init_test.sh revision 328811 
1#!/bin/sh
2# $FreeBSD: stable/11/tests/sys/geom/class/eli/init_test.sh 328811 2018-02-02 21:57:00Z asomers $
3
4init_test()
5{
6	cipher=$1
7	secsize=$2
8	ealgo=${cipher%%:*}
9	keylen=${cipher##*:}
10
11	atf_check -s exit:0 -e ignore \
12		geli init -B none -e $ealgo -l $keylen -P -K keyfile \
13		-s $secsize ${md}
14	atf_check geli attach -p -k keyfile ${md}
15
16	atf_check dd if=rnd of=/dev/${md}.eli bs=${secsize} count=${sectors} \
17		status=none
18
19	md_rnd=`dd if=rnd bs=${secsize} count=${sectors} status=none | md5`
20	atf_check_equal 0 $?
21	md_ddev=`dd if=/dev/${md}.eli bs=${secsize} count=${sectors} status=none | md5`
22	atf_check_equal 0 $?
23	md_edev=`dd if=/dev/${md} bs=${secsize} count=${sectors} status=none | md5`
24	atf_check_equal 0 $?
25
26	if [ ${md_rnd} != ${md_ddev} ]; then
27		atf_fail "Miscompare for ealgo=${ealgo} keylen=${keylen} sec=${secsize}"
28	fi
29	if [ ${md_rnd} == ${md_edev} ]; then
30		atf_fail "Data was not encrypted for ealgo=${ealgo} keylen=${keylen} sec=${secsize}"
31	fi
32}
33atf_test_case init cleanup
34init_head()
35{
36	atf_set "descr" "Basic I/O with geli"
37	atf_set "require.user" "root"
38	atf_set "timeout" 600
39}
40init_body()
41{
42	. $(atf_get_srcdir)/conf.sh
43
44	sectors=32
45
46	atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none
47	atf_check dd if=/dev/random of=rnd bs=$MAX_SECSIZE count=${sectors} \
48		status=none
49	for_each_geli_config_nointegrity init_test
50}
51init_cleanup()
52{
53	. $(atf_get_srcdir)/conf.sh
54	geli_test_cleanup
55}
56
57atf_test_case init_B cleanup
58init_B_head()
59{
60	atf_set "descr" "init -B can select an alternate backup metadata file"
61	atf_set "require.user" "root"
62}
63init_B_body()
64{
65	. $(atf_get_srcdir)/conf.sh
66
67	sectors=100
68
69	atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none
70
71	md=$(attach_md -t malloc -s $sectors)
72
73	# -B none
74	rm -f /var/backups/${md}.eli
75	atf_check -s exit:0 -o ignore geli init -B none -P -K keyfile ${md}
76	if [ -f /var/backups/${md}.eli ]; then
77		atf_fail "geli created a backup file even with -B none"
78	fi
79
80	# no -B
81	rm -f /var/backups/${md}.eli
82	atf_check -s exit:0 -o ignore geli init -P -K keyfile ${md}
83	if [ ! -f /var/backups/${md}.eli ]; then
84		atf_fail "geli did not create a backup file"
85	fi
86	atf_check geli clear ${md}
87	atf_check -s not-exit:0 -e ignore geli attach -p -k keyfile ${md}
88	atf_check -s exit:0 -o ignore geli restore /var/backups/${md}.eli ${md}
89	atf_check -s exit:0 -o ignore geli attach -p -k keyfile ${md}
90	atf_check geli detach ${md}
91	rm -f /var/backups/${md}.eli
92
93	# -B file
94	rm -f backupfile
95	atf_check -s exit:0 -o ignore \
96		geli init -B backupfile -P -K keyfile ${md}
97	if [ ! -f backupfile ]; then
98		atf_fail "geli init -B did not create a backup file"
99	fi
100	atf_check geli clear ${md}
101	atf_check -s not-exit:0 -e ignore geli attach -p -k keyfile ${md}
102	atf_check geli restore backupfile ${md}
103	atf_check geli attach -p -k keyfile ${md}
104}
105init_B_cleanup()
106{
107	. $(atf_get_srcdir)/conf.sh
108	geli_test_cleanup
109}
110
111atf_test_case init_J cleanup
112init_J_head()
113{
114	atf_set "descr" "init -J accepts a passfile"
115	atf_set "require.user" "root"
116}
117init_J_body()
118{
119	. $(atf_get_srcdir)/conf.sh
120
121	sectors=100
122	md=$(attach_md -t malloc -s `expr $sectors + 1`)
123
124	atf_check dd if=/dev/random of=keyfile0 bs=512 count=16 status=none
125	atf_check dd if=/dev/random of=keyfile1 bs=512 count=16 status=none
126	dd if=/dev/random bs=512 count=16 status=none | sha1 > passfile0
127	atf_check_equal 0 $?
