eessppeelllloo/cryptsetup
1
0
Fork 0
mirror of https://gitlab.com/cryptsetup/cryptsetup.git synced 2025-12-05 16:00:05 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
8a3e16fa25924dd5cd6ad4977419e09295f7cf41
cryptsetup/tests/verity-compat-test
Milan Broz 8a3e16fa25 tests: Avoid verity concurrent test failure on device node check 
This regularly crashes on Alpine Linux that use some strange
configuration.
Udev settle seems to help, despite it should be noop on recent systems...
2025-11-21 14:29:38 +01:00

620 lines
22 KiB
Bash
Executable File
Raw Blame History

#!/bin/bash
[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".."
VERITYSETUP=$CRYPTSETUP_PATH/veritysetup
if [ -n "$CRYPTSETUP_TESTS_RUN_IN_MESON" ]; then
VERITYSETUP_VALGRIND=$VERITYSETUP
else
VERITYSETUP_VALGRIND=../.libs/veritysetup
VERITYSETUP_LIB_VALGRIND=../.libs
fi
DEV_NAME=verity3273
DEV_NAME2=verity3273x
DEV_OUT="$DEV_NAME.out"
IMG=verity-data
IMG_HASH=verity-hash
IMG_TMP=tst-dev
FEC_DEV=tst_fec123
# If we need deterministic image creation
DEV_SALT=9e7457222290f1bac0d42ad2de2d602a87bb871c22ab70ca040bad450578a436
DEV_UUID=a60c98d2-ae9b-4865-bfcb-b4e3ace11033
remove_mapping()
{
[ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove $DEV_NAME2 >/dev/null 2>&1
[ -b /dev/mapper/$DEV_NAME ] && dmsetup remove $DEV_NAME >/dev/null 2>&1
[ ! -z "$LOOPDEV1" ] && losetup -d $LOOPDEV1 >/dev/null 2>&1
rm -f $IMG $IMG.roothash $IMG_HASH $DEV_OUT $FEC_DEV $IMG_TMP >/dev/null 2>&1
LOOPDEV1=""
LOOPDEV2=""
}
fail()
{
[ -n "$1" ] && echo "$1"
echo "FAILED backtrace:"
while caller $frame; do ((frame++)); done
[ -f $DEV_OUT ] && cat $DEV_OUT
remove_mapping
exit 2
}
_sigchld() { local c=$?; [ $c -eq 139 ] && fail "Segfault"; [ $c -eq 134 ] && fail "Aborted"; }
trap _sigchld CHLD
skip()
{
[ -n "$1" ] && echo "$1"
exit 77
}
prepare() # $1 dev1_siz [$2 dev2_size]
{
remove_mapping
dd if=/dev/zero of=$IMG bs=1k count=$1 >/dev/null 2>&1
LOOPDEV1=$(losetup -f 2>/dev/null)
[ -z "$LOOPDEV1" ] && fail "No free loop device"
losetup $LOOPDEV1 $IMG
[ -z "$2" ] && return
LOOPDEV2=$IMG_HASH
}
wipe()
{
dd if=/dev/zero of=$LOOPDEV1 bs=256k >/dev/null 2>&1
rm -f $IMG_HASH $DEV_OUT >/dev/null 2>&1
}
check_exists()
{
[ -b /dev/mapper/$DEV_NAME ] || fail
}
check_version() # MAJ MIN
{
VER_STR=$(dmsetup targets | grep verity | cut -f 3 -dv)
[ -z "$VER_STR" ] && fail "Failed to parse dm-verity version."
VER_MAJ=$(echo $VER_STR | cut -f 1 -d.)
VER_MIN=$(echo $VER_STR | cut -f 2 -d.)
test $VER_MAJ -gt $1 && return 0
test $VER_MAJ -lt $1 && return 1
test $VER_MIN -ge $2 && return 0
return 1
}
check_version_kernel()
{
KER_STR=$(uname -r)
[ -z "$KER_STR" ] && fail "Failed to parse kernel version."
KER_MAJ=$(echo $KER_STR | cut -f 1 -d.)
