| OLD | NEW |
| 1 // Copyright (c) 2009-2010 The Chromium OS Authors. All rights reserved. | 1 // Copyright (c) 2009-2010 The Chromium OS Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // Unit tests for Mount. | 5 // Unit tests for Mount. |
| 6 | 6 |
| 7 #include "cryptohome/mount.h" | 7 #include "mount.h" |
| 8 | 8 |
| 9 #include <openssl/sha.h> | 9 #include <openssl/sha.h> |
| 10 #include <pwd.h> | 10 #include <pwd.h> |
| 11 #include <string.h> // For memset(), memcpy() | 11 #include <string.h> // For memset(), memcpy() |
| 12 #include <stdlib.h> | 12 #include <stdlib.h> |
| 13 #include <sys/types.h> | 13 #include <sys/types.h> |
| 14 | 14 |
| 15 #include "base/file_path.h" | 15 #include <base/file_path.h> |
| 16 #include "base/file_util.h" | 16 #include <base/file_util.h> |
| 17 #include "base/logging.h" | 17 #include <base/logging.h> |
| 18 #include "chromeos/utility.h" | 18 #include <chromeos/utility.h> |
| 19 #include "cryptohome/username_passkey.h" | 19 #include <gtest/gtest.h> |
| 20 #include "gtest/gtest.h" | 20 |
| 21 #include "crypto.h" |
| 22 #include "secure_blob.h" |
| 23 #include "username_passkey.h" |
| 21 | 24 |
| 22 namespace cryptohome { | 25 namespace cryptohome { |
| 23 using namespace chromeos; | |
| 24 using namespace file_util; | |
| 25 using std::string; | 26 using std::string; |
| 26 | 27 |
| 27 const char kImageDir[] = "test_image_dir"; | 28 const char kImageDir[] = "test_image_dir"; |
| 28 const char kSkelDir[] = "test_image_dir/skel"; | 29 const char kSkelDir[] = "test_image_dir/skel"; |
| 29 const char kFakeUser[] = "testuser@invalid.domain"; | 30 const char kFakeUser[] = "testuser@invalid.domain"; |
| 30 const char kFakeUser2[] = "testuser2@invalid.domain"; | 31 const char kFakeUser2[] = "testuser2@invalid.domain"; |
| 31 const char kFakeUser3[] = "testuser3@invalid.domain"; | 32 const char kFakeUser3[] = "testuser3@invalid.domain"; |
| 32 | 33 |
| 33 class MountTest : public ::testing::Test { | 34 class MountTest : public ::testing::Test { |
| 35 public: |
| 36 MountTest() { } |
| 37 virtual ~MountTest() { } |
| 38 |
| 34 void SetUp() { | 39 void SetUp() { |
| 35 FilePath image_dir(kImageDir); | 40 FilePath image_dir(kImageDir); |
| 36 FilePath path = image_dir.Append("salt"); | 41 FilePath path = image_dir.Append("salt"); |
| 37 ASSERT_TRUE(PathExists(path)) << path.value() << " does not exist!"; | 42 ASSERT_TRUE(file_util::PathExists(path)) << path.value() |
| 43 << " does not exist!"; |
| 38 | 44 |
| 39 int64 file_size; | 45 int64 file_size; |
| 40 ASSERT_TRUE(GetFileSize(path, &file_size)) << "Could not get size of " | 46 ASSERT_TRUE(file_util::GetFileSize(path, &file_size)) |
| 41 << path.value(); | 47 << "Could not get size of " |
| 48 << path.value(); |
| 42 | 49 |
| 43 char* buf = new char[file_size]; | 50 char* buf = new char[file_size]; |
| 44 int data_read = ReadFile(path, buf, file_size); | 51 int data_read = file_util::ReadFile(path, buf, file_size); |
| 45 system_salt_.assign(buf, buf + data_read); | 52 system_salt_.assign(buf, buf + data_read); |
