"Fossies" - the Fresh Open Source Software Archive 
Member "cryptsetup-2.4.3/tests/reencryption-compat-test2" (13 Jan 2022, 17337 Bytes) of package /linux/misc/cryptsetup-2.4.3.tar.xz:
As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) Bash source code syntax highlighting (style:
standard) with prefixed line numbers and
code folding option.
Alternatively you can here
view or
download the uninterpreted source code file.
See also the last
Fossies "Diffs" side-by-side code changes report for "reencryption-compat-test2":
2.3.6_vs_2.4.0.
1 #!/bin/bash
2
3 [ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".."
4 CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup
5 REENC=$CRYPTSETUP_PATH/cryptsetup-reencrypt
6 FAST_PBKDF_ARGON="--pbkdf argon2i --pbkdf-force-iterations 4 --pbkdf-memory 32 --pbkdf-parallel 1"
7 FAST_PBKDF_PBKDF2="--pbkdf-force-iterations 1000 --pbkdf pbkdf2"
8
9 DEV_NAME=reenc9768
10 DEV_NAME2=reenc1273
11 IMG=reenc-data
12 IMG_HDR=$IMG.hdr
13 ORIG_IMG=reenc-data-orig
14 KEY1=key1
15 PWD1="93R4P4pIqAH8"
16 PWD2="1cND4319812f"
17 PWD3="1-9Qu5Ejfnqv"
18
19 MNT_DIR=./mnt_luks
20 START_DIR=$(pwd)
21 [ -f /etc/system-fips ] && FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null)
22
23 function fips_mode()
24 {
25 [ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ]
26 }
27
28 function dm_crypt_features()
29 {
30 local VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv)
31 [ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version."
32
33 local VER_MAJ=$(echo $VER_STR | cut -f 1 -d.)
34 local VER_MIN=$(echo $VER_STR | cut -f 2 -d.)
35
36 [ $VER_MAJ -lt 1 ] && return
37 [ $VER_MAJ -eq 1 -a $VER_MIN -lt 11 ] && return
38 ALLOW_DISCARDS=--allow-discards
39 [ $VER_MAJ -eq 1 -a $VER_MIN -lt 14 ] && return
40 PERF_CPU=--perf-same_cpu_crypt
41 }
42
43 function del_scsi_device()
44 {
45 rmmod scsi_debug >/dev/null 2>&1
46 sleep 2
47 }
48
49 function remove_mapping()
50 {
51 [ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove --retry $DEV_NAME2
52 [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove --retry $DEV_NAME
53 rm -f $IMG $IMG_HDR $ORIG_IMG $KEY1 >/dev/null 2>&1
54 umount $MNT_DIR > /dev/null 2>&1
55 rmdir $MNT_DIR > /dev/null 2>&1
56 del_scsi_device
57 }
58
59 function fail()
60 {
61 [ -n "$1" ] && echo "$1"
62 echo "FAILED backtrace:"
63 while caller $frame; do ((frame++)); done
64 cd $START_DIR
65 remove_mapping
66 exit 2
67 }
68
69 function skip()
70 {
71 [ -n "$1" ] && echo "$1"
72 exit 77
73 }
74
75 function add_scsi_device() {
76 del_scsi_device
77 if [ -d /sys/module/scsi_debug ] ; then
78 echo "Cannot use scsi_debug module (in use or compiled-in), test skipped."
79 exit 77
80 fi
81 modprobe scsi_debug $@ delay=0 >/dev/null 2>&1
82 if [ $? -ne 0 ] ; then
83 echo "This kernel seems to not support proper scsi_debug module, test skipped."
84 exit 77
85 fi
86
87 sleep 2
88 SCSI_DEV="/dev/"$(grep -l -e scsi_debug /sys/block/*/device/model | cut -f4 -d /)
89 [ -b $SCSI_DEV ] || fail "Cannot find $SCSI_DEV."
