|
Packit |
94f725 |
#!/bin/bash
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
CIPHER_XTS_PLAIN="aes-xts-plain64"
|
|
Packit |
94f725 |
CIPHER_CBC_ESSIV="aes-cbc-essiv:sha256"
|
|
Packit |
94f725 |
CIPHER_CBC_TCW="serpent-cbc-tcw"
|
|
Packit |
94f725 |
# TODO: mode with LMK
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
TEST_KEYRING_NAME="keyringtest_keyring"
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
LOGON_KEY_16_OK="dmtst:lkey_16"
|
|
Packit |
94f725 |
LOGON_KEY_32_OK="dmtst:lkey_32"
|
|
Packit |
94f725 |
LOGON_KEY_64_OK="dmtst:lkey_64"
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
HEXKEY_16="be21aa8c733229347bd4e681891e213d";
|
|
Packit |
94f725 |
HEXKEY_32="bb21158c733229347bd4e681891e213d94c685be6a5b84818afe7a78a6de7a1a";
|
|
Packit |
94f725 |
HEXKEY_64="34f95b96abff946b64f1339ff8653cc77c38697c93b797a496f3786e86eed7781850d5112bbae17d209b8310a8f3a034f1cd297667bc0cd1438fad28d87ef6a1"
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
DEVSIZEMB=16
|
|
Packit |
94f725 |
DEVSECTORS=$((DEVSIZEMB*1024*1024/512))
|
|
Packit |
94f725 |
NAME=testcryptdev
|
|
Packit |
94f725 |
CHKS_DMCRYPT=vk_in_dmcrypt.chk
|
|
Packit |
94f725 |
CHKS_KEYRING=vk_in_keyring.chk
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
PWD="aaa"
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".."
|
|
Packit |
94f725 |
CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
[ -f /etc/system-fips ] && FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null)
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
function remove_mapping()
|
|
Packit |
94f725 |
{
|
|
Packit |
94f725 |
[ -b /dev/mapper/$NAME ] && dmsetup remove --retry $NAME
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
# unlink whole test keyring
|
|
Packit |
94f725 |
[ -n "$TEST_KEYRING" ] && keyctl unlink $TEST_KEYRING "@u" >/dev/null
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
rmmod scsi_debug 2>/dev/null
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
rm -f $CHKS_DMCRYPT $CHKS_KEYRING
|
|
Packit |
94f725 |
}
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
function skip()
|
|
Packit |
94f725 |
{
|
|
Packit |
94f725 |
[ -n "$1" ] && echo "$1"
|
|
Packit |
94f725 |
remove_mapping
|
|
Packit |
94f725 |
exit 77
|
|
Packit |
94f725 |
}
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
function fail()
|
|
Packit |
94f725 |
{
|
|
Packit |
94f725 |
[ -n "$1" ] && echo "$1"
|
|
Packit |
94f725 |
echo "FAILED backtrace:"
|
|
Packit |
94f725 |
while caller $frame; do ((frame++)); done
|
|
Packit |
94f725 |
remove_mapping
|
|
Packit |
94f725 |
exit 2
|
|
Packit |
94f725 |
}
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
# $1 hexbyte key
|
|
Packit |
94f725 |
# $2 type
|
|
Packit |
94f725 |
# $3 description
|
|
Packit |
94f725 |
# $4 keyring
|
|
Packit |
94f725 |
function load_key()
|
|
Packit |
94f725 |
{
|
|
Packit |
94f725 |
local tmp="$1"
|
|
Packit |
94f725 |
shift
|
|
Packit |
94f725 |
echo -n "$tmp" | xxd -r -p | keyctl padd $@ >/dev/null
|
|
Packit |
94f725 |
}
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
function dm_crypt_keyring_support()
|
|
Packit |
94f725 |
{
|
|
Packit |
94f725 |
VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv)
|
|
Packit |
94f725 |
[ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version."
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
VER_MAJ=$(echo $VER_STR | cut -f 1 -d.)
|
|
Packit |
94f725 |
VER_MIN=$(echo $VER_STR | cut -f 2 -d.)
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
# run the test with dm-crypt v1.15.0+ on purpose
|
|
Packit |
94f725 |
# the fix is in dm-crypt v1.18.1+
|
|
Packit |
94f725 |
[ $VER_MAJ -gt 1 ] && return 0
|
|
Packit |
94f725 |
[ $VER_MAJ -lt 1 ] && return 1
|
|
Packit |
94f725 |
[ $VER_MIN -ge 15 ]
|
|
Packit |
94f725 |
}
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
function test_and_prepare_keyring() {
|
|
Packit |
94f725 |
keyctl list "@s" > /dev/null || skip "Current session keyring is unreachable, test skipped"
|
|
Packit |
94f725 |
TEST_KEYRING=$(keyctl newring $TEST_KEYRING_NAME "@u" 2> /dev/null)
|
|
Packit |
94f725 |
test -n "$TEST_KEYRING" || skip "Failed to create keyring in user keyring"
|
|
Packit |
94f725 |
keyctl search "@s" keyring "$TEST_KEYRING" > /dev/null 2>&1 || keyctl link "@u" "@s" > /dev/null 2>&1
|
|
Packit |
94f725 |
load_key "$HEXKEY_16" user test_key "$TEST_KEYRING" || skip "Kernel keyring service is useless on this system, test skipped."