| 46 delete buf; | 53 delete buf; |
| 47 } | 54 } |
| 48 | 55 |
| 49 public: | |
| 50 | |
| 51 protected: | 56 protected: |
| 52 // Protected for trivial access | 57 // Protected for trivial access |
| 53 Blob system_salt_; | 58 chromeos::Blob system_salt_; |
| 54 | 59 |
| 55 private: | 60 private: |
| 61 DISALLOW_COPY_AND_ASSIGN(MountTest); |
| 56 }; | 62 }; |
| 57 | 63 |
| 58 TEST_F(MountTest, BadInitTest) { | 64 TEST_F(MountTest, BadInitTest) { |
| 59 // create a Mount instance that points to a bad shadow root | 65 // create a Mount instance that points to a bad shadow root |
| 60 Mount mount(cryptohome::kDefaultSharedUser, | 66 Mount mount; |
| 61 cryptohome::kDefaultEntropySource, | 67 mount.set_shadow_root("/dev/null"); |
| 62 cryptohome::kDefaultHomeDir, | 68 mount.set_skel_source(kSkelDir); |
| 63 "/dev/null", | 69 |
| 64 kSkelDir); | 70 cryptohome::SecureBlob passkey; |
| 65 UsernamePasskey up = UsernamePasskey::FromUsernamePassword(kFakeUser, | 71 cryptohome::Crypto::PasswordToPasskey("zero", system_salt_, &passkey); |
| 66 "zero", | 72 UsernamePasskey up(kFakeUser, passkey); |
| 67 system_salt_); | |
| 68 | 73 |
| 69 EXPECT_EQ(false, mount.Init()); | 74 EXPECT_EQ(false, mount.Init()); |
| 70 EXPECT_EQ(false, mount.TestCredentials(up)); | 75 EXPECT_EQ(false, mount.TestCredentials(up)); |
| 71 } | 76 } |
| 72 | 77 |
| 73 TEST_F(MountTest, GoodDecryptTest0) { | 78 TEST_F(MountTest, GoodDecryptTest0) { |
| 74 // create a Mount instance that points to a good shadow root, test that it | 79 // create a Mount instance that points to a good shadow root, test that it |
| 75 // properly authenticates against the first key | 80 // properly authenticates against the first key |
| 76 Mount mount(cryptohome::kDefaultSharedUser, | 81 Mount mount; |
| 77 cryptohome::kDefaultEntropySource, | 82 mount.set_shadow_root(kImageDir); |
| 78 cryptohome::kDefaultHomeDir, | 83 mount.set_skel_source(kSkelDir); |
| 79 kImageDir, | 84 |
| 80 kSkelDir); | 85 cryptohome::SecureBlob passkey; |
| 81 UsernamePasskey up = UsernamePasskey::FromUsernamePassword(kFakeUser, | 86 cryptohome::Crypto::PasswordToPasskey("zero", system_salt_, &passkey); |
| 82 "zero", | 87 UsernamePasskey up(kFakeUser, passkey); |
| 83 system_salt_); | |
| 84 | 88 |
| 85 EXPECT_EQ(true, mount.Init()); | 89 EXPECT_EQ(true, mount.Init()); |
| 86 EXPECT_EQ(true, mount.TestCredentials(up)); | 90 EXPECT_EQ(true, mount.TestCredentials(up)); |
| 87 } | 91 } |
| 88 | 92 |
| 89 TEST_F(MountTest, GoodDecryptTest1) { | 93 TEST_F(MountTest, GoodDecryptTest1) { |
| 90 // create a Mount instance that points to a good shadow root, test that it | 94 // create a Mount instance that points to a good shadow root, test that it |
| 91 // properly authenticates against the second key | 95 // properly authenticates against the second key |
| 92 Mount mount(cryptohome::kDefaultSharedUser, | 96 Mount mount; |
| 93 cryptohome::kDefaultEntropySource, | 97 mount.set_shadow_root(kImageDir); |