128	dd if=/dev/random bs=512 count=16 status=none | sha1 > passfile1
129	atf_check_equal 0 $?
130
131	for iter in -1 0 64; do
132		atf_check -s not-exit:0 -e ignore \
133			geli init -i ${iter} -B none -J passfile0 -P ${md}
134		atf_check -s not-exit:0 -e ignore \
135			geli init -i ${iter} -B none -J passfile0 -P -K keyfile0 ${md}
136		atf_check geli init -i ${iter} -B none -J passfile0 -K keyfile0 ${md}
137		atf_check -s not-exit:0 -e ignore \
138			geli attach -k keyfile0 -p ${md}
139		atf_check -s not-exit:0 -e ignore \
140			geli attach -j passfile0 ${md}
141		atf_check -s not-exit:0 -e ignore \
142			geli attach -j keyfile0 ${md}
143		atf_check -s not-exit:0 -e ignore \
144			geli attach -k passfile0 -p ${md}
145		atf_check -s not-exit:0 -e ignore \
146			geli attach -j keyfile0 -k passfile0 ${md}
147		atf_check -s not-exit:0 -e ignore \
148			geli attach -j keyfile0 -k keyfile0 ${md}
149		atf_check -s not-exit:0 -e ignore \
150			geli attach -j passfile0 -k passfile0 ${md}
151		atf_check -s exit:0 -e ignore \
152			geli attach -j passfile0 -k keyfile0 ${md}
153		atf_check -s exit:0 -e ignore geli detach ${md}
154		atf_check -s exit:0 -e ignore -x \
155			"cat keyfile0 | geli attach -j passfile0 -k - ${md}"
156		atf_check -s exit:0 -e ignore geli detach ${md}
157		atf_check -s exit:0 -e ignore -x \
158			"cat passfile0 | geli attach -j - -k keyfile0 ${md}"
159		atf_check -s exit:0 -e ignore geli detach ${md}
160
161		atf_check -s not-exit:0 -e ignore \
162			geli init -i ${iter} -B none -J passfile0 -J passfile1 -P ${md}
163		atf_check -s not-exit:0 -e ignore \
164			geli init -i ${iter} -B none -J passfile0 -J passfile1 -P -K keyfile0 -K keyfile1 ${md}
165		atf_check -s exit:0 -e ignore \
166			geli init -i ${iter} -B none -J passfile0 -J passfile1 -K keyfile0 -K keyfile1 ${md}
167		atf_check -s not-exit:0 -e ignore \
168			geli attach -k keyfile0 -p ${md}
169		atf_check -s not-exit:0 -e ignore \
170			geli attach -k keyfile1 -p ${md}
171		atf_check -s not-exit:0 -e ignore \
172			geli attach -j passfile0 ${md}
173		atf_check -s not-exit:0 -e ignore \
174			geli attach -j passfile1 ${md}
175		atf_check -s not-exit:0 -e ignore \
176			geli attach -k keyfile0 -k keyfile1 -p ${md}
177		atf_check -s not-exit:0 -e ignore \
178			geli attach -j passfile0 -j passfile1 ${md}
179		atf_check -s not-exit:0 -e ignore \
180			geli attach -k keyfile0 -j passfile0 ${md}
181		atf_check -s not-exit:0 -e ignore \
182			geli attach -k keyfile0 -j passfile1 ${md}
183		atf_check -s not-exit:0 -e ignore \
184			geli attach -k keyfile1 -j passfile0 ${md}
185		atf_check -s not-exit:0 -e ignore \
186			geli attach -k keyfile1 -j passfile1 ${md}