KER_MIN=$(echo $KER_STR | cut -f 2 -d.)
test $KER_MAJ -gt $1 && return 0
test $KER_MAJ -lt $1 && return 1
test $KER_MIN -ge $2 && return 0
return 1
}
compare_out() # $1 what, $2 expected
{
OPT=$(grep -v "^#" $DEV_OUT | grep -i "$1" | sed -e s/.*\:\ // )
[ -z "$OPT" ] && fail
[ $OPT != $2 ] && fail "$1 differs ($2)"
}
check_root_hash_fail()
{
echo -n "Root hash check "
ROOT_HASH=$($VERITYSETUP format $IMG $IMG_HASH --fec-device $FEC_DEV --fec-roots 2 -h sha256 | grep -e "Root hash" | cut -d: -f2 | tr -d "\t\n ")
ROOT_HASH_BAD=abcdef0000000000000000000000000000000000000000000000000000000000
$VERITYSETUP verify $IMG $IMG_HASH $ROOT_HASH || fail
$VERITYSETUP verify $IMG $IMG_HASH $ROOT_HASH_BAD >/dev/null 2>&1 && fail
$VERITYSETUP verify $IMG $IMG_HASH $ROOT_HASH_BAD --fec-device $FEC_DEV --fec-roots 2 >/dev/null 2>&1 && fail
$VERITYSETUP open $IMG $DEV_NAME $IMG_HASH $ROOT_HASH || fail
check_exists
dd if=/dev/mapper/$DEV_NAME of=/dev/null bs=4096 count=1 >/dev/null 2>&1
dmsetup status $DEV_NAME | grep "verity V" >/dev/null || fail
$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail
$VERITYSETUP open $IMG $DEV_NAME $IMG_HASH $ROOT_HASH_BAD >/dev/null 2>&1 || fail
check_exists
dd if=/dev/mapper/$DEV_NAME of=/dev/null bs=4096 count=1 >/dev/null 2>&1
dmsetup status $DEV_NAME | grep "verity C" >/dev/null || fail
$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail
echo "[OK]"
}
check_root_hash() # $1 size, $2 hash, $3 salt, $4 version, $5 hash, [$6 offset]
{
local FORMAT_PARAMS
local VERIFY_PARAMS
local ROOT_HASH
if [ -z "$LOOPDEV2" ] ; then
BLOCKS=$(($6 / $1))
DEV_PARAMS="$LOOPDEV1 $LOOPDEV1 \
--hash-offset $6 \
--data-blocks=$BLOCKS --debug"
else
DEV_PARAMS="$LOOPDEV1 $LOOPDEV2"
fi
for root_hash_as_file in yes no; do
for sb in yes no; do
FORMAT_PARAMS="--format=$4 --data-block-size=$1 --hash-block-size=$1 --hash=$5 --salt=$3"
if [ $sb == yes ] ; then
VERIFY_PARAMS=""
else
FORMAT_PARAMS="$FORMAT_PARAMS --no-superblock"
VERIFY_PARAMS=$FORMAT_PARAMS
fi
if [ $root_hash_as_file == yes ] ; then
echo -n $2 > $IMG.roothash
FORMAT_PARAMS="$FORMAT_PARAMS --root-hash-file=$IMG.roothash"
VERIFY_PARAMS="$VERIFY_PARAMS --root-hash-file=$IMG.roothash"
ROOT_HASH=""
else
ROOT_HASH="$2"
fi
for fail in data hash; do
wipe
echo -n "V$4(sb=$sb root_hash_as_file=$root_hash_as_file) $5 block size $1: "
$VERITYSETUP format $DEV_PARAMS $FORMAT_PARAMS >$DEV_OUT
if [ $? -ne 0 ] ; then
if [[ $1 =~ "sha2" ]] ; then
fail "Cannot format device."
