tests/bitlk-compat-test

   1 #!/bin/bash
   2
   3 # check bitlk images parsing
   4
   5 [ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".."
   6 CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup
   7 TST_DIR=bitlk-images
   8 MAP=bitlktst
   9 DUMP_VK_FILE=bitlk-test-vk
  10
  11 CRYPTSETUP_VALGRIND=../.libs/cryptsetup
  12 CRYPTSETUP_LIB_VALGRIND=../.libs
  13
  14 [ -z "$srcdir" ] && srcdir="."
  15
  16 function remove_mapping()
  17 {
  18         [ -b /dev/mapper/$MAP ] && dmsetup remove --retry $MAP
  19         rm -rf $TST_DIR
  20 }
  21
  22 function fail()
  23 {
  24         [ -n "$1" ] && echo "$1"
  25         echo " [FAILED]"
  26         echo "FAILED backtrace:"
  27         while caller $frame; do ((frame++)); done
  28         remove_mapping
  29         exit 2
  30 }
  31
  32 function skip()
  33 {
  34         [ -n "$1" ] && echo "$1"
  35         echo "Test skipped."
  36         remove_mapping
  37         exit 77
  38 }
  39
  40 function load_vars()
  41 {
  42         local file=$(echo $1 | sed -e s/^$TST_DIR\\/// | sed -e s/\.img$//)
  43         source <(grep = <(grep -A8 "\[$file\]" $TST_DIR/images.conf))
  44 }
  45
  46 function check_dump()
  47 {
  48         dump=$1
  49         file=$2
  50
  51         # load variables for this image from config file
  52         load_vars $file
  53
  54         # volume size
  55         dump_size=$(echo "$dump" | grep "Volume size:" | cut -d: -f2 | tr -d "\t\n ")
  56         [ "$dump_size" = "104857600[bytes]" -o "$dump_size" = "134217728[bytes]"  ] || fail " volume size check from dump failed."
  57
  58         # description
  59         dump_desc=$(echo "$dump" | grep Description: | cut -d: -f2 | tr -d "\t\n ")
  60         [ "${dump_desc:0:7}" = "DESKTOP" -o  "${dump_desc:0:3}" = "WIN" ] || fail " Description check from dump failed."
  61
  62         # GUID
  63         dump_guid=$(echo "$dump" | grep Version -A 1 | tail -1 | cut -d: -f2 | tr -d "\t\n ")
  64         [ ! -z "$GUID" -a "$dump_guid" = "$GUID"  ] || fail " GUID check from dump failed."
  65
  66         # cipher
  67         dump_cipher=$(echo "$dump" | grep "Cipher name" | cut -d: -f2 | tr -d "\t\n ")
  68         dump_mode=$(echo "$dump" | grep "Cipher mode" | cut -d: -f2 | tr -d "\t\n ")
  69         cipher=$(echo "$dump_cipher-$dump_mode")
  70         [ ! -z "$CIPHER" -a "$cipher" = "$CIPHER" ] || fail " cipher check from dump failed."
  71
  72         if echo "$file" | grep -q -e "smart-card"; then
  73                 # smart card protected VMK GUID
  74                 dump_sc_vmk=$(echo "$dump" | grep "VMK protected with smart card" -B 1 | head -1 | cut -d: -f2 | tr -d "\t ")
  75                 [ ! -z "$SC_VMK_GUID" -a "$dump_sc_vmk" = "$SC_VMK_GUID" ] || fail " smart card protected VMK GUID check from dump failed."
  76         elif echo "$file" | grep -q -e "startup-key"; then
  77                 # startup key protected VMK GUID
  78                 dump_sk_vmk=$(echo "$dump" | grep "VMK protected with startup key" -B 1 | head -1 | cut -d: -f2 | tr -d "\t ")
  79                 [ ! -z "$SK_VMK_GUID" -a "$dump_sk_vmk" = "$SK_VMK_GUID" ] || fail " startup key protected VMK GUID check from dump failed."
