tests/integrity-compat-test

   1 #!/bin/bash
   2 #
   3 # Test integritysetup compatibility.
   4 #
   5 [ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".."
   6 INTSETUP=$CRYPTSETUP_PATH/integritysetup
   7
   8 INTSETUP_VALGRIND=../.libs/integritysetup
   9 INTSETUP_LIB_VALGRIND=../.libs
  10
  11 DEV_NAME=dmc_test
  12 DEV_NAME2=dmc_fake
  13 DEV_LOOP=""
  14 DEV=test123.img
  15 DEV2=test124.img
  16 KEY_FILE=key.img
  17 KEY_FILE2=key2.img
  18
  19 dmremove() { # device
  20         udevadm settle >/dev/null 2>&1
  21         dmsetup remove --retry $1 >/dev/null 2>&1
  22 }
  23
  24 cleanup() {
  25         [ -b /dev/mapper/$DEV_NAME ] && dmremove $DEV_NAME
  26         [ -b /dev/mapper/$DEV_NAME2 ] && dmremove $DEV_NAME2
  27         [ -n "$DEV_LOOP" ] && losetup -d "$DEV_LOOP"
  28         DEV_LOOP=""
  29         rm -f $DEV $DEV2 $KEY_FILE $KEY_FILE2 >/dev/null 2>&1
  30 }
  31
  32 fail()
  33 {
  34         [ -n "$1" ] && echo "$1"
  35         echo "FAILED backtrace:"
  36         while caller $frame; do ((frame++)); done
  37         cleanup
  38         exit 100
  39 }
  40
  41 skip()
  42 {
  43         [ -n "$1" ] && echo "$1"
  44         exit 77
  45 }
  46
  47 function dm_integrity_features()
  48 {
  49         VER_STR=$(dmsetup targets | grep integrity | cut -f2 -dv)
  50         [ -z "$VER_STR" ] && skip "Cannot find dm-integrity target, test skipped."
  51
  52         VER_MAJ=$(echo $VER_STR | cut -f 1 -d.)
  53         VER_MIN=$(echo $VER_STR | cut -f 2 -d.)
  54         VER_PTC=$(echo $VER_STR | cut -f 3 -d.)
  55
  56         [ $VER_MAJ -lt 1 ] && return
  57         [ $VER_MIN -gt 1 ] && {
  58                 DM_INTEGRITY_META=1
  59                 DM_INTEGRITY_RECALC=1
  60         }
  61         [ $VER_MIN -gt 2 ] && {
  62                 DM_INTEGRITY_BITMAP=1
  63         }
  64         [ $VER_MIN -gt 5 ] && {
  65                 DM_INTEGRITY_RESIZE_SUPPORTED=1
  66         }
  67         [ $VER_MIN -gt 6 ] && {
  68                 DM_INTEGRITY_HMAC_FIX=1
  69         }
  70         [ $VER_MIN -gt 7 ] && {
  71                 DM_INTEGRITY_RESET=1
  72         }
  73 }
  74
  75 add_device() {
  76         cleanup
  77         dd if=/dev/urandom of=$KEY_FILE bs=4096 count=1 >/dev/null 2>&1
  78         dd if=/dev/urandom of=$KEY_FILE2 bs=1 count=32 >/dev/null 2>&1
  79         dd if=/dev/zero of=$DEV bs=1M count=32 >/dev/null 2>&1
  80         dd if=/dev/zero of=$DEV2 bs=1M count=32 >/dev/null 2>&1
  81         sync
  82 }
  83
  84 status_check() # name value
  85 {
  86         X=$($INTSETUP status $DEV_NAME | grep "$1" | sed 's/.*: //' | sed 's/^[[:space:]]*//')
  87         if [ "$X" != "$2" ] ; then
  88                 echo "[status FAIL]"
  89                 echo " Expecting $1:$2 got \"$X\"."
  90                 fail
  91         fi
  92 }
  93
  94 dump_check() # name value
  95 {
  96         X=$($INTSETUP dump $DEV | grep "$1" | cut -d' '  -f 2)
  97         if [ "$X" != "$2" ] ; then
  98                 echo "[dump FAIL]"
  99                 echo " Expecting $1:$2 got \"$X\"."
 100                 fail
 101         fi
 102 }
 103
 104 kernel_param_check() # number value
 105 {
 106         X=$(dmsetup table $DEV_NAME | cut -d " " -f $1)
 107         if [ "$X" != $2 ] ; then
 108                 echo "[param_check FAIL]"
 109                 echo "Expecting $2 got \"$X\"."
 110                 fail
 111         fi
 112 }
 113
 114 function valgrind_setup()
 115 {
 116         command -v valgrind >/dev/null || fail "Cannot find valgrind."