187		atf_check -s not-exit:0 -e ignore \
188			geli attach -k keyfile0 -j passfile0 -j passfile1 ${md}
189		atf_check -s not-exit:0 -e ignore \
190			geli attach -k keyfile1 -j passfile0 -j passfile1 ${md}
191		atf_check -s not-exit:0 -e ignore \
192			geli attach -k keyfile0 -k keyfile1 -j passfile0 ${md}
193		atf_check -s not-exit:0 -e ignore \
194			geli attach -k keyfile0 -k keyfile1 -j passfile1 ${md}
195		atf_check -s not-exit:0 -e ignore \
196			geli attach -k keyfile1 -k keyfile0 -j passfile0 -j passfile1 ${md}
197		atf_check -s not-exit:0 -e ignore \
198			geli attach -k keyfile0 -k keyfile1 -j passfile1 -j passfile0 ${md}
199		atf_check -s not-exit:0 -e ignore \
200			geli attach -k keyfile1 -k keyfile0 -j passfile1 -j passfile0 ${md}
201		atf_check -s exit:0 -e ignore \
202			geli attach -j passfile0 -j passfile1 -k keyfile0 -k keyfile1 ${md}
203		atf_check -s exit:0 -e ignore geli detach ${md}
204		atf_check -s exit:0 -e ignore -x \
205			"cat passfile0 | geli attach -j - -j passfile1 -k keyfile0 -k keyfile1 ${md}"
206		atf_check -s exit:0 -e ignore geli detach ${md}
207		atf_check -s exit:0 -e ignore -x \
208			"cat passfile1 | geli attach -j passfile0 -j - -k keyfile0 -k keyfile1 ${md}"
209		atf_check -s exit:0 -e ignore geli detach ${md}
210		atf_check -s exit:0 -e ignore -x \
211			"cat keyfile0 | geli attach -j passfile0 -j passfile1 -k - -k keyfile1 ${md}"
212		atf_check -s exit:0 -e ignore geli detach ${md}
213		atf_check -s exit:0 -e ignore -x \
214			"cat keyfile1 | geli attach -j passfile0 -j passfile1 -k keyfile0 -k - ${md}"
215		atf_check -s exit:0 -e ignore geli detach ${md}
216		atf_check -s exit:0 -e ignore -x \
217			"cat keyfile0 keyfile1 | geli attach -j passfile0 -j passfile1 -k - ${md}"
218		atf_check -s exit:0 -e ignore geli detach ${md}
219		atf_check -s exit:0 -e ignore -x \
220			"cat passfile0 passfile1 | awk '{printf \"%s\", \$0}' | geli attach -j - -k keyfile0 -k keyfile1 ${md}"
221		atf_check -s exit:0 -e ignore geli detach ${md}
222	done
223}
224init_J_cleanup()
225{
226	. $(atf_get_srcdir)/conf.sh
227	geli_test_cleanup
228}
229
230init_a_test()
231{
232	cipher=$1
233	aalgo=$2
234	secsize=$3
235	ealgo=${cipher%%:*}
236	keylen=${cipher##*:}
237
238	atf_check -s exit:0 -e ignore \
239		geli init -B none -a $aalgo -e $ealgo -l $keylen -P -K keyfile \
240		-s $secsize ${md}
241	atf_check geli attach -p -k keyfile ${md}
242
243	atf_check dd if=rnd of=/dev/${md}.eli bs=${secsize} count=${sectors} status=none
244
245	md_rnd=`dd if=rnd bs=${secsize} count=${sectors} status=none | md5`
246	atf_check_equal 0 $?
247	md_ddev=`dd if=/dev/${md}.eli bs=${secsize} count=${sectors} status=none | md5`
248	atf_check_equal 0 $?
