1037 lines
34 KiB
Diff
1037 lines
34 KiB
Diff
From 46dc5904a9a6b0f1dcdb2511cc3f09671ef54b2a Mon Sep 17 00:00:00 2001
|
|
From: Sergio Correia <scorreia@redhat.com>
|
|
Date: Wed, 20 May 2020 21:09:15 -0300
|
|
Subject: [PATCH] Add clevis luks edit command
|
|
|
|
---
|
|
src/luks/clevis-luks-common-functions | 65 ++++--
|
|
src/luks/clevis-luks-edit | 242 +++++++++++++++++++++++
|
|
src/luks/clevis-luks-edit.1.adoc | 69 +++++++
|
|
src/luks/clevis-luks-regen | 125 ++----------
|
|
src/luks/meson.build | 3 +
|
|
src/luks/tests/edit-tang-luks1 | 106 ++++++++++
|
|
src/luks/tests/edit-tang-luks2 | 106 ++++++++++
|
|
src/luks/tests/meson.build | 28 ++-
|
|
src/luks/tests/regen-inplace-luks1 | 2 +-
|
|
src/luks/tests/regen-inplace-luks2 | 2 +-
|
|
src/luks/tests/regen-not-inplace-luks1 | 2 +-
|
|
src/luks/tests/regen-not-inplace-luks2 | 2 +-
|
|
src/luks/tests/tests-common-functions.in | 26 ---
|
|
src/luks/tests/unlock-tang-luks1 | 7 +-
|
|
src/luks/tests/unlock-tang-luks2 | 8 +-
|
|
15 files changed, 606 insertions(+), 187 deletions(-)
|
|
create mode 100755 src/luks/clevis-luks-edit
|
|
create mode 100644 src/luks/clevis-luks-edit.1.adoc
|
|
create mode 100755 src/luks/tests/edit-tang-luks1
|
|
create mode 100755 src/luks/tests/edit-tang-luks2
|
|
|
|
diff --git a/src/luks/clevis-luks-common-functions b/src/luks/clevis-luks-common-functions
|
|
index c9d712a..f3a875c 100644
|
|
--- a/src/luks/clevis-luks-common-functions
|
|
+++ b/src/luks/clevis-luks-common-functions
|
|
@@ -141,11 +141,7 @@ clevis_luks_decode_jwe() {
|
|
local jwe="${1}"
|
|
|
|
local coded
|
|
- if ! coded=$(jose jwe fmt -i- <<< "${jwe}"); then
|
|
- return 1
|
|
- fi
|
|
-
|
|
- coded=$(jose fmt -j- -g protected -u- <<< "${coded}" | tr -d '"')
|
|
+ read -r -d . coded <<< "${jwe}"
|
|
jose b64 dec -i- <<< "${coded}"
|
|
}
|
|
|
|
@@ -291,6 +287,46 @@ clevis_luks_read_pins_from_slot() {
|
|
printf "%s: %s\n" "${SLOT}" "${cfg}"
|
|
}
|
|
|
|
+# clevis_luks_is_key_valid() checks whether the given key is valid to unlock
|
|
+# the given device.
|
|
+clevis_luks_is_key_valid() {
|
|
+ local DEV="${1}"
|
|
+ local KEY="${2}"
|
|
+
|
|
+ if ! cryptsetup open --test-passphrase "${DEV}" \
|
|
+ --key-file <(echo -n "${KEY}") 2>/dev/null; then
|
|
+ return 1
|
|
+ fi
|
|
+ return 0
|
|
+}
|
|
+
|
|
+# clevis_luks_unlock_device_by_slot() does the unlock of the device and slot
|
|
+# passed as parameters and returns the decoded passphrase.
|
|
+clevis_luks_unlock_device_by_slot() {
|
|
+ local DEV="${1}"
|
|
+ local SLT="${2}"
|
|
+
|
|
+ [ -z "${DEV}" ] && return 1
|
|
+ [ -z "${SLT}" ] && return 1
|
|
+
|
|
+ local jwe passphrase
|
|
+ if ! jwe="$(clevis_luks_read_slot "${DEV}" "${SLT}" 2>/dev/null)" \
|
|
+ || [ -z "${jwe}" ]; then
|
|
+ return 1
|
|
+ fi
|
|
+
|
|
+ if ! passphrase="$(clevis decrypt < <(echo -n "${jwe}") 2>/dev/null)" \
|
|
+ || [ -z "${passphrase}" ]; then
|
|
+ return 1
|
|
+ fi
|
|
+
|
|
+ if ! clevis_luks_is_key_valid "${DEV}" "${passphrase}"; then
|
|
+ return 1
|
|
+ fi
|
|
+ echo -n "${passphrase}"
|
|
+ return 0
|
|
+}
|
|
+
|
|
# clevis_luks_unlock_device() does the unlock of the device passed as
|
|
# parameter and returns the decoded passphrase.
|
|
clevis_luks_unlock_device() {
|
|
@@ -303,26 +339,15 @@ clevis_luks_unlock_device() {
|
|
return 1
|
|
fi
|
|
|
|
- local slt jwe passphrase
|
|
+ local slt pt
|
|
for slt in ${used_slots}; do
|
|
- if ! jwe="$(clevis_luks_read_slot "${DEV}" "${slt}" 2>/dev/null)" \
|
|
- || [ -z "${jwe}" ]; then
|
|
- continue
|
|
- fi
|
|
-
|
|
- if ! passphrase="$(clevis decrypt < <(echo -n "${jwe}"))" \
|
|
- || [ -z "${passphrase}" ]; then
|
|
+ if ! pt=$(clevis_luks_unlock_device_by_slot "${DEV}" "${slt}") \
|
|
+ || [ -z "${pt}" ]; then
|
|
continue
|
|
fi
|
|
-
|
|
- if ! cryptsetup luksOpen --test-passphrase "${DEV}" \
|
|
- --key-file <(echo -n "${passphrase}"); then
|
|
- continue
|
|
- fi
|
|
- echo -n "${passphrase}"
|
|
+ echo -n "${pt}"
|
|
return 0
|
|
done
|
|
-
|
|
return 1
|
|
}
|
|
|
|
diff --git a/src/luks/clevis-luks-edit b/src/luks/clevis-luks-edit
|
|
new file mode 100755
|
|
index 0000000..fc95f75
|
|
--- /dev/null
|
|
+++ b/src/luks/clevis-luks-edit
|
|
@@ -0,0 +1,242 @@
|
|
+#!/bin/bash -e
|
|
+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
+#
|
|
+# Copyright (c) 2020 Red Hat, Inc.