90 }
91
92 function open_crypt() # $1 pwd, $2 hdr
93 {
94 if [ -n "$2" ] ; then
95 echo "$1" | $CRYPTSETUP luksOpen $IMG $DEV_NAME --header $2 || fail
96 elif [ -n "$1" ] ; then
97 echo "$1" | $CRYPTSETUP luksOpen $IMG $DEV_NAME || fail
98 else
99 $CRYPTSETUP luksOpen -d $KEY1 $IMG $DEV_NAME || fail
100 fi
101 }
102
103 function wipe_dev() # $1 dev
104 {
105 dd if=/dev/zero of=$1 bs=256k conv=notrunc >/dev/null 2>&1
106 }
107
108 function wipe() # $1 pass
109 {
110 open_crypt $1
111 wipe_dev /dev/mapper/$DEV_NAME
112 udevadm settle >/dev/null 2>&1
113 $CRYPTSETUP luksClose $DEV_NAME || fail
114 }
115
116 function prepare() # $1 dev1_siz
117 {
118 remove_mapping
119
120 dd if=/dev/zero of=$IMG bs=1k count=$1 >/dev/null 2>&1
121
122 if [ ! -e $KEY1 ]; then
123 dd if=/dev/urandom of=$KEY1 count=1 bs=32 >/dev/null 2>&1
124 fi
125 }
126
127 function check_hash_dev() # $1 dev, $2 hash, $3 size
128 {
129 if [ -n "$3" ]; then
130 HASH=$(head -c $3 $1 | sha256sum | cut -d' ' -f 1)
131 else
132 HASH=$(sha256sum $1 | cut -d' ' -f 1)
133 fi
134 [ $HASH != "$2" ] && fail "HASH differs ($HASH)"
135 }
136
137 function check_hash() # $1 pwd, $2 hash, $3 hdr
138 {
139 open_crypt $1 $3
140 check_hash_dev /dev/mapper/$DEV_NAME $2
141 $CRYPTSETUP remove $DEV_NAME || fail
142 }
143
144 function backup_orig()
145 {
146 sync
147 cp $IMG $ORIG_IMG
148 }
149
150 function rollback()
151 {
152 sync
153 cp $ORIG_IMG $IMG
154 }
155
156 function check_slot() #space separated list of active key slots
157 {
158 local _out=$($CRYPTSETUP luksDump $IMG | grep -e ": luks2" | sed -e 's/[[:space:]]*\([0-9]\+\):.*/\1/g')
159
160 local _req
161 local _hdr
162 local _j
163
164 for _i in $*; do
165 _j=$((_i))
166 _req="$_req $_j"
167 done
168
169 for _i in $_out; do
170 _j=$((_i))
171 _hdr="$_hdr $_j"
172 done
173
174 test "$_req" = "$_hdr"
175 }
176
177 function simple_scsi_reenc()
178 {
179 echo -n "$1"
180 echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 $FAST_PBKDF_ARGON $SCSI_DEV || fail
181
182 echo $PWD1 | $CRYPTSETUP luksOpen $SCSI_DEV $DEV_NAME || fail
183 HASH=$(sha256sum /dev/mapper/$DEV_NAME | cut -d' ' -f 1)
184 $CRYPTSETUP luksClose $DEV_NAME || fail
185
186 echo $PWD1 | $REENC -q $FAST_PBKDF_ARGON $SCSI_DEV || fail
187
188 echo $PWD1 | $CRYPTSETUP luksOpen $SCSI_DEV $DEV_NAME || fail
189 check_hash_dev /dev/mapper/$DEV_NAME $HASH
190 $CRYPTSETUP luksClose $DEV_NAME || fail
191 }
192
193 function mount_and_test() {
194 test -d $MNT_DIR || mkdir -p $MNT_DIR
195 mount $@ $MNT_DIR 2>/dev/null || {
196 echo -n "failed to mount [SKIP]"
197 return 0
198 }
199 rm $MNT_DIR/* 2>/dev/null
200 cd $MNT_DIR
201
202 if [ "${REENC:0:1}" != "/" ] ; then
203 MNT_REENC=$START_DIR/$REENC
204 else
205 MNT_REENC=$REENC
206 fi
207 echo $PWD2 | $MNT_REENC $START_DIR/$IMG -q --use-fsync --use-directio --write-log $FAST_PBKDF_ARGON || return 1
208 cd $START_DIR
209 umount $MNT_DIR
210 echo -n [OK]
211 }
212
213 function test_logging_tmpfs() {
214 echo -n "[tmpfs]"
215 mount_and_test -t tmpfs none -o size=$[25*1024*1024] || return 1
216 echo
217 }
218
219 function test_logging() {
220 echo -n "$1:"
221 for img in $(ls img_fs*img.xz) ; do
222 wipefs -a $SCSI_DEV > /dev/null
223 echo -n "[${img%.img.xz}]"
224 xz -d -c $img | dd of=$SCSI_DEV bs=4k >/dev/null 2>&1
225 mount_and_test $SCSI_DEV || return 1
226 done
227 echo
228 }
229
230 [ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
231 [ ! -x "$REENC" ] && skip "Cannot find $REENC, test skipped."
