From 3ed404e5bbc8f53968b0f542e8a4379b2f919d18 Mon Sep 17 00:00:00 2001 From: Ondrej Kozina Date: Thu, 29 Nov 2018 13:51:10 +0100 Subject: [PATCH] Add validation tests for non-default metadata. --- ...luks2-metadata-size-64k-inv-area-c0.img.sh | 94 ++++++++++++++++++ ...luks2-metadata-size-64k-inv-area-c1.img.sh | 96 +++++++++++++++++++ ...adata-size-64k-inv-keyslots-size-c0.img.sh | 96 +++++++++++++++++++ tests/luks2-validation-test | 3 + 4 files changed, 289 insertions(+) create mode 100755 tests/generators/generate-luks2-metadata-size-64k-inv-area-c0.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-64k-inv-area-c1.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-64k-inv-keyslots-size-c0.img.sh diff --git a/tests/generators/generate-luks2-metadata-size-64k-inv-area-c0.img.sh b/tests/generators/generate-luks2-metadata-size-64k-inv-area-c0.img.sh new file mode 100755 index 00000000..16e2078a --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-64k-inv-area-c0.img.sh @@ -0,0 +1,94 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with non-default metadata json_size +# and keyslots area trespassing in json area. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 64KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_64K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024-1)) + # overlap in json area by exactly one byte + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024-1)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-64k-inv-area-c1.img.sh b/tests/generators/generate-luks2-metadata-size-64k-inv-area-c1.img.sh new file mode 100755 index 00000000..7ff670b9 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-64k-inv-area-c1.img.sh @@ -0,0 +1,96 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with non-default metadata json_size +# and keyslot area overflowing out of keyslots area. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 64KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_64K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + --arg mda $((2*TEST_MDA_SIZE_BYTES)) \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .keyslots."7".area.offset = ( ((.config.keyslots_size | tonumber) + ($mda | tonumber) - (.keyslots."7".area.size | tonumber) + 1) | tostring ) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 $TEST_JSN_SIZE +# .keyslots.7.area.offset = ( ((.config.keyslots_size | tonumber) + ($mda | tonumber) - (.keyslots.7.area.size | tonumber) + 1) | tostring ) | + jq -c --arg mda $((2*TEST_MDA_SIZE_BYTES)) --arg jsize $JSON_SIZE \ + 'if (.keyslots."7".area.offset != ( ((.config.keyslots_size | tonumber) + ($mda | tonumber) - (.keyslots."7".area.size | tonumber) + 1) | tostring )) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-64k-inv-keyslots-size-c0.img.sh b/tests/generators/generate-luks2-metadata-size-64k-inv-keyslots-size-c0.img.sh new file mode 100755 index 00000000..8f3d8d7a --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-64k-inv-keyslots-size-c0.img.sh @@ -0,0 +1,96 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary with predefined json_size where keyslots size +# overflows in data area (segment offset) +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 64KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_64K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + --arg mda $((2*TEST_MDA_SIZE_BYTES)) \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .config.keyslots_size = (((($off | tonumber) - ($mda | tonumber) + 4096)) | tostring ) | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE --arg off $DATA_OFFSET --arg mda $((2*TEST_MDA_SIZE_BYTES)) \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) or + (.config.keyslots_size != (((($off | tonumber) - ($mda | tonumber) + 4096)) | tostring )) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/luks2-validation-test b/tests/luks2-validation-test index fe3f2738..1f13aaee 100755 --- a/tests/luks2-validation-test +++ b/tests/luks2-validation-test @@ -207,6 +207,9 @@ RUN luks2-invalid-json-size-c1.img "F" "Failed to detect invalid json_size con RUN luks2-invalid-json-size-c2.img "F" "Failed to detect mismatching json size in config and binary hdr" RUN luks2-metadata-size-32k.img "R" "Valid 32KiB metadata size failed to validate" RUN luks2-metadata-size-64k.img "R" "Valid 64KiB metadata size failed to validate" +RUN luks2-metadata-size-64k-inv-area-c0.img "F" "Failed to detect keyslot area trespassing in json area" +RUN luks2-metadata-size-64k-inv-area-c1.img "F" "Failed to detect keyslot area overflowing keyslots area" +RUN luks2-metadata-size-64k-inv-keyslots-size-c0.img "F" "Failed to detect keyslots size overflowing in data area" RUN luks2-metadata-size-128k.img "R" "Valid 128KiB metadata size failed to validate" RUN luks2-metadata-size-256k.img "R" "Valid 256KiB metadata size failed to validate" RUN luks2-metadata-size-512k.img "R" "Valid 512KiB metadata size failed to validate"