From cf92789ca614a07e4e4c0d5ebc235a1cdaa5a341 Mon Sep 17 00:00:00 2001 From: Otavio Pontes Date: Thu, 27 Jun 2019 12:57:49 -0700 Subject: [PATCH] test: Add a key rotation test Signed-off-by: Otavio Pontes --- Makefile.am | 1 + test/functional/signature/key-rotation.bats | 152 ++++++++++++++++++++ test/functional/testlib.bash | 1 + 3 files changed, 154 insertions(+) create mode 100755 test/functional/signature/key-rotation.bats diff --git a/Makefile.am b/Makefile.am index ca91b945..01ec336f 100644 --- a/Makefile.am +++ b/Makefile.am @@ -273,6 +273,7 @@ BATS = \ test/functional/signature/invalid-certificate.bats \ test/functional/signature/no-signature.bats \ test/functional/signature/permission-incorrect.bats \ + test/functional/signature/key-rotation.bats \ test/functional/update/update-boot-file.bats \ test/functional/update/update-boot-skip.bats \ test/functional/update/update-bundle-removed.bats \ diff --git a/test/functional/signature/key-rotation.bats b/test/functional/signature/key-rotation.bats new file mode 100755 index 00000000..04a0dfac --- /dev/null +++ b/test/functional/signature/key-rotation.bats @@ -0,0 +1,152 @@ +#!/usr/bin/env bats + +# Author: Otavio Pontes +# Email: otavio.pontes@intel.com + +load "../testlib" + +test_setup() { + + create_test_environment -r "$TEST_NAME" 10 1 + export CERT_PATH="/usr/share/clear/update-ca/Swupd_Root.pem" + export SWUPD_OPTS_EXTRA="$SWUPD_OPTS_NO_FMT_NO_CERT -C $TARGETDIR$CERT_PATH" + + create_version -r "$TEST_NAME" 20 10 + update_bundle "$TEST_NAME" os-core --add "$CERT_PATH":"$FUNC_DIR"/Swupd_Root.pem + bump_format "$TEST_NAME" + + # Rotate the key inside the content. We need to sign release 30 using old root key and sign the release 40 and 50 using the new key. And include the new key in releases 30, 40 and 50. + generate_certificate "$TEST_NAME/new_root.key" "$TEST_NAME/new_root.pem" + sudo sh -c "mv $WEBDIR/40 $WEBDIR/000" + sudo sh -c "sed -i '/Swupd_Root.pem/d' $WEBDIR/30/Manifest.os-core" + + update_bundle "$TEST_NAME" os-core --add "$CERT_PATH":"$TEST_NAME"/new_root.pem + + sudo sh -c "mv $WEBDIR/000 $WEBDIR/40" + sudo sh -c "sed -i '/Swupd_Root.pem/d' $WEBDIR/40/Manifest.os-core" + sudo sh -c "grep 'Swupd_Root.pem' $WEBDIR/30/Manifest.os-core >> $WEBDIR/40/Manifest.os-core" + sudo sh -c "sed -i 's/\t30\t/\t40\t/' $WEBDIR/40/Manifest.os-core" + + create_version -r "$TEST_NAME" 50 40 2 + + # Create the key to rotate and re-sign content after the bump + sign_cmd=$(cat <<-EOM + # Sign the MoM with self signed intermediate cert + openssl smime -sign -binary -in "$WEBDIR"/40/Manifest.MoM -signer "$TEST_NAME/new_root.pem" -inkey "$TEST_NAME/new_root.key" -out "$WEBDIR"/40/Manifest.MoM.sig -outform DER + openssl smime -sign -binary -in "$WEBDIR"/50/Manifest.MoM -signer "$TEST_NAME/new_root.pem" -inkey "$TEST_NAME/new_root.key" -out "$WEBDIR"/50/Manifest.MoM.sig -outform DER + EOM + ) + + sudo sh -c "$sign_cmd" + +} + +@test "SIG017: Key rotation" { + + run sudo sh -c "$SWUPD update -V 20 $SWUPD_OPTS_NO_FMT" + assert_status_is "$SWUPD_OK" + + assert_file_exists "$TARGETDIR""$CERT_PATH" + run sudo sh -c "$SWUPD update -V 30 $SWUPD_OPTS_EXTRA" + + assert_status_is "$SWUPD_OK" + expected_output=$(cat <<-EOM + Update started. + Preparing to update from 20 to 30 + Downloading