mirror of
https://gitlab.com/cryptsetup/cryptsetup.git
synced 2025-12-19 06:40:08 +01:00
26f6d1cb10
For some reason the volume key file have to exists. Let's change the logic to the same as for luksBackupHeader (a file is created and operation fails if it already exists).
935 lines
42 KiB
Bash
Executable File
935 lines
42 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
PS4='$LINENO:'
|
|
CRYPTSETUP=../cryptsetup
|
|
|
|
CRYPTSETUP_VALGRIND=../.libs/cryptsetup
|
|
CRYPTSETUP_LIB_VALGRIND=../.libs
|
|
|
|
DEV_NAME=dummy
|
|
DEV_NAME2=dummy2
|
|
DEV_NAME3=dummy3
|
|
ORIG_IMG=luks-test-orig
|
|
IMG=luks-test
|
|
IMG10=luks-test-v10
|
|
HEADER_IMG=luks-header
|
|
KEY1=key1
|
|
KEY2=key2
|
|
KEY5=key5
|
|
KEYE=keye
|
|
PWD0="compatkey"
|
|
PWD1="93R4P4pIqAH8"
|
|
PWD2="mymJeD8ivEhE"
|
|
PWD3="ocMakf3fAcQO"
|
|
PWDW="rUkL4RUryBom"
|
|
VK_FILE="compattest_vkfile"
|
|
|
|
FAST_PBKDF_OPT="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
|
|
|
LUKS_HEADER="S0-5 S6-7 S8-39 S40-71 S72-103 S104-107 S108-111 R112-131 R132-163 S164-167 S168-207 A0-591"
|
|
KEY_SLOT0="S208-211 S212-215 R216-247 A248-251 A251-255"
|
|
KEY_MATERIAL0="R4096-68096"
|
|
KEY_MATERIAL0_EXT="R4096-68096"
|
|
|
|
KEY_SLOT1="S256-259 S260-263 R264-295 A296-299 A300-303"
|
|
KEY_MATERIAL1="R69632-133632"
|
|
KEY_MATERIAL1_EXT="S69632-133632"
|
|
|
|
KEY_SLOT5="S448-451 S452-455 R456-487 A488-491 A492-495"
|
|
KEY_MATERIAL5="R331776-395264"
|
|
KEY_MATERIAL5_EXT="S331776-395264"
|
|
|
|
TEST_UUID="12345678-1234-1234-1234-123456789abc"
|
|
|
|
LOOPDEV=$(losetup -f 2>/dev/null)
|
|
[ -f /etc/system-fips ] && FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null)
|
|
|
|
function remove_mapping()
|
|
{
|
|
[ -b /dev/mapper/$DEV_NAME3 ] && dmsetup remove $DEV_NAME3 >/dev/null 2>&1
|
|
[ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove $DEV_NAME2 >/dev/null 2>&1
|
|
[ -b /dev/mapper/$DEV_NAME ] && dmsetup remove $DEV_NAME >/dev/null 2>&1
|
|
losetup -d $LOOPDEV >/dev/null 2>&1
|
|
rm -f $ORIG_IMG $IMG $IMG10 $KEY1 $KEY2 $KEY5 $KEYE $HEADER_IMG $VK_FILE missing-file >/dev/null 2>&1
|
|
}
|
|
|
|
function force_uevent()
|
|
{
|
|
DNAME=$(echo $LOOPDEV | cut -f3 -d /)
|
|
echo "change" >/sys/block/$DNAME/uevent
|
|
}
|
|
|
|
function fail()
|
|
{
|
|
[ -n "$1" ] && echo "$1"
|
|
remove_mapping
|
|
echo "FAILED at line $(caller)"
|
|
exit 2
|
|
}
|
|
|
|
function fips_mode()
|
|
{
|
|
[ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ]
|
|
}
|
|
|
|
function can_fail_fips()
|
|
{
|
|
# Ignore this fail if running in FIPS mode
|
|
fips_mode || fail $1
|
|
}
|
|
|
|
function skip()
|
|
{
|
|
[ -n "$1" ] && echo "$1"
|
|
remove_mapping
|
|
[ -z "$2" ] && exit $2
|
|
exit 77
|
|
}
|
|
|
|
function prepare()
|
|
{
|
|
[ -b /dev/mapper/$DEV_NAME ] && dmsetup remove $DEV_NAME >/dev/null 2>&1
|
|
|
|
case "$2" in
|
|
file)
|
|
remove_mapping
|
|
dd if=/dev/zero of=$IMG bs=1k count=10000 >/dev/null 2>&1
|
|
sync
|
|
;;
|
|
wipe)
|
|
remove_mapping
|
|
dd if=/dev/zero of=$IMG bs=1k count=10000 >/dev/null 2>&1
|
|
sync
|
|
losetup $LOOPDEV $IMG
|
|
;;
|
|
new)
|
|
remove_mapping
|
|
xz -cd compatimage.img.xz > $IMG
|
|
# FIXME: switch to internal loop (no losetup at all)
|
|
echo "bad" | $CRYPTSETUP luksOpen --key-slot 0 --test-passphrase $IMG 2>&1 | \
|
|
grep "autoclear flag" && skip "WARNING: Too old kernel, test skipped."