 117         [ ! -f $INTSETUP_VALGRIND ] && fail "Unable to get location of cryptsetup executable."
 118         export LD_LIBRARY_PATH="$INTSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH"
 119 }
 120
 121 function valgrind_run()
 122 {
 123         INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${INTSETUP_VALGRIND} "$@"
 124 }
 125
 126 int_check_sum_only() # checksum
 127 {
 128         VSUM=$(sha256sum /dev/mapper/$DEV_NAME | cut -d' ' -f 1)
 129         if [ "$VSUM" = "$1" ] ; then
 130                 echo -n "[CHECKSUM OK]"
 131         else
 132                 echo "[FAIL]"
 133                 echo " Expecting $1 got $VSUM."
 134                 fail
 135         fi
 136 }
 137
 138 int_check_sum() # alg checksum [keyfile keysize]
 139 {
 140         if [ -n "$4" ] ; then
 141                 KEY_PARAMS="--integrity-key-file $3 --integrity-key-size $4"
 142         else
 143                 KEY_PARAMS=""
 144         fi
 145
 146         # Fill device with zeroes and reopen it
 147         dd if=/dev/zero of=/dev/mapper/$DEV_NAME bs=1M oflag=direct >/dev/null 2>&1
 148         dmremove $DEV_NAME
 149
 150         $INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS || fail "Cannot activate device."
 151
 152         int_check_sum_only $2
 153 }
 154
 155 intformat() # alg alg_out tagsize outtagsize sector_size csum [keyfile keysize]
 156 {
 157         if [ -n "$8" ] ; then
 158                 KEY_PARAMS="--integrity-key-file $7 --integrity-key-size $8"
 159         else
 160                 KEY_PARAMS=""
 161         fi
 162
 163         if [ $3 -ne 0 ] ; then
 164                 TAG_PARAMS="--tag-size $3"
 165         else
 166                 TAG_PARAMS=""
 167         fi
 168
 169         echo -n "[INTEGRITY:$2:$4:$5]"
 170         [ -n "$8" ] && echo -n "[KEYFILE:$8]"
 171         echo -n "[FORMAT]"
 172         $INTSETUP format --integrity-legacy-padding -q --integrity $1 $TAG_PARAMS --sector-size $5 $KEY_PARAMS $DEV >/dev/null 2>&1
 173         if [ $? -ne 0 ] ; then
 174                 if [[ $1 =~ "sha2" || $1 =~ "crc" ]] ; then
 175                         fail "Cannot format device."
 176                 fi
 177                 echo "[N/A]"
 178                 return
 179         fi
 180
 181         dump_check "tag_size" $4
 182         dump_check "sector_size" $5
 183         echo -n "[ACTIVATE]"
 184         $INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS || fail "Cannot activate device."
 185         if [ -n "$8" ]; then
 186                 KEY_HEX=$(xxd -c 4096 -l $8 -p $7)
 187                 [ -z "$KEY_HEX" ] && fail "Cannot decode key."
 188                 dmsetup table --showkeys $DEV_NAME | grep -q $KEY_HEX || fail "Key mismatch."
 189         fi
 190         status_check "tag size" $4
 191         status_check "integrity" $2
 192         status_check "sector size" "$5 bytes"
 193         int_check_sum $1 $6 $7 $8
 194         echo -n "[REMOVE]"
 195         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 196         echo "[OK]"
 197 }
 198
 199 int_error_detection() # mode alg tagsize outtagsize sector_size key_file key_size
 200 {
 201         if [ "$1" == "B" ] ; then
 202                 INT_MODE="-B"
 203         else
 204                 INT_MODE=""
 205         fi
 206         if [ -n "$7" ] ; then
 207                 KEY_PARAMS="--integrity-key-file $6 --integrity-key-size $7"
 208         else
 209                 KEY_PARAMS=""
 210         fi
 211         if [ $3 -ne 0 ] ; then
 212                 TAG_PARAMS="--tag-size $3"
 213         else
 214                 TAG_PARAMS=""
 215         fi
 216         dd if=/dev/zero of=$DEV bs=1M count=32 >/dev/null 2>&1
 217
 218         echo -n "[INTEGRITY:$1:$2:$4:$5]"
 219         echo -n "[FORMAT]"
 220         $INTSETUP format -q --integrity $2 $TAG_PARAMS --sector-size $5 $KEY_PARAMS $DEV $INT_MODE >/dev/null 2>&1
 221         if [ $? -ne 0 ] ; then
 222                 if [[ $2 =~ "sha2" || $2 =~ "crc" ]] ; then
 223                         fail "Cannot format device."
 224                 fi
 225                 echo "[N/A]"
 226                 return
 227         fi
 228         echo -n "[ACTIVATE]"
 229         $INTSETUP open $DEV $DEV_NAME --integrity $2 --integrity-no-journal $KEY_PARAMS $INT_MODE || fail "Cannot activate device."