packs for: + - os-core + Finishing packs extraction... + Statistics for going from version 20 to version 30: + changed bundles : 1 + new bundles : 0 + deleted bundles : 0 + changed files : 3 + new files : 0 + deleted files : 0 + No extra files need to be downloaded + Staging file content + Applying update + Update was applied. + Calling post-update helper scripts + Update successful. System updated from version 20 to version 30 + EOM + ) + assert_is_output "$expected_output" + assert_file_exists "$TARGETDIR"/core + + run sudo sh -c "$SWUPD update -V 50 $SWUPD_OPTS_EXTRA" + + assert_status_is "$SWUPD_OK" + expected_output=$(cat <<-EOM + Update started. + Preparing to update from 40 to 50 + Downloading packs for: + - os-core + Finishing packs extraction... + Statistics for going from version 40 to version 50: + changed bundles : 1 + new bundles : 0 + deleted bundles : 0 + changed files : 2 + new files : 0 + deleted files : 0 + No extra files need to be downloaded + Staging file content + Applying update + Update was applied. + Calling post-update helper scripts + Update successful. System updated from version 40 to version 50 + EOM + ) + assert_is_output "$expected_output" + assert_file_exists "$TARGETDIR"/core + +} + +@test "SIG018: Using incorrect keys should fail after key rotation" { + + run sudo sh -c "$SWUPD update -V 20 $SWUPD_OPTS_NO_FMT" + assert_status_is "$SWUPD_OK" + assert_file_exists "$TARGETDIR""$CERT_PATH" + + run sudo sh -c "$SWUPD update -V 30 $SWUPD_OPTS_NO_FMT" + assert_status_is "$SWUPD_OK" + expected_output=$(cat <<-EOM + Update started. + Preparing to update from 20 to 30 + Downloading packs for: + - os-core + Finishing packs extraction... + Statistics for going from version 20 to version 30: + changed bundles : 1 + new bundles : 0 + deleted bundles : 0 + changed files : 3 + new files : 0 + deleted files : 0 + No extra files need to be downloaded + Staging file content + Applying update + Update was applied. + Calling post-update helper scripts + Update successful. System updated from version 20 to version 30 + EOM + ) + assert_is_output "$expected_output" + assert_file_exists "$TARGETDIR"/core + + run sudo sh -c "$SWUPD update -V 50 $SWUPD_OPTS_NO_FMT" + + assert_status_is "$SWUPD_COULDNT_LOAD_MOM" + expected_output=$(cat <<-EOM + Update started. + Preparing to update from 40 to 50 + Error: Certificate verification error - self signed certificate + Error: Signature check error + Signature check failed! + EOM + ) + assert_in_output "$expected_output" + assert_file_exists "$TARGETDIR"/core + +} diff --git a/test/functional/testlib.bash b/test/functional/testlib.bash index 3a3a3e59..4b936b19 100644 --- a/test/functional/testlib.bash +++ b/test/functional/testlib.bash @@ -412,6 +412,7 @@ set_env_variables() { # swupd_function export SWUPD_OPTS_NO_CERT="-S $testfs_path/state -p $testfs_path/target-dir -F staging -I" export SWUPD_OPTS_MIRROR="-p $testfs_path/target-dir" export SWUPD_OPTS_NO_FMT="-S $testfs_path/state -p $testfs_path/target-dir -C $FUNC_DIR/Swupd_Root.pem -I" + export SWUPD_OPTS_NO_FMT_NO_CERT="-S $testfs_path/state -p $testfs_path/target-dir -I" export SWUPD_OPTS_NO_PATH="-S $testfs_path/state -F staging -C $FUNC_DIR/Swupd_Root.pem -I" export CLIENT_CERT_DIR="$testfs_path/target-dir/etc/swupd"