From 52a09e6230f0c82808a8d2ebfb477c2da745dad9 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Mon, 13 Nov 2023 20:35:29 +0100 Subject: [PATCH 1/2] test: skip --tpm2-device-key= tests with older OpenSSL --tpm2-device-key= requires OpenSSL >= 3 with KDF-SS, so let's skip the test if we're running with older OpenSSL. + systemd-cryptenroll --tpm2-device-key=/tmp/srk.pub --tpm2-pcrs=12:sha256=F5A5FD42D16A20302798EF6ED309979B43003D2320D9F0E8EA9831A92759FB4B /tmp/systemd-cryptsetup-H8y.IMAGE Failed to find TPM2 pcrlock policy file 'pcrlock.json': No such file or directory Allocating context for crypt device /tmp/systemd-cryptsetup-H8y.IMAGE. Trying to open and read device /tmp/systemd-cryptsetup-H8y.IMAGE with direct-io. Trying to open device /tmp/systemd-cryptsetup-H8y.IMAGE without direct-io. Initialising device-mapper backend library. Trying to load LUKS2 crypt type from device /tmp/systemd-cryptsetup-H8y.IMAGE. Crypto backend (OpenSSL 1.1.1k FIPS 25 Mar 2021) initialized in cryptsetup library version 2.3.7. Detected kernel Linux 4.18.0-521.el8.ppc64le ppc64le. ... Failed to find TPM PCR public key file 'tpm2-pcr-public-key.pem': No such file or directory Failed to read TPM2 PCR public key, proceeding without: No such file or directory Can't find symbol Esys_TR_GetTpmHandle: /lib64/libtss2-esys.so.0: undefined symbol: Esys_TR_GetTpmHandle libtss2-esys too old, does not include Esys_TR_GetTpmHandle. Can't find symbol Esys_TR_GetTpmHandle: /lib64/libtss2-esys.so.0: undefined symbol: Esys_TR_GetTpmHandle libtss2-esys too old, does not include Esys_TR_GetTpmHandle. PolicyPCR calculated digest: 9a1f511fb94f030eb21d0332ef2739727bf0ead4ec26a204d15b09cdeb4b2555 Calculating sealed object. Calculating encrypted seed for sealed object. Calculating encrypted seed for ECC sealed object. Calculating KDFe(). KDF-SS requires openssl >= 3. Could not calculate KDFe: Operation not supported Could not calculate encrypted seed: Operation not supported Failed to seal to TPM2: Operation not supported --- test/units/testsuite-70.cryptsetup.sh | 42 +++++++++++++++------------ test/units/util.sh | 8 +++++ 2 files changed, 32 insertions(+), 18 deletions(-) diff --git a/test/units/testsuite-70.cryptsetup.sh b/test/units/testsuite-70.cryptsetup.sh index 3501e8eeb3..4cd627fe1a 100755 --- a/test/units/testsuite-70.cryptsetup.sh +++ b/test/units/testsuite-70.cryptsetup.sh @@ -141,9 +141,12 @@ if tpm_has_pcr sha256 12; then cmp /tmp/srk.pub /run/systemd/tpm2-srk-public-key.tpm2b_public fi - PASSWORD=passphrase systemd-cryptenroll --tpm2-device-key=/tmp/srk.pub --tpm2-pcrs="12:sha256=$CURRENT_PCR_VALUE" "$IMAGE" - systemd-cryptsetup attach test-volume "$IMAGE" - tpm2-device=auto,headless=1 - systemd-cryptsetup detach test-volume + # --tpm2-device-key= requires OpenSSL >= 3 with KDF-SS + if openssl_supports_kdf SSKDF; then + PASSWORD=passphrase systemd-cryptenroll --tpm2-device-key=/tmp/srk.pub --tpm2-pcrs="12:sha256=$CURRENT_PCR_VALUE" "$IMAGE" + systemd-cryptsetup attach test-volume "$IMAGE" - tpm2-device=auto,headless=1 + systemd-cryptsetup detach test-volume + fi rm -f /tmp/pcr.dat /tmp/srk.pub fi @@ -195,26 +198,29 @@ PASSWORD=passphrase systemd-cryptenroll --tpm2-device=auto --tpm2-seal-key-handl systemd-cryptsetup attach test-volume "$IMAGE" - tpm2-device=auto,headless=1 systemd-cryptsetup detach test-volume -# Make sure that --tpm2-device-key= also works with systemd-repart -tpm2_readpublic -c 0x81000001 -o /tmp/srk.pub -mkdir /tmp/dditest -cat > /tmp/dditest/50-root.conf <= 3 with KDF-SS +if openssl_supports_kdf SSKDF; then + # Make sure that --tpm2-device-key= also