]>
Commit | Line | Data |
---|---|---|
7d969014 DB |
1 | /* |
2 | * QEMU Crypto block encryption | |
3 | * | |
4 | * Copyright (c) 2016 Red Hat, Inc. | |
5 | * | |
6 | * This library is free software; you can redistribute it and/or | |
7 | * modify it under the terms of the GNU Lesser General Public | |
8 | * License as published by the Free Software Foundation; either | |
9 | * version 2 of the License, or (at your option) any later version. | |
10 | * | |
11 | * This library is distributed in the hope that it will be useful, | |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
14 | * Lesser General Public License for more details. | |
15 | * | |
16 | * You should have received a copy of the GNU Lesser General Public | |
17 | * License along with this library; if not, see <http://www.gnu.org/licenses/>. | |
18 | * | |
19 | */ | |
20 | ||
21 | #include "qemu/osdep.h" | |
22 | #include "crypto/init.h" | |
23 | #include "crypto/block.h" | |
24 | #include "qemu/buffer.h" | |
25 | #include "crypto/secret.h" | |
3e308f20 DB |
26 | #ifndef _WIN32 |
27 | #include <sys/resource.h> | |
28 | #endif | |
29 | ||
30 | #if defined(CONFIG_UUID) && (defined(_WIN32) || defined RUSAGE_THREAD) | |
31 | #define TEST_LUKS | |
32 | #else | |
33 | #undef TEST_LUKS | |
34 | #endif | |
7d969014 DB |
35 | |
36 | static QCryptoBlockCreateOptions qcow_create_opts = { | |
37 | .format = Q_CRYPTO_BLOCK_FORMAT_QCOW, | |
38 | .u.qcow = { | |
39 | .has_key_secret = true, | |
40 | .key_secret = (char *)"sec0", | |
41 | }, | |
42 | }; | |
43 | ||
44 | static QCryptoBlockOpenOptions qcow_open_opts = { | |
45 | .format = Q_CRYPTO_BLOCK_FORMAT_QCOW, | |
46 | .u.qcow = { | |
47 | .has_key_secret = true, | |
48 | .key_secret = (char *)"sec0", | |
49 | }, | |
50 | }; | |
51 | ||
3e308f20 DB |
52 | |
53 | #ifdef TEST_LUKS | |
54 | static QCryptoBlockOpenOptions luks_open_opts = { | |
55 | .format = Q_CRYPTO_BLOCK_FORMAT_LUKS, | |
56 | .u.luks = { | |
57 | .has_key_secret = true, | |
58 | .key_secret = (char *)"sec0", | |
59 | }, | |
60 | }; | |
61 | ||
62 | ||
63 | /* Creation with all default values */ | |
64 | static QCryptoBlockCreateOptions luks_create_opts_default = { | |
65 | .format = Q_CRYPTO_BLOCK_FORMAT_LUKS, | |
66 | .u.luks = { | |
67 | .has_key_secret = true, | |
68 | .key_secret = (char *)"sec0", | |
69 | }, | |
70 | }; | |
71 | ||
72 | ||
73 | /* ...and with explicit values */ | |
74 | static QCryptoBlockCreateOptions luks_create_opts_aes256_cbc_plain64 = { | |
75 | .format = Q_CRYPTO_BLOCK_FORMAT_LUKS, | |
76 | .u.luks = { | |
77 | .has_key_secret = true, | |
78 | .key_secret = (char *)"sec0", | |
79 | .has_cipher_alg = true, | |
80 | .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256, | |
81 | .has_cipher_mode = true, | |
82 | .cipher_mode = QCRYPTO_CIPHER_MODE_CBC, | |
83 | .has_ivgen_alg = true, | |
84 | .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64, | |
85 | }, | |
86 | }; | |
87 | ||
88 | ||
89 | static QCryptoBlockCreateOptions luks_create_opts_aes256_cbc_essiv = { | |
90 | .format = Q_CRYPTO_BLOCK_FORMAT_LUKS, | |
91 | .u.luks = { | |
92 | .has_key_secret = true, | |
93 | .key_secret = (char *)"sec0", | |
94 | .has_cipher_alg = true, | |
95 | .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256, | |
96 | .has_cipher_mode = true, | |
97 | .cipher_mode = QCRYPTO_CIPHER_MODE_CBC, | |
98 | .has_ivgen_alg = true, | |
99 | .ivgen_alg = QCRYPTO_IVGEN_ALG_ESSIV, | |
100 | .has_ivgen_hash_alg = true, | |
101 | .ivgen_hash_alg = QCRYPTO_HASH_ALG_SHA256, | |
102 | .has_hash_alg = true, | |
103 | .hash_alg = QCRYPTO_HASH_ALG_SHA1, | |
104 | }, | |
105 | }; | |
106 | #endif /* TEST_LUKS */ | |
107 | ||
108 | ||
7d969014 DB |
109 | static struct QCryptoBlockTestData { |
110 | const char *path; | |
