From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1o1J0d-0000rx-SI for mharc-grub-devel@gnu.org; Tue, 14 Jun 2022 22:43:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:40982) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1o1J0c-0000q3-JU for grub-devel@gnu.org; Tue, 14 Jun 2022 22:43:55 -0400 Received: from mail-qv1-xf2b.google.com ([2607:f8b0:4864:20::f2b]:35723) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1o1J0a-0007ww-2f for grub-devel@gnu.org; Tue, 14 Jun 2022 22:43:54 -0400 Received: by mail-qv1-xf2b.google.com with SMTP id u8so7811729qvj.2 for ; Tue, 14 Jun 2022 19:43:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=efficientek-com.20210112.gappssmtp.com; s=20210112; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=Ky36og4fnzUSBAKXcju3F2SQIVMUFIxfDj6jYrnURHI=; b=HeQeuiuA9ZPG+nKCgF3iqg0AWUnT9E10v7fEn+c+JpTrlZ0Y2OoHp3mbgBHfHX8iN+ 50SloF6SwBqdgxZtvAwBnhL7nHR0GQrKoOzfl+WUePUX41ZtaZq/9GTr7sdoj/tIKCoR WtWi5c53+qA7qkqC1yjJUxC36W+tUd7GD+yykBxz5OPWjkSguyVR8QeYvLpW3gWIZ5/6 VqsWrkVLoj7pbWpAZZcPu1kpUuN+EB9Dc30riWtIOM2VIWSYPI+wr4nk06o2JyQ63Z0a Kq3G/L6upqTEIPnQnoWNih7LPocdRrPl2INpPsUvCffrebC+US2gRJE82DWzLRVEQv5l /dkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=Ky36og4fnzUSBAKXcju3F2SQIVMUFIxfDj6jYrnURHI=; b=xJNS/vYghnAam6USCLOvgSjcbPb/EcV0wNb6xqDWcvDiSrCv/OnA0LSU3TAA2d25fO J5L8UBmzCzZV4LQ+mW6f7aDANb7fxv9jvuQPtRjK74pAee9Hfrsbo8VN3bzvhhkw9eVm bYHhSZWdc3CPKGyHbNWbHDqcc+6/2vGpYrfa/ncCMKN+cFlN/8HPyy/t6Rv9zAQuTRzz x4zIDiehvubGlmyiExvGvGlz/XygbHUAMjnsa3rJJkuEr50aYP46ERch4B0NjCu0AUyh kGbPnyD3v+4U/CbEFJYC+IMGSuQaGC3uOORm//Nzlki2GB9eC7VRWw/0JNowizKLU6E6 Ukpg== X-Gm-Message-State: AJIora+UE0kulye9xzPsD4PRRtsITFsbHnv+aUEcevU5f0EFclt7+B2w pLrRwhzOTX3ZuDtCdS26Cdf1sPrdSnqJmA== X-Google-Smtp-Source: AGRyM1tfXJL+HrFDEBKfPRvBndBM6l2ppxz2KxCTWKKLxvzEYEIRiQMuG7y3gyv/7htCwpD0Tpa2dw== X-Received: by 2002:a0c:c783:0:b0:46b:b44c:8e63 with SMTP id k3-20020a0cc783000000b0046bb44c8e63mr6153349qvj.101.1655261029886; Tue, 14 Jun 2022 19:43:49 -0700 (PDT) Received: from localhost.localdomain ([37.218.244.249]) by smtp.gmail.com with ESMTPSA id u9-20020a05620a430900b006a91da2fc8dsm3374581qko.0.2022.06.14.19.43.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jun 2022 19:43:48 -0700 (PDT) From: Glenn Washburn To: grub-devel@gnu.org, Daniel Kiper Cc: Pierre-Louis Bonicoli , Glenn Washburn Subject: [PATCH v3] grub-fs-tester: Add luks1 and luks2 support Date: Tue, 14 Jun 2022 21:43:03 -0500 Message-Id: <20220615024303.59354-1-development@efficientek.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=2607:f8b0:4864:20::f2b; envelope-from=development@efficientek.com; helo=mail-qv1-xf2b.