Add password verification for stratis-min

stratis-storage · Aug 21, 2024 · e4bd4ce · e4bd4ce
1 parent 4a847dd
commit e4bd4ce
Show file tree

Hide file tree

Showing 3 changed files with 27 additions and 6 deletions.
diff --git a/dracut/90stratis/stratis-rootfs-setup b/dracut/90stratis/stratis-rootfs-setup
@@ -20,8 +20,9 @@ if $(stratis-min pool is-stopped "$STRATIS_ROOTFS_UUID"); then
 		ATTEMPTS_REMAINING=3
 		if
 			! while [ $((ATTEMPTS_REMAINING--)) -gt 0 ]; do
-				systemd-ask-password --id="stratis:$STRATIS_ROOTFS_UUID" "Enter password for Stratis pool with UUID $STRATIS_ROOTFS_UUID containing root filesystem" |
-					stratis-min pool start --prompt --unlock-method=keyring "$STRATIS_ROOTFS_UUID" && break
+				PASSWORD=$(systemd-ask-password --id="stratis:$STRATIS_ROOTFS_UUID" "Enter password for Stratis pool with UUID $STRATIS_ROOTFS_UUID containing root filesystem")
+
+				echo -e "$PASSWORD\n$PASSWORD\n" | stratis-min pool start --prompt --unlock-method=keyring "$STRATIS_ROOTFS_UUID" && break
 			done
 		then
 			echo Failed to start pool with UUID $STRATIS_ROOTFS_UUID using a passphrase >&2

diff --git a/src/jsonrpc/client/utils.rs b/src/jsonrpc/client/utils.rs
@@ -10,7 +10,7 @@ use std::{
 use nix::unistd::isatty;
 use termios::{tcsetattr, Termios, ECHO, ECHONL, TCSADRAIN};
 
-use crate::stratis::StratisResult;
+use crate::stratis::{StratisError, StratisResult};
 
 #[macro_export]
 macro_rules! do_request {
@@ -217,8 +217,8 @@ pub fn to_suffix_repr(size: u128) -> String {
     })
 }
 
-pub fn prompt_password() -> StratisResult<Option<String>> {
-    print!("Enter passphrase followed by return: ");
+pub fn get_passphrase(msg: &str) -> StratisResult<Option<String>> {
+    print!("{}", msg);
     stdout().flush()?;
 
     let stdin = stdin();
@@ -252,6 +252,16 @@ pub fn prompt_password() -> StratisResult<Option<String>> {
     }
 }
 
+pub fn prompt_password() -> StratisResult<Option<String>> {
+    let pass = get_passphrase("Enter passphrase followed by return: ")?;
+    let verify_pass = get_passphrase("Verify passphrase: ")?;
+    if pass != verify_pass {
+        Err(StratisError::Msg("Passphrases did not match".to_string()))
+    } else {
+        Ok(pass)
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

diff --git a/tests/stratis_min.rs b/tests/stratis_min.rs
@@ -634,7 +634,7 @@ fn test_stratis_min_list_defaults() {
 
 fn stratis_min_key_set() {
     let mut cmd = Command::cargo_bin("stratis-min").unwrap();
-    cmd.write_stdin("thisisatestpassphrase\n")
+    cmd.write_stdin("thisisatestpassphrase\nthisisatestpassphrase\n")
         .arg("key")
         .arg("set")
         .arg("--capture-key")
@@ -643,6 +643,16 @@ fn stratis_min_key_set() {
     let mut cmd = Command::cargo_bin("stratis-min").unwrap();
     cmd.arg("key").arg("unset").arg("testkey");
     cmd.assert().success();
+
+    let mut cmd = Command::cargo_bin("stratis-min").unwrap();
+    cmd.write_stdin("thisisatestpassphrase\ndoesnotmatch\n")
+        .arg("key")
+        .arg("set")
+        .arg("--capture-key")
+        .arg("testkey1");
+    cmd.assert()
+        .failure()
+        .stderr(predicate::str::contains("Passphrases did not match"));
 }
 
 #[test]