fi
return
fi
echo -n "[root hash]"
compare_out "root hash" $2
compare_out "salt" "$3"
$VERITYSETUP verify $DEV_PARAMS $VERIFY_PARAMS $ROOT_HASH >>$DEV_OUT 2>&1 || fail
echo -n "[verify]"
$VERITYSETUP create $DEV_NAME $DEV_PARAMS $VERIFY_PARAMS $ROOT_HASH >>$DEV_OUT 2>&1 || fail
check_exists
echo -n "[activate]"
dd if=/dev/mapper/$DEV_NAME of=/dev/null bs=$1 2>/dev/null
dmsetup status $DEV_NAME | grep "verity V" >/dev/null || fail
echo -n "[in-kernel verify]"
$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail
case $fail in
data)
dd if=/dev/urandom of=$LOOPDEV1 bs=1 seek=3456 count=8 conv=notrunc 2>/dev/null
TXT="data_dev"
;;
hash)
if [ -z "$LOOPDEV2" ] ; then
dd if=/dev/urandom of=$LOOPDEV1 bs=1 seek=$((8193 + $4)) count=8 conv=notrunc 2>/dev/null
else
dd if=/dev/urandom of=$LOOPDEV2 bs=1 seek=8193 count=8 conv=notrunc 2>/dev/null
fi
TXT="hash_dev"
;;
esac
$VERITYSETUP verify $DEV_PARAMS $VERIFY_PARAMS $ROOT_HASH >>$DEV_OUT 2>&1 && \
fail "userspace check for $TXT corruption"
$VERITYSETUP create $DEV_NAME $DEV_PARAMS $VERIFY_PARAMS $ROOT_HASH >>$DEV_OUT 2>&1 || \
fail "activation"
dd if=/dev/mapper/$DEV_NAME of=/dev/null bs=$1 2>/dev/null
dmsetup status $DEV_NAME | grep "verity V" >/dev/null && \
fail "in-kernel check for $TXT corruption"
$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail "deactivation"
echo "[$TXT corruption]"
done
done
done
}
corrupt_device() # $1 device, $2 device_size(in bytes), $3 #{corrupted_bytes}
{
# Repeatable magic corruption :-)
CORRUPT=$3
RANDOM=43
while [ "$CORRUPT" -gt 0 ]; do
SEEK=$RANDOM
while [ $SEEK -ge $2 ] ; do SEEK=$RANDOM; done
echo -n -e "\x55" | dd of=$1 bs=1 count=1 seek=$SEEK conv=notrunc > /dev/null 2>&1
CORRUPT=$(($CORRUPT - 1))
done
}
# $1 data_device, $2 hash_device, $3 fec_device, $4 data/hash_block_size(in bytes),
# $5 data_size(in blocks), $6 device_size(in blocks), $7 hash_offset(in bytes),
# $8 fec_offset(in bytes), $9 fec_roots, ${10} corrupted_bytes, [${11} superblock(y/n), ${12} salt]
# NOTE: do not use fail() in this function, use RET code
check_fec()
{
INDEX=25
dd if=/dev/zero of=$1 bs=$4 count=$6 > /dev/null 2>&1
echo -n "Block_size: $4, Data_size: $(($4 * $5))B, FEC_roots: $9, Corrupted_bytes: ${10} "
PARAMS=" --data-block-size=$4 --hash-block-size=$4 "
if [ "$5" -ne "$6" ]; then
PARAMS="$PARAMS --data-blocks=$5"
fi
if [ "$7" -ne 0 ]; then
PARAMS="$PARAMS --hash-offset=$7"
fi
if [ "$8" -ne 0 ]; then
PARAMS="$PARAMS --fec-offset=$8"
fi
if [ "${11}" == "n" ]; then
INDEX=24
echo -n "[no-superblock]"
PARAMS="$PARAMS --no-superblock --salt=${12}"
