mirror of
https://gitlab.com/cryptsetup/cryptsetup.git
synced 2025-12-15 12:50:06 +01:00
Add --with-default-luks-format configure time option.
Add option to override default LUKS format version (currently LUKS1).
This commit is contained in:
Ondrej Kozina
committed by
Milan Broz
Milan Broz
parent
10bb78458d
commit
13796ee4c7
13
configure.ac
13
configure.ac
@@ -578,6 +578,19 @@ test -z "$with_luks2_lock_dir_perms" && with_luks2_lock_dir_perms=0700
|
||||
DEFAULT_LUKS2_LOCK_DIR_PERMS=$with_luks2_lock_dir_perms
|
||||
AC_SUBST(DEFAULT_LUKS2_LOCK_DIR_PERMS)
|
||||
|
||||
dnl Override default LUKS format version (for cryptsetup or cryptsetup-reencrypt format actions only).
|
||||
AC_ARG_WITH([default_luks_format],
|
||||
AS_HELP_STRING([--with-default-luks-format=FORMAT], [default LUKS format version (LUKS1/LUKS2) [LUKS1]]),
|
||||
[], with_default_luks_format=LUKS1
|
||||
)
|
||||
|
||||
case $with_default_luks_format in
|
||||
LUKS1) default_luks=CRYPT_LUKS1 ;;
|
||||
LUKS2) default_luks=CRYPT_LUKS2 ;;
|
||||
*) AC_MSG_ERROR([Unknown default LUKS format. Use LUKS1 or LUKS2 only.]) ;;
|
||||
esac
|
||||
AC_DEFINE_UNQUOTED([DEFAULT_LUKS_FORMAT], [$default_luks], [default LUKS format version])
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
AC_CONFIG_FILES([ Makefile
|
||||
|
||||
@@ -916,38 +916,48 @@ static int _wipe_data_device(struct crypt_device *cd)
|
||||
|
||||
static int action_luksFormat(void)
|
||||
{
|
||||
int r = -EINVAL, keysize, integrity_keysize = 0, luks_version, fd;
|
||||
int r = -EINVAL, keysize, integrity_keysize = 0, fd;
|
||||
struct stat st;
|
||||
const char *header_device;
|
||||
const char *header_device, *type;
|
||||
char *msg = NULL, *key = NULL, *password = NULL;
|
||||
char cipher [MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN], integrity[MAX_CIPHER_LEN];
|
||||
size_t passwordLen;
|
||||
struct crypt_device *cd = NULL;
|
||||
struct crypt_params_luks1 params = {
|
||||
struct crypt_params_luks1 params1 = {
|
||||
.hash = opt_hash ?: DEFAULT_LUKS1_HASH,
|
||||
.data_alignment = opt_align_payload,
|
||||
.data_device = opt_header_device ? action_argv[0] : NULL,
|
||||
};
|
||||
struct crypt_params_luks2 params2 = {
|
||||
.data_alignment = params.data_alignment,
|
||||
.data_device = params.data_device,
|
||||
.data_alignment = params1.data_alignment,
|
||||
.data_device = params1.data_device,
|
||||
.sector_size = opt_sector_size,
|
||||
.label = opt_label,
|
||||
.subsystem = opt_subsystem
|
||||
};
|
||||
void *params;
|
||||
|
||||
if (!opt_type)
|
||||
return -EINVAL;
|
||||
else if (!strcmp(opt_type, "luks2"))
|
||||
luks_version = 2;
|
||||
else
|
||||
luks_version = 1;
|
||||
type = luksType(opt_type);
|
||||
if (!type)
|
||||
type = DEFAULT_LUKS_FORMAT;
|
||||
|
||||
if (opt_sector_size > SECTOR_SIZE && luks_version == 1) {
|
||||
if (!strcmp(type, CRYPT_LUKS2)) {
|
||||
params = ¶ms2;
|
||||
} else if (!strcmp(type, CRYPT_LUKS1)) {
|
||||
params = ¶ms1;
|
||||
|
||||
if (opt_sector_size > SECTOR_SIZE) {
|
||||
log_err(_("Unsupported encryption sector size."));
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (opt_integrity) {
|
||||
log_err(_("Integrity option can be used only for LUKS2 format."));
|
||||
return -EINVAL;
|
||||
}
|
||||
} else
|
||||
return -EINVAL;
|
||||
|
||||
/* Create header file (must contain at least one sector)? */
|
||||
if (opt_header_device && stat(opt_header_device, &st) < 0 && errno == ENOENT) {
|
||||
if (!opt_batch_mode &&
|
||||
@@ -986,11 +996,6 @@ static int action_luksFormat(void)
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (luks_version != 2 && opt_integrity) {
|
||||
