445549c898
Using a shell variable instead of an autoconf macro creates less changes to the file, which can be desirable when modifying by hand later and then diffing with the unexpanded file. It also makes it simpler to change the builddir after expansion, which may need to happen when moving the build dir to a different path and not being able to rerun the autoconf expansion. Also, add quoting around the builddir variable as there may be spaces in the path. Signed-off-by: Glenn Washburn <development@efficientek.com> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
200 lines
7.0 KiB
Plaintext
200 lines
7.0 KiB
Plaintext
#! @BUILD_SHEBANG@ -e
|
|
|
|
# Run all grub cryptomount tests in a Qemu instance
|
|
# Copyright (C) 2023 Free Software Foundation, Inc.
|
|
#
|
|
# GRUB is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# GRUB is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
if [ "x$EUID" = "x" ] ; then
|
|
EUID=`id -u`
|
|
fi
|
|
|
|
if [ "$EUID" != 0 ] ; then
|
|
echo "not root; cannot test cryptomount."
|
|
exit 99
|
|
fi
|
|
|
|
if ! which cryptsetup >/dev/null 2>&1; then
|
|
echo "cryptsetup not installed; cannot test cryptomount."
|
|
exit 77
|
|
fi
|
|
|
|
if ! which mkfs.vfat >/dev/null 2>&1; then
|
|
echo "mkfs.vfat not installed; cannot test cryptomount."
|
|
exit 77
|
|
fi
|
|
|
|
COMMON_OPTS='${V:+--debug=$V} --cs-opts="--pbkdf-force-iterations 1000"'
|
|
|
|
debug=${GRUB_SHELL_DEFAULT_DEBUG:-$GRUB_TEST_DEFAULT_DEBUG}
|
|
builddir="@builddir@"
|
|
|
|
_testcase() {
|
|
local EXPECTEDRES=$1
|
|
local LOGPREFIX=$2
|
|
local res=0
|
|
local output
|
|
shift 2
|
|
|
|
# Create a subdir in TMPDIR for each testcase
|
|
_TMPDIR=${TMPDIR:-/tmp}
|
|
TMPDIR=${_TMPDIR}/`echo -n "$(date +%s).${LOGPREFIX}" | sed -e 's,[ /],_,g' -e 's,:$,,g'`
|
|
export TMPDIR
|
|
mkdir -p "$TMPDIR"
|
|
set -- "$@" $([ "${EXPECTEDRES}" -eq 1 ] && echo "--xfail")
|
|
|
|
output=`"$@" 2>&1` || res=$?
|
|
if [ -z "$debug" ]; then
|
|
if ! rmdir "$TMPDIR" >/dev/null 2>&1; then
|
|
echo
|
|
echo "Note: Temporary directory cannot be removed:"
|
|
echo " $TMPDIR"
|
|
echo " Please inspect and remove manually."
|
|
echo
|
|
fi
|
|
fi
|
|
TMPDIR=$_TMPDIR
|
|
|
|
if [ "$res" -eq "$EXPECTEDRES" ]; then
|
|
if [ "$res" -eq 0 ]; then
|
|
echo $LOGPREFIX PASS
|
|
else
|
|
echo $LOGPREFIX XFAIL
|
|
fi
|
|
else
|
|
echo "Error[$res]: $output"
|
|
if [ "$res" -eq 0 ]; then
|
|
echo $LOGPREFIX XPASS
|
|
elif [ "$res" -eq 1 ]; then
|
|
echo $LOGPREFIX FAIL
|
|
else
|
|
# Any exit code other than 1 or 0, indicates a hard error,
|
|
# not a test error
|
|
echo $LOGPREFIX ERROR
|
|
return 99
|
|
fi
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
testcase() { _testcase 0 "$@"; }
|
|
testcase_fail() { _testcase 1 "$@"; }
|
|
|
|
### LUKS1 tests
|
|
eval testcase "'LUKS1 test cryptsetup defaults:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS
|
|
|
|
eval testcase "'LUKS1 test with twofish cipher:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
"--cs-opts='--cipher twofish-xts-plain64'"
|
|
|
|
eval testcase "'LUKS1 test key file support:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
--keyfile
|
|
|
|
eval testcase "'LUKS1 test key file with offset:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
--keyfile --cs-opts="--keyfile-offset=237"
|
|
|
|
eval testcase "'LUKS1 test key file with offset and size:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
--keyfile "--cs-opts='--keyfile-offset=237 --keyfile-size=1023'"
