tests/compat-test2

   1 #!/bin/bash
   2
   3 PS4='$LINENO:'
   4 [ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".."
   5 CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup
   6
   7 CRYPTSETUP_VALGRIND=../.libs/cryptsetup
   8 CRYPTSETUP_LIB_VALGRIND=../.libs
   9
  10 DEV_NAME=dummy
  11 DEV_NAME2=dummy2
  12 DEV_NAME3=dummy3
  13 ORIG_IMG=luks-test-orig
  14 IMG=luks-test
  15 IMG10=luks-test-v10
  16 HEADER_IMG=luks-header
  17 HEADER_KEYU=luks2_keyslot_unassigned.img
  18 HEADER_LUKS2_PV=blkid-luks2-pv.img
  19 KEY1=key1
  20 KEY2=key2
  21 KEY5=key5
  22 KEYE=keye
  23 PWD0="compatkey"
  24 PWD1="93R4P4pIqAH8"
  25 PWD2="mymJeD8ivEhE"
  26 PWD3="ocMakf3fAcQO"
  27 PWD4="Qx3qn46vq0v"
  28 PWDW="rUkL4RUryBom"
  29 TEST_KEYRING_NAME="compattest2_keyring"
  30 TEST_TOKEN0="compattest2_desc0"
  31 TEST_TOKEN1="compattest2_desc1"
  32 VK_FILE="compattest2_vkfile"
  33 IMPORT_TOKEN="{\"type\":\"some_type\",\"keyslots\":[],\"base64_data\":\"zxI7vKB1Qwl4VPB4D-N-OgcC14hPCG0IDu8O7eCqaQ\"}"
  34 TOKEN_FILE0=test-token-file0
  35 TOKEN_FILE1=test-token-file1
  36 KEY_FILE0=test-key-file0
  37 KEY_FILE1=test-key-file1
  38
  39 FAST_PBKDF_OPT="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
  40
  41 TEST_UUID="12345678-1234-1234-1234-123456789abc"
  42
  43 LOOPDEV=$(losetup -f 2>/dev/null)
  44 [ -f /etc/system-fips ] && FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null)
  45
  46 function remove_mapping()
  47 {
  48         [ -b /dev/mapper/$DEV_NAME3 ] && dmsetup remove --retry $DEV_NAME3
  49         [ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove --retry $DEV_NAME2
  50         [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove --retry $DEV_NAME
  51         losetup -d $LOOPDEV >/dev/null 2>&1
  52         rm -f $ORIG_IMG $IMG $IMG10 $KEY1 $KEY2 $KEY5 $KEYE $HEADER_IMG $HEADER_KEYU $VK_FILE $HEADER_LUKS2_PV missing-file $TOKEN_FILE0 $TOKEN_FILE1 test_image_* $KEY_FILE0 $KEY_FILE1 >/dev/null 2>&1
  53
  54         # unlink whole test keyring
  55         [ -n "$TEST_KEYRING" ] && keyctl unlink $TEST_KEYRING "@u" >/dev/null
  56         unset TEST_KEYRING
  57
  58         rmmod scsi_debug 2> /dev/null
  59         scsi_debug_teardown $DEV
  60 }
  61
  62 function force_uevent()
  63 {
  64         DNAME=$(echo $LOOPDEV | cut -f3 -d /)
  65         echo "change" >/sys/block/$DNAME/uevent
  66 }
  67
  68 function fail()
  69 {
  70         [ -n "$1" ] && echo "$1"
  71         remove_mapping
  72         echo "FAILED backtrace:"
  73         while caller $frame; do ((frame++)); done
  74         exit 2
  75 }
  76
  77 function fips_mode()
  78 {
  79         [ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ]
  80 }
  81
  82 function can_fail_fips()
  83 {
  84         # Ignore this fail if running in FIPS mode
  85         fips_mode || fail $1
  86 }
  87
  88 function skip()
  89 {
  90         [ -n "$1" ] && echo "$1"
  91         remove_mapping
  92         exit 77
  93 }
  94
  95 function prepare()
  96 {
  97         [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove --retry $DEV_NAME
  98
  99         case "$2" in
 100         wipe)
 101                 remove_mapping
 102                 dd if=/dev/zero of=$IMG bs=1M count=40 >/dev/null 2>&1
 103                 sync
 104                 losetup $LOOPDEV $IMG
 105                 ;;
 106         new)
 107                 remove_mapping
 108                 xz -cd compatimage.img.xz > $IMG
 109                 xz -dk $HEADER_KEYU.xz
 110                 # FIXME: switch to internal loop (no losetup at all)
 111                 echo "bad" | $CRYPTSETUP luksOpen --key-slot 0 --test-passphrase $IMG 2>&1 | \
 112                         grep "autoclear flag" && skip "WARNING: Too old kernel, test skipped."
 113                 losetup $LOOPDEV $IMG
 114                 xz -cd compatv10image.img.xz > $IMG10
 115                 ;;
 116         reuse | *)
 117                 if [ ! -e $IMG ]; then
 118                         xz -cd compatimage.img.xz > $IMG
 119                         losetup $LOOPDEV $IMG
 120                 fi
 121                 [ ! -e $IMG10 ] && xz -cd compatv10image.img.xz > $IMG10
 122                 ;;
 123         esac
 124
 125         if [ ! -e $KEY1 ]; then
 126                 #dd if=/dev/urandom of=$KEY1 count=1 bs=32 >/dev/null 2>&1
 127                 echo -n $'\x48\xc6\x74\x4f\x41\x4e\x50\xc0\x79\xc2\x2d\x5b\x5f\x68\x84\x17' >$KEY1
 128                 echo -n $'\x9c\x03\x5e\x1b\x4d\x0f\x9a\x75\xb3\x90\x70\x32\x0a\xf8\xae\xc4'>>$KEY1
 129         fi
 130
 131         if [ ! -e $KEY2 ]; then
 132                 dd if=/dev/urandom of=$KEY2 count=1 bs=16 >/dev/null 2>&1
 133         fi
 134
 135         if [ ! -e $KEY5 ]; then
 136                 dd if=/dev/urandom of=$KEY5 count=1 bs=16 >/dev/null 2>&1
 137         fi
 138
 139         if [ ! -e $KEYE ]; then
 140                 touch $KEYE
 141         fi
 142
 143         cp $IMG $ORIG_IMG
 144         [ -n "$1" ] && echo "CASE: $1"
 145 }
 146
 147 function check_exists()
 148 {
 149         [ -b /dev/mapper/$DEV_NAME ] || fail
 150 }
 151
 152 function valgrind_setup()
 153 {
 154         which valgrind >/dev/null 2>&1 || fail "Cannot find valgrind."
 155         [ ! -f $CRYPTSETUP_VALGRIND ] && fail "Unable to get location of cryptsetup executable."
 156         export LD_LIBRARY_PATH="$CRYPTSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH"
 157 }
 158
 159 function valgrind_run()
 160 {
 161         INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${CRYPTSETUP_VALGRIND} "$@"
 162 }
 163
 164 function dm_crypt_keyring_support()
 165 {
 166         VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv)
 167         [ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version."
 168
 169         VER_MAJ=$(echo $VER_STR | cut -f 1 -d.)
 170         VER_MIN=$(echo $VER_STR | cut -f 2 -d.)
 171         VER_PTC=$(echo $VER_STR | cut -f 3 -d.)
 172
 173         test -d /proc/sys/kernel/keys || return 1
 174
 175         [ $VER_MAJ -gt 1 ] && return 0
 176         [ $VER_MAJ -eq 1 -a $VER_MIN -gt 18 ] && return 0
 177         [ $VER_MAJ -eq 1 -a $VER_MIN -eq 18 -a $VER_PTC -ge 1 ] && return 0
 178         return 1
 179 }
 180
 181 function dm_crypt_keyring_flawed()
 182 {
 183         dm_crypt_keyring_support && return 1;
 184
 185         [ $VER_MAJ -gt 1 ] && return 0
 186         [ $VER_MAJ -eq 1 -a $VER_MIN -ge 15 ] && return 0
 187         return 1
 188 }
 189
 190 function dm_crypt_keyring_new_kernel()
 191 {
 192         KER_STR=$(uname -r)
 193         [ -z "$KER_STR" ] && fail "Failed to parse kernel version."
 194         KER_MAJ=$(echo $KER_STR | cut -f 1 -d.)
 195         KER_MIN=$(echo $KER_STR | cut -f 2 -d.)
 196
 197         [ $KER_MAJ -ge 5 ] && return 0
 198         [ $KER_MAJ -eq 4 -a $KER_MIN -ge 15 ] && return 0
 199         return 1
 200 }
 201
 202 function dm_crypt_sector_size_support()
 203 {
 204         VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv)
 205         [ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version."
