github.com/meulengracht/snapd@v0.0.0-20210719210640-8bde69bcc84e/secboot/encrypt_test.go (about)

     1  // -*- Mode: Go; indent-tabs-mode: t -*-
     2  
     3  /*
     4   * Copyright (C) 2019-2021 Canonical Ltd
     5   *
     6   * This program is free software: you can redistribute it and/or modify
     7   * it under the terms of the GNU General Public License version 3 as
     8   * published by the Free Software Foundation.
     9   *
    10   * This program is distributed in the hope that it will be useful,
    11   * but WITHOUT ANY WARRANTY; without even the implied warranty of
    12   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    13   * GNU General Public License for more details.
    14   *
    15   * You should have received a copy of the GNU General Public License
    16   * along with this program.  If not, see <http://www.gnu.org/licenses/>.
    17   *
    18   */
    19  
    20  package secboot_test
    21  
    22  import (
    23  	"fmt"
    24  	"os"
    25  	"path/filepath"
    26  	"testing"
    27  
    28  	. "gopkg.in/check.v1"
    29  
    30  	"github.com/snapcore/snapd/secboot"
    31  	"github.com/snapcore/snapd/testutil"
    32  )
    33  
    34  func TestSecboot(t *testing.T) { TestingT(t) }
    35  
    36  type encryptSuite struct {
    37  	dir string
    38  }
    39  
    40  var _ = Suite(&encryptSuite{})
    41  
    42  func (s *encryptSuite) SetUpTest(c *C) {
    43  	s.dir = c.MkDir()
    44  }
    45  
    46  func (s *encryptSuite) TestRecoveryKeySave(c *C) {
    47  	kf := filepath.Join(s.dir, "test-key")
    48  	kfNested := filepath.Join(s.dir, "deeply/nested/test-key")
    49  
    50  	rkey := secboot.RecoveryKey{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 255}
    51  	err := rkey.Save(kf)
    52  	c.Assert(err, IsNil)
    53  	c.Assert(kf, testutil.FileEquals, rkey[:])
    54  
    55  	fileInfo, err := os.Stat(kf)
    56  	c.Assert(err, IsNil)
    57  	c.Assert(fileInfo.Mode(), Equals, os.FileMode(0600))
    58  
    59  	err = rkey.Save(kfNested)
    60  	c.Assert(err, IsNil)
    61  	c.Assert(kfNested, testutil.FileEquals, rkey[:])
    62  	di, err := os.Stat(filepath.Dir(kfNested))
    63  	c.Assert(err, IsNil)
    64  	c.Assert(di.Mode().Perm(), Equals, os.FileMode(0755))
    65  }
    66  
    67  func (s *encryptSuite) TestEncryptionKeySave(c *C) {
    68  	kf := filepath.Join(s.dir, "test-key")
    69  	kfNested := filepath.Join(s.dir, "deeply/nested/test-key")
    70  
    71  	ekey := secboot.EncryptionKey{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 255}
    72  	err := ekey.Save(kf)
    73  	c.Assert(err, IsNil)
    74  	c.Assert(kf, testutil.FileEquals, []byte(ekey))
    75  
    76  	fileInfo, err := os.Stat(kf)
    77  	c.Assert(err, IsNil)
    78  	c.Assert(fileInfo.Mode(), Equals, os.FileMode(0600))
    79  
    80  	err = ekey.Save(kfNested)
    81  	c.Assert(err, IsNil)
    82  	c.Assert(kfNested, testutil.FileEquals, []byte(ekey))
    83  	di, err := os.Stat(filepath.Dir(kfNested))
    84  	c.Assert(err, IsNil)
    85  	c.Assert(di.Mode().Perm(), Equals, os.FileMode(0755))
    86  }
    87  
    88  func (s *encryptSuite) TestNewAuxKeyHappy(c *C) {
    89  	restore := secboot.MockRandRead(func(p []byte) (int, error) {
    90  		for i := range p {
    91  			p[i] = byte(i % 10)
    92  		}
    93  		return len(p), nil
    94  	})
    95  	defer restore()
    96  
    97  	auxKey, err := secboot.NewAuxKey()
    98  	c.Assert(err, IsNil)
    99  	c.Assert(auxKey, HasLen, 32)
   100  	c.Check(auxKey[:], DeepEquals, []byte{
   101  		0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9,
   102  		0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9,
   103  		0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9,
   104  		0x0, 0x1,
   105  	})
   106  }
   107  
   108  func (s *encryptSuite) TestNewAuxKeySad(c *C) {
   109  	restore := secboot.MockRandRead(func(p []byte) (int, error) {
   110  		return 0, fmt.Errorf("fail")
   111  	})
   112  	defer restore()
   113  
   114  	_, err := secboot.NewAuxKey()
   115  	c.Check(err, ErrorMatches, "fail")
   116  }