mirror of
https://gitlab.com/cryptsetup/cryptsetup.git
synced 2026-01-06 15:35:29 +01:00
e07e3ecc22
Recent kernel changes disallows to use keyed-hash algorithms without settting the key. Unfortunately, dm-integrity fails too late (during IO, not on init). For now fix just the test.
315 lines
9.9 KiB
Bash
Executable File
315 lines
9.9 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# Test integritysetup compatibility.
|
|
#
|
|
INTSETUP=../integritysetup
|
|
INTSETUP_VALGRIND=../.libs/integritysetup
|
|
INTSETUP_LIB_VALGRIND=../.libs
|
|
|
|
DEV_NAME=dmc_test
|
|
DEV=test123.img
|
|
KEY_FILE=key.img
|
|
|
|
dmremove() { # device
|
|
udevadm settle >/dev/null 2>&1
|
|
dmsetup remove $1 >/dev/null 2>&1
|
|
}
|
|
|
|
cleanup() {
|
|
[ -b /dev/mapper/$DEV_NAME ] && dmremove $DEV_NAME
|
|
rm -f $DEV $KEY_FILE >/dev/null 2>&1
|
|
}
|
|
|
|
fail()
|
|
{
|
|
echo
|
|
[ -n "$1" ] && echo "FAILED at line $(caller)"
|
|
cleanup
|
|
exit 100
|
|
}
|
|
|
|
skip()
|
|
{
|
|
[ -n "$1" ] && echo "$1"
|
|
exit 77
|
|
}
|
|
|
|
add_device() {
|
|
cleanup
|
|
dd if=/dev/urandom of=$KEY_FILE bs=1 count=512 >/dev/null 2>&1
|
|
dd if=/dev/zero of=$DEV bs=1M count=32 >/dev/null 2>&1
|
|
sync
|
|
}
|
|
|
|
status_check() # name value
|
|
{
|
|
X=$($INTSETUP status $DEV_NAME | grep "$1" | sed 's/.*: //' | sed 's/^[[:space:]]*//')
|
|
if [ "$X" != "$2" ] ; then
|
|
echo "[status FAIL]"
|
|
echo " Expecting $1:$2 got \"$X\"."
|
|
fail
|
|
fi
|
|
}
|
|
|
|
dump_check() # name value
|
|
{
|
|
X=$($INTSETUP dump $DEV | grep "$1" | cut -d' ' -f 2)
|
|
if [ "$X" != "$2" ] ; then
|
|
echo "[dump FAIL]"
|
|
echo " Expecting $1:$2 got \"$X\"."
|
|
fail
|
|
fi
|
|
}
|
|
|
|
kernel_param_check() # number value
|
|
{
|
|
X=$(dmsetup table $DEV_NAME | cut -d " " -f $1)
|
|
if [ "$X" != $2 ] ; then
|
|
echo "[param_check FAIL]"
|
|
echo "Expecting $2 got \"$X\"."
|
|
fail
|
|
fi
|
|
}
|
|
|
|
function valgrind_setup()
|
|
{
|
|
which valgrind >/dev/null 2>&1 || fail "Cannot find valgrind."
|
|
[ ! -f $INTSETUP_VALGRIND ] && fail "Unable to get location of cryptsetup executable."
|
|
export LD_LIBRARY_PATH="$INTSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH"
|
|
}
|
|
|
|
function valgrind_run()
|
|
{
|
|
INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${INTSETUP_VALGRIND} "$@"
|
|
}
|
|
|
|
int_check_sum() # alg checksum [keyfile keysize]
|
|
{
|
|
if [ -n "$4" ] ; then
|
|
KEY_PARAMS="--integrity-key-file $3 --integrity-key-size $4"
|
|
else
|
|
KEY_PARAMS=""
|
|
fi
|
|
|
|
# Fill device with zeroes and reopen it
|
|
dd if=/dev/zero of=/dev/mapper/$DEV_NAME bs=1M oflag=direct >/dev/null 2>&1
|
|
dmremove $DEV_NAME
|
|
|
|
$INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS || fail "Cannot activate device."