 206
 207         VER_MAJ=$(echo $VER_STR | cut -f 1 -d.)
 208         VER_MIN=$(echo $VER_STR | cut -f 2 -d.)
 209         VER_PTC=$(echo $VER_STR | cut -f 3 -d.)
 210
 211         if [ $VER_MIN -ge 17 -o \( $VER_MIN -eq 14 -a $VER_PTC -ge 5 \) ]; then
 212                 return 0
 213         fi
 214
 215         return 1
 216 }
 217
 218 function test_and_prepare_keyring() {
 219         which keyctl > /dev/null 2>&1 || skip "Cannot find keyctl, test skipped"
 220         keyctl list "@s" > /dev/null || skip "Current session keyring is unreachable, test skipped"
 221         TEST_KEYRING=$(keyctl newring $TEST_KEYRING_NAME "@u" 2> /dev/null)
 222         test -n "$TEST_KEYRING" || skip "Failed to create keyring in user keyring"
 223         keyctl search "@s" keyring "$TEST_KEYRING" > /dev/null 2>&1 || keyctl link "@u" "@s" > /dev/null 2>&1
 224         load_key user test_key test_data "$TEST_KEYRING" || skip "Kernel keyring service is useless on this system, test skipped."
 225 }
 226
 227 # $1 type
 228 # $2 description
 229 # $3 payload
 230 # $4 keyring
 231 function load_key()
 232 {
 233         keyctl add $@ >/dev/null
 234 }
 235
 236 function setup_luks2_env() {
 237         echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 $FAST_PBKDF_OPT $LOOPDEV || fail
 238         $CRYPTSETUP luksDump $LOOPDEV >/dev/null || fail
 239         echo $PWD1 | $CRYPTSETUP open $LOOPDEV $DEV_NAME || fail
 240         HAVE_KEYRING=$($CRYPTSETUP status $DEV_NAME | grep "keyring")
 241         if [ -n "$HAVE_KEYRING" ]; then
 242                 HAVE_KEYRING=1
 243         else
 244                 HAVE_KEYRING=0
 245         fi
 246         $CRYPTSETUP close $DEV_NAME || fail
 247 }
 248
 249 # $1 path to scsi debug bdev
 250 scsi_debug_teardown() {
 251         local _tries=15;
 252
 253         while [ -b "$1" -a $_tries -gt 0 ]; do
 254                 rmmod scsi_debug 2> /dev/null
 255                 if [ -b "$1" ]; then
 256                         sleep .1
 257                         _tries=$((_tries-1))
 258                 fi
 259         done
 260
 261         test ! -b "$1" || rmmod scsi_debug 2> /dev/null
 262 }
 263
 264 function add_scsi_device() {
 265         scsi_debug_teardown $DEV
 266         modprobe scsi_debug $@ delay=0
 267         if [ $? -ne 0 ] ; then
 268                 echo "This kernel seems to not support proper scsi_debug module, test skipped."
 269                 exit 77
 270         fi
 271
 272         sleep 1
 273         DEV="/dev/"$(grep -l -e scsi_debug /sys/block/*/device/model | cut -f4 -d /)
 274         [ -b $DEV ] || fail "Cannot find $DEV."
 275 }
 276
 277 export LANG=C
 278
 279 [ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
 280 [ -z "$LOOPDEV" ] && skip "WARNING: Cannot find free loop device, test skipped."
 281
 282 prepare "[0] Detect LUKS2 environment" wipe
 283 setup_luks2_env
 284
 285 [ -n "$VALG" ] && valgrind_setup && CRYPTSETUP=valgrind_run
 286
 287 prepare "[1] Data offset" wipe
 288 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --offset 1 2>/dev/null && fail
 289 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --offset 16385 2>/dev/null && fail
 290 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --offset 32 2>/dev/null && fail
 291 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --align-payload 16384 --offset 16384 2>/dev/null && fail
 292 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --offset 16384 || fail
 293 $CRYPTSETUP -q luksDump  $LOOPDEV | grep -q "offset: $((512 * 16384)) \[bytes\]" || fail
 294 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 1024 --offset 16384 >/dev/null || fail
 295 $CRYPTSETUP -q luksDump  $LOOPDEV | grep -q "offset: $((512 * 16384)) \[bytes\]" || fail
 296 truncate -s 4096 $HEADER_IMG
 297 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG -q --offset 80000 >/dev/null 2>&1 || fail
 298
 299 prepare "[2] Sector size and old payload alignment" wipe
 300 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size  511 2>/dev/null && fail
 301 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size  256 2>/dev/null && fail
 302 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 8192 2>/dev/null && fail
 303 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size  512 || fail
 304 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --align-payload 5 || fail
 305 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size  512 --align-payload 5 || fail
 306 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 2048 --align-payload 32 >/dev/null || fail
 307 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 4096 >/dev/null || fail
 308 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 2048 --align-payload 32768 >/dev/null || fail
 309 $CRYPTSETUP -q luksDump  $LOOPDEV | grep -q "offset: $((512 * 32768)) \[bytes\]" || fail
 310 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 2048 >/dev/null || fail
 311 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 4096 --align-payload 32768 >/dev/null || fail
 312 $CRYPTSETUP -q luksDump  $LOOPDEV | grep -q "offset: $((512 * 32768)) \[bytes\]" || fail
 313
 314 prepare "[3] format" wipe
 315 echo $PWD1 | $CRYPTSETUP -q $FAST_PBKDF_OPT -c aes-cbc-essiv:sha256 -s 128 luksFormat --type luks2 $LOOPDEV || fail
 316 prepare "[4] format using hash sha512" wipe
 317 echo $PWD1 | $CRYPTSETUP $FAST_PBKDF_OPT -h sha512 -c aes-cbc-essiv:sha256 -s 128 luksFormat --type luks2 $LOOPDEV || fail
 318 $CRYPTSETUP -q luksDump  $LOOPDEV | grep "0: pbkdf2" -A2 | grep "Hash:" | grep -qe sha512 || fail
 319
 320 prepare "[5] open"
 321 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME --test-passphrase || fail
 322 echo $PWDW | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME --test-passphrase 2>/dev/null && fail
 323 [ $? -ne 2 ] && fail "luksOpen should return EPERM exit code"
 324 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
 325 check_exists
 326
 327 # Key Slot 1 and key material section 1 must change, the rest must not.
 328 prepare "[6] add key"
 329 echo -e "$PWD1\n$PWD2" | $CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT || fail
 330 echo $PWD2 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
 331
 332 # Unsuccessful Key Delete - nothing may change
 333 prepare "[7] unsuccessful delete"
 334 echo $PWDW | $CRYPTSETUP luksKillSlot $LOOPDEV 1 2>/dev/null && fail
 335 [ $? -ne 2 ] && fail "luksKillSlot should return EPERM exit code"
 336 #FIXME
 337 #$CRYPTSETUP -q luksKillSlot $LOOPDEV 8 2>/dev/null && fail
 338 #$CRYPTSETUP -q luksKillSlot $LOOPDEV 7 2>/dev/null && fail
 339
 340 # Delete Key Test
 341 # Key Slot 1 and key material section 1 must change, the rest must not
 342 prepare "[8] successful delete"
 343 $CRYPTSETUP -q luksKillSlot $LOOPDEV 1 || fail
 344 echo $PWD2 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2> /dev/null && fail
 345 [ $? -ne 2 ] && fail "luksOpen should return EPERM exit code"
 346 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
 347
 348 # Key Slot 1 and key material section 1 must change, the rest must not
 349 prepare "[9] add key test for key files"
 350 echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV $KEY1 || fail
 351 $CRYPTSETUP -d $KEY1 luksOpen $LOOPDEV $DEV_NAME || fail
 352
 353 # Key Slot 1 and key material section 1 must change, the rest must not
 354 prepare "[10] delete key test with key1 as remaining key"
 355 $CRYPTSETUP -d $KEY1 luksKillSlot $LOOPDEV 0 || fail
 356 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
 357 $CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail
 358
 359 # Delete last slot
 360 prepare "[11] delete last key" wipe
 361 echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 $LOOPDEV $FAST_PBKDF_OPT || fail
 362 echo $PWD1 | $CRYPTSETUP luksKillSlot $LOOPDEV 0 || fail
 363 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
 364
 365 # Format test for ESSIV, and some other parameters.
