summaryrefslogtreecommitdiffstats
path: root/tests/verity-compat-test
blob: 8a28a12eb67542ca9518557c75ec5cc9a4b1e14a (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
#!/bin/bash

[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".."
VERITYSETUP=$CRYPTSETUP_PATH/veritysetup
VERITYSETUP_VALGRIND=../.libs/veritysetup
VERITYSETUP_LIB_VALGRIND=../.libs

DEV_NAME=verity3273
DEV_NAME2=verity3273x
DEV_OUT="$DEV_NAME.out"
IMG=verity-data
IMG_HASH=verity-hash
IMG_TMP=tst-dev
FEC_DEV=tst_fec123
# If we need deterministic image creation
DEV_SALT=9e7457222290f1bac0d42ad2de2d602a87bb871c22ab70ca040bad450578a436
DEV_UUID=a60c98d2-ae9b-4865-bfcb-b4e3ace11033

function remove_mapping()
{
	[ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove $DEV_NAME2 >/dev/null 2>&1
	[ -b /dev/mapper/$DEV_NAME ] && dmsetup remove $DEV_NAME >/dev/null 2>&1
	[ ! -z "$LOOPDEV1" ] && losetup -d $LOOPDEV1 >/dev/null 2>&1
	rm -f $IMG $IMG.roothash $IMG_HASH $DEV_OUT $FEC_DEV $IMG_TMP >/dev/null 2>&1
	LOOPDEV1=""
	LOOPDEV2=""
}

function fail()
{
	[ -n "$1" ] && echo "$1"
	echo "FAILED backtrace:"
	while caller $frame; do ((frame++)); done
	[ -f $DEV_OUT ] && cat $DEV_OUT
	remove_mapping
	exit 2
}

function skip()
{
	[ -n "$1" ] && echo "$1"
	exit 77
}

function prepare() # $1 dev1_siz [$2 dev2_size]
{
	remove_mapping

	dd if=/dev/zero of=$IMG bs=1k count=$1 >/dev/null 2>&1
	LOOPDEV1=$(losetup -f 2>/dev/null)
	[ -z "$LOOPDEV1" ] && fail "No free loop device"
	losetup $LOOPDEV1 $IMG

	[ -z "$2" ] && return
	LOOPDEV2=$IMG_HASH
}

function wipe()
{
	dd if=/dev/zero of=$LOOPDEV1 bs=256k >/dev/null 2>&1
	rm -f $IMG_HASH $DEV_OUT >/dev/null 2>&1
}

function check_exists()
{
	[ -b /dev/mapper/$DEV_NAME ] || fail
}

function check_version() # MAJ MIN
{
	VER_STR=$(dmsetup targets | grep verity | cut -f 3 -dv)
	[ -z "$VER_STR" ] && fail "Failed to parse dm-verity version."

	VER_MAJ=$(echo $VER_STR | cut -f 1 -d.)
	VER_MIN=$(echo $VER_STR | cut -f 2 -d.)

	test $VER_MAJ -gt $1 && return 0
	test $VER_MIN -ge $2 && return 0
	return 1
}

function compare_out() # $1 what, $2 expected
{
	OPT=$(grep -v "^#" $DEV_OUT | grep -i "$1" | sed -e s/.*\:\ // )
	[ -z "$OPT" ] && fail
	[ $OPT != $2 ] && fail "$1 differs ($2)"
}

function check_root_hash_fail()
{
	echo -n "Root hash check "
	ROOT_HASH=$($VERITYSETUP format $IMG $IMG_HASH --fec-device $FEC_DEV --fec-roots 2 -h sha256 | grep -e "Root hash" | cut -d: -f2 | tr -d "\t\n ")
	ROOT_HASH_BAD=abcdef0000000000000000000000000000000000000000000000000000000000

	$VERITYSETUP verify $IMG $IMG_HASH $ROOT_HASH || fail
	$VERITYSETUP verify $IMG $IMG_HASH $ROOT_HASH_BAD >/dev/null 2>&1 && fail
	$VERITYSETUP verify $IMG $IMG_HASH $ROOT_HASH_BAD --fec-device $FEC_DEV --fec-roots 2 >/dev/null 2>&1 && fail

