"Fossies" - the Fresh Open Source Software Archive

Member "cryptsetup-2.4.3/tests/reencryption-compat-test2" (13 Jan 2022, 17337 Bytes) of package /linux/misc/cryptsetup-2.4.3.tar.xz:


As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) Bash source code syntax highlighting (style: standard) with prefixed line numbers and code folding option. Alternatively you can here view or download the uninterpreted source code file. See also the last Fossies "Diffs" side-by-side code changes report for "reencryption-compat-test2": 2.3.6_vs_2.4.0.

    1 #!/bin/bash
    2 
    3 [ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".."
    4 CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup
    5 REENC=$CRYPTSETUP_PATH/cryptsetup-reencrypt
    6 FAST_PBKDF_ARGON="--pbkdf argon2i --pbkdf-force-iterations 4 --pbkdf-memory 32 --pbkdf-parallel 1"
    7 FAST_PBKDF_PBKDF2="--pbkdf-force-iterations 1000 --pbkdf pbkdf2"
    8 
    9 DEV_NAME=reenc9768
   10 DEV_NAME2=reenc1273
   11 IMG=reenc-data
   12 IMG_HDR=$IMG.hdr
   13 ORIG_IMG=reenc-data-orig
   14 KEY1=key1
   15 PWD1="93R4P4pIqAH8"
   16 PWD2="1cND4319812f"
   17 PWD3="1-9Qu5Ejfnqv"
   18 
   19 MNT_DIR=./mnt_luks
   20 START_DIR=$(pwd)
   21 [ -f /etc/system-fips ] && FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null)
   22 
   23 function fips_mode()
   24 {
   25     [ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ]
   26 }
   27 
   28 function dm_crypt_features()
   29 {
   30     local VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv)
   31     [ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version."
   32 
   33     local VER_MAJ=$(echo $VER_STR | cut -f 1 -d.)
   34     local VER_MIN=$(echo $VER_STR | cut -f 2 -d.)
   35 
   36     [ $VER_MAJ -lt 1 ] && return
   37     [ $VER_MAJ -eq 1 -a $VER_MIN -lt 11 ] && return
   38     ALLOW_DISCARDS=--allow-discards
   39     [ $VER_MAJ -eq 1 -a $VER_MIN -lt 14 ] && return
   40     PERF_CPU=--perf-same_cpu_crypt
   41 }
   42 
   43 function del_scsi_device()
   44 {
   45     rmmod scsi_debug >/dev/null 2>&1
   46     sleep 2
   47 }
   48 
   49 function remove_mapping()
   50 {
   51     [ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove --retry $DEV_NAME2
   52     [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove --retry $DEV_NAME
   53     rm -f $IMG $IMG_HDR $ORIG_IMG $KEY1 >/dev/null 2>&1
   54     umount $MNT_DIR > /dev/null 2>&1
   55     rmdir $MNT_DIR > /dev/null 2>&1
   56     del_scsi_device
   57 }
   58 
   59 function fail()
   60 {
   61     [ -n "$1" ] && echo "$1"
   62     echo "FAILED backtrace:"
   63     while caller $frame; do ((frame++)); done
   64     cd $START_DIR
   65     remove_mapping
   66     exit 2
   67 }
   68 
   69 function skip()
   70 {
   71     [ -n "$1" ] && echo "$1"
   72     exit 77
   73 }
   74 
   75 function add_scsi_device() {
   76     del_scsi_device
   77     if [ -d /sys/module/scsi_debug ] ; then
   78         echo "Cannot use scsi_debug module (in use or compiled-in), test skipped."
   79         exit 77
   80     fi
   81     modprobe scsi_debug $@ delay=0 >/dev/null 2>&1
   82     if [ $? -ne 0 ] ; then
   83         echo "This kernel seems to not support proper scsi_debug module, test skipped."
   84         exit 77
   85     fi
   86 
   87     sleep 2
   88     SCSI_DEV="/dev/"$(grep -l -e scsi_debug /sys/block/*/device/model | cut -f4 -d /)
   89     [ -b $SCSI_DEV ] || fail "Cannot find $SCSI_DEV."
