From ccbf2620b50aaa07c17cae8feaf2503f86e80b85 Mon Sep 17 00:00:00 2001 From: Otavio Pontes Date: Wed, 26 Jun 2019 14:13:17 -0700 Subject: [PATCH] test: Adding signature checking tests Signed-off-by: Otavio Pontes --- .travis.yml | 4 +- Makefile.am | 6 +++ .../signature/corrupted-certificate.bats | 49 ++++++++++++++++++ .../signature/corrupted-signature.bats | 51 +++++++++++++++++++ .../signature/invalid-certificate.bats | 50 ++++++++++++++++++ test/functional/signature/no-signature.bats | 51 +++++++++++++++++++ .../signature/permission-incorrect.bats | 26 ++++++++++ test/functional/testlib.bash | 3 +- 8 files changed, 237 insertions(+), 3 deletions(-) create mode 100755 test/functional/signature/corrupted-certificate.bats create mode 100755 test/functional/signature/corrupted-signature.bats create mode 100755 test/functional/signature/invalid-certificate.bats create mode 100755 test/functional/signature/no-signature.bats create mode 100755 test/functional/signature/permission-incorrect.bats diff --git a/.travis.yml b/.travis.yml index 69d7d603..247ff970 100644 --- a/.travis.yml +++ b/.travis.yml @@ -17,7 +17,7 @@ env: - GROUP1="$UPDATE_SUBGROUP1" - GROUP2="$UPDATE_SUBGROUP2 $(find test/functional/{checkupdate,hashdump,mirror,usability} -name *.bats -printf '%p ')" - GROUP3="$(find test/functional/{diagnose,search,os-install,repair} -name *.bats -printf '%p ')" - - GROUP4="$(find test/functional/{bundleadd,bundleremove,bundlelist} -name *.bats -printf '%p ')" + - GROUP4="$(find test/functional/{bundleadd,bundleremove,bundlelist,signature} -name *.bats -printf '%p ')" jobs: include: @@ -34,7 +34,7 @@ jobs: name: "Functional Tests - diagnose, os-install, repair, search" script: env TESTS="$GROUP3" make -e check - stage: test - name: "Functional Tests - bundle-add, bundle-remove, bundle-list" + name: "Functional Tests - bundle-add, bundle-remove, bundle-list, signature" script: env TESTS="$GROUP4" make -e check # Pre-install missing build dependencies: diff --git a/Makefile.am b/Makefile.am index 5c905742..c2483343 100644 --- a/Makefile.am +++ b/Makefile.am @@ -267,6 +267,11 @@ BATS = \ test/functional/search/search-json.bats \ test/functional/search/search-no-disk-space.bats \ test/functional/search/search-sort.bats \ + test/functional/signature/corrupted-certificate.bats \ + test/functional/signature/invalid-certificate.bats \ + test/functional/signature/permission-incorrect.bats \ + test/functional/signature/corrupted-signature.bats \ + test/functional/signature/no-signature.bats \ test/functional/update/update-boot-file.bats \ test/functional/update/update-boot-skip.bats \ test/functional/update/update-bundle-removed.bats \ @@ -310,6 +315,7 @@ BATS = \ test/functional/usability/usa-download-retries.bats \ test/functional/usability/usa-external-modules.bats + UNIT_TESTS = \ test/unit/test_signature.test \ test/unit/test_strings.test \ diff --git a/test/functional/signature/corrupted-certificate.bats b/test/functional/signature/corrupted-certificate.bats new file mode 100755 index 00000000..5405995e --- /dev/null +++ b/test/functional/signature/corrupted-certificate.bats @@ -0,0 +1,49 @@ +#!/usr/bin/env bats + +# Author: Otavio Pontes +# Email: otavio.pontes@intel.com + +load "../testlib" + +test_setup() { + + create_test_environment "$TEST_NAME" + create_bundle -n test-bundle -f /test-file "$TEST_NAME" + write_to_protected_file $TEST_NAME/cert "invalid" + +} + +@test "SIG001: Swupd bundle-add with corrupted certificate" { + + run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS_NO_CERT -C $TEST_NAME/cert test-bundle" + + assert_status_is "$SWUPD_SIGNATURE_VERIFICATION_FAILED" + expected_output=$(cat <<-EOM + Error: Failed to verify certificate: .