Function "key_store_to_cli" was introduced in commit 310ffe7e507e ("mltools: Add key_store_to_cli", 2021-09-21), and put to use in virt-v2v commit cff4514927b3 ("v2v: Pass --key parameters through to the input helper", 2021-09-21). However, the function has not been in use since virt-v2v commit 724ecb5e887e ("input: Turn helper into an OCaml module", 2021-12-02); remove it now. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1809453 Signed-off-by: Laszlo Ersek <lersek(a)redhat.com&gt; Reviewed-by: Richard W.M. Jones <rjones(a)redhat.com&gt; --- Notes: v2: - pick up Rich's R-b mltools/tools_utils.mli | 8 -------- mltools/tools_utils.ml | 10 ---------- 2 files changed, 18 deletions(-) diff --git a/mltools/tools_utils.mli b/mltools/tools_utils.mli index 501830065038..8d9af7a0a661 100644 --- a/mltools/tools_utils.mli +++ b/mltools/tools_utils.mli @@ -101,18 +101,10 @@ val create_standard_options : Getopt.speclist -> ?anon_fun:Getopt.anon_fun -> ?k which allows another tool to run this tool and change the program name used in error messages. Returns a new {!cmdline_options} structure. *) -val key_store_to_cli : key_store -> string list -(** Convert a {!key_store} object back to a list of command line - options, essentially undoing the effect of Getopt parsing. - This is used in virt-v2v to pass the keystore to helpers. - It is not particularly secure, especially if you use the - [:key:] selector, although not any less secure than passing - them via the command line in the first place. *) - val external_command : ?echo_cmd:bool -> string -> string list (** Run an external command, slurp up the output as a list of lines. [echo_cmd] specifies whether to output the full command on verbose mode, and it's on by default. *) diff --git a/mltools/tools_utils.ml b/mltools/tools_utils.ml index 695fda7e548c..8508534e16ee 100644 --- a/mltools/tools_utils.ml +++ b/mltools/tools_utils.ml @@ -418,20 +418,10 @@ let create_standard_options argspec ?anon_fun ?(key_opts = false) let argspec = !argspec in let getopt = Getopt.create argspec ?anon_fun usage_msg in { getopt; ks; debug_gc } -let key_store_to_cli { keys } = - Hashtbl.fold ( - fun k v acc -> - let arg = - match v with - | KeyString s -> sprintf "%s:key:%s" k s - | KeyFileName f -> sprintf "%s:file:%s" k f in - "--key" :: arg :: acc - ) keys [] - (* Run an external command, slurp up the output as a list of lines. *) let external_command ?(echo_cmd = true) cmd = if echo_cmd then debug "%s" cmd; let chan = Unix.open_process_in cmd in -- 2.19.1.3.g30247aa5d201

Currently, get_keys() returns a NULL-terminated array of (char*) elements. In a later patch in this series, we'll want to change the element type to a structure type, at which point the NULL-termination would become awkward. Replace the NULL-termination scheme with the number-of-elements scheme. No behavioral changes. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1809453 Signed-off-by: Laszlo Ersek <lersek(a)redhat.com&gt; Reviewed-by: Richard W.M. Jones <rjones(a)redhat.com&gt; --- Notes: v2: - pick up Rich's R-b options/options.h | 4 +++- options/decrypt.c | 17 +++++++------- options/keys.c | 24 ++++++++++++++------ 3 files changed, 29 insertions(+), 16 deletions(-) diff --git a/options/options.h b/options/options.h index 80df91a85f98..d7a3aeff6f41 100644 --- a/options/options.h +++ b/options/options.h @@ -149,11 +149,13 @@ extern void inspect_mount_root (guestfs_h *g, const char *root); #define inspect_mount() inspect_mount_handle (g, ks) extern void print_inspect_prompt (void); /* in key.c */ extern char *read_key (const char *param); -extern char **get_keys (struct key_store *ks, const char *device, const char *uuid); +extern char **get_keys (struct key_store *ks, const char *device, const char *uuid, + size_t *nr_matches); +extern void free_keys (char **keys, size_t nr_matches); extern struct key_store *key_store_add_from_selector (struct key_store *ks, const char *selector); extern struct