ima-evm-utils: Add some tests for evmctl

Run `make check' to execute the tests.
Currently only ima_hash, (evm) sign, (evm) verify, ima_sign, and ima_verify are tested.

---
Changelog since v6:
- ima_hash.test: Compare generated hashes with known values.
I found that on power8 qemu with default -cpu calculates hashes wrongly. For exmaple: `openssl dgst -sha224 -hex /dev/null' results in 83b2514951547ee00c7062fa3eb42079ff19f280ec81eedbdb0e3997 instead of d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f.
- Make _keyid' use temporary files to not rely on presence of /des/stdout'.
- evm sign: add `--generation 0' option.
I found that on overlay fs (with ext4 over 9p) FS_IOC_GETVERSION does not work.
- gen-keys.sh: allows `force' argument to regenerate all test keys.

Changelog since v5:
- Fix tests if gost-engine is not present. Thx to Mimi Zohar for testing on Xenial.

Changelog since v4:
- Fix bugs found by Mimi Zohar:
- Fix typos in variable names
- Fix `-out -' in asn1parse for openssl 1.0.x

Changelog since v3:
- Apply changes based on some suggestions from Petr Vorel, such as
- Add .gitignore
- Do not color output if stdout is not tty.
- Fix blkid error with --uuid option.
- Remove or change some comments
- Replace ENGINE with EVMCTL_ENGINE and OPENSSL_ENGINE.
- All tests pass over next branch.

Changelog since v2:
- ima_sign.test and ima_verify.test merged into sign_verify.test which is also able to test evm signatures.
- Apply Mimi Zohar suggestions regarding commenting, variable renaming, code rearranging, etc. with intent to simplify the code and review.

Changelog since v1:
- Apply suggestions by Petr Vorel:
- Rename function names and variables to be more understandable.
- Rename tests/functions to tests/functions.sh.
- Define exit codes (77, 99, ...) as variables.
- Added more comments and remove single letter variables (for Mimi Zohar).
- Move getfattr check into function.
- Move evmctl run and check into single function.
- Add sign/verify tests for v1 signatures.
- Minor improvements.
- Since I still edit all 5 files I did not split the patch into multiple commits to separate the files, otherwise editing will become too complicated, as I ought to continuously rebase and edit different commits. This was really non-productive suggestion.

 .gitignore             |   2 +-
 Makefile.am            |   2 +-
 configure.ac           |   1 +
 tests/.gitignore       |  16 +++
 tests/Makefile.am      |  12 ++
 tests/functions.sh     | 272 ++++++++++++++++++++++++++++++++++++
 tests/gen-keys.sh      |  97 +++++++++++++
 tests/ima_hash.test    |  80 +++++++++++
 tests/sign_verify.test | 366 +++++++++++++++++++++++++++++++++++++++++++++++++
 9 files changed, 846 insertions(+), 2 deletions(-)
 create mode 100644 tests/.gitignore
 create mode 100644 tests/Makefile.am
 create mode 100755 tests/functions.sh
 create mode 100755 tests/gen-keys.sh
 create mode 100755 tests/ima_hash.test
 create mode 100755 tests/sign_verify.test

index cb82166..c579199 100644
@@ -21,7 +21,7 @@ missing
 compile
 libtool
 ltmain.sh
-
+test-driver
 
 # Compiled executables
 *.o

index dba408d..45c6f82 100644
@@ -1,4 +1,4 @@
-SUBDIRS = src
+SUBDIRS = src tests
 dist_man_MANS = evmctl.1
 
 doc_DATA =  examples/ima-genkey-self.sh examples/ima-genkey.sh examples/ima-gen-local-ca.sh

index 5aca4c1..3f21ba4 100644
@@ -67,6 +67,7 @@ EVMCTL_MANPAGE_DOCBOOK_XSL
 
 AC_CONFIG_FILES([Makefile
 		src/Makefile
+		tests/Makefile
 		packaging/ima-evm-utils.spec
 		])
 AC_OUTPUT