111 | QCryptoBlockCreateOptions *create_opts; | |
112 | QCryptoBlockOpenOptions *open_opts; | |
113 | ||
114 | bool expect_header; | |
115 | ||
116 | QCryptoCipherAlgorithm cipher_alg; | |
117 | QCryptoCipherMode cipher_mode; | |
118 | QCryptoHashAlgorithm hash_alg; | |
119 | ||
120 | QCryptoIVGenAlgorithm ivgen_alg; | |
3e308f20 DB |
121 | QCryptoHashAlgorithm ivgen_hash; |
122 | ||
123 | bool slow; | |
7d969014 DB |
124 | } test_data[] = { |
125 | { | |
126 | .path = "/crypto/block/qcow", | |
127 | .create_opts = &qcow_create_opts, | |
128 | .open_opts = &qcow_open_opts, | |
129 | ||
130 | .expect_header = false, | |
131 | ||
132 | .cipher_alg = QCRYPTO_CIPHER_ALG_AES_128, | |
133 | .cipher_mode = QCRYPTO_CIPHER_MODE_CBC, | |
134 | ||
135 | .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64, | |
136 | }, | |
3e308f20 DB |
137 | #ifdef TEST_LUKS |
138 | { | |
139 | .path = "/crypto/block/luks/default", | |
140 | .create_opts = &luks_create_opts_default, | |
141 | .open_opts = &luks_open_opts, | |
142 | ||
143 | .expect_header = true, | |
144 | ||
145 | .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256, | |
146 | .cipher_mode = QCRYPTO_CIPHER_MODE_XTS, | |
147 | .hash_alg = QCRYPTO_HASH_ALG_SHA256, | |
148 | ||
149 | .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64, | |
150 | ||
151 | .slow = true, | |
152 | }, | |
153 | { | |
154 | .path = "/crypto/block/luks/aes-256-cbc-plain64", | |
155 | .create_opts = &luks_create_opts_aes256_cbc_plain64, | |
156 | .open_opts = &luks_open_opts, | |
157 | ||
158 | .expect_header = true, | |
159 | ||
160 | .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256, | |
161 | .cipher_mode = QCRYPTO_CIPHER_MODE_CBC, | |
162 | .hash_alg = QCRYPTO_HASH_ALG_SHA256, | |
163 | ||
164 | .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64, | |
165 | ||
166 | .slow = true, | |
167 | }, | |
168 | { | |
169 | .path = "/crypto/block/luks/aes-256-cbc-essiv", | |
170 | .create_opts = &luks_create_opts_aes256_cbc_essiv, | |
171 | .open_opts = &luks_open_opts, | |
172 | ||
173 | .expect_header = true, | |
174 | ||
175 | .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256, | |
176 | .cipher_mode = QCRYPTO_CIPHER_MODE_CBC, | |
177 | .hash_alg = QCRYPTO_HASH_ALG_SHA1, | |
178 | ||
179 | .ivgen_alg = QCRYPTO_IVGEN_ALG_ESSIV, | |
180 | .ivgen_hash = QCRYPTO_HASH_ALG_SHA256, | |
181 | ||
182 | .slow = true, | |
183 | }, | |
184 | #endif | |
7d969014 DB |
185 | }; |
186 | ||
187 | ||
188 | static ssize_t test_block_read_func(QCryptoBlock *block, | |
189 | size_t offset, | |
190 | uint8_t *buf, | |
191 | size_t buflen, | |
192 | Error **errp, | |
193 | void *opaque) | |
194 | { | |
195 | Buffer *header = opaque; | |
196 | ||
197 | g_assert_cmpint(offset + buflen, <=, header->capacity); | |
198 | ||
199 | memcpy(buf, header->buffer + offset, buflen); | |
200 | ||
201 | return buflen; | |
202 | } | |
203 | ||
204 | ||
205 | static ssize_t test_block_init_func(QCryptoBlock *block, | |
206 | size_t headerlen, | |
207 | Error **errp, | |
208 | void *opaque) | |
209 | { | |
210 | Buffer *header = opaque; | |
211 | ||
212 | g_assert_cmpint(header->capacity, ==, 0); | |
213 | ||
214 | buffer_reserve(header, headerlen); | |
215 | ||
216 | return headerlen; | |
217 | } | |
218 | ||
219 | ||
220 | static ssize_t test_block_write_func(QCryptoBlock *block, | |
221 | size_t offset, | |
222 | const uint8_t *buf, | |
223 | size_t buflen, | |
224 | Error **errp, | |
225 | void *opaque) | |
226 | { | |
227 | Buffer *header = opaque; | |
228 | ||
229 | g_assert_cmpint(buflen + offset, <=, header->capacity); | |
230 | ||
231 | memcpy(header->buffer + offset, buf, buflen); | |
232 | header->offset = offset + buflen; | |
233 | ||
234 | return buflen; | |
235 | } | |