  80         else
  81                 # password protected VMK GUID
  82                 dump_pw_vmk=$(echo "$dump" | grep "VMK protected with passphrase" -B 1 | head -1 | cut -d: -f2 | tr -d "\t ")
  83                 [ ! -z "$PW_VMK_GUID" -a "$dump_pw_vmk" = "$PW_VMK_GUID" ] || fail " password protected VMK GUID check from dump failed."
  84         fi
  85
  86         # recovery password protected VMK GUID
  87         dump_rp_vmk=$(echo "$dump" | grep "VMK protected with recovery passphrase" -B 1 | head -1 | cut -d: -f2 | tr -d "\t ")
  88         [ ! -z "$RP_VMK_GUID" -a "$dump_rp_vmk" = "$RP_VMK_GUID" ] || fail " recovery password protected VMK GUID check from dump failed."
  89
  90 }
  91
  92 function valgrind_setup()
  93 {
  94         command -v valgrind >/dev/null || fail "Cannot find valgrind."
  95         [ ! -f $CRYPTSETUP_VALGRIND ] && fail "Unable to get location of cryptsetup executable."
  96         export LD_LIBRARY_PATH="$CRYPTSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH"
  97 }
  98
  99 function valgrind_run()
 100 {
 101         INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${CRYPTSETUP_VALGRIND} "$@"
 102 }
 103
 104 export LANG=C
 105 [ ! -x "$CRYPTSETUP" ] && skip "Cannot find $CRYPTSETUP, test skipped."
 106 [ ! -d $TST_DIR ] && tar xJSf $srcdir/bitlk-images.tar.xz --no-same-owner 2>/dev/null || skip "Incompatible tar."
 107
 108 [ -n "$VALG" ] && valgrind_setup && CRYPTSETUP=valgrind_run
 109
 110 echo "HEADER CHECK"
 111 for file in $(ls $TST_DIR/bitlk-*) ; do
 112         echo -n " $file"
 113         out=$($CRYPTSETUP bitlkDump $file)
 114         check_dump "$out" "$file"
 115         echo " [OK]"
 116 done
 117
 118 if [ $(id -u) != 0 ]; then
 119         echo "WARNING: You must be root to run activation part of test, test skipped."
 120         remove_mapping
 121         exit 0
 122 fi
 123
 124 echo "ACTIVATION FS UUID CHECK"
 125 for file in $(ls $TST_DIR/bitlk-*) ; do
 126         # load variables for this image from config file
 127         load_vars $file
 128
 129         # test with both passphrase and recovery passphrase
 130         for PASSPHRASE in $PW $RP ; do
 131                 echo -n " $file"
 132                 echo $PASSPHRASE | $CRYPTSETUP bitlkOpen -r $file --test-passphrase >/dev/null 2>&1
 133                 ret=$?
 134                 [ $ret -eq 1 ] && echo " [N/A]" && continue
 135                 echo $PASSPHRASE | $CRYPTSETUP bitlkOpen -r $file $MAP >/dev/null 2>&1
 136                 ret=$?
 137                 [ $ret -eq 1 ] && ( echo "$file" | grep -q -e "aes-cbc" ) && echo " [N/A]" && continue
 138                 [ $ret -eq 1 ] && ( echo "$file" | grep -q -e "aes-cbc-elephant" ) && echo " [N/A]" && continue
 139                 [ $ret -eq 1 ] && ( echo "$file" | grep -q -e "clearkey" ) && echo " [N/A]" && continue
 140                 [ $ret -eq 1 ] && ( echo "$file" | grep -q -e "eow" ) && echo " [N/A]" && continue
 141                 [ $ret -eq 1 ] && ( echo "$file" | grep -q -e "-4k.img" ) && echo " [N/A]" && continue
 142                 [ $ret -eq 0 ] || fail " failed to open $file ($ret)"
 143                 $CRYPTSETUP status $MAP >/dev/null || fail
 144                 $CRYPTSETUP status /dev/mapper/$MAP >/dev/null || fail
 145                 uuid=$(blkid -p -o value -s UUID /dev/mapper/$MAP)
 146                 sha256sum=$(sha256sum /dev/mapper/$MAP | cut -d" " -f1)
 147                 $CRYPTSETUP remove $MAP || fail
 148                 [ "$uuid" = "$UUID" ] || fail " UUID check failed."
