cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

test-crypto-block.c (9996B)

      1/*
      2 * QEMU Crypto block encryption
      3 *
      4 * Copyright (c) 2016 Red Hat, Inc.
      5 *
      6 * This library is free software; you can redistribute it and/or
      7 * modify it under the terms of the GNU Lesser General Public
      8 * License as published by the Free Software Foundation; either
      9 * version 2.1 of the License, or (at your option) any later version.
     10 *
     11 * This library is distributed in the hope that it will be useful,
     12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
     13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     14 * Lesser General Public License for more details.
     15 *
     16 * You should have received a copy of the GNU Lesser General Public
     17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
     18 *
     19 */
     20
     21#include "qemu/osdep.h"
     22#include "qapi/error.h"
     23#include "crypto/init.h"
     24#include "crypto/block.h"
     25#include "qemu/buffer.h"
     26#include "qemu/module.h"
     27#include "crypto/secret.h"
     28#ifndef _WIN32
     29#include <sys/resource.h>
     30#endif
     31
     32#if (defined(_WIN32) || defined RUSAGE_THREAD) && \
     33    (defined(CONFIG_NETTLE) || defined(CONFIG_GCRYPT))
     34#define TEST_LUKS
     35#else
     36#undef TEST_LUKS
     37#endif
     38
     39static QCryptoBlockCreateOptions qcow_create_opts = {
     40    .format = Q_CRYPTO_BLOCK_FORMAT_QCOW,
     41    .u.qcow = {
     42        .has_key_secret = true,
     43        .key_secret = (char *)"sec0",
     44    },
     45};
     46
     47static QCryptoBlockOpenOptions qcow_open_opts = {
     48    .format = Q_CRYPTO_BLOCK_FORMAT_QCOW,
     49    .u.qcow = {
     50        .has_key_secret = true,
     51        .key_secret = (char *)"sec0",
     52    },
     53};
     54
     55
     56#ifdef TEST_LUKS
     57static QCryptoBlockOpenOptions luks_open_opts = {
     58    .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
     59    .u.luks = {
     60        .has_key_secret = true,
     61        .key_secret = (char *)"sec0",
     62    },
     63};
     64
     65
     66/* Creation with all default values */
     67static QCryptoBlockCreateOptions luks_create_opts_default = {
     68    .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
     69    .u.luks = {
     70        .has_key_secret = true,
     71        .key_secret = (char *)"sec0",
     72    },
     73};
     74
     75
     76/* ...and with explicit values */
     77static QCryptoBlockCreateOptions luks_create_opts_aes256_cbc_plain64 = {
     78    .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
     79    .u.luks = {
     80        .has_key_secret = true,
     81        .key_secret = (char *)"sec0",
     82        .has_cipher_alg = true,
     83        .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
     84        .has_cipher_mode = true,
     85        .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
     86        .has_ivgen_alg = true,
     87        .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64,
     88    },
     89};
     90
     91
     92static QCryptoBlockCreateOptions luks_create_opts_aes256_cbc_essiv = {
     93    .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
     94    .u.luks = {
     95        .has_key_secret = true,
     96        .key_secret = (char *)"sec0",
     97        .has_cipher_alg = true,
     98        .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
     99        .has_cipher_mode = true,
    100        .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
    101        .has_ivgen_alg = true,
    102        .ivgen_alg = QCRYPTO_IVGEN_ALG_ESSIV,
    103        .has_ivgen_hash_alg = true,
    104        .ivgen_hash_alg = QCRYPTO_HASH_ALG_SHA256,
    105        .has_hash_alg = true,
    106        .hash_alg = QCRYPTO_HASH_ALG_SHA1,
    107    },
    108};
    109#endif /* TEST_LUKS */
    110
    111
    112static struct QCryptoBlockTestData {
    113    const char *path;
    114    QCryptoBlockCreateOptions *create_opts;
    115    QCryptoBlockOpenOptions *open_opts;
    116
    117    bool expect_header;
    118
    119    QCryptoCipherAlgorithm cipher_alg;