new file mode 100644
index 0000000..9ecc984
@@ -0,0 +1,16 @@
+# Generated by test driver
+*.log
+*.trs
+
+# Generated by tests
+*.txt
+*.out
+*.sig
+*.sig2
+
+# Generated certs and keys (by gen-keys.sh)
+*.cer
+*.pub
+*.key
+*.conf
+

new file mode 100644
index 0000000..029f2ff
@@ -0,0 +1,12 @@
+check_SCRIPTS =
+TESTS = $(check_SCRIPTS)
+
+check_SCRIPTS += ima_hash.test sign_verify.test
+
+clean-local:
+	-rm -f *.txt *.out *.sig *.sig2
+
+distclean: distclean-keys
+.PHONY: distclean-keys
+distclean-keys:
+	./gen-keys.sh clean

2.11.0

On 8/17/19 4:33 PM, Vitaly Chikunov wrote:

Hi Vitaly,

I assume this is the latest version of your patch set. I applied the patch. Am seeing the errors given below.

Also, are there any other changes in for ima-evm-utils (besides the files listed below)?

Please let me know if I am missing something.

~/ima-evm-utils/$ ./configure
config.status: error: cannot find input file: `tests/Makefile.in'

~/ima-evm-utils/$ make

Making all in tests
make[2]: Entering directory '~/ima-evm-utils/tests' make[2]: *** No rule to make target 'all'. Stop.

thanks,
-lakshmi

Lakshmi,

Please run autogen.sh twice before running configure.

Thanks,

That fixed the problem. Thanks Vitaly.

-lakshmi

Hi Vitaly,

When I run the tests, all ima_hash tests pass.
But most of sign_verify tests fail.
I am not sure if I am missing anything in the test setup. Please let me know.

In the file sign_verify.test, I commented out all the tests except the following:

	sign_verify  rsa1024  sha1    0x0301 --rsa

The text file sha1.txt created by the test is signed fine. But the signature verification fails.

Please see the log at the end of the mail for more detail.

evmctl fails to decode the key file when using the public key "test-rsa1024.pub"

evmctl -v ima_verify --key test-rsa1024.pub --xattr-user --rsa sha1.txt

But if I pass the certificate file, the file is decoded fine, but signature verification fails.

evmctl -v ima_verify --key test-rsa1024.cer --xattr-user --rsa sha1.txt

Test log
--------
evmctl is ../src/evmctl
openssl is /usr/bin/openssl
xxd is /usr/bin/xxd
getfattr is /usr/bin/getfattr
- openssl dgst -sha1 sha1.txt
- openssl dgst -sha1 -sign test-rsa1024.key -hex sha1.txt
+ evmctl -v ima_sign --rsa --sigfile --hashalgo sha1 --key test-rsa1024.key --xattr-user sha1.txt hash(sha1): da39a3ee5e6b4b0d3255bfef95601890afd80709
sighash: 52d14dacbdb7e7b4195f302357f2324aba026af5
evm/ima signature-v1: 146 bytes
Writing to sha1.txt.sig

030130ca735e0000502a83d5a17c171e01040034d161431091513a700f0f9c92c43aee09b59e48a66123afcc4fc8ca6ab9993aa61df9a5d3e38fdaed2e091c6c24b85a3418c1229417d4f3aedb230fd018e7658a6b785de56d3f8e5c029601d77b303f9100b547b5db4adf7e53877874d807811d47eac9ecefcebe6bd5ef49e345671ac87b5fb27e51ea8565dd19a4b93a4a80
+ evmctl -v ima_verify --key test-rsa1024.pub --xattr-user --rsa sha1.txt

evmctl ima_verify failed with (1)
Failed to d2i_X509_fp key file: test-rsa1024.pub
openssl: error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag
openssl: error:0D07803A:asn1 encoding
routines:asn1_item_embed_d2i:nested asn1 error
hash-v1: da39a3ee5e6b4b0d3255bfef95601890afd80709

thanks,
-lakshmi

Lakshmi,

Please tell what version of ima-evm-utils you are using (what is head commit id).

