3 CRYPTSETUP=../src/cryptsetup
4 REENC=../src/cryptsetup-reencrypt
9 ORIG_IMG=reenc-data-orig
18 function del_scsi_device()
20 rmmod scsi_debug 2>/dev/null
24 function remove_mapping()
26 [ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove $DEV_NAME2
27 [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove $DEV_NAME
28 [ ! -z "$LOOPDEV1" ] && losetup -d $LOOPDEV1 >/dev/null 2>&1
29 rm -f $IMG $ORIG_IMG $KEY1 >/dev/null 2>&1
30 umount $MNT_DIR > /dev/null 2>&1
31 rmdir $MNT_DIR > /dev/null 2>&1
38 [ -n "$1" ] && echo "$1"
47 [ -n "$1" ] && echo "$1"
51 function add_scsi_device() {
53 modprobe scsi_debug $@
54 if [ $? -ne 0 ] ; then
55 echo "This kernel seems to not support proper scsi_debug module, test skipped."
60 SCSI_DEV="/dev/"$(grep -l -e scsi_debug /sys/block/*/device/model | cut -f4 -d /)
61 [ -b $SCSI_DEV ] || fail "Cannot find $SCSI_DEV."
67 echo "$1" | $CRYPTSETUP luksOpen $LOOPDEV1 $DEV_NAME || fail
69 $CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV1 $DEV_NAME || fail
73 function wipe_dev() # $1 dev
75 dd if=/dev/zero of=$1 bs=256k >/dev/null 2>&1
78 function wipe() # $1 pass
81 wipe_dev /dev/mapper/$DEV_NAME
82 udevadm settle >/dev/null 2>&1
83 $CRYPTSETUP luksClose $DEV_NAME || fail
86 function prepare() # $1 dev1_siz
90 dd if=/dev/zero of=$IMG bs=1k count=$1 >/dev/null 2>&1
91 LOOPDEV1=$(losetup -f 2>/dev/null)
92 [ -z "$LOOPDEV1" ] && fail "No free loop device"
93 losetup $LOOPDEV1 $IMG
95 if [ ! -e $KEY1 ]; then
96 dd if=/dev/urandom of=$KEY1 count=1 bs=32 >/dev/null 2>&1
100 function check_hash_dev() # $1 dev, $2 hash
102 HASH=$(sha256sum $1 | cut -d' ' -f 1)
103 [ $HASH != "$2" ] && fail "HASH differs ($HASH)"
106 function check_hash() # $1 pwd, $2 hash
109 check_hash_dev /dev/mapper/$DEV_NAME $2
110 $CRYPTSETUP remove $DEV_NAME || fail
113 function backup_orig()
118 losetup $LOOPDEV1 $IMG
126 losetup $LOOPDEV1 $IMG
129 function check_slot() #space separeted list of ENABLED key slots
132 local _KS1=$_KS0 _KS2=$_KS0 _KS3=$_KS0 _KS4=$_KS0 _KS5=$_KS0 _KS6=$_KS0 _KS7=$_KS0
136 eval _KS$_tmp=ENABLED
139 local _out=$($CRYPTSETUP luksDump $LOOPDEV1 | grep -e "Key Slot" | cut -d ' ' -f 4)
142 for _tmp in $_out; do
143 eval local _orig="\${_KS${_i}}"
144 if [ "$_tmp" != "$_orig" ]; then
145 echo "Keyslot $_i is $_tmp, expected result: $_orig"
154 function simple_scsi_reenc()
157 echo $PWD1 | $CRYPTSETUP luksFormat -i1 $SCSI_DEV || fail
159 echo $PWD1 | $CRYPTSETUP luksOpen $SCSI_DEV $DEV_NAME || fail
160 HASH=$(sha256sum /dev/mapper/$DEV_NAME | cut -d' ' -f 1)
161 $CRYPTSETUP luksClose $DEV_NAME || fail
163 echo $PWD1 | $REENC -q -i 1 $SCSI_DEV || fail
165 echo $PWD1 | $CRYPTSETUP luksOpen $SCSI_DEV $DEV_NAME || fail
166 check_hash_dev /dev/mapper/$DEV_NAME $HASH
167 $CRYPTSETUP luksClose $DEV_NAME || fail
170 function mount_and_test() {
171 test -d $MNT_DIR || mkdir -p $MNT_DIR
172 mount $@ $MNT_DIR 2>/dev/null || {
173 echo -n "failed to mount [SKIP]"
176 rm $MNT_DIR/* 2>/dev/null
178 echo $PWD2 | $START_DIR/$REENC $LOOPDEV1 -q --use-fsync --use-directio --write-log || return 1
184 function test_logging_tmpfs() {
186 mount_and_test -t tmpfs none -o size=$[25*1024*1024] || return 1
190 function test_logging() {
192 for img in $(ls img_fs*img.bz2) ; do
193 wipefs -a $SCSI_DEV > /dev/null
194 echo -n "[${img%.img.bz2}]"
195 bzip2 -d -c $img | dd of=$SCSI_DEV >/dev/null 2>&1
196 mount_and_test $SCSI_DEV || return 1
201 [ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
202 [ ! -x "$REENC" ] && skip "Cannot find $REENC, test skipped."