log_err(_("Integrity option can be used only for LUKS2 format."));
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (opt_integrity) {
|
||||
r = crypt_parse_integrity_mode(opt_integrity, integrity, &integrity_keysize);
|
||||
if (r < 0) {
|
||||
@@ -1030,21 +1035,14 @@ static int action_luksFormat(void)
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (luks_version == 1)
|
||||
r = set_pbkdf_params(cd, CRYPT_LUKS1);
|
||||
else
|
||||
r = set_pbkdf_params(cd, CRYPT_LUKS2);
|
||||
r = set_pbkdf_params(cd, type);
|
||||
if (r) {
|
||||
log_err(_("Failed to set pbkdf parameters."));
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (luks_version == 1)
|
||||
r = crypt_format(cd, CRYPT_LUKS1, cipher, cipher_mode,
|
||||
opt_uuid, key, keysize, ¶ms);
|
||||
else
|
||||
r = crypt_format(cd, CRYPT_LUKS2, cipher, cipher_mode,
|
||||
opt_uuid, key, keysize, ¶ms2);
|
||||
r = crypt_format(cd, type, cipher, cipher_mode,
|
||||
opt_uuid, key, keysize, params);
|
||||
check_signal(&r);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
@@ -2069,6 +2067,9 @@ static void help(poptContext popt_context,
|
||||
"<key file> optional key file for the new key for luksAddKey action\n"),
|
||||
crypt_get_dir());
|
||||
|
||||
log_std(_("\nDefault compiled-in metadata format is %s (for luksFormat action).\n"),
|
||||
DEFAULT_LUKS_FORMAT);
|
||||
|
||||
pbkdf_luks1 = crypt_get_pbkdf_default(CRYPT_LUKS1);
|
||||
pbkdf_luks2 = crypt_get_pbkdf_default(CRYPT_LUKS2);
|
||||
log_std(_("\nDefault compiled-in key and passphrase parameters:\n"
|
||||
|
||||
@@ -143,10 +143,12 @@ static const char *luksType(const char *type)
|
||||
if (type && !strcmp(type, "luks2"))
|
||||
return CRYPT_LUKS2;
|
||||
|
||||
/* make LUKS1 default */
|
||||
if (type && (!strcmp(type, "luks1") || !strcmp(type, "luks")))
|
||||
if (type && !strcmp(type, "luks1"))
|
||||
return CRYPT_LUKS1;
|
||||
|
||||
if (!type || !strcmp(type, "luks"))
|
||||
return DEFAULT_LUKS_FORMAT;
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
||||
@@ -58,10 +58,10 @@ format() # key_bits expected [forced]
|
||||
{
|
||||
if [ -z "$3" ] ; then
|
||||
echo -n "Formatting using topology info ($1 bits key)..."
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat $DEV -q -i1 -c aes-cbc-essiv:sha256 -s $1
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $DEV -q -i1 -c aes-cbc-essiv:sha256 -s $1
|
||||
else
|
||||
echo -n "Formatting using forced sector alignment $3 ($1 bits key)..."
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat $DEV -q -i1 -s $1 -c aes-cbc-essiv:sha256 --align-payload=$2
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $DEV -q -i1 -s $1 -c aes-cbc-essiv:sha256 --align-payload=$2
|
||||
fi
|
||||
|
||||
ALIGN=$($CRYPTSETUP luksDump $DEV |grep "Payload offset" | sed -e s/.*\\t//)
|
||||
@@ -89,10 +89,10 @@ format_null()
|
||||
{
|
||||
if [ $3 -eq 0 ] ; then
|
||||
echo -n "Formatting using topology info ($1 bits key) [slot 0"
|
||||
echo | $CRYPTSETUP luksFormat $DEV -q -i1 -c null -s $1
|
||||
echo | $CRYPTSETUP luksFormat --type luks1 $DEV -q -i1 -c null -s $1
|
||||
else
|
||||
echo -n "Formatting using forced sector alignment $3 ($1 bits key) [slot 0"
|
||||
echo | $CRYPTSETUP luksFormat $DEV -q -i1 -c null -s $1 --align-payload=$3
|
||||
echo | $CRYPTSETUP luksFormat --type luks1 $DEV -q -i1 -c null -s $1 --align-payload=$3
|
||||
fi
|
||||
|
||||
POFF=$(get_offsets "Payload offset")
|
||||
@@ -232,8 +232,8 @@ for file in $(ls img_fs_*.img.bz2) ; do
|
||||
bzip2 -d -c $file | dd of=$DEV bs=1M 2>/dev/null || fail "bad image"
|
||||
[ ! -d $MNT_DIR ] && mkdir $MNT_DIR
|
||||
mount $DEV $MNT_DIR || skip "Mounting image is not available."
