qemu/tests/test-crypto-block.c
<<
>>
Prefs
   1/*
   2 * QEMU Crypto block encryption
   3 *
   4 * Copyright (c) 2016 Red Hat, Inc.
   5 *
   6 * This library is free software; you can redistribute it and/or
   7 * modify it under the terms of the GNU Lesser General Public
   8 * License as published by the Free Software Foundation; either
   9 * version 2 of the License, or (at your option) any later version.
  10 *
  11 * This library is distributed in the hope that it will be useful,
  12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14 * Lesser General Public License for more details.
  15 *
  16 * You should have received a copy of the GNU Lesser General Public
  17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18 *
  19 */
  20
  21#include "qemu/osdep.h"
  22#include "qapi/error.h"
  23#include "crypto/init.h"
  24#include "crypto/block.h"
  25#include "qemu/buffer.h"
  26#include "qemu/module.h"
  27#include "crypto/secret.h"
  28#ifndef _WIN32
  29#include <sys/resource.h>
  30#endif
  31
  32#if (defined(_WIN32) || defined RUSAGE_THREAD) && \
  33    (defined(CONFIG_NETTLE) || defined(CONFIG_GCRYPT))
  34#define TEST_LUKS
  35#else
  36#undef TEST_LUKS
  37#endif
  38
  39static QCryptoBlockCreateOptions qcow_create_opts = {
  40    .format = Q_CRYPTO_BLOCK_FORMAT_QCOW,
  41    .u.qcow = {
  42        .has_key_secret = true,
  43        .key_secret = (char *)"sec0",
  44    },
  45};
  46
  47static QCryptoBlockOpenOptions qcow_open_opts = {
  48    .format = Q_CRYPTO_BLOCK_FORMAT_QCOW,
  49    .u.qcow = {
  50        .has_key_secret = true,
  51        .key_secret = (char *)"sec0",
  52    },
  53};
  54
  55
  56#ifdef TEST_LUKS
  57static QCryptoBlockOpenOptions luks_open_opts = {
  58    .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
  59    .u.luks = {
  60        .has_key_secret = true,
  61        .key_secret = (char *)"sec0",
  62    },
  63};
  64
  65
  66/* Creation with all default values */
  67static QCryptoBlockCreateOptions luks_create_opts_default = {
  68    .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
  69    .u.luks = {
  70        .has_key_secret = true,
  71        .key_secret = (char *)"sec0",
  72    },
  73};
  74
  75
  76/* ...and with explicit values */
  77static QCryptoBlockCreateOptions luks_create_opts_aes256_cbc_plain64 = {
  78    .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
  79    .u.luks = {
  80        .has_key_secret = true,
  81        .key_secret = (char *)"sec0",
  82        .has_cipher_alg = true,
  83        .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
  84        .has_cipher_mode = true,
  85        .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
  86        .has_ivgen_alg = true,
  87        .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64,
  88    },
  89};
  90
  91
  92static QCryptoBlockCreateOptions luks_create_opts_aes256_cbc_essiv = {
  93    .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
  94    .u.luks = {
  95        .has_key_secret = true,
  96        .key_secret = (char *)"sec0",
  97        .has_cipher_alg = true,
  98        .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
  99        .has_cipher_mode = true,
 100        .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
 101        .has_ivgen_alg = true,
 102        .ivgen_alg = QCRYPTO_IVGEN_ALG_ESSIV,
 103        .has_ivgen_hash_alg = true,
 104        .ivgen_hash_alg = QCRYPTO_HASH_ALG_SHA256,
 105        .has_hash_alg = true,
 106        .hash_alg = QCRYPTO_HASH_ALG_SHA1,
 107    },
 108};
 109#endif /* TEST_LUKS */
 110
 111
 112static struct QCryptoBlockTestData {
 113    const char *path;
 114    QCryptoBlockCreateOptions *create_opts;
 115    QCryptoBlockOpenOptions *open_opts;
 116
 117    bool expect_header;
 118
 119    QCryptoCipherAlgorithm cipher_alg;
 120    QCryptoCipherMode cipher_mode;
