2 * QEMU Crypto block encryption
4 * Copyright (c) 2016 Red Hat, Inc.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
22 #include "crypto/init.h"
23 #include "crypto/block.h"
24 #include "qemu/buffer.h"
25 #include "crypto/secret.h"
27 #include <sys/resource.h>
30 #if defined(CONFIG_UUID) && (defined(_WIN32) || defined RUSAGE_THREAD)
36 static QCryptoBlockCreateOptions qcow_create_opts
= {
37 .format
= Q_CRYPTO_BLOCK_FORMAT_QCOW
,
39 .has_key_secret
= true,
40 .key_secret
= (char *)"sec0",
44 static QCryptoBlockOpenOptions qcow_open_opts
= {
45 .format
= Q_CRYPTO_BLOCK_FORMAT_QCOW
,
47 .has_key_secret
= true,
48 .key_secret
= (char *)"sec0",
54 static QCryptoBlockOpenOptions luks_open_opts
= {
55 .format
= Q_CRYPTO_BLOCK_FORMAT_LUKS
,
57 .has_key_secret
= true,
58 .key_secret
= (char *)"sec0",
63 /* Creation with all default values */
64 static QCryptoBlockCreateOptions luks_create_opts_default
= {
65 .format
= Q_CRYPTO_BLOCK_FORMAT_LUKS
,
67 .has_key_secret
= true,
68 .key_secret
= (char *)"sec0",
73 /* ...and with explicit values */
74 static QCryptoBlockCreateOptions luks_create_opts_aes256_cbc_plain64
= {
75 .format
= Q_CRYPTO_BLOCK_FORMAT_LUKS
,
77 .has_key_secret
= true,
78 .key_secret
= (char *)"sec0",
79 .has_cipher_alg
= true,
80 .cipher_alg
= QCRYPTO_CIPHER_ALG_AES_256
,
81 .has_cipher_mode
= true,
82 .cipher_mode
= QCRYPTO_CIPHER_MODE_CBC
,
83 .has_ivgen_alg
= true,
84 .ivgen_alg
= QCRYPTO_IVGEN_ALG_PLAIN64
,
89 static QCryptoBlockCreateOptions luks_create_opts_aes256_cbc_essiv
= {
90 .format
= Q_CRYPTO_BLOCK_FORMAT_LUKS
,
92 .has_key_secret
= true,
93 .key_secret
= (char *)"sec0",
94 .has_cipher_alg
= true,
95 .cipher_alg
= QCRYPTO_CIPHER_ALG_AES_256
,
96 .has_cipher_mode
= true,
97 .cipher_mode
= QCRYPTO_CIPHER_MODE_CBC
,
98 .has_ivgen_alg
= true,
99 .ivgen_alg
= QCRYPTO_IVGEN_ALG_ESSIV
,
100 .has_ivgen_hash_alg
= true,
101 .ivgen_hash_alg
= QCRYPTO_HASH_ALG_SHA256
,
102 .has_hash_alg
= true,
103 .hash_alg
= QCRYPTO_HASH_ALG_SHA1
,
106 #endif /* TEST_LUKS */
109 static struct QCryptoBlockTestData
{
111 QCryptoBlockCreateOptions
*create_opts
;
112 QCryptoBlockOpenOptions
*open_opts
;
116 QCryptoCipherAlgorithm cipher_alg
;
117 QCryptoCipherMode cipher_mode
;
118 QCryptoHashAlgorithm hash_alg
;
120 QCryptoIVGenAlgorithm ivgen_alg
;
121 QCryptoHashAlgorithm ivgen_hash
;
126 .path
= "/crypto/block/qcow",
127 .create_opts
= &qcow_create_opts
,
128 .open_opts
= &qcow_open_opts
,
130 .expect_header
= false,
132 .cipher_alg
= QCRYPTO_CIPHER_ALG_AES_128
,
133 .cipher_mode
= QCRYPTO_CIPHER_MODE_CBC
,
135 .ivgen_alg
= QCRYPTO_IVGEN_ALG_PLAIN64
,
139 .path
= "/crypto/block/luks/default",
140 .create_opts
= &luks_create_opts_default
,
141 .open_opts
= &luks_open_opts
,
143 .expect_header
= true,
145 .cipher_alg
= QCRYPTO_CIPHER_ALG_AES_256
,
146 .cipher_mode
= QCRYPTO_CIPHER_MODE_XTS
,
147 .hash_alg
= QCRYPTO_HASH_ALG_SHA256
,
149 .ivgen_alg
= QCRYPTO_IVGEN_ALG_PLAIN64
,
154 .path
= "/crypto/block/luks/aes-256-cbc-plain64",
155 .create_opts
= &luks_create_opts_aes256_cbc_plain64
,
156 .open_opts
= &luks_open_opts
,
158 .expect_header
= true,
160 .cipher_alg
= QCRYPTO_CIPHER_ALG_AES_256
,
161 .cipher_mode
= QCRYPTO_CIPHER_MODE_CBC
,
162 .hash_alg
= QCRYPTO_HASH_ALG_SHA256
,
164 .ivgen_alg
= QCRYPTO_IVGEN_ALG_PLAIN64
,
169 .path
= "/crypto/block/luks/aes-256-cbc-essiv",
170 .create_opts