Please show me content of your test-rsa1024.key and test-rsa1024.pub, and getfattr -dm. sha1.txt.

Thanks,

evmctl --version
evmctl 1.2

ima-evm-utils$ git log -1
commit 515c99856ef52bbf680e6dd6c338acfb8d088614 (HEAD -> master, tag: v1.2, origin/master, origin/HEAD)

Author: Mimi Zohar <[email protected]>
Date:   Wed Jul 24 07:24:43 2019 -0400

ima-evm-utils: Release version 1.2

getfattr -dm. sha1.txt
# file: sha1.txt user.evm=0sAwEwynNeAABQKoPVoXwXHgEEAAmpCSf+2aCO+Wju3CCoc14f43oqquhhgs401WUd39JGdd7kMAWywyrVoz9bRbcTeIXbV0ylfi+snXHJxJwKRpDL07JCvE/XIFiQH0NIgyV85mzkuGZ6i/PGPghPsLAXY1UufCIgPrCAlXvxjUiIF1Vu5Z52UNoXED3zBqQulQqP

cat test-rsa1024.key

-----BEGIN PRIVATE KEY----- MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAMJp/dT5ZOMV1+4j XmFvutwOIH24kVi+rxG8By10UFM4ESoX1qQFuOMpVWJSHsbHFQRbQy5/JGodDmQ+ s3SlsHoLF60UOzPTmolmNFn31SoTN8yI+0hrlcewH/yv8PbRxVZXJwaRFsiHX9YS D02xA691B7sIVPxtMUVmMpjiLw4RAgMBAAECgYEAuOmTMoRa/tqB3NDrLgXVVwRg xvNL23rSjS2oLgWZeO209bJixvNiXT2tJq0w9KPaS6B6D7mCayNj0tkIWwRVCrcr b8aGZat0Rc/yfQcCf91qd1AFD8SpJ+SbBXJda0qIj21C5zwXg0guwB7m1AB6FS5D eFg5tWONC8sO2buaobkCQQDfx+UrXqkaEwHp/UrV64qGPwk7dYhR9eZD40GpaCEP KDSQjYKijjbiLBW+ztgOMm32Q+pVxaGyLyQh8mM43ybfAkEA3meyFe4T3PsAiARg OKiZXbMqDCWsnB8xQxcpDVcX8oRzF+HaNrzxWpzDf0YhrV8vC6dgYg5f2+UH9Zvu F7AZDwJAPMMnS85pNiZBF8rp/gn11BvbouR3/mE5g+d6FciraVUuaK2z8fWRm3oC 8YtyiPBSgVLRlzaRgDNiqUEKhg+5mwJBAJH957zVh1xrt7GRjcgjhGkpjtRidqgV IbU0otIK9cFQiGyI6UE9TgF5HiuR0dGIxc0UlgRIA0zJTyw+q1AJXKkCQEcvowyb tIjDhgbMb68Euz5RQt6pktASQ7EBquRQ3Pe1MQwWBzF0pJW10f+idzNCHDY554cJ VD/C7jcQ1twWWNs=
-----END PRIVATE KEY-----

cat test-rsa1024.pub
-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCaf3U+WTjFdfuI15hb7rcDiB9 uJFYvq8RvActdFBTOBEqF9akBbjjKVViUh7GxxUEW0MufyRqHQ5kPrN0pbB6Cxet FDsz05qJZjRZ99UqEzfMiPtIa5XHsB/8r/D20cVWVycGkRbIh1/WEg9NsQOvdQe7 CFT8bTFFZjKY4i8OEQIDAQAB
-----END PUBLIC KEY-----

thanks,
-lakshmi