_PASS}"; then

+    error "${TEST}: Bind should have succeeded."

+fi

+new_cfg=$(printf '{"t":1,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \

+          "${url}" "${new_url}")

+

+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then

+    error "${TEST}: edit should have succeeded and added a new tang server"

+fi

+

+# Now let's change the threshold to 2.

+new_cfg=$(printf '{"t":2,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \

+          "${url}" "${new_url}")

+

+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then

+    error "${TEST}: edit should have succeeded and added a new tang server"

+fi

+

+# And finally, let's try a broken config, with a wrong threshold.

+new_cfg=$(printf '{"t":3,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \

+          "${url}" "${new_url}")

+if clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then

+    error "${TEST}: edit should have failed because threshold > number of servers"