   90 }
   91 
   92 function open_crypt() # $1 pwd, $2 hdr
   93 {
   94     if [ -n "$2" ] ; then
   95         echo "$1" | $CRYPTSETUP luksOpen $IMG $DEV_NAME --header $2 || fail
   96     elif [ -n "$1" ] ; then
   97         echo "$1" | $CRYPTSETUP luksOpen $IMG $DEV_NAME || fail
   98     else
   99         $CRYPTSETUP luksOpen -d $KEY1 $IMG $DEV_NAME || fail
  100     fi
  101 }
  102 
  103 function wipe_dev() # $1 dev
  104 {
  105     dd if=/dev/zero of=$1 bs=256k conv=notrunc >/dev/null 2>&1
  106 }
  107 
  108 function wipe() # $1 pass
  109 {
  110     open_crypt $1
  111     wipe_dev /dev/mapper/$DEV_NAME
  112     udevadm settle >/dev/null 2>&1
  113     $CRYPTSETUP luksClose $DEV_NAME || fail
  114 }
  115 
  116 function prepare() # $1 dev1_siz
  117 {
  118     remove_mapping
  119 
  120     dd if=/dev/zero of=$IMG      bs=1k count=$1 >/dev/null 2>&1
  121 
  122     if [ ! -e $KEY1 ]; then
  123         dd if=/dev/urandom of=$KEY1 count=1 bs=32 >/dev/null 2>&1
  124     fi
  125 }
  126 
  127 function check_hash_dev() # $1 dev, $2 hash, $3 size
  128 {
  129     if [ -n "$3" ]; then
  130         HASH=$(head -c $3 $1 | sha256sum | cut -d' ' -f 1)
  131     else
  132         HASH=$(sha256sum $1 | cut -d' ' -f 1)
  133     fi
  134     [ $HASH != "$2" ] && fail "HASH differs ($HASH)"
  135 }
  136 
  137 function check_hash() # $1 pwd, $2 hash, $3 hdr
  138 {
  139     open_crypt $1 $3
  140     check_hash_dev /dev/mapper/$DEV_NAME $2
  141     $CRYPTSETUP remove $DEV_NAME || fail
  142 }
  143 
  144 function backup_orig()
  145 {
  146     sync
  147     cp $IMG $ORIG_IMG
  148 }
  149 
  150 function rollback()
  151 {
  152     sync
  153     cp $ORIG_IMG $IMG
  154 }
  155 
  156 function check_slot() #space separated list of active key slots
  157 {
  158     local _out=$($CRYPTSETUP luksDump $IMG | grep -e ": luks2" | sed -e 's/[[:space:]]*\([0-9]\+\):.*/\1/g')
  159 
  160     local _req
  161     local _hdr
  162     local _j
  163 
  164     for _i in $*; do
  165         _j=$((_i))
  166         _req="$_req $_j"
  167     done
  168 
  169     for _i in $_out; do
  170         _j=$((_i))
  171         _hdr="$_hdr $_j"
  172     done
  173 
  174     test "$_req" = "$_hdr"
  175 }
  176 
  177 function simple_scsi_reenc()
  178 {
  179     echo -n "$1"
  180     echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 $FAST_PBKDF_ARGON $SCSI_DEV || fail
  181 
  182     echo $PWD1 | $CRYPTSETUP luksOpen $SCSI_DEV $DEV_NAME || fail
  183     HASH=$(sha256sum /dev/mapper/$DEV_NAME | cut -d' ' -f 1)
  184     $CRYPTSETUP luksClose $DEV_NAME || fail
  185 
  186     echo $PWD1 | $REENC -q $FAST_PBKDF_ARGON $SCSI_DEV || fail
  187 
  188     echo $PWD1 | $CRYPTSETUP luksOpen $SCSI_DEV $DEV_NAME || fail
  189     check_hash_dev /dev/mapper/$DEV_NAME $HASH
  190     $CRYPTSETUP luksClose $DEV_NAME || fail
  191 }
  192 
  193 function mount_and_test() {
  194     test -d $MNT_DIR || mkdir -p $MNT_DIR
  195     mount $@ $MNT_DIR 2>/dev/null || {
  196         echo -n "failed to mount [SKIP]"
  197         return 0
  198     }
  199     rm $MNT_DIR/* 2>/dev/null
  200     cd $MNT_DIR
  201 
  202     if [ "${REENC:0:1}" != "/" ] ; then
  203         MNT_REENC=$START_DIR/$REENC
  204     else
  205         MNT_REENC=$REENC
  206     fi
  207     echo $PWD2 | $MNT_REENC $START_DIR/$IMG -q --use-fsync --use-directio --write-log $FAST_PBKDF_ARGON || return 1
  208     cd $START_DIR
  209     umount $MNT_DIR
  210     echo -n [OK]
  211 }
  212 
  213 function test_logging_tmpfs() {
  214     echo -n "[tmpfs]"
  215     mount_and_test -t tmpfs none -o size=$[25*1024*1024] || return 1
  216     echo
  217 }
  218 
  219 function test_logging() {
  220     echo -n "$1:"
  221     for img in $(ls img_fs*img.xz) ; do
  222         wipefs -a $SCSI_DEV > /dev/null
  223         echo -n "[${img%.img.xz}]"
  224         xz -d -c $img | dd of=$SCSI_DEV bs=4k >/dev/null 2>&1
  225         mount_and_test $SCSI_DEV || return 1
  226     done
  227     echo
  228 }
  229 
  230 [ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
  231 [ ! -x "$REENC" ] && skip "Cannot find $REENC, test skipped."