key_store *key_store_import_key (struct key_store *ks, const struct key_store_key *key); extern void free_key_store (struct key_store *ks); /* in options.c */ diff --git a/options/decrypt.c b/options/decrypt.c index 1cd7b627e264..c25b5888d8b4 100644 --- a/options/decrypt.c +++ b/options/decrypt.c @@ -122,14 +122,14 @@ decrypt_mountables (guestfs_h *g, const char * const *mountables, const char *mountable; while ((mountable = *mnt_scan++) != NULL) { CLEANUP_FREE char *type = NULL; CLEANUP_FREE char *uuid = NULL; - CLEANUP_FREE_STRING_LIST char **keys = NULL; + char **keys; + size_t nr_matches; CLEANUP_FREE char *mapname = NULL; - const char * const *key_scan; - const char *key; + size_t scan; type = guestfs_vfs_type (g, mountable); if (type == NULL) continue; @@ -142,37 +142,38 @@ decrypt_mountables (guestfs_h *g, const char * const *mountables, continue; /* Grab the keys that we should try with this device, based on device name, * or UUID (if any). */ - keys = get_keys (ks, mountable, uuid); - assert (keys[0] != NULL); + keys = get_keys (ks, mountable, uuid, &nr_matches); + assert (nr_matches > 0); /* Generate a node name for the plaintext (decrypted) device node. */ if (uuid == NULL || asprintf (&mapname, "luks-%s", uuid) == -1) mapname = make_mapname (mountable); /* Try each key in turn. */ - key_scan = (const char * const *)keys; - while ((key = *key_scan++) != NULL) { + for (scan = 0; scan < nr_matches; ++scan) { + const char *key = keys[scan]; int r; guestfs_push_error_handler (g, NULL, NULL); r = guestfs_cryptsetup_open (g, mountable, key, mapname, -1); guestfs_pop_error_handler (g); if (r == 0) break; } - if (key == NULL) + if (scan == nr_matches) error (EXIT_FAILURE, 0, _("could not find key to open LUKS encrypted %s.\n\n" "Try using --key on the command line.\n\n" "Original error: %s (%d)"), mountable, guestfs_last_error (g), guestfs_last_errno (g)); + free_keys (keys, nr_matches); decrypted_some = true; } return decrypted_some; } diff --git a/options/keys.c b/options/keys.c index 8713372a305e..1d97d980a460 100644 --- a/options/keys.c +++ b/options/keys.c @@ -124,11 +124,12 @@ read_first_line_from_file (const char *filename) /* Return the key(s) matching this particular device from the * keystore. There may be multiple. If none are read from the * keystore, ask the user. */ char ** -get_keys (struct key_store *ks, const char *device, const char *uuid) +get_keys (struct key_store *ks, const char *device, const char *uuid, + size_t *nr_matches) { size_t i, j, nmemb; char **r; char *s; @@ -137,18 +138,16 @@ get_keys (struct key_store *ks, const char *device, const char *uuid) */ nmemb = 1; if (ks && ks->nr_keys > nmemb) nmemb = ks->nr_keys; - /* make room for the terminating NULL */ - if (nmemb == (size_t)-1) + if (nmemb > (size_t)-1 / sizeof *r) error (EXIT_FAILURE, 0, _("size_t overflow")); - nmemb++; - r = calloc (nmemb, sizeof (char *)); + r = malloc (nmemb * sizeof *r); if (r == NULL) - error (EXIT_FAILURE, errno, "calloc"); + error (EXIT_FAILURE, errno, "malloc"); j = 0; if (ks) { for (i = 0; i < ks->nr_keys; ++i) { @@ -175,16 +174,27 @@ get_keys (struct key_store *ks, const char *device, const char *uuid) if (j == 0) { /* Key not found in the key store, ask the user for it. */ s = read_key (device); if (!s) error (EXIT_FAILURE, 0, _("could not read key from user")); - r[0] = s; + r[j++] = s; } + *nr_matches = j; return r; } +void +free_keys (char **keys, size_t nr_matches) +{ + size_t i; + + for (i = 0; i < nr_matches; ++i) + free (keys[i]); + free (keys); +} + struct key_store * key_store_add_from_selector (struct key_store *ks, const char *selector) { CLEANUP_FREE_STRING_LIST char **fields = guestfs_int_split_string (':', selector); -- 2.19.1.3.g30247aa5d201