 366 prepare "[12] parameter variation test" wipe
 367 $CRYPTSETUP -q $FAST_PBKDF_OPT -c aes-cbc-essiv:sha256 -s 128 luksFormat --type luks2 $LOOPDEV $KEY1 || fail
 368 $CRYPTSETUP -d $KEY1 luksOpen $LOOPDEV $DEV_NAME || fail
 369
 370 prepare "[13] open/close - stacked devices" wipe
 371 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $LOOPDEV $FAST_PBKDF_OPT || fail
 372 echo $PWD1 | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
 373 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 /dev/mapper/$DEV_NAME $FAST_PBKDF_OPT || fail
 374 echo $PWD1 | $CRYPTSETUP -q luksOpen /dev/mapper/$DEV_NAME $DEV_NAME2 || fail
 375 $CRYPTSETUP -q luksClose  $DEV_NAME2 || fail
 376 $CRYPTSETUP -q luksClose  $DEV_NAME || fail
 377
 378 prepare "[14] format/open - passphrase on stdin & new line" wipe
 379 # stdin defined by "-" must take even newline
 380 #echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksFormat $LOOPDEV - || fail
 381 echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q --key-file=- luksFormat --type luks2 $LOOPDEV || fail
 382 echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q --key-file=- luksOpen $LOOPDEV $DEV_NAME || fail
 383 $CRYPTSETUP -q luksClose  $DEV_NAME || fail
 384 echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
 385 # now also try --key-file
 386 echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q luksFormat --type luks2 $LOOPDEV --key-file=- || fail
 387 echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q --key-file=- luksOpen $LOOPDEV $DEV_NAME || fail
 388 $CRYPTSETUP -q luksClose  $DEV_NAME || fail
 389 # process newline if from stdin
 390 echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q luksFormat --type luks2 $LOOPDEV || fail
 391 echo "$PWD1" | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
 392 $CRYPTSETUP -q luksClose  $DEV_NAME || fail
 393
 394 prepare "[15] UUID - use and report provided UUID" wipe
 395 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --uuid blah --type luks2 $LOOPDEV 2>/dev/null && fail
 396 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --uuid $TEST_UUID --type luks2 $LOOPDEV || fail
 397 tst=$($CRYPTSETUP -q luksUUID $LOOPDEV)
 398 [ "$tst"x = "$TEST_UUID"x ] || fail
 399 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV || fail
 400 $CRYPTSETUP -q luksUUID --uuid $TEST_UUID $LOOPDEV || fail
 401 tst=$($CRYPTSETUP -q luksUUID $LOOPDEV)
 402 [ "$tst"x = "$TEST_UUID"x ] || fail
 403
 404 prepare "[16] luksFormat" wipe
 405 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --master-key-file /dev/urandom --type luks2 $LOOPDEV || fail
 406 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --master-key-file /dev/urandom --type luks2 $LOOPDEV -d $KEY1 || fail
 407 $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --master-key-file /dev/urandom -s 256 --uuid $TEST_UUID --type luks2 $LOOPDEV $KEY1 || fail
 408 $CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail
 409 $CRYPTSETUP -q luksClose  $DEV_NAME || fail
 410 # open by UUID
 411 force_uevent # some systems do not update loop by-uuid
 412 $CRYPTSETUP luksOpen -d $KEY1 UUID=X$TEST_UUID $DEV_NAME 2>/dev/null && fail
 413 $CRYPTSETUP luksOpen -d $KEY1 UUID=$TEST_UUID $DEV_NAME || fail
 414 $CRYPTSETUP -q luksClose  $DEV_NAME || fail
 415 # empty keyfile
 416 $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEYE || fail
 417 $CRYPTSETUP luksOpen -d $KEYE $LOOPDEV $DEV_NAME || fail
 418 $CRYPTSETUP -q luksClose  $DEV_NAME || fail
 419 # open by volume key
 420 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT -s 256 --master-key-file $KEY1 --type luks2 $LOOPDEV || fail
 421 $CRYPTSETUP luksOpen --master-key-file /dev/urandom $LOOPDEV $DEV_NAME 2>/dev/null && fail
 422 $CRYPTSETUP luksOpen --master-key-file $KEY1 $LOOPDEV $DEV_NAME || fail
 423 $CRYPTSETUP -q luksClose  $DEV_NAME || fail
 424
 425 prepare "[17] AddKey volume key, passphrase and keyfile" wipe
 426 # masterkey
 427 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --master-key-file /dev/zero --key-slot 3 || fail
 428 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase || fail
 429 $CRYPTSETUP luksDump $LOOPDEV | grep -q "3: luks2" || fail
 430 echo $PWD2 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --master-key-file /dev/zero --key-slot 4 || fail
 431 echo $PWD2 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 4 || fail
 432 $CRYPTSETUP luksDump $LOOPDEV | grep -q "4: luks2" || fail
 433 echo $PWD3 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --master-key-file /dev/null --key-slot 5 2>/dev/null && fail
 434 $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --master-key-file /dev/zero --key-slot 5 $KEY1 || fail
 435 $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 5 -d $KEY1 || fail
 436 $CRYPTSETUP luksDump $LOOPDEV | grep -q "5: luks2" || fail
 437
 438 # special "-" handling
 439 $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEY1 --key-slot 3 || fail
 440 echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d $KEY1 - || fail
 441 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase 2>/dev/null && fail
 442 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV -d - --test-passphrase || fail
 443 echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d - $KEY2 || fail
 444 $CRYPTSETUP luksOpen $LOOPDEV -d $KEY2 --test-passphrase || fail
 445 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV -d - -d $KEY1 --test-passphrase 2>/dev/null && fail
 446 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV -d $KEY1 -d $KEY1 --test-passphrase 2>/dev/null && fail
 447
 448 # [0]PWD1 [1]PWD2 [2]$KEY1/1 [3]$KEY1 [4]$KEY2
 449 $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEY1 --key-slot 3 || fail
 450 $CRYPTSETUP luksDump $LOOPDEV | grep -q "3: luks2" || fail
 451 $CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 --key-slot 3 2>/dev/null && fail
 452 # keyfile/keyfile
 453 $CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 --key-slot 4 || fail
 454 $CRYPTSETUP luksOpen $LOOPDEV -d $KEY2 --test-passphrase --key-slot 4 || fail
 455 $CRYPTSETUP luksDump $LOOPDEV | grep -q "4: luks2" || fail
 456 # passphrase/keyfile
 457 echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d $KEY1 --key-slot 0 || fail
 458 $CRYPTSETUP luksDump $LOOPDEV | grep -q "0: luks2" || fail
 459 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 0 || fail
 460 # passphrase/passphrase
 461 echo -e "$PWD1\n$PWD2\n" | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --key-slot 1 || fail
 462 echo $PWD2 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 1 || fail
 463 $CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" || fail
 464 # keyfile/passphrase
 465 echo -e "$PWD2\n" | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 2 --new-keyfile-size 3 || fail
 466 $CRYPTSETUP luksDump $LOOPDEV | grep -q "2: luks2" || fail
 467
 468 prepare "[18] RemoveKey passphrase and keyfile" reuse
 469 $CRYPTSETUP luksDump $LOOPDEV | grep -q "3: luks2" || fail
 470 $CRYPTSETUP luksRemoveKey $LOOPDEV $KEY1 || fail
 471 $CRYPTSETUP luksDump $LOOPDEV | grep -q "3: luks2" && fail
 472 $CRYPTSETUP luksRemoveKey $LOOPDEV $KEY1 2>/dev/null && fail
 473 [ $? -ne 2 ] && fail "luksRemoveKey should return EPERM exit code"
 474 $CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 --keyfile-size 1 2>/dev/null && fail
 475 $CRYPTSETUP luksDump $LOOPDEV | grep -q "4: luks2" || fail
 476 $CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 || fail
 477 $CRYPTSETUP luksDump $LOOPDEV | grep -q "4: luks2" && fail
 478 # if password or keyfile is provided, batch mode must not suppress it
 479 echo "badpw" | $CRYPTSETUP luksKillSlot $LOOPDEV 2 2>/dev/null && fail
 480 echo "badpw" | $CRYPTSETUP luksKillSlot $LOOPDEV 2 -q 2>/dev/null && fail
 481 echo "badpw" | $CRYPTSETUP luksKillSlot $LOOPDEV 2 --key-file=- 2>/dev/null && fail
 482 echo "badpw" | $CRYPTSETUP luksKillSlot $LOOPDEV 2 --key-file=- -q 2>/dev/null && fail
 483 $CRYPTSETUP luksDump $LOOPDEV | grep -q "2: luks2" || fail
 484 # kill slot using passphrase from 1
 485 echo $PWD2 | $CRYPTSETUP luksKillSlot $LOOPDEV 2 2>/dev/null || fail
 486 $CRYPTSETUP luksDump $LOOPDEV | grep -q "2: luks2" && fail
 487 # remove key0 / slot 0
 488 echo $PWD1 | $CRYPTSETUP luksRemoveKey $LOOPDEV || fail
 489 $CRYPTSETUP luksDump $LOOPDEV | grep -q "0: luks2" && fail
 490 # last keyslot, in batch mode no passphrase needed...