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat -i 1 $MNT_DIR/luks.img || fail
|
||||
echo $PWD2 | $CRYPTSETUP luksFormat -i 1 $MNT_DIR/luks.img --header $MNT_DIR/luks_header.img || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 -i 1 $MNT_DIR/luks.img || fail
|
||||
echo $PWD2 | $CRYPTSETUP luksFormat --type luks1 -i 1 $MNT_DIR/luks.img --header $MNT_DIR/luks_header.img || fail
|
||||
umount $MNT_DIR
|
||||
done
|
||||
cleanup
|
||||
|
||||
@@ -181,7 +181,7 @@ fi
|
||||
|
||||
prepare "Image in file tests (root capabilities not required)" file
|
||||
echo "[1] format"
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat $IMG $FAST_PBKDF_OPT || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $IMG $FAST_PBKDF_OPT || fail
|
||||
echo "[2] open"
|
||||
echo $PWD0 | $CRYPTSETUP luksOpen $IMG --test-passphrase 2>/dev/null && fail
|
||||
[ $? -ne 2 ] && fail "luksOpen should return EPERM exit code"
|
||||
@@ -207,7 +207,7 @@ echo $PWD2 | $CRYPTSETUP luksOpen $IMG --test-passphrase 2>/dev/null && fail
|
||||
[ $? -ne 2 ] && fail "luksOpen should return EPERM exit code"
|
||||
echo "[6] kill slot"
|
||||
# format new luks device with active keys PWD1, PWD2
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat $IMG $FAST_PBKDF_OPT || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $IMG $FAST_PBKDF_OPT || fail
|
||||
echo -e "$PWD1\n$PWD2" | $CRYPTSETUP luksAddKey $IMG $FAST_PBKDF_OPT || fail
|
||||
# deactivate keys by killing slots
|
||||
$CRYPTSETUP luksDump $IMG | grep -q "Key Slot 0: ENABLED" || fail
|
||||
@@ -224,7 +224,7 @@ $CRYPTSETUP luksDump $IMG | grep -q "Key Slot 1: DISABLED" || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksOpen $IMG --test-passphrase 2>/dev/null && fail
|
||||
echo $PWD2 | $CRYPTSETUP luksOpen $IMG --test-passphrase 2>/dev/null && fail
|
||||
echo "[7] header backup"
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat $IMG $FAST_PBKDF_OPT || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $IMG $FAST_PBKDF_OPT || fail
|
||||
$CRYPTSETUP luksHeaderBackup $IMG --header-backup-file $HEADER_IMG || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksRemoveKey $IMG || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksOpen $IMG --test-passphrase 2>/dev/null && fail
|
||||
@@ -232,7 +232,7 @@ echo "[8] header restore"
|
||||
$CRYPTSETUP luksHeaderRestore -q $IMG --header-backup-file $HEADER_IMG || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksOpen $IMG --test-passphrase || fail
|
||||
echo "[9] luksDump"
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --uuid $TEST_UUID $IMG $KEY1 || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --uuid $TEST_UUID $IMG $KEY1 || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $IMG -d $KEY1 || fail
|
||||
$CRYPTSETUP luksDump $IMG | grep -q "Key Slot 0: ENABLED" || fail
|
||||
$CRYPTSETUP luksDump $IMG | grep -q $TEST_UUID || fail
|
||||
@@ -245,7 +245,7 @@ fips_mode || {
|
||||
echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --master-key-file $VK_FILE $IMG || fail
|
||||
}
|
||||
echo "[10] uuid"
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --uuid $TEST_UUID $IMG || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --uuid $TEST_UUID $IMG || fail
|
||||
$CRYPTSETUP -q luksUUID $IMG | grep -q $TEST_UUID || fail
|
||||
|
||||
[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
|
||||
@@ -287,11 +287,11 @@ check
|
||||
|
||||
# All headers items and first key material section must change
|
||||
prepare "[3] format" wipe
|
||||
echo $PWD1 | $CRYPTSETUP -i 1000 -c aes-cbc-essiv:sha256 -s 128 luksFormat $LOOPDEV || fail
|
||||
echo $PWD1 | $CRYPTSETUP -i 1000 -c aes-cbc-essiv:sha256 -s 128 luksFormat --type luks1 $LOOPDEV || fail
|
||||
check "$LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0"
|
||||
|
||||
prepare "[4] format using hash sha512" wipe
|
||||
echo $PWD1 | $CRYPTSETUP -i 1000 -h sha512 -c aes-cbc-essiv:sha256 -s 128 luksFormat $LOOPDEV || fail
|
||||
echo $PWD1 | $CRYPTSETUP -i 1000 -h sha512 -c aes-cbc-essiv:sha256 -s 128 luksFormat --type luks1 $LOOPDEV || fail
|
||||
check "$LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0"
|
||||
|
||||
prepare "[5] open"
|
||||
@@ -336,20 +336,20 @@ $CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail
|
||||
|
||||
# Delete last slot
|
||||
prepare "[11] delete last key" wipe
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat $LOOPDEV $FAST_PBKDF_OPT || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $LOOPDEV $FAST_PBKDF_OPT || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksKillSlot $LOOPDEV 0 || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