	$VERITYSETUP open $IMG $DEV_NAME $IMG_HASH $ROOT_HASH || fail
	check_exists
	dd if=/dev/mapper/$DEV_NAME of=/dev/null bs=4096 count=1 >/dev/null 2>&1
	dmsetup status $DEV_NAME | grep "verity V" >/dev/null || fail
	$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail

	$VERITYSETUP open $IMG $DEV_NAME $IMG_HASH $ROOT_HASH_BAD >/dev/null 2>&1 || fail
	check_exists
	dd if=/dev/mapper/$DEV_NAME of=/dev/null bs=4096 count=1 >/dev/null 2>&1
	dmsetup status $DEV_NAME | grep "verity C" >/dev/null || fail
	$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail

	echo "[OK]"
}

function check_root_hash() # $1 size, $2 hash, $3 salt, $4 version, $5 hash, [$6 offset]
{
	local FORMAT_PARAMS
	local VERIFY_PARAMS
	local ROOT_HASH

	if [ -z "$LOOPDEV2" ] ; then
		BLOCKS=$(($6 / $1))
		DEV_PARAMS="$LOOPDEV1 $LOOPDEV1 \
			   --hash-offset $6 \
			   --data-blocks=$BLOCKS --debug"
	else
		DEV_PARAMS="$LOOPDEV1 $LOOPDEV2"
	fi

	for root_hash_as_file in yes no; do
	for sb in yes no; do
	FORMAT_PARAMS="--format=$4 --data-block-size=$1 --hash-block-size=$1 --hash=$5 --salt=$3"
	if [ $sb == yes ] ; then
		VERIFY_PARAMS=""
	else
		FORMAT_PARAMS="$FORMAT_PARAMS --no-superblock"
		VERIFY_PARAMS=$FORMAT_PARAMS
	fi
	if [ $root_hash_as_file == yes ] ; then
		echo -n $2 > $IMG.roothash
		FORMAT_PARAMS="$FORMAT_PARAMS --root-hash-file=$IMG.roothash"
		VERIFY_PARAMS="$VERIFY_PARAMS --root-hash-file=$IMG.roothash"
		ROOT_HASH=""
	else
		ROOT_HASH="$2"
	fi

	for fail in data hash; do
	wipe
	echo -n "V$4(sb=$sb root_hash_as_file=$root_hash_as_file) $5 block size $1: "
	$VERITYSETUP format $DEV_PARAMS $FORMAT_PARAMS >$DEV_OUT
	if [ $? -ne 0 ] ; then
		if [[ $1 =~ "sha2" ]] ; then
			fail "Cannot format device."
		fi
		return
	fi

	echo -n "[root hash]"
	compare_out "root hash" $2
	compare_out "salt" "$3"

	$VERITYSETUP verify $DEV_PARAMS $VERIFY_PARAMS $ROOT_HASH >>$DEV_OUT 2>&1 || fail
	echo -n "[verify]"

	$VERITYSETUP create $DEV_NAME $DEV_PARAMS $VERIFY_PARAMS $ROOT_HASH  >>$DEV_OUT 2>&1 || fail
	check_exists
	echo -n "[activate]"

	dd if=/dev/mapper/$DEV_NAME of=/dev/null bs=$1 2>/dev/null
	dmsetup status $DEV_NAME | grep "verity V" >/dev/null || fail
	echo -n "[in-kernel verify]"

	$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail

	case $fail in
	data)
		dd if=/dev/urandom of=$LOOPDEV1 bs=1 seek=3456 count=8 conv=notrunc 2>/dev/null
		TXT="data_dev"
		;;
	hash)
		if [ -z "$LOOPDEV2" ] ; then
			dd if=/dev/urandom of=$LOOPDEV1 bs=1 seek=$((8193 + $4)) count=8 conv=notrunc 2>/dev/null
		else
			dd if=/dev/urandom of=$LOOPDEV2 bs=1 seek=8193 count=8 conv=notrunc 2>/dev/null
		fi
                TXT="hash_dev"
		;;
	esac