|
|
|
|
VSUM=$(sha256sum /dev/mapper/$DEV_NAME | cut -d' ' -f 1)
|
|
if [ "$VSUM" = "$2" ] ; then
|
|
echo -n "[CHECKSUM OK]"
|
|
else
|
|
echo "[FAIL]"
|
|
echo " Expecting $2 got $VSUM."
|
|
fail
|
|
fi
|
|
}
|
|
|
|
intformat() # alg alg_out tagsize sector_size csum [keyfile keysize]
|
|
{
|
|
if [ -n "$7" ] ; then
|
|
KEY_PARAMS="--integrity-key-file $6 --integrity-key-size $7"
|
|
else
|
|
KEY_PARAMS=""
|
|
fi
|
|
|
|
echo -n "[INTEGRITY:$2:$3:$4]"
|
|
echo -n "[FORMAT]"
|
|
$INTSETUP format -q --integrity $1 --tag-size $3 --sector-size $4 $KEY_PARAMS $DEV || fail "Cannot format device."
|
|
dump_check "tag_size" $3
|
|
dump_check "sector_size" $4
|
|
echo -n "[ACTIVATE]"
|
|
$INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS || fail "Cannot activate device."
|
|
status_check "tag size" $3
|
|
status_check "integrity" $2
|
|
status_check "sector size" "$4 bytes"
|
|
int_check_sum $1 $5 $6 $7
|
|
echo -n "[REMOVE]"
|
|
$INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
|
|
echo "[OK]"
|
|
}
|
|
|
|
int_error_detection() # alg tagsize sector_size key_file key_size
|
|
{
|
|
if [ -n "$5" ] ; then
|
|
KEY_PARAMS="--integrity-key-file $4 --integrity-key-size $5"
|
|
else
|
|
KEY_PARAMS=""
|
|
fi
|
|
dd if=/dev/zero of=$DEV bs=1M count=32 >/dev/null 2>&1
|
|
|
|
echo -n "[INTEGRITY:$1:$2:$3]"
|
|
echo -n "[FORMAT]"
|
|
$INTSETUP format -q --integrity $1 --tag-size $2 --sector-size $3 $KEY_PARAMS $DEV || fail "Cannot format device."
|
|
echo -n "[ACTIVATE]"
|
|
$INTSETUP open $DEV $DEV_NAME --integrity $1 --integrity-no-journal $KEY_PARAMS || fail "Cannot activate device."
|
|
|
|
if [ -n "$4" -a -n "$5" ]; then
|
|
echo -n "[KEYED HASH]"
|
|
KEY_HEX=$(xxd -c 256 -l $5 -p $4)
|
|
[ -z "$KEY_HEX" ] && fail "Cannot decode key."
|
|
dmsetup table --showkeys $DEV_NAME | grep -q $KEY_HEX || fail "Key mismatch."
|
|
fi
|
|
|
|
echo -n "[WRITE DATA]"
|
|
echo -n "EXAMPLE TEXT" | dd of=/dev/mapper/$DEV_NAME >/dev/null 2>&1 || fail "Cannot write to device."
|
|
$INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
|
|
|
|
# find offset of data area
|
|
ARR=($(dd if=$DEV bs=512 2>/dev/null | hexdump -C | grep 'EXAMPLE TEXT'))
|
|
OFF_HEX=${ARR[0]}
|
|
OFF_DEC=$((16#$OFF_HEX))
|
|
|
|
echo -n "[CORRUPT DATA:$OFF_DEC]"
|
|
echo -n "Z" | dd of=$DEV bs=1 seek=$OFF_DEC conv=notrunc >/dev/null 2>&1 || fail "Cannot write to device."
|
|
|
|
echo -n "[DETECT ERROR]"
|
|
$INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS || fail "Cannot activate device."
|
|
dd if=/dev/mapper/$DEV_NAME >/dev/null 2>&1 && fail "Error detection failed."