|
||||
# Format test for ESSIV, and some other parameters.
|
||||
prepare "[12] parameter variation test" wipe
|
||||
$CRYPTSETUP -q -i 1000 -c aes-cbc-essiv:sha256 -s 128 luksFormat $LOOPDEV $KEY1 || fail
|
||||
$CRYPTSETUP -q -i 1000 -c aes-cbc-essiv:sha256 -s 128 luksFormat --type luks1 $LOOPDEV $KEY1 || fail
|
||||
check "$LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0"
|
||||
$CRYPTSETUP -d $KEY1 luksOpen $LOOPDEV $DEV_NAME || fail
|
||||
|
||||
prepare "[13] open/close - stacked devices" wipe
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat $LOOPDEV $FAST_PBKDF_OPT || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $LOOPDEV $FAST_PBKDF_OPT || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat /dev/mapper/$DEV_NAME || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 /dev/mapper/$DEV_NAME || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksOpen /dev/mapper/$DEV_NAME $DEV_NAME2 || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME2 || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
@@ -357,33 +357,33 @@ $CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
prepare "[14] format/open - passphrase on stdin & new line" wipe
|
||||
# stdin defined by "-" must take even newline
|
||||
#echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksFormat $LOOPDEV - || fail
|
||||
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q --key-file=- luksFormat $LOOPDEV || fail
|
||||
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q --key-file=- luksFormat --type luks1 $LOOPDEV || fail
|
||||
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q --key-file=- luksOpen $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
# now also try --key-file
|
||||
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q luksFormat $LOOPDEV --key-file=- || fail
|
||||
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q luksFormat --type luks1 $LOOPDEV --key-file=- || fail
|
||||
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q --key-file=- luksOpen $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
# process newline if from stdin
|
||||
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q luksFormat $LOOPDEV || fail
|
||||
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q luksFormat --type luks1 $LOOPDEV || fail
|
||||
echo "$PWD1" | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
|
||||
prepare "[15] UUID - use and report provided UUID" wipe
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --uuid blah $LOOPDEV 2>/dev/null && fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --uuid $TEST_UUID $LOOPDEV || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --uuid $TEST_UUID $LOOPDEV || fail
|
||||
tst=$($CRYPTSETUP -q luksUUID $LOOPDEV)
|
||||
[ "$tst"x = "$TEST_UUID"x ] || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT $LOOPDEV || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV || fail
|
||||
$CRYPTSETUP -q luksUUID --uuid $TEST_UUID $LOOPDEV || fail
|
||||
tst=$($CRYPTSETUP -q luksUUID $LOOPDEV)
|
||||
[ "$tst"x = "$TEST_UUID"x ] || fail
|
||||
|
||||
prepare "[16] luksFormat" wipe
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --master-key-file /dev/urandom $LOOPDEV || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --master-key-file /dev/urandom $LOOPDEV -d $KEY1 || fail
|
||||
$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --master-key-file /dev/urandom -s 256 --uuid $TEST_UUID $LOOPDEV $KEY1 || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --master-key-file /dev/urandom $LOOPDEV || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --master-key-file /dev/urandom $LOOPDEV -d $KEY1 || fail
|
||||
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --master-key-file /dev/urandom -s 256 --uuid $TEST_UUID $LOOPDEV $KEY1 || fail
|
||||
$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
# open by UUID
|
||||
@@ -392,18 +392,18 @@ $CRYPTSETUP luksOpen -d $KEY1 UUID=X$TEST_UUID $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP luksOpen -d $KEY1 UUID=$TEST_UUID $DEV_NAME || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
# empty keyfile
|
||||
$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT $LOOPDEV $KEYE || fail
|
||||
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEYE || fail
|
||||
$CRYPTSETUP luksOpen -d $KEYE $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
# open by volume key
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT -s 256 --master-key-file $KEY1 $LOOPDEV || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT -s 256 --master-key-file $KEY1 $LOOPDEV || fail
|
||||
$CRYPTSETUP luksOpen --master-key-file /dev/urandom $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP luksOpen --master-key-file $KEY1 $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
|
||||
prepare "[17] AddKey volume key, passphrase and keyfile" wipe
|
||||