|
|
losetup $LOOPDEV $IMG
|
|
xz -cd compatv10image.img.xz > $IMG10
|
|
;;
|
|
reuse | *)
|
|
if [ ! -e $IMG ]; then
|
|
xz -cd compatimage.img.xz > $IMG
|
|
losetup $LOOPDEV $IMG
|
|
fi
|
|
[ ! -e $IMG10 ] && xz -cd compatv10image.img.xz > $IMG10
|
|
;;
|
|
esac
|
|
|
|
if [ ! -e $KEY1 ]; then
|
|
#dd if=/dev/urandom of=$KEY1 count=1 bs=32 >/dev/null 2>&1
|
|
echo -n $'\x48\xc6\x74\x4f\x41\x4e\x50\xc0\x79\xc2\x2d\x5b\x5f\x68\x84\x17' >$KEY1
|
|
echo -n $'\x9c\x03\x5e\x1b\x4d\x0f\x9a\x75\xb3\x90\x70\x32\x0a\xf8\xae\xc4'>>$KEY1
|
|
fi
|
|
|
|
if [ ! -e $KEY2 ]; then
|
|
dd if=/dev/urandom of=$KEY2 count=1 bs=16 >/dev/null 2>&1
|
|
fi
|
|
|
|
if [ ! -e $KEY5 ]; then
|
|
dd if=/dev/urandom of=$KEY5 count=1 bs=16 >/dev/null 2>&1
|
|
fi
|
|
|
|
if [ ! -e $KEYE ]; then
|
|
touch $KEYE
|
|
fi
|
|
|
|
cp $IMG $ORIG_IMG
|
|
[ -n "$1" ] && echo "CASE: $1"
|
|
}
|
|
|
|
function check()
|
|
{
|
|
sync
|
|
[ -z "$1" ] && return
|
|
./differ $ORIG_IMG $IMG $1 || fail
|
|
}
|
|
|
|
function check_exists()
|
|
{
|
|
[ -b /dev/mapper/$DEV_NAME ] || fail
|
|
check $1
|
|
}
|
|
|
|
function valgrind_setup()
|
|
{
|
|
which valgrind >/dev/null 2>&1 || fail "Cannot find valgrind."
|
|
[ ! -f $CRYPTSETUP_VALGRIND ] && fail "Unable to get location of cryptsetup executable."
|
|
export LD_LIBRARY_PATH="$CRYPTSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH"
|
|
}
|
|
|
|
function valgrind_run()
|
|
{
|
|
INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${CRYPTSETUP_VALGRIND} "$@"
|
|
}
|
|
|
|
export LANG=C
|
|
|
|
[ -n "$VALG" ] && valgrind_setup && CRYPTSETUP=valgrind_run
|
|
|
|
# LUKS non-root-tests
|
|
if [ $(id -u) != 0 ]; then
|
|
$CRYPTSETUP benchmark -c aes-xts-plain64 >/dev/null 2>&1 || \
|
|
skip "WARNING: Cannot run test without kernel userspace crypto API, test skipped."
|
|
fi
|
|
|
|
prepare "Image in file tests (root capabilities not required)" file
|
|
echo "[1] format"
|
|
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $IMG $FAST_PBKDF_OPT || fail
|
|
echo "[2] open"
|
|
echo $PWD0 | $CRYPTSETUP luksOpen $IMG --test-passphrase 2>/dev/null && fail
|
|
[ $? -ne 2 ] && fail "luksOpen should return EPERM exit code"
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $IMG --test-passphrase || fail
|
|
echo "[3] add key"
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $IMG $FAST_PBKDF_OPT 2>/dev/null && fail
|
|
echo -e "$PWD1\n$PWD2" | $CRYPTSETUP luksAddKey $IMG $FAST_PBKDF_OPT || fail
|
|
echo -e "$PWD0\n$PWD1" | $CRYPTSETUP luksAddKey $IMG $FAST_PBKDF_OPT 2>/dev/null && fail
|
|
echo "[4] change key"
|
|
echo -e "$PWD1\n$PWD0\n" | $CRYPTSETUP luksChangeKey $FAST_PBKDF_OPT $IMG || fail
|
|
echo -e "$PWD1\n$PWD2\n" | $CRYPTSETUP luksChangeKey $FAST_PBKDF_OPT $IMG 2>/dev/null && fail
|
|
[ $? -ne 2 ] && fail "luksChangeKey should return EPERM exit code"
|
|
echo "[5] remove key"
|
|
# delete active keys PWD0, PWD2
|
|
echo $PWD1 | $CRYPTSETUP luksRemoveKey $IMG 2>/dev/null && fail
|
|
[ $? -ne 2 ] && fail "luksRemove should return EPERM exit code"
|
|
echo $PWD0 | $CRYPTSETUP luksRemoveKey $IMG || fail
|
|
echo $PWD2 | $CRYPTSETUP luksRemoveKey $IMG || fail
|
|
# check if keys were deleted
|
|
echo $PWD0 | $CRYPTSETUP luksOpen $IMG --test-passphrase 2>/dev/null && fail
|
|
[ $? -ne 2 ] && fail "luksOpen should return EPERM exit code"
|
|
echo $PWD2 | $CRYPTSETUP luksOpen $IMG --test-passphrase 2>/dev/null && fail
|
|
[ $? -ne 2 ] && fail "luksOpen should return EPERM exit code"
|
|
echo "[6] kill slot"
|
|
# format new luks device with active keys PWD1, PWD2
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $IMG $FAST_PBKDF_OPT || fail
|
|
echo -e "$PWD1\n$PWD2" | $CRYPTSETUP luksAddKey $IMG $FAST_PBKDF_OPT || fail
|
|
# deactivate keys by killing slots
|
|
$CRYPTSETUP luksDump $IMG | grep -q "Key Slot 0: ENABLED" || fail
|
|
$CRYPTSETUP luksDump $IMG | grep -q "Key Slot 1: ENABLED" || fail
|
|
$CRYPTSETUP luksDump $IMG | grep -q "Key Slot 2: DISABLED" || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksKillSlot $IMG 0 2>/dev/null && fail
|
|
echo $PWD2 | $CRYPTSETUP -q luksKillSlot $IMG 0 || fail
|
|
$CRYPTSETUP luksDump $IMG | grep -q "Key Slot 0: DISABLED" || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksKillSlot $IMG 1 2>/dev/null && fail
|
|
[ $? -ne 2 ] && fail "luksKill should return EPERM exit code"
|
|
echo $PWD2 | $CRYPTSETUP -q luksKillSlot $IMG 1 || fail
|
|
$CRYPTSETUP luksDump $IMG | grep -q "Key Slot 1: DISABLED" || fail
|
|
# check if keys were deactivated
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $IMG --test-passphrase 2>/dev/null && fail
|
|
echo $PWD2 | $CRYPTSETUP luksOpen $IMG --test-passphrase 2>/dev/null && fail
|
|
echo "[7] header backup"
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $IMG $FAST_PBKDF_OPT || fail
|
|
$CRYPTSETUP luksHeaderBackup $IMG --header-backup-file $HEADER_IMG || fail
|
|
echo $PWD1 | $CRYPTSETUP luksRemoveKey $IMG || fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $IMG --test-passphrase 2>/dev/null && fail
|
|
echo "[8] header restore"
|
|
$CRYPTSETUP luksHeaderRestore -q $IMG --header-backup-file $HEADER_IMG || fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $IMG --test-passphrase || fail
|
|
echo "[9] luksDump"
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --uuid $TEST_UUID $IMG $KEY1 || fail