 230
 231         if [ -n "$6" -a -n "$7" ]; then
 232                 echo -n "[KEYED HASH]"
 233                 KEY_HEX=$(xxd -c 256 -l $7 -p $6)
 234                 [ -z "$KEY_HEX" ] && fail "Cannot decode key."
 235                 dmsetup table --showkeys $DEV_NAME | grep -q $KEY_HEX || fail "Key mismatch."
 236         fi
 237
 238         echo -n "[WRITE DATA]"
 239         echo -n "EXAMPLE TEXT" | dd of=/dev/mapper/$DEV_NAME >/dev/null 2>&1 || fail "Cannot write to device."
 240         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 241
 242         # find offset of data area
 243         ARR=($(dd if=$DEV bs=512 2>/dev/null | hexdump -C | grep 'EXAMPLE TEXT'))
 244         OFF_HEX=${ARR[0]}
 245         OFF_DEC=$((16#$OFF_HEX))
 246
 247         echo -n "[CORRUPT DATA:$OFF_DEC]"
 248         echo -n "Z" | dd of=$DEV bs=1 seek=$OFF_DEC conv=notrunc >/dev/null 2>&1 || fail "Cannot write to device."
 249
 250         echo -n "[DETECT ERROR]"
 251         $INTSETUP open $DEV $DEV_NAME --integrity $2 $KEY_PARAMS $INT_MODE || fail "Cannot activate device."
 252         dd if=/dev/mapper/$DEV_NAME  >/dev/null 2>&1 && fail "Error detection failed."
 253         echo -n "[REMOVE]"
 254         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 255         echo "[OK]"
 256 }
 257
 258 int_journal() # 1 alg, 2 tagsize, 3 sector_size, 4 watermark, 5 commit_time, 6 journal_integrity, 7 key-file, 8 key-size, 9 journal_integrity_out
 259 {
 260         echo -n "[INTEGRITY JOURNAL:$6:${4}%:${5}ms:$8]"
 261         echo -n "[FORMAT]"
 262         ARGS="--integrity $1 --journal-watermark $4 --journal-commit-time $5 --journal-integrity $6 --journal-integrity-key-file $7 --journal-integrity-key-size $8"
 263         $INTSETUP format -q --tag-size $2 --sector-size $3 $ARGS $DEV || fail "Cannot format device."
 264
 265         echo -n "[ACTIVATE]"
 266
 267         $INTSETUP open $DEV $DEV_NAME $ARGS || fail "Cannot activate device."
 268
 269         echo -n "[KEYED HASH]"
 270         KEY_HEX=$(xxd -c 4096 -l $8 -p $7)
 271         [ -z "$KEY_HEX" ] && fail "Cannot decode key."
 272         dmsetup table --showkeys $DEV_NAME | grep -q $KEY_HEX || fail "Key mismatch."
 273
 274         status_check "journal watermark" "${4}%"
 275         status_check "journal commit time" "${5} ms"
 276         status_check "journal integrity MAC" $9
 277
 278         echo -n "[REMOVE]"
 279         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 280         echo "[OK]"
 281 }
 282
 283
 284 int_journal_crypt() # crypt_alg crypt_alg_kernel crypt_key crypt_key_size
 285 {
 286         echo -n "[JOURNAL CRYPT:$1:${4}B]"
 287
 288         echo -n "[FORMAT]"
 289         ARGS="--journal-crypt $1 --journal-crypt-key-file $3 --journal-crypt-key-size $4"
 290         $INTSETUP format -q $ARGS $DEV || fail "Cannot format device."
 291
 292         echo -n "[ACTIVATE]"
 293         $INTSETUP open $DEV $DEV_NAME $ARGS || fail "Cannot activate device."
 294
 295         KEY_HEX=$(xxd -c 256 -l $4 -p $3)
 296         [ -z "$KEY_HEX" ] && fail "Cannot decode key."
 297         dmsetup table --showkeys $DEV_NAME | grep -q "journal_crypt:$2:$KEY_HEX" || fail "Key mismatch."
 298
 299         $INTSETUP close $DEV_NAME
 300         echo "[OK]"
 301 }
 302
 303 int_mode() # alg tag_size sector_size [keyfile keysize]
 304 {
 305         if [ -n "$5" ] ; then
 306                 KEY_PARAMS="--integrity-key-file $4 --integrity-key-size $5"
 307         else
 308                 KEY_PARAMS=""
 309         fi
 310
 311         echo -n "[MODE TESTS:$1:$2:$3]"
 312         ARGS="--tag-size $2 --sector-size $3"
 313
 314         $INTSETUP format -q $ARGS $KEY_PARAMS $DEV --integrity $1 || fail "Cannot format device."
