mirror of
https://gitlab.com/cryptsetup/cryptsetup.git
synced 2025-12-15 21:00:05 +01:00
ae9c9cf369
LUKS detached header has some limitations, one of them is that you cannot run some explicit check for data offsets without providing also data device. Because luksDump and all key handle commands takes only metadata device (LUKS heaer device), it not easy to properly support data payload offset validation. So if detached header is present for luksFormat, code now allows data payload 0 (IOW whole data device is used) and explicit offset larger than header+keyslots (the same as the header is on data device - so some space is wasted). N.B. with detached header the option --align-payload is used directly without any round up caculations. Fixes Issue#155.
551 lines
24 KiB
Bash
Executable File
551 lines
24 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
PS4='$LINENO:'
|
|
CRYPTSETUP=../src/cryptsetup
|
|
|
|
CRYPTSETUP_VALGRIND=../src/.libs/cryptsetup
|
|
CRYPTSETUP_LIB_VALGRIND=../lib/.libs
|
|
|
|
DEV_NAME=dummy
|
|
DEV_NAME2=dummy2
|
|
DEV_NAME3=dummy3
|
|
ORIG_IMG=luks-test-orig
|
|
IMG=luks-test
|
|
IMG10=luks-test-v10
|
|
HEADER_IMG=luks-header
|
|
KEY1=key1
|
|
KEY2=key2
|
|
KEY5=key5
|
|
KEYE=keye
|
|
PWD0="compatkey"
|
|
PWD1="93R4P4pIqAH8"
|
|
PWD2="mymJeD8ivEhE"
|
|
PWD3="ocMakf3fAcQO"
|
|
PWDW="rUkL4RUryBom"
|
|
|
|
LUKS_HEADER="S0-5 S6-7 S8-39 S40-71 S72-103 S104-107 S108-111 R112-131 R132-163 S164-167 S168-207 A0-591"
|
|
KEY_SLOT0="S208-211 S212-215 R216-247 A248-251 A251-255"
|
|
KEY_MATERIAL0="R4096-68096"
|
|
KEY_MATERIAL0_EXT="R4096-68096"
|
|
|
|
KEY_SLOT1="S256-259 S260-263 R264-295 A296-299 A300-303"
|
|
KEY_MATERIAL1="R69632-133632"
|
|
KEY_MATERIAL1_EXT="S69632-133632"
|
|
|
|
KEY_SLOT5="S448-451 S452-455 R456-487 A488-491 A492-495"
|
|
KEY_MATERIAL5="R331776-395264"
|
|
KEY_MATERIAL5_EXT="S331776-395264"
|
|
|
|
TEST_UUID="12345678-1234-1234-1234-123456789abc"
|
|
|
|
LOOPDEV=$(losetup -f 2>/dev/null)
|
|
FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null)
|
|
|
|
function remove_mapping()
|
|
{
|
|
[ -b /dev/mapper/$DEV_NAME3 ] && dmsetup remove $DEV_NAME3
|
|
[ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove $DEV_NAME2
|
|
[ -b /dev/mapper/$DEV_NAME ] && dmsetup remove $DEV_NAME
|
|
losetup -d $LOOPDEV >/dev/null 2>&1
|
|
rm -f $ORIG_IMG $IMG $IMG10 $KEY1 $KEY2 $KEY5 $KEYE $HEADER_IMG >/dev/null 2>&1
|
|
}
|
|
|
|
function force_uevent()
|
|
{
|
|
DNAME=$(echo $LOOPDEV | cut -f3 -d /)
|
|
echo "change" >/sys/block/$DNAME/uevent
|
|
}
|
|
|
|
function fail()
|
|
{
|
|
[ -n "$1" ] && echo "$1"
|
|
remove_mapping
|
|
echo "FAILED"
|
|
exit 2
|
|
}
|
|
|
|
function can_fail_fips()
|
|
{
|
|
# Ignore this fail if running in FIPS mode
|
|
[ -z "$FIPS_MODE" -o "$FIPS_MODE" -eq 0 ] && fail $1
|
|
}
|
|
|
|
function skip()
|
|
{
|
|
[ -n "$1" ] && echo "$1"
|
|
remove_mapping
|
|
exit 0
|
|
}
|
|
|
|
function prepare()
|
|
{
|
|
[ -b /dev/mapper/$DEV_NAME ] && dmsetup remove $DEV_NAME
|
|
|
|
case "$2" in
|
|
wipe)
|
|
remove_mapping
|
|
dd if=/dev/zero of=$IMG bs=1k count=10000 >/dev/null 2>&1
|
|
sync
|
|
losetup $LOOPDEV $IMG
|
|
;;
|
|
new)
|
|
remove_mapping
|
|
bzip2 -cd compatimage.img.bz2 > $IMG
|
|
# FIXME: switch to internal loop (no losetup at all)
|
|
echo "bad" | $CRYPTSETUP luksOpen --key-slot 0 --test-passphrase $IMG 2>&1 | \
|
|
grep "autoclear flag" && skip "WARNING: Too old kernel, test skipped."