|
|
+# Author: Sergio Correia <scorreia@redhat.com>
|
|
+#
|
|
+# This program is free software: you can redistribute it and/or modify
|
|
+# it under the terms of the GNU General Public License as published by
|
|
+# the Free Software Foundation, either version 3 of the License, or
|
|
+# (at your option) any later version.
|
|
+#
|
|
+# This program is distributed in the hope that it will be useful,
|
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+# GNU General Public License for more details.
|
|
+#
|
|
+# You should have received a copy of the GNU General Public License
|
|
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
+#
|
|
+
|
|
+. clevis-luks-common-functions
|
|
+
|
|
+SUMMARY="Edit a binding from a clevis-bound slot in a LUKS device"
|
|
+
|
|
+usage() {
|
|
+ echo >&2
|
|
+ echo "Usage: clevis luks edit [-f] -d DEV -s SLT [-c CONFIG]" >&2
|
|
+ echo >&2
|
|
+ echo "$SUMMARY": >&2
|
|
+ echo >&2
|
|
+ echo " -d DEV The LUKS device to edit clevis-bound pins" >&2
|
|
+ echo >&2
|
|
+ echo " -s SLOT The slot to use when editing the clevis binding" >&2
|
|
+ echo >&2
|
|
+ echo " -f Proceed with the edit operation even if the configuration is the same" >&2
|
|
+ echo >&2
|
|
+ echo " -c CONFIG The updated config to use" >&2
|
|
+ echo >&2
|
|
+ exit 1
|
|
+}
|
|
+
|
|
+on_exit() {
|
|
+ [ -d "$TMP" ] && rm -rf "${TMP}"
|
|
+}
|
|
+
|
|
+validate_cfg() {
|
|
+ local json="${1}"
|
|
+ jose fmt -j- -O <<< "${json}" 2>/dev/null
|
|
+}
|
|
+
|
|
+edit_cfg() {
|
|
+ local cfg_file="${1}"
|
|
+ local editor="${EDITOR:-vi}"
|
|
+
|
|
+ "${editor}" "${cfg_file}" || true
|
|
+ if ! validate_cfg "$(<"${cfg_file}")"; then
|
|
+ local ans=
|
|
+ while true; do
|
|
+ read -r -p \
|
|
+ "Malformed configuration. Would you like to edit again? [ynYN] " \
|
|
+ ans < /dev/tty
|
|
+
|
|
+ [[ "${ans}" =~ ^[nN]$ ]] && return 1
|
|
+ [[ "${ans}" =~ ^[yY]$ ]] && break
|
|
+ done
|
|
+ edit_cfg "${cfg_file}"
|
|
+ fi
|
|
+ return 0
|
|
+}
|
|
+
|
|
+if [ "${#}" -eq 1 ] && [ "${1}" = "--summary" ]; then
|
|
+ echo "${SUMMARY}"
|
|
+ exit 0
|
|
+fi
|
|
+
|
|
+CFG=
|
|
+FRC=
|
|
+while getopts ":fd:s:c:" o; do
|
|
+ case "$o" in
|
|
+ d) DEV=${OPTARG};;
|
|
+ s) SLT=${OPTARG};;
|
|
+ c) CFG=${OPTARG};;
|
|
+ f) FRC=-f;;
|
|
+ *) usage;;
|
|
+ esac
|
|
+done
|
|
+
|
|
+if [ -z "${DEV}" ]; then
|
|
+ echo "Did not specify a device!" >&2
|
|
+ usage
|
|
+fi
|
|
+
|
|
+if [ -z "${SLT}" ]; then
|
|
+ echo "Did not specify a slot!" >&2
|
|
+ usage
|
|
+fi
|
|
+
|
|
+if ! binding="$(clevis luks list -d "${DEV}" -s "${SLT}" 2>/dev/null)" \
|
|
+ || [ -z "${binding}" ]; then
|
|
+ echo "Error retrieving current configuration from ${DEV}:${SLT}" >&2
|
|
+ exit 1
|
|
+fi
|
|
+
|
|
+read -r _ pin cfg <<< "${binding}"
|
|
+# Remove single quotes.
|
|
+cfg=${cfg//\'}
|
|
+if ! pretty_cfg="$(jq . <<< "${cfg}")" || [ -z "${pretty_cfg}" ]; then
|
|
+ echo "Error reading the configuration from ${DEV}:${SLT}" >&2
|
|
+ exit 1
|
|
+fi
|
|
+
|
|
+if ! TMP="$(mktemp -d)" || [ -z "${TMP}" ]; then
|
|
+ echo "Creating a temporary dir for editing binding failed" >&2
|
|
+ exit 1
|
|
+fi
|
|
+
|
|
+trap 'on_exit' EXIT
|
|
+trap 'on_exit' ERR
|
|
+
|
|
+if [ -z "${CFG}" ]; then
|
|
+ CFG_FILE="${TMP}/cfg"
|
|
+ echo "${pretty_cfg}" > "${CFG_FILE}"
|
|
+ if ! edit_cfg "${CFG_FILE}"; then
|
|
+ exit 1
|
|
+ fi
|
|
+
|
|
+ if ! new_cfg="$(jq . -S < "${CFG_FILE}")" || [ -z "${new_cfg}" ]; then
|
|
+ echo "Error reading the updated config for ${DEV}:${SLT}" >&2
|
|
+ exit 1
|
|
+ fi
|
|
+else
|
|
+ if ! validate_cfg "${CFG}"; then
|
|
+ echo "Invalid configuration given as parameter with -c" >&2
|
|
+ exit 1
|
|
+ fi
|
|
+ new_cfg="$(jq . -S <<< "${CFG}")"
|
|
+fi
|
|
+
|
|
+if [ "${new_cfg}" = "$(jq -S . <<< "${pretty_cfg}")" ] && [ -z "${FRC}" ]; then
|
|
+ echo "No changes detected; exiting" >&2
|
|
+ exit 1
|
|
+fi
|
|
+
|
|
+if ! jcfg="$(jose fmt -j- -Oo- <<< "${new_cfg}" 2>/dev/null)" \
|
|
+ || [ -z "${jcfg}" ]; then
|
|
+ echo "Error preparing the configuration for the binding update" >&2
|
|
+ exit 1
|
|
+fi
|
|
+
|
|
+if [ -z "${CFG}" ]; then
|
|
+ printf "Pin: %s\nNew config:\n%s\n" "${pin}" "${new_cfg}"
|
|
+ while true; do
|
|
+ read -r -p \
|
|
+ "Would you like to proceed with the updated configuration? [ynYN] " \
|
|
+ ans < /dev/tty
|
|
+ [[ "${ans}" =~ ^[nN]$ ]] && exit 0
|
|
+ [[ "${ans}" =~ ^[yY]$ ]] && break
|
|
+ done
|
|
+fi
|
|
+
|
|
+echo "Updating binding..."