 315
 316         echo -n "[JOURNALED WRITES]"
 317         $INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS || fail "Cannot activate device with journal."
 318         status_check "mode" "read/write"
 319         kernel_param_check 7 "J"
 320
 321         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 322
 323         echo -n "[DIRECT WRITES]"
 324         $INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS --integrity-no-journal || fail "Cannot activate device without journal."
 325         status_check "mode" "read/write"
 326         status_check "journal" "not active"
 327         kernel_param_check 7 "D"
 328
 329         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 330
 331         echo -n "[RECOVERY MODE]"
 332         $INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS --integrity-recovery-mode || fail "Cannot activate device in recovery mode."
 333         status_check "mode" "read/write recovery"
 334         kernel_param_check 7 "R"
 335
 336         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 337
 338         echo "[OK]"
 339 }
 340
 341 check_device_size() # device_name expected_size error_message
 342 {
 343         CURRENT_SIZE=$(dmsetup table | grep $1 | cut -d' ' -f 3)
 344         [ $CURRENT_SIZE -eq $2 ] || fail "$3: expected $1 to be of size $2, but is $CURRENT_SIZE"
 345 }
 346
 347 test_resize() # description detached_metadata wipe args
 348 {
 349         echo -n "$1"
 350         if [ -z "$DM_INTEGRITY_RESIZE_SUPPORTED" ] ; then
 351                 echo "[N/A]"
 352                 return
 353         fi
 354
 355         args="$4"
 356         if [ $2 -ne 0 ] ; then
 357                 echo -n "[DETACHED]"
 358         else
 359                 echo -n "[INTERLEAVE]"
 360         fi
 361         if [ $3 -ne 0 ] ; then
 362                 wipe_flag="--wipe"
 363                 echo -n "[WIPE]"
 364         else
 365                 wipe_flag=""
 366                 echo -n "[RECALCULATE]"
 367         fi
 368
 369         add_device
 370         if [ $2 -ne 0 ] ; then
 371                 echo -n "[FORMAT]"
 372                 $INTSETUP format -q $args $DEV2 --data-device $DEV  >/dev/null 2>&1 || fail "Cannot format device."
 373                 echo -n "[ACTIVATE]"
 374                 $INTSETUP open -q $args $DEV2 $DEV_NAME --data-device $DEV  >/dev/null 2>&1 || fail "Cannot activate device."
 375         else
 376                 echo -n "[FORMAT]"
 377                 $INTSETUP format -q $args $DEV  >/dev/null 2>&1 || fail "Cannot format device."
 378                 echo -n "[ACTIVATE]"
 379                 $INTSETUP open -q $args $DEV $DEV_NAME  >/dev/null 2>&1 || fail "Cannot activate device."
 380         fi
 381
 382         if [ $2 -ne 0 ] ; then
 383                 # the whole device has 32MiB, if metadata is detached
 384                 WHOLE_DISK_SIZE=65536
 385         else
 386                 WHOLE_DISK_SIZE=$(dmsetup table | grep $DEV_NAME | cut -d' ' -f 3)
 387         fi
 388
 389         echo -n "[SHRINK]"
 390         $INTSETUP resize -q $wipe_flag $DEV_NAME --device-size 1MiB || fail "Failed to resize the device to 1MiB."
 391         dd if=/dev/mapper/$DEV_NAME >/dev/null 2>&1 || fail "Errors detected after shrink."
 392         check_device_size $DEV_NAME $(( 1024*1024 / 512 )) "Shrinking device failed"
 393
 394         echo -n "[FILL]"
 395         $INTSETUP resize -q $wipe_flag $DEV_NAME --device-size 0 || fail "Failed to resize the device to maximum size."
 396         dd if=/dev/mapper/$DEV_NAME >/dev/null 2>&1 || fail "Errors detected after resize to maximum size."
 397         check_device_size $DEV_NAME $WHOLE_DISK_SIZE "Resizing disk to maximum size failed"
 398
 399         echo -n "[EXPAND FIXED]"
 400         fallocate $DEV --len 64M
 401         $INTSETUP resize -q $wipe_flag $DEV_NAME --device-size 40MiB || fail "Failed to expand the device to a fixed size."
 402         dd if=/dev/mapper/$DEV_NAME >/dev/null 2>&1 || fail "Errors detected after expanding to a fixed size."
 403         check_device_size $DEV_NAME $(( 40*1024*1024 / 512 )) "Resizing disk after expanding to a fixed size failed"
 404
 405         echo -n "[FILL]"
 406         $INTSETUP resize -q $wipe_flag $DEV_NAME --device-size 0 >/dev/null 2>&1 || fail "Failed to resize the device to maximum size after increasing image size."