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jun 2022 02:43:55 -0000 From: Pierre-Louis Bonicoli The logical sector size used by LUKS1 is 512 bytes and LUKS2 uses 512 to 4069 bytes. The deafualt password used is "pass", but can be overridden by setting the PASS environment variable. The device mapper name is set to the name of the temp directory so that its easy to corrolate device mapper name with a particular test run. Also since this name is unique per test run, multiple simultaneous test runs are allowed. Note that cryptsetup is passing the --disable-locks parameter to allow cryptsetup run successfully when /run/lock/cryptsetup is not accessible. Since the device mapper name is unique per test run, there is no need to worry about locking the device to serialize access. Signed-off-by: Pierre-Louis Bonicoli Signed-off-by: Glenn Washburn --- This is a heavily modified version of Pierre-Louis's v2 patch. It has been tested with Fabian's v3 and Josselin's v4 series. Some notable differences from the previous version: * Rebase on to master accounting for cleanup() changes * Allow multple tests runs to run simultaneously * Allow specifying alternate password with environment variable * Fixed bug in previous version where LC_ALL=C was being set for echo and not run_it * Make output on UUID fail consistent with other filesystems * Allow tests to work with older cryptsetups * Fixed bug where luks1 tests were actually testing luks2 * Address my review comments Note: The luks2 test will fail without some form of working grub-probe support for luks2. This patch is independent of the above mentioned patch series, will apply without them just fine, and can be reviewed independently. Glenn --- .gitignore | 2 ++ Makefile.util.def | 12 ++++++++ tests/luks1_test.in | 23 +++++++++++++++ tests/luks2_test.in | 23 +++++++++++++++ tests/util/grub-fs-tester.in | 57 ++++++++++++++++++++++++++++++++++-- 5 files changed, 115 insertions(+), 2 deletions(-) create mode 100644 tests/luks1_test.in create mode 100644 tests/luks2_test.in diff --git a/.gitignore b/.gitignore index f6a1bd051..4064d3d1e 100644 --- a/.gitignore +++ b/.gitignore @@ -230,6 +230,8 @@ widthspec.bin /lib/libgcrypt-grub /libgrub_a_init.c /lzocompress_test +/luks1_test +/luks2_test /m4/ /minixfs_test /missing diff --git a/Makefile.util.def b/Makefile.util.def index d919c562c..3f1162b76 100644 --- a/Makefile.util.def +++ b/Makefile.util.def @@ -1213,6 +1213,18 @@ script = { common = tests/syslinux_test.in; }; +script = { + testcase = native; + name = luks1_test; + common = tests/luks1_test.in; +}; + +script = { + testcase = native; + name = luks2_test; + common = tests/luks2_test.in; +}; + program = { testcase = native; name = example_unit_test; diff --git a/tests/luks1_test.in b/tests/luks1_test.in new file mode 100644 index 000000000..cd28fd714 --- /dev/null +++ b/tests/luks1_test.in @@ -0,0 +1,23 @@ +#!