diff --git a/SOURCES/Add-clevis-luks-report-regen.patch b/SOURCES/Add-clevis-luks-report-regen.patch new file mode 100644 index 0000000..274e651 --- /dev/null +++ b/SOURCES/Add-clevis-luks-report-regen.patch @@ -0,0 +1,858 @@ +From 70d3da5ce8d68e8ff258122592670eb70da0c839 Mon Sep 17 00:00:00 2001 +From: Sergio Correia +Date: Wed, 16 Oct 2019 09:14:58 -0300 +Subject: [PATCH 2/2] Add clevis luks report/regen + +--- + src/luks/clevis-luks-common-functions | 143 ++++++++++++++++++++ + src/luks/clevis-luks-regen | 186 ++++++++++++++++++++++++++ + src/luks/clevis-luks-regen.1.adoc | 36 +++++ + src/luks/clevis-luks-report | 95 +++++++++++++ + src/luks/clevis-luks-report-compare | 71 ++++++++++ + src/luks/clevis-luks-report-decode | 59 ++++++++ + src/luks/clevis-luks-report-sss | 53 ++++++++ + src/luks/clevis-luks-report-tang | 67 ++++++++++ + src/luks/clevis-luks-report.1.adoc | 41 ++++++ + src/luks/meson.build | 12 ++ + 10 files changed, 763 insertions(+) + create mode 100644 src/luks/clevis-luks-common-functions + create mode 100755 src/luks/clevis-luks-regen + create mode 100644 src/luks/clevis-luks-regen.1.adoc + create mode 100755 src/luks/clevis-luks-report + create mode 100755 src/luks/clevis-luks-report-compare + create mode 100755 src/luks/clevis-luks-report-decode + create mode 100755 src/luks/clevis-luks-report-sss + create mode 100755 src/luks/clevis-luks-report-tang + create mode 100644 src/luks/clevis-luks-report.1.adoc + +diff --git a/src/luks/clevis-luks-common-functions b/src/luks/clevis-luks-common-functions +new file mode 100644 +index 0000000..d676253 +--- /dev/null ++++ b/src/luks/clevis-luks-common-functions +@@ -0,0 +1,143 @@ ++#!/bin/bash -e ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2019 Red Hat, Inc. ++# Author: Sergio Correia ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++# valid_slot() will check whether a given slot is possibly valid, i.e., if it ++# is a numeric value within the specified range. ++valid_slot() { ++ local SLT="${1}" ++ local MAX_SLOTS="${2}" ++ case "${SLT}" in ++ ''|*[!0-9]*) ++ return 1 ++ ;; ++ *) ++ # We got an integer, now let's make sure it is within the ++ # supported range. ++ if [ "${SLT}" -ge "${MAX_SLOTS}" ]; then ++ return 1 ++ fi ++ ;; ++ esac ++} ++ ++# clevis_luks_read_slot() will read a particular slot of a given device, which ++# should be either LUKS1 or LUKS2. Returns 1 in case of failure; 0 in case of ++# success. ++clevis_luks_read_slot() { ++ local DEV="${1}" ++ local SLT="${2}" ++ ++ if [ -z "${DEV}" ] || [ -z "${SLT}" ]; then ++ echo "Need both a device and a slot as arguments." >&2 ++ return 1 ++ fi ++ ++ local DATA_CODED='' ++ local MAX_LUKS1_SLOTS=8 ++ local MAX_LUKS2_SLOTS=32 ++ if cryptsetup isLuks --type luks1 "${DEV}"; then ++ if ! valid_slot "${SLT}" "${MAX_LUKS1_SLOTS}"; then ++ echo "Please, provide a valid key slot number; 0-7 for LUKS1" >&2 ++ return 1 ++ fi ++ ++ if ! luksmeta test -d "${DEV}"; then ++ echo "The ${DEV} device is not valid!" >&2 ++ return 1 ++ fi ++ ++ local uuid ++ # Pattern from luksmeta: active slot uuid. ++ read -r _ _ uuid <<< "$(luksmeta show -d "${DEV}" | grep "^${SLT} *")" ++ ++ if [ "${uuid}" = "empty" ]; then ++ echo "The LUKSMeta slot ${SLT} on device ${DEV} is already empty." >&2 ++ return 1 ++ fi ++ ++ if ! DATA_CODED="$(luksmeta load -d "${DEV}" -s "${SLT}")"; then ++ echo "Cannot load data from ${DEV} slot:${SLT}!" >&2 ++ return 1 ++ fi ++ elif cryptsetup isLuks --type luks2 "${DEV}"; then ++ if ! valid_slot "${SLT}" "${MAX_LUKS2_SLOTS}"; then ++ echo "Please, provide a valid key slot number; 0-31 for LUKS2" >&2 ++ return 1 ++ fi ++ ++ local token_id ++ token_id=$(cryptsetup luksDump "${DEV}" \ ++ | grep -E -B1 "^\s+Keyslot:\s+${SLT}$" \ ++ | head -n 1 | sed -rn 's|^\s+([0-9]+): clevis|\1|p') ++ if [ -z "${token_id}" ]; then ++ echo "Cannot load data from ${DEV} slot:${SLT}. No token found!" >&2 ++ return 1 ++ fi ++ ++ local token ++ token=$(cryptsetup token export --token-id "${token_id}" "${DEV}") ++ DATA_CODED=$(jose fmt -j- -Og jwe -o- <<< "${token}" \ ++ | jose jwe fmt -i- -c) ++ ++ if [ -z "${DATA_CODED}" ]; then ++ echo "Cannot load data from ${DEV} slot:${SLT}!" >&2 ++ return 1 ++ fi ++ else ++ echo "${DEV} is not a supported LUKS device!" >&2 ++ return 1 ++ fi ++ echo "${DATA_CODED}" ++} ++ ++# Generate a key with the same entropy as the LUKS Master key of a given ++# device. ++generate_key() { ++ local DEV="${1}" ++ ++ if [ -z "${DEV}" ]; then ++ echo "Please, specify a device." >&2 ++ return 1 ++ fi ++ ++ local dump ++ local filter ++ dump=$(cryptsetup luksDump "${DEV}") ++ if cryptsetup isLuks --type luks1 "${DEV}"; then ++ filter=$(sed -rn 's|MK bits:[ \t]*([0-9]+)|\1|p' <<< "${dump}") ++ elif cryptsetup isLuks --type luks2 "${DEV}"; then ++ filter=$(sed -rn 's|^\s+Key:\s+([0-9]+) bits\s*$|\1|p' <<< "${dump}") ++ else ++ echo "${DEV} is not a supported LUKS device!" >&2 ++ return 1 ++ fi ++ local bits ++ bits=$(sort -n <<< "${filter}" | tail -n 1) ++ pwmake "${bits}" ++} ++ ++findexe() { ++ while read -r -d: path; do ++ [ -f "${path}/${1}" ] && [ -x "${path}/${1}" ] && \ ++ echo "${path}/${1}" && return 0 ++ done <<< "${PATH}:" ++ return 1 ++} ++ +diff --git a/src/luks/clevis-luks-regen b/src/luks/clevis-luks-regen +new file mode 100755 +index 0000000..9535ba3 +--- /dev/null ++++ b/src/luks/clevis-luks-regen +@@ -0,0 +1,186 @@ ++#!/usr/bin/env bash ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2018 Red Hat, Inc. ++# Author: Radovan Sroka ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++. clevis-luks-common-functions ++ ++SUMMARY="Regenerate LUKS metadata" ++ ++if [ "$1" == "--summary" ]; then ++ echo "$SUMMARY" ++ exit 0 ++fi ++ ++function usage_and_exit () { ++ echo >&2 ++ echo "Usage: clevis luks regen -d DEV -s SLOT" >&2 ++ echo >&2 ++ echo "$SUMMARY" >&2 ++ echo >&2 ++ exit "$1" ++} ++ ++if [ "$#" -ne "4" ]; then ++ usage_and_exit 1 ++fi ++ ++while getopts "hd:s:" o; do ++ case "$o" in ++ d) DEV="$OPTARG";; ++ h) usage_and_exit 0;; ++ s) SLT="$OPTARG";; ++ *) usage_and_exit 1;; ++ esac ++done ++ ++function decode_luks_header () { ++ if DATA_CODED="$(jose jwe fmt -i- <<< "$1")"; then ++ DATA_CODED="$(jose fmt -j- -g protected -u- <<< "$DATA_CODED")" ++ DATA_DECODED="$(jose b64 dec -i- <<< "$DATA_CODED")" ++ else ++ echo "Error decoding JWE protected header!" >&2 ++ exit 1 ++ fi ++ ++ echo "$DATA_DECODED" ++} ++ ++function generate_cfg () { ++ echo -n "{" ++ DATA="$(decode_luks_header "$1")" ++ ++ if ! P="$(jose fmt -j- -g clevis -g pin -u- <<< "$DATA")" || [ -z "$P" ]; then ++ echo "Pin wasn't found in LUKS metadata!" >&2 ++ exit 1 ++ fi ++ ++ if ! CONTENT="$(jose fmt -j- -g clevis -g "$P" -o- <<< "$DATA")" || [ -z "$CONTENT" ]; then ++ echo "Content was not found!" >&2 ++ fi ++ ++ # echo -n "\"$P\": [" ++ ++ if [ "$P" = "tang" ] || [ "$P" = "http" ]; then ++ URL="$(jose fmt -j- -g url -u- <<< "$CONTENT")" ++ echo -n "\"url\":\"$URL\"" ++ elif [ "$P" = "sss" ]; then ++ THRESHOLD="$(jose fmt -j- -g t -o- <<< "$CONTENT")" ++ if [ -n "$THRESHOLD" ]; then ++ echo -n "\"t\":$THRESHOLD," ++ fi ++ ++ echo -n "\"pins\":{" ++ ++ CNT=0 ++ PREV="" ++ while ITEM="$(jose fmt -j- -g jwe -g"$CNT" -u- <<< "$CONTENT")"; do ++ if [ -z "$ITEM" ]; then ++ CNT=$(( CNT + 1 )) ++ continue # in some cases it can be empty string ++ fi ++ ++ DD="$(decode_luks_header "$ITEM")" ++ ++ if ! PP="$(jose fmt -j- -g clevis -g pin -u- <<< "$DD")" || [ -z "$PP" ]; then ++ echo "Pin wasn't found in LUKS metadata!" >&2 ++ exit 1 ++ fi ++ ++ if [ "$CNT" -eq 0 ]; then ++ PREV="$PP" ++ echo -n "\"$PP\":[" ++ echo -n "$(generate_cfg "$ITEM")" ++ else ++ if ! [ "$PREV" = "$PP" ]; then ++ echo -n "],\"$PP\":[" ++ echo -n "$(generate_cfg "$ITEM")" ++ else ++ echo -n ",$(generate_cfg "$ITEM")" ++ fi ++ fi ++ ++ PREV="$PP" ++ CNT=$(( CNT + 1 )) ++ done ++ ++ echo -n "]}" ++ ++ else ++ echo "Unknown pin $P!" >&2 ++ exit 1 ++ fi ++ ++ echo -n "}" ++} ++ ++### get luks metadata ++ ++if [ -z "$DEV" ]; then ++ echo "Did not specify a device!" >&2 ++ exit 1 ++fi ++ ++if [ -z "$SLT" ]; then ++ echo "Did not specify a slot!" >&2 ++ exit 1 ++fi ++ ++if ! OLD_LUKS_CODED="$(clevis_luks_read_slot "$DEV" "$SLT")"; then ++ echo "Error reading metadata from LUKS device!" >&2 ++ exit 1 ++fi ++ ++### ---------------------------------------------------------------------- ++ ++DECODED="$(decode_luks_header "$OLD_LUKS_CODED")" ++ ++if ! PIN="$(jose fmt -j- -g clevis -g pin -u- <<< "$DECODED")" || [ -z "$PIN" ]; then ++ echo "Pin wasn't found in LUKS metadata!" >&2 ++ exit 1 ++fi ++ ++CFG="$(generate_cfg "$OLD_LUKS_CODED")" ++ ++### ---------------------------------------------------------------------- ++ ++echo "Regenerating with:" ++echo "PIN: $PIN" ++echo "CONFIG: $CFG" ++ ++trap 'echo "Ignoring CONTROL-C!"' INT TERM ++ ++# Get the existing key. ++read -r -s -p "Enter existing LUKS password: " existing_key; echo ++ ++# Check if the key is valid. ++if ! cryptsetup luksOpen --test-passphrase "${DEV}" <<< "${existing_key}"; then ++ exit 1 ++fi ++ ++if ! clevis luks unbind -d "${DEV}" -s "${SLT}" -f; then ++ echo "Error during unbind of rotated key from slot:$SLT in $DEV" >&2 ++ exit 1 ++fi ++ ++if ! clevis luks bind -d "${DEV}" -s "${SLT}" "${PIN}" "${CFG}" -k - <<< "${existing_key}"; then ++ echo "Error during bind of new key from slot:$SLT in $DEV" >&2 ++ exit 1 ++fi ++ ++echo "Keys were succesfully rotated." +diff --git a/src/luks/clevis-luks-regen.1.adoc b/src/luks/clevis-luks-regen.1.adoc +new file mode 100644 +index 0000000..3cd6b7c +--- /dev/null ++++ b/src/luks/clevis-luks-regen.1.adoc +@@ -0,0 +1,36 @@ ++CLEVIS-LUKS-REGEN(1) ++===================== ++:doctype: manpage ++ ++ ++== NAME ++ ++clevis-luks-regen - Regenerates LUKS metadata ++ ++== SYNOPSIS ++ ++*clevis luks regen* -d DEV -s SLT ++ ++== OVERVIEW ++ ++The *clevis luks regen* command regenerates the LUKS metadata for a given slot in a LUKS device. It effectively ++performs an operation equivalent to *clevis luks unbind* and *clevis luks bind* for rebinding said slot and device. ++ ++== OPTIONS ++ ++* *-d* _DEV_ : ++ The bound LUKS device ++ ++* *-s* _SLT_ : ++ The slot or key slot number for rebinding. Note that it requires that such slot is currently bound by clevis. ++ ++== EXAMPLE ++ ++ Regenerate the binding of slot 1 from /dev/sda1: ++ ++ # clevis luks regen -d /dev/sda1 -s 1 ++ ++== SEE ALSO ++ ++link:clevis-luks-bind.1.adoc[*clevis-luks-bind*(1)] ++link:clevis-luks-unbind.1.adoc[*clevis-luks-unbind*(1)] +diff --git a/src/luks/clevis-luks-report b/src/luks/clevis-luks-report +new file mode 100755 +index 0000000..f047256 +--- /dev/null ++++ b/src/luks/clevis-luks-report +@@ -0,0 +1,95 @@ ++#!/usr/bin/bash -e ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2018 Red Hat, Inc. ++# Author: Radovan Sroka ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++. clevis-luks-common-functions ++ ++SUMMARY="Report any key rotation on the server side" ++ ++if [ "$1" == "--summary" ]; then ++ echo "$SUMMARY" ++ exit 0 ++fi ++ ++function usage_and_exit () { ++ echo >&2 ++ echo "Usage: clevis luks report [-qr] -d DEV -s SLOT" >&2 ++ echo >&2 ++ echo -e " -q\t Quiet mode" >&2 ++ echo -e " -r\t Regenerate luks metadata with \"clevis luks regen -d DEV -s SLOT\"" >&2 ++ echo >&2 ++ echo "$SUMMARY" >&2 ++ echo >&2 ++ exit "$1" ++} ++ ++while getopts "hd:s:rq" o; do ++ case "$o" in ++ d) DEV="$OPTARG";; ++ h) usage_and_exit 0;; ++ r) ROPT="regen";; ++ s) SLT="$OPTARG";; ++ q) QOPT="quiet";; ++ *) usage_and_exit 1;; ++ esac ++done ++ ++### get luks metadata ++ ++if [ -z "$DEV" ]; then ++ echo "Did not specify a device!" >&2 ++ exit 1 ++fi ++ ++if [ -z "$SLT" ]; then ++ echo "Did not specify a slot!" >&2 ++ exit 1 ++fi ++ ++if ! DATA_CODED=$(clevis_luks_read_slot "${DEV}" "${SLT}"); then ++ # Error message was already displayed by clevis_luks_read_slot(), ++ # at this point. ++ exit 1 ++fi ++ ++EXE="$(findexe clevis-luks-report-decode)" ++RESULT="$($EXE "${DATA_CODED}")" ++ ++if [ -n "$RESULT" ]; then ++ echo "$RESULT" ++ echo "Report detected that some keys were rotated." ++ if [ -z "$QOPT" ]; then ++ if [ -z "$ROPT" ]; then ++ read -r -p "Do you want to regenerate luks metadata with \"clevis luks regen -d $DEV -s $SLT\"? [ynYN] " ans < /dev/tty ++ [[ "$ans" =~ ^[yY]$ ]] && ROPT="regen" ++ fi ++ fi ++else ++ exit 0 ++fi ++ ++if [ "$ROPT" = "regen" ]; then ++ EXE="$(findexe clevis-luks-regen)" ++ exec "$EXE" -d "$DEV" -s "$SLT" ++else ++ if [ -n "${RESULT}" ]; then ++ # Keys were rotated. ++ exit 1 ++ fi ++fi +diff --git a/src/luks/clevis-luks-report-compare b/src/luks/clevis-luks-report-compare +new file mode 100755 +index 0000000..2ba5132 +--- /dev/null ++++ b/src/luks/clevis-luks-report-compare +@@ -0,0 +1,71 @@ ++#!/usr/bin/bash -e ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2018 Red Hat, Inc. ++# Author: Radovan Sroka ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++SUMMARY="Compare two sets of keys" ++ ++if [ "$1" == "--summary" ]; then ++ echo "$SUMMARY" ++ exit 1 ++fi ++ ++if [ -z "$1" ]; then ++ echo "$0 missing the first argument!" ++ exit 1 ++fi ++ ++if [ -z "$2" ]; then ++ echo "$0 missing the second argument!" ++ exit 1 ++fi ++ ++ADV_KEYS="$1" # keys from advertisement ++LUKS_KEYS="$2" # keys from luks metadata ++ ++### iterate over adv keys and make thumbprints ++CNT=0 ++declare -a ADV_KEYS_ARRAY ++while res="$(jose fmt -j- -g keys -g"$CNT" -o- <<< "$ADV_KEYS")"; do ++ thp="$(echo "$res" | jose jwk thp -i-)" ++ ADV_KEYS_ARRAY["$CNT"]="$thp" ++ CNT=$(( CNT + 1 )) ++done ++ ++CNT=0 ++while key="$(jose fmt -j- -g keys -g"$CNT" -o- <<< "$LUKS_KEYS")"; do ++ thp="$(echo "$key" | jose jwk thp -i-)" ++ ++ FOUND=0 ++ for k in "${ADV_KEYS_ARRAY[@]}" ++ do ++ if [ "$k" = "$thp" ]; then ++ FOUND=1 ++ break ++ fi ++ done ++ ++ if [ "$FOUND" -eq "0" ]; then ++ echo "Key \"$thp\" is not in the advertisement and was probably rotated!" ++ echo "$key" ++ echo ++ fi ++ CNT=$(( CNT + 1 )) ++done ++ ++exit 0 +diff --git a/src/luks/clevis-luks-report-decode b/src/luks/clevis-luks-report-decode +new file mode 100755 +index 0000000..f39d1e9 +--- /dev/null ++++ b/src/luks/clevis-luks-report-decode +@@ -0,0 +1,59 @@ ++#!/usr/bin/bash -e ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2018 Red Hat, Inc. ++# Author: Radovan Sroka ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++. clevis-luks-common-functions ++ ++SUMMARY="Decode luks header" ++ ++if [ "$1" == "--summary" ]; then ++ echo "$SUMMARY" ++ exit 1 ++fi ++ ++if [ -z "$1" ]; then ++ echo "$0 missing the first argument!" ++ exit 1 ++fi ++ ++DATA_CODED="$1" ++ ++if DATA_CODED="$(jose jwe fmt -i- <<< "$DATA_CODED")"; then ++ DATA_CODED="$(jose fmt -j- -g protected -u- <<< "$DATA_CODED")" ++ DATA_DECODED="$(jose b64 dec -i- <<< "$DATA_CODED")" ++else ++ echo "Error decoding JWE protected header!" >&2 ++ exit 1 ++fi ++ ++### get pin and url ++ ++if ! PIN="$(jose fmt -j- -g clevis -g pin -u- <<< "$DATA_DECODED")" || [ -z "$PIN" ]; then ++ echo "Pin wasn't found in luks metadata!" >&2 ++ exit 1 ++fi ++ ++if ! CONTENT="$(jose fmt -j- -g clevis -g "$PIN" -o- <<< "$DATA_DECODED")" || [ -z "$CONTENT" ]; then ++ echo "Content wasn't found!" >&2 ++ exit 1 ++fi ++ ++EXE="$(findexe clevis-luks-report-"$PIN")" ++ ++exec "$EXE" "$CONTENT" +diff --git a/src/luks/clevis-luks-report-sss b/src/luks/clevis-luks-report-sss +new file mode 100755 +index 0000000..1dba4c1 +--- /dev/null ++++ b/src/luks/clevis-luks-report-sss +@@ -0,0 +1,53 @@ ++#!/bin/bash -e ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2018 Red Hat, Inc. ++# Author: Radovan Sroka ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++. clevis-luks-common-functions ++ ++SUMMARY="SSS report plugin" ++ ++if [ "$1" == "--summary" ]; then ++ echo "$SUMMARY" ++ exit 1 ++fi ++ ++if [ -z "$1" ]; then ++ echo "$0 missing the first argument!" >&2 ++ exit 1 ++fi ++ ++CONTENT="$1" # sss content ++ ++CNT=0 ++while DATA_CODED="$(jose fmt -j- -g jwe -g"$CNT" -u- <<< "$CONTENT")"; do ++ if [ -z "$DATA_CODED" ]; then ++ CNT=$(( CNT + 1 )) ++ continue # in some cases it can be empty string ++ fi ++ ++ EXE="$(findexe clevis-luks-report-decode)" ++ if ! $EXE "$DATA_CODED"; then ++ echo "Failed" >&2 ++ exit 1 ++ fi ++ ++ CNT=$(( CNT + 1 )) ++done ++ ++exit 0 +diff --git a/src/luks/clevis-luks-report-tang b/src/luks/clevis-luks-report-tang +new file mode 100755 +index 0000000..07f2a72 +--- /dev/null ++++ b/src/luks/clevis-luks-report-tang +@@ -0,0 +1,67 @@ ++#!