71 lines
2.8 KiB
Diff
71 lines
2.8 KiB
Diff
From bc8c4fa2b3ba76647de9742c28bae751757dc2dd Mon Sep 17 00:00:00 2001
|
|
From: Vojtech Trefny <vtrefny@redhat.com>
|
|
Date: Thu, 18 May 2023 14:45:42 +0200
|
|
Subject: [PATCH 1/2] tests: Use longer passphrase for LUKS in dm_test
|
|
|
|
The short passphrase doesn't work when running in FIPS mode.
|
|
---
|
|
tests/dm_test.py | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/tests/dm_test.py b/tests/dm_test.py
|
|
index 936e3055..3b491d89 100644
|
|
--- a/tests/dm_test.py
|
|
+++ b/tests/dm_test.py
|
|
@@ -59,8 +59,8 @@ class DevMapperGetSubsystemFromName(DevMapperTestCase):
|
|
def test_get_subsystem_from_name_crypt(self):
|
|
"""Verify that it is possible to get luks device subsystem from its name"""
|
|
self.addCleanup(self._destroy_crypt)
|
|
- run("echo \"key\" | cryptsetup luksFormat %s -" %self.loop_dev)
|
|
- run("echo \"key\" | cryptsetup open %s libbd_dm_tests-subsystem_crypt --key-file=-" %self.loop_dev)
|
|
+ run("echo \"supersecretkey\" | cryptsetup luksFormat %s -" %self.loop_dev)
|
|
+ run("echo \"supersecretkey\" | cryptsetup open %s libbd_dm_tests-subsystem_crypt --key-file=-" %self.loop_dev)
|
|
subsystem = BlockDev.dm_get_subsystem_from_name("libbd_dm_tests-subsystem_crypt")
|
|
self.assertEqual(subsystem, "CRYPT")
|
|
|
|
--
|
|
2.40.1
|
|
|
|
|
|
From b1f6d1484a980885b9870d27d2b113c98400851b Mon Sep 17 00:00:00 2001
|
|
From: Vojtech Trefny <vtrefny@redhat.com>
|
|
Date: Thu, 18 May 2023 14:56:32 +0200
|
|
Subject: [PATCH 2/2] tests: Skip crypto tests with argon2 in FIPS mode
|
|
|
|
argon is not available when running in FIPS mode.
|
|
---
|
|
tests/crypto_test.py | 17 +++++++++++++++++
|
|
1 file changed, 17 insertions(+)
|
|
|
|
diff --git a/tests/crypto_test.py b/tests/crypto_test.py
|
|
index 94b89131..91ea1f35 100644
|
|
--- a/tests/crypto_test.py
|
|
+++ b/tests/crypto_test.py
|
|
@@ -175,6 +175,23 @@ class CryptoTestFormat(CryptoTestCase):
|
|
self.fail("Failed to get pbkdf information from:\n%s %s" % (out, err))
|
|
self.assertEqual(m.group(1), "pbkdf2")
|
|
|
|
+ def _is_fips_enabled(self):
|
|
+ if not os.path.exists("/proc/sys/crypto/fips_enabled"):
|
|
+ # if the file doesn't exist, we are definitely not in FIPS mode
|
|
+ return False
|
|
+
|
|
+ with open("/proc/sys/crypto/fips_enabled", "r") as f:
|
|
+ enabled = f.read()
|
|
+ return enabled.strip() == "1"
|
|
+
|
|
+ @tag_test(TestTags.SLOW, TestTags.CORE)
|
|
+ @unittest.skipUnless(HAVE_LUKS2, "LUKS 2 not supported")
|
|
+ def test_luks2_format_pbkdf_options(self):
|
|
+ """Verify that formatting device as LUKS 2 works"""
|
|
+
|
|
+ if self._is_fips_enabled():
|
|
+ self.skipTest("FIPS mode is enabled, cannot use argon2, skipping")
|
|
+
|
|
# different options for argon2 -- all parameters set
|
|
pbkdf = BlockDev.CryptoLUKSPBKDF(type="argon2id", max_memory_kb=100*1024, iterations=10, parallel_threads=1)
|
|
extra = BlockDev.CryptoLUKSExtra(pbkdf=pbkdf)
|
|
--
|
|
2.40.1
|
|
|