|
|
losetup $LOOPDEV $IMG
|
|
bzip2 -cd compatv10image.img.bz2 > $IMG10
|
|
;;
|
|
reuse | *)
|
|
if [ ! -e $IMG ]; then
|
|
bzip2 -cd compatimage.img.bz2 > $IMG
|
|
losetup $LOOPDEV $IMG
|
|
fi
|
|
[ ! -e $IMG10 ] && bzip2 -cd compatv10image.img.bz2 > $IMG10
|
|
;;
|
|
esac
|
|
|
|
if [ ! -e $KEY1 ]; then
|
|
dd if=/dev/urandom of=$KEY1 count=1 bs=32 >/dev/null 2>&1
|
|
fi
|
|
|
|
if [ ! -e $KEY2 ]; then
|
|
dd if=/dev/urandom of=$KEY2 count=1 bs=16 >/dev/null 2>&1
|
|
fi
|
|
|
|
if [ ! -e $KEY5 ]; then
|
|
dd if=/dev/urandom of=$KEY5 count=1 bs=16 >/dev/null 2>&1
|
|
fi
|
|
|
|
if [ ! -e $KEYE ]; then
|
|
touch $KEYE
|
|
fi
|
|
|
|
cp $IMG $ORIG_IMG
|
|
[ -n "$1" ] && echo "CASE: $1"
|
|
}
|
|
|
|
function check()
|
|
{
|
|
sync
|
|
[ -z "$1" ] && return
|
|
./differ $ORIG_IMG $IMG $1 || fail
|
|
}
|
|
|
|
function check_exists()
|
|
{
|
|
[ -b /dev/mapper/$DEV_NAME ] || fail
|
|
check $1
|
|
}
|
|
|
|
function valgrind_setup()
|
|
{
|
|
which valgrind >/dev/null 2>&1 || fail "Cannot find valgrind."
|
|
[ ! -f $CRYPTSETUP_VALGRIND ] && fail "Unable to get location of cryptsetup executable."
|
|
export LD_LIBRARY_PATH="$CRYPTSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH"
|
|
}
|
|
|
|
function valgrind_run()
|
|
{
|
|
INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${CRYPTSETUP_VALGRIND} "$@"
|
|
}
|
|
|
|
[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
|
|
[ -z "$LOOPDEV" ] && skip "WARNING: Cannot find free loop device, test skipped."
