tests/mode-test

   1 #!/bin/bash
   2 #
   3 # Test mode compatibility, check input + kernel and cryptsetup cipher status
   4 #
   5 CRYPTSETUP=../src/cryptsetup
   6 DEV_NAME=dmc_test
   7 LOOPDEV=/dev/loop5
   8 HEADER_IMG=mode-test.img
   9 PASSWORD=3xrododenron
  10
  11 # cipher-chainmode-ivopts:ivmode
  12 CIPHERS="aes twofish serpent"
  13 MODES="cbc lrw xts"
  14 IVMODES="null benbi plain plain64 essiv:sha256"
  15
  16 cleanup() {
  17         for dev in $(dmsetup status --target crypt | sed s/\:\ .*// | grep "^$DEV_NAME"_); do
  18                 dmsetup remove $dev
  19         done
  20         udevadm settle 2>/dev/null 2>&1
  21         sleep 2
  22         [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove $DEV_NAME
  23         losetup -d $LOOPDEV >/dev/null 2>&1
  24         rm -f $HEADER_IMG >/dev/null 2>&1
  25 }
  26
  27 fail()
  28 {
  29         [ -n "$1" ] && echo "$1"
  30         cleanup
  31         exit 100
  32 }
  33
  34 add_device() {
  35         dd if=/dev/zero of=$HEADER_IMG bs=1M count=6 >/dev/null 2>&1
  36         sync
  37         losetup $LOOPDEV $HEADER_IMG >/dev/null 2>&1
  38         dmsetup create $DEV_NAME --table "0 10240 linear $LOOPDEV 8" >/dev/null 2>&1
  39 }
  40
  41 dmcrypt_check() # device outstring
  42 {
  43         X=$(dmsetup table $1 2>/dev/null | cut -d' '  -f 4)
  44         if [ $X = $2 ] ; then
  45                 echo -n "[table OK]"
  46         else
  47                 echo "[table FAIL]"
  48                 echo " Expecting $2 got $X."
  49                 fail
  50         fi
  51
  52         X=$($CRYPTSETUP status $1 | grep cipher | sed s/\.\*cipher:\\s*//)
  53         if [ $X = $2 ] ; then
  54                 echo -n "[status OK]"
  55         else
  56                 echo "[status FAIL]"
  57                 echo " Expecting $2 got $X."
  58                 fail
  59         fi
  60
  61         dmsetup remove $1 >/dev/null 2>&1
  62 }
  63
  64 dmcrypt_check_sum() # cipher device outstring
  65 {
  66         EXPSUM="c036cbb7553a909f8b8877d4461924307f27ecb66cff928eeeafd569c3887e29"
  67         # Fill device with zeroes and reopen it
  68         dd if=/dev/zero of=/dev/mapper/$2 bs=1M count=6 >/dev/null 2>&1
  69         sync
  70         dmsetup remove $2
  71         echo $PASSWORD | $CRYPTSETUP create -c $1 -s 256 $2 /dev/mapper/$DEV_NAME >/dev/null 2>&1
  72         ret=$?
  73         VSUM=$(sha256sum /dev/mapper/$2 | cut -d' ' -f 1)
  74         if [ $ret -eq 0 -a "$VSUM" = "$EXPSUM" ] ; then
  75                 echo -n "[OK]"
  76         else
  77                 echo "[FAIL]"
  78                 echo " Expecting $EXPSUM got $VSUM."
  79                 fail
  80         fi
  81
  82         dmsetup remove $2 >/dev/null 2>&1
  83 }
  84
  85 dmcrypt()
  86 {
  87         OUT=$2
  88         [ -z "$OUT" ] && OUT=$1
  89         printf "%-25s" "$1"
  90
  91         echo $PASSWORD | $CRYPTSETUP create -c $1 -s 256 "$DEV_NAME"_"$1" /dev/mapper/$DEV_NAME >/dev/null 2>&1
  92         if [ $? -eq 0 ] ; then
  93                 echo -n -e "PLAIN:"
  94                 dmcrypt_check "$DEV_NAME"_"$1" $OUT
  95         else
  96                 echo -n "[n/a]"
  97         fi
  98
  99         echo $PASSWORD | $CRYPTSETUP luksFormat -i 1 -c $1 -s 256 /dev/mapper/$DEV_NAME >/dev/null 2>&1
 100         if [ $? -eq 0 ] ; then
 101                 echo -n -e " LUKS:"
 102                 echo $PASSWORD | $CRYPTSETUP luksOpen /dev/mapper/$DEV_NAME "$DEV_NAME"_"$1" >/dev/null 2>&1
 103                 dmcrypt_check "$DEV_NAME"_"$1" $OUT
 104         fi
 105
 106         # repeated device creation must return the same checksum
 107         echo $PASSWORD | $CRYPTSETUP create -c $1 -s 256 "$DEV_NAME"_"$1" /dev/mapper/$DEV_NAME >/dev/null 2>&1
 108         if [ $? -eq 0 ] ; then
 109                 echo -n -e " CHECKSUM:"
 110                 dmcrypt_check_sum "$1" "$DEV_NAME"_"$1"
 111         fi
 112         echo
 113 }
 114
 115 if [ $(id -u) != 0 ]; then
 116         echo "WARNING: You must be root to run this test, test skipped."
 117         exit 0
 118 fi
 119
 120 add_device
 121
 122 # compatibility modes
 123 dmcrypt aes aes-cbc-plain
 124 dmcrypt aes-plain aes-cbc-plain
 125
 126 # codebook doesn't support IV at all
 127 for cipher in $CIPHERS ; do
 128         dmcrypt "$cipher-ecb"
 129 done
 130
 131 for cipher in $CIPHERS ; do
 132         for mode in $MODES ; do
 133                 for ivmode in $IVMODES ; do
 134                         dmcrypt "$cipher-$mode-$ivmode"
 135                 done
 136         done
 137 done
 138
 139 cleanup