232 which wipefs >/dev/null || skip "Cannot find wipefs, test skipped."
233 fips_mode && skip "This test cannot be run in FIPS mode."
234
235 # REENCRYPTION tests
236
237 HASH1=b69dae56a14d1a8314ed40664c4033ea0a550eea2673e04df42a66ac6b9faf2c
238 HASH4=2daeb1f36095b44b318410b3f4e8b5d989dcc7bb023d1426c492dab0a3053e74
239 HASH5=bb9f8df61474d25e71fa00722318cd387396ca1736605e1248821cc0de3d3af8
240 HASH6=4d9cbaf3aa0935a8c113f139691b3daf9c94c8d6c278aedc8eec66a4b9f6c8ae
241 HASH7=5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef
242
243 echo "[1] Reencryption"
244 prepare 8192
245 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 -c aes-cbc-plain $FAST_PBKDF_ARGON --offset 8192 $IMG || fail
246 wipe $PWD1
247 check_hash $PWD1 $HASH5
248 echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_ARGON
249 check_hash $PWD1 $HASH5
250 echo $PWD1 | $REENC $IMG -q -s 256 $FAST_PBKDF_ARGON
251 check_hash $PWD1 $HASH5
252 echo $PWD1 | $REENC $IMG -q -s 256 -c aes-xts-plain64 -h sha256 $FAST_PBKDF_ARGON
253 check_hash $PWD1 $HASH5
254 echo $PWD1 | $REENC $IMG -q --use-directio $FAST_PBKDF_ARGON
255 check_hash $PWD1 $HASH5
256 echo $PWD1 | $REENC $IMG -q --master-key-file /dev/urandom $FAST_PBKDF_ARGON
257 check_hash $PWD1 $HASH5
258 echo $PWD1 | $REENC $IMG -q -s 512 --master-key-file /dev/urandom $FAST_PBKDF_ARGON
259 check_hash $PWD1 $HASH5
260 $CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail
261 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 --luks2-metadata-size 128k -c aes-cbc-plain $FAST_PBKDF_ARGON --offset 8192 $IMG > /dev/null || fail
262 wipe $PWD1
263 check_hash $PWD1 $HASH5
264 echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_ARGON > /dev/null || fail
265 check_hash $PWD1 $HASH5
266 MDA_SIZE=$($CRYPTSETUP luksDump $IMG | grep "Metadata area: " | cut -f 3 -d ' ')
267 test "$MDA_SIZE" -eq 131072 || fail "Unexpected Metadata area size $MDA_SIZE"
268
269 echo "[2] Reencryption with data shift"
270 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -c aes-cbc-essiv:sha256 -s 128 $FAST_PBKDF_ARGON --offset 8192 $IMG || fail
271 wipe $PWD1
272 echo $PWD1 | $REENC $IMG -q -s 256 --reduce-device-size 1024S $FAST_PBKDF_ARGON || fail
273 check_hash $PWD1 $HASH6
274 echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_ARGON || fail
275 check_hash $PWD1 $HASH6
276 $CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail
277
278 echo "[3] Reencryption with keyfile"
279 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -d $KEY1 -c aes-cbc-essiv:sha256 -s 128 $FAST_PBKDF_ARGON --offset 8192 $IMG || fail
280 wipe
281 check_hash "" $HASH5
282 echo $PWD1 | $CRYPTSETUP -q luksAddKey -d $KEY1 $IMG $FAST_PBKDF_ARGON || fail
283 $REENC $IMG -d $KEY1 $FAST_PBKDF_ARGON -q 2>/dev/null && fail
284 $REENC $IMG -d $KEY1 -S 0 $FAST_PBKDF_ARGON -q || fail
285 check_hash "" $HASH5
286 check_slot 0 || fail "Only keyslot 0 expected to be enabled"
287 $REENC $IMG -d $KEY1 $FAST_PBKDF_ARGON -q || fail
288 $CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail
289 # FIXME echo $PWD1 | $REENC ...
