Attachment #22845 for bug #61272

View | Details | Raw Unified | Return to bug 61272
Collapse All | Expand All




tab='	'
pkcs11_luks_key="/tmp/pkcs11-luks.key"
crypttab=/etc/crypttab
lukskeys="${lukskeys:-/etc/luks.keys}"

match_dev_in_array() {
	[ "$#" = 2 ] || return 2

}

findkey() {
	local path keydev luksdev prefix rc=0 s v

	while IFS='' read -u 3 -r s; do
		for n in path keydev luksdev; do
			v=
			if [ -n "$s" ] && [ -z "${s##*$tab*}" ]; then
				v="${s%%$tab*}"
				s="${s#*$tab}"
			else
				v="$s"
				s=
			fi
			eval "$n=\"\$v\""
		done

	while IFS="$tab" read -u 3 -r path keydev luksdev; do
		if [ -z "$path" ]; then
			message "ERROR: keypath required."
			return 1


		message "Found keyfile '$path' for '${LUKS_ROOT#/dev/}' encrypted partition."
		return 0
	done 3< "$lukskeys"

	# Keyfile not found yet.
	return 2

	# First of all, we check /etc/luks.keys, which is usually created from
	# /proc/cmdline.
	#
	if [ -f "$lukskeys" ]; then
		message "$LUKS_ROOT: trying to find the keyfile in the '$lukskeys'."
		findkey
		[ "${LUKS_KEY_FORMAT:-plain}" != plain ] ||
			luks_pipekey=y




=== Test 1: Empty keydev with matching luksdev (key-path<TAB><TAB>UUID=...) ===
message: Found keyfile '<TMPDIR>/keys/target.key' for 'sda2' encrypted partition.
rc=0
=== Test 2: Skip non-matching entry and find matching (empty keydev) ===
message: Found keyfile '<TMPDIR>/keys/target.key' for 'sda2' encrypted partition.
rc=0
=== Test 3: PKCS#11 key with empty keydev (filters/lukskeys format) ===
read_pkcs11_key: pkcs11:model=test;id=1
message: Found keyfile '<TMPDIR>/pkcs11-luks.key' for 'sda2' encrypted partition.
rc=0
=== Test 4: Single field (key-path only) ===
message: Found keyfile '<TMPDIR>/keys/target.key' for 'sda2' encrypted partition.
rc=0
=== Test 5: All 3 fields (key-path, keydev, luksdev) ===
mount: -r /dev/sdb1 <TMPDIR>/mnt
message: Found keyfile 'custom/key.bin' for 'sda2' encrypted partition.
rc=0
=== Test 6: Empty keypath error ===
message: ERROR: keypath required.
rc=1
rc=0




#!/bin/bash -efu
# SPDX-License-Identifier: GPL-3.0-or-later

cwd="${0%/*}"

tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT

tab='	'
mnt="$tmpdir/mnt"
mkdir -p "$mnt"
lukskeys="$tmpdir/luks.keys"
LUKS_ROOT="/dev/sda2"
ID_FS_UUID="target-uuid-1234"

pkcs11_luks_key="$tmpdir/pkcs11-luks.key"

# Mock functions needed by findkey
message() {
	echo "message: $*" | sed "s#$tmpdir#<TMPDIR>#g"
}

get_dev() {
	local val="$1"
	[ "$val" = "UUID=$ID_FS_UUID" ] || [ "$val" = "$LUKS_ROOT" ]
}

mount() {
	echo "mount: $*" | sed "s#$tmpdir#<TMPDIR>#g"
	return 1
}

read_pkcs11_key() {
	echo "read_pkcs11_key: $*"
	path="$pkcs11_luks_key"
	touch "$path"
	return 0
}

# Extract findkey from 085-luks
eval "$(sed -n '/^findkey() {/,/^}/p' features/luks/data/lib/uevent/handlers/085-luks)"

run_test() {
	local desc="$1"
	echo "=== $desc ==="
	local rc=0
	( findkey ) || rc=$?
	echo "rc=$rc"
}

mkdir -p "$tmpdir/keys"
touch "$tmpdir/keys/target.key"
touch "$tmpdir/keys/other.key"

#
# Regression tests for commit ba53c151:
# When keydev is empty (key-path<TAB><TAB>UUID=...), IFS tab-splitting in bash
# must not collapse consecutive tabs. Otherwise, UUID= is assigned to keydev
# instead of luksdev, leading to an invalid mount attempt and early abort.
#

printf '%s\t\tUUID=%s\n' "$tmpdir/keys/target.key" "$ID_FS_UUID" > "$lukskeys"
run_test "Test 1: Empty keydev with matching luksdev (key-path<TAB><TAB>UUID=...)"

