guara/crates/guara-core/tests/e2e_crypt.rs

//! Ponta a ponta: volume LUKS2 com ext4 dentro, arquivo apagado, senha informada ao Guará.

mod common;
use common::*;
use guara_core::assemble::{assemble_source, Assembly, SecretInput};
use guara_core::scan::{self, Outcome};
use guara_core::source::{FileSource, Source};
use guara_core::*;
use std::path::Path;
use std::process::{Command, Stdio};
use std::sync::Arc;

fn have(t: &str) -> bool {
    Command::new("sh")
        .args(["-c", &format!("command -v {t}")])
        .output()
        .map(|o| o.status.success())
        .unwrap_or(false)
}

fn run_stdin(c: &mut Command, input: &str) -> bool {
    use std::io::Write;
    let mut ch = c
        .stdin(Stdio::piped())
        .stdout(Stdio::null())
        .stderr(Stdio::null())
        .spawn()
        .unwrap();
    ch.stdin
        .take()
        .unwrap()
        .write_all(input.as_bytes())
        .unwrap();
    ch.wait().unwrap().success()
}

fn data(seed: u64, n: usize) -> Vec<u8> {
    let mut x = seed | 1;
    (0..n)
        .map(|_| {
            x ^= x << 13;
            x ^= x >> 7;
            x ^= x << 17;
            (x >> 24) as u8
        })
        .collect()
}

#[test]
fn deleted_file_inside_luks2_is_recovered_with_password() {
    if !(have("cryptsetup") && have("mke2fs") && have("debugfs") && have("python3")) {
        eprintln!("SKIP: ferramentas ausentes");
        return;
    }
    init();
    let dir = tempfile::tempdir().unwrap();
    let root = dir.path().join("root");
    std::fs::create_dir_all(root.join("docs")).unwrap();
    let secret_doc = data(11, 120_000);
    std::fs::write(root.join("docs/segredo.dat"), &secret_doc).unwrap();
    std::fs::write(root.join("docs/fica.dat"), data(12, 5000)).unwrap();
    let plain = dir.path().join("plain.img");
    std::fs::File::create(&plain)
        .unwrap()
        .set_len(8 << 20)
        .unwrap();
    assert!(Command::new("mke2fs")
        .args(["-q", "-F", "-t", "ext4", "-d"])
        .arg(&root)
        .arg(&plain)
        .status()
        .unwrap()
        .success());
    let dbg = |c: &str| {
        Command::new("debugfs")
            .arg("-w")
            .arg("-R")
            .arg(c)
            .arg(&plain)
            .output()
            .unwrap()
    };
    dbg("rm /docs/segredo.dat");

    let img = dir.path().join("luks.img");
    std::fs::File::create(&img)
        .unwrap()
        .set_len(32 << 20)
        .unwrap();
    let pw = "correct horse";
    let mut fmt = Command::new("cryptsetup");
    fmt.args([
        "luksFormat",
        "--batch-mode",
        "--type",
        "luks2",
        "--pbkdf",
        "pbkdf2",
        "--pbkdf-force-iterations",
        "1000",
        "--sector-size",
        "512",
        "--key-file",
        "-",
    ])
    .arg(&img);
    assert!(run_stdin(&mut fmt, pw));
    let vkf = dir.path().join("vk");
    let mut d = Command::new("cryptsetup");
    d.args([
        "luksDump",
        "--dump-volume-key",
        "--batch-mode",
        "--key-file",
        "-",
        "--volume-key-file",
    ])
    .arg(&vkf)
    .arg(&img);
    assert!(run_stdin(&mut d, pw));
    let out = Command::new("cryptsetup")
        .arg("luksDump")
        .arg(&img)
        .output()
        .unwrap();
    let t = String::from_utf8_lossy(&out.stdout).to_string();
    let off: u64 = t
        .lines()
        .skip_while(|l| !l.starts_with("Data segments"))
        .find(|l| l.contains("offset:"))
        .unwrap()
        .split(':')
        .nth(1)
        .unwrap()
        .split_whitespace()
        .next()
        .unwrap()
        .parse()
        .unwrap();
    assert!(Command::new("python3")
        .arg(Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/support/luks_encrypt.py"))
        .arg(&img)
        .arg(&plain)
        .arg(&vkf)
        .arg(off.to_string())
        .arg("aes-xts-plain64")
        .arg("512")
        .status()
        .unwrap()
        .success());

    let base: Arc<dyn Source> = Arc::new(FileSource::open(&img).unwrap());
    // Sem senha: o volume segue fechado e a varredura não inventa arquivos.
    let locked = assemble_source(base.clone(), &Assembly::default()).unwrap();
    assert_eq!(locked.unlocked.len(), 0);
    assert_eq!(locked.locked.len(), 1);

    let asm = Assembly {
        secrets: vec![SecretInput::Password { value: pw.into() }],
        ..Default::default()
    };
    let open = assemble_source(base, &asm).unwrap();
    assert_eq!(open.unlocked.len(), 1);
    let mut sink = Collect::default();
    let outc = scan::run(
        open.source.as_ref(),
        &ScanOptions {
            mode: ScanMode::Deep,
            ..Default::default()
        },
        None,
        &[],
        &|| false,
        &mut sink,
    );
    assert!(matches!(outc, Outcome::Completed));
    let f = sink
        .found
        .iter()
        .find(|f| f.name == "segredo.dat")
        .unwrap_or_else(|| {
            panic!(
                "não achou: {:?}",
                sink.found.iter().map(|f| &f.name).collect::<Vec<_>>()
            )
        });
    assert_eq!(f.size, 120_000);
    let dest = tempfile::tempdir().unwrap();
    let refs = vec![f];
    let rep = recover::recover(
        open.source.as_ref(),
        &refs,
        dest.path(),
        &|| false,
        &mut |_, _, _| {},
    )
    .unwrap();
    assert!(rep.failed.is_empty());
    let p = &rep.recovered[0].path;
    let p = if Path::new(p).is_absolute() {
        Path::new(p).to_path_buf()
    } else {
        dest.path().join(p)
    };
    assert!(std::fs::read(p).unwrap() == secret_doc);
}