|
|
+
|
|
+# Create new key.
|
|
+if ! new_pass=$(generate_key "${DEV}"); then
|
|
+ echo "Error generating new key for device ${DEV}" >&2
|
|
+ exit 1
|
|
+fi
|
|
+
|
|
+# Reencrypt the new password.
|
|
+if ! jwe="$(clevis encrypt "${pin}" "${jcfg}" -y <<< "${new_pass}")"; then
|
|
+ echo "Error using pin '${pin}' with config '${jcfg}'" >&2
|
|
+ exit 1
|
|
+fi
|
|
+
|
|
+# Backup LUKS header.
|
|
+if ! clevis_luks_backup_dev "${DEV}" "${TMP}"; then
|
|
+ echo "Error while trying to back up LUKS header from ${DEV}" >&2
|
|
+ exit 1
|
|
+fi
|
|
+
|
|
+# Get passphrase.
|
|
+if ! pt="$(clevis_luks_unlock_device "${DEV}")" \
|
|
+ || [ -z "${pt}" ]; then
|
|
+ # Unable to retrieve a passphrase from the bindings, so let's query
|
|
+ # the user.
|
|
+ read -r -s -p "Enter existing LUKS password: " pt; echo
|
|
+ # Check if the key is valid.
|
|
+ if ! clevis_luks_is_key_valid "${DEV}" "${pt}"; then
|
|
+ echo "The key provided is not valid for ${DEV}" >&2
|
|
+ exit 1
|
|
+ fi
|
|
+fi
|
|
+
|
|
+# Check if we can do the update in-place, i.e., if the key we got is the one
|
|
+# for the slot we are interested in.
|
|
+in_place=
|
|
+if cryptsetup open --test-passphrase --key-slot "${SLT}" "${DEV}" \
|
|
+ <<< "${pt}"; then
|
|
+ in_place=true
|
|
+fi
|
|
+
|
|
+# Update the key slot with the new key. If we have the key for this slot,
|
|
+# the change happens in-place. Otherwise, we kill the slot and re-add it.
|
|
+if [ -n "${in_place}" ]; then
|
|
+ if ! cryptsetup luksChangeKey "${DEV}" --key-slot "${SLT}" \
|
|
+ <(echo -n "${new_pass}") <<< "${pt}"; then
|
|
+ echo "Error updating LUKS passphrase in ${DEV}:${SLT}" >&2
|
|
+ clevis_luks_restore_dev "${DEV}" "${TMP}"
|
|
+ exit 1
|
|
+ fi
|
|
+else
|
|
+ if ! cryptsetup luksKillSlot --batch-mode "${DEV}" "${SLT}"; then
|
|
+ echo "Error wiping slot ${SLT} from ${DEV}" >&2
|
|
+ clevis_luks_restore_dev "${DEV}" "${TMP}"
|
|
+ exit 1
|
|
+ fi
|
|
+
|
|
+ if ! echo -n "${new_pass}" \
|
|
+ | cryptsetup luksAddKey --key-slot "${SLT}" \
|
|
+ --key-file <(echo -n "${pt}") "${DEV}"; then
|
|
+ echo "Error updating LUKS passphrase in ${DEV}:${SLT}." >&2
|
|
+ clevis_luks_restore_dev "${DEV}" "${TMP}"
|
|
+ exit 1
|
|
+ fi
|
|
+fi
|
|
+
|
|
+# Update the metadata.
|
|
+if ! clevis_luks_save_slot "${DEV}" "${SLT}" "${jwe}" "overwrite"; then
|
|
+ echo "Error updating metadata in ${DEV}:${SLT}" >&2
|
|
+ clevis_luks_restore_dev "${DEV}" "${TMP}"
|
|
+ exit 1
|
|
+fi
|
|
+
|
|
+# Make sure we can unlock the device with this keyslot.
|
|
+if ! clevis_luks_unlock_device_by_slot "${DEV}" "${SLT}" >/dev/null \
|
|
+ 2>/dev/null; then
|
|
+ echo "Invalid configuration detected. Reverting changes." >&2
|
|
+ clevis_luks_restore_dev "${DEV}" "${TMP}"
|
|
+ exit 1
|
|
+fi
|
|
+
|
|
+echo "Binding edited successfully."
|
|
diff --git a/src/luks/clevis-luks-edit.1.adoc b/src/luks/clevis-luks-edit.1.adoc
|
|
new file mode 100644
|
|
index 0000000..454de89
|
|
--- /dev/null
|
|
+++ b/src/luks/clevis-luks-edit.1.adoc
|
|
@@ -0,0 +1,69 @@
|
|
+CLEVIS-LUKS-EDIT(1)
|
|
+===================
|
|
+:doctype: manpage
|
|
+
|
|
+
|
|
+== NAME
|
|
+
|
|
+clevis-luks-edit - Edit a binding from a clevis-bound slot in a LUKS device
|
|
+
|
|
+== SYNOPSIS
|
|
+
|
|
+*clevis luks edit* -d DEV -s SLT [-c CONFIG]
|
|
+
|
|
+== OVERVIEW
|
|
+
|
|
+The *clevis luks edit* command edits clevis bindings from a LUKS device.
