Skip to content

Commit 3a48bcf

Browse files
MartinVokurekjohlju
MartinVokurek
authored and
johlju
committed
Correctly handles fully decrypted volumes when correct Key Protectors is present (#16)
- Fixed issue which caused Test-TargetResource to incorrectly succeed on fully decrypted volumes when correct Key Protectors were present (issue #13)
1 parent 9b00d76 commit 3a48bcf

File tree

3 files changed

+121
-6
lines changed

3 files changed

+121
-6
lines changed

‎Misc/xBitlockerCommon.psm1‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ function EnableBitlocker
8686
{
8787
throw "A TpmProtector must be used if Pin is used."
8888
}
89-
89+
9090
if ($PSBoundParameters.ContainsKey("AdAccountOrGroupProtector") -and $PrimaryProtector -notlike "AdAccountOrGroupProtector" -and !(ContainsKeyProtector -Type "AdAccountOrGroup" -KeyProtectorCollection $blv.KeyProtector))
9191
{
9292
Write-Verbose "Adding AdAccountOrGroupProtector"
@@ -164,7 +164,7 @@ function EnableBitlocker
164164
$handledTpmAlready = $true
165165

166166
$params.Add("Pin", $Pin.Password)
167-
167+
168168
if ($PSBoundParameters.ContainsKey("StartupKeyProtector"))
169169
{
170170
$params.Add("TpmAndPinAndStartupKeyProtector", $true)
@@ -181,7 +181,7 @@ function EnableBitlocker
181181
$handledTpmAlready = $true
182182

183183
$params.Add("TpmAndStartupKeyProtector", $true)
184-
$params.Add("StartupKeyPath", $StartupKeyPath)
184+
$params.Add("StartupKeyPath", $StartupKeyPath)
185185
}
186186

187187

@@ -325,6 +325,11 @@ function TestBitlocker
325325
Write-Verbose "Unable to locate MountPoint: $($MountPoint)"
326326
return $false
327327
}
328+
elseif ($blv.VolumeStatus -eq "FullyDecrypted")
329+
{
330+
Write-Verbose "MountPoint: $($MountPoint) Not Encrypted"
331+
return $false
332+
}
328333
elseif ($blv.KeyProtector -eq $null -or $blv.KeyProtector.Count -eq 0)
329334
{
330335
Write-Verbose "No key protectors on MountPoint: $($MountPoint)"
@@ -352,7 +357,7 @@ function TestBitlocker
352357
if ($PSBoundParameters.ContainsKey("Pin") -and !(ContainsKeyProtector -Type "TpmPin" -KeyProtectorCollection $blv.KeyProtector -StartsWith $true))
353358
{
354359
Write-Verbose "MountPoint '$($MountPoint) 'does not have TpmPin assigned."
355-
return $false
360+
return $false
356361
}
357362

358363
if ($PSBoundParameters.ContainsKey("RecoveryKeyProtector") -and !(ContainsKeyProtector -Type "ExternalKey" -KeyProtectorCollection $blv.KeyProtector))
@@ -383,7 +388,7 @@ function TestBitlocker
383388
{
384389
Write-Verbose "MountPoint '$($MountPoint) 'does not have TPM + StartupKey protector."
385390
return $false
386-
}
391+
}
387392
}
388393
}
389394

@@ -397,7 +402,7 @@ function TestBitlocker
397402
return $true
398403
}
399404

400-
#Ensures that required Bitlocker prereqs are installed
405+
#Ensures that required Bitlocker prereqs are installed
401406
function CheckForPreReqs
402407
{
403408
$hasAllPreReqs = $true

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,8 @@ Defaults to false.
131131
* Fixed encoding on README.md.
132132
* Added `PowerShellVersion = '4.0'`, and updated copyright information, in the
133133
module manifest.
134+
* Fixed issue which caused Test to incorrectly succeed on fully decrypted volumes when correct Key Protectors were present ([issue #13](https://github.com/PowerShell/xBitlocker/issues/13))
135+
134136