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $IMG -d $KEY1 || fail
|
|
$CRYPTSETUP luksDump $IMG | grep -q "Key Slot 0: ENABLED" || fail
|
|
$CRYPTSETUP luksDump $IMG | grep -q $TEST_UUID || fail
|
|
echo $PWDW | $CRYPTSETUP luksDump $IMG --dump-master-key 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP luksDump $IMG --dump-master-key | grep -q "MK dump:" || can_fail_fips
|
|
$CRYPTSETUP luksDump -q $IMG --dump-master-key -d $KEY1 | grep -q "MK dump:" || can_fail_fips
|
|
echo $PWD1 | $CRYPTSETUP luksDump -q $IMG --dump-master-key --master-key-file $VK_FILE >/dev/null || can_fail_fips
|
|
echo $PWD1 | $CRYPTSETUP luksDump -q $IMG --dump-master-key --master-key-file $VK_FILE 2>/dev/null && fail
|
|
fips_mode || {
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --master-key-file $VK_FILE $IMG || fail
|
|
}
|
|
echo "[10] uuid"
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --uuid $TEST_UUID $IMG || fail
|
|
$CRYPTSETUP -q luksUUID $IMG | grep -q $TEST_UUID || fail
|
|
|
|
[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
|
|
[ -z "$LOOPDEV" ] && skip "WARNING: Cannot find free loop device, test skipped."
|
|
|
|
# LUKS root-tests
|
|
prepare "[1] open - compat image - acceptance check" new
|
|
echo $PWD0 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
|
|
check_exists
|
|
ORG_SHA1=$(sha1sum -b /dev/mapper/$DEV_NAME | cut -f 1 -d' ')
|
|
[ "$ORG_SHA1" = 676062b66ebf36669dab705442ea0762dfc091b0 ] || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
# Check it can be opened from header backup as well
|
|
$CRYPTSETUP luksHeaderBackup $IMG --header-backup-file $HEADER_IMG || fail
|
|
echo $PWD0 | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME --header $HEADER_IMG || fail
|
|
check_exists
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
# Check restore
|
|
$CRYPTSETUP luksHeaderRestore -q $IMG --header-backup-file $HEADER_IMG || fail
|
|
|
|
# Repeat for V1.0 header - not aligned first keyslot
|
|
echo $PWD0 | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME || fail
|
|
check_exists
|
|
ORG_SHA1=$(sha1sum -b /dev/mapper/$DEV_NAME | cut -f 1 -d' ')
|
|
[ "$ORG_SHA1" = 51b48c2471a7593ceaf14dc5e66bca86ed05f6cc ] || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
rm -f $HEADER_IMG
|
|
$CRYPTSETUP luksHeaderBackup $IMG10 --header-backup-file $HEADER_IMG
|
|
echo $PWD0 | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME --header $HEADER_IMG || fail
|
|
check_exists
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
prepare "[2] open - compat image - denial check" new
|
|
echo $PWDW | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
echo $PWDW | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME 2>/dev/null && fail
|
|
check
|
|
|
|
# All headers items and first key material section must change
|
|
prepare "[3] format" wipe
|
|
echo $PWD1 | $CRYPTSETUP -i 1000 -c aes-cbc-essiv:sha256 -s 128 luksFormat --type luks1 $LOOPDEV || fail
|
|
check "$LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0"
|
|
|
|
prepare "[4] format using hash sha512" wipe
|
|
echo $PWD1 | $CRYPTSETUP -i 1000 -h sha512 -c aes-cbc-essiv:sha256 -s 128 luksFormat --type luks1 $LOOPDEV || fail
|
|
check "$LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0"
|
|
|
|
prepare "[5] open"
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME --test-passphrase || fail
|
|
echo $PWDW | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME --test-passphrase 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
|
|
check_exists
|
|
|
|
# Key Slot 1 and key material section 1 must change, the rest must not.
|
|
prepare "[6] add key"
|
|
echo -e "$PWD1\n$PWD2" | $CRYPTSETUP luksAddKey $LOOPDEV || fail
|
|
check "$KEY_SLOT1 $KEY_MATERIAL1"
|
|
echo $PWD2 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
|
|
|
|
# Unsuccessful Key Delete - nothing may change
|
|
prepare "[7] unsuccessful delete"
|
|
echo $PWDW | $CRYPTSETUP luksKillSlot $LOOPDEV 1 2>/dev/null && fail
|
|
$CRYPTSETUP -q luksKillSlot $LOOPDEV 8 2>/dev/null && fail
|
|
$CRYPTSETUP -q luksKillSlot $LOOPDEV 7 2>/dev/null && fail
|
|
check
|
|
|
|
# Delete Key Test
|
|
# Key Slot 1 and key material section 1 must change, the rest must not
|
|
prepare "[8] successful delete"
|
|
$CRYPTSETUP -q luksKillSlot $LOOPDEV 1 || fail
|
|
check "$KEY_SLOT1 $KEY_MATERIAL1_EXT"
|
|
echo $PWD2 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2> /dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
|
|
|
|
# Key Slot 1 and key material section 1 must change, the rest must not
|
|
prepare "[9] add key test for key files"
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV $KEY1 || fail
|
|
check "$KEY_SLOT1 $KEY_MATERIAL1"
|
|
$CRYPTSETUP -d $KEY1 luksOpen $LOOPDEV $DEV_NAME || fail
|
|
|
|
# Key Slot 1 and key material section 1 must change, the rest must not
|
|
prepare "[10] delete key test with key1 as remaining key"
|
|
$CRYPTSETUP -d $KEY1 luksKillSlot $LOOPDEV 0 || fail
|
|
check "$KEY_SLOT0 $KEY_MATERIAL0_EXT"
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail
|
|
|
|
# Delete last slot
|
|
prepare "[11] delete last key" wipe
|
|
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $LOOPDEV $FAST_PBKDF_OPT || fail
|
|
echo $PWD1 | $CRYPTSETUP luksKillSlot $LOOPDEV 0 || fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