|
|
|
|
[ -n "$VALG" ] && valgrind_setup && CRYPTSETUP=valgrind_run
|
|
|
|
# LUKS tests
|
|
|
|
prepare "[1] open - compat image - acceptance check" new
|
|
echo $PWD0 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
|
|
check_exists
|
|
ORG_SHA1=$(sha1sum -b /dev/mapper/$DEV_NAME | cut -f 1 -d' ')
|
|
[ "$ORG_SHA1" = 676062b66ebf36669dab705442ea0762dfc091b0 ] || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
# Check it can be opened from header backup as well
|
|
$CRYPTSETUP luksHeaderBackup $IMG --header-backup-file $HEADER_IMG || fail
|
|
echo $PWD0 | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME --header $HEADER_IMG || fail
|
|
check_exists
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
# Check restore
|
|
$CRYPTSETUP luksHeaderRestore -q $IMG --header-backup-file $HEADER_IMG || fail
|
|
|
|
# Repeat for V1.0 header - not aligned first keyslot
|
|
echo $PWD0 | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME || fail
|
|
check_exists
|
|
ORG_SHA1=$(sha1sum -b /dev/mapper/$DEV_NAME | cut -f 1 -d' ')
|
|
[ "$ORG_SHA1" = 51b48c2471a7593ceaf14dc5e66bca86ed05f6cc ] || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
rm -f $HEADER_IMG
|
|
$CRYPTSETUP luksHeaderBackup $IMG10 --header-backup-file $HEADER_IMG
|
|
echo $PWD0 | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME --header $HEADER_IMG || fail
|
|
check_exists
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
prepare "[2] open - compat image - denial check" new
|
|
echo $PWDW | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
echo $PWDW | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME 2>/dev/null && fail
|
|
check
|
|
|
|
# All headers items and first key material section must change
|
|
prepare "[3] format" wipe
|
|
echo $PWD1 | $CRYPTSETUP -i 1000 -c aes-cbc-essiv:sha256 -s 128 luksFormat $LOOPDEV || fail
|
|
check "$LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0"
|
|
|
|
prepare "[4] format using hash sha512" wipe
|
|
echo $PWD1 | $CRYPTSETUP -i 1000 -h sha512 -c aes-cbc-essiv:sha256 -s 128 luksFormat $LOOPDEV || fail
|
|
check "$LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0"
|
|
|
|
prepare "[5] open"
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME --test-passphrase || fail
|
|
echo $PWDW | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME --test-passphrase 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
|
|
check_exists
|
|
|
|
# Key Slot 1 and key material section 1 must change, the rest must not.
|
|
prepare "[6] add key"
|
|
echo -e "$PWD1\n$PWD2" | $CRYPTSETUP luksAddKey $LOOPDEV || fail
|
|
check "$KEY_SLOT1 $KEY_MATERIAL1"
|
|
echo $PWD2 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
|
|
|
|
# Unsuccessful Key Delete - nothing may change
|
|
prepare "[7] unsuccessful delete"
|
|
echo $PWDW | $CRYPTSETUP luksKillSlot $LOOPDEV 1 2>/dev/null && fail
|
|
$CRYPTSETUP -q luksKillSlot $LOOPDEV 8 2>/dev/null && fail
|
|
$CRYPTSETUP -q luksKillSlot $LOOPDEV 7 2>/dev/null && fail
|
|
check
|
|
|
|
# Delete Key Test
|
|
# Key Slot 1 and key material section 1 must change, the rest must not
|
|
prepare "[8] successful delete"
|
|
$CRYPTSETUP -q luksKillSlot $LOOPDEV 1 || fail
|
|
check "$KEY_SLOT1 $KEY_MATERIAL1_EXT"
|
|
echo $PWD2 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2> /dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
|
|
|
|
# Key Slot 1 and key material section 1 must change, the rest must not
|
|
prepare "[9] add key test for key files"
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $LOOPDEV $KEY1 || fail
|
|
check "$KEY_SLOT1 $KEY_MATERIAL1"
|
|
$CRYPTSETUP -d $KEY1 luksOpen $LOOPDEV $DEV_NAME || fail
|
|
|
|
# Key Slot 1 and key material section 1 must change, the rest must not
|
|
prepare "[10] delete key test with key1 as remaining key"
|
|
$CRYPTSETUP -d $KEY1 luksKillSlot $LOOPDEV 0 || fail
|
|
check "$KEY_SLOT0 $KEY_MATERIAL0_EXT"
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail
|
|
|
|
# Delete last slot
|
|
prepare "[11] delete last key" wipe
|
|
echo $PWD1 | $CRYPTSETUP luksFormat $LOOPDEV || fail
|
|
echo $PWD1 | $CRYPTSETUP luksKillSlot $LOOPDEV 0 || fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