 407         dd if=/dev/mapper/$DEV_NAME >/dev/null 2>&1 || fail "Error detection failed after increasing image size."
 408         CURRENT_SIZE=$(dmsetup table | grep $DEV_NAME | cut -d' ' -f 3)
 409         [ $CURRENT_SIZE -ge $(( 40*1024*1024 / 512 )) ] || fail "Growing integrity device failed $CURRENT_SIZE is not greater than 40MB ($(( 40*1024*1024 / 512 )) blocks)."
 410         if [ $2 -ne 0 ] ; then
 411                 [ $CURRENT_SIZE -eq 131072 ] || fail "Growing integrity device failed $CURRENT_SIZE is not equal to 64MB (131072 blocks)."
 412         fi
 413
 414         echo -n "[REMOVE]"
 415         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 416         echo "[OK]"
 417 }
 418
 419 [ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
 420 [ ! -x "$INTSETUP" ] && skip "Cannot find $INTSETUP, test skipped."
 421 command -v blockdev >/dev/null || skip "Cannot find blockdev utility, test skipped."
 422
 423 [ -n "$VALG" ] && valgrind_setup && INTSETUP=valgrind_run
 424 command -v hexdump >/dev/null || skip "WARNING: hexdump tool required."
 425 command -v xxd >/dev/null || skip "WARNING: xxd tool required."
 426 modprobe dm-integrity >/dev/null 2>&1
 427 dm_integrity_features
 428
 429 add_device
 430 intformat blake2s-256 blake2s-256    32 32  512 8e5fe4119558e117bfc40e3b0f13ade3abe497b52604d4c7cca0cfd6c7f4cf11
 431 intformat blake2b-256 blake2b-256    32 32  512 8e5fe4119558e117bfc40e3b0f13ade3abe497b52604d4c7cca0cfd6c7f4cf11
 432 intformat crc32c      crc32c          0  4  512 08f63eb27fb9ce2ce903b0a56429c68ce5e209253ba42154841ef045a53839d7
 433 intformat crc32       crc32           0  4  512 08f63eb27fb9ce2ce903b0a56429c68ce5e209253ba42154841ef045a53839d7
 434 intformat xxhash64    xxhash64        0  8  512 6ff6bb889a8485f1fb26aa82671ff5da64f60381fc469e31d7be6094241eee09
 435 intformat sha1        sha1            0 20  512 6eedd6344dab8875cd185fcd6565dfc869ab36bc57e577f40c685290b1fa7fe7
 436 intformat sha1        sha1           16 16 4096 e152ec88227b539cd9cafd8bdb587a1072d720cd6bcebe1398d4136c9e7f337b
 437 intformat sha256      sha256          0 32  512 8e5fe4119558e117bfc40e3b0f13ade3abe497b52604d4c7cca0cfd6c7f4cf11
 438 intformat hmac-sha256 hmac\(sha256\)  0 32  512 8e5fe4119558e117bfc40e3b0f13ade3abe497b52604d4c7cca0cfd6c7f4cf11 $KEY_FILE 32
 439 intformat sha256      sha256          0 32 4096 33f7dfa5163ca9f740383fb8b0919574e38a7b20a94a4170fde4238196b7c4b4
 440 intformat hmac-sha256 hmac\(sha256\)  0 32 4096 33f7dfa5163ca9f740383fb8b0919574e38a7b20a94a4170fde4238196b7c4b4 $KEY_FILE 32
 441 intformat hmac-sha256 hmac\(sha256\)  0 32 4096 33f7dfa5163ca9f740383fb8b0919574e38a7b20a94a4170fde4238196b7c4b4 $KEY_FILE 4096
 442
 443 echo "Error detection tests:"
 444 int_error_detection J crc32c   0  4  512
 445 int_error_detection J crc32c   0  4 4096
 446 int_error_detection J crc32    0  4  512
 447 int_error_detection J crc32    0  4 4096
 448 int_error_detection J xxhash64 0  8  512
 449 int_error_detection J xxhash64 0  8 4096
 450 int_error_detection J sha1     0 20  512
 451 int_error_detection J sha1    16 16  512
 452 int_error_detection J sha1     0 20 4096
 453 int_error_detection J sha256   0 32  512
 454 int_error_detection J sha256   0 32 4096
 455
 456 command -v xxd >/dev/null || skip "WARNING: xxd tool required."