	$VERITYSETUP verify $DEV_PARAMS $VERIFY_PARAMS $ROOT_HASH >>$DEV_OUT 2>&1 && \
		fail "userspace check for $TXT corruption"
	$VERITYSETUP create $DEV_NAME $DEV_PARAMS $VERIFY_PARAMS $ROOT_HASH >>$DEV_OUT 2>&1 || \
		fail "activation"
	dd if=/dev/mapper/$DEV_NAME of=/dev/null bs=$1 2>/dev/null
	dmsetup status $DEV_NAME | grep "verity V" >/dev/null && \
		fail "in-kernel check for $TXT corruption"
	$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail "deactivation"
	echo "[$TXT corruption]"
	done
	done
	done
}

function corrupt_device() # $1 device, $2 device_size(in bytes), $3 #{corrupted_bytes}
{
	# Repeatable magic corruption :-)
	CORRUPT=$3
	RANDOM=43
	while [ "$CORRUPT" -gt 0 ]; do
		SEEK=$RANDOM
		while [ $SEEK -ge $2 ] ; do SEEK=$RANDOM; done
		echo -n -e "\x55" | dd of=$1 bs=1 count=1 seek=$SEEK conv=notrunc > /dev/null 2>&1
		CORRUPT=$(($CORRUPT - 1))
	done
}

# $1 data_device, $2 hash_device, $3 fec_device, $4 data/hash_block_size(in bytes),
# $5 data_size(in blocks), $6 device_size(in blocks), $7 hash_offset(in bytes),
# $8 fec_offset(in bytes), $9 fec_roots, ${10} corrupted_bytes, [${11} superblock(y/n), ${12} salt]
function check_fec()
{
	INDEX=25
	dd if=/dev/zero of=$1 bs=$4 count=$6 > /dev/null 2>&1

	echo -n "Block_size: $4, Data_size: $(($4 * $5))B, FEC_roots: $9, Corrupted_bytes: ${10} "

	PARAMS=" --data-block-size=$4 --hash-block-size=$4 "
	if [ "$5" -ne "$6" ]; then
		PARAMS="$PARAMS --data-blocks=$5"
	fi

	if [ "$7" -ne 0 ]; then
		PARAMS="$PARAMS --hash-offset=$7"
	fi

	if [ "$8" -ne 0 ]; then
		PARAMS="$PARAMS --fec-offset=$8"
	fi

	if [ "${11}" == "n" ]; then
		INDEX=24
		echo -n "[no-superblock]"
		PARAMS="$PARAMS --no-superblock --salt=${12}"
	elif [ -n "${12}" ]; then
		PARAMS="$PARAMS --salt=${12}"
	fi

	if [[ "$1" == "$2" && "$1" == "$3" ]]; then
		echo -n "[one_device_test]"
		dd if=/dev/zero of=$IMG_TMP bs=$4 count=$5  > /dev/null 2>&1
		HASH_ORIG=$(sha256sum $IMG_TMP | cut -d' ' -f 1)
	else
		HASH_ORIG=$(sha256sum $1 | cut -d' ' -f 1)
	fi

	ROOT_HASH=$($VERITYSETUP format $1 $2 --fec-device=$3 $PARAMS | grep -e "Root hash" | cut -d: -f2 | tr -d "\t\n ")

	corrupt_device $1 $(($5 * $4)) ${10}

	$VERITYSETUP create $DEV_NAME $1 $2 $ROOT_HASH --fec-device=$3 $PARAMS > /dev/null 2>&1
	if [ "$?" -ne "0" ] ; then
		echo "[N/A, test skipped]"
		return 3
	fi

	udevadm settle > /dev/null 2>&1

	dd if=/dev/mapper/$DEV_NAME of=$IMG_TMP > /dev/null 2>&1
	HASH_REPAIRED=$(sha256sum $IMG_TMP | cut -d' ' -f 1)

	$VERITYSETUP close $DEV_NAME

	if [ "$HASH_ORIG" != "$HASH_REPAIRED" ]; then
		echo -n "[kernel correction failed]"
		$VERITYSETUP verify $1 $2 $ROOT_HASH --fec-device=$3 $PARAMS >/dev/null 2>&1 && fail "Userspace verify should fail"
		echo -n "[userspace verify failed]"
		RET=1
	else
		echo -n "[repaired in kernel]"
		$VERITYSETUP verify $1 $2 $ROOT_HASH --fec-device=$3 $PARAMS >/dev/null 2>&1 || fail "Userspace verify failed"
		echo "[userspace verify][OK]"
		RET=0
	fi
	rm $1 $2 $3 $IMG_TMP > /dev/null 2>&1
	return $RET
}