 491 $CRYPTSETUP luksKillSlot -q $LOOPDEV 1 || fail
 492 $CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" && fail
 493
 494 prepare "[19] create & status & resize" wipe
 495 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV || fail
 496 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
 497 if dm_crypt_keyring_support; then
 498         echo | $CRYPTSETUP -q resize --size 100 $DEV_NAME 2>/dev/null && fail
 499 fi
 500 echo $PWD1 | $CRYPTSETUP -q resize --size 100 $DEV_NAME || fail
 501 $CRYPTSETUP -q status  $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail
 502 echo $PWD1 | $CRYPTSETUP -q resize --device-size 51200 $DEV_NAME || fail
 503 $CRYPTSETUP -q status  $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail
 504 echo $PWD1 | $CRYPTSETUP -q resize --device-size 1M $DEV_NAME || fail
 505 $CRYPTSETUP -q status  $DEV_NAME | grep "size:" | grep -q "2048 sectors" || fail
 506 echo $PWD1 | $CRYPTSETUP -q resize --device-size 512k --size 1024 $DEV_NAME > /dev/null 2>&1 && fail
 507 echo $PWD1 | $CRYPTSETUP -q resize --device-size 4097 $DEV_NAME > /dev/null 2>&1 && fail
 508 $CRYPTSETUP -q status  $DEV_NAME | grep "size:" | grep -q "2048 sectors" || fail
 509 $CRYPTSETUP close $DEV_NAME || fail
 510 echo $PWD1 | $CRYPTSETUP luksOpen --disable-keyring $LOOPDEV $DEV_NAME || fail
 511 echo | $CRYPTSETUP -q resize --size 100 $DEV_NAME || fail
 512 $CRYPTSETUP -q status  $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail
 513 $CRYPTSETUP close $DEV_NAME || fail
 514 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
 515 if dm_crypt_keyring_support; then
 516         $CRYPTSETUP -q resize --disable-keyring --size 100 $DEV_NAME 2>/dev/null && fail
 517 fi
 518 if dm_crypt_sector_size_support; then
 519         $CRYPTSETUP close $DEV_NAME || fail
 520         echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 --sector-size 4096 $LOOPDEV > /dev/null || fail
 521         echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
 522         echo $PWD1 | $CRYPTSETUP -q resize --device-size 1M $DEV_NAME || fail
 523         $CRYPTSETUP -q status  $DEV_NAME | grep "size:" | grep -q "2048 sectors" || fail
 524         echo $PWD1 | $CRYPTSETUP -q resize --device-size 2049s $DEV_NAME > /dev/null 2>&1 && fail
 525         echo $PWD1 | $CRYPTSETUP -q resize --size 2049 $DEV_NAME > /dev/null 2>&1 && fail
 526         $CRYPTSETUP -q status  $DEV_NAME | grep "size:" | grep -q "2048 sectors" || fail
 527 fi
 528 $CRYPTSETUP close $DEV_NAME || fail
 529 # Resize not aligned to logical block size
 530 add_scsi_device dev_size_mb=32 sector_size=4096
 531 echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 $FAST_PBKDF_OPT $DEV || fail
 532 echo $PWD1 | $CRYPTSETUP open $DEV $DEV_NAME || fail
 533 OLD_SIZE=$($CRYPTSETUP status $DEV_NAME | grep "^ \+size:" | sed 's/.* \([0-9]\+\) .*/\1/')
 534 echo $PWD1 | $CRYPTSETUP resize $DEV_NAME -b 7 2> /dev/null && fail
 535 dmsetup info $DEV_NAME | grep -q SUSPENDED && fail
 536 NEW_SIZE=$($CRYPTSETUP status $DEV_NAME | grep "^ \+size:" | sed 's/.* \([0-9]\+\) .*/\1/')
 537 test $OLD_SIZE -eq $NEW_SIZE || fail
 538 $CRYPTSETUP close $DEV_NAME || fail
 539
 540 prepare "[20] Disallow open/create if already mapped." wipe
 541 $CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 || fail
 542 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV 2>/dev/null && fail
 543 $CRYPTSETUP remove  $DEV_NAME || fail
 544 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV || fail
 545 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
 546 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME2 2>/dev/null && fail
 547 $CRYPTSETUP  luksClose  $DEV_NAME || fail
 548
 549 prepare "[21] luksDump" wipe
 550 echo $PWD1 | $CRYPTSETUP -q luksFormat --key-size 256 $FAST_PBKDF_OPT --uuid $TEST_UUID --type luks2 $LOOPDEV $KEY1 || fail
 551 echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d $KEY1 || fail
 552 $CRYPTSETUP luksDump $LOOPDEV | grep -q "0: luks2" || fail
 553 $CRYPTSETUP luksDump $LOOPDEV | grep -q $TEST_UUID || fail
 554 echo $PWDW | $CRYPTSETUP luksDump $LOOPDEV --dump-master-key 2>/dev/null && fail
 555 echo $PWD1 | $CRYPTSETUP luksDump $LOOPDEV --dump-master-key | grep -q "MK dump:" || fail
 556 $CRYPTSETUP luksDump -q $LOOPDEV --dump-master-key -d $KEY1 | grep -q "MK dump:" || fail
 557 echo $PWD1 | $CRYPTSETUP luksDump -q $LOOPDEV --dump-master-key --master-key-file $VK_FILE >/dev/null || fail
 558 echo $PWD1 | $CRYPTSETUP luksDump -q $LOOPDEV --dump-master-key --master-key-file $VK_FILE 2>/dev/null && fail
 559 echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --master-key-file $VK_FILE $LOOPDEV || fail
 560 # Use volume key file without keyslots
 561 $CRYPTSETUP luksErase -q $LOOPDEV || fail
 562 $CRYPTSETUP luksOpen --master-key-file $VK_FILE --key-size 256 --test-passphrase $LOOPDEV || fail
 563 echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --master-key-file $VK_FILE --key-size 256 $LOOPDEV || fail
 564 echo $PWD1 | $CRYPTSETUP luksOpen --test-passphrase $LOOPDEV || fail
 565
 566 prepare "[22] remove disappeared device" wipe
 567 dmsetup create $DEV_NAME --table "0 39998 linear $LOOPDEV 2" || fail
 568 echo $PWD1 | $CRYPTSETUP -q $FAST_PBKDF_OPT luksFormat --type luks2 /dev/mapper/$DEV_NAME || fail
 569 echo $PWD1 | $CRYPTSETUP -q luksOpen /dev/mapper/$DEV_NAME $DEV_NAME2 || fail
 570 # underlying device now returns error but node is still present
 571 dmsetup load $DEV_NAME --table "0 40000 error" || fail
 572 dmsetup resume $DEV_NAME || fail
 573 $CRYPTSETUP -q luksClose $DEV_NAME2 || fail
 574 dmsetup remove --retry $DEV_NAME || fail
 575
 576 prepare "[23] ChangeKey passphrase and keyfile" wipe
 577 # [0]$KEY1 [1]key0
 578 $CRYPTSETUP -q luksFormat --type luks2 $LOOPDEV $KEY1 $FAST_PBKDF_OPT --key-slot 0 || fail
 579 echo $PWD1 | $CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 --key-slot 1 || fail
 580 # keyfile [0] / keyfile [0]
 581 $CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 --key-slot 0 || fail
 582 # passphrase [1] / passphrase [1]
 583 echo -e "$PWD1\n$PWD2\n" | $CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT --key-slot 1 || fail
 584 # keyfile [0] / keyfile [new]
 585 $CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY2 $KEY1 || fail
 586 $CRYPTSETUP luksDump $LOOPDEV | grep -q "0: luks2" && fail
 587 # passphrase [1] / passphrase [new]
 588 echo -e "$PWD2\n$PWD1\n" | $CRYPTSETUP luksChangeKey $FAST_PBKDF_OPT $LOOPDEV || fail
 589 $CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" && fail
 590 # use all slots
 591 $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail
 592 $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail
 593 $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail
 594 $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail
 595 $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail
 596 $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail
 597 # still allows replace
 598 #FIXME
 599 #$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 || fail
 600 #$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 2>/dev/null && fail
 601
 602 prepare "[24] Keyfile limit" wipe
 603 $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEY1 --key-slot 0 -l 13 || fail
 604 $CRYPTSETUP --key-file=$KEY1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
 605 $CRYPTSETUP --key-file=$KEY1 -l 0 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
 606 $CRYPTSETUP --key-file=$KEY1 -l -1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