290
291 echo "[4] Encryption of not yet encrypted device"
292 # well, movin' zeroes :-)
293 OFFSET=8192 # default LUKS2 header size
294 prepare 8192
295 check_hash_dev $IMG $HASH4
296 echo $PWD1 | $REENC --type luks2 $IMG -c aes-cbc-essiv:sha256 -s 128 --new --reduce-device-size "$OFFSET"S -q $FAST_PBKDF_ARGON || fail
297 check_hash $PWD1 $HASH5
298 $CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail
299 # 64MiB + 1 KiB
300 prepare 65537
301 OFFSET=131072
302 check_hash_dev $IMG $HASH7 1024
303 echo $PWD1 | $REENC --type luks2 $IMG -c aes-cbc-essiv:sha256 -s 128 --new --reduce-device-size "$OFFSET"S -q $FAST_PBKDF_ARGON || fail
304 check_hash $PWD1 $HASH7
305 $CRYPTSETUP --type luks2 luksDump $IMG > /dev/null || fail
306 prepare 8192
307
308 echo "[5] Reencryption using specific keyslot"
309 echo $PWD2 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
310 echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 1 $IMG || fail
311 echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 2 $IMG || fail
312 echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 3 $IMG || fail
313 echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 4 $IMG || fail
314 echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 5 $IMG || fail
315 echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 6 $IMG || fail
316 echo -e "$PWD2\n$PWD3" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 22 $IMG || fail
317 backup_orig
318 echo $PWD2 | $REENC $FAST_PBKDF_ARGON -S 0 -q $IMG || fail
319 check_slot 0 || fail "Only keyslot 0 expected to be enabled"
320 wipe $PWD2
321 rollback
322 echo $PWD1 | $REENC $FAST_PBKDF_ARGON -S 1 -q $IMG || fail
323 check_slot 1 || fail "Only keyslot 1 expected to be enabled"
324 wipe $PWD1
325 rollback
326 echo $PWD2 | $REENC $FAST_PBKDF_ARGON -S 6 -q $IMG || fail
327 check_slot 6 || fail "Only keyslot 6 expected to be enabled"
328 wipe $PWD2
329 rollback
330 echo $PWD3 | $REENC $FAST_PBKDF_ARGON -S 22 -q $IMG || fail
331 check_slot 22 || fail "Only keyslot 22 expected to be enabled"
332 wipe $PWD3
333 rollback
334
335 echo "[6] Reencryption using all active keyslots"
336 echo -e "$PWD2\n$PWD1\n$PWD2\n$PWD1\n$PWD2\n$PWD1\n$PWD2\n$PWD3" | $REENC -q $IMG $FAST_PBKDF_ARGON || fail
337 check_slot 0 1 2 3 4 5 6 22 || fail "All keyslots expected to be enabled"
338
339 echo "[7] Reencryption of block devices with different block size"
340 add_scsi_device sector_size=512 dev_size_mb=32
341 simple_scsi_reenc "[512 sector]"
342 add_scsi_device sector_size=4096 dev_size_mb=32
343 simple_scsi_reenc "[4096 sector]"
344 add_scsi_device sector_size=512 physblk_exp=3 dev_size_mb=32
345 simple_scsi_reenc "[4096/512 sector]"
346 echo "[OK]"
347
348 echo "[8] Header only reencryption (hash and iteration time)"
349 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
350 wipe $PWD1
351 check_hash $PWD1 $HASH5
352 echo $PWD1 | $REENC $IMG -q --keep-key || fail
353 check_hash $PWD1 $HASH5
354 echo $PWD1 | $REENC $IMG -q --keep-key --pbkdf pbkdf2 --pbkdf-force-iterations 999 2>/dev/null && fail
355 check_hash $PWD1 $HASH5
356 echo $PWD1 | $REENC $IMG -q --keep-key --pbkdf-force-iterations 3 2>/dev/null && fail
357 check_hash $PWD1 $HASH5