function check_option() # $1 size, $2 hash, $3 salt, $4 version, $5 hash, $6 CLI option, $7 status option
{
	DEV_PARAMS="$LOOPDEV1 $LOOPDEV2"
	FORMAT_PARAMS="--format=$4 --data-block-size=$1 --hash-block-size=$1 --hash=$5 --salt=$3"

	echo -n "Option $6 "
	$VERITYSETUP format $DEV_PARAMS $FORMAT_PARAMS >/dev/null 2>&1 || fail
	$VERITYSETUP create $DEV_NAME $DEV_PARAMS $2 $6 >/dev/null 2>&1 || fail
	check_exists
	$VERITYSETUP status $DEV_NAME 2>/dev/null | grep flags | grep -q $7 || fail
	dmsetup table $DEV_NAME 2>/dev/null | grep -q $7 || fail
	$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail
	echo "[OK]"
}

function valgrind_setup()
{
	command -v valgrind >/dev/null || fail "Cannot find valgrind."
	[ ! -f $VERITYSETUP_VALGRIND ] && fail "Unable to get location of veritysetup executable."
	export LD_LIBRARY_PATH="$VERITYSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH"
}

function valgrind_run()
{
	INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${VERITYSETUP_VALGRIND} "$@"
}

function checkOffsetBug() # $1 size, $2 hash-offset, $3 data-blocks
{
	echo -n "Size :: $1 B | Hash-offset :: $2 blocks | Data-blocks :: $3 "
	dd if=/dev/zero of=$IMG bs=1 count=0 seek=$1 >/dev/null 2>&1
	$VERITYSETUP --data-blocks=$3 --hash-offset=$2 format $IMG $IMG >/dev/null 2>&1 || fail "Test [hash-offset greater than 2G] failed"
	echo "[OK]"
	remove_mapping
}

function checkOverlapBug() # $1 size, $2 hash-offset, $3 data-blocks, $4 block_size, $5 fec_offset
{
	echo -n "Device-size :: $1 B | "
	[ $# -ge 3 ] && echo -n "Data-blocks :: $3 blocks| "
	[ $# -lt 3 ] && echo -n "Data-blocks :: whole device | "
	[ $# -ge 4 ] && echo -n "Block-size :: $4 B | "
	[ $# -lt 4 ] && echo -n "Block-size :: 4096 B | "
	echo -n "Hash-offset :: $2 B | "

	dd if=/dev/zero of=$IMG bs=1 count=0 seek=$1 >/dev/null 2>&1
	if [ -z $3 ] ; then
		# veritysetup must fail
		$VERITYSETUP --hash-offset=$2 format $IMG $IMG >/dev/null 2>&1 && fail "Test [overlap with option \"--data-blocks\" not entered] failed"
	else
		$VERITYSETUP --data-block-size=$4 --hash-block-size=$4 --data-blocks=$3 --hash-offset=$2 format $IMG $IMG >/dev/null 2>&1
		RET=$?
		[ "$3" -gt "$(($2 / $4))" ] && [ "$RET" -eq "0" ] && fail "Test [overlap - hash-offset in data area] failed"
	fi

	if [ $# -eq 5 ] ; then
		echo -n "FEC-offset :: $5 B | "
		PARAMS="--data-block-size=$4 --hash-block-size=$4 --data-blocks=$3 --fec-device=$IMG --fec-offset=$5"

		# test data-fec area overlap
		$VERITYSETUP format $IMG $IMG_HASH $PARAMS >/dev/null 2>&1
		RET=$?
		[ "$(($3*$4))" -gt "$5" ] && [ "$RET" -eq "0" ] && fail "Test [data/fec area overlap] failed"

		HASH_SIZE=$(stat --printf="%s" $IMG_HASH)

