tests/*/luks: add blackbox tests for luks

coreos · Aug 11, 2023 · 619deba · 619deba
1 parent d06b0f0
commit 619deba
Show file tree

Hide file tree

Showing 3 changed files with 246 additions and 0 deletions.
diff --git a/tests/negative/luks/creation.go b/tests/negative/luks/creation.go
@@ -0,0 +1,58 @@
+// Copyright 2023 CoreOS, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package luks
+
+import (
+	"github.com/coreos/ignition/v2/tests/register"
+	"github.com/coreos/ignition/v2/tests/types"
+)
+
+func init() {
+	register.Register(register.NegativeTest, LuksOnNonExtDevice())
+}
+
+func LuksOnNonExtDevice() types.Test {
+	name := "tang.filesystem.luks.encrypt"
+	in := types.GetBaseDisk()
+	out := types.GetBaseDisk()
+	mntDevices := []types.MntDevice{
+		{
+			Label:        "EFI-SYSTEM",
+			Substitution: "$DEVICE",
+		},
+	}
+	config := `{
+		"ignition": { "version": "$version" },
+		"storage": {
+		  "luks": [
+			{
+			  "device": "$DEVICE",
+			  "name": "luks-$UUID",
+			  "wipe_volume": true
+			}
+		  ]
+		}
+	}`
+	configMinVersion := "3.2.0"
+
+	return types.Test{
+		Name:             name,
+		In:               in,
+		Out:              out,
+		MntDevices:       mntDevices,
+		Config:           config,
+		ConfigMinVersion: configMinVersion,
+	}
+}
diff --git a/tests/positive/luks/creation.go b/tests/positive/luks/creation.go
@@ -0,0 +1,187 @@
+// Copyright 2023 CoreOS, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package luks
+
+import (
+	"github.com/coreos/ignition/v2/tests/register"
+	"github.com/coreos/ignition/v2/tests/types"
+)
+
+func init() {
+	register.Register(register.PositiveTest, LuksWithStaticKey())
+	register.Register(register.PositiveTest, LuksWithOfflineTang())
+	register.Register(register.PositiveTest, LuksWithTPM())
+
+}
+
+func LuksWithStaticKey() types.Test {
+	name := "static.filesystem.luks.encrypt"
+	in := types.GetBaseDisk()
+	out := types.GetBaseDisk()
+	mntDevices := []types.MntDevice{
+		{
+			Label:        "OEM",
+			Substitution: "$DEVICE",
+		},
+	}
+	config := `{
+		"ignition": { "version": "$version" },
+		"storage": {
+		  "disks": [
+			{
+			  "device": "$DEVICE",
+			  "partitions": [
+				{
+					"label": "luks-device",
+					"sizeMiB": 0,
+					"startMiB": 0
+				}
+				],
+				"wipe_table": true
+			}
+		  ],
+		  "luks": [
+			{
+			  "device": "$DEVICE",
+			  "name": "luks-$UUID",
+			  "keyFile": {
+				"compression": "",
+				"source": "data:REPLACE-THIS-WITH-YOUR-KEY-MATERIAL"
+			  },
+			  "wipe_volume": true
+			}
+		  ]
+		}
+	}`
+	configMinVersion := "3.2.0"
+	in[0].Partitions.GetPartition("OEM").FilesystemType = "ext4"
+	out[0].Partitions.GetPartition("OEM").FilesystemType = "crypto_LUKS"
+
+	return types.Test{
+		Name:             name,
+		In:               in,
+		Out:              out,
+		MntDevices:       mntDevices,
+		Config:           config,
+		ConfigMinVersion: configMinVersion,
+	}
+}
+
+func LuksWithTPM() types.Test {
+	name := "tpm.filesystem.luks.encrypt"
+	in := types.GetBaseDisk()
+	out := types.GetBaseDisk()
+	mntDevices := []types.MntDevice{
+		{
+			Label:        "OEM",
+			Substitution: "$DEVICE",
+		},
+	}
+	config := `{
+		"ignition": { "version": "$version" },
+		"storage": {
+		  "disks": [
+			{
+			  "device": "$DEVICE",
+			  "partitions": [
+				{
+					"label": "luks-device",
