1437647052
As explained in commit a21618c8a (tests: Test aborts due to missing requirements should be marked as error instead of skipped) and in the Automake manual[1], skipped tests are tests that should not be run, e.g. running the ohci test on the powerpc-ieee1275 as there are no native ohci drivers for that platform. Test that fail for reasons other than there is a bug in GRUB code that is causing the test to fail are hard errors. Commonly this is because the test is run in an improperly configured environment, like required programs are missing. If a hard error condition is identified with a SKIP return code, the person running the tests can not know without investigating every skip if a SKIP in the tests was because the test does not apply to the target being tested or because the user had a misconfigured environment that was causing the test not to run. By ensuring that a test is skipped only when it should not run, the person running the test can be sure that there is no need to investigate why the test was skipped. This reverts commit bf13fed5f (tests: Skip tests if required tools are not available). [1] https://www.gnu.org/software/automake/manual/automake.html#Generalities-about-Testing Signed-off-by: Glenn Washburn <development@efficientek.com> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
200 lines
7.0 KiB
Plaintext
200 lines
7.0 KiB
Plaintext
#! @BUILD_SHEBANG@ -e
|
|
|
|
# Run all grub cryptomount tests in a Qemu instance
|
|
# Copyright (C) 2023 Free Software Foundation, Inc.
|
|
#
|
|
# GRUB is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# GRUB is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
if [ "x$EUID" = "x" ] ; then
|
|
EUID=`id -u`
|
|
fi
|
|
|
|
if [ "$EUID" != 0 ] ; then
|
|
echo "not root; cannot test cryptomount."
|
|
exit 99
|
|
fi
|
|
|
|
if ! which cryptsetup >/dev/null 2>&1; then
|
|
echo "cryptsetup not installed; cannot test cryptomount."
|
|
exit 99
|
|
fi
|
|
|
|
if ! which mkfs.vfat >/dev/null 2>&1; then
|
|
echo "mkfs.vfat not installed; cannot test cryptomount."
|
|
exit 99
|
|
fi
|
|
|
|
COMMON_OPTS='${V:+--debug=$V} --cs-opts="--pbkdf-force-iterations 1000"'
|
|
|
|
debug=${GRUB_SHELL_DEFAULT_DEBUG:-$GRUB_TEST_DEFAULT_DEBUG}
|
|
builddir="@builddir@"
|
|
|
|
_testcase() {
|
|
local EXPECTEDRES=$1
|
|
local LOGPREFIX=$2
|
|
local res=0
|
|
local output
|
|
shift 2
|
|
|
|
# Create a subdir in TMPDIR for each testcase
|
|
_TMPDIR=${TMPDIR:-/tmp}
|
|
TMPDIR=${_TMPDIR}/`echo -n "$(date +%s).${LOGPREFIX}" | sed -e 's,[ /],_,g' -e 's,:$,,g'`
|
|
export TMPDIR
|
|
mkdir -p "$TMPDIR"
|
|
set -- "$@" $([ "${EXPECTEDRES}" -eq 1 ] && echo "--xfail")
|
|
|
|
output=`"$@" 2>&1` || res=$?
|
|
if [ -z "$debug" ]; then
|
|
if ! rmdir "$TMPDIR" >/dev/null 2>&1; then
|
|
echo
|
|
echo "Note: Temporary directory cannot be removed:"
|
|
echo " $TMPDIR"
|
|
echo " Please inspect and remove manually."