135137
### 1.1.0.0
136138

‎Tests/Unit/xBitlockerCommon.tests.ps1‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
$script:moduleRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
2+
Import-Module -Name (Join-Path -Path $script:moduleRoot -ChildPath (Join-Path -Path 'Misc' -ChildPath 'xBitlockerCommon.psm1')) -Force
3+
4+
# Begin Testing
5+
try
6+
{
7+
InModuleScope "xBitlockerCommon" {
8+
9+
function Get-BitlockerVolume
10+
{
11+
param
12+
(
13+
[Parameter()]
14+
[System.String]
15+
$MountPoint
16+
)
17+
}
18+
19+
Describe "xBitlockerCommon\TestBitlocker" {
20+
21+
Context 'When OS Volume is not Encrypted and No Key Protectors Assigned' {
22+
Mock `
23+
-CommandName Get-BitlockerVolume `
24+
-ModuleName 'xBitlockerCommon' `
25+
-MockWith {
26+
# Decrypted with no Key Protectors
27+
return @{
28+
VolumeType = 'OperatingSystem'
29+
MountPoint = $MountPoint
30+
CapacityGB = 500
31+
VolumeStatus = 'FullyDecrypted'
32+
EncryptionPercentage = 0
33+
KeyProtector = @()
34+
AutoUnlockEnabled = $null
35+
ProtectionStatus = 'Off'
36+
}
37+
}
38+
39+
It 'Should Fail The Test (TPM and RecoveryPassword Protectors)' {
40+
TestBitlocker -MountPoint 'C:' -PrimaryProtector 'TPMProtector' -RecoveryPasswordProtector $true | Should -Be $false
41+
}
42+
}
43+
44+
Context 'When OS Volume is Encrypted using TPM and Recovery Password Protectors' {
45+
Mock `
46+
-CommandName Get-BitlockerVolume `
47+
-ModuleName 'xBitlockerCommon' `
48+
-MockWith {
49+
# Encrypted with TPM and Recovery Password Key Protectors
50+
return @{
51+
VolumeType = 'OperatingSystem'
52+
MountPoint = $MountPoint
53+
CapacityGB = 500
54+
VolumeStatus = 'FullyEncrypted'
55+
EncryptionPercentage = 100
56+
KeyProtector = @(
57+
@{
58+
KeyProtectorType = 'Tpm'
59+
},
60+
@{
61+
KeyProtectorType = 'RecoveryPassword'
62+
}
63+
)
64+
AutoUnlockEnabled = $null
65+
ProtectionStatus = 'On'
66+
}
67+
}
68+
69+
It 'Should Pass The Test (TPM and RecoveryPassword Protectors)' {
70+
TestBitlocker -MountPoint 'C:' -PrimaryProtector 'TPMProtector' -RecoveryPasswordProtector $true -verbose | Should -Be $true
71+
}
72+
}
73+
74+
Context 'When OS Volume is Decrypted, but has TPM and Recovery Password Protectors assigned' {
75+
Mock `
76+
-CommandName Get-BitlockerVolume `
77+
-ModuleName 'xBitlockerCommon' `
78+
-MockWith {
79+
# Encrypted with TPM and Recovery Password Key Protectors
80+
return @{
81+
VolumeType = 'OperatingSystem'
82+
MountPoint = $MountPoint
83+
CapacityGB = 500
84+
VolumeStatus = 'FullyDecrypted'
85+
EncryptionPercentage = 0
86+
KeyProtector = @(
87+
@{
88+
KeyProtectorType = 'Tpm'
89+
},
90+
@{
91+
KeyProtectorType = 'RecoveryPassword'
92+
}
93+
)
94+
AutoUnlockEnabled = $null
95+
ProtectionStatus = 'Off'
96+
}
97+
}
98+
99+
It 'Should Fail The Test (TPM and RecoveryPassword Protectors)' {
100+
TestBitlocker -MountPoint 'C:' -PrimaryProtector 'TPMProtector' -RecoveryPasswordProtector $true | Should -Be $false
101+
}
102+
}
103+
}
104+
}
105+
}
106+
finally
107+
{
108+
}

0 commit comments

Comments
 (0)