elif [ -n "${12}" ]; then
PARAMS="$PARAMS --salt=${12}"
fi
if [[ "$1" == "$2" && "$1" == "$3" ]]; then
echo -n "[one_device_test]"
dd if=/dev/zero of=$IMG_TMP bs=$4 count=$5 > /dev/null 2>&1
HASH_ORIG=$(sha256sum $IMG_TMP | cut -d' ' -f 1)
else
HASH_ORIG=$(sha256sum $1 | cut -d' ' -f 1)
fi
ROOT_HASH=$($VERITYSETUP format $1 $2 --fec-device=$3 $PARAMS | grep -e "Root hash" | cut -d: -f2 | tr -d "\t\n ")
corrupt_device $1 $(($5 * $4)) ${10}
$VERITYSETUP create $DEV_NAME $1 $2 $ROOT_HASH --fec-device=$3 $PARAMS > /dev/null 2>&1
if [ "$?" -ne "0" ] ; then
echo "[N/A, test skipped]"
return 3
fi
udevadm settle > /dev/null 2>&1
dd if=/dev/mapper/$DEV_NAME of=$IMG_TMP > /dev/null 2>&1
HASH_REPAIRED=$(sha256sum $IMG_TMP | cut -d' ' -f 1)
# If empty, status not supported
REPAIRED=$(dmsetup status $DEV_NAME |sed -e s/.*verity\ \[VC\]\ *//)
if [ -n "$REPAIRED" -a "$REPAIRED" != "-" ] ; then
echo -n "[EC events: $REPAIRED]"
else
REPAIRED=""
fi
$VERITYSETUP close $DEV_NAME
if [ "$HASH_ORIG" != "$HASH_REPAIRED" ]; then
RET=1
if [ -n "$REPAIRED" ]; then
[ "$REPAIRED" -eq 0 ] || { RET=4; echo "FEC repaired events should be 0."; }
fi
echo -n "[kernel correction failed]"
$VERITYSETUP verify $1 $2 $ROOT_HASH --fec-device=$3 $PARAMS >/dev/null 2>&1 && { RET=5; echo "Userspace verify should fail"; }
echo -n "[userspace verify failed]"
else
RET=0
echo -n "[repaired in kernel]"
if [ -n "$REPAIRED" ]; then
[ "$REPAIRED" -gt 0 ] || { RET=4; echo "FEC repaired events should be greater than 0."; }
fi
$VERITYSETUP verify $1 $2 $ROOT_HASH --fec-device=$3 $PARAMS >/dev/null 2>&1 || { RET=5; echo "Userspace verify failed"; }
echo "[userspace verify][OK]"
fi
rm $1 $2 $3 $IMG_TMP > /dev/null 2>&1
return $RET
}
check_option() # $1 size, $2 hash, $3 salt, $4 version, $5 hash, $6 status option, $7-$8 CLI options
{
DEV_PARAMS="$LOOPDEV1 $LOOPDEV2"
FORMAT_PARAMS="--format=$4 --data-block-size=$1 --hash-block-size=$1 --hash=$5 --salt=$3"
echo -n "Option $7 / $6 "
$VERITYSETUP format $DEV_PARAMS $FORMAT_PARAMS >/dev/null 2>&1 || fail
$VERITYSETUP create $DEV_NAME $DEV_PARAMS $2 $7 $8 >/dev/null 2>&1 || fail
check_exists
$VERITYSETUP status $DEV_NAME 2>/dev/null | grep flags | grep -q $6 || fail
dmsetup table $DEV_NAME 2>/dev/null | grep -q $6 || fail
$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail
echo "[OK]"
}
valgrind_setup()
{
command -v valgrind >/dev/null || fail "Cannot find valgrind."
[ ! -f $VERITYSETUP_VALGRIND ] && fail "Unable to get location of veritysetup executable."
[ ! -f valg.sh ] && fail "Unable to get location of valg runner script."