 121    QCryptoHashAlgorithm hash_alg;
 122
 123    QCryptoIVGenAlgorithm ivgen_alg;
 124    QCryptoHashAlgorithm ivgen_hash;
 125
 126    bool slow;
 127} test_data[] = {
 128    {
 129        .path = "/crypto/block/qcow",
 130        .create_opts = &qcow_create_opts,
 131        .open_opts = &qcow_open_opts,
 132
 133        .expect_header = false,
 134
 135        .cipher_alg = QCRYPTO_CIPHER_ALG_AES_128,
 136        .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
 137
 138        .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64,
 139    },
 140#ifdef TEST_LUKS
 141    {
 142        .path = "/crypto/block/luks/default",
 143        .create_opts = &luks_create_opts_default,
 144        .open_opts = &luks_open_opts,
 145
 146        .expect_header = true,
 147
 148        .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
 149        .cipher_mode = QCRYPTO_CIPHER_MODE_XTS,
 150        .hash_alg = QCRYPTO_HASH_ALG_SHA256,
 151
 152        .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64,
 153
 154        .slow = true,
 155    },
 156    {
 157        .path = "/crypto/block/luks/aes-256-cbc-plain64",
 158        .create_opts = &luks_create_opts_aes256_cbc_plain64,
 159        .open_opts = &luks_open_opts,
 160
 161        .expect_header = true,
 162
 163        .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
 164        .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
 165        .hash_alg = QCRYPTO_HASH_ALG_SHA256,
 166
 167        .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64,
 168
 169        .slow = true,
 170    },
 171    {
 172        .path = "/crypto/block/luks/aes-256-cbc-essiv",
 173        .create_opts = &luks_create_opts_aes256_cbc_essiv,
 174        .open_opts = &luks_open_opts,
 175
 176        .expect_header = true,
 177
 178        .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
 179        .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
 180        .hash_alg = QCRYPTO_HASH_ALG_SHA1,
 181
 182        .ivgen_alg = QCRYPTO_IVGEN_ALG_ESSIV,
 183        .ivgen_hash = QCRYPTO_HASH_ALG_SHA256,
 184
 185        .slow = true,
 186    },
 187#endif
 188};
 189
 190
 191static ssize_t test_block_read_func(QCryptoBlock *block,
 192                                    size_t offset,
 193                                    uint8_t *buf,
 194                                    size_t buflen,
 195                                    void *opaque,
 196                                    Error **errp)
 197{
 198    Buffer *header = opaque;
 199
 200    g_assert_cmpint(offset + buflen, <=, header->capacity);
 201
 202    memcpy(buf, header->buffer + offset, buflen);
 203
 204    return buflen;
 205}
 206
 207
 208static ssize_t test_block_init_func(QCryptoBlock *block,
 209                                    size_t headerlen,
 210                                    void *opaque,
 211                                    Error **errp)
 212{
 213    Buffer *header = opaque;
 214
 215    g_assert_cmpint(header->capacity, ==, 0);
 216
 217    buffer_reserve(header, headerlen);
 218
 219    return headerlen;
 220}
 221
 222
 223static ssize_t test_block_write_func(QCryptoBlock *block,
 224                                     size_t offset,
 225                                     const uint8_t *buf,
 226                                     size_t buflen,
 227                                     void *opaque,
 228                                     Error **errp)
 229{
 230    Buffer *header = opaque;
 231
 232    g_assert_cmpint(buflen + offset, <=, header->capacity);
 233
 234    memcpy(header->buffer + offset, buf, buflen);
 235    header->offset = offset + buflen;
 236
 237    return buflen;
 238}
 239
 240
 241static Object *test_block_secret(void)
 242{
 243    return object_new_with_props(
 244        TYPE_QCRYPTO_SECRET,
 245        object_get_objects_root(),
 246        "sec0",