		# test hash-fec area overlap
		$VERITYSETUP format $IMG $IMG $PARAMS --hash-offset=$2 >/dev/null 2>&1
		RET=$?
		[ "$(($2 + $HASH_SIZE))" -gt "$5" ] && [ "$RET" -eq "0" ] && fail "Test [hash/fec area overlap] failed"
	fi

	echo "[OK]"
	remove_mapping
}

# $1 size, $2 block size, $3 roots, $4 hash offset, $5 fec offset,
# $6 one dev(1 - one device, 2 - one device for data and hash, one device for fec data, 3 - three separate devices),
# $7 #{corrupted bytes}
function checkUserSpaceRepair()
{
	BS=512
	COUNT=50000
	dd if=/dev/zero of=$IMG bs=$BS count=$COUNT >/dev/null 2>&1
	PARAMS="--data-block-size=$2 --hash-block-size=$2 --fec-roots=$3"
	[ "$1" -gt 0 ] && PARAMS="$PARAMS --data-blocks=$1" && BS=$2 && COUNT=$1

	# different parameters for different number of devices
	[ "$6" -eq 1 ] && HASH_DEV=$IMG && FEC=$IMG && PARAMS="$PARAMS --hash-offset=$4 --fec-offset=$5" && echo -n "[One device]"
	[ "$6" -eq 2 ] && HASH_DEV=$IMG && FEC=$FEC_DEV && PARAMS="$PARAMS --hash-offset=$4" && echo -n "[Two separate data/hash and fec devices]"
	[ "$6" -eq 3 ] && HASH_DEV=$IMG_HASH && FEC=$FEC_DEV && echo -n "[Three separate devices]"

	echo -n "[nroots::$3]"

	ROOT_HASH=$($VERITYSETUP format $IMG $HASH_DEV --fec-device $FEC $PARAMS --salt=$DEV_SALT --uuid=$DEV_UUID | grep -e "Root hash" | cut -d: -f2 | tr -d "\t\n ")

	echo -n "[Errors can be corrected]"
	corrupt_device $IMG $(($BS*$COUNT)) $7
	$VERITYSETUP verify $IMG $HASH_DEV $ROOT_HASH --fec-device=$FEC $PARAMS >/dev/null 2>&1
	RET=$?
	[ "$RET" -ne 0 ] && fail "Device can be corrected, but it wasn't."
	echo -n "[OK]"

	echo -n "[Errors cannot be corrected]"
	dd if=/dev/urandom of=$IMG bs=$BS count=$COUNT conv=notrunc >/dev/null 2>&1
	$VERITYSETUP verify $IMG $HASH_DEV $ROOT_HASH --fec-device=$FEC $PARAMS >/dev/null 2>&1
	RET=$?
	[ "$RET" -eq 0 ] && fail "Device cannot be correct, but it didn't fail."
	echo "[OK]"
}

function check_concurrent() # $1 hash
{
	DEV_PARAMS="$LOOPDEV1 $LOOPDEV2"

	# First check that with two sequential opens, we are returning the expected -EEXIST
	$VERITYSETUP format $DEV_PARAMS >/dev/null 2>&1 || fail
	$VERITYSETUP create $DEV_NAME $DEV_PARAMS $1 >/dev/null 2>&1 || fail
	check_exists
	$VERITYSETUP create $DEV_NAME $DEV_PARAMS $1 2>&1 >/dev/null | grep -q "Device $DEV_NAME already exists" || fail
	$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail

	# Then do two concurrent opens, and check that libdevmapper did not return -EINVAL, which is
	# not gracefully recoverable. Either could fail depending on scheduling, so just check that
	# the libdevmapper error does not appear in either of the outputs.
	cat /dev/null >$DEV_OUT
	$VERITYSETUP create -v $DEV_NAME $DEV_PARAMS $1 >>$DEV_OUT 2>&1 &
	$VERITYSETUP create -v $DEV_NAME $DEV_PARAMS $1 >>$DEV_OUT 2>&1 &
	wait
	grep -q "Command failed with code .* (wrong or missing parameters)" $DEV_OUT && fail
	check_exists
	rm $DEV_OUT
	$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail

	echo "[OK]"
}

export LANG=C
[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
[ ! -x "$VERITYSETUP" ] && skip "Cannot find $VERITYSETUP, test skipped."

[ -n "$VALG" ] && valgrind_setup && VERITYSETUP=valgrind_run
modprobe dm-verity >/dev/null 2>&1
dmsetup targets | grep verity >/dev/null 2>&1 || skip "Cannot find dm-verity target, test skipped."