358 echo $PWD1 | $REENC $IMG -q --keep-key --pbkdf-force-iterations 4 --pbkdf-memory 31 2>/dev/null && fail
359 check_hash $PWD1 $HASH5
360 echo $PWD1 | $REENC $IMG -q --keep-key --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --hash sha512
361 check_hash $PWD1 $HASH5
362 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep PBKDF: | sed -e 's/[[:space:]]\+PBKDF:\ \+//g')" = "pbkdf2" ] || fail
363 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep Hash: | sed -e 's/[[:space:]]\+Hash:\ \+//g')" = "sha512" ] || fail
364 echo $PWD1 | $REENC $IMG -q --keep-key $FAST_PBKDF_ARGON
365 check_hash $PWD1 $HASH5
366 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep PBKDF: | sed -e 's/[[:space:]]\+PBKDF:\ \+//g')" = argon2i ] || fail
367 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep "Time cost" | sed -e 's/[[:space:]]\+Time\ cost:\ \+//g')" -eq 4 ] || fail
368 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep Memory | sed -e 's/[[[:space:]]\+Memory:\ \+//g')" -eq 32 ] || fail
369 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep Threads | sed -e 's/[[[:space:]]\+Threads:\ \+//g')" -eq 1 ] || fail
370 echo -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksAddKey -S21 $FAST_PBKDF_ARGON $IMG || fail
371 echo $PWD2 | $REENC -S21 -q --keep-key --pbkdf pbkdf2 --pbkdf-force-iterations 1000 $IMG || fail
372 check_hash $PWD2 $HASH5
373 check_slot 21 || fail "Only keyslot 21 expected to be enabled"
374 $CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail
375
376 echo "[9] Test log I/Os on various underlying block devices"
377 echo $PWD2 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
378 add_scsi_device sector_size=512 dev_size_mb=32
379 test_logging "[512 sector]" || fail
380 add_scsi_device sector_size=4096 dev_size_mb=32
381 test_logging "[4096 sector]" || fail
382 add_scsi_device sector_size=512 dev_size_mb=32 physblk_exp=3
383 test_logging "[4096/512 sector]" || fail
384 test_logging_tmpfs || fail
385
386 echo "[10] Removal of encryption"
387 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
388 wipe $PWD1
389 check_hash $PWD1 $HASH5
390 echo $PWD1 | $REENC $IMG -q --decrypt || fail
391 check_hash_dev $IMG $HASH4
392
393 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -S5 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
394 wipe $PWD1
395 check_hash $PWD1 $HASH5
396 echo $PWD1 | $REENC $IMG -q --decrypt || fail
397 check_hash_dev $IMG $HASH4
398
399 echo "[11] Reencryption with tokens"
400 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
401 wipe $PWD1
402 check_hash $PWD1 $HASH5
403 echo -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksAddKey -S23 $FAST_PBKDF_ARGON $IMG || fail
404 echo -e "$PWD1\n$PWD3" | $CRYPTSETUP -q luksAddKey -S1 $FAST_PBKDF_ARGON $IMG || fail
405 echo -e "$PWD1\n$PWD3" | $CRYPTSETUP -q luksAddKey -S3 $FAST_PBKDF_ARGON $IMG || fai
406 $CRYPTSETUP token add --key-description key-name0 --key-slot 23 --token-id 0 $IMG
407 $CRYPTSETUP token add --key-description key-name2 --key-slot 1 --token-id 2 $IMG
408 $CRYPTSETUP token add --key-description key-name31 --token-id 31 $IMG
409 echo $PWD1 | $CRYPTSETUP -q luksKillSlot $IMG 3 || fail
410 echo $PWD2 | $REENC $FAST_PBKDF_ARGON -S 23 -q $IMG || fail
