Skip to content

Commit 1513887

Browse files
committed
fix: clevis-luks-list didn't show all configured bindings
Previously, the value of sss was overwritten every time, so only the last entry for sss pins was displayed. Fix this by saving them all and instead of manually processing the sss pin, reuse clevis_luks_join_sss_cfg as it is used in the other functions Fixes #505. The test adjustments are needed since previously the command always listed an object for sss instead of a list. This is not the way it works for other pins, for example tang does always give you a list. So if you apply this patch: ```diff diff --git a/src/luks/tests/list-sss-tang-luks2 b/src/luks/tests/list-sss-tang-luks2 index 5f05696..a9dad34 100755 --- a/src/luks/tests/list-sss-tang-luks2 +++ b/src/luks/tests/list-sss-tang-luks2 @@ -36,15 +36,9 @@ PIN="sss" PINS="sss tang" CFG=$(printf ' { - "t": 2, + "t": 1, "pins": { - "tang": [ - {"url":"ADDR1","adv":"%s"}, - {"url":"ADDR2","adv":"%s"}, - {"url":"ADDR3","adv":"%s"}, - {"url":"ADDR4","adv":"%s"}, - {"url":"ADDR5","adv":"%s"} - ] + "tang": {"url":"ADDR1","adv":"%s"} } } ' "${ADV}" "${ADV}" "${ADV}" "${ADV}" "${ADV}") ``` to only have one tang config and not have it in a list, the test `list-sss-tang-luks2` will also fail with non-matching configs even outside of this branch. So while both formats are equivalent, we can't reasonably determine which format was used on encryption and we should use one format everywhere. It makes sense to adapt the more general format that is already used for tang and tpm.
1 parent bcac529 commit 1513887

3 files changed

Lines changed: 37 additions & 27 deletions

File tree

src/luks/clevis-luks-common-functions.in

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -293,7 +293,7 @@ clevis_luks_process_sss_pin() {
293293
sss_tpm2="${sss_tpm2},${cfg}"
294294
;;
295295
sss)
296-
sss=$(echo "${cfg}" | tr -d "'")
296+
sss="${sss},${cfg}"
297297
;;
298298
esac
299299
done
@@ -304,7 +304,7 @@ clevis_luks_process_sss_pin() {
304304
fi
305305

306306
if [ -n "${sss_tang}" ]; then
307-
cfg=$(clevis_luks_join_sss_cfg "tang" "${sss_tang}")
307+
cfg="${cfg},"$(clevis_luks_join_sss_cfg "tang" "${sss_tang}")
308308
fi
309309

310310
if [ -n "${sss_tpm1}" ]; then
@@ -320,7 +320,7 @@ clevis_luks_process_sss_pin() {
320320
fi
321321

322322
if [ -n "${sss}" ]; then
323-
cfg=$(printf '%s,"sss":%s' "${cfg}" "${sss}")
323+
cfg="${cfg},"$(clevis_luks_join_sss_cfg "sss" "${sss}")
324324
fi
325325

326326
# Remove possible leading comma.

src/luks/tests/list-recursive-luks1

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -38,21 +38,26 @@ CFG=$(printf '
3838
{
3939
"t": 1,
4040
"pins": {
41-
"sss": {
42-
"t": 1,
43-
"pins": {
44-
"sss": {
45-
"t": 1,
46-
"pins": {
47-
"tang": [
48-
{
49-
"url": "ADDR","adv": "%s"
41+
"sss": [
42+
{
43+
"t": 1,
44+
"pins": {
45+
"sss": [
46+
{
47+
"t": 1,
48+
"pins": {
49+
"tang": [
50+
{
51+
"url": "ADDR",
52+
"adv": "%s"
53+
}
54+
]
5055
}
51-
]
52-
}
56+
}
57+
]
5358
}
5459
}
55-
}
60+
]
5661
}
5762
}
5863
' "${ADV}")

src/luks/tests/list-recursive-luks2

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -38,21 +38,26 @@ CFG=$(printf '
3838
{
3939
"t": 1,
4040
"pins": {
41-
"sss": {
42-
"t": 1,
43-
"pins": {
44-
"sss": {
45-
"t": 1,
46-
"pins": {
47-
"tang": [
48-
{
49-
"url": "ADDR","adv": "%s"
41+
"sss": [
42+
{
43+
"t": 1,
44+
"pins": {
45+
"sss": [
46+
{
47+
"t": 1,
48+
"pins": {
49+
"tang": [
50+
{
51+
"url": "ADDR",
52+
"adv": "%s"
53+
}
54+
]
5055
}
51-
]
52-
}
56+
}
57+
]
5358
}
5459
}
55-
}
60+
]
5661
}
5762
}
5863
' "${ADV}")

0 commit comments

Comments
 (0)