1#!/bin/sh 2# $FreeBSD$ 3 4. $(atf_get_srcdir)/conf.sh 5 6init_test() 7{ 8 cipher=$1 9 secsize=$2 10 ealgo=${cipher%%:*} 11 keylen=${cipher##*:} 12 13 atf_check -s exit:0 -e ignore \ 14 geli init -B none -e $ealgo -l $keylen -P -K keyfile \ 15 -s $secsize ${md} 16 atf_check geli attach -p -k keyfile ${md} 17 18 atf_check dd if=rnd of=/dev/${md}.eli bs=${secsize} count=${sectors} \ 19 status=none 20 21 md_rnd=`dd if=rnd bs=${secsize} count=${sectors} status=none | md5` 22 atf_check_equal 0 $? 23 md_ddev=`dd if=/dev/${md}.eli bs=${secsize} count=${sectors} status=none | md5` 24 atf_check_equal 0 $? 25 md_edev=`dd if=/dev/${md} bs=${secsize} count=${sectors} status=none | md5` 26 atf_check_equal 0 $? 27 28 if [ ${md_rnd} != ${md_ddev} ]; then 29 atf_fail "Miscompare for ealgo=${ealgo} keylen=${keylen} sec=${secsize}" 30 fi 31 if [ ${md_rnd} == ${md_edev} ]; then 32 atf_fail "Data was not encrypted for ealgo=${ealgo} keylen=${keylen} sec=${secsize}" 33 fi 34} 35atf_test_case init cleanup 36init_head() 37{ 38 atf_set "descr" "Basic I/O with geli" 39 atf_set "require.user" "root" 40 atf_set "timeout" 600 41} 42init_body() 43{ 44 geli_test_setup 45 46 sectors=32 47 48 atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none 49 atf_check dd if=/dev/random of=rnd bs=$MAX_SECSIZE count=${sectors} \ 50 status=none 51 for_each_geli_config_nointegrity init_test 52} 53init_cleanup() 54{ 55 geli_test_cleanup 56} 57 58atf_test_case init_B cleanup 59init_B_head() 60{ 61 atf_set "descr" "init -B can select an alternate backup metadata file" 62 atf_set "require.user" "root" 63} 64init_B_body() 65{ 66 geli_test_setup 67 68 sectors=100 69 70 atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none 71 72 md=$(attach_md -t malloc -s $sectors) 73 74 # -B none 75 rm -f /var/backups/${md}.eli 76 atf_check -s exit:0 -o ignore geli init -B none -P -K keyfile ${md} 77 if [ -f /var/backups/${md}.eli ]; then 78 atf_fail "geli created a backup file even with -B none" 79 fi 80 81 # no -B 82 rm -f /var/backups/${md}.eli 83 atf_check -s exit:0 -o ignore geli init -P -K keyfile ${md} 84 if [ ! -f /var/backups/${md}.eli ]; then 85 atf_fail "geli did not create a backup file" 86 fi 87 atf_check geli clear ${md} 88 atf_check -s not-exit:0 -e ignore geli attach -p -k keyfile ${md} 89 atf_check -s exit:0 -o ignore geli restore /var/backups/${md}.eli ${md} 90 atf_check -s exit:0 -o ignore geli attach -p -k keyfile ${md} 91 atf_check geli detach ${md} 92 rm -f /var/backups/${md}.eli 93 94 # -B file 95 rm -f backupfile 96 atf_check -s exit:0 -o ignore \ 97 geli init -B backupfile -P -K keyfile ${md} 98 if [ ! -f backupfile ]; then 99 atf_fail "geli init -B did not create a backup file" 100 fi 101 atf_check geli clear ${md} 102 atf_check -s not-exit:0 -e ignore geli attach -p -k keyfile ${md} 103 atf_check geli restore backupfile ${md} 104 atf_check geli attach -p -k keyfile ${md} 105} 106init_B_cleanup() 107{ 108 geli_test_cleanup 109} 110 111atf_test_case init_J cleanup 112init_J_head() 113{ 114 atf_set "descr" "init -J accepts a passfile" 115 atf_set "require.user" "root" 116} 117init_J_body() 118{ 119 geli_test_setup 120 121 sectors=100 122 md=$(attach_md -t malloc -s `expr $sectors + 1`) 123 124 atf_check dd if=/dev/random of=keyfile0 bs=512 count=16 status=none 125 atf_check dd if=/dev/random of=keyfile1 bs=512 count=16 status=none 126 dd if=/dev/random bs=512 count=16 status=none | sha1 > passfile0 127 atf_check_equal 0 $? 128 dd if=/dev/random bs=512 count=16 status=none | sha1 > passfile1 129 atf_check_equal 0 $? 