|
|
# Format test for ESSIV, and some other parameters.
|
|
prepare "[12] parameter variation test" wipe
|
|
$CRYPTSETUP -q -i 1000 -c aes-cbc-essiv:sha256 -s 128 luksFormat $LOOPDEV $KEY1 || fail
|
|
check "$LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0"
|
|
$CRYPTSETUP -d $KEY1 luksOpen $LOOPDEV $DEV_NAME || fail
|
|
|
|
prepare "[13] open/close - stacked devices" wipe
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat $LOOPDEV || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat /dev/mapper/$DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksOpen /dev/mapper/$DEV_NAME $DEV_NAME2 || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME2 || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
prepare "[14] format/open - passphrase on stdin & new line" wipe
|
|
# stdin defined by "-" must take even newline
|
|
#echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksFormat $LOOPDEV - || fail
|
|
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q --key-file=- luksFormat $LOOPDEV || fail
|
|
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q --key-file=- luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
# now also try --key-file
|
|
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksFormat $LOOPDEV --key-file=- || fail
|
|
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q --key-file=- luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
# process newline if from stdin
|
|
echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksFormat $LOOPDEV || fail
|
|
echo "$PWD1" | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
prepare "[15] UUID - use and report provided UUID" wipe
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --uuid blah $LOOPDEV 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --uuid $TEST_UUID $LOOPDEV || fail
|
|
tst=$($CRYPTSETUP -q luksUUID $LOOPDEV)
|
|
[ "$tst"x = "$TEST_UUID"x ] || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat $LOOPDEV || fail
|
|
$CRYPTSETUP -q luksUUID --uuid $TEST_UUID $LOOPDEV || fail
|
|
tst=$($CRYPTSETUP -q luksUUID $LOOPDEV)
|
|
[ "$tst"x = "$TEST_UUID"x ] || fail
|
|
|
|
prepare "[16] luksFormat" wipe
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --master-key-file /dev/urandom $LOOPDEV || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --master-key-file /dev/urandom $LOOPDEV -d $KEY1 || fail
|
|
$CRYPTSETUP -q luksFormat --master-key-file /dev/urandom -s 256 --uuid $TEST_UUID $LOOPDEV $KEY1 || fail
|
|
$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
# open by UUID
|
|
force_uevent # some systems do not update loop by-uuid
|
|
$CRYPTSETUP luksOpen -d $KEY1 UUID=X$TEST_UUID $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP luksOpen -d $KEY1 UUID=$TEST_UUID $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
# empty keyfile
|
|
$CRYPTSETUP -q luksFormat $LOOPDEV $KEYE || fail
|
|
$CRYPTSETUP luksOpen -d $KEYE $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
# open by volume key
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat -s 256 --master-key-file $KEY1 $LOOPDEV || fail
|
|
$CRYPTSETUP luksOpen --master-key-file /dev/urandom $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP luksOpen --master-key-file $KEY1 $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
prepare "[17] AddKey volume key, passphrase and keyfile" wipe
|
|
# masterkey
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat $LOOPDEV --master-key-file /dev/zero --key-slot 3 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 3: ENABLED" || fail
|
|
echo $PWD2 | $CRYPTSETUP luksAddKey $LOOPDEV --master-key-file /dev/zero --key-slot 4 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 4: ENABLED" || fail
|
|
echo $PWD3 | $CRYPTSETUP luksAddKey $LOOPDEV --master-key-file /dev/null --key-slot 5 2>/dev/null && fail
|
|
# [0]PWD1 [1]PWD2 [2]$KEY1/1 [3]$KEY1 [4]$KEY2
|
|
$CRYPTSETUP -q luksFormat $LOOPDEV $KEY1 --key-slot 3 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 3: ENABLED" || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 --key-slot 3 2>/dev/null && fail
|
|
# keyfile/keyfile
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 --key-slot 4 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 4: ENABLED" || fail
|
|
# passphrase/keyfile
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 --key-slot 0 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 0: ENABLED" || fail
|
|
# passphrase/passphrase
|
|
echo -e "$PWD1\n$PWD2\n" | $CRYPTSETUP luksAddKey $LOOPDEV --key-slot 1 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: ENABLED" || fail
|
|
# keyfile/passphrase
|
|
echo -e "$PWD2\n" | $CRYPTSETUP luksAddKey $LOOPDEV $KEY1 --key-slot 2 --new-keyfile-size 1 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 2: ENABLED" || fail
|
|
|
|
prepare "[18] RemoveKey passphrase and keyfile" reuse
|
|
$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY1 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 3: DISABLED" || fail
|
|
$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY1 2>/dev/null && fail
|
|
$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 --keyfile-size 1 2>/dev/null && fail
|
|
$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 4: DISABLED" || fail
|
|
# kill slot using passphrase from 1
|
|
echo $PWD2 | $CRYPTSETUP luksKillSlot $LOOPDEV 2 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 2: DISABLED" || fail
|
|
# remove key0 / slot 0
|
|
echo $PWD1 | $CRYPTSETUP luksRemoveKey $LOOPDEV || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 0: DISABLED" || fail