# masterkey
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT $LOOPDEV --master-key-file /dev/zero --key-slot 3 || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --master-key-file /dev/zero --key-slot 3 || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase || fail
|
||||
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 3: ENABLED" || fail
|
||||
echo $PWD2 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --master-key-file /dev/zero --key-slot 4 || fail
|
||||
@@ -415,7 +415,7 @@ $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 5 -d $KEY1 || fail
|
||||
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 5: ENABLED" || fail
|
||||
|
||||
# special "-" handling
|
||||
$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 3 || fail
|
||||
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 3 || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d $KEY1 - || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase 2>/dev/null && fail
|
||||
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV -d - --test-passphrase || fail
|
||||
@@ -425,7 +425,7 @@ echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV -d - -d $KEY1 --test-passphrase 2>/de
|
||||
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV -d $KEY1 -d $KEY1 --test-passphrase 2>/dev/null && fail
|
||||
|
||||
# [0]PWD1 [1]PWD2 [2]$KEY1/1 [3]$KEY1 [4]$KEY2
|
||||
$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 3 || fail
|
||||
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 3 || fail
|
||||
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 3: ENABLED" || fail
|
||||
$CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 --key-slot 3 2>/dev/null && fail
|
||||
# keyfile/keyfile
|
||||
@@ -529,7 +529,7 @@ echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME2 2>/dev/null && fail
|
||||
$CRYPTSETUP luksClose $DEV_NAME || fail
|
||||
|
||||
prepare "[21] luksDump" wipe
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --uuid $TEST_UUID $LOOPDEV $KEY1 || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --uuid $TEST_UUID $LOOPDEV $KEY1 || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d $KEY1 || fail
|
||||
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 0: ENABLED" || fail
|
||||
$CRYPTSETUP luksDump $LOOPDEV | grep -q $TEST_UUID || fail
|
||||
@@ -543,7 +543,7 @@ fips_mode || {
|
||||
|
||||
prepare "[22] remove disappeared device" wipe
|
||||
dmsetup create $DEV_NAME --table "0 5000 linear $LOOPDEV 2" || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q $FAST_PBKDF_OPT luksFormat /dev/mapper/$DEV_NAME || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q $FAST_PBKDF_OPT luksFormat --type luks1 /dev/mapper/$DEV_NAME || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksOpen /dev/mapper/$DEV_NAME $DEV_NAME2 || fail
|
||||
# underlying device now returns error but node is still present
|
||||
dmsetup load $DEV_NAME --table "0 5000 error" || fail
|
||||
@@ -553,7 +553,7 @@ dmsetup remove $DEV_NAME || fail
|
||||
|
||||
prepare "[23] ChangeKey passphrase and keyfile" wipe
|
||||
# [0]$KEY1 [1]key0
|
||||
$CRYPTSETUP -q luksFormat $LOOPDEV $KEY1 $FAST_PBKDF_OPT --key-slot 0 || fail
|
||||
$CRYPTSETUP -q luksFormat --type luks1 $LOOPDEV $KEY1 $FAST_PBKDF_OPT --key-slot 0 || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 --key-slot 1 || fail
|
||||
# keyfile [0] / keyfile [0]
|
||||
$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 --key-slot 0 || fail
|
||||
@@ -577,7 +577,7 @@ $CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 || fail
|
||||
$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 2>/dev/null && fail
|
||||
|
||||
prepare "[24] Keyfile limit" wipe
|
||||
$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 0 -l 13 || fail
|
||||
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 0 -l 13 || fail
|
||||
$CRYPTSETUP --key-file=$KEY1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP --key-file=$KEY1 -l 0 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP --key-file=$KEY1 -l -1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
@@ -602,7 +602,7 @@ echo $PWD1 | $CRYPTSETUP luksRemoveKey $LOOPDEV -l 11 2>/dev/null && fail
|
||||
echo $PWDW"0" | $CRYPTSETUP luksRemoveKey $LOOPDEV -l 12 2>/dev/null && fail
|
||||
echo -e "$PWD1\n" | $CRYPTSETUP luksRemoveKey $LOOPDEV -d- -l 12 || fail
|
||||
# offset
|
||||
$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 0 -l 13 --keyfile-offset 16 || fail
|
||||
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 0 -l 13 --keyfile-offset 16 || fail
|
||||
$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 15 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 16 luksOpen $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP luksClose $DEV_NAME || fail
|
||||
@@ -615,7 +615,7 @@ $CRYPTSETUP luksOpen -d $KEY2 $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP luksClose $DEV_NAME || fail
|
||||
# large device with keyfile
|
||||