 247        &error_abort,
 248        "data", "123456",
 249        NULL);
 250}
 251
 252static void test_block_assert_setup(const struct QCryptoBlockTestData *data,
 253                                    QCryptoBlock *blk)
 254{
 255    QCryptoIVGen *ivgen;
 256    QCryptoCipher *cipher;
 257
 258    ivgen = qcrypto_block_get_ivgen(blk);
 259    cipher = qcrypto_block_get_cipher(blk);
 260
 261    g_assert(ivgen);
 262    g_assert(cipher);
 263
 264    g_assert_cmpint(data->cipher_alg, ==, cipher->alg);
 265    g_assert_cmpint(data->cipher_mode, ==, cipher->mode);
 266    g_assert_cmpint(data->hash_alg, ==,
 267                    qcrypto_block_get_kdf_hash(blk));
 268
 269    g_assert_cmpint(data->ivgen_alg, ==,
 270                    qcrypto_ivgen_get_algorithm(ivgen));
 271    g_assert_cmpint(data->ivgen_hash, ==,
 272                    qcrypto_ivgen_get_hash(ivgen));
 273}
 274
 275
 276static void test_block(gconstpointer opaque)
 277{
 278    const struct QCryptoBlockTestData *data = opaque;
 279    QCryptoBlock *blk;
 280    Buffer header;
 281    Object *sec = test_block_secret();
 282
 283    memset(&header, 0, sizeof(header));
 284    buffer_init(&header, "header");
 285
 286    blk = qcrypto_block_create(data->create_opts, NULL,
 287                               test_block_init_func,
 288                               test_block_write_func,
 289                               &header,
 290                               &error_abort);
 291    g_assert(blk);
 292
 293    if (data->expect_header) {
 294        g_assert_cmpint(header.capacity, >, 0);
 295    } else {
 296        g_assert_cmpint(header.capacity, ==, 0);
 297    }
 298
 299    test_block_assert_setup(data, blk);
 300
 301    qcrypto_block_free(blk);
 302    object_unparent(sec);
 303
 304    /* Ensure we can't open without the secret */
 305    blk = qcrypto_block_open(data->open_opts, NULL,
 306                             test_block_read_func,
 307                             &header,
 308                             0,
 309                             1,
 310                             NULL);
 311    g_assert(blk == NULL);
 312
 313    /* Ensure we can't open without the secret, unless NO_IO */
 314    blk = qcrypto_block_open(data->open_opts, NULL,
 315                             test_block_read_func,
 316                             &header,
 317                             QCRYPTO_BLOCK_OPEN_NO_IO,
 318                             1,
 319                             &error_abort);
 320
 321    g_assert(qcrypto_block_get_cipher(blk) == NULL);
 322    g_assert(qcrypto_block_get_ivgen(blk) == NULL);
 323
 324    qcrypto_block_free(blk);
 325
 326
 327    /* Now open for real with secret */
 328    sec = test_block_secret();
 329    blk = qcrypto_block_open(data->open_opts, NULL,
 330                             test_block_read_func,
 331                             &header,
 332                             0,
 333                             1,
 334                             &error_abort);
 335    g_assert(blk);
 336
 337    test_block_assert_setup(data, blk);
 338
 339    qcrypto_block_free(blk);
 340
 341    object_unparent(sec);
 342
 343    buffer_free(&header);
 344}
 345
 346
 347int main(int argc, char **argv)
 348{
 349    gsize i;
 350
 351    module_call_init(MODULE_INIT_QOM);
 352    g_test_init(&argc, &argv, NULL);
 353
 354    g_assert(qcrypto_init(NULL) == 0);
 355
 356    for (i = 0; i < G_N_ELEMENTS(test_data); i++) {
 357        if (test_data[i].open_opts->format == Q_CRYPTO_BLOCK_FORMAT_LUKS &&
 358            !qcrypto_hash_supports(test_data[i].hash_alg)) {
 359            continue;
 360        }
 361        if (!test_data[i].slow ||
 362            g_test_slow()) {
 363            g_test_add_data_func(test_data[i].path, &test_data[i], test_block);
 364        }
 365    }
 366
 367    return g_test_run();
 368}
 369