/usr/bin/bash -e ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2018 Red Hat, Inc. ++# Author: Radovan Sroka ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++. clevis-luks-common-functions ++ ++SUMMARY="Tang report plugin" ++ ++if [ "$1" == "--summary" ]; then ++ echo "$SUMMARY" ++ exit 1 ++fi ++ ++if [ -z "$1" ]; then ++ echo "$0 missing the first argument!" ++ exit 1 ++fi ++ ++CONTENT="$1" ++ ++### Get the advertisement ++if ! URL="$(jose fmt -j- -g url -u- <<< "$CONTENT")" || [ -z "$URL" ]; then ++ echo "URL was not found!" >&2 ++ exit 1 ++fi ++ ++if ! jws="$(curl -sfg "$URL/adv")"; then ++ echo "Unable to fetch advertisement: $URL/adv!" >&2 ++ exit 1 ++fi ++ ++if ! TANG_KEYS="$(jose fmt -j- -Og payload -SyOg keys -AUo- <<< "$jws")"; then ++ echo "Advertisement is malformed!" >&2 ++ exit 1 ++fi ++ ++### Check advertisement validity ++ver="$(jose jwk use -i- -r -u verify -o- <<< "$TANG_KEYS")" ++if ! jose jws ver -i "$jws" -k- -a <<< "$ver"; then ++ echo "Advertisement is missing signatures!" >&2 ++ exit 1 ++fi ++ ++if ! LUKS_KEYS="$(jose fmt -j- -g adv -o- <<< "$CONTENT")" || [ -z "$LUKS_KEYS" ]; then ++ echo "LUKS keys from LUKS metadata were not found!" >&2 ++ exit 1 ++fi ++ ++EXE="$(findexe clevis-luks-report-compare)" ++ ++exec "$EXE" "$TANG_KEYS" "$LUKS_KEYS" +diff --git a/src/luks/clevis-luks-report.1.adoc b/src/luks/clevis-luks-report.1.adoc +new file mode 100644 +index 0000000..cf42afe +--- /dev/null ++++ b/src/luks/clevis-luks-report.1.adoc +@@ -0,0 +1,41 @@ ++CLEVIS-LUKS-REPORT(1) ++===================== ++:doctype: manpage ++ ++ ++== NAME ++ ++clevis-luks-report - Reports whether a pin bound to a LUKS1 or LUKS2 volume has been rotated ++ ++== SYNOPSIS ++ ++*clevis luks report* -d DEV -s SLT ++ ++== OVERVIEW ++ ++The *clevis luks report* command checks a given slot of a LUKS device and reports whether the pin bound to it ++-- if any -- has been rotated. ++ ++== OPTIONS ++ ++* *-d* _DEV_ : ++ The bound LUKS device ++ ++* *-s* _SLT_ : ++ The slot or key slot number for the pin to be verified ++ ++* *-q* : ++ Quiet mode. If used, we will not prompt whether to regenerate data with *clevis luks regen* ++ ++* *-r* : ++ Regenerates LUKS metadata with *clevis luks regen -d DEV -s SLOT* ++ ++== EXAMPLE ++ ++ Check whether the pin bound to slot 1 in /dev/sda1 has been rotated: ++ ++ # clevis luks report -d /dev/sda1 -s 1 ++ ++== SEE ALSO ++ ++link:clevis-luks-regen.1.adoc[*clevis-luks-regen*(1)] +diff --git a/src/luks/meson.build b/src/luks/meson.build +index 1f64ab0..7c045c4 100644 +--- a/src/luks/meson.build ++++ b/src/luks/meson.build +@@ -15,6 +15,18 @@ if libcryptsetup.found() and luksmeta.found() and pwmake.found() + bins += join_paths(meson.current_source_dir(), 'clevis-luks-bind') + mans += join_paths(meson.current_source_dir(), 'clevis-luks-bind.1') + ++ bins += join_paths(meson.current_source_dir(), 'clevis-luks-common-functions') ++ ++ bins += join_paths(meson.current_source_dir(), 'clevis-luks-regen') ++ mans += join_paths(meson.current_source_dir(), 'clevis-luks-regen.1') ++ ++ bins += join_paths(meson.current_source_dir(), 'clevis-luks-report') ++ bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-compare') ++ bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-decode') ++ bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-sss') ++ bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-tang') ++ mans += join_paths(meson.current_source_dir(), 'clevis-luks-report.1') ++ + mans += join_paths(meson.current_source_dir(), 'clevis-luks-unlockers.7') + else + warning('Will not install LUKS support due to missing dependencies!') +-- +2.21.0 + diff --git a/SOURCES/Add-rd.neednet-1-to-cmdline-only-if-there-are-device.patch b/SOURCES/Add-rd.neednet-1-to-cmdline-only-if-there-are-device.patch new file mode 100644 index 0000000..a73b797 --- /dev/null +++ b/SOURCES/Add-rd.neednet-1-to-cmdline-only-if-there-are-device.patch @@ -0,0 +1,57 @@ +From 25009adea66d3bf9b73f128273de28e532b03281 Mon Sep 17 00:00:00 2001 +From: Sergio Correia +Date: Sat, 30 Nov 2019 18:23:09 -0500 +Subject: [PATCH] Add rd.neednet=1 to cmdline only if there are devices bound + to tang + +--- + src/luks/systemd/dracut/module-setup.sh.in | 24 ++++++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +diff --git a/src/luks/systemd/dracut/module-setup.sh.in b/src/luks/systemd/dracut/module-setup.sh.in +index 990bf4a..841f7a8 100755 +--- a/src/luks/systemd/dracut/module-setup.sh.in ++++ b/src/luks/systemd/dracut/module-setup.sh.in +@@ -18,19 +18,35 @@ + # along with this program. If not, see . + # + ++is_bound_to_tang() { ++ local dev ++ for dev in $(lsblk -p -n -s -r \ ++ | awk '$6 == "crypt" { getline; print $1 }' | sort -u); do ++ if clevis luks list -d "${dev}" 2>/dev/null | grep -q tang; then ++ return 0 ++ fi ++ done ++ return 1 ++} ++ + depends() { +- echo crypt systemd network +- return 0 ++ local depends="crypt systemd" ++ if is_bound_to_tang; then ++ depends=$(printf "%s network" "${depends}") ++ fi ++ echo "${depends}" + } + +-cmdline() { ++tang_cmdline() { + echo "rd.neednet=1" + } + + install() { + local ret=0 + +- cmdline > "${initdir}/etc/cmdline.d/99clevis.conf" ++ if is_bound_to_tang; then ++ tang_cmdline > "${initdir}/etc/cmdline.d/99clevis.conf" ++ fi + + inst_hook initqueue/online 60 "$moddir/clevis-hook.sh" + inst_hook initqueue/settled 60 "$moddir/clevis-hook.sh" +-- +2.18.1 + diff --git a/SOURCES/Add-support-for-listing-existing-PBD-policies-in-pla.patch b/SOURCES/Add-support-for-listing-existing-PBD-policies-in-pla.patch new file mode 100644 index 0000000..4f6c2bf --- /dev/null +++ b/SOURCES/Add-support-for-listing-existing-PBD-policies-in-pla.patch @@ -0,0 +1,1009 @@ +From a128130755bcd893ccf1d70b52c13fbaf29613c9 Mon Sep 17 00:00:00 2001 +From: Sergio Correia +Date: Sat, 30 Nov 2019 14:26:59 -0500 +Subject: [PATCH] Add clevis luks list command + +Usage: +clevis luks list -d DEV [-s SLT] + +Examples: + +clevis luks list -d device +1: sss '{"t":1,"pins":{"tang":[{"url":"addr1"},{"url":"addr2"}],"tpm2":[{"hash":"sha256","key":"ecc"}],"sss":{"t":1,"pins":{"tang":[{"url":"addr3"}]}}}}' +2: tang '{"url":"addr"}' +3: tpm2 '{"hash":"sha256","key":"ecc","pcr_bank":"sha1","pcr_ids":"7"}' + +clevis luks list -d device -s 3 +3: tpm2 '{"hash":"sha256","key":"ecc","pcr_bank":"sha1","pcr_ids":"7"}' +--- + src/luks/clevis-luks-common-functions | 173 ++++++++++++++++++++++++++ + src/luks/clevis-luks-list | 77 ++++++++++++ + src/luks/clevis-luks-list.1.adoc | 58 +++++++++ + src/luks/meson.build | 8 +- + src/luks/tests/list-recursive-luks1 | 85 +++++++++++++ + src/luks/tests/list-recursive-luks2 | 85 +++++++++++++ + src/luks/tests/list-sss-tang-luks1 | 77 ++++++++++++ + src/luks/tests/list-sss-tang-luks2 | 77 ++++++++++++ + src/luks/tests/list-tang-luks1 | 64 ++++++++++ + src/luks/tests/list-tang-luks2 | 64 ++++++++++ + src/luks/tests/meson.build | 36 ++++++ + src/luks/tests/tests-common-functions | 76 +++++++++++ + 12 files changed, 879 insertions(+), 1 deletion(-) + create mode 100755 src/luks/clevis-luks-list + create mode 100644 src/luks/clevis-luks-list.1.adoc + create mode 100755 src/luks/tests/list-recursive-luks1 + create mode 100755 src/luks/tests/list-recursive-luks2 + create mode 100755 src/luks/tests/list-sss-tang-luks1 + create mode 100755 src/luks/tests/list-sss-tang-luks2 + create mode 100755 src/luks/tests/list-tang-luks1 + create mode 100755 src/luks/tests/list-tang-luks2 + create mode 100644 src/luks/tests/meson.build + create mode 100644 src/luks/tests/tests-common-functions + +diff --git a/src/luks/clevis-luks-common-functions b/src/luks/clevis-luks-common-functions +index d676253..9ba1812 100644 +--- a/src/luks/clevis-luks-common-functions ++++ b/src/luks/clevis-luks-common-functions +@@ -141,3 +141,176 @@ findexe() { + return 1 + } + ++# clevis_luks_used_slots() will return the list of used slots for a given LUKS ++# device. ++clevis_luks_used_slots() { ++ local DEV="${1}" ++ ++ local slots ++ if cryptsetup isLuks --type luks1 "${DEV}"; then ++ readarray -t slots < <(cryptsetup luksDump "${DEV}" \ ++ | sed -rn 's|^Key Slot ([0-7]): ENABLED$|\1|p') ++ elif cryptsetup isLuks --type luks2 "${DEV}"; then ++ readarray -t slots < <(cryptsetup luksDump "${DEV}" \ ++ | sed -rn 's|^\s+([0-9]+): luks2$|\1|p') ++ else ++ echo "${DEV} is not a supported LUKS device!" >&2 ++ return 1 ++ fi ++ echo "${slots[@]}" ++} ++ ++# clevis_luks_decode_jwe() will decode a given JWE. ++clevis_luks_decode_jwe() { ++ local jwe="${1}" ++ ++ local coded ++ if ! coded=$(jose jwe fmt -i- <<< "${jwe}"); then ++ return 1 ++ fi ++ ++ coded=$(jose fmt -j- -g protected -u- <<< "${coded}" | tr -d '"') ++ jose b64 dec -i- <<< "${coded}" ++} ++ ++# clevis_luks_print_pin_config() will print the config of a given pin; i.e. ++# for tang it will display the associated url address, and for tpm2, the ++# properties in place, like the hash, for instance. ++clevis_luks_print_pin_config() { ++ local P="${1}" ++ local decoded="${2}" ++ ++ local content ++ if ! content="$(jose fmt -j- -g clevis -g "${P}" -o- <<< "${decoded}")" \ ++ || [[ -z "${content}" ]]; then ++ return 1 ++ fi ++ ++ local pin= ++ case "${P}" in ++ tang) ++ local url ++ url="$(jose fmt -j- -g url -u- <<< "${content}")" ++ pin=$(printf '{"url":"%s"}' "${url}") ++ printf "tang '%s'" "${pin}" ++ ;; ++ tpm2) ++ # Valid properties for tpm2 pin are the following: ++ # hash, key, pcr_bank, pcr_ids, pcr_digest. ++ local key ++ local value ++ for key in 'hash' 'key' 'pcr_bank' 'pcr_ids' 'pcr_digest'; do ++ if value=$(jose fmt -j- -g "${key}" -u- <<< "${content}"); then ++ pin=$(printf '%s,"%s":"%s"' "${pin}" "${key}" "${value}") ++ fi ++ done ++ # Remove possible leading comma. ++ pin=${pin/#,/} ++ printf "tpm2 '{%s}'" "${pin}" ++ ;; ++ sss) ++ local threshold ++ threshold=$(jose fmt -j- -Og t -o- <<< "${content}") ++ clevis_luks_process_sss_pin "${content}" "${threshold}" ++ ;; ++ *) ++ printf "unknown pin '%s'" "${P}" ++ ;; ++ esac ++} ++ ++# clevis_luks_decode_pin_config() will receive a JWE and extract a pin config ++# from it. ++clevis_luks_decode_pin_config() { ++ local jwe="${1}" ++ ++ local decoded ++ if ! decoded=$(clevis_luks_decode_jwe "${jwe}"); then ++ return 1 ++ fi ++ ++ local P ++ if ! P=$(jose fmt -j- -Og clevis -g pin -u- <<< "${decoded}"); then ++ return 1 ++ fi ++ ++ clevis_luks_print_pin_config "${P}" "${decoded}" ++} ++ ++# clevis_luks_join_sss_cfg() will receive a list of configurations for a given ++# pin and returns it as list, in the format PIN [cfg1, cfg2, ..., cfgN]. ++clevis_luks_join_sss_cfg() { ++ local pin="${1}" ++ local cfg="${2}" ++ cfg=$(echo "${cfg}" | tr -d "'" | sed -e 's/^,//') ++ printf '"%s":[%s]' "${pin}" "${cfg}" ++} ++ ++# clevis_luks_process_sss_pin() will receive a JWE with information on the sss ++# pin config, and also its associated threshold, and will extract the info. ++clevis_luks_process_sss_pin() { ++ local jwe="${1}" ++ local threshold="${2}" ++ ++ local sss_tang ++ local sss_tpm2 ++ local sss ++ local pin_cfg ++ local pin ++ local cfg ++ ++ local coded ++ for coded in $(jose fmt -j- -Og jwe -Af- <<< "${jwe}"| tr -d '"'); do ++ if ! pin_cfg="$(clevis_luks_decode_pin_config "${coded}")"; then ++ continue ++ fi ++ read -r pin cfg <<< "${pin_cfg}" ++ case "${pin}" in ++ tang) ++ sss_tang="${sss_tang},${cfg}" ++ ;; ++ tpm2) ++ sss_tpm2="${sss_tpm2},${cfg}" ++ ;; ++ sss) ++ sss=$(echo "${cfg}" | tr -d "'") ++ ;; ++ esac ++ done ++ ++ cfg= ++ if [[ -n "${sss_tang}" ]]; then ++ cfg=$(clevis_luks_join_sss_cfg "tang" "${sss_tang}") ++ fi ++ ++ if [[ -n "${sss_tpm2}" ]]; then ++ cfg="${cfg},"$(clevis_luks_join_sss_cfg "tpm2" "${sss_tpm2}") ++ fi ++ ++ if [[ -n "${sss}" ]]; then ++ cfg=$(printf '%s,"sss":%s' "${cfg}" "${sss}") ++ fi ++ ++ # Remove possible leading comma. ++ cfg=${cfg/#,/} ++ pin=$(printf '{"t":%d,"pins":{%s}}' "${threshold}" "${cfg}") ++ printf "sss '%s'" "${pin}" ++} ++ ++# clevis_luks_read_pins_from_slot() will receive a given device and slot and ++# will then output its associated policy configuration. ++clevis_luks_read_pins_from_slot() { ++ local DEV="${1}" ++ local SLOT="${2}" ++ ++ local jwe ++ if ! jwe=$(clevis_luks_read_slot "${DEV}" "${SLOT}" 2>/dev/null); then ++ return 1 ++ fi ++ ++ local cfg ++ if ! cfg="$(clevis_luks_decode_pin_config "${jwe}")"; then ++ return 1 ++ fi ++ printf "%s: %s\n" "${SLOT}" "${cfg}" ++} +diff --git a/src/luks/clevis-luks-list b/src/luks/clevis-luks-list +new file mode 100755 +index 0000000..58678c4 +--- /dev/null ++++ b/src/luks/clevis-luks-list +@@ -0,0 +1,77 @@ ++#!/bin/bash -e ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2017-2019 Red Hat, Inc. ++# Author: Javier Martinez Canillas ++# Author: Sergio Correia - LUKS2 support. ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++. clevis-luks-common-functions ++ ++SUMMARY="Lists pins bound to a LUKSv1 or LUKSv2 device" ++ ++function usage() { ++ echo >&2 ++ echo "Usage: clevis luks list -d DEV [-s SLT]" >&2 ++ echo >&2 ++ echo "$SUMMARY": >&2 ++ echo >&2 ++ echo " -d DEV The LUKS device to list bound pins" >&2 ++ echo >&2 ++ echo " -s SLOT The slot number to list" >&2 ++ echo >&2 ++ exit 1 ++} ++ ++if [ ${#} -eq 1 ] && [ "${1}" = "--summary" ]; then ++ echo "${SUMMARY}" ++ exit 0 ++fi ++ ++while getopts ":d:s:" o; do ++ case "$o" in ++ d) DEV=${OPTARG};; ++ s) SLT=${OPTARG};; ++ *) usage;; ++ esac ++done ++ ++if [ -z "${DEV}" ]; then ++ echo "Did not specify a device!" >&2 ++ usage ++fi ++ ++if cryptsetup isLuks --type luks1 "${DEV}"; then ++ if ! luksmeta test -d "${DEV}" 2>/dev/null; then ++ echo "The ${DEV} device is not valid!" >&2 ++ exit 1 ++ fi ++fi ++ ++if [ -n "${SLT}" ]; then ++ clevis_luks_read_pins_from_slot "${DEV}" "${SLT}" ++else ++ if ! slots=$(clevis_luks_used_slots "${DEV}"); then ++ echo "No used slots detected for device ${DEV}!" >&2 ++ exit 1 ++ fi ++ ++ for s in ${slots}; do ++ if ! clevis_luks_read_pins_from_slot "${DEV}" "${s}"; then ++ continue ++ fi ++ done ++fi +diff --git a/src/luks/clevis-luks-list.1.adoc b/src/luks/clevis-luks-list.1.adoc +new file mode 100644 +index 0000000..2e84f05 +--- /dev/null ++++ b/src/luks/clevis-luks-list.1.adoc +@@ -0,0 +1,58 @@ ++CLEVIS-LUKS-LIST(1) ++=================== ++:doctype: manpage ++ ++ ++== NAME ++ ++clevis-luks-list - Lists pins bound to a LUKS device ++ ++== SYNOPSIS ++ ++*clevis luks list* -d DEV [-s SLT] ++ ++== OVERVIEW ++ ++The *clevis luks list* command list the pins bound to LUKS device. ++For example: ++ ++ clevis luks list -d /dev/sda1 ++ ++== OPTIONS ++ ++* *-d* _DEV_ : ++ The LUKS device on which to list bound pins ++ ++* *-s* _SLT_ : ++ The slot to use for listing the pin from ++ ++== EXAMPLES ++ ++ clevis luks list -d /dev/sda1 ++ 1: sss '{"t":1,"pins":{"tang":[{"url":"addr1"},{"url":"addr2"}],"tpm2":[{"hash":"sha256","key":"ecc"}],"sss":{"t":1,"pins":{"tang":[{"url":"addr3"}]}}}}' ++ 2: tang '{"url":"addr"}' ++ 3: tpm2 '{"hash":"sha256","key":"ecc","pcr_bank":"sha1","pcr_ids":"7"}' ++ ++As we can see in the example above, */dev/sda1* has three slots bound each with a different pin. ++- Slot #1 is bound with the _sss_ pin, and uses also tang and tpm2 pins in its policy. ++- Slot #2 is bound using the _tang_ pin ++- Slot #3 is bound with the _tpm2_ pin ++ ++Note that the output of *clevis luks list* can be used with the *clevis luks bind* command, such as: ++ ++ clevis luks bind -d /dev/sda1 tpm2 '{"hash":"sha256","key":"ecc","pcr_bank":"sha1","pcr_ids":"7"}' ++ ++And we will bind another slot with a policy similar to the one we have in slot #3. ++Also note that if you are interested in a particular slot, you can pass the _-s SLT_ argument to *clevis luks list*: ++ ++ clevis luks list -d /dev/sda1 -s 2 ++ 2: tang '{"url":"addr"}' ++ ++In the above example, we listed only the pin bound to slot #2. ++ ++== SEE ALSO ++ ++link:clevis-luks-bind.1.adoc[*clevis-luks-bind*(1)], ++link:clevis-encrypt-tang.1.adoc[*clevis-encrypt-tang*(1)], ++link:clevis-encrypt-tpm2.1.adoc[*clevis-encrypt-tpm2*(1)], ++link:clevis-encrypt-sss.1.adoc[*clevis-encrypt-sss*(1)], +diff --git a/src/luks/meson.build b/src/luks/meson.build +index 7c045c4..51d82fb 100644 +--- a/src/luks/meson.build ++++ b/src/luks/meson.build +@@ -20,6 +20,9 @@ if libcryptsetup.found() and luksmeta.found() and pwmake.found() + bins += join_paths(meson.current_source_dir(), 'clevis-luks-regen') + mans += join_paths(meson.current_source_dir(), 'clevis-luks-regen.1') + ++ bins += join_paths(meson.current_source_dir(), 'clevis-luks-list') ++ mans += join_paths(meson.current_source_dir(), 'clevis-luks-list.1') ++ + bins += join_paths(meson.current_source_dir(), 'clevis-luks-report') + bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-compare') + bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-decode') +@@ -30,4 +33,7 @@ if libcryptsetup.found() and luksmeta.found() and pwmake.found() + mans += join_paths(meson.current_source_dir(), 'clevis-luks-unlockers.7') + else + warning('Will not install LUKS support due to missing dependencies!') +-endif +\ No newline at end of file ++endif ++ ++# Tests. ++subdir('tests') +diff --git a/src/luks/tests/list-recursive-luks1 b/src/luks/tests/list-recursive-luks1 +new file mode 100755 +index 0000000..d9eaa3a +--- /dev/null ++++ b/src/luks/tests/list-recursive-luks1 +@@ -0,0 +1,85 @@ ++#!/bin/bash -ex ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2019 Red Hat, Inc. ++# Author: Sergio Correia ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++TEST=$(basename "${0}") ++. tests-common-functions ++ ++on_exit() { ++ [ -d "${TMP}" ] && rm -rf "${TMP}" ++} ++ ++trap 'on_exit' EXIT ++trap 'exit' ERR ++ ++TMP="$(mktemp -d)" ++ ++ADV="${TMP}/adv.jws" ++create_tang_adv "${ADV}" ++PIN="sss" ++CFG=$(printf ' ++{ ++ "t": 1, ++ "pins": { ++ "sss": { ++ "t": 1, ++ "pins": { ++ "sss": { ++ "t": 1, ++ "pins": { ++ "tang": [ ++ { ++ "url": "ADDR","adv": "%s" ++ } ++ ] ++ } ++ } ++ } ++ } ++ } ++} ++' "${ADV}") ++ ++# LUKS1. ++DEV="${TMP}/luks1-device" ++UUID="cb6e8904-81ff-40da-a84a-07ab9ab5715e" ++new_device "luks1" "${DEV}" ++ ++if ! clevis luks bind -f -d "${DEV}" "${PIN}" "${CFG}" <<< "${DEFAULT_PASS}"; then ++ error "${TEST}: Binding is expected to succeed when given a correct (${DEFAULT_PASS}) password." ++fi ++ ++SLT=1 ++if ! read -r slot pin cfg < <(clevis luks list -d "${DEV}" -s "${SLT}"); then ++ error "${TEST}: clevis luks list is expected to succeed for device(${DEV}) and slot (${SLT})" ++fi ++ ++if [[ "${slot}" != "${SLT}:" ]]; then ++ error "${TEST}: slot (${slot}) is expected to be ${SLT}" ++fi ++ ++if [[ "${pin}" != "${PIN}" ]]; then ++ error "${TEST}: pin (${pin}) is expected to be '${PIN}'" ++fi ++ ++to_remove_from_cfg=$(printf ',"adv": "%s"' "${ADV}") ++cfg_for_cmp=${cfg//"${to_remove_from_cfg}"/} ++if ! pin_cfg_equal "${cfg}" "${cfg_for_cmp}"; then ++ error "${TEST}: config obtained from clevis luks list (${cfg}) is expected to match the one used to bind the test (${cfg_for_cmp})" ++fi +diff --git a/src/luks/tests/list-recursive-luks2 b/src/luks/tests/list-recursive-luks2 +new file mode 100755 +index 0000000..80a8278 +--- /dev/null ++++ b/src/luks/tests/list-recursive-luks2 +@@ -0,0 +1,85 @@ ++#!/bin/bash -ex ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2019 Red Hat, Inc. ++# Author: Sergio Correia ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++TEST=$(basename "${0}") ++. tests-common-functions ++ ++on_exit() { ++ [ -d "${TMP}" ] && rm -rf "${TMP}" ++} ++ ++trap 'on_exit' EXIT ++trap 'exit' ERR ++ ++TMP="$(mktemp -d)" ++ ++ADV="${TMP}/adv.jws" ++create_tang_adv "${ADV}" ++PIN="sss" ++CFG=$(printf ' ++{ ++ "t": 1, ++ "pins": { ++ "sss": { ++ "t": 1, ++ "pins": { ++ "sss": { ++ "t": 1, ++ "pins": { ++ "tang": [ ++ { ++ "url": "ADDR","adv": "%s" ++ } ++ ] ++ } ++ } ++ } ++ } ++ } ++} ++' "${ADV}") ++ ++# LUKS2. ++DEV="${TMP}/luks1-device" ++UUID="cb6e8904-81ff-40da-a84a-07ab9ab5715e" ++new_device "luks2" "${DEV}" ++ ++if ! clevis luks bind -f -d "${DEV}" "${PIN}" "${CFG}" <<< "${DEFAULT_PASS}"; then ++ error "${TEST}: Binding is expected to succeed when given a correct (${DEFAULT_PASS}) password." ++fi ++ ++SLT=1 ++if ! read -r slot pin cfg < <(clevis luks list -d "${DEV}" -s "${SLT}"); then ++ error "${TEST}: clevis luks list is expected to succeed for device(${DEV}) and slot (${SLT})" ++fi ++ ++if [[ "${slot}" != "${SLT}:" ]]; then ++ error "${TEST}: slot (${slot}) is expected to be ${SLT}" ++fi ++ ++if [[ "${pin}" != "${PIN}" ]]; then ++ error "${TEST}: pin (${pin}) is expected to be '${PIN}'" ++fi ++ ++to_remove_from_cfg=$(printf ',"adv": "%s"' "${ADV}") ++cfg_for_cmp=${cfg//"${to_remove_from_cfg}"/} ++if ! pin_cfg_equal "${cfg}" "${cfg_for_cmp}"; then ++ error "${TEST}: config obtained from clevis luks list (${cfg}) is expected to match the one used to bind the test (${cfg_for_cmp})" ++fi +diff --git a/src/luks/tests/list-sss-tang-luks1 b/src/luks/tests/list-sss-tang-luks1 +new file mode 100755 +index 0000000..086fa35 +--- /dev/null ++++ b/src/luks/tests/list-sss-tang-luks1 +@@ -0,0 +1,77 @@ ++#!/bin/bash -ex ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2019 Red Hat, Inc. ++# Author: Sergio Correia ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++TEST=$(basename "${0}") ++. tests-common-functions ++ ++on_exit() { ++ [ -d "${TMP}" ] && rm -rf "${TMP}" ++} ++ ++trap 'on_exit' EXIT ++trap 'exit' ERR ++ ++TMP="$(mktemp -d)" ++ ++ADV="${TMP}/adv.jws" ++create_tang_adv "${ADV}" ++PIN="sss" ++CFG=$(printf ' ++{ ++ "t": 2, ++ "pins": { ++ "tang": [ ++ {"url":"ADDR1","adv":"%s"}, ++ {"url":"ADDR2","adv":"%s"}, ++ {"url":"ADDR3","adv":"%s"}, ++ {"url":"ADDR4","adv":"%s"}, ++ {"url":"ADDR5","adv":"%s"} ++ ] ++ } ++} ++' "${ADV}" "${ADV}" "${ADV}" "${ADV}" "${ADV}") ++ ++# LUKS1. ++DEV="${TMP}/luks1-device" ++UUID="cb6e8904-81ff-40da-a84a-07ab9ab5715e" ++new_device "luks1" "${DEV}" ++ ++if ! clevis luks bind -f -d "${DEV}" ${PIN} "${CFG}" <<< "${DEFAULT_PASS}"; then ++ error "${TEST}: Binding is expected to succeed when given a correct (${DEFAULT_PASS}) password." ++fi ++ ++SLT=1 ++if ! read -r slot pin cfg < <(clevis luks list -d "${DEV}" -s "${SLT}"); then ++ error "${TEST}: clevis luks list is expected to succeed for device(${DEV}) and slot (${SLT})" ++fi ++ ++if [[ "${slot}" != "${SLT}:" ]]; then ++ error "${TEST}: slot (${slot}) is expected to be ${SLT}" ++fi ++ ++if [[ "${pin}" != "${PIN}" ]]; then ++ error "${TEST}: pin (${pin}) is expected to be '${PIN}'" ++fi ++ ++to_remove_from_cfg=$(printf ',"adv": "%s"' "${ADV}") ++cfg_for_cmp=${cfg//"${to_remove_from_cfg}"/} ++if ! pin_cfg_equal "${cfg}" "${cfg_for_cmp}"; then ++ error "${TEST}: config obtained from clevis luks list (${cfg}) is expected to match the one used to bind the test (${cfg_for_cmp})" ++fi +diff --git a/src/luks/tests/list-sss-tang-luks2 b/src/luks/tests/list-sss-tang-luks2 +new file mode 100755 +index 0000000..ea4cfbb +--- /dev/null ++++ b/src/luks/tests/list-sss-tang-luks2 +@@ -0,0 +1,77 @@ ++#!