1 #!/bin/bash 2 3 # check luks1 images parsing 4 5 # NOTE: if image with whirlpool hash fails, check 6 # that you are not using old gcrypt with flawed whirlpool 7 # (see cryptsetup debug output) 8 9 [ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." 10 CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup 11 TST_DIR=luks1-images 12 MAP=luks1tst 13 KEYFILE=keyfile1 14 15 [ -z "$srcdir" ] && srcdir="." 16 17 function remove_mapping() 18 { 19 [ -b /dev/mapper/$MAP ] && dmsetup remove --retry $MAP 20 rm -rf $TST_DIR 21 } 22 23 function fail() 24 { 25 [ -n "$1" ] && echo "$1" 26 echo " [FAILED]" 27 echo "FAILED backtrace:" 28 while caller $frame; do ((frame++)); done 29 remove_mapping 30 exit 2 31 } 32 33 function skip() 34 { 35 [ -n "$1" ] && echo "$1" 36 echo "Test skipped." 37 remove_mapping 38 exit 77 39 } 40 41 function test_one() 42 { 43 $CRYPTSETUP benchmark -c "$1" -s "$2" | grep -v "#" || skip 44 } 45 46 function test_required() 47 { 48 which lsblk >/dev/null 2>&1 || skip "WARNING: lsblk tool required." 49 50 echo "REQUIRED KDF TEST" 51 $CRYPTSETUP benchmark -h whirlpool | grep "N/A" && skip 52 53 echo "REQUIRED CIPHERS TEST" 54 echo "# Algorithm | Key | Encryption | Decryption" 55 56 test_one aes-xts 256 57 test_one twofish-xts 256 58 test_one serpent-xts 256 59 test_one aes-cbc 256 60 test_one aes-lrw 256 61 } 62 63 export LANG=C 64 65 test_required 66 [ ! -d $TST_DIR ] && tar xJf $srcdir/luks1-images.tar.xz --no-same-owner 67 68 echo "PASSPHRASE CHECK" 69 for file in $(ls $TST_DIR/luks1_*) ; do 70 echo -n " $file" 71 $CRYPTSETUP luksOpen -d $TST_DIR/$KEYFILE $file --test-passphrase 2>/dev/null 72 ret=$? 73 # ignore missing whirlpool (pwd failed is exit code 2) 74 [ $ret -eq 1 ] && (echo $file | grep -q -e "whirlpool") && echo " [N/A]" && continue 75 # ignore flawed whirlpool (pwd failed is exit code 2) 76 [ $ret -eq 2 ] && (echo $file | grep -q -e "whirlpool") && \ 77 ($CRYPTSETUP luksDump $file --debug | grep -q -e "flawed whirlpool") && \ 78 echo " [IGNORED (flawed Whirlpool library)]" && continue 79 [ $ret -ne 0 ] && fail 80 echo " [OK]" 81 done 82 83 if [ $(id -u) != 0 ]; then 84 echo "WARNING: You must be root to run activation part of test, test skipped." 85 remove_mapping 86 exit 0 87 fi 88 89 echo "ACTIVATION FS UUID CHECK" 90 for file in $(ls $TST_DIR/luks1_*) ; do 91 echo -n " $file" 92 $CRYPTSETUP luksOpen -d $TST_DIR/$KEYFILE $file $MAP 2>/dev/null 93 ret=$? 94 # ignore missing whirlpool (pwd failed is exit code 2) 95 [ $ret -eq 1 ] && (echo $file | grep -q -e "whirlpool") && echo " [N/A]" && continue 96 # ignore flawed whirlpool (pwd failed is exit code 2) 97 [ $ret -eq 2 ] && (echo $file | grep -q -e "whirlpool") && \ 98 ($CRYPTSETUP luksDump $file --debug | grep -q -e "flawed whirlpool") && \ 99 echo " [IGNORED (flawed Whirlpool library)]" && continue 100 [ $ret -ne 0 ] && fail 101 $CRYPTSETUP status $MAP >/dev/null || fail 102 $CRYPTSETUP status /dev/mapper/$MAP >/dev/null || fail 103 UUID=$(lsblk -n -o UUID /dev/mapper/$MAP) 104 $CRYPTSETUP remove $MAP || fail 105 [ "$UUID" != "DEAD-BABE" ] && fail "UUID check failed." 106 echo " [OK]" 107 done 108 109 remove_mapping 110 exit 0