echo -e '0 10000000 error'\\n'10000000 1000000 zero' | dmsetup create $DEV_NAME2 || fail
|
||||
$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT $LOOPDEV /dev/mapper/$DEV_NAME2 -l 13 --keyfile-offset 5120000000 || fail
|
||||
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV /dev/mapper/$DEV_NAME2 -l 13 --keyfile-offset 5120000000 || fail
|
||||
$CRYPTSETUP --key-file=/dev/mapper/$DEV_NAME2 -l 13 --keyfile-offset 5119999999 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP --key-file=/dev/mapper/$DEV_NAME2 -l 13 --keyfile-offset 5120000000 luksOpen $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP luksClose $DEV_NAME || fail
|
||||
@@ -638,7 +638,7 @@ $CRYPTSETUP luksResume $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP -q remove $DEV_NAME || fail
|
||||
$CRYPTSETUP luksSuspend $DEV_NAME 2>/dev/null && fail
|
||||
# LUKS
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT $LOOPDEV || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP luksSuspend $DEV_NAME || fail
|
||||
$CRYPTSETUP -q resize $DEV_NAME 2>/dev/null && fail
|
||||
@@ -649,7 +649,7 @@ $CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
|
||||
prepare "[27] luksOpen with specified key slot number" wipe
|
||||
# first, let's try passphrase option
|
||||
echo $PWD3 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT -S 5 $LOOPDEV || fail
|
||||
echo $PWD3 | $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF_OPT -S 5 $LOOPDEV || fail
|
||||
check $LUKS_HEADER $KEY_SLOT5 $KEY_MATERIAL5
|
||||
echo $PWD3 | $CRYPTSETUP luksOpen -S 4 $LOOPDEV $DEV_NAME && fail
|
||||
[ -b /dev/mapper/$DEV_NAME ] && fail
|
||||
@@ -663,7 +663,7 @@ echo $PWD3 | $CRYPTSETUP luksOpen -S 0 $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
echo $PWD1 | $CRYPTSETUP luksOpen -S 5 $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
[ -b /dev/mapper/$DEV_NAME ] && fail
|
||||
# second, try it with keyfiles
|
||||
$CRYPTSETUP luksFormat -q -S 5 -d $KEY5 $LOOPDEV || fail
|
||||
$CRYPTSETUP luksFormat --type luks1 -q -S 5 -d $KEY5 $LOOPDEV || fail
|
||||
check $LUKS_HEADER $KEY_SLOT5 $KEY_MATERIAL5
|
||||
$CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 || fail
|
||||
check $LUKS_HEADER $KEY_SLOT1 $KEY_MATERIAL1
|
||||
@@ -676,10 +676,10 @@ $CRYPTSETUP luksOpen -S 5 -d $KEY1 $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
[ -b /dev/mapper/$DEV_NAME ] && fail
|
||||
|
||||
prepare "[28] Detached LUKS header" wipe
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --align-payload 1 >/dev/null 2>&1 && fail
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --align-payload 8192 || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --align-payload 0 || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --align-payload 8192 || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --align-payload 0 || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail
|
||||
$CRYPTSETUP -q resize $DEV_NAME --size 100 --header $HEADER_IMG || fail
|
||||
$CRYPTSETUP -q status $DEV_NAME --header $HEADER_IMG | grep "size:" | grep -q "100 sectors" || fail
|
||||
@@ -697,7 +697,7 @@ $CRYPTSETUP luksKillSlot -q _fakedev_ --header $HEADER_IMG 5 || fail
|
||||
$CRYPTSETUP luksDump _fakedev_ --header $HEADER_IMG | grep -q "Key Slot 5: DISABLED" || fail
|
||||
|
||||
prepare "[29] Repair metadata" wipe
|
||||
$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 0 || fail
|
||||
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 0 || fail
|
||||
# second sector overwrite should corrupt keyslot 6+7
|
||||
dd if=/dev/urandom of=$LOOPDEV bs=512 seek=1 count=1 >/dev/null 2>&1
|
||||
$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME >/dev/null 2>&1 && fail
|
||||
@@ -706,7 +706,7 @@ $CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP luksClose $DEV_NAME || fail
|
||||
|
||||
prepare "[30] LUKS erase" wipe
|
||||
$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT $LOOPDEV $KEY5 --key-slot 5 || fail
|
||||
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY5 --key-slot 5 || fail
|
||||
$CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 || fail
|
||||
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: ENABLED" || fail
|
||||
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 5: ENABLED" || fail
|
||||
@@ -796,7 +796,7 @@ prepare "[35] Interactive format of device." wipe
|
||||
expect - >/dev/null <<EOF
|
||||
proc abort {} { send_error "Timeout. "; exit 2 }
|
||||
set timeout 10
|
||||
eval spawn $CRYPTSETUP luksFormat $FAST_PBKDF_OPT -v $LOOPDEV
|
||||
eval spawn $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF_OPT -v $LOOPDEV
|
||||
expect timeout abort "Are you sure? (Type uppercase yes):"
|
||||
send "YES\n"
|
||||
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
||||
@@ -826,7 +826,7 @@ expect timeout abort "Are you sure? (Type uppercase yes):"
|
||||
send "YES\n"
|
||||
expect timeout abort "Command successful."