    120    QCryptoCipherMode cipher_mode;
    121    QCryptoHashAlgorithm hash_alg;
    122
    123    QCryptoIVGenAlgorithm ivgen_alg;
    124    QCryptoHashAlgorithm ivgen_hash;
    125
    126    bool slow;
    127} test_data[] = {
    128    {
    129        .path = "/crypto/block/qcow",
    130        .create_opts = &qcow_create_opts,
    131        .open_opts = &qcow_open_opts,
    132
    133        .expect_header = false,
    134
    135        .cipher_alg = QCRYPTO_CIPHER_ALG_AES_128,
    136        .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
    137
    138        .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64,
    139    },
    140#ifdef TEST_LUKS
    141    {
    142        .path = "/crypto/block/luks/default",
    143        .create_opts = &luks_create_opts_default,
    144        .open_opts = &luks_open_opts,
    145
    146        .expect_header = true,
    147
    148        .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
    149        .cipher_mode = QCRYPTO_CIPHER_MODE_XTS,
    150        .hash_alg = QCRYPTO_HASH_ALG_SHA256,
    151
    152        .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64,
    153
    154        .slow = true,
    155    },
    156    {
    157        .path = "/crypto/block/luks/aes-256-cbc-plain64",
    158        .create_opts = &luks_create_opts_aes256_cbc_plain64,
    159        .open_opts = &luks_open_opts,
    160
    161        .expect_header = true,
    162
    163        .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
    164        .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
    165        .hash_alg = QCRYPTO_HASH_ALG_SHA256,
    166
    167        .ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64,
    168
    169        .slow = true,
    170    },
    171    {
    172        .path = "/crypto/block/luks/aes-256-cbc-essiv",
    173        .create_opts = &luks_create_opts_aes256_cbc_essiv,
    174        .open_opts = &luks_open_opts,
    175
    176        .expect_header = true,
    177
    178        .cipher_alg = QCRYPTO_CIPHER_ALG_AES_256,
    179        .cipher_mode = QCRYPTO_CIPHER_MODE_CBC,
    180        .hash_alg = QCRYPTO_HASH_ALG_SHA1,
    181
    182        .ivgen_alg = QCRYPTO_IVGEN_ALG_ESSIV,
    183        .ivgen_hash = QCRYPTO_HASH_ALG_SHA256,
    184
    185        .slow = true,
    186    },
    187#endif
    188};
    189
    190
    191static ssize_t test_block_read_func(QCryptoBlock *block,
    192                                    size_t offset,
    193                                    uint8_t *buf,
    194                                    size_t buflen,
    195                                    void *opaque,
    196                                    Error **errp)
    197{
    198    Buffer *header = opaque;
    199
    200    g_assert_cmpint(offset + buflen, <=, header->capacity);
    201
    202    memcpy(buf, header->buffer + offset, buflen);
    203
    204    return buflen;
    205}
    206
    207
    208static ssize_t test_block_init_func(QCryptoBlock *block,
    209                                    size_t headerlen,
    210                                    void *opaque,
    211                                    Error **errp)
    212{
    213    Buffer *header = opaque;
    214
    215    g_assert_cmpint(header->capacity, ==, 0);
    216
    217    buffer_reserve(header, headerlen);
    218
    219    return headerlen;
    220}
    221
    222
    223static ssize_t test_block_write_func(QCryptoBlock *block,
    224                                     size_t offset,
    225                                     const uint8_t *buf,
    226                                     size_t buflen,
    227                                     void *opaque,
    228                                     Error **errp)
    229{
    230    Buffer *header = opaque;
    231
    232    g_assert_cmpint(buflen + offset, <=, header->capacity);
    233
    234    memcpy(header->buffer + offset, buf, buflen);
    235    header->offset = offset + buflen;
    236
    237    return buflen;
    238}
    239
    240
    241static Object *test_block_secret(void)
    242{
    243    return object_new_with_props(
    244        TYPE_QCRYPTO_SECRET,
    245        object_get_objects_root(),