|
|
|
|
eval testcase "'LUKS1 test detached header support:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
--detached-header
|
|
|
|
eval testcase "'LUKS1 test both detached header and key file:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
--keyfile --detached-header
|
|
|
|
### LUKS2 tests (mirroring the LUKS1 tests above)
|
|
LUKS2_COMMON_OPTS="--luks=2 --cs-opts=--pbkdf=pbkdf2"
|
|
eval testcase "'LUKS2 test cryptsetup defaults:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS
|
|
|
|
eval testcase "'LUKS2 test with twofish cipher:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
"--cs-opts='--cipher twofish-xts-plain64'"
|
|
|
|
eval testcase "'LUKS2 test key file support:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
--keyfile
|
|
|
|
eval testcase "'LUKS2 test key file with offset:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
--keyfile --cs-opts="--keyfile-offset=237"
|
|
|
|
eval testcase "'LUKS2 test key file with offset and size:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
--keyfile "--cs-opts='--keyfile-offset=237 --keyfile-size=1023'"
|
|
|
|
eval testcase "'LUKS2 test detached header support:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
--detached-header
|
|
|
|
eval testcase "'LUKS2 test both detached header and key file:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
--keyfile --detached-header
|
|
|
|
### LUKS1 specific tests
|
|
# Tests for xts-plain and xts-plain64 modes
|
|
eval testcase "'LUKS1 test cryptsetup xts-plain:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
"--cs-opts='--cipher aes-xts-plain'"
|
|
|
|
eval testcase "'LUKS1 test cryptsetup xts-plain64:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=1 $COMMON_OPTS \
|
|
"--cs-opts='--cipher aes-xts-plain64'"
|
|
|
|
### LUKS2 specific tests
|
|
eval testcase "'LUKS2 test with 1k sector size:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
"--cs-opts='--sector-size 1024'"
|
|
|
|
eval testcase "'LUKS2 test with 2k sector size:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
"--cs-opts='--sector-size 2048'"
|
|
|
|
eval testcase "'LUKS2 test with 4k sector size:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
"--cs-opts='--sector-size 4096'"
|
|
|
|
eval testcase "'LUKS2 test with non-default key slot:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
"--cs-opts='--key-slot 5'"
|
|
|
|
eval testcase "'LUKS2 test with different metadata size:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
"--cs-opts='--luks2-metadata-size 512k'"
|
|
|
|
eval testcase "'LUKS2 test with argon2 pbkdf:'" \
|
|
"$builddir/grub-shell-luks-tester" --luks=2 $COMMON_OPTS \
|
|
"--cs-opts='--pbkdf-memory 32'" "--cs-opts='--pbkdf-parallel 1'"
|
|
|
|
# Add good password to second slot and change first slot to unchecked password
|
|
csscript=`mktemp "${TMPDIR:-/tmp}/tmp.XXXXXXXXXX"` || exit 99
|
|
cat >$csscript <<'EOF'
|
|
CSOPTS="--pbkdf-force-iterations 1000 --pbkdf=pbkdf2 --force-password"
|
|
cryptsetup $CSOPTS --key-file $lukskeyfile luksAddKey $luksdiskfile $lukskeyfile
|
|
echo "newpass" | cryptsetup $CSOPTS --key-file $lukskeyfile --key-slot 0 luksChangeKey $luksdiskfile
|
|
EOF
|
|
|
|
eval testcase "'LUKS2 test with second key slot and first slot using different password:'" \
|
|
"$builddir/grub-shell-luks-tester" $LUKS2_COMMON_OPTS $COMMON_OPTS \
|
|
"--cs-script='$csscript'"
|
|
|
|
test -n "$debug" || rm "$csscript"
|
|
exit 0
|