203 which wipefs >/dev/null || skip "Cannot find wipefs, test skipped."
207 HASH1=b69dae56a14d1a8314ed40664c4033ea0a550eea2673e04df42a66ac6b9faf2c
208 HASH2=d85ef2a08aeac2812a648deb875485a6e3848fc3d43ce4aa380937f08199f86b
209 HASH3=e4e5749032a5163c45125eccf3e8598ba5ed840df442c97e1d5ad4ad84359605
210 HASH4=2daeb1f36095b44b318410b3f4e8b5d989dcc7bb023d1426c492dab0a3053e74
212 echo "[1] Reencryption"
214 echo $PWD1 | $CRYPTSETUP -q luksFormat -s 128 -c aes-cbc-plain -i 1 --align-payload 4096 $LOOPDEV1 || fail
216 check_hash $PWD1 $HASH1
217 echo $PWD1 | $REENC $LOOPDEV1 -q
218 check_hash $PWD1 $HASH1
219 echo $PWD1 | $REENC $LOOPDEV1 -q -s 256
220 check_hash $PWD1 $HASH1
221 echo $PWD1 | $REENC $LOOPDEV1 -q -s 256 -c aes-xts-plain64 -h sha256
222 check_hash $PWD1 $HASH1
223 echo $PWD1 | $REENC $LOOPDEV1 -q --use-directio
224 check_hash $PWD1 $HASH1
226 echo "[2] Reencryption with data shift"
227 echo $PWD1 | $CRYPTSETUP -q luksFormat -c aes-cbc-essiv:sha256 -s 128 -i 1 --align-payload 2048 $LOOPDEV1 || fail
229 echo $PWD1 | $REENC $LOOPDEV1 -q -s 256 --reduce-device-size 1024S || fail
230 check_hash $PWD1 $HASH2
231 echo $PWD1 | $REENC $LOOPDEV1 -q -i 1 || fail
232 check_hash $PWD1 $HASH2
234 echo "[3] Reencryption with keyfile"
235 echo $PWD1 | $CRYPTSETUP -q luksFormat -d $KEY1 -c aes-cbc-essiv:sha256 -s 128 -i 1 --align-payload 4096 $LOOPDEV1 || fail
238 echo $PWD1 | $CRYPTSETUP -q luksAddKey -d $KEY1 $LOOPDEV1 || fail
239 $REENC $LOOPDEV1 -d $KEY1 -i 1 -q 2>/dev/null && fail
240 $REENC $LOOPDEV1 -d $KEY1 -S 0 -i 1 -q || fail
242 check_slot 0 || fail "Only keyslot 0 expected to be enabled"
243 $REENC $LOOPDEV1 -d $KEY1 -i 1 -q || fail
244 # FIXME echo $PWD1 | $REENC ...