    246        "sec0",
    247        &error_abort,
    248        "data", "123456",
    249        NULL);
    250}
    251
    252static void test_block_assert_setup(const struct QCryptoBlockTestData *data,
    253                                    QCryptoBlock *blk)
    254{
    255    QCryptoIVGen *ivgen;
    256    QCryptoCipher *cipher;
    257
    258    ivgen = qcrypto_block_get_ivgen(blk);
    259    cipher = qcrypto_block_get_cipher(blk);
    260
    261    g_assert(ivgen);
    262    g_assert(cipher);
    263
    264    g_assert_cmpint(data->cipher_alg, ==, cipher->alg);
    265    g_assert_cmpint(data->cipher_mode, ==, cipher->mode);
    266    g_assert_cmpint(data->hash_alg, ==,
    267                    qcrypto_block_get_kdf_hash(blk));
    268
    269    g_assert_cmpint(data->ivgen_alg, ==,
    270                    qcrypto_ivgen_get_algorithm(ivgen));
    271    g_assert_cmpint(data->ivgen_hash, ==,
    272                    qcrypto_ivgen_get_hash(ivgen));
    273}
    274
    275
    276static void test_block(gconstpointer opaque)
    277{
    278    const struct QCryptoBlockTestData *data = opaque;
    279    QCryptoBlock *blk;
    280    Buffer header;
    281    Object *sec = test_block_secret();
    282
    283    memset(&header, 0, sizeof(header));
    284    buffer_init(&header, "header");
    285
    286    blk = qcrypto_block_create(data->create_opts, NULL,
    287                               test_block_init_func,
    288                               test_block_write_func,
    289                               &header,
    290                               &error_abort);
    291    g_assert(blk);
    292
    293    if (data->expect_header) {
    294        g_assert_cmpint(header.capacity, >, 0);
    295    } else {
    296        g_assert_cmpint(header.capacity, ==, 0);
    297    }
    298
    299    test_block_assert_setup(data, blk);
    300
    301    qcrypto_block_free(blk);
    302    object_unparent(sec);
    303
    304    /* Ensure we can't open without the secret */
    305    blk = qcrypto_block_open(data->open_opts, NULL,
    306                             test_block_read_func,
    307                             &header,
    308                             0,
    309                             1,
    310                             NULL);
    311    g_assert(blk == NULL);
    312
    313    /* Ensure we can't open without the secret, unless NO_IO */
    314    blk = qcrypto_block_open(data->open_opts, NULL,
    315                             test_block_read_func,
    316                             &header,
    317                             QCRYPTO_BLOCK_OPEN_NO_IO,
    318                             1,
    319                             &error_abort);
    320
    321    g_assert(qcrypto_block_get_cipher(blk) == NULL);
    322    g_assert(qcrypto_block_get_ivgen(blk) == NULL);
    323
    324    qcrypto_block_free(blk);
    325
    326
    327    /* Now open for real with secret */
    328    sec = test_block_secret();
    329    blk = qcrypto_block_open(data->open_opts, NULL,
    330                             test_block_read_func,
    331                             &header,
    332                             0,
    333                             1,
    334                             &error_abort);
    335    g_assert(blk);
    336
    337    test_block_assert_setup(data, blk);
    338
    339    qcrypto_block_free(blk);
    340
    341    object_unparent(sec);
    342
    343    buffer_free(&header);
    344}
    345
    346
    347int main(int argc, char **argv)
    348{
    349    gsize i;
    350
    351    module_call_init(MODULE_INIT_QOM);
    352    g_test_init(&argc, &argv, NULL);
    353
    354    g_assert(qcrypto_init(NULL) == 0);
    355
    356    for (i = 0; i < G_N_ELEMENTS(test_data); i++) {
    357        if (test_data[i].open_opts->format == Q_CRYPTO_BLOCK_FORMAT_LUKS &&
    358            !qcrypto_hash_supports(test_data[i].hash_alg)) {
    359            continue;
    360        }
    361        if (!test_data[i].slow ||
    362            g_test_slow()) {
    363            g_test_add_data_func(test_data[i].path, &test_data[i], test_block);
    364        }
    365    }
    366
    367    return g_test_run();
    368}