From ea39aecba34cfbe378e94ba324047c6e6033542a Mon Sep 17 00:00:00 2001 From: Milan Broz Date: Thu, 28 Nov 2024 17:20:13 +0100 Subject: [PATCH] Add integrity key tests. --- tests/api-test.c | 50 ++++++++++++++++++++++++++++++++------ tests/luks2-integrity-test | 17 ++++++++++--- 2 files changed, 56 insertions(+), 11 deletions(-) diff --git a/tests/api-test.c b/tests/api-test.c index c9953c3de..7b9a2891b 100644 --- a/tests/api-test.c +++ b/tests/api-test.c @@ -2004,15 +2004,24 @@ static void IntegrityTest(void) .tag_size = 4, .integrity = "crc32c", .sector_size = 4096, - }, ip = {}; + }, ip = {}, params2 = { + .tag_size = 32, + .integrity = "hmac(sha256)", + .sector_size = 4096, + }; struct crypt_active_device cad; int ret; - // FIXME: this should be more detailed + const char *key_integrity_hex = "e9668637426e277d126fe848e47417953701a511eee43b53c671342cec400d6e"; + size_t integrity_key_size = strlen(key_integrity_hex) / 2; + char integrity_key[128]; - OK_(crypt_init(&cd,DEVICE_1)); - FAIL_(crypt_format(cd,CRYPT_INTEGRITY,NULL,NULL,NULL,NULL,0,NULL), "params field required"); - ret = crypt_format(cd,CRYPT_INTEGRITY,NULL,NULL,NULL,NULL,0,¶ms); + crypt_decode_key(integrity_key, key_integrity_hex, integrity_key_size); + params2.integrity_key_size = integrity_key_size; + + OK_(crypt_init(&cd, DEVICE_1)); + FAIL_(crypt_format(cd, CRYPT_INTEGRITY, NULL, NULL, NULL, NULL, 0, NULL), "params field required"); + ret = crypt_format(cd, CRYPT_INTEGRITY, NULL, NULL, NULL, NULL, 0, ¶ms); if (ret < 0) { printf("WARNING: cannot format integrity device, skipping test.\n"); CRYPT_FREE(cd); @@ -2027,7 +2036,7 @@ static void IntegrityTest(void) EQ_(ip.journal_watermark, params.journal_watermark); EQ_(ip.integrity_key_size, 0); OK_(strcmp(ip.integrity,params.integrity)); - FAIL_(crypt_set_uuid(cd,DEVICE_1_UUID),"can't set uuid to integrity device"); + FAIL_(crypt_set_uuid(cd,DEVICE_1_UUID), "can't set uuid to integrity device"); CRYPT_FREE(cd); OK_(crypt_init(&cd, DEVICE_1)); @@ -2047,8 +2056,8 @@ static void IntegrityTest(void) OK_(crypt_init_by_name(&cd, CDEVICE_1)); OK_(crypt_get_integrity_info(cd, &ip)); EQ_(ip.tag_size, params.tag_size); - OK_(strcmp(ip.integrity,params.integrity)); - OK_(strcmp(CRYPT_INTEGRITY,crypt_get_type(cd))); + OK_(strcmp(ip.integrity, params.integrity)); + OK_(strcmp(CRYPT_INTEGRITY, crypt_get_type(cd))); if (t_dm_integrity_recalculate_support()) { OK_(crypt_get_active_device(cd, CDEVICE_1, &cad)); @@ -2060,6 +2069,31 @@ static void IntegrityTest(void) OK_(crypt_deactivate(cd, CDEVICE_1)); CRYPT_FREE(cd); + + // legacy format with NULL + OK_(crypt_init(&cd, DEVICE_1)); + OK_(crypt_format(cd, CRYPT_INTEGRITY, NULL, NULL, NULL, NULL, 