|
|
+For example:
|
|
+
|
|
+ clevis luks edit -d /dev/sda1 -s 1
|
|
+
|
|
+== OPTIONS
|
|
+
|
|
+* *-d* _DEV_ :
|
|
+ The LUKS device to edit clevis-bound pins
|
|
+
|
|
+* *-s* _SLT_ :
|
|
+ The slot to use when editing the clevis binding
|
|
+
|
|
+* *-f* :
|
|
+ Proceed with the edit operation even if the config is the same as the current one
|
|
+
|
|
+* *-c* _CONFIG_ :
|
|
+ The updated config to use
|
|
+
|
|
+
|
|
+== EXAMPLES
|
|
+
|
|
+ clevis luks list -d /dev/sda1
|
|
+ 1: tang '{"url":"addr"}'
|
|
+
|
|
+As we can see in the example above, */dev/sda1* has one slots bound, in this case, to a _tang_ pin.
|
|
+
|
|
+We can edit this binding by issuing the following command:
|
|
+
|
|
+ clevis luks edit -d /dev/sda1 -s 1
|
|
+
|
|
+This will open a text editor -- the one set in the $EDITOR environment variable, or _vi_, as a fallback -- with the current
|
|
+configuration of this binding to be edited. In this case, we should have the following:
|
|
+
|
|
+ {
|
|
+ "url": "addr"
|
|
+ }
|
|
+
|
|
+Once at the editor, we can edit the pin configuration. For _tang_, we could edit the _url_, for instance. After completing the change,
|
|
+save the file and exit. The updated configuration will be validated for JSON, and if there are no errors, you will be shown the
|
|
+updated configuration and prompted whether to proceed.
|
|
+
|
|
+By proceeding, the binding will be updated. There may be required to provide a valid LUKS passphrase for the device.
|
|
+
|
|
+In the second example, we will update the same device and slot, but we will be providing the updated configuration as well:
|
|
+
|
|
+ clevis luks edit -d /dev/sda1 -s 1 -c '{"url":"new-addr-here"}'
|
|
+
|
|
+In this case, the binding update will be done in non-interactive mode, however it also may be required to provide a valud LUKS
|
|
+passphrase for the device.
|
|
+
|
|
+== SEE ALSO
|
|
+
|
|
+link:clevis-luks-list.1.adoc[*clevis-luks-list*(1)],
|
|
diff --git a/src/luks/clevis-luks-regen b/src/luks/clevis-luks-regen
|
|
index 6071d85..8f32e08 100755
|
|
--- a/src/luks/clevis-luks-regen
|
|
+++ b/src/luks/clevis-luks-regen
|
|
@@ -41,15 +41,7 @@ function usage_and_exit () {
|
|
exit "${1}"
|
|
}
|
|
|
|
-on_exit() {
|
|
- if [ ! -d "${TMP}" ] || ! rm -rf "${TMP}"; then
|
|
- echo "Delete temporary files failed!" >&2
|
|
- echo "You need to clean up: ${TMP}" >&2
|
|
- exit 1
|
|
- fi
|
|
-}
|
|
-
|
|
-while getopts ":hfd:s:" o; do
|
|
+while getopts ":hd:s:" o; do
|
|
case "$o" in
|
|
d) DEV="$OPTARG";;
|
|
h) usage_and_exit 0;;
|
|
@@ -68,117 +60,22 @@ if [ -z "$SLT" ]; then
|
|
exit 1
|
|
fi
|
|
|
|
-### ----------------------------------------------------------------------
|
|
-if ! pin_cfg=$(clevis luks list -d "${DEV}" -s "${SLT}" 2>/dev/null); then
|
|
- echo "Error obtaining current configuration of device ${DEV}:${SLT}" >&2
|
|
+if ! binding="$(clevis luks list -d "${DEV}" -s "${SLT}" 2>/dev/null)" \
|
|
+ || [ -z "${binding}" ]; then
|
|
+ echo "Error retrieving current configuration from ${DEV}:${SLT}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
-PIN=$(echo "${pin_cfg}" | awk '{ print $2 }')
|
|
-CFG=$(echo "${pin_cfg}" | awk '{ print $3 }' | tr -d "'")
|
|
+read -r _ pin cfg <<< "${binding}"
|
|
|
|
echo "Regenerating with:"
|
|
-echo "PIN: $PIN"
|
|
-echo "CONFIG: $CFG"
|
|
-
|
|
-trap 'echo "Ignoring CONTROL-C!"' INT TERM
|
|
-
|
|
-# Get the existing key.
|
|
-if ! existing_key=$(clevis luks pass -d "${DEV}" -s "${SLT}" 2>/dev/null); then
|
|
- # We failed to obtain the passphrase for the slot -- perhaps
|
|
- # it was rotated? --, so let's request user input.
|
|
- read -r -s -p "Enter existing LUKS password: " existing_key; echo
|
|
-fi
|
|
-
|
|
-# Check if the key is valid.
|
|
-if ! cryptsetup open --test-passphrase "${DEV}" <<< "${existing_key}"; then
|
|
- exit 1
|
|
-fi
|
|
-
|
|
-# Check if we can do the update in-place, i.e., if the key we got is the one
|
|
-# for the slot we are interested in.
|
|
-in_place=
|
|
-if cryptsetup open --test-passphrase --key-slot "${SLT}" "${DEV}" \
|
|
- <<< "${existing_key}"; then
|
|
- in_place=true
|
|
-fi
|
|
-
|
|
-# Create new key.
|
|
-if ! new_passphrase=$(generate_key "${DEV}"); then
|
|
- echo "Error generating new key for device ${DEV}" >&2
|
|
- exit 1
|
|
-fi
|
|
-
|
|
-# Reencrypt the new password.
|
|
-if ! jwe="$(clevis encrypt "${PIN}" "${CFG}" <<< "${new_passphrase}")"; then
|
|
- echo "Error using pin '${PIN}' with config '${CFG}'" >&2
|
|
- exit 1
|
|
-fi
|
|
-
|
|
-# Updating the metadata and the actual passphrase are destructive operations,
|
|
-# hence we will do a backup of the LUKS header and restore it later in case
|
|
-# we have issues performing these operations.
|
|
-if ! TMP="$(mktemp -d)"; then
|
|
- echo "Creating a temporary dir for device backup/restore failed!" >&2
|
|
- exit 1
|
|
-fi
|
|
-trap 'on_exit' EXIT
|
|
-
|
|
-# Backup LUKS header.