if [ -z "$CRYPTSETUP_TESTS_RUN_IN_MESON" ]; then
export LD_LIBRARY_PATH="$VERITYSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH"
fi
}
valgrind_run()
{
INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${VERITYSETUP_VALGRIND} "$@"
}
checkOffsetBug() # $1 size, $2 hash-offset, $3 data-blocks
{
echo -n "Size :: $1 B | Hash-offset :: $2 blocks | Data-blocks :: $3 "
dd if=/dev/zero of=$IMG bs=1 count=0 seek=$1 >/dev/null 2>&1
$VERITYSETUP --data-blocks=$3 --hash-offset=$2 format $IMG $IMG >/dev/null 2>&1 || fail "Test [hash-offset greater than 2G] failed"
echo "[OK]"
remove_mapping
}
checkOverlapBug() # $1 size, $2 hash-offset, $3 data-blocks, $4 block_size, $5 fec_offset
{
echo -n "Device-size :: $1 B | "
[ $# -ge 3 ] && echo -n "Data-blocks :: $3 blocks| "
[ $# -lt 3 ] && echo -n "Data-blocks :: whole device | "
[ $# -ge 4 ] && echo -n "Block-size :: $4 B | "
[ $# -lt 4 ] && echo -n "Block-size :: 4096 B | "
echo -n "Hash-offset :: $2 B | "
dd if=/dev/zero of=$IMG bs=1 count=0 seek=$1 >/dev/null 2>&1
if [ -z $3 ] ; then
# veritysetup must fail
$VERITYSETUP --hash-offset=$2 format $IMG $IMG >/dev/null 2>&1 && fail "Test [overlap with option \"--data-blocks\" not entered] failed"
else
$VERITYSETUP --data-block-size=$4 --hash-block-size=$4 --data-blocks=$3 --hash-offset=$2 format $IMG $IMG >/dev/null 2>&1
RET=$?
[ "$3" -gt "$(($2 / $4))" ] && [ "$RET" -eq "0" ] && fail "Test [overlap - hash-offset in data area] failed"
fi
if [ $# -eq 5 ] ; then
echo -n "FEC-offset :: $5 B | "
PARAMS="--data-block-size=$4 --hash-block-size=$4 --data-blocks=$3 --fec-device=$IMG --fec-offset=$5"
# test data-fec area overlap
$VERITYSETUP format $IMG $IMG_HASH $PARAMS >/dev/null 2>&1
RET=$?
[ "$(($3*$4))" -gt "$5" ] && [ "$RET" -eq "0" ] && fail "Test [data/fec area overlap] failed"
HASH_SIZE=$(stat --printf="%s" $IMG_HASH)
# test hash-fec area overlap
$VERITYSETUP format $IMG $IMG $PARAMS --hash-offset=$2 >/dev/null 2>&1
RET=$?
[ "$(($2 + $HASH_SIZE))" -gt "$5" ] && [ "$RET" -eq "0" ] && fail "Test [hash/fec area overlap] failed"
fi
echo "[OK]"
remove_mapping
}
# $1 size, $2 block size, $3 roots, $4 hash offset, $5 fec offset,
# $6 one dev(1 - one device, 2 - one device for data and hash, one device for fec data, 3 - three separate devices),
# $7 #{corrupted bytes}
checkUserSpaceRepair()
{
BS=512
COUNT=50000
dd if=/dev/zero of=$IMG bs=$BS count=$COUNT >/dev/null 2>&1
PARAMS="--data-block-size=$2 --hash-block-size=$2 --fec-roots=$3"
[ "$1" -gt 0 ] && PARAMS="$PARAMS --data-blocks=$1" && BS=$2 && COUNT=$1
# different parameters for different number of devices
[ "$6" -eq 1 ] && HASH_DEV=$IMG && FEC=$IMG && PARAMS="$PARAMS --hash-offset=$4 --fec-offset=$5" && echo -n "[One device]"
[ "$6" -eq 2 ] && HASH_DEV=$IMG && FEC=$FEC_DEV && PARAMS="$PARAMS --hash-offset=$4" && echo -n "[Two separate data/hash and fec devices]"
[ "$6" -eq 3 ] && HASH_DEV=$IMG_HASH && FEC=$FEC_DEV && echo -n "[Three separate devices]"
echo -n "[nroots::$3]"
ROOT_HASH=$($VERITYSETUP format $IMG $HASH_DEV --fec-device $FEC $PARAMS --salt=$DEV_SALT --uuid=$DEV_UUID | grep -e "Root hash" | cut -d: -f2 | tr -d "\t\n ")
echo -n "[Errors can be corrected]"
corrupt_device $IMG $(($BS*$COUNT)) $7
$VERITYSETUP verify $IMG $HASH_DEV $ROOT_HASH --fec-device=$FEC $PARAMS >/dev/null 2>&1
RET=$?