249
250	if [ ${md_rnd} != ${md_ddev} ]; then
251		atf_fail "Miscompare for aalgo=${aalgo} ealgo=${ealgo} keylen=${keylen} sec=${secsize}"
252	fi
253}
254atf_test_case init_a cleanup
255init_a_head()
256{
257	atf_set "descr" "I/O with geli and HMACs"
258	atf_set "require.user" "root"
259	atf_set "timeout" 3600
260}
261init_a_body()
262{
263	. $(atf_get_srcdir)/conf.sh
264
265	sectors=100
266
267	atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none
268	atf_check dd if=/dev/random of=rnd bs=$MAX_SECSIZE count=${sectors} \
269		status=none
270	for_each_geli_config init_a_test
271	true
272}
273init_a_cleanup()
274{
275	. $(atf_get_srcdir)/conf.sh
276	geli_test_cleanup
277}
278
279init_alias_test() {
280	ealgo=$1
281	keylen=$2
282	expected_ealgo=$3
283	expected_keylen=$4
284
285	atf_check geli init -B none -e $ealgo -l $keylen -P -K keyfile ${md}
286	atf_check geli attach -p -k keyfile ${md}
287	real_ealgo=`geli list ${md}.eli | awk '/EncryptionAlgorithm/ {print $2}'`
288	real_keylen=`geli list ${md}.eli | awk '/KeyLength/ {print $2}'`
289
290	if [ "${real_ealgo}" != "${expected_ealgo}" ]; then
291		atf_fail "expected ${expected_ealgo} but got ${real_ealgo}"
292	fi
293
294	if [ "${real_keylen}" != "${expected_keylen}" ]; then
295		atf_fail "expected ${expected_keylen} but got ${real_keylen}"
296	fi
297	atf_check geli detach ${md}
298}
299atf_test_case init_alias cleanup
300init_alias_head()
301{
302	atf_set "descr" "geli init accepts cipher aliases"
303	atf_set "require.user" "root"
304}
305init_alias_body()
306{
307	. $(atf_get_srcdir)/conf.sh
308
309	md=$(attach_md -t malloc -s 1024k)
310	atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none
311
312	for spec in aes:0:AES-XTS:128 aes:128:AES-XTS:128 aes:256:AES-XTS:256 \
313		3des:0:3DES-CBC:192 3des:192:3DES-CBC:192 \
314		blowfish:0:Blowfish-CBC:128 blowfish:128:Blowfish-CBC:128 \
315		blowfish:160:Blowfish-CBC:160 blowfish:192:Blowfish-CBC:192 \
316		blowfish:224:Blowfish-CBC:224 blowfish:256:Blowfish-CBC:256 \
317		blowfish:288:Blowfish-CBC:288 blowfish:352:Blowfish-CBC:352 \
318		blowfish:384:Blowfish-CBC:384 blowfish:416:Blowfish-CBC:416 \
319		blowfish:448:Blowfish-CBC:448 \
320		camellia:0:CAMELLIA-CBC:128 camellia:128:CAMELLIA-CBC:128 \
321		camellia:256:CAMELLIA-CBC:256 ; do
322
323		ealgo=`echo $spec | cut -d : -f 1`
324		keylen=`echo $spec | cut -d : -f 2`
325		expected_ealgo=`echo $spec | cut -d : -f 3`
326		expected_keylen=`echo $spec | cut -d : -f 4`
327
328		init_alias_test $ealgo $keylen $expected_ealgo $expected_keylen
329	done
330}
331init_alias_cleanup()
332{
333	. $(atf_get_srcdir)/conf.sh
334	geli_test_cleanup
335}
336
337atf_test_case init_i_P cleanup
338init_i_P_head()
339{
340	atf_set "descr" "geli: Options -i and -P are mutually exclusive"
341	atf_set "require.user" "root"
342}
343init_i_P_body()
344{
345	. $(atf_get_srcdir)/conf.sh
346
347	sectors=100
348	md=$(attach_md -t malloc -s `expr $sectors + 1`)
349
350	atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none
351
352	atf_check -s not-exit:0 -e "match:Options -i and -P are mutually exclusive"\
353		geli init -B none -i 64 -P -K keyfile $md
354}
355init_i_P_cleanup()
356{
357	. $(atf_get_srcdir)/conf.sh
358	geli_test_cleanup
359}
360
361atf_test_case nokey cleanup
362nokey_head()
363{
364	atf_set "descr" "geli init fails if called with no key component"
365	atf_set "require.user" "root"
366}
367nokey_body()
368{
369	. $(atf_get_srcdir)/conf.sh
370
371	sectors=100
372	md=$(attach_md -t malloc -s `expr $sectors + 1`)
373
374	atf_check -s not-exit:0 -e match:"No key components given" \
375		geli init -B none -P ${md}
376}
377nokey_cleanup()
378{
379	. $(atf_get_srcdir)/conf.sh
380	geli_test_cleanup
381}
382
383atf_init_test_cases()
384{
385	atf_add_test_case init
386	atf_add_test_case init_B
387	atf_add_test_case init_J
388	atf_add_test_case init_a
389	atf_add_test_case init_alias
390	atf_add_test_case init_i_P
391	atf_add_test_case nokey
392}
393