|
|
-if ! clevis_luks_backup_dev "${DEV}" "${TMP}"; then
|
|
- echo "Error while trying to back up LUKS header from ${DEV}" >&2
|
|
- exit 1
|
|
-fi
|
|
-
|
|
-restore_device() {
|
|
- local DEV="${1}"
|
|
- local TMP="${2}"
|
|
-
|
|
- if ! clevis_luks_restore_dev "${DEV}" "${TMP}"; then
|
|
- echo "Error while trying to restore LUKS header from ${DEV}." >&2
|
|
- else
|
|
- echo "LUKS header restored successfully." >&2
|
|
- fi
|
|
-}
|
|
-
|
|
-# Update the key slot with the new key. If we have the key for this slot,
|
|
-# the change happens in-place. Otherwise, we kill the slot and re-add it.
|
|
-if [ -n "${in_place}" ]; then
|
|
- if ! cryptsetup luksChangeKey "${DEV}" --key-slot "${SLT}" \
|
|
- <(echo -n "${new_passphrase}") <<< "${existing_key}"; then
|
|
- echo "Error updating LUKS passphrase in ${DEV}:${SLT}" >&2
|
|
- restore_device "${DEV}" "${TMP}"
|
|
- exit 1
|
|
- fi
|
|
-else
|
|
- if ! cryptsetup luksKillSlot --batch-mode "${DEV}" "${SLT}"; then
|
|
- echo "Error wiping slot ${SLT} from ${DEV}" >&2
|
|
- restore_device "${DEV}" "${TMP}"
|
|
- exit 1
|
|
- fi
|
|
-
|
|
- if ! echo -n "${new_passphrase}" \
|
|
- | cryptsetup luksAddKey --key-slot "${SLT}" \
|
|
- --key-file <(echo -n "${existing_key}") "${DEV}"; then
|
|
- echo "Error updating LUKS passphrase in ${DEV}:${SLT}." >&2
|
|
- restore_device "${DEV}" "${TMP}"
|
|
- exit 1
|
|
- fi
|
|
-fi
|
|
-
|
|
-# Update the metadata.
|
|
-if ! clevis_luks_save_slot "${DEV}" "${SLT}" "${jwe}" "overwrite"; then
|
|
- echo "Error updating metadata in ${DEV}:${SLT}" >&2
|
|
- restore_device "${DEV}" "${TMP}"
|
|
- exit 1
|
|
-fi
|
|
+echo "PIN: ${pin}"
|
|
+echo "CONFIG: ${cfg}"
|
|
|
|
-# Now make sure that we can unlock this device after the change.
|
|
-# If we can't, undo the changes.
|
|
-if ! cryptsetup open --test-passphrase --key-slot "${SLT}" "${DEV}" 2>/dev/null \
|
|
- <<< "$(clevis luks pass -d "${DEV}" -s "${SLT}" 2>/dev/null)"; then
|
|
- echo "Invalid configuration detected after rebinding. Reverting changes."
|
|
- restore_device "${DEV}" "${TMP}"
|
|
+# Remove single quotes.
|
|
+cfg=${cfg//\'}
|
|
+if ! clevis luks edit -f -d "${DEV}" -s "${SLT}" -c "${cfg}" >/dev/null; then
|
|
+ echo "Error rotating keys in ${DEV}:${SLT}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
diff --git a/src/luks/meson.build b/src/luks/meson.build
|
|
index ee588c3..ba02bd9 100644
|
|
--- a/src/luks/meson.build
|
|
+++ b/src/luks/meson.build
|
|
@@ -54,6 +54,9 @@ if libcryptsetup.found() and luksmeta.found() and pwmake.found()
|
|
bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-sss')
|
|
bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-tang')
|
|
mans += join_paths(meson.current_source_dir(), 'clevis-luks-report.1')
|
|
+
|
|
+ bins += join_paths(meson.current_source_dir(), 'clevis-luks-edit')
|
|
+ mans += join_paths(meson.current_source_dir(), 'clevis-luks-edit.1')
|
|
else
|
|
warning('Will not install LUKS support due to missing dependencies!')
|
|
endif
|
|
diff --git a/src/luks/tests/edit-tang-luks1 b/src/luks/tests/edit-tang-luks1
|
|
new file mode 100755
|
|
index 0000000..3d42d68
|
|
--- /dev/null
|
|
+++ b/src/luks/tests/edit-tang-luks1
|
|
@@ -0,0 +1,106 @@
|
|
+#!/bin/bash -ex
|
|
+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
+#
|
|
+# Copyright (c) 2020 Red Hat, Inc.
|
|
+# Author: Sergio Correia <scorreia@redhat.com>
|
|
+#
|
|
+# This program is free software: you can redistribute it and/or modify
|
|
+# it under the terms of the GNU General Public License as published by
|
|
+# the Free Software Foundation, either version 3 of the License, or
|
|
+# (at your option) any later version.
|
|
+#
|
|
+# This program is distributed in the hope that it will be useful,
|
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+# GNU General Public License for more details.
|
|
+#
|
|
+# You should have received a copy of the GNU General Public License
|
|
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
+
|
|
+TEST=$(basename "${0}")
|
|
+. tests-common-functions
|
|
+
|
|
+. clevis-luks-common-functions
|
|
+
|
|
+on_exit() {
|
|
+ local d
|
|
+ for d in "${TMP}" "${TMP2}"; do
|
|
+ [ ! -d "${d}" ] && continue
|
|
+ tang_stop "${d}"
|
|
+ rm -rf "${d}"
|
|
+ done
|
|
+}
|
|
+
|
|
+trap 'on_exit' EXIT
|
|
+trap 'on_exit' ERR
|
|
+
|
|
+TMP="$(mktemp -d)"
|
|
+
|
|
+port=$(get_random_port)
|
|
+tang_run "${TMP}" "${port}" &
|
|
+tang_wait_until_ready "${port}"
|
|
+
|
|
+url="http://${TANG_HOST}:${port}"
|
|
+
|
|
+cfg=$(printf '{"url":"%s"}' "${url}")
|
|
+
|
|
+# LUKS1.