* + EOM + ) + assert_regex_in_output "$expected_output" + assert_file_not_exists "$TARGETDIR"/test-file + +} + +@test "SIG002: Force swupd bundle-add a bundle with corrupted certificate" { + + run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS_NO_CERT -C $TEST_NAME/cert --nosigcheck test-bundle" + + assert_status_is "$SWUPD_OK" + expected_output=$(cat <<-EOM + FAILED TO VERIFY SIGNATURE OF Manifest.MoM. Operation proceeding due to + --nosigcheck, but system security may be compromised + Loading required manifests... + No packs need to be downloaded + Starting download of remaining update content. This may take a while... + Installing bundle(s) files... + Calling post-update helper scripts + Successfully installed 1 bundle + EOM + ) + assert_in_output "$expected_output" + assert_file_exists "$TARGETDIR"/test-file + +} diff --git a/test/functional/signature/corrupted-signature.bats b/test/functional/signature/corrupted-signature.bats new file mode 100755 index 00000000..9135a2d6 --- /dev/null +++ b/test/functional/signature/corrupted-signature.bats @@ -0,0 +1,51 @@ +#!/usr/bin/env bats + +# Author: Otavio Pontes +# Email: otavio.pontes@intel.com + +load "../testlib" + +test_setup() { + + create_test_environment "$TEST_NAME" + create_bundle -n test-bundle -f /test-file "$TEST_NAME" + + write_to_protected_file "$WEBDIR/10/Manifest.MoM.sig" "bad signature" + +} + +@test "SIG003: Swupd bundle-add with corrupted MoM signature" { + + run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS test-bundle" + + assert_status_is "$SWUPD_COULDNT_LOAD_MOM" + expected_output=$(cat <<-EOM + Error: FAILED TO VERIFY SIGNATURE OF Manifest.MoM version 10!!! + Error: Cannot load official manifest MoM for version 10 + EOM + ) + assert_in_output "$expected_output" + assert_file_not_exists "$TARGETDIR"/test-file + +} + +@test "SIG004: Force swupd bundle-add a bundle with corrupted MoM signature" { + + run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS --nosigcheck test-bundle" + + assert_status_is "$SWUPD_OK" + expected_output=$(cat <<-EOM + FAILED TO VERIFY SIGNATURE OF Manifest.MoM. Operation proceeding due to + --nosigcheck, but system security may be compromised + Loading required manifests... + No packs need to be downloaded + Starting download of remaining update content. This may take a while... + Installing bundle(s) files... + Calling post-update helper scripts + Successfully installed 1 bundle + EOM + ) + assert_in_output "$expected_output" + assert_file_exists "$TARGETDIR"/test-file + +} diff --git a/test/functional/signature/invalid-certificate.bats b/test/functional/signature/invalid-certificate.bats new file mode 100755 index 00000000..df63e407 --- /dev/null +++ b/test/functional/signature/invalid-certificate.bats @@ -0,0 +1,50 @@ +#!/usr/bin/env bats + +# Author: Otavio Pontes +# Email: otavio.pontes@intel.com + +load "../testlib" + +test_setup() { + + create_test_environment "$TEST_NAME" + create_bundle -n test-bundle -f /test-file "$TEST_NAME" + sudo sh -c "openssl req -x509 -sha512 -days 1 -newkey rsa:4096 -keyout $TEST_NAME/key -out $TEST_NAME/cert -nodes -subj '/C=US/ST=Oregon/L=Portland/O=Company Name/OU=Org/CN=localhost'" + +} + +@test "SIG005: Swupd bundle-add with invalid certificate" { + + run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS_NO_CERT -C $TEST_NAME/cert test-bundle" + + assert_status_is "$SWUPD_COULDNT_LOAD_MOM" + expected_output=$(cat <<-EOM + Error: FAILED TO VERIFY SIGNATURE OF Manifest.MoM version 10!!! + Error: Cannot load official manifest MoM for version 10 + EOM + ) + assert_in_output "$expected_output" + assert_file_not_exists "$TARGETDIR"/test-file + +} + +@test "SIG006: Force swupd bundle-add a bundle with invalid certificate" { + + run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS_NO_CERT -C $TEST_NAME/cert --nosigcheck test-bundle" + + assert_status_is "$SWUPD_OK" + expected_output=$(cat <<-EOM + FAILED TO VERIFY SIGNATURE OF Manifest.MoM. Operation proceeding due to + --nosigcheck, but system security may be compromised + Loading required manifests... + No packs need to be downloaded + Starting download of remaining update content. This may take a while... + Installing bundle(s) files... + Calling post-update helper scripts + Successfully installed 1 bundle + EOM + ) + assert_in_output "$expected_output" + assert_file_exists "$TARGETDIR"/test-file + +} diff --git a/test/functional/signature/no-signature.bats b/test/functional/signature/no-signature.bats new file mode 100755 index 00000000..777c0ce4 --- /dev/null +++ b/test/functional/signature/no-signature.bats @@ -0,0 +1,51 @@ +#!