 457 int_error_detection J hmac-sha256  0 32 512 $KEY_FILE 32
 458 int_error_detection J hmac-sha256  0 32 4096 $KEY_FILE 32
 459
 460 echo "Journal parameters tests:"
 461 # Watermark is calculated in kernel, so it can be rounded down/up
 462 int_journal crc32  4  512  66 1000 hmac-sha256 $KEY_FILE 32 hmac\(sha256\)
 463 int_journal sha256 32 4096 34 5000 hmac-sha1   $KEY_FILE 16 hmac\(sha1\)
 464 int_journal sha1   20 512  75 9999 hmac-sha256 $KEY_FILE 32 hmac\(sha256\)
 465 int_journal sha1   20 512  75 9999 hmac-sha256 $KEY_FILE 4096 hmac\(sha256\)
 466
 467 echo "Journal encryption tests:"
 468 int_journal_crypt cbc-aes cbc\(aes\) $KEY_FILE 32
 469 int_journal_crypt cbc-aes cbc\(aes\) $KEY_FILE 16
 470 int_journal_crypt ctr-aes ctr\(aes\) $KEY_FILE 32
 471 int_journal_crypt ctr-aes ctr\(aes\) $KEY_FILE 16
 472
 473 echo "Mode tests:"
 474 int_mode crc32c      4  512
 475 int_mode crc32       4  512
 476 int_mode sha1        20 512
 477 int_mode sha256      32 512
 478 int_mode hmac-sha256 32 512  $KEY_FILE 32
 479 int_mode hmac-sha256 32 4096 $KEY_FILE 32
 480
 481 echo -n "Recalculate tags in-kernel:"
 482 add_device
 483 if [ -n "$DM_INTEGRITY_RECALC" ] ; then
 484         $INTSETUP format -q $DEV --no-wipe || fail "Cannot format device."
 485         $INTSETUP open $DEV $DEV_NAME --integrity-recalculate || fail "Cannot activate device."
 486         dd if=/dev/mapper/$DEV_NAME of=/dev/null bs=1M 2>/dev/null || fail "Cannot recalculate tags in-kernel"
 487         int_check_sum_only 08f63eb27fb9ce2ce903b0a56429c68ce5e209253ba42154841ef045a53839d7
 488         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 489         echo -n "[OK]"
 490         if [ -n "$DM_INTEGRITY_RESET" ] ; then
 491                 $INTSETUP open $DEV $DEV_NAME -I sha256 --integrity-recalculate-reset || fail "Cannot activate device."
 492                 dd if=/dev/mapper/$DEV_NAME of=/dev/null bs=1M 2>/dev/null || fail "Cannot reset recalculate tags in-kernel"
 493                 int_check_sum_only 08f63eb27fb9ce2ce903b0a56429c68ce5e209253ba42154841ef045a53839d7
 494                 $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 495                 echo "[RESET OK]"
 496         else
 497                 echo "[RESET N/A]"
 498         fi
 499 else
 500         echo "[N/A]"
 501 fi
 502
 503 echo -n "Separate metadata device:"
 504 if [ -n "$DM_INTEGRITY_META" ] ; then
 505         add_device
 506         $INTSETUP format -q $DEV --data-device $DEV2 || fail "Cannot format device."
 507         $INTSETUP open $DEV --data-device $DEV2 $DEV_NAME || fail "Cannot activate device."
 508         int_check_sum_only 83ee47245398adee79bd9c0a8bc57b821e92aba10f5f9ade8a5d1fae4d8c4302
 509         $INTSETUP status $DEV_NAME | grep -q 'metadata device:' || fail
 510         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 511         echo "[OK]"
 512 else
 513         echo "[N/A]"
 514 fi
 515
 516 echo -n "Bitmap mode parameters:"
 517 if [ -n "$DM_INTEGRITY_BITMAP" ] ; then
 518         add_device
 519         $INTSETUP format -q $DEV --integrity-bitmap-mode $DEV2 || fail "Cannot format device."
 520         $INTSETUP open $DEV --integrity-bitmap-mode --bitmap-sectors-per-bit 65536 --bitmap-flush-time 5000 $DEV_NAME || fail "Cannot activate device."