246 echo "[4] Encryption of not yet encrypted device"
247 # well, movin' zeroes :-)
249 SIZE=$(blockdev --getsz $LOOPDEV1)
251 dmsetup create $DEV_NAME2 --table "0 $(($SIZE - $OFFSET)) linear $LOOPDEV1 0" || fail
252 check_hash_dev /dev/mapper/$DEV_NAME2 $HASH3
253 dmsetup remove $DEV_NAME2 || fail
254 echo $PWD1 | $REENC $LOOPDEV1 -c aes-cbc-essiv:sha256 -s 128 --new --reduce-device-size "$OFFSET"S -q
255 check_hash $PWD1 $HASH3
257 echo "[5] Reencryption using specific keyslot"
258 echo $PWD2 | $CRYPTSETUP -q luksFormat -i 1 $LOOPDEV1 || fail
259 echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey -i 1 -S 1 $LOOPDEV1 || fail
260 echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey -i 1 -S 2 $LOOPDEV1 || fail
261 echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey -i 1 -S 3 $LOOPDEV1 || fail
262 echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey -i 1 -S 4 $LOOPDEV1 || fail
263 echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey -i 1 -S 5 $LOOPDEV1 || fail
264 echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey -i 1 -S 6 $LOOPDEV1 || fail
265 echo -e "$PWD2\n$PWD3" | $CRYPTSETUP -q luksAddKey -i 1 -S 7 $LOOPDEV1 || fail
267 echo $PWD2 | $REENC -i 1 -S 0 -q $LOOPDEV1 || fail
268 check_slot 0 || fail "Only keyslot 0 expected to be enabled"
271 echo $PWD1 | $REENC -i 1 -S 1 -q $LOOPDEV1 || fail
272 check_slot 1 || fail "Only keyslot 1 expected to be enabled"
275 echo $PWD2 | $REENC -i 1 -S 6 -q $LOOPDEV1 || fail
276 check_slot 6 || fail "Only keyslot 6 expected to be enabled"
279 echo $PWD3 | $REENC -i 1 -S 7 -q $LOOPDEV1 || fail
280 check_slot 7 || fail "Only keyslot 7 expected to be enabled"
284 echo "[6] Reencryption using all active keyslots"
285 echo -e "$PWD2\n$PWD1\n$PWD2\n$PWD1\n$PWD2\n$PWD1\n$PWD2\n$PWD3" | $REENC -q $LOOPDEV1 || fail
286 check_slot 0 1 2 3 4 5 6 7 || fail "All keyslots expected to be enabled"
288 echo "[7] Reencryption of block devices with different block size"
289 add_scsi_device sector_size=512 dev_size_mb=8
290 simple_scsi_reenc "[512 sector]"
291 add_scsi_device sector_size=4096 dev_size_mb=8
292 simple_scsi_reenc "[4096 sector]"
293 add_scsi_device sector_size=512 physblk_exp=3 dev_size_mb=8
294 simple_scsi_reenc "[4096/512 sector]"
297 echo "[8] Header only reencryption (hash and iteration time)"
298 echo $PWD1 | $CRYPTSETUP -q luksFormat --hash sha1 $LOOPDEV1 || fail
300 check_hash $PWD1 $HASH1
301 echo $PWD1 | $REENC $LOOPDEV1 -q --keep-key --hash sha256 --iter-time 1
302 check_hash $PWD1 $HASH1
303 echo $PWD1 | $REENC $LOOPDEV1 -q --keep-key --hash sha512
304 check_hash $PWD1 $HASH1
305 echo $PWD1 | $REENC $LOOPDEV1 -q --keep-key --iter-time 1
306 check_hash $PWD1 $HASH1
308 echo "[9] Test log I/Os on various underlaying block devices"
310 echo $PWD2 | $CRYPTSETUP -q luksFormat -i 1 $LOOPDEV1 || fail
311 add_scsi_device sector_size=512 dev_size_mb=25
312 test_logging "[512 sector]" || fail
313 add_scsi_device sector_size=4096 dev_size_mb=25
314 test_logging "[4096 sector]" || fail
315 add_scsi_device sector_size=512 dev_size_mb=25 physblk_exp=3
316 test_logging "[4096/512 sector]" || fail
317 test_logging_tmpfs || fail
319 echo "[10] Removal of encryption"
321 echo $PWD1 | $CRYPTSETUP -q luksFormat -i 1 $LOOPDEV1 || fail
323 check_hash $PWD1 $HASH1
324 echo $PWD1 | $REENC $LOOPDEV1 -q --decrypt
325 check_hash_dev $LOOPDEV1 $HASH4