|
|
# Format test for ESSIV, and some other parameters.
|
|
prepare "[12] parameter variation test" wipe
|
|
$CRYPTSETUP -q -i 1000 -c aes-cbc-essiv:sha256 -s 128 luksFormat --type luks1 $LOOPDEV $KEY1 || fail
|
|
check "$LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0"
|
|
$CRYPTSETUP -d $KEY1 luksOpen $LOOPDEV $DEV_NAME || fail
|
|
|
|
prepare "[13] open/close - stacked devices" wipe
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $LOOPDEV $FAST_PBKDF_OPT || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 /dev/mapper/$DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksOpen /dev/mapper/$DEV_NAME $DEV_NAME2 || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME2 || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
prepare "[14] format/open - passphrase on stdin & new line" wipe
|
|
# stdin defined by "-" must take even newline
|
|
#echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksFormat $LOOPDEV - || fail
|
|
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q --key-file=- luksFormat --type luks1 $LOOPDEV || fail
|
|
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q --key-file=- luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
# now also try --key-file
|
|
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q luksFormat --type luks1 $LOOPDEV --key-file=- || fail
|
|
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q --key-file=- luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
# process newline if from stdin
|
|
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q luksFormat --type luks1 $LOOPDEV || fail
|
|
echo "$PWD1" | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
prepare "[15] UUID - use and report provided UUID" wipe
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --uuid blah $LOOPDEV 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --uuid $TEST_UUID $LOOPDEV || fail
|
|
tst=$($CRYPTSETUP -q luksUUID $LOOPDEV)
|
|
[ "$tst"x = "$TEST_UUID"x ] || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV || fail
|
|
$CRYPTSETUP -q luksUUID --uuid $TEST_UUID $LOOPDEV || fail
|
|
tst=$($CRYPTSETUP -q luksUUID $LOOPDEV)
|
|
[ "$tst"x = "$TEST_UUID"x ] || fail
|
|
|
|
prepare "[16] luksFormat" wipe
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --master-key-file /dev/urandom $LOOPDEV || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --master-key-file /dev/urandom $LOOPDEV -d $KEY1 || fail
|
|
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --master-key-file /dev/urandom -s 256 --uuid $TEST_UUID $LOOPDEV $KEY1 || fail
|
|
$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
# open by UUID
|
|
force_uevent # some systems do not update loop by-uuid
|
|
$CRYPTSETUP luksOpen -d $KEY1 UUID=X$TEST_UUID $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP luksOpen -d $KEY1 UUID=$TEST_UUID $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
# empty keyfile
|
|
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEYE || fail
|
|
$CRYPTSETUP luksOpen -d $KEYE $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
# open by volume key
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT -s 256 --master-key-file $KEY1 $LOOPDEV || fail
|
|
$CRYPTSETUP luksOpen --master-key-file /dev/urandom $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP luksOpen --master-key-file $KEY1 $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
prepare "[17] AddKey volume key, passphrase and keyfile" wipe
|
|
# masterkey
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --master-key-file /dev/zero --key-slot 3 || fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 3: ENABLED" || fail
|
|
echo $PWD2 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --master-key-file /dev/zero --key-slot 4 || fail
|
|
echo $PWD2 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 4 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 4: ENABLED" || fail
|
|
echo $PWD3 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --master-key-file /dev/null --key-slot 5 2>/dev/null && fail
|
|
$CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --master-key-file /dev/zero --key-slot 5 $KEY1 || fail
|
|
$CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 5 -d $KEY1 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 5: ENABLED" || fail
|
|
|
|
# special "-" handling
|
|
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 3 || fail
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d $KEY1 - || fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV -d - --test-passphrase || fail
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d - $KEY2 || fail
|
|
$CRYPTSETUP luksOpen $LOOPDEV -d $KEY2 --test-passphrase || fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV -d - -d $KEY1 --test-passphrase 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV -d $KEY1 -d $KEY1 --test-passphrase 2>/dev/null && fail
|
|
|
|
# [0]PWD1 [1]PWD2 [2]$KEY1/1 [3]$KEY1 [4]$KEY2
|
|
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 3 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 3: ENABLED" || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 --key-slot 3 2>/dev/null && fail
|
|
# keyfile/keyfile
|
|
$CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 --key-slot 4 || fail
|
|
$CRYPTSETUP luksOpen $LOOPDEV -d $KEY2 --test-passphrase --key-slot 4 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 4: ENABLED" || fail
|
|
# passphrase/keyfile
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d $KEY1 --key-slot 0 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 0: ENABLED" || fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 0 || fail
|
|
# passphrase/passphrase
|
|
echo -e "$PWD1\n$PWD2\n" | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --key-slot 1 || fail
|
|
echo $PWD2 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 1 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: ENABLED" || fail
|
|
# keyfile/passphrase
|
|
echo -e "$PWD2\n" | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 2 --new-keyfile-size 3 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 2: ENABLED" || fail
|
|
|
|
prepare "[18] RemoveKey passphrase and keyfile" reuse
|
|
$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY1 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 3: DISABLED" || fail
|
|
$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY1 2>/dev/null && fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY2 $KEY1 --key-slot 3 2>/dev/null || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 3: ENABLED" || fail
|
|
$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 --keyfile-size 1 2>/dev/null && fail
|
|
$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 4: DISABLED" || fail
|
|
# if password or keyfile is provided, batch mode must not suppress it
|
|
echo "badpw" | $CRYPTSETUP luksKillSlot $LOOPDEV 2 2>/dev/null && fail
|
|
echo "badpw" | $CRYPTSETUP luksKillSlot $LOOPDEV 2 -q 2>/dev/null && fail
|
|
echo "badpw" | $CRYPTSETUP luksKillSlot $LOOPDEV 2 --key-file=- 2>/dev/null && fail
|
|
echo "badpw" | $CRYPTSETUP luksKillSlot $LOOPDEV 2 --key-file=- -q 2>/dev/null && fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 2: ENABLED" || fail
|
|
# kill slot using passphrase from 1
|
|
echo $PWD2 | $CRYPTSETUP luksKillSlot $LOOPDEV 2 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 2: DISABLED" || fail
|
|
# kill slot with redirected stdin
|
|
$CRYPTSETUP luksKillSlot $LOOPDEV 3 </dev/null 2>/dev/null || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 3: DISABLED" || fail
|
|
# remove key0 / slot 0
|
|
echo $PWD1 | $CRYPTSETUP luksRemoveKey $LOOPDEV || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 0: DISABLED" || fail