 521         $INTSETUP status $DEV_NAME | grep -q 'bitmap 512-byte sectors per bit: 65536' || fail
 522         $INTSETUP status $DEV_NAME | grep -q 'bitmap flush interval: 5000 ms' || fail
 523         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 524         echo "[OK]"
 525         echo "Bitmap error detection tests:"
 526         int_error_detection B crc32c      0  4 512
 527         int_error_detection B crc32c      0  4 4096
 528         int_error_detection B sha256      0 32 512
 529         int_error_detection B sha256      0 32 4096
 530         int_error_detection B hmac-sha256 0 32 512 $KEY_FILE 32
 531         int_error_detection B hmac-sha256 0 32 4096 $KEY_FILE 32
 532 else
 533         echo "[N/A]"
 534 fi
 535
 536 echo -n "Big device:"
 537 add_device
 538 DEV_LOOP=$(losetup -f $DEV --show)
 539 if [ -n "$DEV_LOOP" ] ; then
 540 dmsetup create $DEV_NAME2 <<EOF
 541 0 16284 linear $DEV_LOOP 0
 542 16284 80000000000 zero
 543 EOF
 544         [ ! -b /dev/mapper/$DEV_NAME2 ] && fail
 545         $INTSETUP format -q -s 512 --no-wipe /dev/mapper/$DEV_NAME2
 546         $INTSETUP open /dev/mapper/$DEV_NAME2 $DEV_NAME || fail
 547         D_SIZE=$($INTSETUP dump /dev/mapper/$DEV_NAME2 | grep provided_data_sectors | sed -e 's/.*provided_data_sectors\ \+//g')
 548         A_SIZE=$(blockdev --getsz /dev/mapper/$DEV_NAME)
 549         # Compare strings (to avoid 64bit integers), not integers
 550         [ -n "$A_SIZE" -a "$D_SIZE" != "$A_SIZE" ] && fail
 551         echo "[OK]"
 552 else
 553         echo "[N/A]"
 554 fi
 555
 556 echo -n "Deferred removal of device:"
 557 add_device
 558 $INTSETUP format -q $DEV || fail "Cannot format device."
 559 $INTSETUP open $DEV $DEV_NAME || fail "Cannot activate device."
 560 dmsetup create $DEV_NAME2 --table "0 8 linear /dev/mapper/$DEV_NAME 0"
 561 [ ! -b /dev/mapper/$DEV_NAME2 ] && fail
 562 $INTSETUP close $DEV_NAME >/dev/null 2>&1 && fail
 563 $INTSETUP -q status $DEV_NAME >/dev/null 2>&1 || fail
 564 $INTSETUP close --deferred $DEV_NAME >/dev/null 2>&1
 565 if [ $? -eq 0 ] ; then
 566         dmsetup info $DEV_NAME | grep -q "DEFERRED REMOVE" || fail
 567         $INTSETUP close --cancel-deferred $DEV_NAME >/dev/null 2>&1
 568         dmsetup info $DEV_NAME | grep -q "DEFERRED REMOVE" >/dev/null 2>&1 && fail
 569         $INTSETUP close --deferred $DEV_NAME >/dev/null 2>&1
 570         dmsetup remove $DEV_NAME2 || fail
 571         $INTSETUP -q status $DEV_NAME >/dev/null 2>&1 && fail
 572         echo "[OK]"
 573 else
 574         dmsetup remove $DEV_NAME2 >/dev/null 2>&1
 575         $INTSETUP close $DEV_NAME >/dev/null 2>&1
 576         echo "[N/A]"
 577 fi
 578
 579 echo -n "Fixed HMAC and legacy flags:"
 580 if [ -n "$DM_INTEGRITY_HMAC_FIX" ] ; then
 581         add_device
 582         # only data HMAC
 583         ARGS="--integrity hmac-sha256 --integrity-key-file $KEY_FILE --integrity-key-size 32"
 584         $INTSETUP format -q $DEV --integrity-legacy-hmac --no-wipe --tag-size 32 $ARGS || fail "Cannot format device."
 585         $INTSETUP open $DEV $DEV_NAME --integrity-recalculate $ARGS >/dev/null 2>&1 && fail "Cannot activate device."
 586         $INTSETUP open $DEV $DEV_NAME --integrity-legacy-recalculate $ARGS || fail "Cannot activate device."
 587         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 588         # New version - must fail (no journal HMAC)
 589         $INTSETUP format -q $DEV --no-wipe --tag-size 32 $ARGS || fail "Cannot format device."
 590         $INTSETUP open $DEV $DEV_NAME --integrity-recalculate $ARGS  >/dev/null 2>&1 && fail "Cannot activate device."
 591         $INTSETUP open $DEV $DEV_NAME --integrity-legacy-recalculate $ARGS || fail "Cannot activate device."
 592         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 593
 594         # data and journal HMAC
 595         ARGS="$ARGS --journal-integrity hmac-sha256 --journal-integrity-key-file $KEY_FILE2 --journal-integrity-key-size 32"
 596         $INTSETUP format -q $DEV --integrity-legacy-hmac --no-wipe --tag-size 32 $ARGS || fail "Cannot format device."
 597         $INTSETUP open $DEV $DEV_NAME --integrity-recalculate $ARGS >/dev/null 2>&1 && fail "Cannot activate device."
 598         $INTSETUP open $DEV $DEV_NAME --integrity-legacy-recalculate $ARGS || fail "Cannot activate device."
 599         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 600         # New fixed version
 601         $INTSETUP format -q $DEV --no-wipe --tag-size 32 $ARGS || fail "Cannot format device."
 602         $INTSETUP dump $DEV | grep "flags" | grep -q "fix_hmac" || fail "Flag for HMAC not set."
 603         $INTSETUP open $DEV $DEV_NAME --integrity-recalculate $ARGS || fail "Cannot activate device."