/bin/bash -ex ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2019 Red Hat, Inc. ++# Author: Sergio Correia ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++TEST=$(basename "${0}") ++. tests-common-functions ++ ++on_exit() { ++ [ -d "${TMP}" ] && rm -rf "${TMP}" ++} ++ ++trap 'on_exit' EXIT ++trap 'exit' ERR ++ ++TMP="$(mktemp -d)" ++ ++ADV="${TMP}/adv.jws" ++create_tang_adv "${ADV}" ++PIN="sss" ++CFG=$(printf ' ++{ ++ "t": 2, ++ "pins": { ++ "tang": [ ++ {"url":"ADDR1","adv":"%s"}, ++ {"url":"ADDR2","adv":"%s"}, ++ {"url":"ADDR3","adv":"%s"}, ++ {"url":"ADDR4","adv":"%s"}, ++ {"url":"ADDR5","adv":"%s"} ++ ] ++ } ++} ++' "${ADV}" "${ADV}" "${ADV}" "${ADV}" "${ADV}") ++ ++# LUKS2. ++DEV="${TMP}/luks1-device" ++UUID="cb6e8904-81ff-40da-a84a-07ab9ab5715e" ++new_device "luks2" "${DEV}" ++ ++if ! clevis luks bind -f -d "${DEV}" ${PIN} "${CFG}" <<< "${DEFAULT_PASS}"; then ++ error "${TEST}: Binding is expected to succeed when given a correct (${DEFAULT_PASS}) password." ++fi ++ ++SLT=1 ++if ! read -r slot pin cfg < <(clevis luks list -d "${DEV}" -s "${SLT}"); then ++ error "${TEST}: clevis luks list is expected to succeed for device(${DEV}) and slot (${SLT})" ++fi ++ ++if [[ "${slot}" != "${SLT}:" ]]; then ++ error "${TEST}: slot (${slot}) is expected to be ${SLT}" ++fi ++ ++if [[ "${pin}" != "${PIN}" ]]; then ++ error "${TEST}: pin (${pin}) is expected to be '${PIN}'" ++fi ++ ++to_remove_from_cfg=$(printf ',"adv": "%s"' "${ADV}") ++cfg_for_cmp=${cfg//"${to_remove_from_cfg}"/} ++if ! pin_cfg_equal "${cfg}" "${cfg_for_cmp}"; then ++ error "${TEST}: config obtained from clevis luks list (${cfg}) is expected to match the one used to bind the test (${cfg_for_cmp})" ++fi +diff --git a/src/luks/tests/list-tang-luks1 b/src/luks/tests/list-tang-luks1 +new file mode 100755 +index 0000000..c526693 +--- /dev/null ++++ b/src/luks/tests/list-tang-luks1 +@@ -0,0 +1,64 @@ ++#!/bin/bash -ex ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2019 Red Hat, Inc. ++# Author: Sergio Correia ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++TEST=$(basename "${0}") ++. tests-common-functions ++ ++on_exit() { ++ [ -d "${TMP}" ] && rm -rf "${TMP}" ++} ++ ++trap 'on_exit' EXIT ++trap 'exit' ERR ++ ++TMP="$(mktemp -d)" ++ ++ADV="${TMP}/adv.jws" ++create_tang_adv "${ADV}" ++PIN="tang" ++CFG=$(printf '{"url": "ADDR","adv": "%s"}' "${ADV}") ++ ++# LUKS1. ++DEV="${TMP}/luks1-device" ++UUID="cb6e8904-81ff-40da-a84a-07ab9ab5715e" ++new_device "luks1" "${DEV}" ++ ++if ! clevis luks bind -f -d "${DEV}" "${PIN}" "${CFG}" <<< "${DEFAULT_PASS}"; then ++ error "${TEST}: Binding is expected to succeed when given a correct (${DEFAULT_PASS}) password." ++fi ++ ++SLT=1 ++if ! read -r slot pin cfg < <(clevis luks list -d "${DEV}" -s "${SLT}"); then ++ error "${TEST}: clevis luks list is expected to succeed for device(${DEV}) and slot (${SLT})" ++fi ++ ++if [[ "${slot}" != "${SLT}:" ]]; then ++ error "${TEST}: slot (${slot}) is expected to be ${SLT}" ++fi ++ ++if [[ "${pin}" != "${PIN}" ]]; then ++ error "${TEST}: pin (${pin}) is expected to be '${PIN}'" ++fi ++ ++to_remove_from_cfg=$(printf ',"adv": "%s"' "${ADV}") ++cfg_for_cmp=${cfg//"${to_remove_from_cfg}"/} ++if ! pin_cfg_equal "${cfg}" "${cfg_for_cmp}"; then ++ error "${TEST}: config obtained from clevis luks list (${cfg}) is expected to match the one used to bind the test (${cfg_for_cmp})" ++fi +diff --git a/src/luks/tests/list-tang-luks2 b/src/luks/tests/list-tang-luks2 +new file mode 100755 +index 0000000..d4d4849 +--- /dev/null ++++ b/src/luks/tests/list-tang-luks2 +@@ -0,0 +1,64 @@ ++#!/bin/bash -ex ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2019 Red Hat, Inc. ++# Author: Sergio Correia ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++TEST=$(basename "${0}") ++. tests-common-functions ++ ++on_exit() { ++ [ -d "${TMP}" ] && rm -rf "${TMP}" ++} ++ ++trap 'on_exit' EXIT ++trap 'exit' ERR ++ ++TMP="$(mktemp -d)" ++ ++ADV="${TMP}/adv.jws" ++create_tang_adv "${ADV}" ++PIN="tang" ++CFG=$(printf '{"url": "ADDR","adv": "%s"}' "${ADV}") ++ ++# LUKS2. ++DEV="${TMP}/luks1-device" ++UUID="cb6e8904-81ff-40da-a84a-07ab9ab5715e" ++new_device "luks2" "${DEV}" ++ ++if ! clevis luks bind -f -d "${DEV}" "${PIN}" "${CFG}" <<< "${DEFAULT_PASS}"; then ++ error "${TEST}: Binding is expected to succeed when given a correct (${DEFAULT_PASS}) password." ++fi ++ ++SLT=1 ++if ! read -r slot pin cfg < <(clevis luks list -d "${DEV}" -s "${SLT}"); then ++ error "${TEST}: clevis luks list is expected to succeed for device(${DEV}) and slot (${SLT})" ++fi ++ ++if [[ "${slot}" != "${SLT}:" ]]; then ++ error "${TEST}: slot (${slot}) is expected to be ${SLT}" ++fi ++ ++if [[ "${pin}" != "${PIN}" ]]; then ++ error "${TEST}: pin (${pin}) is expected to be '${PIN}'" ++fi ++ ++to_remove_from_cfg=$(printf ',"adv": "%s"' "${ADV}") ++cfg_for_cmp=${cfg//"${to_remove_from_cfg}"/} ++if ! pin_cfg_equal "${cfg}" "${cfg_for_cmp}"; then ++ error "${TEST}: config obtained from clevis luks list (${cfg}) is expected to match the one used to bind the test (${cfg_for_cmp})" ++fi +diff --git a/src/luks/tests/meson.build b/src/luks/tests/meson.build +new file mode 100644 +index 0000000..6513eaa +--- /dev/null ++++ b/src/luks/tests/meson.build +@@ -0,0 +1,36 @@ ++# We use jq for comparing the pin config in the clevis luks list tests. ++jq = find_program('jq', required: false) ++ ++env = environment() ++env.prepend('PATH', ++ join_paths(meson.source_root(), 'src'), ++ join_paths(meson.source_root(), 'src', 'luks'), ++ join_paths(meson.source_root(), 'src', 'pins', 'sss'), ++ join_paths(meson.source_root(), 'src', 'pins', 'tang'), ++ join_paths(meson.source_root(), 'src', 'pins', 'tpm2'), ++ meson.current_source_dir(), ++ meson.current_build_dir(), ++ join_paths(meson.build_root(), 'src'), ++ join_paths(meson.build_root(), 'src', 'luks'), ++ join_paths(meson.build_root(), 'src', 'pins', 'sss'), ++ join_paths(meson.build_root(), 'src', 'pins', 'tang'), ++ join_paths(meson.build_root(), 'src', 'pins', 'tpm2'), ++ separator: ':' ++) ++ ++if jq.found() ++ test('list-recursive-luks1', find_program('list-recursive-luks1'), env: env) ++ test('list-tang-luks1', find_program('list-tang-luks1'), env: env) ++ test('list-sss-tang-luks1', find_program('list-sss-tang-luks1'), env: env) ++else ++ warning('Will not run "clevis luks list" tests due to missing jq dependency') ++endif ++ ++# LUKS2 tests go here, and they get included if we get support for it, based ++# on the cryptsetup version. ++# Binding LUKS2 takes longer, so timeout is increased for a few tests. ++if jq.found() ++ test('list-recursive-luks2', find_program('list-recursive-luks2'), env: env, timeout: 60) ++ test('list-tang-luks2', find_program('list-tang-luks2'), env: env, timeout: 60) ++ test('list-sss-tang-luks2', find_program('list-sss-tang-luks2'), env: env, timeout: 60) ++endif +diff --git a/src/luks/tests/tests-common-functions b/src/luks/tests/tests-common-functions +new file mode 100644 +index 0000000..b65a84a +--- /dev/null ++++ b/src/luks/tests/tests-common-functions +@@ -0,0 +1,76 @@ ++#!/bin/bash -ex ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2019 Red Hat, Inc. ++# Author: Sergio Correia ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++# We require cryptsetup >= 2.0.4 to fully support LUKSv2. ++# Support is determined at build time. ++luks2_supported() { ++ # In RHEL8 we support LUKS2. ++ return 0 ++} ++ ++# Creates a tang adv to be used in the test. ++create_tang_adv() { ++ local adv="${1}" ++ local SIG="${TMP}/sig.jwk" ++ jose jwk gen -i '{"alg":"ES512"}' > "${SIG}" ++ ++ local EXC="${TMP}/exc.jwk" ++ jose jwk gen -i '{"alg":"ECMR"}' > "${EXC}" ++ ++ local TEMPLATE='{"protected":{"cty":"jwk-set+json"}}' ++ jose jwk pub -s -i "${SIG}" -i "${EXC}" \ ++ | jose jws sig -I- -s "${TEMPLATE}" -k "${SIG}" -o "${adv}" ++} ++ ++ ++# Creates a new LUKS1 or LUKS2 device to be used. ++new_device() { ++ local LUKS="${1}" ++ local DEV="${2}" ++ ++ local DEV_CACHED="${TMP}/${LUKS}.cached" ++ ++ # Let's reuse an existing device, if there is one. ++ if [ -f "${DEV_CACHED}" ]; then ++ echo "Reusing cached ${LUKS} device..." ++ cp -f "${DEV_CACHED}" "${DEV}" ++ return 0 ++ fi ++ ++ fallocate -l16M "${DEV}" ++ cryptsetup luksFormat --type "${LUKS}" --batch-mode --force-password "${DEV}" <<< "${DEFAULT_PASS}" ++ # Caching the just-formatted device for possible reuse. ++ cp -f "${DEV}" "${DEV_CACHED}" ++} ++ ++error() { ++ echo "${1}" >&2 ++ exit 1 ++} ++ ++pin_cfg_equal() { ++ local cfg1="${1}" ++ local cfg2="${1}" ++ ++ diff <(jq -S . < <(echo -n "${cfg1}")) \ ++ <(jq -S . < <(echo -n "${cfg2}")) ++} ++ ++export DEFAULT_PASS='just-some-test-password-here' +-- +2.18.1 + diff --git a/SOURCES/Add-the-option-to-extract-luks-passphrase-used-for-b.patch b/SOURCES/Add-the-option-to-extract-luks-passphrase-used-for-b.patch new file mode 100644 index 0000000..4f2465d --- /dev/null +++ b/SOURCES/Add-the-option-to-extract-luks-passphrase-used-for-b.patch @@ -0,0 +1,364 @@ +From 69556d143544a72f84e9daf25924e3ae5132ce1a Mon Sep 17 00:00:00 2001 +From: Sergio Correia +Date: Sat, 30 Nov 2019 14:58:43 -0500 +Subject: [PATCH] Add the option to extract luks passphrase used for binding + +Usage: + +clevis luks pass -d /dev/sda1 -s 1 + +--- + src/luks/clevis-luks-pass | 69 +++++++++++++++++++++++++++++ + src/luks/clevis-luks-pass.1.adoc | 43 ++++++++++++++++++ + src/luks/meson.build | 3 ++ + src/luks/tests/meson.build | 11 +++++ + src/luks/tests/pass-tang-luks1 | 75 ++++++++++++++++++++++++++++++++ + src/luks/tests/pass-tang-luks2 | 75 ++++++++++++++++++++++++++++++++ + 6 files changed, 276 insertions(+) + create mode 100755 src/luks/clevis-luks-pass + create mode 100644 src/luks/clevis-luks-pass.1.adoc + create mode 100755 src/luks/tests/pass-tang-luks1 + create mode 100755 src/luks/tests/pass-tang-luks2 + +diff --git a/src/luks/clevis-luks-pass b/src/luks/clevis-luks-pass +new file mode 100755 +index 0000000..1ce8c4c +--- /dev/null ++++ b/src/luks/clevis-luks-pass +@@ -0,0 +1,69 @@ ++#!