= &luks_create_opts_aes256_cbc_essiv
,
171 .open_opts
= &luks_open_opts
,
173 .expect_header
= true,
175 .cipher_alg
= QCRYPTO_CIPHER_ALG_AES_256
,
176 .cipher_mode
= QCRYPTO_CIPHER_MODE_CBC
,
177 .hash_alg
= QCRYPTO_HASH_ALG_SHA1
,
179 .ivgen_alg
= QCRYPTO_IVGEN_ALG_ESSIV
,
180 .ivgen_hash
= QCRYPTO_HASH_ALG_SHA256
,
188 static ssize_t
test_block_read_func(QCryptoBlock
*block
,
195 Buffer
*header
= opaque
;
197 g_assert_cmpint(offset
+ buflen
, <=, header
->capacity
);
199 memcpy(buf
, header
->buffer
+ offset
, buflen
);
205 static ssize_t
test_block_init_func(QCryptoBlock
*block
,
210 Buffer
*header
= opaque
;
212 g_assert_cmpint(header
->capacity
, ==, 0);
214 buffer_reserve(header
, headerlen
);
220 static ssize_t
test_block_write_func(QCryptoBlock
*block
,
227 Buffer
*header
= opaque
;
229 g_assert_cmpint(buflen
+ offset
, <=, header
->capacity
);
231 memcpy(header
->buffer
+ offset
, buf
, buflen
);
232 header
->offset
= offset
+ buflen
;
238 static Object
*test_block_secret(void)
240 return object_new_with_props(
242 object_get_objects_root(),
249 static void test_block_assert_setup(const struct QCryptoBlockTestData
*data
,
253 QCryptoCipher
*cipher
;
255 ivgen
= qcrypto_block_get_ivgen(blk
);
256 cipher
= qcrypto_block_get_cipher(blk
);
261 g_assert_cmpint(data
->cipher_alg
, ==, cipher
->alg
);
262 g_assert_cmpint(data
->cipher_mode
, ==, cipher
->mode
);
263 g_assert_cmpint(data
->hash_alg
, ==,
264 qcrypto_block_get_kdf_hash(blk
));
266 g_assert_cmpint(data
->ivgen_alg
, ==,
267 qcrypto_ivgen_get_algorithm(ivgen
));
268 g_assert_cmpint(data
->ivgen_hash
, ==,
269 qcrypto_ivgen_get_hash(ivgen
));
273 static void test_block(gconstpointer opaque
)
275 const struct QCryptoBlockTestData
*data
= opaque
;
278 Object
*sec
= test_block_secret();
280 memset(&header
, 0, sizeof(header
));
281 buffer_init(&header
, "header");
283 blk
= qcrypto_block_create(data
->create_opts
,
284 test_block_init_func
,
285 test_block_write_func
,
290 if (data
->expect_header
) {
291 g_assert_cmpint(header
.capacity
, >, 0);
293 g_assert_cmpint(header
.capacity
, ==, 0);
296 test_block_assert_setup(data
, blk
);
298 qcrypto_block_free(blk
);
299 object_unparent(sec
);
301 /* Ensure we can't open without the secret */
302 blk
= qcrypto_block_open(data
->open_opts
,
303 test_block_read_func
,
307 g_assert(blk
== NULL
);
309 /* Ensure we can't open without the secret, unless NO_IO */
310 blk
= qcrypto_block_open(data
->open_opts
,
311 test_block_read_func
,
313 QCRYPTO_BLOCK_OPEN_NO_IO
,
316 g_assert(qcrypto_block_get_cipher(blk
) == NULL
);
317 g_assert(qcrypto_block_get_ivgen(blk
) == NULL
);
319 qcrypto_block_free(blk
);
322 /* Now open for real with secret */
323 sec
= test_block_secret();
324 blk
= qcrypto_block_open(data
->open_opts
,
325 test_block_read_func
,
331 test_block_assert_setup(data
, blk
);
333 qcrypto_block_free(blk
);
335 object_unparent(sec
);
337 buffer_free(&header
);
341 int main(int argc
, char **argv
)
345 module_call_init(MODULE_INIT_QOM
);
346 g_test_init(&argc
, &argv
, NULL
);
348 g_assert(qcrypto_init(NULL
) == 0);
350 for (i
= 0; i
< G_N_ELEMENTS(test_data
); i
++) {
351 if (test_data
[i
].open_opts
->format
== Q_CRYPTO_BLOCK_FORMAT_LUKS
&&
352 !qcrypto_hash_supports(test_data
[i
].hash_alg
)) {
355 if (!test_data
[i
].slow
||
357 g_test_add_data_func(test_data
[i
].path
, &test_data
[i
], test_block
);