| 94 cryptohome::kDefaultHomeDir, | 98 mount.set_skel_source(kSkelDir); |
| 95 kImageDir, | 99 |
| 96 kSkelDir); | 100 cryptohome::SecureBlob passkey; |
| 97 UsernamePasskey up = UsernamePasskey::FromUsernamePassword(kFakeUser, | 101 cryptohome::Crypto::PasswordToPasskey("one", system_salt_, &passkey); |
| 98 "one", | 102 UsernamePasskey up(kFakeUser, passkey); |
| 99 system_salt_); | |
| 100 | 103 |
| 101 EXPECT_EQ(true, mount.Init()); | 104 EXPECT_EQ(true, mount.Init()); |
| 102 EXPECT_EQ(true, mount.TestCredentials(up)); | 105 EXPECT_EQ(true, mount.TestCredentials(up)); |
| 103 } | 106 } |
| 104 | 107 |
| 105 TEST_F(MountTest, GoodDecryptTest2) { | 108 TEST_F(MountTest, GoodDecryptTest2) { |
| 106 // create a Mount instance that points to a good shadow root, test that it | 109 // create a Mount instance that points to a good shadow root, test that it |
| 107 // properly authenticates against the third key | 110 // properly authenticates against the third key |
| 108 Mount mount(cryptohome::kDefaultSharedUser, | 111 Mount mount; |
| 109 cryptohome::kDefaultEntropySource, | 112 mount.set_shadow_root(kImageDir); |
| 110 cryptohome::kDefaultHomeDir, | 113 mount.set_skel_source(kSkelDir); |
| 111 kImageDir, | 114 |
| 112 kSkelDir); | 115 cryptohome::SecureBlob passkey; |
| 113 UsernamePasskey up = UsernamePasskey::FromUsernamePassword(kFakeUser, | 116 cryptohome::Crypto::PasswordToPasskey("two", system_salt_, &passkey); |
| 114 "two", | 117 UsernamePasskey up(kFakeUser, passkey); |
| 115 system_salt_); | |
| 116 | 118 |
| 117 EXPECT_EQ(true, mount.Init()); | 119 EXPECT_EQ(true, mount.Init()); |
| 118 EXPECT_EQ(true, mount.TestCredentials(up)); | 120 EXPECT_EQ(true, mount.TestCredentials(up)); |
| 119 } | 121 } |
| 120 | 122 |
| 121 TEST_F(MountTest, BadDecryptTest) { | 123 TEST_F(MountTest, BadDecryptTest) { |
| 122 // create a Mount instance that points to a good shadow root, test that it | 124 // create a Mount instance that points to a good shadow root, test that it |
| 123 // properly denies access with a bad passkey | 125 // properly denies access with a bad passkey |
| 124 Mount mount(cryptohome::kDefaultSharedUser, | 126 Mount mount; |
| 125 cryptohome::kDefaultEntropySource, | 127 mount.set_shadow_root(kImageDir); |
| 126 cryptohome::kDefaultHomeDir, | 128 mount.set_skel_source(kSkelDir); |
| 127 kImageDir, | 129 |
| 128 kSkelDir); | 130 cryptohome::SecureBlob passkey; |
| 129 UsernamePasskey up = UsernamePasskey::FromUsernamePassword(kFakeUser, | 131 cryptohome::Crypto::PasswordToPasskey("bogus", system_salt_, &passkey); |
| 130 "bogus", | 132 UsernamePasskey up(kFakeUser, passkey); |
| 131 system_salt_); | |
| 132 | 133 |
| 133 EXPECT_EQ(true, mount.Init()); | 134 EXPECT_EQ(true, mount.Init()); |
| 134 EXPECT_EQ(false, mount.TestCredentials(up)); | 135 EXPECT_EQ(false, mount.TestCredentials(up)); |
| 135 } | 136 } |
| 136 | 137 |
| 137 TEST_F(MountTest, CreateCryptohomeTest) { | 138 TEST_F(MountTest, CreateCryptohomeTest) { |