 604         $INTSETUP close $DEV_NAME || fail "Cannot deactivate device."
 605         echo "[OK]"
 606 else
 607         echo "[N/A]"
 608 fi
 609
 610 # shrinking the mapping should also work on older kernels
 611 echo -n "[INTEGRITY BASIC RESIZE NOKEY]"
 612 add_device
 613 ARGS="--integrity crc32"
 614
 615 echo -n "[FORMAT]"
 616 $INTSETUP format -q $DEV $ARGS || fail "Cannot format device."
 617 echo -n "[ACTIVATE]"
 618 $INTSETUP open -q $DEV $DEV_NAME $ARGS >/dev/null 2>&1 || fail "Cannot activate device."
 619 echo -n "[SHRINK]"
 620 $INTSETUP resize $DEV_NAME --device-size 1MiB  >/dev/null 2>&1 || fail "Failed to resize the device to 1MiB."
 621 check_device_size $DEV_NAME $(( 1024*1024 / 512 )) "Shrinking device failed"
 622 dd if=/dev/mapper/$DEV_NAME >/dev/null 2>&1 || fail "Errors detectied after resize."
 623 echo "[OK]"
 624
 625 echo -n "[INTEGRITY BASIC RESIZE KEY]"
 626 add_device
 627
 628 ARGS="--integrity hmac-sha256 --integrity-key-size 128 --integrity-key-file $KEY_FILE --journal-integrity hmac-sha256 --journal-integrity-key-file $KEY_FILE --journal-integrity-key-size 128 --journal-crypt ctr-aes --journal-crypt-key-size 16 --journal-crypt-key-file $KEY_FILE"
 629
 630 echo -n "[FORMAT]"
 631 $INTSETUP format -q $DEV $ARGS || fail "Cannot format device."
 632 echo -n "[ACTIVATE]"
 633 $INTSETUP open -q $DEV $DEV_NAME $ARGS >/dev/null 2>&1 || fail "Cannot activate device."
 634 echo -n "[SHRINK]"
 635 $INTSETUP resize $DEV_NAME --device-size 1MiB >/dev/null 2>&1 || fail "Failed to resize the device to 1MiB."
 636 check_device_size $DEV_NAME $(( 1024*1024 / 512 )) "Shrinking device failed"
 637 dd if=/dev/mapper/$DEV_NAME >/dev/null 2>&1 || fail "Errors detectied after resize."
 638 echo "[OK]"
 639
 640 test_resize "[INTEGRITY RESIZE NOKEY]" 0 0 "--integrity crc32"
 641 test_resize "[INTEGRITY RESIZE NOKEY]" 0 1 "--integrity crc32"
 642 test_resize "[INTEGRITY RESIZE NOKEY DETACHED]" 1 0 "--integrity crc32"
 643 test_resize "[INTEGRITY RESIZE NOKEY DETACHED]" 1 1 "--integrity crc32"
 644 if [ -n "$DM_INTEGRITY_HMAC_FIX" ] ; then
 645         test_resize "[INTEGRITY RESIZE KEY]" 0 0 "--integrity hmac-sha256 --integrity-key-size 128 --integrity-key-file $KEY_FILE --journal-integrity hmac-sha256 --journal-integrity-key-file $KEY_FILE --journal-integrity-key-size 128 --journal-crypt ctr-aes --journal-crypt-key-size 16 --journal-crypt-key-file $KEY_FILE"
 646         test_resize "[INTEGRITY RESIZE KEY]" 0 1 "--integrity hmac-sha256 --integrity-key-size 128 --integrity-key-file $KEY_FILE --journal-integrity hmac-sha256 --journal-integrity-key-file $KEY_FILE --journal-integrity-key-size 128 --journal-crypt ctr-aes --journal-crypt-key-size 16 --journal-crypt-key-file $KEY_FILE"
 647         test_resize "[INTEGRITY RESIZE KEY DETACHED]" 1 0 "--integrity hmac-sha256 --integrity-key-size 128 --integrity-key-file $KEY_FILE --journal-integrity hmac-sha256 --journal-integrity-key-file $KEY_FILE --journal-integrity-key-size 128 --journal-crypt ctr-aes --journal-crypt-key-size 16 --journal-crypt-key-file $KEY_FILE"
 648         test_resize "[INTEGRITY RESIZE KEY DETACHED]" 1 1 "--integrity hmac-sha256 --integrity-key-size 128 --integrity-key-file $KEY_FILE --journal-integrity hmac-sha256 --journal-integrity-key-file $KEY_FILE --journal-integrity-key-size 128 --journal-crypt ctr-aes --journal-crypt-key-size 16 --journal-crypt-key-file $KEY_FILE"
 649 fi
 650
 651 cleanup