Extend the "matching_key" structure with a new boolean field, "clevis". "clevis" is mutually exclusive with a non-NULL "passphrase" field. If "clevis" is set, open the LUKS device with guestfs_clevis_luks_unlock() -- which requires no explicit passphrase --; otherwise, continue calling guestfs_cryptsetup_open(). This patch introduces no change in observable behavior; there is no user interface yet for setting the "clevis" field to "true". Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1809453 Signed-off-by: Laszlo Ersek <lersek(a)redhat.com&gt; --- Notes: v2: - check GUESTFS_HAVE_CLEVIS_LUKS_UNLOCK; error out if unavailable [Rich] v1 notes were: This patch introduces a call to guestfs_clevis_luks_unlock(), which is a new libguestfs API (introduced in the sibling libguestfs series). Assuming we still care about building guestfs-tools and virt-v2v against an independent libguestfs (library and appliance), we need to do one of the following things: (1) Make the call dependent on the GUESTFS_HAVE_CLEVIS_LUKS_UNLOCK feature test macro. If it is missing, the library is too old, just set "r = -1", and (possibly) print a warning to stderr. (2) Cut a new libguestfs release, and bump the minimum version in "m4/guestfs-libraries.m4" (in both guestfs-tools and virt-v2v) to the new version. Both of these have drawbacks. Disadvantages of (1): - Printing a raw warning to stderr is OK for the C-language tools, but the code is used by OCaml tools as well, which have pretty-printed warnings. - Simply skipping the guestfs_clevis_luks_unlock() call -- i.e., pretending it fails -- is not user-friendly. In particular, once we add the new selector type for "--key" later in this series, and document it in "options/key-option.pod", all the tools' docs will pick it up at once, even if the library is too old to provide the interface. Disadvantages of (2): - We may not want to leap over a large version distance in "m4/guestfs-libraries.m4" (in both guestfs-tools and virt-v2v), for whatever reason. - Even if we make the guestfs_clevis_luks_unlock() API mandatory in the library, the daemon may not implement it -- it's ultimately appliance (host distro) dependent, which is why the API belongs to a new option group called "clevisluks". That is, the actual behavior of guestfs_clevis_luks_unlock() may still differ from what the user expects based on "options/key-option.pod". This drawback is mitigated however: the documentation of the new selector in "options/key-option.pod" references "ENCRYPTED DISKS" in guestfs(3), which in turn references "guestfs_clevis_luks_unlock", which does highlight the "clevisluks" option group. I vote (2) -- cut a new libguestfs release, then bump the "m4/guestfs-libraries.m4" requirements. I'm not doing that just yet in those projects (in the sibling series here): if I did that, those series would not compile; the libguestfs version number would have to be increased first! And I don't know if we want *something else* in the new libguestfs release, additionally. options/options.h | 6 ++++++ options/decrypt.c | 13 ++++++++++++- options/keys.c | 7 ++++++- 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/options/options.h b/options/options.h index 9bd812525d8a..61a385da13ae 100644 --- a/options/options.h +++ b/options/options.h @@ -136,10 +136,16 @@ struct key_store { /* A key matching a particular ID (pathname of the libguestfs device node that * stands for the encrypted block device, or LUKS UUID). */ struct matching_key { + /* True iff the passphrase should be reconstructed using Clevis, talking to + * Tang servers over the network. + */ + bool clevis; + + /* Explicit passphrase, otherwise. */ char *passphrase; }; /* in config.c */ extern void parse_config (void); diff --git a/options/decrypt.c b/options/decrypt.c index 421a38c2a11f..97c8b88d16aa 100644 --- a/options/decrypt.c +++ b/options/decrypt.c @@ -155,11 +155,22 @@ decrypt_mountables (guestfs_h *g, const char * const *mountables, for (scan = 0; scan < nr_matches; ++scan) { struct matching_key *key = keys + scan; int r; guestfs_push_error_handler (g, NULL, NULL); - r = guestfs_cryptsetup_open (g, mountable, key->passphrase, mapname, -1); + assert (key->clevis == (key->passphrase == NULL)); + if (key->clevis) +#ifdef GUESTFS_HAVE_CLEVIS_LUKS_UNLOCK + r = guestfs_clevis_luks_unlock (g, mountable, mapname); +#else + error (EXIT_FAILURE, 0, + _("'clevis_luks_unlock', needed for decrypting %s, is " + "unavailable in this libguestfs version"), mountable); +#endif + else + r = guestfs_cryptsetup_open (g, mountable, key->passphrase, mapname, + -1); guestfs_pop_error_handler (g); if (r == 0) break; } diff --git a/options/keys.c b/options/keys.c index 56fca17a94b5..75c659561c52 100644 --- a/options/keys.c +++ b/options/keys.c @@ -159,15 +159,17 @@ get_keys (struct key_store *ks, const char *device, const char *uuid, switch (key->type) { case key_string: s = strdup (key->string.s); if (!s) error (EXIT_FAILURE, errno, "strdup"); + match->clevis = false; match->passphrase = s; ++match; break; case key_file: s = read_first_line_from_file (key->file.name); + match->clevis = false; match->passphrase = s; ++match; break; } } @@ -176,10 +178,11 @@ get_keys (struct key_store *ks, const char *device, const char *uuid, if (match == r) { /* Key not found in the key store, ask the user for it. */ s = read_key (device); if (!s) error (EXIT_FAILURE, 0, _("could not read key from user")); + match->clevis = false; match->passphrase = s; ++match; } *nr_matches = (size_t)(match - r); @@ -192,11 +195,13 @@ free_keys (struct matching_key *keys, size_t nr_matches) size_t i; for (i = 0; i < nr_matches; ++i) { struct matching_key *key = keys + i; - free (key->passphrase); + assert (key->clevis == (key->passphrase == NULL)); + if (!key->clevis) + free (key->passphrase); } free (keys); } struct key_store * -- 2.19.1.3.g30247aa5d201

On 06/30/22 18:10, Richard W.M. Jones wrote: That's not the case. This is what I've been trying to express, but I've failed. :( See: $ virt-v2v -on converted --key /dev/sda2:clevis clevis [ 0.0] Setting up the source: -i libvirt clevis [ 1.2] Opening the source virt-v2v: 'clevis_luks_unlock', needed for decrypting /dev/sda2, is unavailable in this libguestfs version This code runs (in virt-v2v, for example) on the following call path: main [v2v/v2v.ml] create_standard_options [common/mltools/tools_utils.ml] Getopt.parse parse_key_selector [common/mltools/tools_utils.ml] List.push_back (* at this point, cmdline_options.ks * has been populated *) convert [convert/convert.ml] (* skipped in virt-v2v, because it * enables networking anyway: *) key_store_requires_network [common/mltools/tools_utils.ml] g#set_network g#launch inspect_decrypt [common/mltools/tools_utils.ml] c_inspect_decrypt [common/mltools/tools_utils.ml] guestfs_int_mllib_inspect_decrypt [common/mltools/tools_utils-c.c] loop over cmdline_options.ks: key_store_import_key [common/options/keys.c] inspect_do_decrypt [common/options/decrypt.c] decrypt_mountables [common/options/decrypt.c] MACRO CHECK HERE guestfs_clevis_luks_unlock free_key_store [common/options/keys.c] This is why I said "it's too late to report this error in decrypt_mountables()"! In comparison, here's how the C tools work (such as virt-cat): main [cat/cat.c] OPTION_key [common/options/options.h] key_store_add_from_selector [common/options/keys.c] key_store_import_key [common/options/keys.c] /* "ks" has been populated */ key_store_requires_network [common/options/keys.c] guestfs_set_network guestfs_launch inspect_mount [common/options/options.h] inspect_mount_handle [common/options/inspect.c] inspect_do_decrypt [common/options/decrypt.c] decrypt_mountables [common/options/decrypt.c] MACRO CHECK HERE guestfs_clevis_luks_unlock free_key_store [common/options/keys.c] Note the following important facts: (1) The macro check is reached, in both kinds of tools, way after the options have been parsed, and quite a bit after the appliance has been launched. (2) The OCaml and C *option parsers* share *nothing* related to keys. Consider: - OCaml does not call key_store_add_from_selector() at all, - while OCaml does call key_store_import_key(), it does