0, ¶ms2)); + OK_(crypt_get_integrity_info(cd, &ip)); + EQ_(ip.tag_size, params2.tag_size); + EQ_(ip.integrity_key_size, integrity_key_size); + OK_(strcmp(ip.integrity, params2.integrity)); + CRYPT_FREE(cd); + + // provide specific key + OK_(crypt_init(&cd, DEVICE_1)); + OK_(crypt_format(cd, CRYPT_INTEGRITY, NULL, NULL, NULL, integrity_key, integrity_key_size, ¶ms2)); + OK_(crypt_get_integrity_info(cd, &ip)); + EQ_(ip.tag_size, params2.tag_size); + EQ_(ip.integrity_key_size, integrity_key_size); + OK_(strcmp(ip.integrity, params2.integrity)); + CRYPT_FREE(cd); + + OK_(crypt_init(&cd, DEVICE_1)); + OK_(crypt_load(cd, CRYPT_INTEGRITY, NULL)); + OK_(crypt_activate_by_volume_key(cd, CDEVICE_1, NULL, 0, 0)); + GE_(crypt_status(cd, CDEVICE_1), CRYPT_ACTIVE); + OK_(crypt_deactivate(cd, CDEVICE_1)); + CRYPT_FREE(cd); } static void WipeTest(void) diff --git a/tests/luks2-integrity-test b/tests/luks2-integrity-test index ff41ebf61..390b56d24 100755 --- a/tests/luks2-integrity-test +++ b/tests/luks2-integrity-test @@ -120,10 +120,18 @@ int_error_detection() # alg int sector_size intformat() # alg integrity integrity_out key_size int_key_size sector_size csum [test_hdr] { - echo -n "[$1:$2:$4:$6]" + echo -n "[$1:$2:$4:$6:$5]" echo -n "[FORMAT]" - $CRYPTSETUP luksFormat --type luks2 -q -c $1 --integrity $2 --sector-size $6 -s $4 \ - $FAST_PBKDF_OPT -d $KEY_FILE $DEV --offset 8192 --integrity-legacy-padding >/dev/null 2>&1 + + # just trick, if int key size is not multiple of 16, use explicit flag + if [ $(($5 % 16)) -eq 0 ]; then + INT_PARAMS="--integrity $2 --integrity-legacy-padding" + else + INT_PARAMS="--integrity $2 --integrity-key-size $5 --integrity-legacy-padding" + fi + + $CRYPTSETUP luksFormat --type luks2 -q -c $1 $INT_PARAMS --sector-size $6 -s $4 \ + $FAST_PBKDF_OPT -d $KEY_FILE $DEV --offset 8192 >/dev/null 2>&1 if [ $? -ne 0 ] ; then echo "[N/A]" return @@ -206,6 +214,9 @@ intformat aes-xts-random hmac-sha512 hmac\(sha512\) 512 512 4096 621f6c03f intformat aes-xts-plain64 hmac-sha1 hmac\(sha1\) 512 160 4096 7370c66a92708fb71b186931468be6aa9b26f4f88373b00b1c57360b9ee1304e intformat aes-xts-random hmac-sha1 hmac\(sha1\) 512 160 4096 8c0463f5ac09613674bdf40b0ff6f985edbc3de04e51fdc688873cb333ef3cda +intformat aes-xts-plain64 hmac-sha256 hmac\(sha256\) 512 264 512 ee501705a084cd0ab6f4a28014bcf62b8bfa3434de00b82743c50b3abf06232c +intformat aes-xts-plain64 hmac-sha512 hmac\(sha512\) 512 792 512 9040d276d8bfab30bbc4bf389e152e08c13ac6fa84d49d11c1bee6e1638fd8f1 + intformat aes-gcm-random aead aead 128 0 512 5f6f3f6be03c74d9aaaeaf40dd310c99a20e2786045f78a1fc6a0b189d231f57 intformat aes-gcm-random aead aead 128 0 4096 358d6beceddf593aff6b22c31684e0df9c226330aff5812e060950215217d21b intformat aes-gcm-random aead aead 256 0 512 5f6f3f6be03c74d9aaaeaf40dd310c99a20e2786045f78a1fc6a0b189d231f57