 607 $CRYPTSETUP --key-file=$KEY1 -l 14 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
 608 $CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
 609 $CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset -1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
 610 $CRYPTSETUP --key-file=$KEY1 -l 13 luksOpen $LOOPDEV $DEV_NAME || fail
 611 $CRYPTSETUP luksClose  $DEV_NAME || fail
 612 $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 2>/dev/null && fail
 613 $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 -l 14 2>/dev/null && fail
 614 $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 -l -1 2>/dev/null && fail
 615 $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT -l 13 --new-keyfile-size 12 || fail
 616 $CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 2>/dev/null && fail
 617 $CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 -l 12 || fail
 618 $CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 2>/dev/null && fail
 619 [ $? -ne 2 ] && fail "luksChangeKey should return EPERM exit code"
 620 $CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 -l 14 2>/dev/null && fail
 621 $CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT -l 13 || fail
 622 # -l is ignored for stdin if _only_ passphrase is used
 623 echo $PWD1 | $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY2 $FAST_PBKDF_OPT || fail
 624 # this is stupid, but expected
 625 echo $PWD1 | $CRYPTSETUP luksRemoveKey $LOOPDEV -l 11 2>/dev/null && fail
 626 echo $PWDW"0" | $CRYPTSETUP luksRemoveKey $LOOPDEV -l 12 2>/dev/null && fail
 627 echo -e "$PWD1\n" | $CRYPTSETUP luksRemoveKey $LOOPDEV -d- -l 12 || fail
 628 # offset
 629 $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEY1 --key-slot 0 -l 13 --keyfile-offset 16 || fail
 630 $CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 15 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
 631 $CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 16 luksOpen $LOOPDEV $DEV_NAME || fail
 632 $CRYPTSETUP luksClose  $DEV_NAME || fail
 633 $CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 -l 13 --keyfile-offset 16 $KEY2 --new-keyfile-offset 1 || fail
 634 $CRYPTSETUP --key-file=$KEY2 --keyfile-offset 11 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
 635 $CRYPTSETUP --key-file=$KEY2 --keyfile-offset 1 luksOpen $LOOPDEV $DEV_NAME || fail
 636 $CRYPTSETUP luksClose  $DEV_NAME || fail
 637 $CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY2 --keyfile-offset 1 $KEY2 --new-keyfile-offset 0 || fail
 638 $CRYPTSETUP luksOpen -d $KEY2 $LOOPDEV $DEV_NAME || fail
 639 $CRYPTSETUP luksClose $DEV_NAME || fail
 640
 641 prepare "[26] Suspend/Resume" wipe
 642 # LUKS
 643 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV || fail
 644 echo $PWD1 | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail
 645 $CRYPTSETUP luksSuspend $DEV_NAME || fail
 646 $CRYPTSETUP -q status  $DEV_NAME | grep -q "(suspended)" || fail
 647 $CRYPTSETUP -q resize  $DEV_NAME 2>/dev/null && fail
 648 echo $PWDW | $CRYPTSETUP luksResume $DEV_NAME 2>/dev/null && fail
 649 [ $? -ne 2 ] && fail "luksResume should return EPERM exit code"
 650 echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME  || fail
 651 $CRYPTSETUP -q luksClose $DEV_NAME || fail
 652
 653 prepare "[27] luksOpen with specified key slot number" wipe
 654 # first, let's try passphrase option
 655 echo $PWD3 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT -S 5 --type luks2 $LOOPDEV || fail
 656 echo $PWD3 | $CRYPTSETUP luksOpen -S 4 $LOOPDEV $DEV_NAME 2>/dev/null && fail
 657 [ -b /dev/mapper/$DEV_NAME ] && fail
 658 echo $PWD3 | $CRYPTSETUP luksOpen -S 5 $LOOPDEV $DEV_NAME || fail
 659 check_exists
 660 $CRYPTSETUP luksClose $DEV_NAME || fail
 661 echo -e "$PWD3\n$PWD1" | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 0 $LOOPDEV || fail
 662 echo $PWD3 | $CRYPTSETUP luksOpen -S 0 $LOOPDEV $DEV_NAME 2>/dev/null && fail
 663 [ -b /dev/mapper/$DEV_NAME ] && fail
 664 echo $PWD1 | $CRYPTSETUP luksOpen -S 5 $LOOPDEV $DEV_NAME 2>/dev/null && fail
 665 [ -b /dev/mapper/$DEV_NAME ] && fail
 666 # second, try it with keyfiles
 667 $CRYPTSETUP -q luksFormat -q -S 5 $FAST_PBKDF_OPT -d $KEY5 --type luks2 $LOOPDEV || fail
 668 $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 || fail
 669 $CRYPTSETUP luksOpen -S 5 -d $KEY5 $LOOPDEV $DEV_NAME || fail
 670 check_exists
 671 $CRYPTSETUP luksClose $DEV_NAME || fail
 672 $CRYPTSETUP luksOpen -S 1 -d $KEY5 $LOOPDEV $DEV_NAME 2>/dev/null && fail
 673 [ -b /dev/mapper/$DEV_NAME ] && fail
 674 $CRYPTSETUP luksOpen -S 5 -d $KEY1 $LOOPDEV $DEV_NAME 2>/dev/null && fail
 675 [ -b /dev/mapper/$DEV_NAME ] && fail
 676 # test keyslot not assigned to segment is unable to unlock volume
 677 # otoh it should be allowed to test for proper passphrase
 678 prepare "" new
 679 echo $PWD1 | $CRYPTSETUP open -S1 --test-passphrase $HEADER_KEYU || fail
 680 echo $PWD1 | $CRYPTSETUP open --test-passphrase $HEADER_KEYU || fail
 681 echo $PWD1 | $CRYPTSETUP open -S1 $HEADER_KEYU $DEV_NAME 2>/dev/null && fail
 682 [ -b /dev/mapper/$DEV_NAME ] && fail
 683 echo $PWD1 | $CRYPTSETUP open $HEADER_KEYU $DEV_NAME 2>/dev/null && fail
 684 [ -b /dev/mapper/$DEV_NAME ] && fail
 685 echo $PWD0 | $CRYPTSETUP open -S1 --test-passphrase $HEADER_KEYU $DEV_NAME 2>/dev/null && fail
 686 $CRYPTSETUP luksKillSlot -q $HEADER_KEYU 0
 687 $CRYPTSETUP luksDump $HEADER_KEYU | grep -q "0: luks2" && fail
 688 echo $PWD1 | $CRYPTSETUP open -S1 --test-passphrase $HEADER_KEYU || fail
 689 echo $PWD1 | $CRYPTSETUP open --test-passphrase $HEADER_KEYU || fail
 690 echo $PWD1 | $CRYPTSETUP open -S1 $HEADER_KEYU $DEV_NAME 2>/dev/null && fail
 691
 692 prepare "[28] Detached LUKS header" wipe
 693 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG || fail
 694 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG --align-payload 1 >/dev/null 2>&1 && fail
 695 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG --align-payload 8192 || fail
 696 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG --align-payload 4096 >/dev/null || fail
 697 $CRYPTSETUP luksDump $HEADER_IMG | grep -e "0: crypt" -A1 | grep -qe $((4096*512)) || fail
 698 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG --align-payload 0 || fail
 699 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV-missing --header $HEADER_IMG $DEV_NAME 2>/dev/null && fail
 700 echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail
 701 echo $PWD1 | $CRYPTSETUP -q resize  $DEV_NAME --size 100 --header $HEADER_IMG || fail
 702 $CRYPTSETUP -q status  $DEV_NAME --header $HEADER_IMG | grep "size:" | grep -q "100 sectors" || fail
 703 $CRYPTSETUP -q status  $DEV_NAME | grep "type:" | grep -q "n/a" || fail
 704 $CRYPTSETUP -q status  $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail
 705 $CRYPTSETUP luksSuspend $DEV_NAME --header $HEADER_IMG || fail
 706 echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME --header $HEADER_IMG || fail
 707 $CRYPTSETUP luksSuspend $DEV_NAME || fail
 708 echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME && fail
 709 echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME --header $HEADER_IMG || fail
 710 $CRYPTSETUP luksClose $DEV_NAME || fail
 711 echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 5 _fakedev_ --header $HEADER_IMG $KEY5 || fail
 712 $CRYPTSETUP luksDump _fakedev_ --header $HEADER_IMG | grep -q "5: luks2" || fail
 713 $CRYPTSETUP luksKillSlot -q _fakedev_ --header $HEADER_IMG 5 || fail
 714 $CRYPTSETUP luksDump _fakedev_ --header $HEADER_IMG | grep -q "5: luks2" && fail
 715 echo $PWD1 | $CRYPTSETUP open --test-passphrase $HEADER_IMG || fail