|
|
|
|
echo -n "[REMOVE]"
|
|
$INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
|
|
echo "[OK]"
|
|
}
|
|
|
|
int_journal() # 1 alg, 2 tagsize, 3 sector_size, 4 watermark, 5 commit_time, 6 journal_integrity, 7 key-file, 8 key-size, 9 journal_integrity_out
|
|
{
|
|
echo -n "[INTEGRITY JOURNAL:$6:${4}%:${5}ms]"
|
|
echo -n "[FORMAT]"
|
|
ARGS="--integrity $1 --journal-watermark $4 --journal-commit-time $5 --journal-integrity $6 --journal-integrity-key-file $7 --journal-integrity-key-size $8"
|
|
$INTSETUP format -q --tag-size $2 --sector-size $3 $ARGS $DEV || fail "Cannot format device."
|
|
|
|
echo -n "[ACTIVATE]"
|
|
|
|
$INTSETUP open $DEV $DEV_NAME $ARGS || fail "Cannot activate device."
|
|
|
|
echo -n "[KEYED HASH]"
|
|
KEY_HEX=$(xxd -c 256 -l $8 -p $7)
|
|
[ -z "$KEY_HEX" ] && fail "Cannot decode key."
|
|
dmsetup table --showkeys $DEV_NAME | grep -q $KEY_HEX || fail "Key mismatch."
|
|
|
|
status_check "journal watermark" "${4}%"
|
|
status_check "journal commit time" "${5} ms"
|
|
status_check "journal integrity MAC" $9
|
|
|
|
echo -n "[REMOVE]"
|
|
$INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
|
|
echo "[OK]"
|
|
}
|
|
|
|
|
|
int_journal_crypt() # crypt_alg crypt_alg_kernel crypt_key crypt_key_size
|
|
{
|
|
echo -n "[JOURNAL CRYPT:$1:${4}B]"
|
|
|
|
echo -n "[FORMAT]"
|
|
ARGS="--journal-crypt $1 --journal-crypt-key-file $3 --journal-crypt-key-size $4"
|
|
$INTSETUP format -q $ARGS $DEV || fail "Cannot format device."
|
|
|
|
echo -n "[ACTIVATE]"
|
|
$INTSETUP open $DEV $DEV_NAME $ARGS || fail "Cannot activate device."
|
|
|
|
KEY_HEX=$(xxd -c 256 -l $4 -p $3)
|
|
[ -z "$KEY_HEX" ] && fail "Cannot decode key."
|
|
dmsetup table --showkeys $DEV_NAME | grep -q "journal_crypt:$2:$KEY_HEX" || fail "Key mismatch."
|
|
|
|
$INTSETUP close $DEV_NAME
|
|
echo "[OK]"
|
|
}
|
|
|
|
int_mode() # alg tag_size sector_size [keyfile keysize]
|
|
{
|
|
if [ -n "$5" ] ; then
|
|
KEY_PARAMS="--integrity-key-file $4 --integrity-key-size $5"
|
|
else
|
|
KEY_PARAMS=""
|
|
fi
|
|
|
|
echo -n "[MODE TESTS:$1:$2:$3]"
|
|
ARGS="--tag-size $2 --sector-size $3"
|
|
|
|
$INTSETUP format -q $ARGS $KEY_PARAMS $DEV --integrity $1 || fail "Cannot format device."
|
|
|
|
echo -n "[JOURNALED WRITES]"
|
|
$INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS || fail "Cannot activate device with journal."
|
|
status_check "mode" "read/write"
|
|
kernel_param_check 7 "J"
|
|
|
|
$INTSETUP close $DEV_NAME fail "Cannot deactivate device."
|
|
|
|
echo -n "[DIRECT WRITES]"
|
|
$INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS --integrity-no-journal || fail "Cannot activate device without journal."
|
|
status_check "mode" "read/write"
|
|
status_check "journal" "not active"
|
|
kernel_param_check 7 "D"
|
|
|
|
$INTSETUP close $DEV_NAME fail "Cannot deactivate device."
|
|
|
|
echo -n "[RECOVERY MODE]"
|
|
$INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS --integrity-recovery-mode || fail "Cannot activate device in recovery mode."
|
|
status_check "mode" "read/write recovery"
|
|
kernel_param_check 7 "R"
|
|
|
|
$INTSETUP close $DEV_NAME fail "Cannot deactivate device."