+					"sizeMiB": 0,
+					"startMiB": 0
+				}
+				],
+				"wipe_table": true
+			}
+		  ],
+		  "luks": [
+			{
+			  "clevis": {
+				"tpm2": true
+			  },	
+			  "device": "$DEVICE",
+			  "name": "luks-$UUID",
+			  "wipe_volume": true
+			}
+		  ]
+		}
+	}`
+	configMinVersion := "3.2.0"
+	in[0].Partitions.GetPartition("OEM").FilesystemType = "ext4"
+	out[0].Partitions.GetPartition("OEM").FilesystemType = "crypto_LUKS"
+
+	return types.Test{
+		Name:             name,
+		In:               in,
+		Out:              out,
+		MntDevices:       mntDevices,
+		Config:           config,
+		ConfigMinVersion: configMinVersion,
+	}
+}
+
+func LuksWithOfflineTang() types.Test {
+	name := "tang.filesystem.luks.encrypt"
+	in := types.GetBaseDisk()
+	out := types.GetBaseDisk()
+	mntDevices := []types.MntDevice{
+		{
+			Label:        "OEM",
+			Substitution: "$DEVICE",
+		},
+	}
+	config := `{
+		"ignition": { "version": "$version" },
+		"storage": {
+		  "disks": [
+			{
+			  "device": "$DEVICE",
+			  "partitions": [
+				{
+					"label": "luks-device",
+					"sizeMiB": 0,
+					"startMiB": 0
+				}
+				],
+				"wipe_table": false
+			}
+		  ],
+		  "luks": [{
+			"clevis": {
+				"tang": [{
+					  "thumbprint": "REPLACE-THIS-WITH-YOUR-TANG-THUMBPRINT",
+					  "url": "https://tang.example.com",
+					  "advertisement": "{\"payload\": \"eyJrZXlzIjogW3siYWxnIjogIkVTNTEyIiwgImt0eSI6ICJFQyIsICJjcnYiOiAiUC01MjEiLCAieCI6ICJBRGFNajJmazNob21CWTF5WElSQ21uRk92cmUzOFZjdHMwTnNHeDZ6RWNxdEVXcjh5ekhUMkhfa2hjNGpSa19FQWFLdjNrd2RjZ05sOTBLcGhfMGYyQ190IiwgInkiOiAiQUZ2d1UyeGJ5T1RydWo0V1NtcVlqN2wtcUVTZmhWakdCNTI1Q2d6d0NoZUZRRTBvb1o3STYyamt3NkRKQ05yS3VPUDRsSEhicm8tYXhoUk9MSXNJVExvNCIsICJrZXlfb3BzIjogWyJ2ZXJpZnkiXX0sIHsiYWxnIjogIkVDTVIiLCAia3R5IjogIkVDIiwgImNydiI6ICJQLTUyMSIsICJ4IjogIkFOZDVYcTFvZklUbTdNWG16OUY0VVRSYmRNZFNIMl9XNXczTDVWZ0w3b3hwdmpyM0hkLXNLNUVqd3A1V2swMnJMb3NXVUJjYkZyZEhjZFJTTVJoZlVFTFIiLCAieSI6ICJBRVVaVlVZWkFBY2hVcmdoX3poaTV3SUUzeTEycGwzeWhqUk5LcGpSdW9tUFhKaDhRaFhXRmRWZEtMUlEwX1lwUjNOMjNSUk1pU1lvWlg0Qm42QnlrQVBMIiwgImtleV9vcHMiOiBbImRlcml2ZUtleSJdfV19\", \"protected\": \"eyJhbGciOiJFUzUxMiIsImN0eSI6Imp3ay1zZXQranNvbiJ9\", \"signature\": \"APHfSyVzLwELwG0pMJyIP74gWvhHUvDtv0SESBxA2uOdSXq76IdWHW2xvCZDdlNan8pnqUvEedPZjf_vdKBw9MTXAPMkRxVnu64HepKwlrzzm_zG2R4CHpoCOsGgjH9-acYxg-Vha63oMojv3_bV0VHg-NbzNLaxietgYplstvcNIwkv\"}"
+				}]
+			},
+			"device": "$DEVICE",
+			  "name": "luks-$UUID",
+			  "wipe_volume": true
+
+		  }]
+		}
+	}`
+	configMinVersion := "3.4.0"
+	in[0].Partitions.GetPartition("OEM").FilesystemType = "ext4"
+	out[0].Partitions.GetPartition("OEM").FilesystemType = "crypto_LUKS"
+
+	return types.Test{
+		Name:             name,
+		In:               in,
+		Out:              out,
+		MntDevices:       mntDevices,
+		Config:           config,
+		ConfigMinVersion: configMinVersion,
+	}
+}
diff --git a/tests/registry/registry.go b/tests/registry/registry.go
@@ -27,6 +27,7 @@ import (
 	_ "github.com/coreos/ignition/v2/tests/positive/files"
 	_ "github.com/coreos/ignition/v2/tests/positive/filesystems"
 	_ "github.com/coreos/ignition/v2/tests/positive/general"
+	_ "github.com/coreos/ignition/v2/tests/positive/luks"
 	_ "github.com/coreos/ignition/v2/tests/positive/partitions"
 	_ "github.com/coreos/ignition/v2/tests/positive/passwd"
 	_ "github.com/coreos/ignition/v2/tests/positive/proxy"