SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #30018 from mrc0mmand/TEST-70

Browse Source 
test: skip --tpm2-device-key= tests with older OpenSSL
This commit is contained in:
Luca Boccassi
2023-11-13 20:58:43 +00:00
committed by GitHub
parent abc19a6ffa 968d232db5
commit 1029edea3c
6 changed files with 49 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/partition/repart.c
+3 -3
View File
@@ -4177,7 +4177,7 @@ static int sign_verity_roothash(
return 0;
#else
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "openssl is not supported, cannot setup verity signature: %m");
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL is not supported, cannot setup verity signature: %m");
#endif
}
@@ -4918,7 +4918,7 @@ static int parse_x509_certificate(const char *certificate, size_t certificate_si
return 0;
#else
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "openssl is not supported, cannot parse X509 certificate.");
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL is not supported, cannot parse X509 certificate.");
#endif
}
@@ -4945,7 +4945,7 @@ static int parse_private_key(const char *key, size_t key_size, EVP_PKEY **ret) {
return 0;
#else
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "openssl is not supported, cannot parse private key.");
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL is not supported, cannot parse private key.");
#endif
}
src/shared/openssl-util.c
+9 -9
View File
@@ -7,8 +7,8 @@
#include "string-util.h"
#if HAVE_OPENSSL
/* For each error in the the Openssl thread error queue, log the provided message and the Openssl error
* string. If there are no errors in the Openssl thread queue, this logs the message with "No openssl
/* For each error in the the OpenSSL thread error queue, log the provided message and the OpenSSL error
* string. If there are no errors in the OpenSSL thread queue, this logs the message with "No openssl
* errors." This logs at level debug. Returns -EIO (or -ENOMEM). */
#define log_openssl_errors(fmt, ...) _log_openssl_errors(UNIQ, fmt, ##__VA_ARGS__)
#define _log_openssl_errors(u, fmt, ...) \
@@ -18,7 +18,7 @@
!UNIQ_T(BUF, u) \
? log_oom_debug() \
: __log_openssl_errors(u, UNIQ_T(BUF, u), UNIQ_T(MAX, u), fmt, ##__VA_ARGS__) \
?: log_debug_errno(SYNTHETIC_ERRNO(EIO), fmt ": No openssl errors.", ##__VA_ARGS__); \
?: log_debug_errno(SYNTHETIC_ERRNO(EIO), fmt ": No OpenSSL errors.", ##__VA_ARGS__); \
})
#define __log_openssl_errors(u, buf, max, fmt, ...) \
({ \
@@ -394,18 +394,18 @@ int kdf_ss_derive(
return log_openssl_errors("Failed to build KDF-SS OSSL_PARAM");
if (EVP_KDF_derive(ctx, buf, derive_size, params) <= 0)
return log_openssl_errors("Openssl KDF-SS derive failed");
return log_openssl_errors("OpenSSL KDF-SS derive failed");
*ret = TAKE_PTR(buf);
return 0;
#else
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "KDF-SS requires openssl >= 3.");
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "KDF-SS requires OpenSSL >= 3.");
#endif
}
/* Perform Key-Based HMAC KDF. The mode must be "COUNTER" or "FEEDBACK". The parameter naming is from the
* Openssl api, and maps to SP800-108 naming as "...key, salt, info, and seed correspond to KI, Label,
* OpenSSL api, and maps to SP800-108 naming as "...key, salt, info, and seed correspond to KI, Label,
* Context, and IV (respectively)...". The derive_size parameter specifies how many bytes are derived.