so *outside* of option parsing. Namely, "parse_key_selector" records the command line options in an OCaml-only data structure (cmdline_options.ks). That is then translated to an *ephemeral* C-language keystore much later, with key_store_import_key() -- only in guestfs_int_mllib_inspect_decrypt()! That is, after the appliance is running. - Correspondingly: in the C tools, the C-language keystore is freed *after* inspection completes (that is, free_key_store() is called *after* inspect_mount() returns), but in OCaml, the ephemeral keystore is released (correctly) *inside* guestfs_int_mllib_inspect_decrypt() -- that is, internally to the outer function "inspect_decrypt". If we want to catch the lack of GUESTFS_HAVE_CLEVIS_LUKS_UNLOCK during option parsing, then I need to implement a brand new C function, and wrap it for OCaml too (OCaml cannot check the C-language macro GUESTFS_HAVE_CLEVIS_LUKS_UNLOCK). For this: because we already have "key_store_requires_network" (same name, but totally separate impl in C and OCaml), I'd have to rename that function (both impls) to "key_store_contains_clevis", and use it for two purposes: - right after option parsing, if the key store contains clevis, but the feature test macro is missing, bail. - just before launching the appliance, if the key store contains clevis, enable networking. (My previous proposal went one step further: check the "clevisluks" option group too, once the appliance is up and running.) I'm sorry that I've failed to explain this before. I've tried, but it's really complicated. I hope the call trees help! Thanks, Laszlo

From an earlier patch in this series, we can now represent LUKS decryption with Clevis+Tang in those matching keys that we distill for a particular guestfs device or LUKS UUID. Now extend the keystore (composed from command line options), i.e. the store that is filtered into matching keys, with a selector type that stands for Clevis+Tang. Again, this patch introduces no change in observable behavior; there is still no user interface for placing a selector of the new type into the keystore. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1809453 Signed-off-by: Laszlo Ersek <lersek(a)redhat.com&gt; Reviewed-by: Richard W.M. Jones <rjones(a)redhat.com&gt; --- Notes: v2: - fix the "tpe" typo in the patch subject - pick up Rich's R-b options/options.h | 1 + options/keys.c | 8 ++++++++ 2 files changed, 9 insertions(+) diff --git a/options/options.h b/options/options.h index 61a385da13ae..e7a0364cc926 100644 --- a/options/options.h +++ b/options/options.h @@ -113,10 +113,11 @@ struct key_store_key { char *id; enum { key_string, /* key specified as string */ key_file, /* key stored in a file */ + key_clevis, /* key reconstructed with Clevis+Tang */ } type; union { struct { char *s; /* string of the key */ } string; diff --git a/options/keys.c b/options/keys.c index 75c659561c52..7729fe79c99b 100644 --- a/options/keys.c +++ b/options/keys.c @@ -169,10 +169,15 @@ get_keys (struct key_store *ks, const char *device, const char *uuid, s = read_first_line_from_file (key->file.name); match->clevis = false; match->passphrase = s; ++match; break; + case key_clevis: + match->clevis = true; + match->passphrase = NULL; + ++match; + break; } } } if (match == r) { @@ -289,9 +294,12 @@ free_key_store (struct key_store *ks) free (key->string.s); break; case key_file: free (key->file.name); break; + case key_clevis: + /* nothing */ + break; } free (key->id); } } -- 2.19.1.3.g30247aa5d201

