tests/test-crypto-block.c

   1 /*
   2  * QEMU Crypto block encryption
   3  *
   4  * Copyright (c) 2016 Red Hat, Inc.
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "crypto/init.h"
  23 #include "crypto/block.h"
  24 #include "qemu/buffer.h"
  25 #include "crypto/secret.h"
  26 #ifndef _WIN32
  27 #include <sys/resource.h>
  28 #endif
  29
  30 #if defined(CONFIG_UUID) && (defined(_WIN32) || defined RUSAGE_THREAD)
  31 #define TEST_LUKS
  32 #else
  33 #undef TEST_LUKS
  34 #endif
  35
  36 static QCryptoBlockCreateOptions qcow_create_opts = {
  37     .format = Q_CRYPTO_BLOCK_FORMAT_QCOW,
  38     .u.qcow = {
  39         .has_key_secret = true,
  40         .key_secret = (char *)"sec0",
  41     },
  42 };
  43
  44 static QCryptoBlockOpenOptions qcow_open_opts = {
  45     .format = Q_CRYPTO_BLOCK_FORMAT_QCOW,
  46     .u.qcow = {
  47         .has_key_secret = true,
  48         .key_secret = (char *)"sec0",
  49     },
  50 };
  51
  52
  53 #ifdef TEST_LUKS
  54 static QCryptoBlockOpenOptions luks_open_opts = {
  55     .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
  56     .u.luks = {
  57         .has_key_secret = true,
  58         .key_secret = (char *)"sec0",
  59     },
  60 };
  61
  62
  63 /* Creation with all default values */
  64 static QCryptoBlockCreateOptions luks_create_opts_default = {
  65     .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
  66     .u.luks = {
  67         .has_key_secret = true,
  68         .key_secret = (char *)"sec0",
  69     },
  70 };
  71
  72
  73 /* ...and with explicit values */
  74 static QCryptoBlockCreateOptions luks_create_opts_aes256_cbc_plain64 = {
  75     .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
  76     .u.luks = {
  77         .has_key_secret = true,
  78         .key_secret = (char *)"sec0",
  79         .has_cipher_alg = true,
  80         .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
  81         .has_cipher_mode = true,
  82         .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
  83         .has_ivgen_alg = true,
  84         .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64,
  85     },
  86 };
  87
  88
  89 static QCryptoBlockCreateOptions luks_create_opts_aes256_cbc_essiv = {
  90     .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
  91     .u.luks = {
  92         .has_key_secret = true,
  93         .key_secret = (char *)"sec0",
  94         .has_cipher_alg = true,
  95         .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
  96         .has_cipher_mode = true,
  97         .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
  98         .has_ivgen_alg = true,
  99         .ivgen_alg = QCRYPTO_IVGEN_ALG_ESSIV,
 100         .has_ivgen_hash_alg = true,
 101         .ivgen_hash_alg = QCRYPTO_HASH_ALG_SHA256,
 102         .has_hash_alg = true,
 103         .hash_alg = QCRYPTO_HASH_ALG_SHA1,
 104     },
 105 };
 106 #endif /* TEST_LUKS */
 107
 108
 109 static struct QCryptoBlockTestData {
 110     const char *path;
 111     QCryptoBlockCreateOptions *create_opts;
 112     QCryptoBlockOpenOptions *open_opts;
 113
 114     bool expect_header;
 115
 116     QCryptoCipherAlgorithm cipher_alg;
 117     QCryptoCipherMode cipher_mode;
 118     QCryptoHashAlgorithm hash_alg;
 119
 120     QCryptoIVGenAlgorithm ivgen_alg;
 121     QCryptoHashAlgorithm ivgen_hash;
 122
 123     bool slow;
 124 } test_data[] = {
 125     {
 126         .path = "/crypto/block/qcow",
 127         .create_opts = &qcow_create_opts,
 128         .open_opts = &qcow_open_opts,
 129
 130         .expect_header = false,
 131
 132         .cipher_alg = QCRYPTO_CIPHER_ALG_AES_128,
 133         .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
 134
 135         .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64,
 136     },
 137 #ifdef TEST_LUKS
 138     {
 139         .path = "/crypto/block/luks/default",
 140         .create_opts = &luks_create_opts_default,
 141         .open_opts = &luks_open_opts,
 142
 143         .expect_header = true,
 144
 145         .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
 146         .cipher_mode = QCRYPTO_CIPHER_MODE_XTS,
 147         .hash_alg = QCRYPTO_HASH_ALG_SHA256,
 148
 149         .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64,
 150
 151         .slow = true,
 152     },
 153     {
 154         .path = "/crypto/block/luks/aes-256-cbc-plain64",
 155         .create_opts = &luks_create_opts_aes256_cbc_plain64,
 156         .open_opts = &luks_open_opts,
 157
 158         .expect_header = true,
 159
 160         .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
 161         .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
 162         .hash_alg = QCRYPTO_HASH_ALG_SHA256,
 163
 164         .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64,
 165
 166         .slow = true,
 167     },
 168     {
 169         .path = "/crypto/block/luks/aes-256-cbc-essiv",
 170         .create_opts = &luks_create_opts_aes256_cbc_essiv,
 171         .open_opts = &luks_open_opts,
 172
 173         .expect_header = true,
 174
 175         .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
 176         .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
 177         .hash_alg = QCRYPTO_HASH_ALG_SHA1,
 178
 179         .ivgen_alg = QCRYPTO_IVGEN_ALG_ESSIV,
 180         .ivgen_hash = QCRYPTO_HASH_ALG_SHA256,
 181
 182         .slow = true,
 183     },
 184 #endif
 185 };
 186
 187
 188 static ssize_t test_block_read_func(QCryptoBlock *block,