|
|
# last keyslot, in batch mode no passphrase needed...
|
|
$CRYPTSETUP luksKillSlot -q $LOOPDEV 1 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: DISABLED" || fail
|
|
|
|
prepare "[19] create & status & resize" wipe
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash xxx 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --cipher aes-cbc-essiv:sha256 --offset 3 --skip 4 --readonly || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "offset:" | grep -q "3 sectors" || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "skipped:" | grep -q "4 sectors" || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "mode:" | grep -q "readonly" || fail
|
|
$CRYPTSETUP -q resize $DEV_NAME --size 100 || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail
|
|
$CRYPTSETUP -q resize $DEV_NAME || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "19997 sectors" || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
$CRYPTSETUP -q status $DEV_NAME >/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha1 $LOOPDEV || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP -q create $DEV_NAME --hash sha1 $LOOPDEV || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP -q create $DEV_NAME --hash sha1 --size 100 $LOOPDEV || fail
|
|
$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
# verify is ignored on non-tty input
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --verify-passphrase 2>/dev/null || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 --key-size 255 2>/dev/null && fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 --key-size -1 2>/dev/null && fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 -l -1 2>/dev/null && fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 || fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 2>/dev/null && fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d blah 2>/dev/null && fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d /dev/urandom || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
|
|
prepare "[20] Disallow open/create if already mapped." wipe
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 || fail
|
|
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 2>/dev/null && fail
|
|
$CRYPTSETUP create $DEV_NAME2 $LOOPDEV -d $KEY1 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat $LOOPDEV 2>/dev/null && fail
|
|
$CRYPTSETUP remove $DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat $LOOPDEV || fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME2 2>/dev/null && fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
|
|
prepare "[21] luksDump" wipe
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat --uuid $TEST_UUID $LOOPDEV $KEY1 || fail
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 0: ENABLED" || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q $TEST_UUID || fail
|
|
echo $PWDW | $CRYPTSETUP luksDump $LOOPDEV --dump-master-key 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP luksDump $LOOPDEV --dump-master-key | grep -q "MK dump:" || can_fail_fips
|
|
$CRYPTSETUP luksDump -q $LOOPDEV --dump-master-key -d $KEY1 | grep -q "MK dump:" || can_fail_fips
|
|
|
|
prepare "[22] remove disappeared device" wipe
|
|
dmsetup create $DEV_NAME --table "0 5000 linear $LOOPDEV 2" || fail
|
|
echo $PWD1 | $CRYPTSETUP -q -i 0 luksFormat /dev/mapper/$DEV_NAME || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksOpen /dev/mapper/$DEV_NAME $DEV_NAME2 || fail
|
|
# underlying device now returns error but node is still present
|
|
dmsetup load $DEV_NAME --table "0 5000 error" || fail
|
|
dmsetup resume $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME2 || fail
|
|
dmsetup remove $DEV_NAME || fail
|
|
|
|
prepare "[23] ChangeKey passphrase and keyfile" wipe
|
|
# [0]$KEY1 [1]key0
|
|
$CRYPTSETUP -q luksFormat $LOOPDEV $KEY1 --key-slot 0 || fail