  232 which wipefs >/dev/null ||  skip "Cannot find wipefs, test skipped."
  233 fips_mode && skip "This test cannot be run in FIPS mode."
  234 
  235 # REENCRYPTION tests
  236 
  237 HASH1=b69dae56a14d1a8314ed40664c4033ea0a550eea2673e04df42a66ac6b9faf2c
  238 HASH4=2daeb1f36095b44b318410b3f4e8b5d989dcc7bb023d1426c492dab0a3053e74
  239 HASH5=bb9f8df61474d25e71fa00722318cd387396ca1736605e1248821cc0de3d3af8
  240 HASH6=4d9cbaf3aa0935a8c113f139691b3daf9c94c8d6c278aedc8eec66a4b9f6c8ae
  241 HASH7=5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef
  242 
  243 echo "[1] Reencryption"
  244 prepare 8192
  245 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 -c aes-cbc-plain $FAST_PBKDF_ARGON --offset 8192 $IMG || fail
  246 wipe $PWD1
  247 check_hash $PWD1 $HASH5
  248 echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_ARGON
  249 check_hash $PWD1 $HASH5
  250 echo $PWD1 | $REENC $IMG -q -s 256 $FAST_PBKDF_ARGON
  251 check_hash $PWD1 $HASH5
  252 echo $PWD1 | $REENC $IMG -q -s 256 -c aes-xts-plain64 -h sha256 $FAST_PBKDF_ARGON
  253 check_hash $PWD1 $HASH5
  254 echo $PWD1 | $REENC $IMG -q --use-directio $FAST_PBKDF_ARGON
  255 check_hash $PWD1 $HASH5
  256 echo $PWD1 | $REENC $IMG -q --master-key-file /dev/urandom $FAST_PBKDF_ARGON
  257 check_hash $PWD1 $HASH5
  258 echo $PWD1 | $REENC $IMG -q -s 512 --master-key-file /dev/urandom $FAST_PBKDF_ARGON
  259 check_hash $PWD1 $HASH5
  260 $CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail
  261 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 --luks2-metadata-size 128k -c aes-cbc-plain $FAST_PBKDF_ARGON --offset 8192 $IMG > /dev/null || fail
  262 wipe $PWD1
  263 check_hash $PWD1 $HASH5
  264 echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_ARGON > /dev/null || fail
  265 check_hash $PWD1 $HASH5
  266 MDA_SIZE=$($CRYPTSETUP luksDump $IMG | grep "Metadata area: " | cut -f 3 -d ' ')
  267 test "$MDA_SIZE" -eq 131072 || fail "Unexpected Metadata area size $MDA_SIZE"
  268 
  269 echo "[2] Reencryption with data shift"
  270 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -c aes-cbc-essiv:sha256 -s 128 $FAST_PBKDF_ARGON --offset 8192 $IMG || fail
  271 wipe $PWD1
  272 echo $PWD1 | $REENC $IMG -q -s 256 --reduce-device-size 1024S $FAST_PBKDF_ARGON || fail
  273 check_hash $PWD1 $HASH6
  274 echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_ARGON || fail
  275 check_hash $PWD1 $HASH6
  276 $CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail
  277 
  278 echo "[3] Reencryption with keyfile"
  279 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -d $KEY1 -c aes-cbc-essiv:sha256 -s 128 $FAST_PBKDF_ARGON --offset 8192 $IMG || fail
  280 wipe
  281 check_hash "" $HASH5
  282 echo $PWD1 | $CRYPTSETUP -q luksAddKey -d $KEY1 $IMG $FAST_PBKDF_ARGON || fail
  283 $REENC $IMG -d $KEY1 $FAST_PBKDF_ARGON -q 2>/dev/null && fail
  284 $REENC $IMG -d $KEY1 -S 0 $FAST_PBKDF_ARGON -q || fail
  285 check_hash "" $HASH5
  286 check_slot 0 || fail "Only keyslot 0 expected to be enabled"
  287 $REENC $IMG -d $KEY1 $FAST_PBKDF_ARGON -q || fail
  288 $CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail
  289 # FIXME echo $PWD1 | $REENC ...