| 138 // creates a cryptohome | 139 // creates a cryptohome |
| 139 Mount mount(cryptohome::kDefaultSharedUser, | 140 Mount mount; |
| 140 cryptohome::kDefaultEntropySource, | 141 mount.set_shadow_root(kImageDir); |
| 141 cryptohome::kDefaultHomeDir, | 142 mount.set_skel_source(kSkelDir); |
| 142 kImageDir, | |
| 143 kSkelDir); | |
| 144 // Don't set the vault ownership--this will fail | |
| 145 mount.set_set_vault_ownership(false); | 143 mount.set_set_vault_ownership(false); |
| 146 UsernamePasskey up = UsernamePasskey::FromUsernamePassword(kFakeUser2, | 144 |
| 147 "one", | 145 cryptohome::SecureBlob passkey; |
| 148 system_salt_); | 146 cryptohome::Crypto::PasswordToPasskey("one", system_salt_, &passkey); |
| 147 UsernamePasskey up(kFakeUser2, passkey); |
| 149 | 148 |
| 150 EXPECT_EQ(true, mount.Init()); | 149 EXPECT_EQ(true, mount.Init()); |
| 151 EXPECT_EQ(true, mount.CreateCryptohome(up, 0)); | 150 EXPECT_EQ(true, mount.CreateCryptohome(up, 0)); |
| 152 | 151 |
| 153 FilePath image_dir(kImageDir); | 152 FilePath image_dir(kImageDir); |
| 154 FilePath user_path = image_dir.Append(up.GetObfuscatedUsername(system_salt_)); | 153 FilePath user_path = image_dir.Append(up.GetObfuscatedUsername(system_salt_)); |
| 155 FilePath key_path = user_path.Append("master.0"); | 154 FilePath key_path = user_path.Append("master.0"); |
| 156 FilePath vault_path = user_path.Append("vault"); | 155 FilePath vault_path = user_path.Append("vault"); |
| 157 FilePath skel_testfile_path = user_path.Append("sub_path/.testfile"); | 156 FilePath skel_testfile_path = user_path.Append("sub_path/.testfile"); |
| 158 | 157 |
| 159 EXPECT_EQ(true, file_util::PathExists(key_path)); | 158 EXPECT_EQ(true, file_util::PathExists(key_path)); |
| 160 EXPECT_EQ(true, file_util::PathExists(vault_path)); | 159 EXPECT_EQ(true, file_util::PathExists(vault_path)); |
| 161 } | 160 } |
| 162 | 161 |
| 163 TEST_F(MountTest, SystemSaltTest) { | 162 TEST_F(MountTest, SystemSaltTest) { |
| 164 // checks that cryptohome reads the system salt | 163 // checks that cryptohome reads the system salt |
| 165 Mount mount(cryptohome::kDefaultSharedUser, | 164 Mount mount; |
| 166 cryptohome::kDefaultEntropySource, | 165 mount.set_shadow_root(kImageDir); |
| 167 cryptohome::kDefaultHomeDir, | 166 mount.set_skel_source(kSkelDir); |
| 168 kImageDir, | |
| 169 kSkelDir); | |
| 170 | 167 |
| 171 EXPECT_EQ(true, mount.Init()); | 168 EXPECT_EQ(true, mount.Init()); |
| 172 chromeos::Blob system_salt = mount.GetSystemSalt(); | 169 chromeos::Blob system_salt; |
| 170 mount.GetSystemSalt(&system_salt); |
| 173 EXPECT_EQ(true, (system_salt.size() == system_salt_.size())); | 171 EXPECT_EQ(true, (system_salt.size() == system_salt_.size())); |
| 174 EXPECT_EQ(0, memcmp(&system_salt[0], &system_salt_[0], | 172 EXPECT_EQ(0, memcmp(&system_salt[0], &system_salt_[0], |
| 175 system_salt.size())); | 173 system_salt.size())); |
| 176 } | 174 } |
| 177 | 175 |
| 178 } // namespace cryptohome | 176 } // namespace cryptohome |
| OLD | NEW |