|
|
# last keyslot, in batch mode no passphrase needed...
|
|
$CRYPTSETUP luksKillSlot -q $LOOPDEV 1 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: DISABLED" || fail
|
|
|
|
prepare "[19] create & status & resize" wipe
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash xxx 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --cipher aes-cbc-essiv:sha256 --offset 3 --skip 4 --readonly || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "offset:" | grep -q "3 sectors" || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "skipped:" | grep -q "4 sectors" || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "mode:" | grep -q "readonly" || fail
|
|
$CRYPTSETUP -q resize $DEV_NAME --size 100 || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail
|
|
$CRYPTSETUP -q resize $DEV_NAME || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "19997 sectors" || fail
|
|
# Resize underlying loop device as well
|
|
truncate -s 16M $IMG || fail
|
|
$CRYPTSETUP -q resize $DEV_NAME || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "32765 sectors" || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
$CRYPTSETUP -q status $DEV_NAME >/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha1 $LOOPDEV || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP -q create $DEV_NAME --hash sha1 $LOOPDEV || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP -q create $DEV_NAME --hash sha1 --size 100 $LOOPDEV || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
# 4k sector resize (if kernel supports it)
|
|
echo $PWD1 | $CRYPTSETUP -q open --type plain $LOOPDEV $DEV_NAME --sector-size 4096 --size 8 >/dev/null 2>&1
|
|
if [ $? -eq 0 ] ; then
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "8 sectors"
|
|
$CRYPTSETUP -q resize $DEV_NAME --size 16 || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "16 sectors"
|
|
$CRYPTSETUP -q resize $DEV_NAME --size 9 2>/dev/null && fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
fi
|
|
# verify is ignored on non-tty input
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --verify-passphrase 2>/dev/null || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 --key-size 255 2>/dev/null && fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 --key-size -1 2>/dev/null && fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 -l -1 2>/dev/null && fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 || fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 2>/dev/null && fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d blah 2>/dev/null && fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d /dev/urandom || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
|
|
prepare "[20] Disallow open/create if already mapped." wipe
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 || fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 2>/dev/null && fail
|
|
$CRYPTSETUP create $DEV_NAME2 $LOOPDEV -d $KEY1 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat $LOOPDEV 2>/dev/null && fail
|
|
$CRYPTSETUP remove $DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat $LOOPDEV || fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME2 2>/dev/null && fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
|
|
prepare "[21] luksDump" wipe
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --uuid $TEST_UUID $LOOPDEV $KEY1 || fail
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d $KEY1 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 0: ENABLED" || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q $TEST_UUID || fail
|
|
echo $PWDW | $CRYPTSETUP luksDump $LOOPDEV --dump-master-key 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP luksDump $LOOPDEV --dump-master-key | grep -q "MK dump:" || can_fail_fips
|
|
$CRYPTSETUP luksDump -q $LOOPDEV --dump-master-key -d $KEY1 | grep -q "MK dump:" || can_fail_fips
|
|
echo $PWD1 | $CRYPTSETUP luksDump -q $LOOPDEV --dump-master-key --master-key-file $VK_FILE > /dev/null || can_fail_fips
|
|
fips_mode || {
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --master-key-file $VK_FILE $LOOPDEV || fail
|
|
}
|
|
|
|
prepare "[22] remove disappeared device" wipe
|
|
dmsetup create $DEV_NAME --table "0 5000 linear $LOOPDEV 2" || fail
|
|
echo $PWD1 | $CRYPTSETUP -q $FAST_PBKDF_OPT luksFormat --type luks1 /dev/mapper/$DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksOpen /dev/mapper/$DEV_NAME $DEV_NAME2 || fail
|
|
# underlying device now returns error but node is still present
|
|
dmsetup load $DEV_NAME --table "0 5000 error" || fail
|
|
dmsetup resume $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME2 || fail
|
|
dmsetup remove $DEV_NAME || fail
|
|
|
|
prepare "[23] ChangeKey passphrase and keyfile" wipe
|
|
# [0]$KEY1 [1]key0
|
|
$CRYPTSETUP -q luksFormat --type luks1 $LOOPDEV $KEY1 $FAST_PBKDF_OPT --key-slot 0 || fail
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 --key-slot 1 || fail
|
|
# keyfile [0] / keyfile [0]
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 --key-slot 0 || fail
|
|
# passphrase [1] / passphrase [1]
|
|
echo -e "$PWD1\n$PWD2\n" | $CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT --key-slot 1 || fail
|
|
# keyfile [0] / keyfile [new]
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY2 $KEY1 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 0: DISABLED" || fail
|
|
# passphrase [1] / passphrase [new]
|
|
echo -e "$PWD2\n$PWD1\n" | $CRYPTSETUP luksChangeKey $FAST_PBKDF_OPT $LOOPDEV || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: DISABLED" || fail
|
|
# use all slots
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail
|
|
# still allows replace
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 || fail
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 2>/dev/null && fail
|
|
|
|
prepare "[24] Keyfile limit" wipe
|
|
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 0 -l 13 || fail
|
|
$CRYPTSETUP --key-file=$KEY1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l 0 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l -1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l 14 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset -1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l 13 luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT 2>/dev/null && fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT -l 14 2>/dev/null && fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT -l -1 2>/dev/null && fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT -l 13 --new-keyfile-size 12 || fail
|
|
$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 2>/dev/null && fail
|
|
$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 -l 12 || fail
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT 2>/dev/null && fail
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT -l 14 2>/dev/null && fail
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT -l 13 || fail
|
|
# -l is ignored for stdin if _only_ passphrase is used
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY2 $FAST_PBKDF_OPT || fail
|
|
# this is stupid, but expected
|
|
echo $PWD1 | $CRYPTSETUP luksRemoveKey $LOOPDEV -l 11 2>/dev/null && fail
|
|
echo $PWDW"0" | $CRYPTSETUP luksRemoveKey $LOOPDEV -l 12 2>/dev/null && fail
|
|
echo -e "$PWD1\n" | $CRYPTSETUP luksRemoveKey $LOOPDEV -d- -l 12 || fail
|
|
# offset
|
|
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 0 -l 13 --keyfile-offset 16 || fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 15 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 16 luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 -l 13 --keyfile-offset 16 $KEY2 --new-keyfile-offset 1 || fail
|
|
$CRYPTSETUP --key-file=$KEY2 --keyfile-offset 11 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY2 --keyfile-offset 1 luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY2 --keyfile-offset 1 $KEY2 --new-keyfile-offset 0 || fail
|
|
$CRYPTSETUP luksOpen -d $KEY2 $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
# large device with keyfile
|
|
echo -e '0 10000000 error'\\n'10000000 1000000 zero' | dmsetup create $DEV_NAME2 || fail
|
|
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV /dev/mapper/$DEV_NAME2 -l 13 --keyfile-offset 5120000000 || fail
|
|
$CRYPTSETUP --key-file=/dev/mapper/$DEV_NAME2 -l 13 --keyfile-offset 5119999999 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=/dev/mapper/$DEV_NAME2 -l 13 --keyfile-offset 5120000000 luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d /dev/mapper/$DEV_NAME2 \
|
|
--keyfile-offset 5120000000 -l 13 /dev/mapper/$DEV_NAME2 --new-keyfile-offset 5120000001 --new-keyfile-size 15 || fail
|
|
dmsetup remove $DEV_NAME2
|
|
|
|
prepare "[25] Create shared segments" wipe
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --offset 0 --size 256 || fail
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME2 $LOOPDEV --hash sha1 --offset 512 --size 256 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME2 $LOOPDEV --hash sha1 --offset 512 --size 256 --shared || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME2 || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
|
|
prepare "[26] Suspend/Resume" wipe
|
|
# only LUKS is supported
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha1 $LOOPDEV || fail
|
|
$CRYPTSETUP luksSuspend $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP luksResume $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
$CRYPTSETUP luksSuspend $DEV_NAME 2>/dev/null && fail
|
|
# LUKS
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP luksSuspend $DEV_NAME || fail
|
|
$CRYPTSETUP -q resize $DEV_NAME 2>/dev/null && fail
|
|
echo $PWDW | $CRYPTSETUP luksResume $DEV_NAME 2>/dev/null && fail
|
|
[ $? -ne 2 ] && fail "luksResume should return EPERM exit code"
|
|
echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
prepare "[27] luksOpen with specified key slot number" wipe
|
|
# first, let's try passphrase option
|
|
echo $PWD3 | $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF_OPT -S 5 $LOOPDEV || fail
|
|
check $LUKS_HEADER $KEY_SLOT5 $KEY_MATERIAL5
|
|
echo $PWD3 | $CRYPTSETUP luksOpen -S 4 $LOOPDEV $DEV_NAME && fail
|
|
[ -b /dev/mapper/$DEV_NAME ] && fail
|
|
echo $PWD3 | $CRYPTSETUP luksOpen -S 5 $LOOPDEV $DEV_NAME || fail
|
|
check_exists
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
echo -e "$PWD3\n$PWD1" | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 0 $LOOPDEV || fail
|
|
check $LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0
|
|
echo $PWD3 | $CRYPTSETUP luksOpen -S 0 $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
[ -b /dev/mapper/$DEV_NAME ] && fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen -S 5 $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
[ -b /dev/mapper/$DEV_NAME ] && fail
|
|
# second, try it with keyfiles
|
|
$CRYPTSETUP luksFormat --type luks1 -q -S 5 -d $KEY5 $LOOPDEV || fail
|
|
check $LUKS_HEADER $KEY_SLOT5 $KEY_MATERIAL5
|
|
$CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 || fail
|
|
check $LUKS_HEADER $KEY_SLOT1 $KEY_MATERIAL1
|
|
$CRYPTSETUP luksOpen -S 5 -d $KEY5 $LOOPDEV $DEV_NAME || fail
|
|
check_exists
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