  290 
  291 echo "[4] Encryption of not yet encrypted device"
  292 # well, movin' zeroes :-)
  293 OFFSET=8192 # default LUKS2 header size
  294 prepare 8192
  295 check_hash_dev $IMG $HASH4
  296 echo $PWD1 | $REENC --type luks2 $IMG -c aes-cbc-essiv:sha256 -s 128 --new --reduce-device-size "$OFFSET"S -q $FAST_PBKDF_ARGON || fail
  297 check_hash $PWD1 $HASH5
  298 $CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail
  299 # 64MiB + 1 KiB
  300 prepare 65537
  301 OFFSET=131072
  302 check_hash_dev $IMG $HASH7 1024
  303 echo $PWD1 | $REENC --type luks2 $IMG -c aes-cbc-essiv:sha256 -s 128 --new --reduce-device-size "$OFFSET"S -q $FAST_PBKDF_ARGON || fail
  304 check_hash $PWD1 $HASH7
  305 $CRYPTSETUP --type luks2 luksDump $IMG > /dev/null || fail
  306 prepare 8192
  307 
  308 echo "[5] Reencryption using specific keyslot"
  309 echo $PWD2 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
  310 echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 1 $IMG || fail
  311 echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 2 $IMG || fail
  312 echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 3 $IMG || fail
  313 echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 4 $IMG || fail
  314 echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 5 $IMG || fail
  315 echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 6 $IMG || fail
  316 echo -e "$PWD2\n$PWD3" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 22 $IMG || fail
  317 backup_orig
  318 echo $PWD2 | $REENC $FAST_PBKDF_ARGON -S 0 -q $IMG || fail
  319 check_slot 0 || fail "Only keyslot 0 expected to be enabled"
  320 wipe $PWD2
  321 rollback
  322 echo $PWD1 | $REENC $FAST_PBKDF_ARGON -S 1 -q $IMG || fail
  323 check_slot 1 || fail "Only keyslot 1 expected to be enabled"
  324 wipe $PWD1
  325 rollback
  326 echo $PWD2 | $REENC $FAST_PBKDF_ARGON -S 6 -q $IMG || fail
  327 check_slot 6 || fail "Only keyslot 6 expected to be enabled"
  328 wipe $PWD2
  329 rollback
  330 echo $PWD3 | $REENC $FAST_PBKDF_ARGON -S 22 -q $IMG || fail
  331 check_slot 22 || fail "Only keyslot 22 expected to be enabled"
  332 wipe $PWD3
  333 rollback
  334 
  335 echo "[6] Reencryption using all active keyslots"
  336 echo -e "$PWD2\n$PWD1\n$PWD2\n$PWD1\n$PWD2\n$PWD1\n$PWD2\n$PWD3" | $REENC -q $IMG $FAST_PBKDF_ARGON || fail
  337 check_slot 0 1 2 3 4 5 6 22 || fail "All keyslots expected to be enabled"
  338 
  339 echo "[7] Reencryption of block devices with different block size"
  340 add_scsi_device sector_size=512 dev_size_mb=32
  341 simple_scsi_reenc "[512 sector]"
  342 add_scsi_device sector_size=4096 dev_size_mb=32
  343 simple_scsi_reenc "[4096 sector]"
  344 add_scsi_device sector_size=512 physblk_exp=3 dev_size_mb=32
  345 simple_scsi_reenc "[4096/512 sector]"
  346 echo "[OK]"
  347 
  348 echo "[8] Header only reencryption (hash and iteration time)"
  349 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
  350 wipe $PWD1
  351 check_hash $PWD1 $HASH5
  352 echo $PWD1 | $REENC $IMG -q --keep-key || fail
  353 check_hash $PWD1 $HASH5
  354 echo $PWD1 | $REENC $IMG -q --keep-key --pbkdf pbkdf2 --pbkdf-force-iterations 999 2>/dev/null && fail
  355 check_hash $PWD1 $HASH5
  356 echo $PWD1 | $REENC $IMG -q --keep-key --pbkdf-force-iterations 3 2>/dev/null && fail
  357 check_hash $PWD1 $HASH5