*
* For more details see: https://www.openssl.org/docs/manmaster/man7/EVP_KDF-KB.html */
@@ -480,13 +480,13 @@ int kdf_kb_hmac_derive(
return log_oom_debug();
if (EVP_KDF_derive(ctx, buf, derive_size, params) <= 0)
return log_openssl_errors("Openssl KDF-KB derive failed");
return log_openssl_errors("OpenSSL KDF-KB derive failed");
*ret = TAKE_PTR(buf);
return 0;
#else
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "KDF-KB requires openssl >= 3.");
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "KDF-KB requires OpenSSL >= 3.");
#endif
}
@@ -1144,6 +1144,6 @@ int x509_fingerprint(X509 *cert, uint8_t buffer[static SHA256_DIGEST_SIZE]) {
sha256_direct(der, dersz, buffer);
return 0;
#else
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "openssl is not supported, cannot calculate X509 fingerprint: %m");
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL is not supported, cannot calculate X509 fingerprint: %m");
#endif
}
src/shared/tpm2-util.c
+3 -3
View File
@@ -4133,7 +4133,7 @@ static int tpm2_ecc_curve_from_openssl_curve_id(int openssl_ecc_curve_id, TPM2_E
}
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"Openssl ECC curve id %d not supported.", openssl_ecc_curve_id);
"OpenSSL ECC curve id %d not supported.", openssl_ecc_curve_id);
}
static int tpm2_ecc_curve_to_openssl_curve_id(TPM2_ECC_CURVE tpm2_ecc_curve_id, int *ret) {
@@ -4882,7 +4882,7 @@ static int tpm2_calculate_seal_rsa_seed(
_cleanup_(EVP_PKEY_freep) EVP_PKEY *parent_pkey = NULL;
r = tpm2_tpm2b_public_to_openssl_pkey(parent, &parent_pkey);
if (r < 0)
return log_debug_errno(r, "Could not convert TPM2B_PUBLIC to Openssl PKEY: %m");
return log_debug_errno(r, "Could not convert TPM2B_PUBLIC to OpenSSL PKEY: %m");
r = tpm2_hash_alg_to_size(parent->publicArea.nameAlg);
if (r < 0)
@@ -4944,7 +4944,7 @@ static int tpm2_calculate_seal_ecc_seed(
_cleanup_(EVP_PKEY_freep) EVP_PKEY *parent_pkey = NULL;
r = tpm2_tpm2b_public_to_openssl_pkey(parent, &parent_pkey);
if (r < 0)
return log_debug_errno(r, "Could not convert TPM2B_PUBLIC to Openssl PKEY: %m");
return log_debug_errno(r, "Could not convert TPM2B_PUBLIC to OpenSSL PKEY: %m");
int curve_id;
r = ecc_pkey_to_curve_x_y(
src/test/test-openssl.c
+2 -2
View File
@@ -308,7 +308,7 @@ TEST(kdf_kb_hmac_derive) {
assert_se(kdf_kb_hmac_derive("COUNTER", "SHA256", key, key_len, salt, strlen(salt), info, info_len, /* seed= */ NULL, /* seed_size= */ 0, 64, &derived_key) >= 0);
assert_se(memcmp_nn(derived_key, 64, expected_derived_key, expected_derived_key_len) == 0);
#else
log_tests_skipped("KDF-KB requires Openssl >= 3");
log_tests_skipped("KDF-KB requires OpenSSL >= 3");
#endif
}
@@ -345,7 +345,7 @@ TEST(kdf_ss_derive) {
"ed25a0043d6c1eb28296da1f9ab138dafee18f4c937bfc43601d4ee6e7634199",
"30EB1A1E9DEA7DE4DDB8F3FDF50A01E30581D606C1228D98AFF691DF743AC2EE9D99EFD2AE1946C079AA18C9524877FA65D5065F0DAED058AB3416AF80EB2B73");
#else
log_tests_skipped("KDF-SS requires Openssl >= 3");
log_tests_skipped("KDF-SS requires OpenSSL >= 3");