@BUILD_SHEBANG@ + +set -e + +if [ "x$EUID" = "x" ] ; then + EUID=`id -u` +fi + +if [ "$EUID" != 0 ] ; then + exit 99 +fi + +if ! which mkfs.ext2 >/dev/null 2>&1; then + echo "mkfs.ext2 not installed; cannot test luks." + exit 99 +fi + +if ! which cryptsetup >/dev/null 2>&1; then + echo "cryptsetup not installed; cannot test luks." + exit 99 +fi + +"@builddir@/grub-fs-tester" luks1 diff --git a/tests/luks2_test.in b/tests/luks2_test.in new file mode 100644 index 000000000..6a26ba626 --- /dev/null +++ b/tests/luks2_test.in @@ -0,0 +1,23 @@ +#!@BUILD_SHEBANG@ + +set -e + +if [ "x$EUID" = "x" ] ; then + EUID=`id -u` +fi + +if [ "$EUID" != 0 ] ; then + exit 99 +fi + +if ! which mkfs.ext2 >/dev/null 2>&1; then + echo "mkfs.ext2 not installed; cannot test luks2." + exit 99 +fi + +if ! which cryptsetup >/dev/null 2>&1; then + echo "cryptsetup not installed; cannot test luks2." + exit 99 +fi + +"@builddir@/grub-fs-tester" luks2 diff --git a/tests/util/grub-fs-tester.in b/tests/util/grub-fs-tester.in index 43f6175c3..e488c0e41 100644 --- a/tests/util/grub-fs-tester.in +++ b/tests/util/grub-fs-tester.in @@ -6,6 +6,7 @@ export BLKID_FILE=/dev/null fs="$1" GRUBFSTEST="@builddir@/grub-fstest" +GRUBPROBE="@builddir@/grub-probe" tempdir=`mktemp -d "${TMPDIR:-/tmp}/${0##*/}.$(date '+%Y%m%d%H%M%S%N').${fs}.XXX"` || { echo "Failed to make temporary directory"; exit 99; } @@ -13,6 +14,8 @@ tempdir=`mktemp -d "${TMPDIR:-/tmp}/${0##*/}.$(date '+%Y%m%d%H%M%S%N').${fs}.XXX # xorriso -as mkisofs options to ignore locale when processing file names and # FSLABEL. This is especially needed for the conversion to Joliet UCS-2. XORRISOFS_CHARSET="-input-charset UTF-8 -output-charset UTF-8" +DMNAME="${tempdir##*/}" +PASS="${PASS:-pass}" MOUNTS= LODEVICES= @@ -28,6 +31,10 @@ cleanup() { umount "$i" || : done + if [ -e /dev/mapper/"$DMNAME" ]; then + cryptsetup close --disable-locks "$DMNAME" + fi + for lodev in $LODEVICES; do local i=600 while losetup -l -O NAME | grep -q "^$lodev\$"; do @@ -68,7 +75,12 @@ run_grubfstest () { need_images="$need_images $FSIMAGEP${i}.img"; done - run_it -c $NEED_IMAGES_N $need_images "$@" + case x"$fs" in + xluks*) + echo -n "$PASS" | run_it -C -c $NEED_IMAGES_N $need_images "$@";; + *) + run_it -c $NEED_IMAGES_N $need_images "$@";; + esac } # OS LIMITATION: GNU/Linux has no AFS support, so we use a premade image and a reference tar file. I.a. no multiblocksize test @@ -76,6 +88,8 @@ run_grubfstest () { MINLOGSECSIZE=9 MAXLOGSECSIZE=9 case x"$fs" in + xluks2) + MAXLOGSECSIZE=12;; xntfs*) MINLOGSECSIZE=8 MAXLOGSECSIZE=12;; @@ -363,7 +377,7 @@ for LOGSECSIZE in $(range "$MINLOGSECSIZE" "$MAXLOGSECSIZE" 1); do #FSLABEL="g;/_é莭莽😁кит u" ;; # FS LIMITATION: reiserfs, extN and jfs label is at most 16 UTF-8 characters - x"reiserfs_old" | x"reiserfs" | x"ext"* | x"lvm"* | x"mdraid"* | x"jfs" | x"jfs_caseins") + x"reiserfs_old" | x"reiserfs" | x"ext"* | x"lvm"* | x"luks"* | x"mdraid"* | x"jfs" | x"jfs_caseins") FSLABEL="g;/éт 