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 --key-slot 1 || fail
|
|
# keyfile [0] / keyfile [0]
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 --key-slot 0 || fail
|
|
# passphrase [1] / passphrase [1]
|
|
echo -e "$PWD1\n$PWD2\n" | $CRYPTSETUP luksChangeKey $LOOPDEV --key-slot 1 || fail
|
|
# keyfile [0] / keyfile [new]
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY2 $KEY1 || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 0: DISABLED" || fail
|
|
# passphrase [1] / passphrase [new]
|
|
echo -e "$PWD2\n$PWD1\n" | $CRYPTSETUP luksChangeKey $LOOPDEV || fail
|
|
$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: DISABLED" || fail
|
|
# use all slots
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 -i 1 || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 -i 1 || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 -i 1 || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 -i 1 || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 -i 1 || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 -i 1 || fail
|
|
# still allows replace
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 || fail
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 2>/dev/null && fail
|
|
|
|
prepare "[24] Keyfile limit" wipe
|
|
$CRYPTSETUP -q luksFormat -i1 $LOOPDEV $KEY1 --key-slot 0 -l 13 || fail
|
|
$CRYPTSETUP --key-file=$KEY1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l 0 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l -1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l 14 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset -1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l 13 luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 2>/dev/null && fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 -l 14 2>/dev/null && fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 -l -1 2>/dev/null && fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 -i1 -l 13 --new-keyfile-size 12 || fail
|
|
$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 2>/dev/null && fail
|
|
$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 -l 12 || fail
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 2>/dev/null && fail
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 -l 14 2>/dev/null && fail
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 -i1 -l 13 || fail
|
|
# -l is ignored for stdin if _only_ passphrase is used
|
|
echo $PWD1 | $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY2 -i1 || fail
|
|
# this is stupid, but expected
|
|
echo $PWD1 | $CRYPTSETUP luksRemoveKey $LOOPDEV -l 11 2>/dev/null && fail
|
|
echo $PWDW"0" | $CRYPTSETUP luksRemoveKey $LOOPDEV -l 12 2>/dev/null && fail
|
|
echo -e "$PWD1\n" | $CRYPTSETUP luksRemoveKey $LOOPDEV -d- -l 12 || fail
|
|
# offset
|
|
$CRYPTSETUP -q luksFormat -i1 $LOOPDEV $KEY1 --key-slot 0 -l 13 --keyfile-offset 16 || fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 15 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 16 luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
$CRYPTSETUP luksAddKey $LOOPDEV -i1 -d $KEY1 -l 13 --keyfile-offset 16 $KEY2 --new-keyfile-offset 1 || fail
|
|
$CRYPTSETUP --key-file=$KEY2 --keyfile-offset 11 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP --key-file=$KEY2 --keyfile-offset 1 luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
$CRYPTSETUP luksChangeKey $LOOPDEV -i1 -d $KEY2 --keyfile-offset 1 $KEY2 --new-keyfile-offset 0 || fail
|
|
$CRYPTSETUP luksOpen -d $KEY2 $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
|
|
prepare "[25] Create shared segments" wipe
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --offset 0 --size 256 || fail
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME2 $LOOPDEV --hash sha1 --offset 512 --size 256 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME2 $LOOPDEV --hash sha1 --offset 512 --size 256 --shared || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME2 || fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