[ "$RET" -ne 0 ] && fail "Device can be corrected, but it wasn't."
echo -n "[OK]"
echo -n "[Errors cannot be corrected]"
dd if=/dev/urandom of=$IMG bs=$BS count=$COUNT conv=notrunc >/dev/null 2>&1
$VERITYSETUP verify $IMG $HASH_DEV $ROOT_HASH --fec-device=$FEC $PARAMS >/dev/null 2>&1
RET=$?
[ "$RET" -eq 0 ] && fail "Device cannot be correct, but it didn't fail."
echo "[OK]"
}
check_concurrent() # $1 hash
{
DEV_PARAMS="$LOOPDEV1 $LOOPDEV2"
# First check that with two sequential opens, we are returning the expected -EEXIST
$VERITYSETUP format $DEV_PARAMS >/dev/null 2>&1 || fail
$VERITYSETUP create $DEV_NAME $DEV_PARAMS $1 >/dev/null 2>&1 || fail
check_exists
$VERITYSETUP create $DEV_NAME $DEV_PARAMS $1 2>&1 >/dev/null | grep -q "Device $DEV_NAME already exists" || fail
$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail
# Then do two concurrent opens, and check that libdevmapper did not return -EINVAL, which is
# not gracefully recoverable. Either could fail depending on scheduling, so just check that
# the libdevmapper error does not appear in either of the outputs.
cat /dev/null >$DEV_OUT
$VERITYSETUP create -v --shared $DEV_NAME $DEV_PARAMS $1 >>$DEV_OUT 2>&1 &
$VERITYSETUP create -v --shared $DEV_NAME $DEV_PARAMS $1 >>$DEV_OUT 2>&1 &
wait
grep -q "Command failed with code .* (wrong or missing parameters)" $DEV_OUT && fail
grep -q "Command failed with code .* (wrong device or file specified)." $DEV_OUT && fail
# Some distros have strange udev rules, settle here seems to be necessary
udevadm settle >/dev/null 2>&1
check_exists
rm $DEV_OUT
$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail
echo "[OK]"
}
export LANG=C
[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
[ ! -x "$VERITYSETUP" ] && skip "Cannot find $VERITYSETUP, test skipped."
[ -n "$VALG" ] && valgrind_setup && VERITYSETUP=valgrind_run
modprobe dm-verity >/dev/null 2>&1
dmsetup targets | grep verity >/dev/null 2>&1 || skip "Cannot find dm-verity target, test skipped."
# VERITYSETUP tests
SALT=e48da609055204e89ae53b655ca2216dd983cf3cb829f34f63a297d106d53e2d
echo "Verity tests [separate devices]"
prepare 8192 1024
check_root_hash_fail
check_root_hash 512 9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174 $SALT 1 sha256
check_root_hash 1024 54d92778750495d1f80832b486ebd007617d746271511bbf0e295e143da2b3df $SALT 1 sha256
check_root_hash 4096 e522df0f97da4febb882ac40f30b37dc0b444bf6df418929463fa25280f09d5c $SALT 1 sha256
# version 0
check_root_hash 4096 cbbf4ebd004ef65e29b935bb635a39cf754d677f3fa10b0126da725bbdf10f7d $SALT 0 sha256
# no salt
check_root_hash 4096 ef29c902d87350f1da4bfa536e16cebc162a909bf89abe448b81ec500d4fb9bf - 1 sha256
# sha1
check_root_hash 1024 d0e9163ca8844aaa2e88fe5265a8c5d9ee494a99 $SALT 1 sha1
check_root_hash 1024 73509e8e868be6b8ac939817a98a3d35121413b2 dadada 1 sha1
echo "Verity tests [one device offset]"
prepare $((8192 + 1024))
check_root_hash 512 9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174 $SALT 1 sha256 8388608
check_root_hash 1024 54d92778750495d1f80832b486ebd007617d746271511bbf0e295e143da2b3df $SALT 1 sha256 8388608
check_root_hash 4096 e522df0f97da4febb882ac40f30b37dc0b444bf6df418929463fa25280f09d5c $SALT 1 sha256 8388608
# version 0
check_root_hash 4096 cbbf4ebd004ef65e29b935bb635a39cf754d677f3fa10b0126da725bbdf10f7d $SALT 0 sha256 8388608
# no salt
check_root_hash 4096 ef29c902d87350f1da4bfa536e16cebc162a909bf89abe448b81ec500d4fb9bf - 1 sha256 8388608
# sha1
check_root_hash 1024 d0e9163ca8844aaa2e88fe5265a8c5d9ee494a99 $SALT 1 sha1 8388608
check_root_hash 1024 73509e8e868be6b8ac939817a98a3d35121413b2 dadada 1 sha1 8388608
if check_version 1 3; then
echo "Verity data corruption options test."