 189                                     size_t offset,
 190                                     uint8_t *buf,
 191                                     size_t buflen,
 192                                     Error **errp,
 193                                     void *opaque)
 194 {
 195     Buffer *header = opaque;
 196
 197     g_assert_cmpint(offset + buflen, <=, header->capacity);
 198
 199     memcpy(buf, header->buffer + offset, buflen);
 200
 201     return buflen;
 202 }
 203
 204
 205 static ssize_t test_block_init_func(QCryptoBlock *block,
 206                                     size_t headerlen,
 207                                     Error **errp,
 208                                     void *opaque)
 209 {
 210     Buffer *header = opaque;
 211
 212     g_assert_cmpint(header->capacity, ==, 0);
 213
 214     buffer_reserve(header, headerlen);
 215
 216     return headerlen;
 217 }
 218
 219
 220 static ssize_t test_block_write_func(QCryptoBlock *block,
 221                                      size_t offset,
 222                                      const uint8_t *buf,
 223                                      size_t buflen,
 224                                      Error **errp,
 225                                      void *opaque)
 226 {
 227     Buffer *header = opaque;
 228
 229     g_assert_cmpint(buflen + offset, <=, header->capacity);
 230
 231     memcpy(header->buffer + offset, buf, buflen);
 232     header->offset = offset + buflen;
 233
 234     return buflen;
 235 }
 236
 237
 238 static Object *test_block_secret(void)
 239 {
 240     return object_new_with_props(
 241         TYPE_QCRYPTO_SECRET,
 242         object_get_objects_root(),
 243         "sec0",
 244         &error_abort,
 245         "data", "123456",
 246         NULL);
 247 }
 248
 249 static void test_block_assert_setup(const struct QCryptoBlockTestData *data,
 250                                     QCryptoBlock *blk)
 251 {
 252     QCryptoIVGen *ivgen;
 253     QCryptoCipher *cipher;
 254
 255     ivgen = qcrypto_block_get_ivgen(blk);
 256     cipher = qcrypto_block_get_cipher(blk);
 257
 258     g_assert(ivgen);
 259     g_assert(cipher);
 260
 261     g_assert_cmpint(data->cipher_alg, ==, cipher->alg);
 262     g_assert_cmpint(data->cipher_mode, ==, cipher->mode);
 263     g_assert_cmpint(data->hash_alg, ==,
 264                     qcrypto_block_get_kdf_hash(blk));
 265
 266     g_assert_cmpint(data->ivgen_alg, ==,
 267                     qcrypto_ivgen_get_algorithm(ivgen));
 268     g_assert_cmpint(data->ivgen_hash, ==,
 269                     qcrypto_ivgen_get_hash(ivgen));
 270 }
 271
 272
 273 static void test_block(gconstpointer opaque)
 274 {
 275     const struct QCryptoBlockTestData *data = opaque;
 276     QCryptoBlock *blk;
 277     Buffer header;
 278     Object *sec = test_block_secret();
 279
 280     memset(&header, 0, sizeof(header));
 281     buffer_init(&header, "header");
 282
 283     blk = qcrypto_block_create(data->create_opts,
 284                                test_block_init_func,
 285                                test_block_write_func,
 286                                &header,
 287                                &error_abort);
 288     g_assert(blk);
 289
 290     if (data->expect_header) {
 291         g_assert_cmpint(header.capacity, >, 0);
 292     } else {
 293         g_assert_cmpint(header.capacity, ==, 0);
 294     }
 295
 296     test_block_assert_setup(data, blk);
 297
 298     qcrypto_block_free(blk);
 299     object_unparent(sec);
 300
 301     /* Ensure we can't open without the secret */
 302     blk = qcrypto_block_open(data->open_opts,
 303                              test_block_read_func,
 304                              &header,
 305                              0,
 306                              NULL);
 307     g_assert(blk == NULL);
 308
 309     /* Ensure we can't open without the secret, unless NO_IO */
 310     blk = qcrypto_block_open(data->open_opts,
 311                              test_block_read_func,
 312                              &header,
 313                              QCRYPTO_BLOCK_OPEN_NO_IO,
 314                              &error_abort);
 315
 316     g_assert(qcrypto_block_get_cipher(blk) == NULL);
 317     g_assert(qcrypto_block_get_ivgen(blk) == NULL);
 318
 319     qcrypto_block_free(blk);
 320
 321
 322     /* Now open for real with secret */
 323     sec = test_block_secret();
 324     blk = qcrypto_block_open(data->open_opts,
 325                              test_block_read_func,
 326                              &header,
 327                              0,
 328                              &error_abort);
 329     g_assert(blk);
 330
 331     test_block_assert_setup(data, blk);
 332
 333     qcrypto_block_free(blk);
 334
 335     object_unparent(sec);
 336
 337     buffer_free(&header);
 338 }
 339
 340
 341 int main(int argc, char **argv)
 342 {
 343     gsize i;
 344
 345     module_call_init(MODULE_INIT_QOM);
 346     g_test_init(&argc, &argv, NULL);
 347
 348     g_assert(qcrypto_init(NULL) == 0);
 349
 350     for (i = 0; i < G_N_ELEMENTS(test_data); i++) {
 351         if (test_data[i].open_opts->format == Q_CRYPTO_BLOCK_FORMAT_LUKS &&
 352             !qcrypto_hash_supports(test_data[i].hash_alg)) {
 353             continue;
 354         }
 355         if (!test_data[i].slow ||
 356             g_test_slow()) {
 357             g_test_add_data_func(test_data[i].path, &test_data[i], test_block);
 358         }
 359     }
 360
 361     return g_test_run();
 362 }