[RFC][PATCH 10/10] selftests/bpf: Prepare a test for user asymmetric key signatures
Roberto Sassu
roberto.sassu at huaweicloud.com
Thu Jul 6 14:42:23 UTC 2023
From: Roberto Sassu <roberto.sassu at huawei.com>
Reuse the existing test for PKCS#7 signatures, to test also user asymmetric
key signatures.
Run the new test only if gpg supports the new command --conv-kernel.
Signed-off-by: Roberto Sassu <roberto.sassu at huawei.com>
---
...y_pkcs7_sig.c => verify_pkcs7_uasym_sig.c} | 159 +++++++++++++++---
...s7_sig.c => test_verify_pkcs7_uasym_sig.c} | 18 +-
.../testing/selftests/bpf/verify_sig_setup.sh | 82 ++++++++-
3 files changed, 226 insertions(+), 33 deletions(-)
rename tools/testing/selftests/bpf/prog_tests/{verify_pkcs7_sig.c => verify_pkcs7_uasym_sig.c} (69%)
rename tools/testing/selftests/bpf/progs/{test_verify_pkcs7_sig.c => test_verify_pkcs7_uasym_sig.c} (82%)
diff --git a/tools/testing/selftests/bpf/prog_tests/verify_pkcs7_sig.c b/tools/testing/selftests/bpf/prog_tests/verify_pkcs7_uasym_sig.c
similarity index 69%
rename from tools/testing/selftests/bpf/prog_tests/verify_pkcs7_sig.c
rename to tools/testing/selftests/bpf/prog_tests/verify_pkcs7_uasym_sig.c
index dd7f2bc7004..89664351d98 100644
--- a/tools/testing/selftests/bpf/prog_tests/verify_pkcs7_sig.c
+++ b/tools/testing/selftests/bpf/prog_tests/verify_pkcs7_uasym_sig.c
@@ -18,7 +18,7 @@
#include <linux/keyctl.h>
#include <test_progs.h>
-#include "test_verify_pkcs7_sig.skel.h"
+#include "test_verify_pkcs7_uasym_sig.skel.h"
#define MAX_DATA_SIZE (1024 * 1024)
#define MAX_SIG_SIZE 1024
@@ -29,6 +29,24 @@
/* In stripped ARM and x86-64 modules, ~ is surprisingly rare. */
#define MODULE_SIG_STRING "~Module signature appended~\n"
+#define PKEY_ID_PGP 0
+#define PKEY_ID_X509 1
+#define PKEY_ID_PKCS7 2
+
+static char *key_types_str[PKEY_ID_PKCS7 + 1] = {
+ [PKEY_ID_PGP] = "pgp",
+ [PKEY_ID_X509] = "x509",
+ [PKEY_ID_PKCS7] = "pkcs7",
+};
+
+enum algos { ALGO_RSA, ALGO_ECDSA_P256, ALGO_ECDSA_P384, ALGO__LAST };
+
+static char *algos_str[ALGO_ECDSA_P384 + 1] = {
+ [ALGO_RSA] = "rsa",
+ [ALGO_ECDSA_P256] = "ecdsa_p256",
+ [ALGO_ECDSA_P384] = "ecdsa_p384",
+};
+
/*
* Module signature information block.
*
@@ -74,13 +92,15 @@ static int libbpf_print_cb(enum libbpf_print_level level, const char *fmt,
return 0;
}
-static int _run_setup_process(const char *setup_dir, const char *cmd)
+static int _run_setup_process(const char *setup_dir, const char *cmd,
+ __u8 key_type, __u8 pkey_algo)
{
int child_pid, child_status;
child_pid = fork();
if (child_pid == 0) {
- execlp("./verify_sig_setup.sh", "./verify_sig_setup.sh", cmd,
+ execlp("./verify_sig_setup.sh", "./verify_sig_setup.sh",
+ cmd, key_types_str[key_type], algos_str[pkey_algo] ?: "",
setup_dir, NULL);
exit(errno);
@@ -92,11 +112,13 @@ static int _run_setup_process(const char *setup_dir, const char *cmd)
return -EINVAL;
}
-static int populate_data_item_str(const char *tmp_dir, struct data *data_item)
+static int populate_data_item_str(const char *tmp_dir, __u8 key_type,
+ struct data *data_item)
{
struct stat st;
char data_template[] = "/tmp/dataXXXXXX";
char path[PATH_MAX];
+ char path_out[PATH_MAX];
int ret, fd, child_status, child_pid;
data_item->data_len = 4;
@@ -123,10 +145,26 @@ static int populate_data_item_str(const char *tmp_dir, struct data *data_item)