|
||||
expect timeout abort eof
|
||||
eval spawn $CRYPTSETUP luksFormat $FAST_PBKDF_OPT -v $LOOPDEV
|
||||
eval spawn $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF_OPT -v $LOOPDEV
|
||||
expect timeout abort "Are you sure? (Type uppercase yes):"
|
||||
send "YES\n"
|
||||
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
||||
|
||||
@@ -65,7 +65,7 @@ add_device dev_size_mb=16 sector_size=512 num_tgts=1 lbpu=1
|
||||
# for now just check that flag is enabled
|
||||
|
||||
echo "[1] Allowing discards for LUKS device"
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat $DEV -q -i1 || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $DEV -q -i1 || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksOpen $DEV $DEV_NAME --allow-discards || fail
|
||||
$CRYPTSETUP status $DEV_NAME | grep flags | grep discards >/dev/null || fail
|
||||
$CRYPTSETUP resize $DEV_NAME --size 100 || fail
|
||||
|
||||
@@ -158,7 +158,7 @@ function check_slot() #space separeted list of ENABLED key slots
|
||||
function simple_scsi_reenc()
|
||||
{
|
||||
echo -n "$1"
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF $SCSI_DEV || fail
|
||||
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF $SCSI_DEV || fail
|
||||
|
||||
echo $PWD1 | $CRYPTSETUP luksOpen $SCSI_DEV $DEV_NAME || fail
|
||||
HASH=$(sha256sum /dev/mapper/$DEV_NAME | cut -d' ' -f 1)
|
||||
@@ -215,7 +215,7 @@ HASH4=2daeb1f36095b44b318410b3f4e8b5d989dcc7bb023d1426c492dab0a3053e74
|
||||
|
||||
echo "[1] Reencryption"
|
||||
prepare 8192
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat -s 128 -c aes-cbc-plain $FAST_PBKDF --align-payload 4096 $LOOPDEV1 || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 -s 128 -c aes-cbc-plain $FAST_PBKDF --align-payload 4096 $LOOPDEV1 || fail
|
||||
wipe $PWD1
|
||||
check_hash $PWD1 $HASH1
|
||||
echo $PWD1 | $REENC $LOOPDEV1 -q $FAST_PBKDF
|
||||
@@ -233,7 +233,7 @@ check_hash $PWD1 $HASH1
|
||||
$CRYPTSETUP --type luks1 luksDump $LOOPDEV1 > /dev/null || fail
|
||||
|
||||
echo "[2] Reencryption with data shift"
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat -c aes-cbc-essiv:sha256 -s 128 $FAST_PBKDF --align-payload 2048 $LOOPDEV1 || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 -c aes-cbc-essiv:sha256 -s 128 $FAST_PBKDF --align-payload 2048 $LOOPDEV1 || fail
|
||||
wipe $PWD1
|
||||
echo $PWD1 | $REENC $LOOPDEV1 -q -s 256 --reduce-device-size 1024S $FAST_PBKDF || fail
|
||||
check_hash $PWD1 $HASH2
|
||||
@@ -242,7 +242,7 @@ check_hash $PWD1 $HASH2
|
||||
$CRYPTSETUP --type luks1 luksDump $LOOPDEV1 > /dev/null || fail
|
||||
|
||||
echo "[3] Reencryption with keyfile"
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat -d $KEY1 -c aes-cbc-essiv:sha256 -s 128 $FAST_PBKDF --align-payload 4096 $LOOPDEV1 || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 -d $KEY1 -c aes-cbc-essiv:sha256 -s 128 $FAST_PBKDF --align-payload 4096 $LOOPDEV1 || fail
|
||||
wipe
|
||||
check_hash "" $HASH1
|
||||
echo $PWD1 | $CRYPTSETUP -q luksAddKey -d $KEY1 $LOOPDEV1 $FAST_PBKDF || fail
|
||||
@@ -261,12 +261,12 @@ wipe_dev $LOOPDEV1
|
||||
dmsetup create $DEV_NAME2 --table "0 $(($SIZE - $OFFSET)) linear $LOOPDEV1 0" || fail
|
||||
check_hash_dev /dev/mapper/$DEV_NAME2 $HASH3
|
||||
dmsetup remove $DEV_NAME2 || fail