# VERITYSETUP tests

SALT=e48da609055204e89ae53b655ca2216dd983cf3cb829f34f63a297d106d53e2d

echo "Verity tests [separate devices]"
prepare 8192 1024
check_root_hash_fail

check_root_hash  512 9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174 $SALT 1 sha256
check_root_hash 1024 54d92778750495d1f80832b486ebd007617d746271511bbf0e295e143da2b3df $SALT 1 sha256
check_root_hash 4096 e522df0f97da4febb882ac40f30b37dc0b444bf6df418929463fa25280f09d5c $SALT 1 sha256
# version 0
check_root_hash 4096 cbbf4ebd004ef65e29b935bb635a39cf754d677f3fa10b0126da725bbdf10f7d $SALT 0 sha256
# no salt
check_root_hash 4096 ef29c902d87350f1da4bfa536e16cebc162a909bf89abe448b81ec500d4fb9bf - 1 sha256
# sha1
check_root_hash 1024 d0e9163ca8844aaa2e88fe5265a8c5d9ee494a99 $SALT 1 sha1
check_root_hash 1024 73509e8e868be6b8ac939817a98a3d35121413b2 dadada 1 sha1

echo "Verity tests [one device offset]"
prepare $((8192 + 1024))
check_root_hash  512 9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174 $SALT 1 sha256 8388608
check_root_hash 1024 54d92778750495d1f80832b486ebd007617d746271511bbf0e295e143da2b3df $SALT 1 sha256 8388608
check_root_hash 4096 e522df0f97da4febb882ac40f30b37dc0b444bf6df418929463fa25280f09d5c $SALT 1 sha256 8388608
# version 0
check_root_hash 4096 cbbf4ebd004ef65e29b935bb635a39cf754d677f3fa10b0126da725bbdf10f7d $SALT 0 sha256 8388608
# no salt
check_root_hash 4096 ef29c902d87350f1da4bfa536e16cebc162a909bf89abe448b81ec500d4fb9bf - 1 sha256 8388608
# sha1
check_root_hash 1024 d0e9163ca8844aaa2e88fe5265a8c5d9ee494a99 $SALT 1 sha1 8388608
check_root_hash 1024 73509e8e868be6b8ac939817a98a3d35121413b2 dadada 1 sha1 8388608

if check_version 1 3; then
	echo "Verity data corruption options test."
	SALT=e48da609055204e89ae53b655ca2216dd983cf3cb829f34f63a297d106d53e2d
	HASH=9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174
	prepare 8192 1024
	check_option 512 $HASH $SALT 1 sha256 "--ignore-corruption" "ignore_corruption"
	check_option 512 $HASH $SALT 1 sha256 "--restart-on-corruption" "restart_on_corruption"
	check_option 512 $HASH $SALT 1 sha256 "--ignore-zero-blocks" "ignore_zero_blocks"
	check_option 512 $HASH $SALT 1 sha256 "--ignore-corruption --ignore-zero-blocks" "ignore_corruption"
	if check_version 1 4; then
		check_option 512 $HASH $SALT 1 sha256 "--check-at-most-once" "check_at_most_once"
	fi
	if check_version 1 7; then
		check_option 512 $HASH $SALT 1 sha256 "--panic-on-corruption" "panic_on_corruption"
	fi

	if check_version 1 9; then
		echo "Verity data performance options test."
		check_option 512 $HASH $SALT 1 sha256 "--use-tasklets" "try_verify_in_tasklet"
	fi
fi

echo "Veritysetup [hash-offset bigger than 2G works] "
checkOffsetBug 3000000000 2499997696 256
checkOffsetBug 10000000000 8000000000 128

echo "Veritysetup [overlap-detection] "
checkOverlapBug 2097152 1433600
checkOverlapBug 2097152 1433600 350 4096
checkOverlapBug 2097152 1228800 350 4096 # data-hash overlap
checkOverlapBug 2097152 0 350 4096 1228800 # data-fec overlap
checkOverlapBug 10240000 256000 400 512 256512 # hash-fec overlap

if check_version 1 3; then
	echo "Veritysetup [FEC tests]"
	for INDEX in  {1..4}; do
	  # in the first iteration check if we can use FEC (it can be compiled-out)
	  (check_fec $IMG $IMG $IMG 4096 30 150 163840 409600 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) )
	  RET=$?
	  [ "$RET" -eq "3" ] && break
	  [ "$RET" -eq "0" ] || fail "FEC repair failed"