|
|
echo
|
|
fi
|
|
fi
|
|
TMPDIR=$_TMPDIR
|
|
|
|
if [ "$res" -eq "$EXPECTEDRES" ]; then
|
|
if [ "$res" -eq 0 ]; then
|
|
echo $LOGPREFIX PASS
|
|
else
|
|
echo $LOGPREFIX XFAIL
|
|
fi
|
|
else
|
|
echo "Error[$res]: $output"
|
|
if [ "$res" -eq 0 ]; then
|
|
echo $LOGPREFIX XPASS
|
|
elif [ "$res" -eq 1 ]; then
|
|
echo $LOGPREFIX FAIL
|
|
else
|
|
# Any exit code other than 1 or 0, indicates a hard error,
|
|
# not a test error
|
|
echo $LOGPREFIX ERROR
|
|
return 99
|
|
fi
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
testcase() { _testcase 0 "$@"; }
|
|
testcase_fail() { _testcase 1 "$@"; }
|
|
|
|
### LUKS1 tests
|
|
eval testcase "'LUKS1 test cryptsetup defaults:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS
|
|
|
|
eval testcase "'LUKS1 test with twofish cipher:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
"--cs-opts='--cipher twofish-xts-plain64'"
|
|
|
|
eval testcase "'LUKS1 test key file support:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
--keyfile
|
|
|
|
eval testcase "'LUKS1 test key file with offset:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
--keyfile --cs-opts="--keyfile-offset=237"
|
|
|
|
eval testcase "'LUKS1 test key file with offset and size:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
--keyfile "--cs-opts='--keyfile-offset=237 --keyfile-size=1023'"
|
|
|
|
eval testcase "'LUKS1 test detached header support:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
--detached-header
|
|
|
|
eval testcase "'LUKS1 test both detached header and key file:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
--keyfile --detached-header
|
|
|
|
### LUKS2 tests (mirroring the LUKS1 tests above)
|
|
LUKS2_COMMON_OPTS="--luks=2 --cs-opts=--pbkdf=pbkdf2"
|
|
eval testcase "'LUKS2 test cryptsetup defaults:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS
|
|
|
|
eval testcase "'LUKS2 test with twofish cipher:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
"--cs-opts='--cipher twofish-xts-plain64'"
|
|
|
|
eval testcase "'LUKS2 test key file support:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
--keyfile
|
|
|
|
eval testcase "'LUKS2 test key file with offset:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
--keyfile --cs-opts="--keyfile-offset=237"
|
|
|
|
eval testcase "'LUKS2 test key file with offset and size:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
--keyfile "--cs-opts='--keyfile-offset=237 --keyfile-size=1023'"
|
|
|
|
eval testcase "'LUKS2 test detached header support:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
--detached-header
|
|
|
|
eval testcase "'LUKS2 test both detached header and key file:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
--keyfile --detached-header
|
|
|
|
### LUKS1 specific tests
|
|
# Tests for xts-plain and xts-plain64 modes
|
|
eval testcase "'LUKS1 test cryptsetup xts-plain:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
"--cs-opts='--cipher aes-xts-plain'"
|
|
|
|
eval testcase "'LUKS1 test cryptsetup xts-plain64:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
"--cs-opts='--cipher aes-xts-plain64'"
|
|
|
|
### LUKS2 specific tests
|
|
eval testcase "'LUKS2 test with 1k sector size:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
"--cs-opts='--sector-size 1024'"
|
|
|
|
eval testcase "'LUKS2 test with 2k sector size:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
"--cs-opts='--sector-size 2048'"
|
|
|
|
eval testcase "'LUKS2 test with 4k sector size:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
"--cs-opts='--sector-size 4096'"
|
|
|
|
eval testcase "'LUKS2 test with non-default key slot:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
"--cs-opts='--key-slot 5'"
|
|
|
|
eval testcase "'LUKS2 test with different metadata size:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
"--cs-opts='--luks2-metadata-size 512k'"
|
|
|
|
eval testcase "'LUKS2 test with argon2 pbkdf:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=2 $COMMON_OPTS \
|
|
"--cs-opts='--pbkdf-memory 32'" "--cs-opts='--pbkdf-parallel 1'"
|
|
|
|
# Add good password to second slot and change first slot to unchecked password
|
|
csscript=`mktemp "${TMPDIR:-/tmp}/tmp.XXXXXXXXXX"` || exit 99
|
|
cat >$csscript <<'EOF'
|
|
CSOPTS="--pbkdf-force-iterations 1000 --pbkdf=pbkdf2 --force-password"
|
|
cryptsetup $CSOPTS --key-file $lukskeyfile luksAddKey $luksdiskfile $lukskeyfile
|
|
echo "newpass" | cryptsetup $CSOPTS --key-file $lukskeyfile --key-slot 0 luksChangeKey $luksdiskfile
|
|
EOF
|
|
|
|
eval testcase "'LUKS2 test with second key slot and first slot using different password:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
"--cs-script='$csscript'"
|
|
|
|
test -n "$debug" || rm "$csscript"
|
|
exit 0
|