 716
 717 prepare "[29] Repair metadata" wipe
 718 xz -dk $HEADER_LUKS2_PV.xz
 719 $CRYPTSETUP isLuks --disable-locks $HEADER_LUKS2_PV && fail
 720 $CRYPTSETUP isLuks $HEADER_LUKS2_PV && fail
 721 $CRYPTSETUP isLuks --disable-locks --type luks2 $HEADER_LUKS2_PV && fail
 722 $CRYPTSETUP isLuks --type luks2 $HEADER_LUKS2_PV && fail
 723 $CRYPTSETUP -q repair $HEADER_LUKS2_PV || fail
 724 $CRYPTSETUP isLuks $HEADER_LUKS2_PV || fail
 725 $CRYPTSETUP isLuks --type luks2 $HEADER_LUKS2_PV || fail
 726 $CRYPTSETUP isLuks --type luks1 $HEADER_LUKS2_PV && fail
 727
 728 prepare "[30] LUKS erase" wipe
 729 $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEY5 --key-slot 5 || fail
 730 $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 || fail
 731 $CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" || fail
 732 $CRYPTSETUP luksDump $LOOPDEV | grep -q "5: luks2" || fail
 733 $CRYPTSETUP luksErase -q $LOOPDEV || fail
 734 $CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" && fail
 735 $CRYPTSETUP luksDump $LOOPDEV | grep -q "5: luks2" && fail
 736
 737 prepare "[31] LUKS convert" wipe
 738 $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks1 $LOOPDEV $KEY5 --key-slot 5 || fail
 739 $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 || fail
 740 $CRYPTSETUP -q convert --type luks1 $LOOPDEV >/dev/null 2>&1 && fail
 741 $CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: ENABLED" || fail
 742 $CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 5: ENABLED" || fail
 743 $CRYPTSETUP -q convert --type luks2 $LOOPDEV || fail
 744 $CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" || fail
 745 $CRYPTSETUP luksDump $LOOPDEV | grep -q "5: luks2" || fail
 746 $CRYPTSETUP -q convert --type luks1 $LOOPDEV || fail
 747 # hash test
 748 $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 --sector-size 512 $LOOPDEV $KEY5 -S 0 --hash sha1 || fail
 749 $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 --hash sha256 || fail
 750 $CRYPTSETUP -q convert --type luks1 $LOOPDEV >/dev/null 2>&1 && fail
 751 $CRYPTSETUP -q luksKillSlot $LOOPDEV 1 || fail
 752 $CRYPTSETUP -q convert --type luks1 $LOOPDEV || fail
 753 $CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 0: ENABLED" || fail
 754 $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 0 -d $KEY5 || fail
 755 # sector size test
 756 $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 --sector-size 1024 $LOOPDEV $KEY5 || fail
 757 $CRYPTSETUP -q convert --type luks1 $LOOPDEV >/dev/null 2>&1 && fail
 758
 759 # create LUKS1 with data offset not aligned to 4KiB
 760 $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks1 $LOOPDEV $KEY5 --align-payload 4097 || fail
 761 $CRYPTSETUP -q convert --type luks2 $LOOPDEV || fail
 762 $CRYPTSETUP isLuks --type luks2 $LOOPDEV || fail
 763 $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 0 -d $KEY5 || fail
 764
 765 if dm_crypt_keyring_flawed; then
 766         prepare "[32a] LUKS2 keyring dm-crypt bug" wipe
 767         echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG || fail
 768         echo $PWD1 | $CRYPTSETUP open $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail
 769         $CRYPTSETUP -q status $DEV_NAME | grep "key location:" | grep -q "dm-crypt" || fail
 770         $CRYPTSETUP close $DEV_NAME || fail
 771         # key must not load in kernel key even when dm-crypt module is missing
 772         if rmmod dm-crypt > /dev/null 2>&1; then
 773                 echo $PWD1 | $CRYPTSETUP open $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail
 774                 $CRYPTSETUP -q status $DEV_NAME | grep "key location:" | grep -q "dm-crypt" || fail
 775                 $CRYPTSETUP close $DEV_NAME || fail
 776         fi
 777 fi
 778
 779 if dm_crypt_keyring_support && dm_crypt_keyring_new_kernel; then
 780         prepare "[32] LUKS2 key in keyring" wipe
 781         echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG || fail
 782
 783         # check keyring support detection works as expected
 784         rmmod dm-crypt > /dev/null 2>&1 || true
 785         echo $PWD1 | $CRYPTSETUP open $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail
 786         $CRYPTSETUP -q status $DEV_NAME | grep "key location:" | grep -q "keyring" || fail
 787         $CRYPTSETUP close $DEV_NAME || fail
 788
 789         echo $PWD1 | $CRYPTSETUP open  $LOOPDEV --disable-keyring --header $HEADER_IMG $DEV_NAME || fail
 790         $CRYPTSETUP -q status $DEV_NAME | grep "key location:" | grep -q "dm-crypt" || fail
 791         $CRYPTSETUP close $DEV_NAME || fail
 792
 793         echo $PWD1 | $CRYPTSETUP open $LOOPDEV --disable-keyring --header $HEADER_IMG $DEV_NAME || fail
 794         $CRYPTSETUP luksSuspend $DEV_NAME || fail
 795         echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME --header $HEADER_IMG || fail
 796         $CRYPTSETUP -q status $DEV_NAME | grep "key location:" | grep -q "keyring" || fail
 797         $CRYPTSETUP close $DEV_NAME || fail
 798
 799         echo $PWD1 | $CRYPTSETUP open $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail
 800         $CRYPTSETUP luksSuspend $DEV_NAME || fail
 801         echo $PWD1 | $CRYPTSETUP luksResume --disable-keyring $DEV_NAME --header $HEADER_IMG || fail
 802         $CRYPTSETUP -q status $DEV_NAME | grep "key location:" | grep -q "dm-crypt" || fail
 803         $CRYPTSETUP close $DEV_NAME || fail
 804 fi
 805
 806 # FIXME: candidate for non-root tests
 807 prepare "[33] tokens" wipe
 808 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV || fail
 809 if [ $HAVE_KEYRING -gt 0 -a -d /proc/sys/kernel/keys ]; then
 810
 811         test_and_prepare_keyring
 812
 813         $CRYPTSETUP token add $LOOPDEV --key-description $TEST_TOKEN0 --token-id 3 || fail
 814         $CRYPTSETUP luksDump $LOOPDEV | grep -q -e "3: luks2-keyring" || fail
 815         # keyslot 5 is inactive
 816         $CRYPTSETUP token add $LOOPDEV --key-description $TEST_TOKEN1 --key-slot 5 2> /dev/null && fail
 817         # key description is not reachable
 818         $CRYPTSETUP open --token-only $LOOPDEV --test-passphrase && fail
 819         # wrong passphrase
 820         load_key user $TEST_TOKEN0 "blabla" "$TEST_KEYRING" || fail "Cannot load 32 byte user key type"
 821         $CRYPTSETUP open --token-only $LOOPDEV --test-passphrase 2>/dev/null && fail
 822         load_key user $TEST_TOKEN0 $PWD1 "$TEST_KEYRING" || fail "Cannot load 32 byte user key type"
 823         $CRYPTSETUP open --token-only $LOOPDEV --test-passphrase || fail
 824         $CRYPTSETUP open --token-only $LOOPDEV $DEV_NAME || fail
 825         $CRYPTSETUP status $DEV_NAME > /dev/null || fail
 826         $CRYPTSETUP close $DEV_NAME || fail
 827         $CRYPTSETUP token remove --token-id 3 $LOOPDEV || fail
 828         $CRYPTSETUP luksDump $LOOPDEV | grep -q -e "3: luks2-keyring" && fail
 829
 830         # test we can remove keyslot with token
 831         echo -e "$PWD1\n$PWD2" | $CRYPTSETUP luksAddKey -S4 $FAST_PBKDF_OPT $LOOPDEV || fail
 832         $CRYPTSETUP token add $LOOPDEV --key-description $TEST_TOKEN1 --key-slot 4 || fail
 833         $CRYPTSETUP -q luksKillSlot $LOOPDEV 4 || fail
 834 fi
 835 echo -n "$IMPORT_TOKEN" | $CRYPTSETUP token import $LOOPDEV --token-id 10 || fail
 836 echo -n "$IMPORT_TOKEN" | $CRYPTSETUP token import $LOOPDEV --token-id 11 --json-file - || fail
 837 echo -n "$IMPORT_TOKEN" > $TOKEN_FILE0
 838 $CRYPTSETUP token import $LOOPDEV --token-id 12 --json-file $TOKEN_FILE0 || fail
 839 $CRYPTSETUP token import $LOOPDEV --token-id 12 --json-file $TOKEN_FILE0 2>/dev/null && fail