|
|
+DEV="${TMP}/luks1-device"
|
|
+new_device "luks1" "${DEV}"
|
|
+
|
|
+if ! clevis luks bind -y -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
|
|
+ error "${TEST}: Bind should have succeeded."
|
|
+fi
|
|
+
|
|
+# Now let's try to change the config but using the same one we already have.
|
|
+if clevis luks edit -d "${DEV}" -s 1 -c "${cfg}"; then
|
|
+ error "${TEST}: edit should not have succeeded because the config is the same."
|
|
+fi
|
|
+
|
|
+# And now, just a broken config.
|
|
+new_cfg=$(printf '{"url&:"%s"}' "${url}")
|
|
+if clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
|
|
+ error "${TEST}: edit should have failed because of invalid JSON"
|
|
+fi
|
|
+
|
|
+# Now let's have another tang instance running and change the config to use
|
|
+# the new one.
|
|
+port2=$(get_random_port)
|
|
+TMP2="$(mktemp -d)"
|
|
+tang_run "${TMP2}" "${port2}" &
|
|
+tang_wait_until_ready "${port2}"
|
|
+new_url="http://${TANG_HOST}:${port2}"
|
|
+new_cfg=$(printf '{"url":"%s"}' "${new_url}")
|
|
+
|
|
+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
|
|
+ error "${TEST}: edit should have succeeded."
|
|
+fi
|
|
+
|
|
+# And now let's use sss and start with a single tang server, then add a second
|
|
+# one.
|
|
+new_device "luks1" "${DEV}"
|
|
+cfg=$(printf '{"t":1,"pins":{"tang":[{"url":"%s"}]}}' "${url}")
|
|
+if ! clevis luks bind -y -d "${DEV}" sss "${cfg}" <<< "${DEFAULT_PASS}"; then
|
|
+ error "${TEST}: Bind should have succeeded."
|
|
+fi
|
|
+new_cfg=$(printf '{"t":1,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \
|
|
+ "${url}" "${new_url}")
|
|
+
|
|
+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
|
|
+ error "${TEST}: edit should have succeeded and added a new tang server"
|
|
+fi
|
|
+
|
|
+# Now let's change the threshold to 2.
|
|
+new_cfg=$(printf '{"t":2,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \
|
|
+ "${url}" "${new_url}")
|
|
+
|
|
+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
|
|
+ error "${TEST}: edit should have succeeded and added a new tang server"
|
|
+fi
|
|
+
|
|
+# And finally, let's try a broken config, with a wrong threshold.
|
|
+new_cfg=$(printf '{"t":3,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \
|
|
+ "${url}" "${new_url}")
|
|
+if clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
|
|
+ error "${TEST}: edit should have failed because threshold > number of servers"
|
|
+fi
|
|
diff --git a/src/luks/tests/edit-tang-luks2 b/src/luks/tests/edit-tang-luks2
|
|
new file mode 100755
|
|
index 0000000..9000053
|
|
--- /dev/null
|
|
+++ b/src/luks/tests/edit-tang-luks2
|
|
@@ -0,0 +1,106 @@
|
|
+#!/bin/bash -ex
|
|
+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
+#
|
|
+# Copyright (c) 2020 Red Hat, Inc.
|
|
+# Author: Sergio Correia <scorreia@redhat.com>
|
|
+#
|
|
+# This program is free software: you can redistribute it and/or modify
|
|
+# it under the terms of the GNU General Public License as published by
|
|
+# the Free Software Foundation, either version 3 of the License, or
|
|
+# (at your option) any later version.
|
|
+#
|
|
+# This program is distributed in the hope that it will be useful,
|
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+# GNU General Public License for more details.
|
|
+#
|
|
+# You should have received a copy of the GNU General Public License
|
|
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
+
|
|
+TEST=$(basename "${0}")
|
|
+. tests-common-functions
|
|
+
|
|
+. clevis-luks-common-functions
|
|
+
|
|
+on_exit() {
|
|
+ local d
|
|
+ for d in "${TMP}" "${TMP2}"; do
|
|
+ [ ! -d "${d}" ] && continue
|
|
+ tang_stop "${d}"
|
|
+ rm -rf "${d}"
|
|
+ done
|
|
+}
|
|
+
|
|
+trap 'on_exit' EXIT
|
|
+trap 'on_exit' ERR
|
|
+
|
|
+TMP="$(mktemp -d)"
|
|
+
|
|
+port=$(get_random_port)
|
|
+tang_run "${TMP}" "${port}" &
|
|
+tang_wait_until_ready "${port}"
|
|
+
|
|
+url="http://${TANG_HOST}:${port}"
|
|
+
|
|
+cfg=$(printf '{"url":"%s"}' "${url}")
|
|
+
|
|
+# LUKS2.
|
|
+DEV="${TMP}/luks2-device"
|
|
+new_device "luks2" "${DEV}"
|
|
+
|
|
+if ! clevis luks bind -y -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
|
|
+ error "${TEST}: Bind should have succeeded."
|
|
+fi
|
|
+
|
|
+# Now let's try to change the config but using the same one we already have.
|
|
+if clevis luks edit -d "${DEV}" -s 1 -c "${cfg}"; then
|
|
+ error "${TEST}: edit should not have succeeded because the config is the same."
|
|
+fi
|
|
+
|
|
+# And now, just a broken config.
|
|
+new_cfg=$(printf '{"url&:"%s"}' "${url}")
|
|
+if clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
|
|
+ error "${TEST}: edit should have failed because of invalid JSON"
|
|
+fi
|
|
+
|
|
+# Now let's have another tang instance running and change the config to use
|
|
+# the new one.
|
|
+port2=$(get_random_port)
|
|
+TMP2="$(mktemp -d)"
|
|
+tang_run "${TMP2}" "${port2}" &
|
|
+tang_wait_until_ready "${port2}"
|
|
+new_url="http://${TANG_HOST}:${port2}"
|
|
+new_cfg=$(printf '{"url":"%s"}' "${new_url}")
|
|
+
|
|
+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
|
|
+ error "${TEST}: edit should have succeeded."
|
|
+fi
|
|
+
|
|
+# And now let's use sss and start with a single tang server, then add a second
|
|
+# one.
