3 CRYPTSETUP=../src/cryptsetup
8 ORIG_IMG=luks-test-orig
13 LUKS_HEADER="S0-5 S6-7 S8-39 S40-71 S72-103 S104-107 S108-111 R112-131 R132-163 S164-167 S168-207 A0-591"
14 KEY_SLOT0="S208-211 S212-215 R216-247 S248-251 S251-255"
15 KEY_MATERIAL0="R4096-68096"
16 KEY_MATERIAL0_EXT="R4096-68096"
18 KEY_SLOT1="S256-259 S260-263 R264-295 S296-299 S300-303"
19 KEY_MATERIAL1="R69632-133632"
20 KEY_MATERIAL1_EXT="S69632-133632"
22 function remove_mapping()
24 [ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove $DEV_NAME2
25 [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove $DEV_NAME
26 losetup -d $LOOPDEV >/dev/null 2>&1
27 rm -f $ORIG_IMG $IMG $IMG1 $KEY1 >/dev/null 2>&1
39 if [ $(id -u) != 0 ]; then
40 echo "WARNING: You must be root to run this test, test skipped."
44 [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove $DEV_NAME
46 if [ ! -e $KEY1 ]; then
47 dd if=/dev/urandom of=$KEY1 count=1 bs=32 >/dev/null 2>&1
50 if [ ! -e $IMG ]; then
51 bzip2 -cd compatimage.img.bz2 > $IMG
52 losetup -d $LOOPDEV >/dev/null 2>&1
58 [ -n "$1" ] && echo "CASE: $1"
64 ./fileDiffer.py $IMG $ORIG_IMG $1|| fail
67 function check_exists()
69 [ -b /dev/mapper/$DEV_NAME ] || fail
75 prepare "[1] open - compat image - acceptance check"
76 echo "compatkey" | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
79 prepare "[2] open - compat image - denial check"
80 echo "wrongkey" | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME && fail
83 # All headers items and first key material section must change
85 echo "key0" | $CRYPTSETUP -i 1000 -c aes-cbc-essiv:sha256 -s 128 luksFormat $LOOPDEV || fail
86 check "$LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0"
88 prepare "[4] format using hash sha512"
89 echo "key0" | $CRYPTSETUP -i 1000 -h sha512 -c aes-cbc-essiv:sha256 -s 128 luksFormat $LOOPDEV || fail
90 check "$LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0"
93 echo "key0" | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
96 # Key Slot 1 and key material section 1 must change, the rest must not.
98 echo -e "key0\nkey1" | $CRYPTSETUP luksAddKey $LOOPDEV || fail
99 check "$KEY_SLOT1 $KEY_MATERIAL1"
100 echo "key1" | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
102 # Unsuccessful Key Delete - nothing may change
103 prepare "[7] unsuccessful delete"
104 echo "invalid" | $CRYPTSETUP luksDelKey $LOOPDEV 1 && fail
108 # Key Slot 1 and key material section 1 must change, the rest must not
109 prepare "[8] successful delete"
110 $CRYPTSETUP -q luksDelKey $LOOPDEV 1 || fail
111 check "$KEY_SLOT1 $KEY_MATERIAL1_EXT"
112 echo "key1" | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME && fail
113 echo "key0" | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
115 # Key Slot 1 and key material section 1 must change, the rest must not
116 prepare "[9] add key test for key files"
117 echo "key0" | $CRYPTSETUP luksAddKey $LOOPDEV $KEY1 || fail
118 check "$KEY_SLOT1 $KEY_MATERIAL1"
119 $CRYPTSETUP -d $KEY1 luksOpen $LOOPDEV $DEV_NAME || fail
121 # Key Slot 1 and key material section 1 must change, the rest must not
122 prepare "[10] delete key test with key1 as remaining key"
123 $CRYPTSETUP -d $KEY1 luksDelKey $LOOPDEV 0 || fail
124 check "$KEY_SLOT0 $KEY_MATERIAL0_EXT"
125 echo "key0" | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME && fail
126 $CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail
129 prepare "[11] delete last key"
130 echo "key0" | $CRYPTSETUP luksFormat $LOOPDEV || fail
131 echo "key0" | $CRYPTSETUP luksKillSlot $LOOPDEV 0 || fail
132 echo "key0" | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME && fail
134 # Format test for ESSIV, and some other parameters.
135 prepare "[12] parameter variation test"
136 $CRYPTSETUP -q -i 1000 -c aes-cbc-essiv:sha256 -s 128 luksFormat $LOOPDEV $KEY1 || fail
137 check "$LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0"
138 $CRYPTSETUP -d $KEY1 luksOpen $LOOPDEV $DEV_NAME || fail
140 prepare "[13] open/close - stacked devices"
141 echo "key0" | $CRYPTSETUP -q luksFormat $LOOPDEV || fail
142 echo "key0" | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
143 echo "key0" | $CRYPTSETUP -q luksFormat /dev/mapper/$DEV_NAME || fail
144 echo "key0" | $CRYPTSETUP -q luksOpen /dev/mapper/$DEV_NAME $DEV_NAME2 || fail
145 $CRYPTSETUP -q luksClose $DEV_NAME2 || fail
146 $CRYPTSETUP -q luksClose $DEV_NAME || fail
148 prepare "[14] format/open - passphrase on stdin & new line"
149 # stdin defined by "-" must take even newline
150 echo -n $'foo\nbar' | $CRYPTSETUP -q luksFormat $LOOPDEV - || fail
151 echo -n $'foo\nbar' | $CRYPTSETUP -q --key-file=- luksOpen $LOOPDEV $DEV_NAME || fail
152 $CRYPTSETUP -q luksClose $DEV_NAME || fail
153 echo -n $'foo\nbar' | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME && fail
154 # now also try --key-file
155 echo -n $'foo\nbar' | $CRYPTSETUP -q luksFormat $LOOPDEV --key-file=- || fail
156 echo -n $'foo\nbar' | $CRYPTSETUP -q --key-file=- luksOpen $LOOPDEV $DEV_NAME || fail
157 $CRYPTSETUP -q luksClose $DEV_NAME || fail
158 # process newline if from stdin
159 echo -n $'foo\nbar' | $CRYPTSETUP -q luksFormat $LOOPDEV || fail
160 echo 'foo' | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
161 $CRYPTSETUP -q luksClose $DEV_NAME || fail