 840 $CRYPTSETUP token export $LOOPDEV --token-id 10 | diff --from-file - $TOKEN_FILE0 || fail
 841 $CRYPTSETUP token export $LOOPDEV --token-id 11 | diff --from-file - $TOKEN_FILE0 || fail
 842 $CRYPTSETUP token export $LOOPDEV --token-id 12 | diff --from-file - $TOKEN_FILE0 || fail
 843 $CRYPTSETUP token export $LOOPDEV --token-id 12 --json-file $TOKEN_FILE1 || fail
 844 diff $TOKEN_FILE0 $TOKEN_FILE1 || fail
 845 $CRYPTSETUP token export $LOOPDEV --token-id 12 > $TOKEN_FILE1 || fail
 846 diff $TOKEN_FILE0 $TOKEN_FILE1 || fail
 847
 848 prepare "[34] LUKS keyslot priority" wipe
 849 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -S 1 || fail
 850 echo -e "$PWD1\n$PWD2" | $CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -S 5 || fail
 851 $CRYPTSETUP config $LOOPDEV -S 0 --priority prefer && fail
 852 $CRYPTSETUP config $LOOPDEV -S 1 --priority bla >/dev/null 2>&1 && fail
 853 $CRYPTSETUP config $LOOPDEV -S 1 --priority ignore || fail
 854 echo $PWD1 | $CRYPTSETUP open $LOOPDEV --test-passphrase 2>/dev/null && fail
 855 echo $PWD1 | $CRYPTSETUP open $LOOPDEV --test-passphrase -S 1 || fail
 856 echo $PWD2 | $CRYPTSETUP open $LOOPDEV --test-passphrase || fail
 857 $CRYPTSETUP config $LOOPDEV -S 1 --priority normal || fail
 858 echo $PWD1 | $CRYPTSETUP open $LOOPDEV --test-passphrase || fail
 859 $CRYPTSETUP config $LOOPDEV -S 1 --priority ignore || fail
 860 echo $PWD1 | $CRYPTSETUP open $LOOPDEV --test-passphrase 2>/dev/null && fail
 861
 862 prepare "[35] LUKS label and subsystem" wipe
 863 echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV || fail
 864 $CRYPTSETUP luksDump $LOOPDEV | grep "Subsystem:" | grep -q "(no subsystem)" || fail
 865 $CRYPTSETUP luksDump $LOOPDEV | grep "Label:" | grep -q "(no label)" || fail
 866 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --subsystem SatelliteTwo --label TheLabel || fail
 867 $CRYPTSETUP luksDump $LOOPDEV | grep "Subsystem:" | grep -q "SatelliteTwo" || fail
 868 $CRYPTSETUP luksDump $LOOPDEV | grep "Label:" | grep -q "TheLabel" || fail
 869 $CRYPTSETUP config $LOOPDEV --subsystem SatelliteThree
 870 $CRYPTSETUP luksDump $LOOPDEV | grep "Subsystem:" | grep -q "SatelliteThree" || fail
 871 $CRYPTSETUP luksDump $LOOPDEV | grep "Label:" | grep -q "(no label)" || fail
 872 $CRYPTSETUP config $LOOPDEV --subsystem SatelliteThree --label TheLabel
 873 $CRYPTSETUP luksDump $LOOPDEV | grep "Subsystem:" | grep -q "SatelliteThree" || fail
 874 $CRYPTSETUP luksDump $LOOPDEV | grep "Label:" | grep -q "TheLabel" || fail
 875
 876 prepare "[36] LUKS PBKDF setting" wipe
 877 echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 --pbkdf bla $LOOPDEV >/dev/null 2>&1 && fail
 878 # Force setting, no benchmark. PBKDF2 has 1000 iterations as a minimum
 879 echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 --pbkdf pbkdf2   --pbkdf-force-iterations 999 $LOOPDEV 2>/dev/null && fail
 880 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --pbkdf pbkdf2   --pbkdf-force-iterations 1234 $LOOPDEV || fail
 881 $CRYPTSETUP luksDump $LOOPDEV | grep "Iterations:" | grep -q "1234" || fail
 882 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --pbkdf argon2id --pbkdf-force-iterations 3 $LOOPDEV 2>/dev/null && fail
 883 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --pbkdf argon2id --pbkdf-force-iterations 4 --pbkdf-memory 100000 $LOOPDEV || can_fail_fips
 884 $CRYPTSETUP luksDump $LOOPDEV | grep "PBKDF:" | grep -q "argon2id" || can_fail_fips
 885 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --pbkdf argon2i  --pbkdf-force-iterations 4 \
 886         --pbkdf-memory 1234 --pbkdf-parallel 1 $LOOPDEV || can_fail_fips
 887 $CRYPTSETUP luksDump $LOOPDEV | grep "PBKDF:" | grep -q "argon2i" || can_fail_fips
 888 $CRYPTSETUP luksDump $LOOPDEV | grep "Time cost:" | grep -q "4" || can_fail_fips
 889 $CRYPTSETUP luksDump $LOOPDEV | grep "Memory:" | grep -q "1234" || can_fail_fips
 890 $CRYPTSETUP luksDump $LOOPDEV | grep "Threads:" | grep -q "1" || can_fail_fips
 891 # Benchmark
 892 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --pbkdf argon2i -i 500 --pbkdf-memory 1234 --pbkdf-parallel 1 $LOOPDEV || can_fail_fips
 893 [ 0"$($CRYPTSETUP luksDump $LOOPDEV | grep "Time cost:" | cut -d: -f 2 | sed -e 's/\ //g')" -gt 0 ] || can_fail_fips
 894 [ 0"$($CRYPTSETUP luksDump $LOOPDEV | grep "Memory:" | cut -d: -f 2 | sed -e 's/\ //g')" -gt 0 ] || can_fail_fips
 895 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --pbkdf pbkdf2 -i 500 $LOOPDEV || fail
 896 [ 0"$($CRYPTSETUP luksDump $LOOPDEV | grep -m1 "Iterations:" | cut -d' ' -f 2 | sed -e 's/\ //g')" -gt 1000 ] || fail
 897
 898 prepare "[37] LUKS Keyslot convert" wipe
 899 $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks1 $LOOPDEV $KEY5 --key-slot 5 || fail
 900 $CRYPTSETUP -q luksConvertKey $LOOPDEV --key-file $KEY5 2>/dev/null && fail
 901 $CRYPTSETUP -q convert --type luks2 $LOOPDEV || fail
 902 $CRYPTSETUP luksDump $LOOPDEV | grep -q "5: luks2" || fail
 903 $CRYPTSETUP luksDump $LOOPDEV | grep "PBKDF:" | grep -q "pbkdf2" || fail
 904 $CRYPTSETUP -q luksConvertKey $LOOPDEV -S 5 --key-file $KEY5 --pbkdf argon2i -i1 --pbkdf-memory 32 || can_fail_fips
 905 $CRYPTSETUP luksDump $LOOPDEV | grep -q "5: luks2" || can_fail_fips
 906 echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -S 1 --key-file $KEY5 || fail
 907 $CRYPTSETUP -q luksKillSlot $LOOPDEV 5 || fail
 908 $CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" || fail
 909 $CRYPTSETUP luksDump $LOOPDEV | grep "PBKDF:" | grep -q "pbkdf2" || fail
 910 echo $PWD1 | $CRYPTSETUP -q luksConvertKey $LOOPDEV -S 1 --pbkdf argon2i -i1 --pbkdf-memory 32 || can_fail_fips
 911 $CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" || can_fail_fips
 912 echo $PWD3 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 21 --unbound -s 16 $LOOPDEV || fail
 913 echo $PWD3 | $CRYPTSETUP luksConvertKey --pbkdf-force-iterations 1001 --pbkdf pbkdf2 -S 21 $LOOPDEV || fail
 914
 915 prepare "[38] luksAddKey unbound tests" wipe
 916 $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEY5 --key-slot 5 || fail
 917 # unbound key may have arbitrary size
 918 echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --unbound -s 16 $LOOPDEV || fail
 919 echo $PWD2 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --unbound -s 32 -S 2 $LOOPDEV || fail
 920 $CRYPTSETUP luksDump $LOOPDEV | grep -q "2: luks2 (unbound)" || fail
 921 dd if=/dev/urandom of=$KEY_FILE0 bs=64 count=1 > /dev/null 2>&1 || fail
 922 echo $PWD3 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --unbound -s 512 -S 3 --master-key-file $KEY_FILE0 $LOOPDEV || fail
 923 $CRYPTSETUP luksDump $LOOPDEV | grep -q "3: luks2 (unbound)" || fail
 924 # unbound key size is required
 925 echo $PWD1 | $CRYPTSETUP -q luksAddKey --unbound $LOOPDEV 2>/dev/null && fail
 926 echo $PWD3 | $CRYPTSETUP -q luksAddKey --unbound --master-key-file /dev/urandom $LOOPDEV 2> /dev/null && fail
 927 # do not allow to replace keyslot by unbound slot
 928 echo $PWD1 | $CRYPTSETUP -q luksAddKey -S5 --unbound -s 32 $LOOPDEV 2>/dev/null && fail
 929 echo $PWD2 | $CRYPTSETUP -q open $LOOPDEV $DEV_NAME 2> /dev/null && fail
 930 echo $PWD2 | $CRYPTSETUP -q open $LOOPDEV --test-passphrase || fail
 931 echo $PWD2 | $CRYPTSETUP -q open -S2 $LOOPDEV $DEV_NAME 2> /dev/null && fail
 932 echo $PWD2 | $CRYPTSETUP -q open -S2 $LOOPDEV --test-passphrase || fail
 933 echo $PWD1 | $CRYPTSETUP -q open $LOOPDEV $DEV_NAME 2> /dev/null && fail
 934 echo $PWD1 | $CRYPTSETUP -q open $LOOPDEV --test-passphrase || fail
 935 # check we're able to change passphrase for unbound keyslot
