Skip to content

Commit f6b5e4b

Browse files
prestistprestist
authored
Merge pull request #1685 from prestist/luks-blackbox-tests
Luks blackbox tests
2 parents f4e1952 + 6278609 commit f6b5e4b

File tree

4 files changed

+192
-1
lines changed

4 files changed

+192
-1
lines changed

‎tests/blackbox_test.go

+26-1
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,15 @@ import (
1919
"flag"
2020
"fmt"
2121
"os"
22+
"os/exec"
2223
"os/signal"
2324
"path/filepath"
2425
"strings"
2526
"testing"
2627
"time"
2728

2829
"github.com/coreos/ignition/v2/config"
30+
"github.com/coreos/ignition/v2/internal/exec/util"
2931
"github.com/coreos/ignition/v2/tests/register"
3032
"github.com/coreos/ignition/v2/tests/servers"
3133
"github.com/coreos/ignition/v2/tests/types"
@@ -259,13 +261,20 @@ func outer(t *testing.T, test types.Test, negativeTests bool) error {
259261
// If we're not expecting the config to be bad, make sure it passes
260262
// validation.
261263
if !test.ConfigShouldBeBad {
262-
_, rpt, err := config.Parse([]byte(test.Config))
264+
renderedConfig, rpt, err := config.Parse([]byte(test.Config))
263265
if rpt.IsFatal() {
264266
return fmt.Errorf("test has bad config: %s", rpt.String())
265267
}
266268
if err != nil {
267269
return fmt.Errorf("error parsing config: %v", err)
268270
}
271+
defer func() {
272+
for _, luks := range renderedConfig.Storage.Luks {
273+
if err := removeLuksDevice(luks.Name); err != nil {
274+
t.Error(fmt.Errorf("failed to remove existing LUKS device %s: %v", luks.Name, err))
275+
}
276+
}
277+
}()
269278
}
270279

271280
// Ignition config
@@ -347,3 +356,19 @@ func outer(t *testing.T, test types.Test, negativeTests bool) error {
347356
return fmt.Errorf("Expected failure and ignition succeeded")
348357
}
349358
}
359+
360+
// Remove a LUKS device
361+
func removeLuksDevice(deviceName string) error {
362+
deviceExists, err := util.PathExists(fmt.Sprintf("/dev/mapper/%s", deviceName))
363+
if err != nil {
364+
return fmt.Errorf("failed to check if device exists at %s: %v", deviceName, err)
365+
}
366+
if deviceExists {
367+
cmd := exec.Command("sudo", "cryptsetup", "luksClose", deviceName)
368+
if err := cmd.Run(); err != nil {
369+
return fmt.Errorf("failed to remove LUKS device %s: %v", deviceName, err)
370+
}
371+
}
372+
373+
return nil
374+
}

‎tests/negative/luks/creation.go

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
// Copyright 2023 CoreOS, Inc.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package luks
16+
17+
import (
18+
"github.com/coreos/ignition/v2/tests/register"
19+
"github.com/coreos/ignition/v2/tests/types"
20+
)
21+
22+
func init() {
23+
register.Register(register.NegativeTest, LuksFailToEncryptFormatedDevice())
24+
}
25+
26+
// Fail to encrypt a device which is formatted without "WipeVolume"
27+
func LuksFailToEncryptFormatedDevice() types.Test {
28+
name := "luks.formatedDevice.noWipeVolume"
29+
in := types.GetBaseDisk()
30+
out := types.GetBaseDisk()
31+
mntDevices := []types.MntDevice{
32+
{
33+
Label: "OEM",
34+
Substitution: "$DEVICE",
35+
},
36+
}
37+
config := `{
38+
"ignition": { "version": "$version" },
39+
"storage": {
40+
"luks": [
41+
{
42+
"device": "$DEVICE",
43+
"name": "$uuid1",
44+
"wipeVolume": false
45+
}
46+
]
47+
}
48+
}`
49+
configMinVersion := "3.2.0"
50+
51+
return types.Test{
52+
Name: name,
53+
In: in,
54+
Out: out,
55+
MntDevices: mntDevices,
56+
Config: config,
57+
ConfigMinVersion: configMinVersion,
58+
}
59+
}