#endif
}
test/units/testsuite-70.cryptsetup.sh
+24 -18
View File
@@ -141,9 +141,12 @@ if tpm_has_pcr sha256 12; then
cmp /tmp/srk.pub /run/systemd/tpm2-srk-public-key.tpm2b_public
fi
PASSWORD=passphrase systemd-cryptenroll --tpm2-device-key=/tmp/srk.pub --tpm2-pcrs="12:sha256=$CURRENT_PCR_VALUE" "$IMAGE"
systemd-cryptsetup attach test-volume "$IMAGE" - tpm2-device=auto,headless=1
systemd-cryptsetup detach test-volume
# --tpm2-device-key= requires OpenSSL >= 3 with KDF-SS
if openssl_supports_kdf SSKDF; then
PASSWORD=passphrase systemd-cryptenroll --tpm2-device-key=/tmp/srk.pub --tpm2-pcrs="12:sha256=$CURRENT_PCR_VALUE" "$IMAGE"
systemd-cryptsetup attach test-volume "$IMAGE" - tpm2-device=auto,headless=1
systemd-cryptsetup detach test-volume
fi
rm -f /tmp/pcr.dat /tmp/srk.pub
fi
@@ -195,26 +198,29 @@ PASSWORD=passphrase systemd-cryptenroll --tpm2-device=auto --tpm2-seal-key-handl
systemd-cryptsetup attach test-volume "$IMAGE" - tpm2-device=auto,headless=1
systemd-cryptsetup detach test-volume
# Make sure that --tpm2-device-key= also works with systemd-repart
tpm2_readpublic -c 0x81000001 -o /tmp/srk.pub
mkdir /tmp/dditest
cat > /tmp/dditest/50-root.conf <<EOF
# --tpm2-device-key= requires OpenSSL >= 3 with KDF-SS
if openssl_supports_kdf SSKDF; then
# Make sure that --tpm2-device-key= also works with systemd-repart
tpm2_readpublic -c 0x81000001 -o /tmp/srk.pub
mkdir /tmp/dditest
cat > /tmp/dditest/50-root.conf <<EOF
[Partition]
Type=root
Format=ext4
CopyFiles=/tmp/dditest:/
Encrypt=tpm2
EOF
PASSWORD=passphrase systemd-repart --tpm2-device-key=/tmp/srk.pub --definitions=/tmp/dditest --empty=create --size=50M /tmp/dditest.raw --tpm2-pcrs=
DEVICE="$(systemd-dissect --attach /tmp/dditest.raw)"
systemd-cryptsetup attach dditest "$DEVICE"p1 - tpm2-device=auto,headless=yes
mkdir /tmp/dditest.mnt
mount -t ext4 /dev/mapper/dditest /tmp/dditest.mnt
cmp /tmp/dditest.mnt/50-root.conf /tmp/dditest/50-root.conf
umount /tmp/dditest.mnt
rmdir /tmp/dditest.mnt
rm /tmp/dditest.raw
rm /tmp/dditest/50-root.conf
rmdir /tmp/dditest
PASSWORD=passphrase systemd-repart --tpm2-device-key=/tmp/srk.pub --definitions=/tmp/dditest --empty=create --size=50M /tmp/dditest.raw --tpm2-pcrs=
DEVICE="$(systemd-dissect --attach /tmp/dditest.raw)"
systemd-cryptsetup attach dditest "$DEVICE"p1 - tpm2-device=auto,headless=yes
mkdir /tmp/dditest.mnt
mount -t ext4 /dev/mapper/dditest /tmp/dditest.mnt
cmp /tmp/dditest.mnt/50-root.conf /tmp/dditest/50-root.conf
umount /tmp/dditest.mnt
rmdir /tmp/dditest.mnt
rm /tmp/dditest.raw
rm /tmp/dditest/50-root.conf
rmdir /tmp/dditest
fi
rm -f "$IMAGE" "$PRIMARY"
test/units/util.sh
+8
View File
@@ -189,3 +189,11 @@ tpm_has_pcr() {
[[ -f "/sys/class/tpm/tpm0/pcr-$algorithm/$pcr" ]]
}
openssl_supports_kdf() {
local kdf="${1:?}"
# The arguments will need to be adjusted to make this work for other KDFs than SSKDF,
# but let's do that when/if the need arises
openssl kdf -keylen 16 -kdfopt digest:SHA2-256 -kdfopt key:foo -out /dev/null "$kdf"
}