{
	printf '%s\t\tUUID=%s\n' "$tmpdir/keys/other.key" "other-uuid-9999"
	printf '%s\t\tUUID=%s\n' "$tmpdir/keys/target.key" "$ID_FS_UUID"
} > "$lukskeys"
run_test "Test 2: Skip non-matching entry and find matching (empty keydev)"

printf 'pkcs11:model=test;id=1\t\tUUID=%s\n' "$ID_FS_UUID" > "$lukskeys"
run_test "Test 3: PKCS#11 key with empty keydev (filters/lukskeys format)"

printf '%s\n' "$tmpdir/keys/target.key" > "$lukskeys"
run_test "Test 4: Single field (key-path only)"

mount() {
	echo "mount: $*" | sed "s#$tmpdir#<TMPDIR>#g"
	return 0
}
mkdir -p "$tmpdir/mnt/custom"
touch "$tmpdir/mnt/custom/key.bin"
printf 'custom/key.bin\t/dev/sdb1\tUUID=%s\n' "$ID_FS_UUID" > "$lukskeys"
run_test "Test 5: All 3 fields (key-path, keydev, luksdev)"

printf '\t\tUUID=%s\n' "$ID_FS_UUID" > "$lukskeys"
run_test "Test 6: Empty keypath error"

Return to bug 61272

Lines 17-22 mnt="/mnt/luks-key" Link Here

(-)a/features/luks/data/lib/uevent/handlers/085-luks (-5 / +18 lines)
17	tab=' '	17	tab=' '
18	pkcs11_luks_key="/tmp/pkcs11-luks.key"	18	pkcs11_luks_key="/tmp/pkcs11-luks.key"
19	crypttab=/etc/crypttab	19	crypttab=/etc/crypttab
		20	lukskeys="${lukskeys:-/etc/luks.keys}"
20		21
21	match_dev_in_array() {	22	match_dev_in_array() {
22	[ "$#" = 2 ] \|\| return 2	23	[ "$#" = 2 ] \|\| return 2
Lines 93-101 freekey() { Link Here
93	}	94	}
94		95
95	findkey() {	96	findkey() {
96	local path keydev luksdev prefix rc=0	97	local path keydev luksdev prefix rc=0 s v
		98
		99	while IFS='' read -u 3 -r s; do
		100	for n in path keydev luksdev; do
		101	v=
		102	if [ -n "$s" ] && [ -z "${s##$tab}" ]; then
		103	v="${s%%$tab*}"
		104	s="${s#*$tab}"
		105	else
		106	v="$s"
		107	s=
		108	fi
		109	eval "$n=\"\$v\""
		110	done
97		111
98	while IFS="$tab" read -u 3 -r path keydev luksdev; do
99	if [ -z "$path" ]; then	112	if [ -z "$path" ]; then
100	message "ERROR: keypath required."	113	message "ERROR: keypath required."
101	return 1	114	return 1
Lines 130-136 findkey() { Link Here
130		143
131	message "Found keyfile '$path' for '${LUKS_ROOT#/dev/}' encrypted partition."	144	message "Found keyfile '$path' for '${LUKS_ROOT#/dev/}' encrypted partition."
132	return 0	145	return 0
133	done 3< /etc/luks.keys	146	done 3< "$lukskeys"
134		147
135	# Keyfile not found yet.	148	# Keyfile not found yet.
136	return 2	149	return 2
Lines 284-291 handler() { Link Here
284	# First of all, we check /etc/luks.keys, which is usually created from	297	# First of all, we check /etc/luks.keys, which is usually created from
285	# /proc/cmdline.	298	# /proc/cmdline.
286	#	299	#
287	if [ -f /etc/luks.keys ]; then	300	if [ -f "$lukskeys" ]; then
288	message "$LUKS_ROOT: trying to find the keyfile in the '/etc/luks.keys'."	301	message "$LUKS_ROOT: trying to find the keyfile in the '$lukskeys'."
289	findkey	302	findkey
290	[ "${LUKS_KEY_FORMAT:-plain}" != plain ] \|\|	303	[ "${LUKS_KEY_FORMAT:-plain}" != plain ] \|\|
291	luks_pipekey=y	304	luks_pipekey=y

Line 0 Link Here

(-)a/testing/tests/ts0063-luks-keys-parsing/expect (+21 lines)
	1	=== Test 1: Empty keydev with matching luksdev (key-path<TAB><TAB>UUID=...) ===
	2	message: Found keyfile '<TMPDIR>/keys/target.key' for 'sda2' encrypted partition.
	3	rc=0
	4	=== Test 2: Skip non-matching entry and find matching (empty keydev) ===
	5	message: Found keyfile '<TMPDIR>/keys/target.key' for 'sda2' encrypted partition.
	6	rc=0
	7	=== Test 3: PKCS#11 key with empty keydev (filters/lukskeys format) ===
	8	read_pkcs11_key: pkcs11:model=test;id=1
	9	message: Found keyfile '<TMPDIR>/pkcs11-luks.key' for 'sda2' encrypted partition.
	10	rc=0
	11	=== Test 4: Single field (key-path only) ===
	12	message: Found keyfile '<TMPDIR>/keys/target.key' for 'sda2' encrypted partition.
	13	rc=0
	14	=== Test 5: All 3 fields (key-path, keydev, luksdev) ===
	15	mount: -r /dev/sdb1 <TMPDIR>/mnt
	16	message: Found keyfile 'custom/key.bin' for 'sda2' encrypted partition.
	17	rc=0
	18	=== Test 6: Empty keypath error ===
	19	message: ERROR: keypath required.
	20	rc=1
	21	rc=0