/bin/bash -e ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2019 Red Hat, Inc. ++# Author: Sergio Correia - LUKS2 support. ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++. clevis-luks-common-functions ++ ++SUMMARY="Returns the LUKS passphrase used for binding a particular slot." ++ ++function usage() { ++ echo >&2 ++ echo "Usage: clevis luks pass -d DEV -s SLT" >&2 ++ echo >&2 ++ echo "$SUMMARY": >&2 ++ echo >&2 ++ echo " -d DEV The LUKS device to extract the LUKS passphrase used for binding" >&2 ++ echo >&2 ++ echo " -s SLOT The slot number to extract the LUKS passphrase" >&2 ++ echo >&2 ++ exit 1 ++} ++ ++if [ ${#} -eq 1 ] && [ "${1}" = "--summary" ]; then ++ echo "${SUMMARY}" ++ exit 0 ++fi ++ ++while getopts ":d:s:" o; do ++ case "$o" in ++ d) DEV=${OPTARG};; ++ s) SLT=${OPTARG};; ++ *) usage;; ++ esac ++done ++ ++if [ -z "${DEV}" ]; then ++ echo "Did not specify a device!" >&2 ++ usage ++fi ++ ++if [ -z "${SLT}" ]; then ++ echo "Did not specify a slot!" >&2 ++ usage ++fi ++ ++if ! jwe=$(clevis_luks_read_slot "${DEV}" "${SLT}" 2>/dev/null); then ++ echo "It was not possible to read slot ${SLT} from ${DEV}!" >&2 ++ exit 1 ++fi ++ ++if ! clevis decrypt < <(echo -n "${jwe}"); then ++ echo "It was not possible to decrypt the passphrase associated to slot ${SLT} in {DEV}!" >&2 ++ exit 1 ++fi +diff --git a/src/luks/clevis-luks-pass.1.adoc b/src/luks/clevis-luks-pass.1.adoc +new file mode 100644 +index 0000000..fa9526a +--- /dev/null ++++ b/src/luks/clevis-luks-pass.1.adoc +@@ -0,0 +1,43 @@ ++CLEVIS-LUKS-PASS(1) ++=================== ++:doctype: manpage ++ ++ ++== NAME ++ ++clevis-luks-pass - Extracts the passphrase used for binding a particular slot in a LUKS device ++ ++== SYNOPSIS ++ ++*clevis luks pass* -d DEV -s SLT ++ ++== OVERVIEW ++ ++The *clevis luks pass* command extracts the passphrase used for binding a particular slot in a LUKS device. ++For example: ++ ++ clevis luks pass -d /dev/sda1 -s 1 ++ ++== OPTIONS ++ ++* *-d* _DEV_ : ++ The LUKS device on which to extract a passphrase from ++ ++* *-s* _SLT_ : ++ The slot to use for extracting the passphrase ++ ++== EXAMPLE ++ ++ clevis luks pass -d /dev/sda1 -s 1 ++ ++ ++Note that the output of *clevis luks pass* might be non-printable, in which case it would be better to redirect its output to a file and use it as a key ++file together with cryptsetup. For instance: ++ ++ clevis luks pass -d /dev/sda1 -s 1 > slot1-passphrase ++ ++And the file slot1-passphrase will contain the passphrase associated with slot #1 in /dev/sda1. ++ ++== SEE ALSO ++ ++link:clevis-luks-unlock.1.adoc[*clevis-luks-unlock*(1)], +diff --git a/src/luks/meson.build b/src/luks/meson.build +index 51d82fb..b2dd724 100644 +--- a/src/luks/meson.build ++++ b/src/luks/meson.build +@@ -23,6 +23,9 @@ if libcryptsetup.found() and luksmeta.found() and pwmake.found() + bins += join_paths(meson.current_source_dir(), 'clevis-luks-list') + mans += join_paths(meson.current_source_dir(), 'clevis-luks-list.1') + ++ bins += join_paths(meson.current_source_dir(), 'clevis-luks-pass') ++ mans += join_paths(meson.current_source_dir(), 'clevis-luks-pass.1') ++ + bins += join_paths(meson.current_source_dir(), 'clevis-luks-report') + bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-compare') + bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-decode') +diff --git a/src/luks/tests/meson.build b/src/luks/tests/meson.build +index 6513eaa..248d2ea 100644 +--- a/src/luks/tests/meson.build ++++ b/src/luks/tests/meson.build +@@ -1,3 +1,9 @@ ++actv = find_program( ++ 'systemd-socket-activate', ++ 'systemd-activate', ++ required: false ++) ++ + # We use jq for comparing the pin config in the clevis luks list tests. + jq = find_program('jq', required: false) + +@@ -15,8 +21,11 @@ env.prepend('PATH', + join_paths(meson.build_root(), 'src', 'pins', 'sss'), + join_paths(meson.build_root(), 'src', 'pins', 'tang'), + join_paths(meson.build_root(), 'src', 'pins', 'tpm2'), ++ libexecdir, ++ '/usr/libexec', + separator: ':' + ) ++env.set('SD_ACTIVATE', actv.path()) + + if jq.found() + test('list-recursive-luks1', find_program('list-recursive-luks1'), env: env) +@@ -25,6 +34,7 @@ if jq.found() + else + warning('Will not run "clevis luks list" tests due to missing jq dependency') + endif ++test('pass-tang-luks1', find_program('pass-tang-luks1'), env: env) + + # LUKS2 tests go here, and they get included if we get support for it, based + # on the cryptsetup version. +@@ -34,3 +44,4 @@ if jq.found() + test('list-tang-luks2', find_program('list-tang-luks2'), env: env, timeout: 60) + test('list-sss-tang-luks2', find_program('list-sss-tang-luks2'), env: env, timeout: 60) + endif ++test('pass-tang-luks2', find_program('pass-tang-luks2'), env: env, timeout: 60) +diff --git a/src/luks/tests/pass-tang-luks1 b/src/luks/tests/pass-tang-luks1 +new file mode 100755 +index 0000000..05cdb3e +--- /dev/null ++++ b/src/luks/tests/pass-tang-luks1 +@@ -0,0 +1,75 @@ ++#!/bin/bash -x ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2019 Red Hat, Inc. ++# Author: Sergio Correia ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++TEST="${0}" ++. tests-common-functions ++ ++function on_exit() { ++ if [ "$PID" ]; then kill $PID; wait $PID || true; fi ++ [ -d "$TMP" ] && rm -rf $TMP ++} ++ ++trap 'on_exit' EXIT ++trap 'exit' ERR ++ ++export TMP=$(mktemp -d) ++mkdir -p "${TMP}/db" ++ ++# Generate the server keys ++KEYS="$TMP/db" ++tangd-keygen $TMP/db sig exc ++if which tangd-update; then ++ mkdir -p "${TMP}/cache" ++ tangd-update "${TMP}/db" "${TMP}/cache" ++ KEYS="${TMP}/cache" ++fi ++ ++# Start the server. ++port=$(shuf -i 1024-65536 -n 1) ++"${SD_ACTIVATE}" --inetd -l 127.0.0.1:"${port}" -a tangd "${KEYS}" & ++export PID=$! ++sleep 0.25 ++ ++url="http://localhost:${port}" ++adv="${TMP}/adv" ++curl "${url}/adv" -o "${adv}" ++ ++cfg=$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv") ++ ++# LUKS1. ++DEV="${TMP}/luks1-device" ++new_device "luks1" "${DEV}" ++ ++if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then ++ error "${TEST}: Bind should have succeeded." ++fi ++ ++#Now let's test the passphrase. ++SLT=1 ++PASS=$(clevis luks pass -d "${DEV}" -s "${SLT}") ++echo $PASS >&2 ++if ! cryptsetup luksOpen --test-passphrase ""${DEV} \ ++ --key-file <(clevis luks pass -d "${DEV}" -s "${SLT}"); then ++ error "Passphrase obtained from clevis luks pass failed." ++fi ++ ++kill -9 "${PID}" ++! wait "${PID}" ++unset PID +diff --git a/src/luks/tests/pass-tang-luks2 b/src/luks/tests/pass-tang-luks2 +new file mode 100755 +index 0000000..9123aa0 +--- /dev/null ++++ b/src/luks/tests/pass-tang-luks2 +@@ -0,0 +1,75 @@ ++#!