SALT=e48da609055204e89ae53b655ca2216dd983cf3cb829f34f63a297d106d53e2d
HASH=9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174
prepare 8192 1024
check_option 512 $HASH $SALT 1 sha256 ignore_corruption --ignore-corruption
check_option 512 $HASH $SALT 1 sha256 restart_on_corruption --restart-on-corruption
check_option 512 $HASH $SALT 1 sha256 ignore_zero_blocks --ignore-zero-blocks
check_option 512 $HASH $SALT 1 sha256 ignore_corruption --ignore-corruption --ignore-zero-blocks
if check_version 1 4; then
check_option 512 $HASH $SALT 1 sha256 check_at_most_once --check-at-most-once
fi
if check_version 1 7; then
check_option 512 $HASH $SALT 1 sha256 panic_on_corruption --panic-on-corruption
fi
if check_version_kernel 6 12; then # dm-verity 1.10+ but they forget bump version
check_option 512 $HASH $SALT 1 sha256 panic_on_error --error-as-corruption --panic-on-corruption
check_option 512 $HASH $SALT 1 sha256 restart_on_error --error-as-corruption --restart-on-corruption
fi
if check_version 1 9; then
echo "Verity data performance options test."
check_option 512 $HASH $SALT 1 sha256 try_verify_in_tasklet --use-tasklets
fi
fi
echo "Veritysetup [hash-offset bigger than 2G works] "
checkOffsetBug 3000000000 2499997696 256
checkOffsetBug 10000000000 8000000000 128
echo "Veritysetup [overlap-detection] "
checkOverlapBug 2097152 1433600
checkOverlapBug 2097152 1433600 350 4096
checkOverlapBug 2097152 1228800 350 4096 # data-hash overlap
checkOverlapBug 2097152 0 350 4096 1228800 # data-fec overlap
checkOverlapBug 10240000 256000 400 512 256512 # hash-fec overlap
if check_version 1 3; then
echo "Veritysetup [FEC tests]"
for INDEX in {1..4}; do
# in the first iteration check if we can use FEC (it can be compiled-out)
(check_fec $IMG $IMG $IMG 4096 30 150 163840 409600 $(($RANDOM % 23 + 2)) $(($INDEX * 4)))
RET=$?