Line 0 Link Here

(-)a/testing/tests/ts0063-luks-keys-parsing/run (-1 / +87 lines)
0	-	1	#!/bin/bash -efu
		2	# SPDX-License-Identifier: GPL-3.0-or-later
		3
		4	cwd="${0%/*}"
		5
		6	tmpdir="$(mktemp -d)"
		7	trap 'rm -rf "$tmpdir"' EXIT
		8
		9	tab=' '
		10	mnt="$tmpdir/mnt"
		11	mkdir -p "$mnt"
		12	lukskeys="$tmpdir/luks.keys"
		13	LUKS_ROOT="/dev/sda2"
		14	ID_FS_UUID="target-uuid-1234"
		15
		16	pkcs11_luks_key="$tmpdir/pkcs11-luks.key"
		17
		18	# Mock functions needed by findkey
		19	message() {
		20	echo "message: $*" \| sed "s#$tmpdir#<TMPDIR>#g"
		21	}
		22
		23	get_dev() {
		24	local val="$1"
		25	[ "$val" = "UUID=$ID_FS_UUID" ] \|\| [ "$val" = "$LUKS_ROOT" ]
		26	}
		27
		28	mount() {
		29	echo "mount: $*" \| sed "s#$tmpdir#<TMPDIR>#g"
		30	return 1
		31	}
		32
		33	read_pkcs11_key() {
		34	echo "read_pkcs11_key: $*"
		35	path="$pkcs11_luks_key"
		36	touch "$path"
		37	return 0
		38	}
		39
		40	# Extract findkey from 085-luks
		41	eval "$(sed -n '/^findkey() {/,/^}/p' features/luks/data/lib/uevent/handlers/085-luks)"
		42
		43	run_test() {
		44	local desc="$1"
		45	echo "=== $desc ==="
		46	local rc=0
		47	( findkey ) \|\| rc=$?
		48	echo "rc=$rc"
		49	}
		50
		51	mkdir -p "$tmpdir/keys"
		52	touch "$tmpdir/keys/target.key"
		53	touch "$tmpdir/keys/other.key"
		54
		55	#
		56	# Regression tests for commit ba53c151:
		57	# When keydev is empty (key-path<TAB><TAB>UUID=...), IFS tab-splitting in bash
		58	# must not collapse consecutive tabs. Otherwise, UUID= is assigned to keydev
		59	# instead of luksdev, leading to an invalid mount attempt and early abort.
		60	#
		61
		62	printf '%s\t\tUUID=%s\n' "$tmpdir/keys/target.key" "$ID_FS_UUID" > "$lukskeys"
		63	run_test "Test 1: Empty keydev with matching luksdev (key-path<TAB><TAB>UUID=...)"
		64
		65	{
66	printf '%s\t\tUUID=%s\n' "$tmpdir/keys/other.key" "other-uuid-9999"
67	printf '%s\t\tUUID=%s\n' "$tmpdir/keys/target.key" "$ID_FS_UUID"
68	} > "$lukskeys"
69	run_test "Test 2: Skip non-matching entry and find matching (empty keydev)"
70
71	printf 'pkcs11:model=test;id=1\t\tUUID=%s\n' "$ID_FS_UUID" > "$lukskeys"
72	run_test "Test 3: PKCS#11 key with empty keydev (filters/lukskeys format)"
73
74	printf '%s\n' "$tmpdir/keys/target.key" > "$lukskeys"
75	run_test "Test 4: Single field (key-path only)"
76
77	mount() {
78	echo "mount: $*" \| sed "s#$tmpdir#<TMPDIR>#g"
79	return 0
80	}
81	mkdir -p "$tmpdir/mnt/custom"
82	touch "$tmpdir/mnt/custom/key.bin"
83	printf 'custom/key.bin\t/dev/sdb1\tUUID=%s\n' "$ID_FS_UUID" > "$lukskeys"
84	run_test "Test 5: All 3 fields (key-path, keydev, luksdev)"
85
86	printf '\t\tUUID=%s\n' "$ID_FS_UUID" > "$lukskeys"
87	run_test "Test 6: Empty keypath error"