}
if (child_pid == 0) {
- snprintf(path, sizeof(path), "%s/signing_key.pem", tmp_dir);
-
- return execlp("./sign-file", "./sign-file", "-d", "sha256",
- path, path, data_template, NULL);
+ if (key_type == PKEY_ID_PKCS7) {
+ snprintf(path, sizeof(path), "%s/signing_key.pem",
+ tmp_dir);
+
+ return execlp("./sign-file", "./sign-file", "-d",
+ "sha256", path, path, data_template,
+ NULL);
+ } else {
+ snprintf(path, sizeof(path), "%s.gpg", data_template);
+
+ return execlp("gpg", "gpg", "--no-options",
+ "--no-auto-check-trustdb",
+ "--no-permission-warning",
+ "--default-key", "eBPF_UASYM_Test",
+ "--sign", "-o", path, "--batch", "--yes",
+ "--compress-algo=none", "-b",
+ "--passphrase", "abc",
+ "--pinentry-mode", "loopback", "-q",
+ data_template, NULL);
+ }
}
waitpid(child_pid, &child_status, 0);
@@ -135,7 +173,35 @@ static int populate_data_item_str(const char *tmp_dir, struct data *data_item)
if (ret)
goto out;
- snprintf(path, sizeof(path), "%s.p7s", data_template);
+ if (key_type != PKEY_ID_PKCS7) {
+ child_pid = fork();
+
+ if (child_pid == -1) {
+ ret = -errno;
+ goto out;
+ }
+
+ if (child_pid == 0) {
+ snprintf(path, sizeof(path), "%s.gpg", data_template);
+ snprintf(path_out, sizeof(path), "%s.kernel",
+ data_template);
+
+ return execlp("gpg", "gpg", "--no-keyring",
+ "--conv-kernel", "-o", path_out, path,
+ NULL);
+ }
+
+ waitpid(child_pid, &child_status, 0);
+
+ ret = WEXITSTATUS(child_status);
+ if (ret)
+ goto out;
+ }
+
+ if (key_type == PKEY_ID_PKCS7)
+ snprintf(path, sizeof(path), "%s.p7s", data_template);
+ else
+ snprintf(path, sizeof(path), "%s.kernel", data_template);
ret = stat(path, &st);
if (ret == -1) {
@@ -254,12 +320,12 @@ static int populate_data_item_mod(struct data *data_item)
return ret;
}
-void test_verify_pkcs7_sig(void)
+static void test_verify_pkcs7_uasym_sig(__u8 key_type, __u8 pkey_algo)
{
libbpf_print_fn_t old_print_cb;
char tmp_dir_template[] = "/tmp/verify_sigXXXXXX";
char *tmp_dir;
- struct test_verify_pkcs7_sig *skel = NULL;
+ struct test_verify_pkcs7_uasym_sig *skel = NULL;
struct bpf_map *map;
struct data data;
int ret, zero = 0;
@@ -272,37 +338,38 @@ void test_verify_pkcs7_sig(void)
if (!ASSERT_OK_PTR(tmp_dir, "mkdtemp"))
return;
- ret = _run_setup_process(tmp_dir, "setup");
+ ret = _run_setup_process(tmp_dir, "setup", key_type, pkey_algo);
if (!ASSERT_OK(ret, "_run_setup_process"))
goto close_prog;
- skel = test_verify_pkcs7_sig__open();
- if (!ASSERT_OK_PTR(skel, "test_verify_pkcs7_sig__open"))
+ skel = test_verify_pkcs7_uasym_sig__open();
+ if (!ASSERT_OK_PTR(skel, "test_verify_pkcs7_uasym_sig__open"))
goto close_prog;
old_print_cb = libbpf_set_print(libbpf_print_cb);
- ret = test_verify_pkcs7_sig__load(skel);
+ ret = test_verify_pkcs7_uasym_sig__load(skel);
libbpf_set_print(old_print_cb);
if (ret < 0 && kfunc_not_supported) {
printf(
- "%s:SKIP:bpf_verify_pkcs7_signature() kfunc not supported\n",
+ "%s:SKIP:bpf_verify_*_signature() kfunc not supported\n",
__func__);
test__skip();
goto close_prog;
}
- if (!ASSERT_OK(ret, "test_verify_pkcs7_sig__load"))
+ if (!ASSERT_OK(ret, "test_verify_pkcs7_uasym_sig__load"))
goto close_prog;
- ret = test_verify_pkcs7_sig__attach(skel);
- if (!ASSERT_OK(ret, "test_verify_pkcs7_sig__attach"))
+ ret = test_verify_pkcs7_uasym_sig__attach(skel);