works with systemd-repart + tpm2_readpublic -c 0x81000001 -o /tmp/srk.pub + mkdir /tmp/dditest + cat > /tmp/dditest/50-root.conf < Date: Mon, 13 Nov 2023 20:47:17 +0100 Subject: [PATCH 2/2] tree-wide: unify OpenSSL spelling in log messages Seeing three different spellings of OpenSSL in one log file triggers some inner OCD I didn't even know I have. --- src/partition/repart.c | 6 +++--- src/shared/openssl-util.c | 18 +++++++++--------- src/shared/tpm2-util.c | 6 +++--- src/test/test-openssl.c | 4 ++-- 4 files changed, 17 insertions(+), 17 deletions(-) diff --git a/src/partition/repart.c b/src/partition/repart.c index d76732b349..88d4c5186d 100644 --- a/src/partition/repart.c +++ b/src/partition/repart.c @@ -4177,7 +4177,7 @@ static int sign_verity_roothash( return 0; #else - return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "openssl is not supported, cannot setup verity signature: %m"); + return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL is not supported, cannot setup verity signature: %m"); #endif } @@ -4918,7 +4918,7 @@ static int parse_x509_certificate(const char *certificate, size_t certificate_si return 0; #else - return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "openssl is not supported, cannot parse X509 certificate."); + return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL is not supported, cannot parse X509 certificate."); #endif } @@ -4945,7 +4945,7 @@ static int parse_private_key(const char *key, size_t key_size, EVP_PKEY **ret) { return 0; #else - return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "openssl is not supported, cannot parse private key."); + return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL is not supported, cannot parse private key."); #endif } diff --git a/src/shared/openssl-util.c b/src/shared/openssl-util.c index fcf7474edc..311fb4d9cb 100644 --- a/src/shared/openssl-util.c +++ b/src/shared/openssl-util.c @@ -7,8 +7,8 @@ #include "string-util.h" #if HAVE_OPENSSL -/* For each error in the the Openssl thread error queue, log the provided message and the Openssl error - * string. If there are no errors in the Openssl thread queue, this logs the message with "No openssl +/* For each error in the the OpenSSL thread error queue, log the provided message and the OpenSSL error + * string. If there are no errors in the OpenSSL thread queue, this logs the message with "No openssl * errors." This logs at level debug. Returns -EIO (or -ENOMEM). */ #define log_openssl_errors(fmt, ...) _log_openssl_errors(UNIQ, fmt, ##__VA_ARGS__) #define _log_openssl_errors(u, fmt, ...) \ @@ -18,7 +18,7 @@ !UNIQ_T(BUF, u) \ ? log_oom_debug() \ : __log_openssl_errors(u, UNIQ_T(BUF, u), UNIQ_T(MAX, u), fmt, ##__VA_ARGS__) \ - ?: log_debug_errno(SYNTHETIC_ERRNO(EIO), fmt ": No openssl errors.", ##__VA_ARGS__); \ + ?: log_debug_errno(SYNTHETIC_ERRNO(EIO), fmt ": No OpenSSL errors.", ##__VA_ARGS__); \ }) #define __log_openssl_errors(u, buf, max, fmt, ...) \ ({ \ @@ -394,18 +394,18 @@ int kdf_ss_derive( return log_openssl_errors("Failed to build KDF-SS OSSL_PARAM"); if (EVP_KDF_derive(ctx, buf, derive_size, params) <= 0) - return log_openssl_errors("Openssl KDF-SS derive failed"); + return log_openssl_errors("OpenSSL KDF-SS derive failed"); *ret = TAKE_PTR(buf); return 0; #else - return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "KDF-SS requires openssl >= 3."); + return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "KDF-SS requires OpenSSL >= 3."); #endif } /* Perform Key-Based HMAC KDF. The mode must be "COUNTER" or "FEEDBACK". The parameter naming is from the - * Openssl api, and maps to SP800-108 naming as "...key, salt, info, and seed correspond to KI, Label, + * OpenSSL api, and maps to SP800-108 naming as "...key, salt, info, and seed correspond to KI, Label, * Context, and IV (respectively)...". The derive_size parameter specifies how many bytes are derived. * * For more details see: https://www.openssl.org/docs/manmaster/man7/EVP_KDF-KB.html */ @@ -480,13 +480,13 @@ int kdf_kb_hmac_derive( return log_oom_debug(); if (EVP_KDF_derive(ctx, buf, derive_size, params) <= 0) - return log_openssl_errors("Openssl KDF-KB derive failed"); + return log_openssl_errors("OpenSSL KDF-KB derive failed"); *ret = TAKE_PTR(buf); return 0; #else - return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "KDF-KB requires openssl >= 3."); + return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "KDF-KB requires OpenSSL >= 3."); #endif } @@ -1144,6 +1144,6 @@ int x509_fingerprint(X509 *cert, uint8_t buffer[static SHA256_DIGEST_SIZE]) { sha256_direct(der, dersz, buffer); return 0; #else - return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "openssl is not supported, cannot calculate X509 fingerprint: %m"); + return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL is not supported, cannot calculate X509 fingerprint: %m"); #endif } diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c index cbdf7ad97d..94c44710e3 100644 --- a/src/shared/tpm2-util.c +++ b/src/shared/tpm2-util.c @@ -4133,7 +4133,7 @@ static int tpm2_ecc_curve_from_openssl_curve_id(int openssl_ecc_curve_id, TPM2_E } return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), - "Openssl ECC curve id %d not supported.", openssl_ecc_curve_id); + "OpenSSL ECC curve id %d not supported.", openssl_ecc_curve_id); } static int tpm2_ecc_curve_to_openssl_curve_id(TPM2_ECC_CURVE tpm2_ecc_curve_id, int *ret) { @@ -4882,7 +4882,7 @@ static int tpm2_calculate_seal_rsa_seed( _cleanup_(EVP_PKEY_freep) EVP_PKEY *parent_pkey = NULL; r = tpm2_tpm2b_public_to_openssl_pkey(parent, &parent_pkey); if (r < 0) - return log_debug_errno(r, "Could not convert TPM2B_PUBLIC to Openssl PKEY: %m"); + return log_debug_errno(r, "Could not convert TPM2B_PUBLIC to OpenSSL PKEY: %m"); r = tpm2_hash_alg_to_size(parent->publicArea.nameAlg); if (r < 0) @@ -4944,7 +4944,7 @@ static int tpm2_calculate_seal_ecc_seed( _cleanup_(EVP_PKEY_freep) EVP_PKEY *parent_pkey = NULL; r = tpm2_tpm2b_public_to_openssl_pkey(parent, &parent_pkey); if (r < 0) - return log_debug_errno(r, "Could not convert TPM2B_PUBLIC to Openssl PKEY: %m"); + return log_debug_errno(r, "Could not convert TPM2B_PUBLIC to OpenSSL PKEY: %m"); int curve_id; r = ecc_pkey_to_curve_x_y( diff --git a/src/test/test-openssl.c b/src/test/test-openssl.c index 57872221f8..dfdd1ab5b4 100644 --- a/src/test/test-openssl.c +++ b/src/test/test-openssl.c @@ -308,7 +308,7 @@ TEST(kdf_kb_hmac_derive) { assert_se(kdf_kb_hmac_derive("COUNTER", "SHA256", key, key_len, salt, strlen(salt), info, info_len, /* seed= */ NULL, /* seed_size= */ 0, 64, &derived_key) >= 0); assert_se(memcmp_nn(derived_key, 64, expected_derived_key, expected_derived_key_len) == 0); #else - log_tests_skipped("KDF-KB requires Openssl >= 3"); + log_tests_skipped("KDF-KB requires OpenSSL >= 3"); #endif } @@ -345,7 +345,7 @@ TEST(kdf_ss_derive) { "ed25a0043d6c1eb28296da1f9ab138dafee18f4c937bfc43601d4ee6e7634199", "30EB1A1E9DEA7DE4DDB8F3FDF50A01E30581D606C1228D98AFF691DF743AC2EE9D99EFD2AE1946C079AA18C9524877FA65D5065F0DAED058AB3416AF80EB2B73"); #else - log_tests_skipped("KDF-SS requires Openssl >= 3"); + log_tests_skipped("KDF-SS requires OpenSSL >= 3"); #endif }