莭😁";; # FS LIMITATION: No underscore, space, semicolon, slash or international characters in UFS* in label. Limited to 32 UTF-8 characters x"ufs1" | x"ufs1_sun" | x"ufs2") @@ -832,6 +846,12 @@ for LOGSECSIZE in $(range "$MINLOGSECSIZE" "$MAXLOGSECSIZE" 1); do MOUNTDEVICE="/dev/mapper/grub_test-testvol" MOUNTFS=ext2 "mkfs.ext2" -L "$FSLABEL" -q "${MOUNTDEVICE}" ;; + x"luks"*) + echo -n "$PASS" | cryptsetup luksFormat --type "$fs" --sector-size $SECSIZE --pbkdf pbkdf2 --disable-locks $LODEVICE + echo -n "$PASS" | cryptsetup open --disable-locks $LODEVICE "$DMNAME" + MOUNTDEVICE="/dev/mapper/${DMNAME}" + MOUNTFS=ext2 + "mkfs.ext2" -L "$FSLABEL" -q "${MOUNTDEVICE}" ;; xf2fs) "mkfs.f2fs" -l "$FSLABEL" -q "${MOUNTDEVICE}" ;; xnilfs2) @@ -944,6 +964,22 @@ for LOGSECSIZE in $(range "$MINLOGSECSIZE" "$MAXLOGSECSIZE" 1); do GRUBDEVICE="mduuid/`mdadm --detail --export $MOUNTDEVICE | grep MD_UUID=|sed 's,MD_UUID=,,g;s,:,,g'`";; xlvm*) GRUBDEVICE="lvm/grub_test-testvol";; + xluks*) + if test x"$fs" = xluks2 && ! (cryptsetup luksDump --debug-json --disable-locks $LODEVICE | grep -q "\"sector_size\":$SECSIZE"); then + echo "Unexpected sector size for $LODEVICE (expected: $SECSIZE)" + exit 1 + fi + + UUID=$(cryptsetup luksUUID --disable-locks $LODEVICE | tr -d '-') + PROBE_UUID=$("$GRUBPROBE" --device $MOUNTDEVICE --target=cryptodisk_uuid) + if [ x"$UUID" != x"$PROBE_UUID" ]; then + echo "UUID FAIL" + echo "$UUID" + echo "$PROBE_UUID" + exit 1 + fi + GRUBDEVICE="cryptouuid/${UUID}" + ;; esac GRUBDIR="($GRUBDEVICE)" case x"$fs" in @@ -1102,6 +1138,15 @@ for LOGSECSIZE in $(range "$MINLOGSECSIZE" "$MAXLOGSECSIZE" 1); do sleep 1 vgchange -a n grub_test ;; + xluks*) + for try in $(range 0 20 1); do + if umount "$MNTPOINTRW" ; then + break; + fi + done + UMOUNT_TIME=$(date -u "+%Y-%m-%d %H:%M:%S") + cryptsetup close --disable-locks "$DMNAME" + ;; xmdraid*) sleep 1 for try in $(range 0 20 1); do @@ -1152,6 +1197,11 @@ for LOGSECSIZE in $(range "$MINLOGSECSIZE" "$MAXLOGSECSIZE" 1); do mount -t "$MOUNTFS" "${MOUNTDEVICE}" "$MNTPOINTRO" -o ${MOUNTOPTS}${SELINUXOPTS}ro MOUNTS="$MOUNTS $MNTPOINTRO" ;; + xluks*) + echo -n "$PASS" | cryptsetup open --disable-locks $LODEVICE "$DMNAME" + mount -t "$MOUNTFS" "${MOUNTDEVICE}" "$MNTPOINTRO" -o ${MOUNTOPTS}${SELINUXOPTS}ro + MOUNTS="$MOUNTS $MNTPOINTRO" + ;; xmdraid*) mdadm --assemble /dev/md/"${fs}_$NDEVICES" $LODEVICES sleep 1 @@ -1600,6 +1650,9 @@ for LOGSECSIZE in $(range "$MINLOGSECSIZE" "$MAXLOGSECSIZE" 1); do vgchange -a n grub_test sleep 1 ;; + xluks*) + cryptsetup close --disable-locks "$DMNAME" + ;; esac case x"$fs" in x"tarfs" | x"cpio_"* | x"iso9660" | xrockridge | xjoliet | xrockridge_joliet | x"ziso9660" | x"romfs" | x"squash4_"* | x"iso9660_1999" | xrockridge_1999 | xjoliet_1999 | xrockridge_joliet_1999) ;; -- 2.34.1