236 | ||
237 | ||
238 | static Object *test_block_secret(void) | |
239 | { | |
240 | return object_new_with_props( | |
241 | TYPE_QCRYPTO_SECRET, | |
242 | object_get_objects_root(), | |
243 | "sec0", | |
244 | &error_abort, | |
245 | "data", "123456", | |
246 | NULL); | |
247 | } | |
248 | ||
249 | static void test_block_assert_setup(const struct QCryptoBlockTestData *data, | |
250 | QCryptoBlock *blk) | |
251 | { | |
252 | QCryptoIVGen *ivgen; | |
253 | QCryptoCipher *cipher; | |
254 | ||
255 | ivgen = qcrypto_block_get_ivgen(blk); | |
256 | cipher = qcrypto_block_get_cipher(blk); | |
257 | ||
258 | g_assert(ivgen); | |
259 | g_assert(cipher); | |
260 | ||
261 | g_assert_cmpint(data->cipher_alg, ==, cipher->alg); | |
262 | g_assert_cmpint(data->cipher_mode, ==, cipher->mode); | |
263 | g_assert_cmpint(data->hash_alg, ==, | |
264 | qcrypto_block_get_kdf_hash(blk)); | |
265 | ||
266 | g_assert_cmpint(data->ivgen_alg, ==, | |
267 | qcrypto_ivgen_get_algorithm(ivgen)); | |
268 | g_assert_cmpint(data->ivgen_hash, ==, | |
269 | qcrypto_ivgen_get_hash(ivgen)); | |
270 | } | |
271 | ||
272 | ||
273 | static void test_block(gconstpointer opaque) | |
274 | { | |
275 | const struct QCryptoBlockTestData *data = opaque; | |
276 | QCryptoBlock *blk; | |
277 | Buffer header; | |
278 | Object *sec = test_block_secret(); | |
279 | ||
280 | memset(&header, 0, sizeof(header)); | |
281 | buffer_init(&header, "header"); | |
282 | ||
283 | blk = qcrypto_block_create(data->create_opts, | |
284 | test_block_init_func, | |
285 | test_block_write_func, | |
286 | &header, | |
287 | &error_abort); | |
288 | g_assert(blk); | |
289 | ||
290 | if (data->expect_header) { | |
291 | g_assert_cmpint(header.capacity, >, 0); | |
292 | } else { | |
293 | g_assert_cmpint(header.capacity, ==, 0); | |
294 | } | |
295 | ||
296 | test_block_assert_setup(data, blk); | |
297 | ||
298 | qcrypto_block_free(blk); | |
299 | object_unparent(sec); | |
300 | ||
301 | /* Ensure we can't open without the secret */ | |
302 | blk = qcrypto_block_open(data->open_opts, | |
303 | test_block_read_func, | |
304 | &header, | |
305 | 0, | |
306 | NULL); | |
307 | g_assert(blk == NULL); | |
308 | ||
309 | /* Ensure we can't open without the secret, unless NO_IO */ | |
310 | blk = qcrypto_block_open(data->open_opts, | |
311 | test_block_read_func, | |
312 | &header, | |
313 | QCRYPTO_BLOCK_OPEN_NO_IO, | |
314 | &error_abort); | |
315 | ||
316 | g_assert(qcrypto_block_get_cipher(blk) == NULL); | |
317 | g_assert(qcrypto_block_get_ivgen(blk) == NULL); | |
318 | ||
319 | qcrypto_block_free(blk); | |
320 | ||
321 | ||
322 | /* Now open for real with secret */ | |
323 | sec = test_block_secret(); | |
324 | blk = qcrypto_block_open(data->open_opts, | |
325 | test_block_read_func, | |
326 | &header, | |
327 | 0, | |
328 | &error_abort); | |
329 | g_assert(blk); | |
330 | ||
331 | test_block_assert_setup(data, blk); | |
332 | ||
333 | qcrypto_block_free(blk); | |
334 | ||
335 | object_unparent(sec); | |
336 | ||
337 | buffer_free(&header); | |
338 | } | |
339 | ||
340 | ||
341 | int main(int argc, char **argv) | |
342 | { | |
343 | gsize i; | |
344 | ||
345 | module_call_init(MODULE_INIT_QOM); | |
346 | g_test_init(&argc, &argv, NULL); | |
347 | ||
348 | g_assert(qcrypto_init(NULL) == 0); | |
349 | ||
350 | for (i = 0; i < G_N_ELEMENTS(test_data); i++) { | |
3e308f20 DB |
351 | if (test_data[i].open_opts->format == Q_CRYPTO_BLOCK_FORMAT_LUKS && |
352 | !qcrypto_hash_supports(test_data[i].hash_alg)) { | |
353 | continue; | |
354 | } | |
355 | if (!test_data[i].slow || | |
356 | g_test_slow()) { | |
357 | g_test_add_data_func(test_data[i].path, &test_data[i], test_block); | |
358 | } | |
7d969014 DB |
359 | } |
360 | ||
361 | return g_test_run(); | |
362 | } |