‎tests/positive/luks/creation.go

+105
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
// Copyright 2023 CoreOS, Inc.
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package luks
16+
17+
import (
18+
"github.com/coreos/ignition/v2/tests/register"
19+
"github.com/coreos/ignition/v2/tests/types"
20+
)
21+
22+
func init() {
23+
register.Register(register.PositiveTest, LuksWithKeyfileKey())
24+
register.Register(register.PositiveTest, LuksWithTPM2())
25+
26+
}
27+
28+
func LuksWithKeyfileKey() types.Test {
29+
name := "luks.formattedDevice.wipeVolume.keyfile"
30+
in := types.GetBaseDisk()
31+
out := types.GetBaseDisk()
32+
mntDevices := []types.MntDevice{
33+
{
34+
Label: "OEM",
35+
Substitution: "$DEVICE",
36+
},
37+
}
38+
config := `{
39+
"ignition": { "version": "$version" },
40+
"storage": {
41+
"luks": [
42+
{
43+
"device": "$DEVICE",
44+
"name": "$uuid1",
45+
"keyFile": {
46+
"compression": "",
47+
"source": "data:,REPLACE-THIS-WITH-YOUR-KEY-MATERIAL"
48+
},
49+
"wipeVolume": true
50+
}
51+
]
52+
}
53+
}`
54+
configMinVersion := "3.2.0"
55+
in[0].Partitions.GetPartition("OEM").FilesystemType = "ext4"
56+
out[0].Partitions.GetPartition("OEM").FilesystemType = "crypto_LUKS"
57+
58+
return types.Test{
59+
Name: name,
60+
In: in,
61+
Out: out,
62+
MntDevices: mntDevices,
63+
Config: config,
64+
ConfigMinVersion: configMinVersion,
65+
}
66+
}
67+
68+
func LuksWithTPM2() types.Test {
69+
name := "luks.formattedDevice.wipeVolume.tpm2"
70+
in := types.GetBaseDisk()
71+
out := types.GetBaseDisk()
72+
mntDevices := []types.MntDevice{
73+
{
74+
Label: "OEM",
75+
Substitution: "$DEVICE",
76+
},
77+
}
78+
config := `{
79+
"ignition": { "version": "$version" },
80+
"storage": {
81+
"luks": [
82+
{
83+
"clevis": {
84+
"tpm2": true
85+
},
86+
"device": "$DEVICE",
87+
"name": "$uuid1",
88+
"wipeVolume": true
89+
}
90+
]
91+
}
92+
}`
93+
configMinVersion := "3.2.0"
94+
in[0].Partitions.GetPartition("OEM").FilesystemType = "ext4"
95+
out[0].Partitions.GetPartition("OEM").FilesystemType = "crypto_LUKS"
96+
97+
return types.Test{
98+
Name: name,
99+
In: in,
100+
Out: out,
101+
MntDevices: mntDevices,
102+
Config: config,
103+
ConfigMinVersion: configMinVersion,
104+
}
105+
}

‎tests/registry/registry.go

+2
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ import (
1919
_ "github.com/coreos/ignition/v2/tests/negative/files"
2020
_ "github.com/coreos/ignition/v2/tests/negative/filesystems"
2121
_ "github.com/coreos/ignition/v2/tests/negative/general"
22+
_ "github.com/coreos/ignition/v2/tests/negative/luks"
2223
_ "github.com/coreos/ignition/v2/tests/negative/partitions"
2324
_ "github.com/coreos/ignition/v2/tests/negative/proxy"
2425
_ "github.com/coreos/ignition/v2/tests/negative/regression"
@@ -27,6 +28,7 @@ import (
2728
_ "github.com/coreos/ignition/v2/tests/positive/files"
2829
_ "github.com/coreos/ignition/v2/tests/positive/filesystems"
2930
_ "github.com/coreos/ignition/v2/tests/positive/general"
31+
_ "github.com/coreos/ignition/v2/tests/positive/luks"
3032
_ "github.com/coreos/ignition/v2/tests/positive/partitions"
3133
_ "github.com/coreos/ignition/v2/tests/positive/passwd"
3234
_ "github.com/coreos/ignition/v2/tests/positive/proxy"

0 commit comments

Comments
 (0)