  358 echo $PWD1 | $REENC $IMG -q --keep-key --pbkdf-force-iterations 4 --pbkdf-memory 31 2>/dev/null && fail
  359 check_hash $PWD1 $HASH5
  360 echo $PWD1 | $REENC $IMG -q --keep-key --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --hash sha512
  361 check_hash $PWD1 $HASH5
  362 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep PBKDF: | sed -e 's/[[:space:]]\+PBKDF:\ \+//g')" = "pbkdf2" ] || fail
  363 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep Hash:  | sed -e 's/[[:space:]]\+Hash:\ \+//g')" = "sha512" ] || fail
  364 echo $PWD1 | $REENC $IMG -q --keep-key $FAST_PBKDF_ARGON
  365 check_hash $PWD1 $HASH5
  366 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep PBKDF:      | sed -e 's/[[:space:]]\+PBKDF:\ \+//g')" = argon2i ] || fail
  367 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep "Time cost" | sed -e 's/[[:space:]]\+Time\ cost:\ \+//g')" -eq 4 ] || fail
  368 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep Memory      | sed -e 's/[[[:space:]]\+Memory:\ \+//g')" -eq 32 ] || fail
  369 [ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep Threads     | sed -e 's/[[[:space:]]\+Threads:\ \+//g')" -eq 1 ] || fail
  370 echo -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksAddKey -S21 $FAST_PBKDF_ARGON $IMG || fail
  371 echo $PWD2 | $REENC -S21 -q --keep-key --pbkdf pbkdf2 --pbkdf-force-iterations 1000 $IMG || fail
  372 check_hash $PWD2 $HASH5
  373 check_slot 21 || fail "Only keyslot 21 expected to be enabled"
  374 $CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail
  375 
  376 echo "[9] Test log I/Os on various underlying block devices"
  377 echo $PWD2 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
  378 add_scsi_device sector_size=512 dev_size_mb=32
  379 test_logging "[512 sector]" || fail
  380 add_scsi_device sector_size=4096 dev_size_mb=32
  381 test_logging "[4096 sector]" || fail
  382 add_scsi_device sector_size=512 dev_size_mb=32 physblk_exp=3
  383 test_logging "[4096/512 sector]" || fail
  384 test_logging_tmpfs || fail
  385 
  386 echo "[10] Removal of encryption"
  387 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
  388 wipe $PWD1
  389 check_hash $PWD1 $HASH5
  390 echo $PWD1 | $REENC $IMG -q --decrypt || fail
  391 check_hash_dev $IMG $HASH4
  392 
  393 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -S5 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
  394 wipe $PWD1
  395 check_hash $PWD1 $HASH5
  396 echo $PWD1 | $REENC $IMG -q --decrypt || fail
  397 check_hash_dev $IMG $HASH4
  398 
  399 echo "[11] Reencryption with tokens"
  400 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
  401 wipe $PWD1
  402 check_hash $PWD1 $HASH5
  403 echo -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksAddKey -S23 $FAST_PBKDF_ARGON $IMG || fail
  404 echo -e "$PWD1\n$PWD3" | $CRYPTSETUP -q luksAddKey -S1 $FAST_PBKDF_ARGON $IMG || fail
  405 echo -e "$PWD1\n$PWD3" | $CRYPTSETUP -q luksAddKey -S3 $FAST_PBKDF_ARGON $IMG || fai
  406 $CRYPTSETUP token add --key-description key-name0 --key-slot 23 --token-id 0 $IMG
  407 $CRYPTSETUP token add --key-description key-name2 --key-slot 1 --token-id 2 $IMG
  408 $CRYPTSETUP token add --key-description key-name31 --token-id 31 $IMG
  409 echo $PWD1 | $CRYPTSETUP -q luksKillSlot $IMG 3 || fail
  410 echo $PWD2 | $REENC $FAST_PBKDF_ARGON -S 23 -q $IMG || fail