|
|
+new_device "luks2" "${DEV}"
|
|
+cfg=$(printf '{"t":1,"pins":{"tang":[{"url":"%s"}]}}' "${url}")
|
|
+if ! clevis luks bind -y -d "${DEV}" sss "${cfg}" <<< "${DEFAULT_PASS}"; then
|
|
+ error "${TEST}: Bind should have succeeded."
|
|
+fi
|
|
+new_cfg=$(printf '{"t":1,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \
|
|
+ "${url}" "${new_url}")
|
|
+
|
|
+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
|
|
+ error "${TEST}: edit should have succeeded and added a new tang server"
|
|
+fi
|
|
+
|
|
+# Now let's change the threshold to 2.
|
|
+new_cfg=$(printf '{"t":2,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \
|
|
+ "${url}" "${new_url}")
|
|
+
|
|
+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
|
|
+ error "${TEST}: edit should have succeeded and added a new tang server"
|
|
+fi
|
|
+
|
|
+# And finally, let's try a broken config, with a wrong threshold.
|
|
+new_cfg=$(printf '{"t":3,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \
|
|
+ "${url}" "${new_url}")
|
|
+if clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
|
|
+ error "${TEST}: edit should have failed because threshold > number of servers"
|
|
+fi
|
|
diff --git a/src/luks/tests/meson.build b/src/luks/tests/meson.build
|
|
index 4795488..67fa597 100644
|
|
--- a/src/luks/tests/meson.build
|
|
+++ b/src/luks/tests/meson.build
|
|
@@ -4,8 +4,9 @@ actv = find_program(
|
|
required: false
|
|
)
|
|
|
|
-# We use jq for comparing the pin config in the clevis luks list tests.
|
|
-jq = find_program('jq', required: false)
|
|
+# We use jq for comparing the pin config in the clevis luks list tests
|
|
+# and also in clevis luks edit.
|
|
+jq = find_program('jq', required: true)
|
|
|
|
# we use systemd-socket-activate for running test tang servers.
|
|
actv = find_program(
|
|
@@ -74,19 +75,16 @@ test('bind-pass-with-newline', find_program('bind-pass-with-newline-luks1'), env
|
|
test('bind-pass-with-newline-keyfile', find_program('bind-pass-with-newline-keyfile-luks1'), env: env)
|
|
# Bug #70.
|
|
test('bind-already-used-luksmeta-slot', find_program('bind-already-used-luksmeta-slot'), env: env, timeout: 60)
|
|
-
|
|
-if jq.found()
|
|
- test('list-recursive-luks1', find_program('list-recursive-luks1'), env: env)
|
|
- test('list-tang-luks1', find_program('list-tang-luks1'), env: env)
|
|
- test('list-sss-tang-luks1', find_program('list-sss-tang-luks1'), env: env)
|
|
-else
|
|
- warning('Will not run "clevis luks list" tests due to missing jq dependency')
|
|
-endif
|
|
+test('list-recursive-luks1', find_program('list-recursive-luks1'), env: env)
|
|
+test('list-tang-luks1', find_program('list-tang-luks1'), env: env)
|
|
+test('list-sss-tang-luks1', find_program('list-sss-tang-luks1'), env: env)
|
|
|
|
if has_tang
|
|
test('unlock-tang-luks1', find_program('unlock-tang-luks1'), env: env, timeout: 90)
|
|
test('assume-yes-luks1', find_program('assume-yes-luks1'), env: env)
|
|
+ test('edit-tang-luks1', find_program('edit-tang-luks1'), env: env, timeout: 90)
|
|
endif
|
|
+
|
|
test('pass-tang-luks1', find_program('pass-tang-luks1'), env: env)
|
|
test('backup-restore-luks1', find_program('backup-restore-luks1'), env: env)
|
|
test('regen-inplace-luks1', find_program('regen-inplace-luks1'), env: env, timeout: 90)
|
|
@@ -100,16 +98,14 @@ if luksmeta_data.get('OLD_CRYPTSETUP') == '0'
|
|
test('bind-luks2', find_program('bind-luks2'), env: env, timeout: 60)
|
|
test('unbind-unbound-slot-luks2', find_program('unbind-unbound-slot-luks2'), env: env)
|
|
test('unbind-luks2', find_program('unbind-luks2'), env: env, timeout: 60)
|
|
-
|
|
- if jq.found()
|
|
- test('list-recursive-luks2', find_program('list-recursive-luks2'), env: env, timeout: 60)
|
|
- test('list-tang-luks2', find_program('list-tang-luks2'), env: env, timeout: 60)
|
|
- test('list-sss-tang-luks2', find_program('list-sss-tang-luks2'), env: env, timeout: 60)
|
|
- endif
|
|
+ test('list-recursive-luks2', find_program('list-recursive-luks2'), env: env, timeout: 60)
|
|
+ test('list-tang-luks2', find_program('list-tang-luks2'), env: env, timeout: 60)
|
|
+ test('list-sss-tang-luks2', find_program('list-sss-tang-luks2'), env: env, timeout: 60)
|
|
|
|
if has_tang
|
|
test('unlock-tang-luks2', find_program('unlock-tang-luks2'), env: env, timeout: 120)
|
|
test('assume-yes-luks2', find_program('assume-yes-luks2'), env: env, timeout: 60)
|
|
+ test('edit-tang-luks2', find_program('edit-tang-luks2'), env: env, timeout: 120)
|
|
endif
|
|
test('pass-tang-luks2', find_program('pass-tang-luks2'), env: env, timeout: 60)
|
|
test('backup-restore-luks2', find_program('backup-restore-luks2'), env:env, timeout: 90)
|
|
diff --git a/src/luks/tests/regen-inplace-luks1 b/src/luks/tests/regen-inplace-luks1
|
|
index 3a42ced..32072c4 100755
|
|
--- a/src/luks/tests/regen-inplace-luks1
|
|
+++ b/src/luks/tests/regen-inplace-luks1
|
|
@@ -76,7 +76,7 @@ fi
|
|
old_key=$(clevis luks pass -d "${DEV}" -s "${SLT}")