[ "$RET" -eq 3 ] && break
[ "$RET" -eq 0 ] || fail "FEC repair failed"
(check_fec $IMG $IMG $IMG 512 500 50000 2457600 4915200 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'n' $SALT) || fail "FEC repair failed"
(check_fec $IMG $IMG $IMG 512 500 50000 2457600 4915200 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'y' $SALT) || fail "FEC repair failed"
(check_fec $IMG $IMG $IMG 4096 64 6250 4194304 8388608 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'n' $SALT) || fail "FEC repair failed"
(check_fec $IMG $IMG $IMG 4096 64 6250 4194304 8388608 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'y' $SALT) || fail "FEC repair failed"
(check_fec $IMG $IMG_HASH $FEC_DEV 4096 30 30 0 0 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'n' $SALT) || fail "FEC repair failed"
(check_fec $IMG $IMG_HASH $FEC_DEV 4096 35 35 0 0 $(($RANDOM % 23 + 2)) $(($INDEX * 4))) || fail "FEC repair failed"
(check_fec $IMG $IMG_HASH $FEC_DEV 512 2000 2000 0 0 $(($RANDOM % 23 + 2)) $(($INDEX * 4))) || fail "FEC repair failed"
(check_fec $IMG $IMG_HASH $FEC_DEV 1024 2000 2000 0 0 $(($RANDOM % 23 + 2)) $(($INDEX * 4))) || fail "FEC repair failed"
# this test should fail
(check_fec $IMG $IMG_HASH $FEC_DEV 4096 30 30 0 0 $(($RANDOM % 23 + 2)) $(($RANDOM % 200 + 200)))
RET=$?
[ "$RET" -eq 1 ] || fail "FEC repair must fail"
echo "[OK]"
done
fi
echo "Correction in userspace: "
# checkUserSpaceRepair <#blocks> <block_size> <roots> <hash_offset> <fec_offset> <#devices> <#corrupted bytes>
checkUserSpaceRepair -1 512 2 0 0 3 100
checkUserSpaceRepair 400 512 2 256000 0 2 50
checkUserSpaceRepair 500 512 2 2457600 4915200 1 1
checkUserSpaceRepair -1 4096 2 0 0 3 10
checkUserSpaceRepair 400 4096 2 2048000 0 2 1
checkUserSpaceRepair 500 4096 2 2457600 4915200 1 2
echo -n "Verity concurrent opening tests:"
prepare 8192 1024
check_concurrent 9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174
echo -n "Deferred removal of device:"
prepare 8192 1024
$VERITYSETUP format $LOOPDEV1 $IMG_HASH --format=1 --data-block-size=512 --hash-block-size=512 --hash=sha256 --salt=$SALT >/dev/null 2>&1 || fail "Cannot format device."
$VERITYSETUP open $LOOPDEV1 $DEV_NAME $DEV $IMG_HASH 9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174 || fail "Cannot activate device."
dmsetup create $DEV_NAME2 --table "0 8 linear /dev/mapper/$DEV_NAME 0"
[ ! -b /dev/mapper/$DEV_NAME2 ] && fail
$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 && fail
$VERITYSETUP status $DEV_NAME >/dev/null 2>&1 || fail
$VERITYSETUP close --deferred $DEV_NAME >/dev/null 2>&1
if [ $? -eq 0 ] ; then
dmsetup info $DEV_NAME | grep -q "DEFERRED REMOVE" || fail
$VERITYSETUP close --cancel-deferred $DEV_NAME >/dev/null 2>&1
dmsetup info $DEV_NAME | grep -q "DEFERRED REMOVE" >/dev/null 2>&1 && fail
$VERITYSETUP close --deferred $DEV_NAME >/dev/null 2>&1
dmsetup remove $DEV_NAME2 || fail
$VERITYSETUP status $DEV_NAME >/dev/null 2>&1 && fail
echo "[OK]"
else
dmsetup remove $DEV_NAME2 >/dev/null 2>&1
$VERITYSETUP close $DEV_NAME >/dev/null 2>&1
echo "[N/A]"
fi
echo -n "Early check for active name:"
prepare 8192 1024
DM_BAD_NAME=x/x
DM_LONG_NAME=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
$VERITYSETUP format $LOOPDEV1 $IMG_HASH --format=1 --data-block-size=512 --hash-block-size=512 --hash=sha256 --salt=$SALT >/dev/null 2>&1 || fail "Cannot format device."
$VERITYSETUP open $LOOPDEV1 $DM_BAD_NAME $DEV $IMG_HASH 9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174 2>/dev/null && fail
$VERITYSETUP open $LOOPDEV1 $DM_LONG_NAME $DEV $IMG_HASH 9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174 2>/dev/null && fail
echo "[OK]"
remove_mapping
exit 0
Reference in New Issue View Git Blame Copy Permalink