  411 $CRYPTSETUP luksDump $IMG | grep "0: luks2-keyring" >/dev/null || fail
  412 [ "$($CRYPTSETUP luksDump $IMG | grep -A2 -m1 "0: luks2-keyring" | grep Keyslot: | sed -e 's/[[[:space:]]\+Keyslot:\ \+//g')" -eq 23 ] || fail
  413 $CRYPTSETUP luksDump $IMG | grep "2: luks2-keyring" >/dev/null || fail
  414 $CRYPTSETUP luksDump $IMG | grep "31: luks2-keyring" >/dev/null || fail
  415 [ "$($CRYPTSETUP luksDump $IMG | grep -A2 -m1 "31: luks2-keyring" | grep Keyslot: | sed -e 's/[[[:space:]]\+Keyslot:\ \+//g')" -eq 23 ] || fail
  416 
  417 echo "[12] Reencryption with persistent flags"
  418 dm_crypt_features
  419 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
  420 wipe $PWD1
  421 check_hash $PWD1 $HASH5
  422 echo $PWD1 | $CRYPTSETUP open $IMG $DEV_NAME $ALLOW_DISCARDS $PERF_CPU --persistent || fail
  423 $CRYPTSETUP close $DEV_NAME || fail
  424 echo $PWD1 | $REENC $FAST_PBKDF_ARGON -q $IMG || fail
  425 if [ -n "$PERF_CPU" ]; then
  426     $CRYPTSETUP luksDump $IMG | grep -m1 Flags: | grep same-cpu-crypt > /dev/null || fail
  427 fi
  428 if [ -n "$ALLOW_DISCARDS" ]; then
  429     $CRYPTSETUP luksDump $IMG | grep -m1 Flags: | grep allow-discards > /dev/null || fail
  430 fi
  431 
  432 echo "[13] Detached header - adding encryption/reencryption/decryption"
  433 prepare 8192
  434 check_hash_dev $IMG $HASH4
  435 echo $PWD1 | $REENC --type luks2 $IMG -q $FAST_PBKDF_ARGON --header $IMG_HDR --new
  436 check_hash $PWD1 $HASH4 $IMG_HDR
  437 echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_ARGON --header $IMG_HDR
  438 check_hash $PWD1 $HASH4 $IMG_HDR
  439 echo $PWD1 | $REENC $IMG -q --header $IMG_HDR --decrypt
  440 check_hash_dev $IMG $HASH4
  441 # existing header of zero size
  442 cat /dev/null >$IMG_HDR
  443 echo $PWD1 | $REENC --type luks2 $IMG -q $FAST_PBKDF_ARGON --header $IMG_HDR --new
  444 check_hash $PWD1 $HASH4 $IMG_HDR
  445 $CRYPTSETUP isLuks $IMG && fail
  446 $CRYPTSETUP isLuks $IMG_HDR || fail
  447 $CRYPTSETUP luksDump $IMG_HDR | grep -q "0: luks2" || fail
  448 
  449 echo "[14] Reencryption with unbound keyslot"
  450 prepare 8192
  451 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail
  452 echo $PWD2 | $CRYPTSETUP -q luksAddKey -S 3 --unbound --key-size 64 $FAST_PBKDF_ARGON $IMG || fail
  453 wipe $PWD1
  454 check_hash $PWD1 $HASH5
  455 $CRYPTSETUP luksDump $IMG | grep -q "3: luks2 (unbound)" || fail
  456 echo $PWD2 | $REENC $IMG -q $FAST_PBKDF_ARGON 2>/dev/null && fail
  457 echo -e "$PWD1\n$PWD2" | $REENC $IMG -q $FAST_PBKDF_ARGON || fail
  458 $CRYPTSETUP luksDump $IMG | grep -q "3: luks2 (unbound)" || fail
  459 
  460 echo "[15] Reencryption after conversion"
  461 prepare 8192
  462 echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_PBKDF2 $IMG --offset 4096 || fail
  463 wipe $PWD1
  464 check_hash $PWD1 $HASH1
  465 $CRYPTSETUP -q convert --type luks2 $IMG || fail
  466 echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_PBKDF2 || fail
  467 check_hash $PWD1 $HASH1
  468 echo $PWD1 | $CRYPTSETUP -q luksFormat --sector-size 512 --type luks2 $FAST_PBKDF_PBKDF2 $IMG --offset 8192 || fail
  469 wipe $PWD1
  470 check_hash $PWD1 $HASH5
  471 $CRYPTSETUP -q convert --type luks1 $IMG || fail
  472 echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_PBKDF2 || fail
  473 check_hash $PWD1 $HASH5
  474 
  475 remove_mapping
  476 exit 0