|
||||
echo $PWD1 | $REENC $LOOPDEV1 -c aes-cbc-essiv:sha256 -s 128 --new --reduce-device-size "$OFFSET"S -q $FAST_PBKDF
|
||||
echo $PWD1 | $REENC $LOOPDEV1 -c aes-cbc-essiv:sha256 -s 128 --new --type luks1 --reduce-device-size "$OFFSET"S -q $FAST_PBKDF
|
||||
check_hash $PWD1 $HASH3
|
||||
$CRYPTSETUP --type luks1 luksDump $LOOPDEV1 > /dev/null || fail
|
||||
|
||||
echo "[5] Reencryption using specific keyslot"
|
||||
echo $PWD2 | $CRYPTSETUP -q luksFormat $FAST_PBKDF $LOOPDEV1 || fail
|
||||
echo $PWD2 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF $LOOPDEV1 || fail
|
||||
echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF -S 1 $LOOPDEV1 || fail
|
||||
echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF -S 2 $LOOPDEV1 || fail
|
||||
echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF -S 3 $LOOPDEV1 || fail
|
||||
@@ -308,7 +308,7 @@ simple_scsi_reenc "[4096/512 sector]"
|
||||
echo "[OK]"
|
||||
|
||||
echo "[8] Header only reencryption (hash and iteration time)"
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --hash sha1 $FAST_PBKDF $LOOPDEV1 || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 --hash sha1 $FAST_PBKDF $LOOPDEV1 || fail
|
||||
wipe $PWD1
|
||||
check_hash $PWD1 $HASH1
|
||||
echo $PWD1 | $REENC $LOOPDEV1 -q --keep-key --pbkdf-force-iterations 999 2>/dev/null && fail
|
||||
@@ -326,7 +326,7 @@ $CRYPTSETUP --type luks1 luksDump $LOOPDEV1 > /dev/null || fail
|
||||
|
||||
echo "[9] Test log I/Os on various underlaying block devices"
|
||||
prepare 8192
|
||||
echo $PWD2 | $CRYPTSETUP -q luksFormat $FAST_PBKDF $LOOPDEV1 || fail
|
||||
echo $PWD2 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF $LOOPDEV1 || fail
|
||||
add_scsi_device sector_size=512 dev_size_mb=32
|
||||
test_logging "[512 sector]" || fail
|
||||
add_scsi_device sector_size=4096 dev_size_mb=32
|
||||
@@ -337,7 +337,7 @@ test_logging_tmpfs || fail
|
||||
|
||||
echo "[10] Removal of encryption"
|
||||
prepare 8192
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF $LOOPDEV1 || fail
|
||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF $LOOPDEV1 || fail
|
||||
wipe $PWD1
|
||||
check_hash $PWD1 $HASH1
|
||||
echo $PWD1 | $REENC $LOOPDEV1 -q --decrypt
|
||||
@@ -346,7 +346,7 @@ check_hash_dev $LOOPDEV1 $HASH4
|
||||
echo "[11] Detached header - adding encryption/reencryption/decryption"
|
||||
prepare 8192
|
||||
check_hash_dev $IMG $HASH4
|
||||
echo $PWD1 | $REENC $LOOPDEV1 -q $FAST_PBKDF --header $IMG_HDR --new
|
||||
echo $PWD1 | $REENC $LOOPDEV1 -q $FAST_PBKDF --header $IMG_HDR --new --type luks1
|
||||
check_hash $PWD1 $HASH4 $IMG_HDR
|
||||
echo $PWD1 | $REENC $LOOPDEV1 -q $FAST_PBKDF --header $IMG_HDR
|
||||
check_hash $PWD1 $HASH4 $IMG_HDR
|
||||
@@ -354,7 +354,7 @@ echo $PWD1 | $REENC $LOOPDEV1 -q --header $IMG_HDR --decrypt
|
||||
check_hash_dev $IMG $HASH4
|
||||
# existing header of zero size
|
||||
cat /dev/null >$IMG_HDR
|
||||
echo $PWD1 | $REENC $LOOPDEV1 -q $FAST_PBKDF --header $IMG_HDR --new
|
||||
echo $PWD1 | $REENC $LOOPDEV1 -q $FAST_PBKDF --header $IMG_HDR --new --type luks1
|
||||
check_hash $PWD1 $HASH4 $IMG_HDR
|
||||
$CRYPTSETUP isLuks $LOOPDEV1 && fail
|
||||
$CRYPTSETUP isLuks $IMG_HDR || fail
|
||||
|
||||
Reference in New Issue
Block a user