|
|
prepare "[26] Suspend/Resume" wipe
|
|
# only LUKS is supported
|
|
echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha1 $LOOPDEV || fail
|
|
$CRYPTSETUP luksSuspend $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP luksResume $DEV_NAME 2>/dev/null && fail
|
|
$CRYPTSETUP -q remove $DEV_NAME || fail
|
|
$CRYPTSETUP luksSuspend $DEV_NAME 2>/dev/null && fail
|
|
# LUKS
|
|
echo $PWD1 | $CRYPTSETUP -q luksFormat $LOOPDEV || fail
|
|
echo $PWD1 | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP luksSuspend $DEV_NAME || fail
|
|
$CRYPTSETUP -q resize $DEV_NAME 2>/dev/null && fail
|
|
echo $PWDW | $CRYPTSETUP luksResume $DEV_NAME -T 1 2>/dev/null && fail
|
|
echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME || fail
|
|
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
|
|
|
prepare "[27] luksOpen with specified key slot number" wipe
|
|
# first, let's try passphrase option
|
|
echo $PWD3 | $CRYPTSETUP luksFormat -S 5 $LOOPDEV || fail
|
|
check $LUKS_HEADER $KEY_SLOT5 $KEY_MATERIAL5
|
|
echo $PWD3 | $CRYPTSETUP luksOpen -S 4 $LOOPDEV $DEV_NAME && fail
|
|
[ -b /dev/mapper/$DEV_NAME ] && fail
|
|
echo $PWD3 | $CRYPTSETUP luksOpen -S 5 $LOOPDEV $DEV_NAME || fail
|
|
check_exists
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
echo -e "$PWD3\n$PWD1" | $CRYPTSETUP luksAddKey -S 0 $LOOPDEV || fail
|
|
check $LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0
|
|
echo $PWD3 | $CRYPTSETUP luksOpen -S 0 $LOOPDEV $DEV_NAME && fail
|
|
[ -b /dev/mapper/$DEV_NAME ] && fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen -S 5 $LOOPDEV $DEV_NAME && fail
|
|
[ -b /dev/mapper/$DEV_NAME ] && fail
|
|
# second, try it with keyfiles
|
|
$CRYPTSETUP luksFormat -q -S 5 -d $KEY5 $LOOPDEV || fail
|
|
check $LUKS_HEADER $KEY_SLOT5 $KEY_MATERIAL5
|
|
$CRYPTSETUP luksAddKey -S 1 -d $KEY5 $LOOPDEV $KEY1 || fail
|
|
check $LUKS_HEADER $KEY_SLOT1 $KEY_MATERIAL1
|
|
$CRYPTSETUP luksOpen -S 5 -d $KEY5 $LOOPDEV $DEV_NAME || fail
|
|
check_exists
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
$CRYPTSETUP luksOpen -S 1 -d $KEY5 $LOOPDEV $DEV_NAME && fail
|
|
[ -b /dev/mapper/$DEV_NAME ] && fail
|
|
$CRYPTSETUP luksOpen -S 5 -d $KEY1 $LOOPDEV $DEV_NAME && fail
|
|
[ -b /dev/mapper/$DEV_NAME ] && fail
|
|
|
|
prepare "[28] Detached LUKS header" wipe
|
|
dd if=/dev/zero of=$HEADER_IMG bs=1M count=4 >/dev/null 2>&1
|
|
echo $PWD1 | $CRYPTSETUP luksFormat -i1 $LOOPDEV --header $HEADER_IMG || fail
|
|
echo $PWD1 | $CRYPTSETUP luksFormat -i1 $LOOPDEV --header $HEADER_IMG --align-payload 1 >/dev/null 2>&1 && fail
|
|
echo $PWD1 | $CRYPTSETUP luksFormat -i1 $LOOPDEV --header $HEADER_IMG --align-payload 8192 || fail
|
|
echo $PWD1 | $CRYPTSETUP luksFormat -i1 $LOOPDEV --header $HEADER_IMG --align-payload 0 || fail
|
|
echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail
|
|
$CRYPTSETUP -q resize $DEV_NAME --size 100 --header $HEADER_IMG || fail
|
|
$CRYPTSETUP -q status $DEV_NAME --header $HEADER_IMG | grep "size:" | grep -q "100 sectors" || fail
|
|
$CRYPTSETUP luksSuspend $DEV_NAME --header $HEADER_IMG || fail
|
|
echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME --header $HEADER_IMG || fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
|
|
prepare "[29] Repair metadata" wipe
|
|
$CRYPTSETUP -q luksFormat -i1 $LOOPDEV $KEY1 --key-slot 0 || fail
|
|
# second sector overwrite should corrupt keyslot 6+7
|
|
dd if=/dev/urandom of=$LOOPDEV bs=512 seek=1 count=1 >/dev/null 2>&1
|
|
$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME >/dev/null 2>&1 && fail
|
|
$CRYPTSETUP -q repair $LOOPDEV >/dev/null 2>&1 || fail
|
|
$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail
|
|
$CRYPTSETUP luksClose $DEV_NAME || fail
|
|
|
|
remove_mapping
|
|
exit 0
|