From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 27CB1605F9 for ; Fri, 5 Feb 2021 16:37:15 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 22AACB228 for ; Fri, 5 Feb 2021 16:36:45 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [212.186.127.180]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 78F69B21E for ; Fri, 5 Feb 2021 16:36:44 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 45B07461EC for ; Fri, 5 Feb 2021 16:36:44 +0100 (CET) From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= To: pbs-devel@lists.proxmox.com Date: Fri, 5 Feb 2021 16:35:33 +0100 Message-Id: <20210205153535.2578184-9-f.gruenbichler@proxmox.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20210205153535.2578184-1-f.gruenbichler@proxmox.com> References: <20210205153535.2578184-1-f.gruenbichler@proxmox.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.026 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [proxmox-backup-client.rs] Subject: [pbs-devel] [PATCH proxmox-backup 07/10] client: extend tests for master key handling X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Feb 2021 15:37:15 -0000 Signed-off-by: Fabian Grünbichler --- src/bin/proxmox-backup-client.rs | 62 ++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) diff --git a/src/bin/proxmox-backup-client.rs b/src/bin/proxmox-backup-client.rs index b737d9f0..76e82184 100644 --- a/src/bin/proxmox-backup-client.rs +++ b/src/bin/proxmox-backup-client.rs @@ -784,6 +784,9 @@ fn test_crypto_parameters_handling() -> Result<(), Error> { let some_key = Some(vec![1;1]); let default_key = Some(vec![2;1]); + let some_master_key = Some(vec![3;1]); + let default_master_key = Some(vec![4;1]); + let no_key_res = CryptoParams { enc_key: None, master_pubkey: None, @@ -794,6 +797,17 @@ fn test_crypto_parameters_handling() -> Result<(), Error> { master_pubkey: None, mode: CryptMode::Encrypt, }; + let some_key_some_master_res = CryptoParams { + enc_key: some_key.clone(), + master_pubkey: some_master_key.clone(), + mode: CryptMode::Encrypt, + }; + let some_key_default_master_res = CryptoParams { + enc_key: some_key.clone(), + master_pubkey: default_master_key.clone(), + mode: CryptMode::Encrypt, + }; + let some_key_sign_res = CryptoParams { enc_key: some_key.clone(), master_pubkey: None, @@ -812,6 +826,8 @@ fn test_crypto_parameters_handling() -> Result<(), Error> { let keypath = "./tests/keyfile.test"; replace_file(&keypath, some_key.as_ref().unwrap(), CreateOptions::default())?; + let master_keypath = "./tests/masterkeyfile.test"; + replace_file(&master_keypath, some_master_key.as_ref().unwrap(), CreateOptions::default())?; let invalid_keypath = "./tests/invalid_keyfile.test"; // no params, no default key == no key @@ -917,6 +933,52 @@ fn test_crypto_parameters_handling() -> Result<(), Error> { assert!(crypto_parameters(&json!({"keyfile": invalid_keypath, "crypt-mode": "none"})).is_err()); assert!(crypto_parameters(&json!({"keyfile": invalid_keypath, "crypt-mode": "sign-only"})).is_err()); assert!(crypto_parameters(&json!({"keyfile": invalid_keypath, "crypt-mode": "encrypt"})).is_err()); + + // now remove default key again + unsafe { key::set_test_encryption_key(Ok(None)); } + // set a default master key + unsafe { key::set_test_default_master_pubkey(Ok(default_master_key.clone())); } + + // and use an explicit master key + assert!(crypto_parameters(&json!({"master-pubkey-file": master_keypath})).is_err()); + // just a default == no key + let res = crypto_parameters(&json!({})); + assert_eq!(res.unwrap(), no_key_res); + + // keyfile param == key from keyfile + let res = crypto_parameters(&json!({"keyfile": keypath, "master-pubkey-file": master_keypath})); + assert_eq!(res.unwrap(), some_key_some_master_res); + // same with fallback to default master key + let res = crypto_parameters(&json!({"keyfile": keypath})); + assert_eq!(res.unwrap(), some_key_default_master_res); + + // crypt mode none == error + assert!(crypto_parameters(&json!({"crypt-mode": "none", "master-pubkey-file": master_keypath})).is_err()); + // with just default master key == no key + let res = crypto_parameters(&json!({"crypt-mode": "none"})); + assert_eq!(res.unwrap(), no_key_res); + + // crypt mode encrypt without enc key == error + assert!(crypto_parameters(&json!({"crypt-mode": "encrypt", "master-pubkey-file": master_keypath})).is_err()); + assert!(crypto_parameters(&json!({"crypt-mode": "encrypt"})).is_err()); + + // crypt mode none with explicit key == Error + assert!(crypto_parameters(&json!({"crypt-mode": "none", "keyfile": keypath, "master-pubkey-file": master_keypath})).is_err()); + assert!(crypto_parameters(&json!({"crypt-mode": "none", "keyfile": keypath})).is_err()); + + // crypt mode encrypt with keyfile == key from keyfile with correct mode + let res = crypto_parameters(&json!({"crypt-mode": "encrypt", "keyfile": keypath, "master-pubkey-file": master_keypath})); + assert_eq!(res.unwrap(), some_key_some_master_res); + let res = crypto_parameters(&json!({"crypt-mode": "encrypt", "keyfile": keypath})); + assert_eq!(res.unwrap(), some_key_default_master_res); + + // invalid master keyfile parameter always errors when a key is passed, even with a valid + // default master key + assert!(crypto_parameters(&json!({"keyfile": keypath, "master-pubkey-file": invalid_keypath})).is_err()); + assert!(crypto_parameters(&json!({"keyfile": keypath, "master-pubkey-file": invalid_keypath,"crypt-mode": "none"})).is_err()); + assert!(crypto_parameters(&json!({"keyfile": keypath, "master-pubkey-file": invalid_keypath,"crypt-mode": "sign-only"})).is_err()); + assert!(crypto_parameters(&json!({"keyfile": keypath, "master-pubkey-file": invalid_keypath,"crypt-mode": "encrypt"})).is_err()); + Ok(()) } -- 2.20.1