 936 echo -e "$PWD2\n$PWD3" | $CRYPTSETUP luksChangeKey $FAST_PBKDF_OPT -S 2 $LOOPDEV || fail
 937 echo $PWD3 | $CRYPTSETUP open --test-passphrase $FAST_PBKDF_OPT -S 2 $LOOPDEV || fail
 938 echo $PWD3 | $CRYPTSETUP -q open -S 2 $LOOPDEV $DEV_NAME 2> /dev/null && fail
 939 # do not allow adding keyslot by unbound keyslot
 940 echo -e "$PWD3\n$PWD1" | $CRYPTSETUP -q luksAddKey $LOOPDEV 2> /dev/null && fail
 941 # check adding keyslot works when there's unbound keyslot
 942 echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --key-file $KEY5 -S8 || fail
 943 echo $PWD1 | $CRYPTSETUP open $LOOPDEV $DEV_NAME || fail
 944 $CRYPTSETUP close $DEV_NAME || fail
 945 $CRYPTSETUP luksKillSlot -q $LOOPDEV 2
 946 $CRYPTSETUP luksDump $LOOPDEV | grep -q "2: luks2 (unbound)" && fail
 947 echo $PWD3 | $CRYPTSETUP luksDump --unbound --master-key-file $KEY_FILE1 $LOOPDEV 2> /dev/null && fail
 948 echo $PWD3 | $CRYPTSETUP luksDump --unbound 2> /dev/null $LOOPDEV 2> /dev/null && fail
 949 echo $PWD3 | $CRYPTSETUP luksDump --unbound --master-key-file $KEY_FILE1 -S3 $LOOPDEV > /dev/null || fail
 950 diff $KEY_FILE0 $KEY_FILE1 || fail
 951 echo $PWD3 | $CRYPTSETUP luksDump --unbound --master-key-file $KEY_FILE1 -S3 $LOOPDEV 2> /dev/null && fail
 952 diff $KEY_FILE0 $KEY_FILE1 || fail
 953 rm $KEY_FILE1 || fail
 954 echo $PWD3 | $CRYPTSETUP luksDump --unbound --master-key-file $KEY_FILE1 -S3 $LOOPDEV | grep -q "Unbound Key:" && fail
 955 echo $PWD3 | $CRYPTSETUP luksDump --unbound -S3 $LOOPDEV | grep -q "Unbound Key:" || fail
 956 $CRYPTSETUP luksKillSlot -q $LOOPDEV 3 || fail
 957 $CRYPTSETUP luksDump $LOOPDEV | grep -q "3: luks2 (unbound)" && fail
 958
 959 prepare "[39] LUKS2 metadata variants" wipe
 960 tar xJf luks2_mda_images.tar.xz
 961 echo -n "$IMPORT_TOKEN" > $TOKEN_FILE0
 962 for mda in 16 32 64 128 256 512 1024 2048 4096 ; do
 963         echo -n "[$mda KiB]"
 964         echo $PWD4 | $CRYPTSETUP open test_image_$mda $DEV_NAME || fail
 965         $CRYPTSETUP close $DEV_NAME || fail
 966         echo -e "$PWD4\n$PWD3" | $CRYPTSETUP luksAddKey -S9 $FAST_PBKDF_OPT test_image_$mda || fail
 967         echo $PWD4 | $CRYPTSETUP open --test-passphrase test_image_$mda || fail
 968         echo $PWD3 | $CRYPTSETUP open -S9 --test-passphrase test_image_$mda || fail
 969         echo -n "$IMPORT_TOKEN" | $CRYPTSETUP token import test_image_$mda --token-id 10 || fail
 970         $CRYPTSETUP token export test_image_$mda --token-id 10 | diff --from-file - $TOKEN_FILE0 || fail
 971         echo -n "[OK]"
 972 done
 973 echo
 974
 975 prepare "[40] LUKS2 metadata areas" wipe
 976 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV 2> /dev/null || fail
 977 DEFAULT_OFFSET=$($CRYPTSETUP luksDump $LOOPDEV | grep "offset: " | cut -f 2 -d ' ')
 978 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks1 $LOOPDEV --key-size 256 --luks2-metadata-size=128k --luks2-keyslots-size=128k 2> /dev/null && fail
 979 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --luks2-metadata-size=128k --luks2-keyslots-size=127k 2> /dev/null && fail
 980 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --luks2-metadata-size=127k --luks2-keyslots-size=128k 2> /dev/null && fail
 981 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --luks2-metadata-size=128k --luks2-keyslots-size=128M >/dev/null 2>&1 && fail
 982 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --luks2-metadata-size=128k --luks2-keyslots-size=128k >/dev/null || fail
 983 $CRYPTSETUP luksDump $LOOPDEV | grep "Metadata area:" | grep -q "131072 \[bytes\]" || fail
 984 $CRYPTSETUP luksDump $LOOPDEV | grep "Keyslots area:" | grep -q "131072 \[bytes\]" || fail
 985 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --luks2-metadata-size=128k || fail
 986 $CRYPTSETUP luksDump $LOOPDEV | grep "Metadata area:" | grep -q "131072 \[bytes\]" || fail
 987 $CRYPTSETUP luksDump $LOOPDEV | grep "Keyslots area:" | grep -q "$((DEFAULT_OFFSET-2*131072)) \[bytes\]" || fail
 988 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --luks2-keyslots-size=128k >/dev/null || fail
 989 $CRYPTSETUP luksDump $LOOPDEV | grep "Metadata area:" | grep -q "16384 \[bytes\]" || fail
 990 $CRYPTSETUP luksDump $LOOPDEV | grep "Keyslots area:" | grep -q "131072 \[bytes\]" || fail
 991 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --offset 16384 || fail
 992 $CRYPTSETUP luksDump $LOOPDEV | grep "Metadata area:" | grep -q "16384 \[bytes\]" || fail
 993 $CRYPTSETUP luksDump $LOOPDEV | grep "Keyslots area:" | grep -q "8355840 \[bytes\]" || fail
 994 # data offset vs area size
 995 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --offset 64 --luks2-keyslots-size=8192 >/dev/null 2>&1 && fail
 996 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --offset $((256+56)) >/dev/null 2>&1 && fail
 997 echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --offset $((256+64)) >/dev/null || fail
 998
 999 prepare "[41] Per-keyslot encryption parameters" wipe
1000 KEYSLOT_CIPHER="aes-cbc-plain64"
1001 $CRYPTSETUP -q luksFormat --type luks2 $LOOPDEV $KEY1 $FAST_PBKDF_OPT --key-slot 0 --keyslot-cipher $KEYSLOT_CIPHER --keyslot-key-size 128 || fail
1002 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep "Cipher:"    | sed -e 's/[[:space:]]\+Cipher:\ \+//g')" = $KEYSLOT_CIPHER ] || fail
1003 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep "Cipher key:"| sed -e 's/[[:space:]]\+Cipher\ key:\ \+//g')" = "128 bits" ] || fail
1004 $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT --key-slot 1 --keyslot-cipher $KEYSLOT_CIPHER --keyslot-key-size 128 || fail
1005 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "1: luks2" | grep "Cipher:"    | sed -e 's/[[:space:]]\+Cipher:\ \+//g')" = $KEYSLOT_CIPHER ] || fail
1006 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "1: luks2" | grep "Cipher key:"| sed -e 's/[[:space:]]\+Cipher\ key:\ \+//g')" = "128 bits" ] || fail
1007 $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT --key-slot 2 || fail
1008 $CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY2 $KEY1 --key-slot 2 --keyslot-cipher $KEYSLOT_CIPHER --keyslot-key-size 128 || fail
1009 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "2: luks2" | grep "Cipher:"    | sed -e 's/[[:space:]]\+Cipher:\ \+//g')" = $KEYSLOT_CIPHER ] || fail
1010 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "2: luks2" | grep "Cipher key:"| sed -e 's/[[:space:]]\+Cipher\ key:\ \+//g')" = "128 bits" ] || fail
1011 # unbound keyslot
1012 echo $PWD3 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --key-slot 21 --unbound -s 32 --keyslot-cipher $KEYSLOT_CIPHER --keyslot-key-size 128 $LOOPDEV || fail
1013 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "21: luks2" | grep "Cipher:"    | sed -e 's/[[:space:]]\+Cipher:\ \+//g')" = $KEYSLOT_CIPHER ] || fail
1014 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "21: luks2" | grep "Cipher key:"| sed -e 's/[[:space:]]\+Cipher\ key:\ \+//g')" = "128 bits" ] || fail
1015 echo $PWD3 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --key-slot 22 --unbound -s 32 $LOOPDEV || fail
1016 echo $PWD3 | $CRYPTSETUP luksConvertKey --key-slot 22 $LOOPDEV --keyslot-cipher $KEYSLOT_CIPHER --keyslot-key-size 128 $LOOPDEV || fail
1017 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "22: luks2" | grep "Cipher:"    | sed -e 's/[[:space:]]\+Cipher:\ \+//g')" = $KEYSLOT_CIPHER ] || fail
1018 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "22: luks2" | grep "Cipher key:"| sed -e 's/[[:space:]]\+Cipher\ key:\ \+//g')" = "128 bits" ] || fail
1019
1020 remove_mapping
1021 exit 0