/usr/bin/env bats + +# Author: Otavio Pontes +# Email: otavio.pontes@intel.com + +load "../testlib" + +test_setup() { + + create_test_environment "$TEST_NAME" + create_bundle -n test-bundle -f /test-file "$TEST_NAME" + sudo rm "$WEBDIR"/10/Manifest.MoM.sig + +} + +@test "SIG007: Swupd bundle-add without a MoM signature" { + + run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS test-bundle" + + assert_status_is "$SWUPD_COULDNT_LOAD_MOM" + expected_output=$(cat <<-EOM + Warning: Removing corrupt Manifest.MoM artifacts and re-downloading... + Error: FAILED TO VERIFY SIGNATURE OF Manifest.MoM version 10!!! + Error: Cannot load official manifest MoM for version 10 + EOM + ) + assert_is_output "$expected_output" + assert_file_not_exists "$TARGETDIR"/test-file + +} + +@test "SIG008: Force swupd bundle-add a bundle without a MoM signature" { + + run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS --nosigcheck test-bundle" + + assert_status_is "$SWUPD_OK" + expected_output=$(cat <<-EOM + FAILED TO VERIFY SIGNATURE OF Manifest.MoM. Operation proceeding due to + --nosigcheck, but system security may be compromised + Loading required manifests... + No packs need to be downloaded + Starting download of remaining update content. This may take a while... + Installing bundle(s) files... + Calling post-update helper scripts + Successfully installed 1 bundle + EOM + ) + assert_in_output "$expected_output" + assert_file_exists "$TARGETDIR"/test-file + +} diff --git a/test/functional/signature/permission-incorrect.bats b/test/functional/signature/permission-incorrect.bats new file mode 100755 index 00000000..2cd109e1 --- /dev/null +++ b/test/functional/signature/permission-incorrect.bats @@ -0,0 +1,26 @@ +#!/usr/bin/env bats + +# Author: Otavio Pontes +# Email: otavio.pontes@intel.com + +load "../testlib" + +test_setup() { + + create_test_environment "$TEST_NAME" + create_bundle -n test-bundle -f /test-file "$TEST_NAME" + +} + +@test "SIG009: Swupd bundle-add without a MoM signature" { + + run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS test-bundle" + + assert_status_is "$SWUPD_OK" + assert_file_exists "$TARGETDIR"/test-file + + run sudo sh -c "stat -c '%a' $STATEDIR" + assert_status_is 0 + assert_in_output "700" + +} diff --git a/test/functional/testlib.bash b/test/functional/testlib.bash index 0cf4ac64..3d05e73c 100644 --- a/test/functional/testlib.bash +++ b/test/functional/testlib.bash @@ -409,7 +409,7 @@ set_env_variables() { # swupd_function # different options for swupd export SWUPD_OPTS="-S $testfs_path/state -p $testfs_path/target-dir -F staging -C $FUNC_DIR/Swupd_Root.pem -I" export SWUPD_OPTS_KEEPCACHE="$SWUPD_OPTS --keepcache" - export SWUPD_OPTS_NO_CERT="-S $testfs_path/state -p $testfs_path/target-dir -F staging" + export SWUPD_OPTS_NO_CERT="-S $testfs_path/state -p $testfs_path/target-dir -F staging -I" export SWUPD_OPTS_MIRROR="-p $testfs_path/target-dir" export SWUPD_OPTS_NO_FMT="-S $testfs_path/state -p $testfs_path/target-dir -C $FUNC_DIR/Swupd_Root.pem -I" export SWUPD_OPTS_NO_PATH="-S $testfs_path/state -F staging -C $FUNC_DIR/Swupd_Root.pem -I" @@ -3039,6 +3039,7 @@ get_next_available_id() { # swupd_function mirror) group=MIR;; completion) group=USA;; usability) group=USA;; + signature) group=SIG;; autoupdate) group=AUT;; info) group=INF;; clean) group=CLN;;