mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-24 11:34:50 +08:00
fc97590668
Perform several tests to ensure the correct implementation of the bpf_verify_pkcs7_signature() kfunc. Do the tests with data signed with a generated testing key (by using sign-file from scripts/) and with the tcp_bic.ko kernel module if it is found in the system. The test does not fail if tcp_bic.ko is not found. First, perform an unsuccessful signature verification without data. Second, perform a successful signature verification with the session keyring and a new one created for testing. Then, ensure that permission and validation checks are done properly on the keyring provided to bpf_verify_pkcs7_signature(), despite those checks were deferred at the time the keyring was retrieved with bpf_lookup_user_key(). The tests expect to encounter an error if the Search permission is removed from the keyring, or the keyring is expired. Finally, perform a successful and unsuccessful signature verification with the keyrings with pre-determined IDs (the last test fails because the key is not in the platform keyring). The test is currently in the deny list for s390x (JIT does not support calling kernel function). Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Link: https://lore.kernel.org/r/20220920075951.929132-13-roberto.sassu@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
105 lines
2.0 KiB
Bash
Executable File
105 lines
2.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# SPDX-License-Identifier: GPL-2.0
|
|
|
|
set -e
|
|
set -u
|
|
set -o pipefail
|
|
|
|
VERBOSE="${SELFTESTS_VERBOSE:=0}"
|
|
LOG_FILE="$(mktemp /tmp/verify_sig_setup.log.XXXXXX)"
|
|
|
|
x509_genkey_content="\
|
|
[ req ]
|
|
default_bits = 2048
|
|
distinguished_name = req_distinguished_name
|
|
prompt = no
|
|
string_mask = utf8only
|
|
x509_extensions = myexts
|
|
|
|
[ req_distinguished_name ]
|
|
CN = eBPF Signature Verification Testing Key
|
|
|
|
[ myexts ]
|
|
basicConstraints=critical,CA:FALSE
|
|
keyUsage=digitalSignature
|
|
subjectKeyIdentifier=hash
|
|
authorityKeyIdentifier=keyid
|
|
"
|
|
|
|
usage()
|
|
{
|
|
echo "Usage: $0 <setup|cleanup <existing_tmp_dir>"
|
|
exit 1
|
|
}
|
|
|
|
setup()
|
|
{
|
|
local tmp_dir="$1"
|
|
|
|
echo "${x509_genkey_content}" > ${tmp_dir}/x509.genkey
|
|
|
|
openssl req -new -nodes -utf8 -sha256 -days 36500 \
|
|
-batch -x509 -config ${tmp_dir}/x509.genkey \
|
|
-outform PEM -out ${tmp_dir}/signing_key.pem \
|
|
-keyout ${tmp_dir}/signing_key.pem 2>&1
|
|
|
|
openssl x509 -in ${tmp_dir}/signing_key.pem -out \
|
|
${tmp_dir}/signing_key.der -outform der
|
|
|
|
key_id=$(cat ${tmp_dir}/signing_key.der | keyctl padd asymmetric ebpf_testing_key @s)
|
|
|
|
keyring_id=$(keyctl newring ebpf_testing_keyring @s)
|
|
keyctl link $key_id $keyring_id
|
|
}
|
|
|
|
cleanup() {
|
|
local tmp_dir="$1"
|
|
|
|
keyctl unlink $(keyctl search @s asymmetric ebpf_testing_key) @s
|
|
keyctl unlink $(keyctl search @s keyring ebpf_testing_keyring) @s
|
|
rm -rf ${tmp_dir}
|
|
}
|
|
|
|
catch()
|
|
{
|
|
local exit_code="$1"
|
|
local log_file="$2"
|
|
|
|
if [[ "${exit_code}" -ne 0 ]]; then
|
|
cat "${log_file}" >&3
|
|
fi
|
|
|
|
rm -f "${log_file}"
|
|
exit ${exit_code}
|
|
}
|
|
|
|
main()
|
|
{
|
|
[[ $# -ne 2 ]] && usage
|
|
|
|
local action="$1"
|
|
local tmp_dir="$2"
|
|
|
|
[[ ! -d "${tmp_dir}" ]] && echo "Directory ${tmp_dir} doesn't exist" && exit 1
|
|
|
|
if [[ "${action}" == "setup" ]]; then
|
|
setup "${tmp_dir}"
|
|
elif [[ "${action}" == "cleanup" ]]; then
|
|
cleanup "${tmp_dir}"
|
|
else
|
|
echo "Unknown action: ${action}"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
trap 'catch "$?" "${LOG_FILE}"' EXIT
|
|
|
|
if [[ "${VERBOSE}" -eq 0 ]]; then
|
|
# Save the stderr to 3 so that we can output back to
|
|
# it incase of an error.
|
|
exec 3>&2 1>"${LOG_FILE}" 2>&1
|
|
fi
|
|
|
|
main "$@"
|
|
rm -f "${LOG_FILE}"
|