guara/crates/guara-core/tests/luks.rs

//! LUKS1/LUKS2: imagens criadas pelo cryptsetup; o conteúdo é cifrado por uma
//! implementação independente (python cryptography) com a chave real do volume.

use guara_core::crypt::{luks, Secret, UnlockError};
use guara_core::source::{read_vec, FileSource, Source};
use std::path::Path;
use std::process::{Command, Stdio};
use std::sync::Arc;

fn have(tool: &str) -> bool {
    Command::new("sh")
        .args(["-c", &format!("command -v {tool}")])
        .output()
        .map(|o| o.status.success())
        .unwrap_or(false)
}

fn py_ok() -> bool {
    Command::new("python3")
        .args(["-c", "import cryptography"])
        .output()
        .map(|o| o.status.success())
        .unwrap_or(false)
}

fn run_stdin(cmd: &mut Command, input: &str) -> bool {
    use std::io::Write;
    let mut ch = cmd.stdin(Stdio::piped()).stdout(Stdio::null()).stderr(Stdio::null()).spawn().unwrap();
    ch.stdin.take().unwrap().write_all(input.as_bytes()).unwrap();
    ch.wait().unwrap().success()
}

fn plain_data(len: usize) -> Vec<u8> {
    let mut x = 0x9E3779B97F4A7C15u64;
    (0..len)
        .map(|_| {
            x ^= x << 13;
            x ^= x >> 7;
            x ^= x << 17;
            (x >> 32) as u8
        })
        .collect()
}

struct Case<'a> {
    name: &'a str,
    format_args: Vec<&'a str>,
    cipher: &'a str,
    sector: u32,
    ver2: bool,
}

fn payload_offset(img: &Path, ver2: bool) -> u64 {
    let o = Command::new("cryptsetup").arg("luksDump").arg(img).output().unwrap();
    let t = String::from_utf8_lossy(&o.stdout).to_string();
    if ver2 {
        let l = t.lines().skip_while(|l| !l.starts_with("Data segments")).find(|l| l.contains("offset:")).unwrap();
        l.split(':').nth(1).unwrap().split_whitespace().next().unwrap().parse().unwrap()
    } else {
        let l = t.lines().find(|l| l.starts_with("Payload offset")).unwrap();
        l.split(':').nth(1).unwrap().trim().parse::<u64>().unwrap() * 512
    }
}

fn run_case(c: &Case) {
    if !have("cryptsetup") || !py_ok() {
        eprintln!("SKIP: cryptsetup/python3-cryptography ausentes");
        return;
    }
    let dir = tempfile::tempdir().unwrap();
    let img = dir.path().join("l.img");
    let plain = dir.path().join("plain.bin");
    let data = plain_data(3 * 1024 * 1024 + 4096);
    std::fs::write(&plain, &data).unwrap();
    std::fs::File::create(&img).unwrap().set_len(24 << 20).unwrap();
    let pw = "senha com acentuação ç";
    let mut fmt = Command::new("cryptsetup");
    fmt.args(["luksFormat", "--batch-mode", "--key-file", "-"]);
    fmt.args(&c.format_args);
    fmt.arg(&img);
    assert!(run_stdin(&mut fmt, pw), "luksFormat falhou ({})", c.name);
    let vkf = dir.path().join("vk.bin");
    let mut dump = Command::new("cryptsetup");
    dump.args(["luksDump", "--dump-volume-key", "--batch-mode", "--key-file", "-", "--volume-key-file"]);
    dump.arg(&vkf).arg(&img);
    assert!(run_stdin(&mut dump, pw), "dump da chave falhou ({})", c.name);
    let off = payload_offset(&img, c.ver2);
    let st = Command::new("python3")
        .arg(Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/support/luks_encrypt.py"))
        .arg(&img)
        .arg(&plain)
        .arg(&vkf)
        .arg(off.to_string())
        .arg(c.cipher)
        .arg(c.sector.to_string())
        .status()
        .unwrap();
    assert!(st.success());

    let src: Arc<dyn Source> = Arc::new(FileSource::open(&img).unwrap());
    // Senha errada primeiro.
    match luks::unlock(src.clone(), &[Secret::Password("errada".into())]) {
        Err(UnlockError::WrongSecret) => {}
        Err(e) => panic!("{}: erro inesperado {e}", c.name),
        Ok(_) => panic!("{}: abriu com senha errada", c.name),
    }
    let u = luks::unlock(src.clone(), &[Secret::Password("x".into()), Secret::Password(pw.into())])
        .unwrap_or_else(|e| panic!("{}: {e}", c.name));
    let got = read_vec(u.source.as_ref(), 0, data.len()).unwrap();
    assert!(got == data, "{}: conteúdo difere", c.name);
    // Também abre com a chave do volume.
    let vk = std::fs::read(&vkf).unwrap();
    let u2 = luks::unlock(src, &[Secret::VolumeKey(vk)]).unwrap();
    assert_eq!(read_vec(u2.source.as_ref(), 1000, 5000).unwrap(), &data[1000..6000]);
}

#[test]
fn luks1_xts() {
    run_case(&Case {
        name: "luks1-xts",
        format_args: vec!["--type", "luks1", "--pbkdf-force-iterations", "1000", "-c", "aes-xts-plain64", "-s", "512"],
        cipher: "aes-xts-plain64",
        sector: 512,
        ver2: false,
    });
}

#[test]
fn luks1_cbc_essiv_sha1() {
    run_case(&Case {
        name: "luks1-cbc-essiv",
        format_args: vec!["--type", "luks1", "--pbkdf-force-iterations", "1000", "-c", "aes-cbc-essiv:sha256", "-s", "256", "-h", "sha1"],
        cipher: "aes-cbc-essiv:sha256",
        sector: 512,
        ver2: false,
    });
}

#[test]
fn luks2_argon2id_xts() {
    run_case(&Case {
        name: "luks2-argon2id",
        format_args: vec!["--type", "luks2", "--pbkdf", "argon2id", "--pbkdf-force-iterations", "4", "--pbkdf-memory", "64", "-c", "aes-xts-plain64", "-s", "512"],
        cipher: "aes-xts-plain64",
        sector: 4096,
        ver2: true,
    });
}

#[test]
fn luks2_pbkdf2_sector512_aes256() {
    run_case(&Case {
        name: "luks2-pbkdf2",
        format_args: vec!["--type", "luks2", "--pbkdf", "pbkdf2", "--pbkdf-force-iterations", "1000", "-c", "aes-xts-plain64", "-s", "256", "--sector-size", "512"],
        cipher: "aes-xts-plain64",
        sector: 512,
        ver2: true,
    });
}