+ if (!ASSERT_OK(ret, "test_verify_pkcs7_uasym_sig__attach"))
goto close_prog;
map = bpf_object__find_map_by_name(skel->obj, "data_input");
if (!ASSERT_OK_PTR(map, "data_input not found"))
goto close_prog;
+ skel->bss->key_type = key_type;
skel->bss->monitored_pid = getpid();
/* Test without data and signature. */
@@ -313,7 +380,7 @@ void test_verify_pkcs7_sig(void)
goto close_prog;
/* Test successful signature verification with session keyring. */
- ret = populate_data_item_str(tmp_dir, &data);
+ ret = populate_data_item_str(tmp_dir, key_type, &data);
if (!ASSERT_OK(ret, "populate_data_item_str"))
goto close_prog;
@@ -363,9 +430,13 @@ void test_verify_pkcs7_sig(void)
if (!ASSERT_LT(ret, 0, "bpf_map_update_elem data_input"))
goto close_prog;
- ret = populate_data_item_mod(&data);
- if (!ASSERT_OK(ret, "populate_data_item_mod"))
- goto close_prog;
+ data.data_len = 0;
+
+ if (key_type == PKEY_ID_PKCS7) {
+ ret = populate_data_item_mod(&data);
+ if (!ASSERT_OK(ret, "populate_data_item_mod"))
+ goto close_prog;
+ }
/* Test signature verification with system keyrings. */
if (data.data_len) {
@@ -392,11 +463,49 @@ void test_verify_pkcs7_sig(void)
}
close_prog:
- _run_setup_process(tmp_dir, "cleanup");
+ _run_setup_process(tmp_dir, "cleanup", key_type, pkey_algo);
if (!skel)
return;
skel->bss->monitored_pid = 0;
- test_verify_pkcs7_sig__destroy(skel);
+ test_verify_pkcs7_uasym_sig__destroy(skel);
+}
+
+static bool gpg_conv_kernel_supported(void)
+{
+ bool supported = false;
+ char line[1024];
+ FILE *fp;
+
+ fp = popen("gpg --conv-kernel /dev/null 2>&1", "r");
+ if (!fp)
+ return false;
+
+ while (fgets(line, sizeof(line), fp)) {
+ if (strstr(line, "gpg: processing message failed: Unknown system error")) {
+ supported = true;
+ break;
+ }
+ }
+
+ pclose(fp);
+ return supported;
+}
+
+void test_verify_pkcs7_sig(void)
+{
+ test_verify_pkcs7_uasym_sig(PKEY_ID_PKCS7, ALGO__LAST);
+}
+
+void test_verify_uasym_sig(void)
+{
+ int i;
+
+ /* This test requires support for the new gpg command --conv-kernel. */
+ if (!gpg_conv_kernel_supported())
+ return;
+
+ for (i = 0; i < ALGO__LAST; i++)
+ test_verify_pkcs7_uasym_sig(PKEY_ID_PGP, i);
}
diff --git a/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c b/tools/testing/selftests/bpf/progs/test_verify_pkcs7_uasym_sig.c
similarity index 82%
rename from tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c
rename to tools/testing/selftests/bpf/progs/test_verify_pkcs7_uasym_sig.c
index 7748cc23de8..f25a023b5bb 100644
--- a/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c
+++ b/tools/testing/selftests/bpf/progs/test_verify_pkcs7_uasym_sig.c
@@ -20,10 +20,14 @@ extern void bpf_key_put(struct bpf_key *key) __ksym;
extern int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_ptr,
struct bpf_dynptr *sig_ptr,
struct bpf_key *trusted_keyring) __ksym;
+extern int bpf_verify_uasym_signature(struct bpf_dynptr *data_ptr,
+ struct bpf_dynptr *sig_ptr,
+ struct bpf_key *trusted_keyring) __ksym;
__u32 monitored_pid;
__u32 user_keyring_serial;
__u64 system_keyring_id;
+__u8 key_type;
struct data {
__u8 data[MAX_DATA_SIZE];
@@ -86,7 +90,19 @@ int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size)
if (!trusted_keyring)
return -ENOENT;
- ret = bpf_verify_pkcs7_signature(&data_ptr, &sig_ptr, trusted_keyring);
+ switch (key_type) {