|
|
|
|
echo "[OK]"
|
|
}
|
|
|
|
[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
|
|
[ ! -x "$INTSETUP" ] && skip "Cannot find $INTSETUP, test skipped."
|
|
|
|
[ -n "$VALG" ] && valgrind_setup && INTSETUP=valgrind_run
|
|
which hexdump >/dev/null 2>&1 || skip "WARNING: hexdump tool required."
|
|
modprobe dm-integrity >/dev/null 2>&1
|
|
dmsetup targets | grep integrity >/dev/null 2>&1 || skip "Cannot find dm-integrity target, test skipped."
|
|
|
|
add_device
|
|
intformat crc32c crc32c 4 512 08f63eb27fb9ce2ce903b0a56429c68ce5e209253ba42154841ef045a53839d7
|
|
intformat crc32 crc32 4 512 08f63eb27fb9ce2ce903b0a56429c68ce5e209253ba42154841ef045a53839d7
|
|
intformat sha1 sha1 20 512 6eedd6344dab8875cd185fcd6565dfc869ab36bc57e577f40c685290b1fa7fe7
|
|
intformat sha1 sha1 16 4096 e152ec88227b539cd9cafd8bdb587a1072d720cd6bcebe1398d4136c9e7f337b
|
|
intformat sha256 sha256 32 512 8e5fe4119558e117bfc40e3b0f13ade3abe497b52604d4c7cca0cfd6c7f4cf11
|
|
intformat hmac-sha256 hmac\(sha256\) 32 512 8e5fe4119558e117bfc40e3b0f13ade3abe497b52604d4c7cca0cfd6c7f4cf11 $KEY_FILE 32
|
|
intformat sha256 sha256 32 4096 33f7dfa5163ca9f740383fb8b0919574e38a7b20a94a4170fde4238196b7c4b4
|
|
intformat hmac-sha256 hmac\(sha256\) 32 4096 33f7dfa5163ca9f740383fb8b0919574e38a7b20a94a4170fde4238196b7c4b4 $KEY_FILE 32
|
|
|
|
echo "Error detection tests:"
|
|
int_error_detection crc32c 4 512
|
|
int_error_detection crc32c 4 4096
|
|
int_error_detection crc32 4 512
|
|
int_error_detection crc32 4 4096
|
|
int_error_detection sha1 20 512
|
|
int_error_detection sha1 16 512
|
|
int_error_detection sha1 20 4096
|
|
int_error_detection sha256 32 512
|
|
int_error_detection sha256 32 4096
|
|
|
|
which xxd >/dev/null 2>&1 || skip "WARNING: xxd tool required."
|
|
int_error_detection hmac-sha256 32 512 $KEY_FILE 32
|
|
int_error_detection hmac-sha256 32 4096 $KEY_FILE 32
|
|
|
|
echo "Journal parameters tests:"
|
|
# Watermark is calculated in kernel, so it can be rounded down/up
|
|
int_journal crc32 4 512 66 1000 hmac-sha256 $KEY_FILE 32 hmac\(sha256\)
|
|
int_journal sha256 32 4096 34 5000 hmac-sha1 $KEY_FILE 16 hmac\(sha1\)
|
|
int_journal sha1 20 512 75 9999 hmac-sha256 $KEY_FILE 32 hmac\(sha256\)
|
|
|
|
echo "Journal encryption tests:"
|
|
int_journal_crypt cbc-aes cbc\(aes\) $KEY_FILE 32
|
|
int_journal_crypt cbc-aes cbc\(aes\) $KEY_FILE 16
|
|
int_journal_crypt salsa20 salsa20 $KEY_FILE 32
|
|
int_journal_crypt ctr-aes ctr\(aes\) $KEY_FILE 32
|
|
int_journal_crypt ctr-aes ctr\(aes\) $KEY_FILE 16
|
|
|
|
echo "Mode tests:"
|
|
int_mode crc32c 4 512
|
|
int_mode crc32 4 512
|
|
int_mode sha1 20 512
|
|
int_mode sha256 32 512
|
|
int_mode hmac-sha256 32 512 $KEY_FILE 32
|
|
int_mode hmac-sha256 32 4096 $KEY_FILE 32
|
|
|
|
cleanup
|