 149                 [ "$sha256sum" = "$SHA256SUM" ] || fail " SHA256 sum check failed."
 150                 echo " [OK]"
 151         done
 152
 153         # test with volume key
 154         rm -f $DUMP_VK_FILE >/dev/null 2>&1
 155         echo -n " $file"
 156         echo $PASSPHRASE | $CRYPTSETUP bitlkDump -r $file --dump-volume-key --volume-key-file $DUMP_VK_FILE >/dev/null 2>&1
 157         ret=$?
 158         [ $ret -eq 0 ] || fail " failed to dump volume key"
 159         $CRYPTSETUP bitlkOpen -r $file $MAP --volume-key-file $DUMP_VK_FILE >/dev/null 2>&1
 160         ret=$?
 161         [ $ret -eq 1 ] && ( echo "$file" | grep -q -e "aes-cbc" ) && echo " [N/A]" && continue
 162         [ $ret -eq 1 ] && ( echo "$file" | grep -q -e "aes-cbc-elephant" ) && echo " [N/A]" && continue
 163         [ $ret -eq 1 ] && ( echo "$file" | grep -q -e "clearkey" ) && echo " [N/A]" && continue
 164         [ $ret -eq 1 ] && ( echo "$file" | grep -q -e "eow" ) && echo " [N/A]" && continue
 165         [ $ret -eq 1 ] && ( echo "$file" | grep -q -e "-4k.img" ) && echo " [N/A]" && continue
 166         [ $ret -eq 0 ] || fail " failed to open $file using volume key ($ret)"
 167         $CRYPTSETUP status $MAP >/dev/null || fail
 168         $CRYPTSETUP status /dev/mapper/$MAP >/dev/null || fail
 169         uuid=$(blkid -p -o value -s UUID /dev/mapper/$MAP)
 170         sha256sum=$(sha256sum /dev/mapper/$MAP | cut -d" " -f1)
 171         $CRYPTSETUP remove $MAP || fail
 172         [ "$uuid" = "$UUID" ] || fail " UUID check failed."
 173         [ "$sha256sum" = "$SHA256SUM" ] || fail " SHA256 sum check failed."
 174         echo " [OK]"
 175         rm -f $DUMP_VK_FILE >/dev/null 2>&1
 176
 177         # startup key test -- we need to use BEK file from the archive
 178         if echo "$file" | grep -q -e "startup-key"; then
 179                 echo -n " $file"
 180                 bek_file=$(echo $SK_VMK_GUID.BEK | tr /a-z/ /A-Z/)
 181                 $CRYPTSETUP bitlkOpen -r $file --test-passphrase --key-file $TST_DIR/$bek_file
 182                 ret=$?
 183                 [ $ret -eq 1 ] && echo " [N/A]" && continue
 184                 $CRYPTSETUP bitlkOpen -r $file $MAP --key-file $TST_DIR/$bek_file >/dev/null 2>&1
 185                 ret=$?
 186                 [ $ret -eq 0 ] || fail " failed to open $file ($ret)"
 187                 $CRYPTSETUP status $MAP >/dev/null || fail
 188                 $CRYPTSETUP status /dev/mapper/$MAP >/dev/null || fail
 189                 uuid=$(blkid -p -o value -s UUID /dev/mapper/$MAP)
 190                 sha256sum=$(sha256sum /dev/mapper/$MAP | cut -d" " -f1)
 191                 $CRYPTSETUP remove $MAP || fail
 192                 [ "$uuid" = "$UUID" ] || fail " UUID check failed."
 193                 [ "$sha256sum" = "$SHA256SUM" ] || fail " SHA256 sum check failed."
 194                 echo " [OK]"
 195
 196         fi
 197 done
 198
 199 remove_mapping
 200 exit 0