+ case PKEY_ID_PKCS7:
+ ret = bpf_verify_pkcs7_signature(&data_ptr, &sig_ptr,
+ trusted_keyring);
+ break;
+ case PKEY_ID_PGP:
+ ret = bpf_verify_uasym_signature(&data_ptr, &sig_ptr,
+ trusted_keyring);
+ break;
+ default:
+ ret = -EOPNOTSUPP;
+ break;
+ }
bpf_key_put(trusted_keyring);
diff --git a/tools/testing/selftests/bpf/verify_sig_setup.sh b/tools/testing/selftests/bpf/verify_sig_setup.sh
index ba08922b4a2..90770ae9e12 100755
--- a/tools/testing/selftests/bpf/verify_sig_setup.sh
+++ b/tools/testing/selftests/bpf/verify_sig_setup.sh
@@ -26,13 +26,39 @@ subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid
"
+gpg_genkey_content_common="\
+ Name-Real: eBPF_UASYM_Test
+ Name-Comment: eBPF_UASYM_Test
+ Name-Email: ebpf_uasym_test at localhost
+ Expire-Date: 0
+ Passphrase: abc
+ %commit
+"
+gpg_genkey_content_rsa="\
+ Key-Type: RSA
+ Key-Length: 4096
+ $gpg_genkey_content_common
+"
+
+gpg_genkey_content_ecdsa_p256="\
+ Key-Type: ECDSA
+ Key-Curve: NIST P-256
+ $gpg_genkey_content_common
+"
+
+gpg_genkey_content_ecdsa_p384="\
+ Key-Type: ECDSA
+ Key-Curve: NIST P-384
+ $gpg_genkey_content_common
+"
+
usage()
{
- echo "Usage: $0 <setup|cleanup <existing_tmp_dir>"
+ echo "Usage: $0 <setup|cleanup> <key type> <existing_tmp_dir>"
exit 1
}
-setup()
+setup_pkcs7()
{
local tmp_dir="$1"
@@ -52,11 +78,37 @@ setup()
keyctl link $key_id $keyring_id
}
-cleanup() {
+setup_pgp()
+{
+ local tmp_dir="$1"
+ local varname="gpg_genkey_content_$2"
+
+ modprobe ecdsa_generic
+
+ echo "${!varname}" > ${tmp_dir}/gpg.genkey
+ gpg --batch --generate-key ${tmp_dir}/gpg.genkey
+
+ key_id=$(gpg --export eBPF_UASYM_Test | gpg --conv-kernel | keyctl padd asymmetric ebpf_testing_key @s)
+ keyring_id=$(keyctl newring ebpf_testing_keyring @s)
+ keyctl link $key_id $keyring_id
+}
+
+cleanup_pkcs7() {
+ local tmp_dir="$1"
+
+ keyctl unlink $(keyctl search @s asymmetric ebpf_testing_key) @s
+ keyctl unlink $(keyctl search @s keyring ebpf_testing_keyring) @s
+ rm -rf ${tmp_dir}
+}
+
+cleanup_pgp() {
local tmp_dir="$1"
keyctl unlink $(keyctl search @s asymmetric ebpf_testing_key) @s
keyctl unlink $(keyctl search @s keyring ebpf_testing_keyring) @s
+ key_fingerprint=$(gpg --fingerprint --with-colons eBPF_UASYM_Test | awk -F ":" '$1 == "fpr" {print $(NF-1)}')
+ gpg --delete-secret-key --batch --yes $key_fingerprint
+ gpg --delete-key --batch --yes $key_fingerprint
rm -rf ${tmp_dir}
}
@@ -75,17 +127,33 @@ catch()
main()
{
- [[ $# -ne 2 ]] && usage
+ [[ $# -ne 4 ]] && usage
local action="$1"
- local tmp_dir="$2"
+ local key_type="$2"
+ local key_algo="$3"
+ local tmp_dir="$4"
[[ ! -d "${tmp_dir}" ]] && echo "Directory ${tmp_dir} doesn't exist" && exit 1
if [[ "${action}" == "setup" ]]; then
- setup "${tmp_dir}"
+ if [[ "${key_type}" == "pkcs7" ]]; then
+ setup_pkcs7 "${tmp_dir}"
+ elif [[ "${key_type}" == "pgp" ]]; then
+ setup_pgp "${tmp_dir}" "${key_algo}"
+ else
+ echo "Unknown key type: ${key_type}"
+ exit 1
+ fi
elif [[ "${action}" == "cleanup" ]]; then
- cleanup "${tmp_dir}"
+ if [[ "${key_type}" == "pkcs7" ]]; then
+ cleanup_pkcs7 "${tmp_dir}"
+ elif [[ "${key_type}" == "pgp" ]]; then
+ cleanup_pgp "${tmp_dir}"
+ else
+ echo "Unknown key type: ${key_type}"
+ exit 1
+ fi
else
echo "Unknown action: ${action}"
exit 1
--
2.34.1
More information about the Linux-security-module-archive
mailing list