411 $CRYPTSETUP luksDump $IMG | grep "0: luks2-keyring" >/dev/null || fail
412 [ "$($CRYPTSETUP luksDump $IMG | grep -A2 -m1 "0: luks2-keyring" | grep Keyslot: | sed -e 's/[[[:space:]]\+Keyslot:\ \+//g')" -eq 23 ] || fail
413 $CRYPTSETUP luksDump $IMG | grep "2: luks2-keyring" >/dev/null || fail
414 $CRYPTSETUP luksDump $IMG | grep "31: luks2-keyring" >/dev/null || fail
415 [ "$($CRYPTSETUP luksDump $IMG | grep -A2 -m1 "31: luks2-keyring" | grep Keyslot: | sed -e 's/[[[:space:]]\+Keyslot:\ \+//g')" -eq 23 ] || fail
416
417 echo "[12] Reencryption with persistent flags"
418 dm_crypt_features
419 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
420 wipe $PWD1
421 check_hash $PWD1 $HASH5
422 echo $PWD1 | $CRYPTSETUP open $IMG $DEV_NAME $ALLOW_DISCARDS $PERF_CPU --persistent || fail
423 $CRYPTSETUP close $DEV_NAME || fail
424 echo $PWD1 | $REENC $FAST_PBKDF_ARGON -q $IMG || fail
425 if [ -n "$PERF_CPU" ]; then
426 $CRYPTSETUP luksDump $IMG | grep -m1 Flags: | grep same-cpu-crypt > /dev/null || fail
427 fi
428 if [ -n "$ALLOW_DISCARDS" ]; then
429 $CRYPTSETUP luksDump $IMG | grep -m1 Flags: | grep allow-discards > /dev/null || fail
430 fi
431
432 echo "[13] Detached header - adding encryption/reencryption/decryption"
433 prepare 8192
434 check_hash_dev $IMG $HASH4
435 echo $PWD1 | $REENC --type luks2 $IMG -q $FAST_PBKDF_ARGON --header $IMG_HDR --new
436 check_hash $PWD1 $HASH4 $IMG_HDR
437 echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_ARGON --header $IMG_HDR
438 check_hash $PWD1 $HASH4 $IMG_HDR
439 echo $PWD1 | $REENC $IMG -q --header $IMG_HDR --decrypt
440 check_hash_dev $IMG $HASH4
441 # existing header of zero size
442 cat /dev/null >$IMG_HDR
443 echo $PWD1 | $REENC --type luks2 $IMG -q $FAST_PBKDF_ARGON --header $IMG_HDR --new
444 check_hash $PWD1 $HASH4 $IMG_HDR
445 $CRYPTSETUP isLuks $IMG && fail
446 $CRYPTSETUP isLuks $IMG_HDR || fail
447 $CRYPTSETUP luksDump $IMG_HDR | grep -q "0: luks2" || fail
448
449 echo "[14] Reencryption with unbound keyslot"
450 prepare 8192
451 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
452 echo $PWD2 | $CRYPTSETUP -q luksAddKey -S 3 --unbound --key-size 64 $FAST_PBKDF_ARGON $IMG || fail
453 wipe $PWD1
454 check_hash $PWD1 $HASH5
455 $CRYPTSETUP luksDump $IMG | grep -q "3: luks2 (unbound)" || fail
456 echo $PWD2 | $REENC $IMG -q $FAST_PBKDF_ARGON 2>/dev/null && fail
457 echo -e "$PWD1\n$PWD2" | $REENC $IMG -q $FAST_PBKDF_ARGON || fail
458 $CRYPTSETUP luksDump $IMG | grep -q "3: luks2 (unbound)" || fail
459
460 echo "[15] Reencryption after conversion"
461 prepare 8192
462 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_PBKDF2 $IMG --offset 4096 || fail
463 wipe $PWD1
464 check_hash $PWD1 $HASH1
465 $CRYPTSETUP -q convert --type luks2 $IMG || fail
466 echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_PBKDF2 || fail
467 check_hash $PWD1 $HASH1
468 echo $PWD1 | $CRYPTSETUP -q luksFormat --sector-size 512 --type luks2 $FAST_PBKDF_PBKDF2 $IMG --offset 8192 || fail
469 wipe $PWD1
470 check_hash $PWD1 $HASH5
471 $CRYPTSETUP -q convert --type luks1 $IMG || fail
472 echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_PBKDF2 || fail
473 check_hash $PWD1 $HASH5
474
475 remove_mapping
476 exit 0