/bin/bash -x ++# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: ++# ++# Copyright (c) 2019 Red Hat, Inc. ++# Author: Sergio Correia ++# ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++# ++ ++TEST="${0}" ++. tests-common-functions ++ ++function on_exit() { ++ if [ "$PID" ]; then kill $PID; wait $PID || true; fi ++ [ -d "$TMP" ] && rm -rf $TMP ++} ++ ++trap 'on_exit' EXIT ++trap 'exit' ERR ++ ++export TMP=$(mktemp -d) ++mkdir -p "${TMP}/db" ++ ++# Generate the server keys ++KEYS="$TMP/db" ++tangd-keygen $TMP/db sig exc ++if which tangd-update; then ++ mkdir -p "${TMP}/cache" ++ tangd-update "${TMP}/db" "${TMP}/cache" ++ KEYS="${TMP}/cache" ++fi ++ ++# Start the server. ++port=$(shuf -i 1024-65536 -n 1) ++"${SD_ACTIVATE}" --inetd -l 127.0.0.1:"${port}" -a tangd "${KEYS}" & ++export PID=$! ++sleep 0.25 ++ ++url="http://localhost:${port}" ++adv="${TMP}/adv" ++curl "${url}/adv" -o "${adv}" ++ ++cfg=$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv") ++ ++# LUKS2. ++DEV="${TMP}/luks2-device" ++new_device "luks2" "${DEV}" ++ ++if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then ++ error "${TEST}: Bind should have succeeded." ++fi ++ ++#Now let's test the passphrase. ++SLT=1 ++PASS=$(clevis luks pass -d "${DEV}" -s "${SLT}") ++echo $PASS >&2 ++if ! cryptsetup luksOpen --test-passphrase ""${DEV} \ ++ --key-file <(clevis luks pass -d "${DEV}" -s "${SLT}"); then ++ error "Passphrase obtained from clevis luks pass failed." ++fi ++ ++kill -9 "${PID}" ++! wait "${PID}" ++unset PID +-- +2.18.1 + diff --git a/SOURCES/Adjust-pin-tang-test-to-account-for-newer-tang-witho.patch b/SOURCES/Adjust-pin-tang-test-to-account-for-newer-tang-witho.patch new file mode 100644 index 0000000..20e6137 --- /dev/null +++ b/SOURCES/Adjust-pin-tang-test-to-account-for-newer-tang-witho.patch @@ -0,0 +1,77 @@ +From 53ecfcf6d934206e3daef4ed3515a0d6f098e276 Mon Sep 17 00:00:00 2001 +From: Sergio Correia +Date: Wed, 16 Oct 2019 11:40:33 -0300 +Subject: [PATCH 1/2] Adjust pin-tang test to account for newer tang without + tangd-update + +--- + src/pins/tang/meson.build | 9 ++------- + src/pins/tang/pin-tang | 11 ++++++++--- + 2 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/src/pins/tang/meson.build b/src/pins/tang/meson.build +index 110d72d..061a79f 100644 +--- a/src/pins/tang/meson.build ++++ b/src/pins/tang/meson.build +@@ -8,11 +8,6 @@ kgen = find_program( + '/usr/libexec/tangd-keygen', + required: false + ) +-updt = find_program( +- join_paths(libexecdir, 'tangd-update'), +- '/usr/libexec/tangd-update', +- required: false +-) + tang = find_program( + join_paths(libexecdir, 'tangd'), + '/usr/libexec/tangd', +@@ -25,7 +20,7 @@ if curl.found() + bins += join_paths(meson.current_source_dir(), 'clevis-encrypt-tang') + mans += join_paths(meson.current_source_dir(), 'clevis-encrypt-tang.1') + +- if actv.found() and kgen.found() and updt.found() and tang.found() ++ if actv.found() and kgen.found() and tang.found() + env = environment() + env.set('SD_ACTIVATE', actv.path()) + env.append('PATH', +@@ -42,4 +37,4 @@ if curl.found() + endif + else + warning('Will not install tang pin due to missing dependencies!') +-endif +\ No newline at end of file ++endif +diff --git a/src/pins/tang/pin-tang b/src/pins/tang/pin-tang +index f420818..9dcc2da 100755 +--- a/src/pins/tang/pin-tang ++++ b/src/pins/tang/pin-tang +@@ -31,18 +31,23 @@ mkdir -p $TMP/db + mkdir -p $TMP/cache + + # Generate the server keys ++KEYS=$TMP/db + tangd-keygen $TMP/db sig exc +-tangd-update $TMP/db $TMP/cache ++if which tangd-update; then ++ tangd-update $TMP/db $TMP/cache ++ KEYS=$TMP/cache ++fi + + # Start the server + port=`shuf -i 1024-65536 -n 1` +-$SD_ACTIVATE --inetd -l 127.0.0.1:$port -a tangd $TMP/cache & ++$SD_ACTIVATE --inetd -l 127.0.0.1:$port -a tangd $KEYS & + export PID=$! + sleep 0.25 + + thp=`jose jwk thp -i "$TMP/db/sig.jwk"` +-adv="$TMP/cache/default.jws" + url="http://localhost:${port}" ++adv="$TMP/adv" ++curl "$url/adv" -o $adv + + cfg=`printf '{"url":"%s","adv":"%s"}' "$url" "$adv"` + enc=`echo -n "hi" | clevis encrypt tang "$cfg"` +-- +2.21.0 + diff --git a/SOURCES/Improve-error-message-when-bind-is-given-an-invalid-.patch b/SOURCES/Improve-error-message-when-bind-is-given-an-invalid-.patch new file mode 100644 index 0000000..e0c2af0 --- /dev/null +++ b/SOURCES/Improve-error-message-when-bind-is-given-an-invalid-.patch @@ -0,0 +1,42 @@ +From 02f17448e379c92745f8203f47e5de0725b1c1b6 Mon Sep 17 00:00:00 2001 +From: Sergio Correia +Date: Fri, 18 Oct 2019 09:04:22 -0300 +Subject: [PATCH] Improve error message when bind is given an invalid PIN + +--- + src/luks/clevis-luks-bind | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/src/luks/clevis-luks-bind b/src/luks/clevis-luks-bind +index 7aae2ea..1b5caf2 100755 +--- a/src/luks/clevis-luks-bind ++++ b/src/luks/clevis-luks-bind +@@ -19,6 +19,8 @@ + # along with this program. If not, see . + # + ++. clevis-luks-common-functions ++ + SUMMARY="Binds a LUKS device using the specified policy" + UUID=cb6e8904-81ff-40da-a84a-07ab9ab5715e + +@@ -68,6 +70,9 @@ fi + if ! PIN=${@:$((OPTIND++)):1} || [ -z "$PIN" ]; then + echo "Did not specify a pin!" >&2 + usage ++elif ! EXE=$(findexe clevis-encrypt-"${PIN}"); then ++ echo "'$PIN' is not a valid pin!" >&2 ++ usage + fi + + if ! CFG=${@:$((OPTIND++)):1} || [ -z "$CFG" ]; then +@@ -142,4 +147,4 @@ else + cryptsetup luksRemoveKey "$DEV" <<<"$key" + exit 1 + fi +-fi +\ No newline at end of file ++fi +-- +2.21.0 + diff --git a/SPECS/clevis.spec b/SPECS/clevis.spec index d72e15d..9746d75 100644 --- a/SPECS/clevis.spec +++ b/SPECS/clevis.spec @@ -2,7 +2,7 @@ Name: clevis Version: 11 -Release: 2%{?dist} +Release: 7%{?dist} Summary: Automated decryption framework License: GPLv3+ @@ -13,6 +13,12 @@ Patch0: Delete-remaining-references-to-the-removed-http-pin.patch Patch1: Install-cryptsetup-and-tpm2_pcrlist-in-the-initramfs.patch Patch2: Add-device-TCTI-library-to-the-initramfs.patch Patch3: Check-key-derivation-key-is-available.patch +Patch4: Adjust-pin-tang-test-to-account-for-newer-tang-witho.patch +Patch5: Add-clevis-luks-report-regen.patch +Patch6: Improve-error-message-when-bind-is-given-an-invalid-.patch +Patch7: Add-support-for-listing-existing-PBD-policies-in-pla.patch +Patch8: Add-the-option-to-extract-luks-passphrase-used-for-b.patch +Patch9: Add-rd.neednet-1-to-cmdline-only-if-there-are-device.patch BuildRequires: gcc BuildRequires: meson @@ -33,6 +39,9 @@ BuildRequires: systemd BuildRequires: dracut BuildRequires: tang >= 6 BuildRequires: curl +BuildRequires: luksmeta +BuildRequires: cracklib-dicts +Buildrequires: jq Requires: tpm2-tools >= 3.0.0 Requires: coreutils @@ -143,9 +152,22 @@ exit 0 %{_mandir}/man1/%{name}-luks-unlock.1* %{_mandir}/man1/%{name}-luks-unbind.1* %{_mandir}/man1/%{name}-luks-bind.1* +%{_mandir}/man1/%{name}-luks-regen.1* +%{_mandir}/man1/%{name}-luks-report.1* +%{_mandir}/man1/%{name}-luks-list.1* +%{_mandir}/man1/%{name}-luks-pass.1.* %{_bindir}/%{name}-luks-unlock %{_bindir}/%{name}-luks-unbind %{_bindir}/%{name}-luks-bind +%{_bindir}/%{name}-luks-common-functions +%{_bindir}/%{name}-luks-regen +%{_bindir}/%{name}-luks-report +%{_bindir}/%{name}-luks-report-compare +%{_bindir}/%{name}-luks-report-decode +%{_bindir}/%{name}-luks-report-sss +%{_bindir}/%{name}-luks-report-tang +%{_bindir}/%{name}-luks-list +%{_bindir}/%{name}-luks-pass %files systemd %{_libexecdir}/%{name}-luks-askpass @@ -160,6 +182,27 @@ exit 0 %attr(4755, root, root) %{_libexecdir}/%{name}-luks-udisks2 %changelog +* Sat Nov 30 2019 Sergio Correia - 11-7 +- Add rd.neednet=1 to cmdline only if there are devices bound to tang + Resolves: rhbz#1762028 + +* Sat Nov 30 2019 Sergio Correia - 11-6 +- Add option to extract luks passphrase used for binding + Resolves: rhbz#1436780 + +* Thu Nov 28 2019 Sergio Correia - 11-5 +- Add support for listing existing PBD policies in place + Resolves: rhbz#1766526 + +* Fri Oct 18 2019 Sergio Correia - 11-4 +- Improve error message when bind is given an invalid PIN + Resolves: rhbz#1543380 + +* Wed Oct 16 2019 Sergio Correia - 11-3 +- Add clevis luks report and regen + Resolves: rhbz#1564566 + Resolves: rhbz#1564559 + * Fri Jan 04 2019 Daniel Kopecek - 11-2 - Check that key derivation key is available - Delete remaining references to the removed http pin