|
|
|
|
# Now let's try regen.
|
|
-if ! clevis_regen "${DEV}" "${SLT}" "${DEFAULT_PASS}"; then
|
|
+if ! clevis luks regen -d "${DEV}" -s "${SLT}"; then
|
|
error "${TEST}: clevis luks regen failed"
|
|
fi
|
|
|
|
diff --git a/src/luks/tests/regen-inplace-luks2 b/src/luks/tests/regen-inplace-luks2
|
|
index 1cb7a29..d1bc182 100755
|
|
--- a/src/luks/tests/regen-inplace-luks2
|
|
+++ b/src/luks/tests/regen-inplace-luks2
|
|
@@ -77,7 +77,7 @@ fi
|
|
old_key=$(clevis luks pass -d "${DEV}" -s "${SLT}")
|
|
|
|
# Now let's try regen.
|
|
-if ! clevis_regen "${DEV}" "${SLT}" "${DEFAULT_PASS}"; then
|
|
+if ! clevis luks regen -d "${DEV}" -s "${SLT}"; then
|
|
error "${TEST}: clevis luks regen failed"
|
|
fi
|
|
|
|
diff --git a/src/luks/tests/regen-not-inplace-luks1 b/src/luks/tests/regen-not-inplace-luks1
|
|
index 1b65ca7..fba61dc 100755
|
|
--- a/src/luks/tests/regen-not-inplace-luks1
|
|
+++ b/src/luks/tests/regen-not-inplace-luks1
|
|
@@ -79,7 +79,7 @@ if [ "${enabled}" -ne 2 ]; then
|
|
fi
|
|
|
|
# Now let's try regen.
|
|
-if ! clevis_regen "${DEV}" "${SLT}" "${DEFAULT_PASS}"; then
|
|
+if ! clevis luks regen -d "${DEV}" -s "${SLT}" <<< "${DEFAULT_PASS}"; then
|
|
error "${TEST}: clevis luks regen failed"
|
|
fi
|
|
|
|
diff --git a/src/luks/tests/regen-not-inplace-luks2 b/src/luks/tests/regen-not-inplace-luks2
|
|
index dc91449..6e3b012 100755
|
|
--- a/src/luks/tests/regen-not-inplace-luks2
|
|
+++ b/src/luks/tests/regen-not-inplace-luks2
|
|
@@ -80,7 +80,7 @@ if [ "${enabled}" -ne 2 ]; then
|
|
fi
|
|
|
|
# Now let's try regen.
|
|
-if ! clevis_regen "${DEV}" "${SLT}" "${DEFAULT_PASS}"; then
|
|
+if ! clevis luks regen -d "${DEV}" -s "${SLT}" <<< "${DEFAULT_PASS}"; then
|
|
error "${TEST}: clevis luks regen failed"
|
|
fi
|
|
|
|
diff --git a/src/luks/tests/tests-common-functions.in b/src/luks/tests/tests-common-functions.in
|
|
index 6101f28..7b3fdad 100755
|
|
--- a/src/luks/tests/tests-common-functions.in
|
|
+++ b/src/luks/tests/tests-common-functions.in
|
|
@@ -229,31 +229,5 @@ tang_get_adv() {
|
|
curl -o "${adv}" http://"${TANG_HOST}":"${port}"/adv
|
|
}
|
|
|
|
-# Regenerate binding.
|
|
-clevis_regen() {
|
|
- local DEV="${1}"
|
|
- local SLT="${2}"
|
|
- local PASS="${3}"
|
|
-
|
|
- expect -d << CLEVIS_REGEN
|
|
- set timeout 120
|
|
- spawn sh -c "clevis luks regen -d $DEV -s $SLT"
|
|
- expect {
|
|
- "Enter existing LUKS password" {
|
|
- send "$PASS\r"
|
|
- exp_continue
|
|
- }
|
|
- "Do you wish to trust these keys" {
|
|
- send "y\r"
|
|
- exp_continue
|
|
- }
|
|
- expect eof
|
|
- wait
|
|
- }
|
|
-CLEVIS_REGEN
|
|
- ret=$?
|
|
- return "${ret}"
|
|
-}
|
|
-
|
|
export TANG_HOST=127.0.0.1
|
|
export DEFAULT_PASS='just-some-test-password-here'
|
|
diff --git a/src/luks/tests/unlock-tang-luks1 b/src/luks/tests/unlock-tang-luks1
|
|
index 841ba01..6ede47b 100755
|
|
--- a/src/luks/tests/unlock-tang-luks1
|
|
+++ b/src/luks/tests/unlock-tang-luks1
|
|
@@ -31,6 +31,10 @@ on_exit() {
|
|
trap 'on_exit' EXIT
|
|
trap 'on_exit' ERR
|
|
|
|
+# LUKS1.
|
|
+DEV="${TMP}/luks1-device"
|
|
+new_device "luks1" "${DEV}"
|
|
+
|
|
TMP="$(mktemp -d)"
|
|
|
|
port=$(get_random_port)
|
|
@@ -43,9 +47,6 @@ tang_get_adv "${port}" "${adv}"
|
|
|
|
cfg=$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv")
|
|
|
|
-# LUKS1.
|
|
-DEV="${TMP}/luks1-device"
|
|
-new_device "luks1" "${DEV}"
|
|
|
|
if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
|
|
error "${TEST}: Bind should have succeeded."
|
|
diff --git a/src/luks/tests/unlock-tang-luks2 b/src/luks/tests/unlock-tang-luks2
|
|
index 81822fb..b32c5aa 100755
|
|
--- a/src/luks/tests/unlock-tang-luks2
|
|
+++ b/src/luks/tests/unlock-tang-luks2
|
|
@@ -31,6 +31,10 @@ on_exit() {
|
|
trap 'on_exit' EXIT
|
|
trap 'on_exit' ERR
|
|
|
|
+# LUKS2.
|
|
+DEV="${TMP}/luks2-device"
|
|
+new_device "luks2" "${DEV}"
|
|
+
|
|
TMP="$(mktemp -d)"
|
|
|
|
port=$(get_random_port)
|
|
@@ -43,10 +47,6 @@ tang_get_adv "${port}" "${adv}"
|
|
|
|
cfg=$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv")
|
|
|
|
-# LUKS2.
|
|
-DEV="${TMP}/luks2-device"
|
|
-new_device "luks2" "${DEV}"
|
|
-
|
|
if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
|
|
error "${TEST}: Bind should have succeeded."
|
|
fi
|
|
--
|
|
2.18.4
|
|
|