$CRYPTSETUP luksOpen -S 1 -d $KEY5 $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
[ -b /dev/mapper/$DEV_NAME ] && fail
|
|
$CRYPTSETUP luksOpen -S 5 -d $KEY1 $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
[ -b /dev/mapper/$DEV_NAME ] && fail
|
|
|
|
prepare "[28] Detached LUKS header" wipe
|
|
echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG || fail
|
|
echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --align-payload 1 >/dev/null 2>&1 && fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --align-payload 8192 || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --align-payload 0 || fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail
|
|
$CRYPTSETUP -q resize $DEV_NAME --size 100 --header $HEADER_IMG || fail
|
|
$CRYPTSETUP -q status $DEV_NAME --header $HEADER_IMG | grep "size:" | grep -q "100 sectors" || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "type:" | grep -q "n/a" || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail
|
|
$CRYPTSETUP luksSuspend $DEV_NAME --header $HEADER_IMG || fail
|
|
echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME --header $HEADER_IMG || fail
|
|
$CRYPTSETUP luksSuspend $DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME && fail
|
|
echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME --header $HEADER_IMG || fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 5 _fakedev_ --header $HEADER_IMG $KEY5 || fail
|
|
$CRYPTSETUP luksDump _fakedev_ --header $HEADER_IMG | grep -q "Key Slot 5: ENABLED" || fail
|
|
$CRYPTSETUP luksKillSlot -q _fakedev_ --header $HEADER_IMG 5 || fail
|
|
$CRYPTSETUP luksDump _fakedev_ --header $HEADER_IMG | grep -q "Key Slot 5: DISABLED" || fail
|
|
|
|
prepare "[29] Repair metadata" wipe
|
|
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 0 || fail
|
|
# second sector overwrite should corrupt keyslot 6+7
|
|
dd if=/dev/urandom of=$LOOPDEV bs=512 seek=1 count=1 >/dev/null 2>&1
|
|
$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME >/dev/null 2>&1 && fail
|
|
$CRYPTSETUP -q repair $LOOPDEV >/dev/null 2>&1 || fail
|
|
$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
|
|
prepare "[30] LUKS erase" wipe
|
|
$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY5 --key-slot 5 || fail
|
|
$CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: ENABLED" || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 5: ENABLED" || fail
|
|
$CRYPTSETUP luksErase -q $LOOPDEV || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: DISABLED" || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 5: DISABLED" || fail
|
|
|
|
prepare "[31] Deferred removal of device" wipe
|
|
echo $PWD1 | $CRYPTSETUP open --type plain $LOOPDEV $DEV_NAME || fail
|
|
echo $PWD2 | $CRYPTSETUP open --type plain /dev/mapper/$DEV_NAME $DEV_NAME2 || fail
|
|
$CRYPTSETUP close $DEV_NAME >/dev/null 2>&1 && fail
|
|
$CRYPTSETUP -q status $DEV_NAME >/dev/null 2>&1 || fail
|
|
$CRYPTSETUP close --deferred $DEV_NAME >/dev/null 2>&1
|
|
if [ $? -eq 0 ] ; then
|
|
dmsetup info $DEV_NAME | grep -q "DEFERRED REMOVE" || fail
|
|
$CRYPTSETUP -q status $DEV_NAME >/dev/null 2>&1 || fail
|
|
$CRYPTSETUP close $DEV_NAME2 || fail
|
|
$CRYPTSETUP -q status $DEV_NAME >/dev/null 2>&1 && fail
|
|
else
|
|
$CRYPTSETUP close $DEV_NAME2 >/dev/null 2>&1
|
|
$CRYPTSETUP close $DEV_NAME >/dev/null 2>&1
|
|
fi
|
|
|
|
# Interactive tests
|
|
# Do not remove sleep 0.1 below, the password query flushes TTY buffer (so the code is racy).
|
|
which expect >/dev/null 2>&1 || skip "WARNING: expect tool missing, interactive test will be skipped." 0
|
|
|
|
prepare "[32] Interactive password retry from terminal." new
|
|
expect - >/dev/null <<EOF
|
|
proc abort {} { send_error "Timeout. "; exit 2 }
|
|
set timeout 10
|
|
eval spawn $CRYPTSETUP luksOpen -v -T 2 $LOOPDEV $DEV_NAME
|
|
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
|
sleep 0.1
|
|
send "$PWD0 x\n"
|
|
expect timeout abort "No key available with this passphrase."
|
|
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
|
sleep 0.1
|
|
send "$PWD0\n"
|
|
expect timeout abort "Key slot 0 unlocked."
|
|
expect timeout abort "Command successful."
|
|
expect timeout abort eof
|
|
exit
|
|
EOF
|
|
[ $? -eq 0 ] || fail "Expect script failed."
|
|
check_exists
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
prepare "[33] Interactive unsuccessful password retry from terminal." new
|
|
expect - >/dev/null <<EOF
|
|
proc abort {} { send_error "Timeout. "; exit 2 }
|
|
set timeout 10
|
|
eval spawn $CRYPTSETUP luksOpen -v -T 2 $LOOPDEV $DEV_NAME
|
|
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
|
sleep 0.1
|
|
send "$PWD0 x\n"
|
|
expect timeout abort "No key available with this passphrase."
|
|
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
|
sleep 0.1
|
|
send "$PWD0 y\n"
|
|
expect timeout abort "No key available with this passphrase."
|
|
expect timeout abort eof
|
|
exit
|
|
EOF
|
|
[ $? -eq 0 ] || fail "Expect script failed."
|
|
|
|
prepare "[34] Interactive kill of last key slot." new
|
|
expect - >/dev/null <<EOF
|
|
proc abort {} { send_error "Timeout. "; exit 2 }
|
|
set timeout 10
|
|
eval spawn $CRYPTSETUP luksKillSlot -v $LOOPDEV 0
|
|
expect timeout abort "Are you sure? (Type uppercase yes):"
|
|
send "YES\n"
|
|
expect timeout abort "Enter any remaining passphrase:"
|
|
sleep 0.1
|
|
send "$PWD0\n"
|
|
expect timeout abort "Command successful."
|
|
expect timeout abort eof
|
|
eval spawn $CRYPTSETUP luksKillSlot -v $LOOPDEV 0
|
|
expect timeout abort "Keyslot 0 is not active."
|
|
expect timeout abort eof
|
|
exit
|
|
EOF
|
|
[ $? -eq 0 ] || fail "Expect script failed."