	  (check_fec $IMG $IMG $IMG 512  500 50000 2457600 4915200 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'n' $SALT) || fail "FEC repair failed"
	  (check_fec $IMG $IMG $IMG 512  500 50000 2457600 4915200 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'y' $SALT) || fail "FEC repair failed"
	  (check_fec $IMG $IMG $IMG 4096  64 6250  4194304 8388608 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'n' $SALT) || fail "FEC repair failed"
	  (check_fec $IMG $IMG $IMG 4096  64 6250  4194304 8388608 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'y' $SALT) || fail "FEC repair failed"

	  (check_fec $IMG $IMG_HASH $FEC_DEV 4096 30 30 0 0 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'n' $SALT) || fail "FEC repair failed"
	  (check_fec $IMG $IMG_HASH $FEC_DEV 4096 35 35 0 0 $(($RANDOM % 23 + 2)) $(($INDEX * 4))) || fail "FEC repair failed"
	  (check_fec $IMG $IMG_HASH $FEC_DEV 512 2000 2000 0 0 $(($RANDOM % 23 + 2)) $(($INDEX * 4))) || fail "FEC repair failed"
	  (check_fec $IMG $IMG_HASH $FEC_DEV 1024 2000 2000 0 0 $(($RANDOM % 23 + 2)) $(($INDEX * 4))) || fail "FEC repair failed"
	  # this test should fail
	  (check_fec $IMG $IMG_HASH $FEC_DEV 4096 30 30 0 0 $(($RANDOM % 23 + 2)) $(($RANDOM % 200 + 200))) && fail "FEC repair must fail"
	  echo "[OK]"
	done
fi

echo "Correction in userspace: "
# checkUserSpaceRepair <#blocks> <block_size> <roots> <hash_offset> <fec_offset> <#devices> <#corrupted bytes>
checkUserSpaceRepair -1  512  2 0       0       3 100
checkUserSpaceRepair 400 512  2 256000  0       2 50
checkUserSpaceRepair 500 512  2 2457600  4915200  1 1
checkUserSpaceRepair -1  4096 2 0       0       3 10
checkUserSpaceRepair 400 4096 2 2048000 0       2 1
checkUserSpaceRepair 500 4096 2 2457600 4915200 1 2

echo -n "Verity concurrent opening tests:"
prepare 8192 1024
check_concurrent 9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174

echo -n "Deferred removal of device:"
prepare 8192 1024
$VERITYSETUP format $LOOPDEV1 $IMG_HASH --format=1 --data-block-size=512 --hash-block-size=512 --hash=sha256 --salt=$SALT >/dev/null 2>&1 || fail "Cannot format device."
$VERITYSETUP open $LOOPDEV1 $DEV_NAME $DEV $IMG_HASH 9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174 || fail "Cannot activate device."
dmsetup create $DEV_NAME2 --table "0 8 linear /dev/mapper/$DEV_NAME 0"
[ ! -b /dev/mapper/$DEV_NAME2 ] && fail
$VERITYSETUP close $DEV_NAME >/dev/null 2>&1 && fail
$VERITYSETUP status $DEV_NAME >/dev/null 2>&1 || fail
$VERITYSETUP close --deferred $DEV_NAME >/dev/null 2>&1
if [ $? -eq 0 ] ; then
	dmsetup info $DEV_NAME | grep -q "DEFERRED REMOVE" || fail
	$VERITYSETUP close --cancel-deferred $DEV_NAME >/dev/null 2>&1
	dmsetup info $DEV_NAME | grep -q "DEFERRED REMOVE" >/dev/null 2>&1 && fail
	$VERITYSETUP close --deferred $DEV_NAME >/dev/null 2>&1
	dmsetup remove $DEV_NAME2 || fail
	$VERITYSETUP status $DEV_NAME >/dev/null 2>&1 && fail
	echo "[OK]"
else
	dmsetup remove $DEV_NAME2 >/dev/null 2>&1
	$VERITYSETUP close $DEV_NAME >/dev/null 2>&1
	echo "[N/A]"
fi

remove_mapping
exit 0