If the "default" label is taken in guestfs_int_mllib_inspect_decrypt(), that means the C code and the OCaml code disagree on the data constructors of the "key_store_key" OCaml type. Such internal errors are best reported with abort() -- not entirely unlike a failed assertion. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1809453 Suggested-by: Richard W.M. Jones <rjones(a)redhat.com&gt; Signed-off-by: Laszlo Ersek <lersek(a)redhat.com&gt; --- Notes: v2: - new patch [Rich] mltools/tools_utils-c.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/mltools/tools_utils-c.c b/mltools/tools_utils-c.c index 081466776666..c703998d4838 100644 --- a/mltools/tools_utils-c.c +++ b/mltools/tools_utils-c.c @@ -74,13 +74,11 @@ guestfs_int_mllib_inspect_decrypt (value gv, value gpv, value keysv) key.file.name = strdup (String_val (Field (v, 0))); if (!key.file.name) caml_raise_out_of_memory (); break; default: - error (EXIT_FAILURE, 0, - "internal error: unhandled Tag_val (v) = %d", - Tag_val (v)); + abort (); } ks = key_store_import_key (ks, &key); keysv = Field (keysv, 1); -- 2.19.1.3.g30247aa5d201

In another patch in this series, we generalize the "--key" selector parsing for C-language utilities. Adapt the OCaml-language "--key" parser: - Incorporate the new (more informative) error messages for consistency. - Prepare for selector types that do not take any type-specific parameters. These will be represented with constant constructors of the "key_store_key" type, and such values are not blocks, but unboxed integers: <https://v2.ocaml.org/manual/intfc.html#ss:c-concrete-datatypes>;. (This patch is best shown with "git show -b" for review.) Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1809453 Signed-off-by: Laszlo Ersek <lersek(a)redhat.com&gt; --- Notes: v2: - fix typo in commit message (s/langauge/language/) [Rich] - handle internal type error with abort() [Rich] mltools/tools_utils.ml | 14 ++++++-- mltools/tools_utils-c.c | 38 +++++++++++--------- 2 files changed, 34 insertions(+), 18 deletions(-) diff --git a/mltools/tools_utils.ml b/mltools/tools_utils.ml index 6006ab7e4f6c..e534cbead47a 100644 --- a/mltools/tools_utils.ml +++ b/mltools/tools_utils.ml @@ -390,18 +390,28 @@ let create_standard_options argspec ?anon_fun ?(key_opts = false) L"colour"; L"colours" ], Getopt.Unit set_colours, s_"Use ANSI colour sequences even if not tty"); add_argspec ([ L"wrap" ], Getopt.Unit set_wrap, s_"Wrap log messages even if not tty"); if key_opts then ( let parse_key_selector arg = - let parts = String.nsplit ~max:3 ":" arg in + let parts = String.nsplit ":" arg in match parts with + | [] -> + error (f_"selector '%s': missing ID") arg + | [ _ ] -> + error (f_"selector '%s': missing TYPE") arg + | [ _; "key" ] + | _ :: "key" :: _ :: _ :: _ -> + error (f_"selector '%s': missing KEY_STRING, or too many fields") arg | [ device; "key"; key ] -> List.push_back ks.keys (device, KeyString key) + | [ _; "file" ] + | _ :: "file" :: _ :: _ :: _ -> + error (f_"selector '%s': missing FILENAME, or too many fields") arg | [ device; "file"; file ] -> List.push_back ks.keys (device, KeyFileName file) | _ -> - error (f_"invalid selector string for --key: %s") arg + error (f_"selector '%s': invalid TYPE") arg in add_argspec ([ L"echo-keys" ], Getopt.Unit c_set_echo_keys, s_"Don’t turn off echo for passphrases"); add_argspec ([ L"keys-from-stdin" ], Getopt.Unit c_set_keys_from_stdin, s_"Read passphrases from stdin"); add_argspec ([ L"key" ], Getopt.String (s_"SELECTOR", parse_key_selector), s_"Specify a LUKS key"); diff --git a/mltools/tools_utils-c.c b/mltools/tools_utils-c.c index c703998d4838..d22a5e65b0c2 100644 --- a/mltools/tools_utils-c.c +++ b/mltools/tools_utils-c.c @@ -60,26 +60,32 @@ guestfs_int_mllib_inspect_decrypt (value gv, value gpv, value keysv) key.id = strdup (String_val (Field (elemv, 0))); if (!key.id) caml_raise_out_of_memory (); v = Field (elemv, 1); - switch (Tag_val (v)) { - case 0: /* KeyString of string */ - key.type = key_string; - key.string.s = strdup (String_val (Field (v, 0))); - if (!key.string.s) - caml_raise_out_of_memory (); - break; - case 1: /* KeyFileName of string */ - key.type = key_file; - key.file.name = strdup (String_val (Field (v, 0))); - if (!key.file.name) - caml_raise_out_of_memory (); - break; - default: - abort (); - } + if (Is_block (v)) + switch (Tag_val (v)) { + case 0: /* KeyString of string */ + key.type = key_string; + key.string.s = strdup (String_val (Field (v, 0))); + if (!key.string.s) + caml_raise_out_of_memory (); + break; + case 1: /* KeyFileName of string */ + key.type = key_file; + key.file.name = strdup (String_val (Field (v, 0))); + if (!key.file.name) + caml_raise_out_of_memory (); + break; + default: + abort (); + } + else + switch (Int_val (v)) { + default: + abort (); + } ks = key_store_import_key (ks, &key); keysv = Field (keysv, 1); } -- 2.19.1.3.g30247aa5d201