|
|
Packit |
94f725 |
}
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
function fips_mode()
|
|
Packit |
94f725 |
{
|
|
Packit |
94f725 |
[ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ]
|
|
Packit |
94f725 |
}
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
add_device() {
|
|
Packit |
94f725 |
modprobe scsi_debug $@ delay=0
|
|
Packit |
94f725 |
if [ $? -ne 0 ] ; then
|
|
Packit |
94f725 |
echo "This kernel seems to not support proper scsi_debug module, test skipped."
|
|
Packit |
94f725 |
exit 77
|
|
Packit |
94f725 |
fi
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
sleep 2
|
|
Packit |
94f725 |
DEV=$(grep -l -e scsi_debug /sys/block/*/device/model | cut -f4 -d /)
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
DEV="/dev/$DEV"
|
|
Packit |
94f725 |
[ -b $DEV ] || fail "Cannot find $DEV."
|
|
Packit |
94f725 |
}
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
|
|
Packit |
94f725 |
which dmsetup >/dev/null 2>&1 || skip "Cannot find dmsetup, test skipped"
|
|
Packit |
94f725 |
which keyctl >/dev/null 2>&1 || skip "Cannot find keyctl, test skipped"
|
|
Packit |
94f725 |
which xxd >/dev/null 2>&1 || skip "Cannot find xxd, test skipped"
|
|
Packit |
94f725 |
which sha1sum > /dev/null 2>&1 || skip "Cannot find sha1sum, test skipped"
|
|
Packit |
94f725 |
modprobe dm-crypt || fail "dm-crypt failed to load"
|
|
Packit |
94f725 |
dm_crypt_keyring_support || skip "dm-crypt doesn't support kernel keyring, test skipped."
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
test_and_prepare_keyring
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
add_device dev_size_mb=$DEVSIZEMB
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
dd if=/dev/urandom of=$DEV bs=1M count=$DEVSIZEMB oflag=direct > /dev/null 2>&1 || fail
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
#test aes cipher with xts mode, plain IV
|
|
Packit |
94f725 |
echo -n "Testing $CIPHER_XTS_PLAIN..."
|
|
Packit |
94f725 |
dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_XTS_PLAIN $HEXKEY_32 0 $DEV 0" || fail
|
|
Packit |
94f725 |
sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail
|
|
Packit |
94f725 |
dmsetup remove --retry $NAME || fail
|
|
Packit |
94f725 |
load_key "$HEXKEY_32" logon $LOGON_KEY_32_OK "$TEST_KEYRING" || fail "Cannot load 32 byte logon key type"
|
|
Packit |
94f725 |
dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_XTS_PLAIN :32:logon:$LOGON_KEY_32_OK 0 $DEV 0" || fail
|
|
Packit |
94f725 |
sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail
|
|
Packit |
94f725 |
dmsetup remove --retry $NAME || fail
|
|
Packit |
94f725 |
diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)"
|
|
Packit |
94f725 |
# same test using message
|
|
Packit |
94f725 |
dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_XTS_PLAIN $HEXKEY_32 0 $DEV 0" || fail
|
|
Packit |
94f725 |
sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail
|
|
Packit |
94f725 |
dmsetup remove --retry $NAME || fail
|
|
Packit |
94f725 |
dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_XTS_PLAIN $HEXKEY_32 0 $DEV 0" || fail
|
|
Packit |
94f725 |
dmsetup suspend $NAME || fail
|
|
Packit |
94f725 |
dmsetup message $NAME 0 key wipe || fail
|
|
Packit |
94f725 |
dmsetup message $NAME 0 "key set :32:logon:$LOGON_KEY_32_OK" || fail
|
|
Packit |
94f725 |
dmsetup resume $NAME || fail
|
|
Packit |
94f725 |
sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail
|
|
Packit |
94f725 |
dmsetup remove --retry $NAME || fail
|
|
Packit |
94f725 |
diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)"
|
|
Packit |
94f725 |
echo "OK"
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
#test aes cipher, xts mode, essiv IV
|
|
Packit |
94f725 |
echo -n "Testing $CIPHER_CBC_ESSIV..."