|
|
|
|
prepare "[35] Interactive format of device." wipe
|
|
expect - >/dev/null <<EOF
|
|
proc abort {} { send_error "Timeout. "; exit 2 }
|
|
set timeout 10
|
|
eval spawn $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF_OPT -v $LOOPDEV
|
|
expect timeout abort "Are you sure? (Type uppercase yes):"
|
|
send "YES\n"
|
|
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
|
sleep 0.1
|
|
send "$PWD0\n"
|
|
expect timeout abort "Verify passphrase:"
|
|
sleep 0.1
|
|
send "$PWD0\n"
|
|
expect timeout abort "Command successful."
|
|
expect timeout abort eof
|
|
eval spawn $CRYPTSETUP luksOpen -v $LOOPDEV --test-passphrase
|
|
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
|
sleep 0.1
|
|
send "$PWD0\n"
|
|
expect timeout abort "Command successful."
|
|
expect timeout abort eof
|
|
exit
|
|
EOF
|
|
[ $? -eq 0 ] || fail "Expect script failed."
|
|
|
|
prepare "[36] Interactive unsuccessful format of device." new
|
|
expect - >/dev/null <<EOF
|
|
proc abort {} { send_error "Timeout. "; exit 2 }
|
|
set timeout 10
|
|
eval spawn $CRYPTSETUP erase -v $LOOPDEV
|
|
expect timeout abort "Are you sure? (Type uppercase yes):"
|
|
send "YES\n"
|
|
expect timeout abort "Command successful."
|
|
expect timeout abort eof
|
|
eval spawn $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF_OPT -v $LOOPDEV
|
|
expect timeout abort "Are you sure? (Type uppercase yes):"
|
|
send "YES\n"
|
|
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
|
sleep 0.1
|
|
send "$PWD0\n"
|
|
expect timeout abort "Verify passphrase:"
|
|
sleep 0.1
|
|
send "$PWD0 x\n"
|
|
expect timeout abort "Passphrases do not match."
|
|
expect timeout abort eof
|
|
eval spawn $CRYPTSETUP luksOpen -v $LOOPDEV -T 1 --test-passphrase
|
|
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
|
sleep 0.1
|
|
send "$PWD0\n"
|
|
expect timeout abort "No key available with this passphrase."
|
|
expect timeout abort eof
|
|
exit
|
|
EOF
|
|
[ $? -eq 0 ] || fail "Expect script failed."
|
|
|
|
prepare "[37] Interactive add key." new
|
|
expect - >/dev/null <<EOF
|
|
proc abort {} { send_error "Timeout. "; exit 2 }
|
|
set timeout 10
|
|
eval spawn $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -v $LOOPDEV
|
|
expect timeout abort "Enter any existing passphrase:"
|
|
sleep 0.1
|
|
send "$PWD0\n"
|
|
expect timeout abort "Enter new passphrase for key slot:"
|
|
sleep 0.1
|
|
send "$PWD1\n"
|
|
expect timeout abort "Verify passphrase:"
|
|
sleep 0.1
|
|
send "$PWD1\n"
|
|
expect timeout abort "Command successful."
|
|
expect timeout abort eof
|
|
eval spawn $CRYPTSETUP luksOpen $FAST_PBKDF_OPT -v $LOOPDEV --test-passphrase
|
|
expect timeout abort "Enter passphrase"
|
|
sleep 0.1
|
|
send "$PWD1\n"
|
|
expect timeout abort "Command successful."
|
|
expect timeout abort eof
|
|
exit
|
|
EOF
|
|
[ $? -eq 0 ] || fail "Expect script failed."
|
|
|
|
prepare "[38] Interactive change key." new
|
|
expect - >/dev/null <<EOF
|
|
proc abort {} { send_error "Timeout. "; exit 2 }
|
|
set timeout 10
|
|
eval spawn $CRYPTSETUP luksChangeKey $FAST_PBKDF_OPT -v $LOOPDEV
|
|
expect timeout abort "Enter passphrase to be changed:"
|
|
sleep 0.1
|
|
send "$PWD0\n"
|
|
expect timeout abort "Enter new passphrase:"
|
|
sleep 0.1
|
|
send "$PWD1\n"
|
|
expect timeout abort "Verify passphrase:"
|
|
sleep 0.1
|
|
send "$PWD1\n"
|
|
expect timeout abort "Command successful."
|
|
expect timeout abort eof
|
|
eval spawn $CRYPTSETUP luksOpen -v $LOOPDEV --test-passphrase
|
|
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
|
sleep 0.1
|
|
send "$PWD1\n"
|
|
expect timeout abort "Command successful."
|
|
expect timeout abort eof
|
|
exit
|
|
EOF
|
|
[ $? -eq 0 ] || fail "Expect script failed."
|
|
|
|
prepare "[39] Interactive suspend and resume." new
|
|
echo $PWD0 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
|
|
expect - >/dev/null <<EOF
|
|
proc abort {} { send_error "Timeout. "; exit 2 }
|
|
set timeout 10
|
|
eval spawn $CRYPTSETUP luksSuspend -v $DEV_NAME
|
|
expect timeout abort "Command successful."
|
|
expect timeout abort eof
|
|
eval spawn $CRYPTSETUP luksResume -v -T 3 $DEV_NAME
|
|
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
|
sleep 0.1
|
|
send "$PWD0 x\n"
|
|
expect timeout abort "No key available with this passphrase."
|
|
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
|
sleep 0.1
|
|
send "$PWD1\n"
|
|
expect timeout abort "No key available with this passphrase."
|
|
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
|
sleep 0.1
|
|
send "$PWD0 y\n"
|
|
expect timeout abort "No key available with this passphrase."
|
|
expect timeout abort eof
|
|
eval spawn $CRYPTSETUP luksResume -v $DEV_NAME
|
|
expect timeout abort "Enter passphrase for $LOOPDEV:"
|
|
sleep 0.1
|
|
send "$PWD0\n"
|
|
expect timeout abort "Command successful."
|
|
expect timeout abort eof
|
|
exit
|
|
EOF
|
|
[ $? -eq 0 ] || fail "Expect script failed."
|
|
$CRYPTSETUP remove $DEV_NAME || fail
|
|
|
|
remove_mapping
|
|
exit 0
|