Provide the user interface (in both the C and the OCaml tools) for selecting network-based, passphrase-less decryption. This is the front-end exposing the previously added back-end. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1809453 Signed-off-by: Laszlo Ersek <lersek(a)redhat.com&gt; Reviewed-by: Richard W.M. Jones <rjones(a)redhat.com&gt; --- Notes: v2: - pick up Rich's R-b mltools/tools_utils.ml | 5 +++++ mltools/tools_utils-c.c | 3 +++ options/keys.c | 4 ++++ options/key-option.pod | 6 ++++++ 4 files changed, 18 insertions(+) diff --git a/mltools/tools_utils.ml b/mltools/tools_utils.ml index e534cbead47a..1da5850340d4 100644 --- a/mltools/tools_utils.ml +++ b/mltools/tools_utils.ml @@ -32,10 +32,11 @@ type key_store = { keys : (string * key_store_key) list ref; } and key_store_key = | KeyString of string | KeyFileName of string + | KeyClevis external c_inspect_decrypt : Guestfs.t -> int64 -> (string * key_store_key) list -> unit = "guestfs_int_mllib_inspect_decrypt" external c_set_echo_keys : unit -> unit = "guestfs_int_mllib_set_echo_keys" [@@noalloc] external c_set_keys_from_stdin : unit -> unit = "guestfs_int_mllib_set_keys_from_stdin" [@@noalloc] external c_rfc3339_date_time_string : unit -> string = "guestfs_int_mllib_rfc3339_date_time_string" @@ -406,10 +407,14 @@ let create_standard_options argspec ?anon_fun ?(key_opts = false) | [ _; "file" ] | _ :: "file" :: _ :: _ :: _ -> error (f_"selector '%s': missing FILENAME, or too many fields") arg | [ device; "file"; file ] -> List.push_back ks.keys (device, KeyFileName file) + | _ :: "clevis" :: _ :: _ -> + error (f_"selector '%s': too many fields") arg + | [ device; "clevis" ] -> + List.push_back ks.keys (device, KeyClevis) | _ -> error (f_"selector '%s': invalid TYPE") arg in add_argspec ([ L"echo-keys" ], Getopt.Unit c_set_echo_keys, s_"Don’t turn off echo for passphrases"); diff --git a/mltools/tools_utils-c.c b/mltools/tools_utils-c.c index d22a5e65b0c2..4ff42e5d5f7f 100644 --- a/mltools/tools_utils-c.c +++ b/mltools/tools_utils-c.c @@ -79,10 +79,13 @@ guestfs_int_mllib_inspect_decrypt (value gv, value gpv, value keysv) default: abort (); } else switch (Int_val (v)) { + case 0: /* KeyClevis */ + key.type = key_clevis; + break; default: abort (); } ks = key_store_import_key (ks, &key); diff --git a/options/keys.c b/options/keys.c index 37e1648fc969..e7c550f4796b 100644 --- a/options/keys.c +++ b/options/keys.c @@ -248,10 +248,14 @@ key_store_add_from_selector (struct key_store *ks, const char *selector) _("selector '%s': missing FILENAME, or too many fields"), selector); key.file.name = strdup (fields[2]); if (!key.file.name) error (EXIT_FAILURE, errno, "strdup"); + } else if (STREQ (fields[1], "clevis")) { + key.type = key_clevis; + if (field_count != 2) + error (EXIT_FAILURE, 0, _("selector '%s': too many fields"), selector); } else error (EXIT_FAILURE, 0, _("selector '%s': invalid TYPE"), selector); return key_store_import_key (ks, &key); } diff --git a/options/key-option.pod b/options/key-option.pod index 90a3b15c57a2..34229ce9cbb2 100644 --- a/options/key-option.pod +++ b/options/key-option.pod @@ -12,6 +12,12 @@ Use the specified C<KEY_STRING> as passphrase. =item B<--key> C<ID>:file:FILENAME Read the passphrase from F<FILENAME>. +=item B<--key> C<ID>:clevis + +Attempt passphrase-less unlocking for C<ID> with Clevis, over the +network. Please refer to L<guestfs(3)/ENCRYPTED DISKS> for more +information on network-bound disk encryption (NBDE). + =back -- 2.19.1.3.g30247aa5d201