|
|
Packit |
94f725 |
dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_ESSIV $HEXKEY_16 0 $DEV 0" || fail
|
|
Packit |
94f725 |
sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail
|
|
Packit |
94f725 |
dmsetup remove --retry $NAME || fail
|
|
Packit |
94f725 |
load_key "$HEXKEY_16" logon $LOGON_KEY_16_OK "$TEST_KEYRING" || fail "Cannot load 16 byte logon key type"
|
|
Packit |
94f725 |
dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_ESSIV :16:logon:$LOGON_KEY_16_OK 0 $DEV 0" || fail
|
|
Packit |
94f725 |
sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail
|
|
Packit |
94f725 |
dmsetup remove --retry $NAME || fail
|
|
Packit |
94f725 |
diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)"
|
|
Packit |
94f725 |
# same test using message
|
|
Packit |
94f725 |
dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_ESSIV $HEXKEY_16 0 $DEV 0" || fail
|
|
Packit |
94f725 |
sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail
|
|
Packit |
94f725 |
dmsetup remove --retry $NAME || fail
|
|
Packit |
94f725 |
dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_ESSIV $HEXKEY_16 0 $DEV 0" || fail
|
|
Packit |
94f725 |
dmsetup suspend $NAME || fail
|
|
Packit |
94f725 |
dmsetup message $NAME 0 key wipe || fail
|
|
Packit |
94f725 |
dmsetup message $NAME 0 "key set :16:logon:$LOGON_KEY_16_OK" || fail
|
|
Packit |
94f725 |
dmsetup resume $NAME || fail
|
|
Packit |
94f725 |
sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail
|
|
Packit |
94f725 |
dmsetup remove --retry $NAME || fail
|
|
Packit |
94f725 |
diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)"
|
|
Packit |
94f725 |
echo "OK"
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
#test serpent cipher, cbc mode, tcw IV
|
|
Packit |
94f725 |
fips_mode || {
|
|
Packit |
94f725 |
echo -n "Testing $CIPHER_CBC_TCW..."
|
|
Packit |
94f725 |
dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_TCW $HEXKEY_64 0 $DEV 0" || fail
|
|
Packit |
94f725 |
sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail
|
|
Packit |
94f725 |
dmsetup remove --retry $NAME || fail
|
|
Packit |
94f725 |
load_key "$HEXKEY_64" logon $LOGON_KEY_64_OK "$TEST_KEYRING" || fail "Cannot load 16 byte logon key type"
|
|
Packit |
94f725 |
dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_TCW :64:logon:$LOGON_KEY_64_OK 0 $DEV 0" || fail
|
|
Packit |
94f725 |
sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail
|
|
Packit |
94f725 |
dmsetup remove --retry $NAME || fail
|
|
Packit |
94f725 |
diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksum mismatch (corruption)"
|
|
Packit |
94f725 |
# same test using message
|
|
Packit |
94f725 |
dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_TCW $HEXKEY_64 0 $DEV 0" || fail
|
|
Packit |
94f725 |
sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail
|
|
Packit |
94f725 |
dmsetup remove --retry $NAME || fail
|
|
Packit |
94f725 |
dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_TCW $HEXKEY_64 0 $DEV 0" || fail
|
|
Packit |
94f725 |
dmsetup suspend $NAME || fail
|
|
Packit |
94f725 |
dmsetup message $NAME 0 key wipe || fail
|
|
Packit |
94f725 |
dmsetup message $NAME 0 "key set :64:logon:$LOGON_KEY_64_OK" || fail
|
|
Packit |
94f725 |
dmsetup resume $NAME || fail
|
|
Packit |
94f725 |
sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail
|
|
Packit |
94f725 |
dmsetup remove --retry $NAME || fail
|
|
Packit |
94f725 |
diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)"
|
|
Packit |
94f725 |
echo "OK"
|
|
Packit |
94f725 |
}
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
echo -n "Test LUKS2 key refresh..."
|
|
Packit |
94f725 |
echo $PWD | $CRYPTSETUP luksFormat --type luks2 --luks2-metadata-size 16k --luks2-keyslots-size 4064k --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --force-password $DEV || fail
|
|
Packit |
94f725 |
echo $PWD | $CRYPTSETUP open $DEV $NAME || fail
|
|
Packit |
94f725 |
$CRYPTSETUP status $NAME | grep -q -i "location:.*keyring" || skip "LUKS2 can't use keyring. Test skipped."
|
|
Packit |
94f725 |
dd if=/dev/mapper/$NAME bs=1M iflag=direct status=none | sha1sum > $CHKS_KEYRING || fail
|
|
Packit |
94f725 |
echo $PWD | $CRYPTSETUP refresh $NAME --disable-keyring || fail
|
|
Packit |
94f725 |
$CRYPTSETUP status $NAME | grep -q -i "location:.*keyring" && fail "Key is still in keyring"
|
|
Packit |
94f725 |
dd if=/dev/mapper/$NAME bs=1M iflag=direct status=none | sha1sum > $CHKS_DMCRYPT || fail
|
|
Packit |
94f725 |
diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksum mismatch (corruption)"
|
|
Packit |
94f725 |
echo "OK"
|
|
Packit |
94f725 |
|
|
Packit |
94f725 |
remove_mapping
|