130 131 for iter in -1 0 64; do 132 atf_check -s not-exit:0 -e ignore \ 133 geli init -i ${iter} -B none -J passfile0 -P ${md} 134 atf_check -s not-exit:0 -e ignore \ 135 geli init -i ${iter} -B none -J passfile0 -P -K keyfile0 ${md} 136 atf_check geli init -i ${iter} -B none -J passfile0 -K keyfile0 ${md} 137 atf_check -s not-exit:0 -e ignore \ 138 geli attach -k keyfile0 -p ${md} 139 atf_check -s not-exit:0 -e ignore \ 140 geli attach -j passfile0 ${md} 141 atf_check -s not-exit:0 -e ignore \ 142 geli attach -j keyfile0 ${md} 143 atf_check -s not-exit:0 -e ignore \ 144 geli attach -k passfile0 -p ${md} 145 atf_check -s not-exit:0 -e ignore \ 146 geli attach -j keyfile0 -k passfile0 ${md} 147 atf_check -s not-exit:0 -e ignore \ 148 geli attach -j keyfile0 -k keyfile0 ${md} 149 atf_check -s not-exit:0 -e ignore \ 150 geli attach -j passfile0 -k passfile0 ${md} 151 atf_check -s exit:0 -e ignore \ 152 geli attach -j passfile0 -k keyfile0 ${md} 153 atf_check -s exit:0 -e ignore geli detach ${md} 154 atf_check -s exit:0 -e ignore -x \ 155 "cat keyfile0 | geli attach -j passfile0 -k - ${md}" 156 atf_check -s exit:0 -e ignore geli detach ${md} 157 atf_check -s exit:0 -e ignore -x \ 158 "cat passfile0 | geli attach -j - -k keyfile0 ${md}" 159 atf_check -s exit:0 -e ignore geli detach ${md} 160 161 atf_check -s not-exit:0 -e ignore \ 162 geli init -i ${iter} -B none -J passfile0 -J passfile1 -P ${md} 163 atf_check -s not-exit:0 -e ignore \ 164 geli init -i ${iter} -B none -J passfile0 -J passfile1 -P -K keyfile0 -K keyfile1 ${md} 165 atf_check -s exit:0 -e ignore \ 166 geli init -i ${iter} -B none -J passfile0 -J passfile1 -K keyfile0 -K keyfile1 ${md} 167 atf_check -s not-exit:0 -e ignore \ 168 geli attach -k keyfile0 -p ${md} 169 atf_check -s not-exit:0 -e ignore \ 170 geli attach -k keyfile1 -p ${md} 171 atf_check -s not-exit:0 -e ignore \ 172 geli attach -j passfile0 ${md} 173 atf_check -s not-exit:0 -e ignore \ 174 geli attach -j passfile1 ${md} 175 atf_check -s not-exit:0 -e ignore \ 176 geli attach -k keyfile0 -k keyfile1 -p ${md} 177 atf_check -s not-exit:0 -e ignore \ 178 geli attach -j passfile0 -j passfile1 ${md} 179 atf_check -s not-exit:0 -e ignore \ 180 geli attach -k keyfile0 -j passfile0 ${md} 181 atf_check -s not-exit:0 -e ignore \ 182 geli attach -k keyfile0 -j passfile1 ${md} 183 atf_check -s not-exit:0 -e ignore \ 184 geli attach -k keyfile1 -j passfile0 ${md} 185 atf_check -s not-exit:0 -e ignore \ 186 geli attach -k keyfile1 -j passfile1 ${md} 187 atf_check -s not-exit:0 -e ignore \ 188 geli attach -k keyfile0 -j passfile0 -j passfile1 ${md} 189 atf_check -s not-exit:0 -e ignore \ 190 geli attach -k keyfile1 -j passfile0 -j passfile1 ${md} 191 atf_check -s not-exit:0 -e ignore \ 192 geli attach -k keyfile0 -k keyfile1 -j passfile0 ${md} 193 atf_check -s not-exit:0 -e ignore \ 194 geli attach -k keyfile0 -k keyfile1 -j passfile1 ${md} 195 atf_check -s not-exit:0 -e ignore \ 196 geli attach -k keyfile1 -k keyfile0 -j passfile0 -j passfile1 ${md} 197 atf_check -s not-exit:0 -e ignore \ 198 geli attach -k keyfile0 -k keyfile1 -j passfile1 -j passfile0 ${md} 199 atf_check -s not-exit:0 -e ignore \ 200 geli attach -k keyfile1 -k keyfile0 -j passfile1 -j passfile0 ${md} 201 atf_check -s exit:0 -e ignore \ 202 geli attach -j passfile0 -j passfile1 -k keyfile0 -k keyfile1 ${md} 203 atf_check -s exit:0 -e ignore geli detach ${md} 204 atf_check -s exit:0 -e ignore -x \ 205 "cat passfile0 | geli attach -j - -j passfile1 -k keyfile0 -k keyfile1 ${md}" 206 atf_check -s exit:0 -e ignore geli detach ${md} 207 atf_check -s exit:0 -e ignore -x \ 208 "cat passfile1 | geli attach -j passfile0 -j - -k keyfile0 -k keyfile1 ${md}" 209 atf_check -s exit:0 -e ignore geli detach ${md} 210 atf_check -s exit:0 -e ignore -x \ 211 "cat keyfile0 | geli attach -j passfile0 -j passfile1 -k - -k keyfile1 ${md}" 212 atf_check -s exit:0 -e ignore geli detach ${md} 213 atf_check -s exit:0 -e ignore -x \ 214 "cat keyfile1 | geli attach -j passfile0 -j passfile1 -k keyfile0 -k - ${md}" 215 atf_check -s exit:0 -e ignore geli detach ${md} 216 atf_check -s exit:0 -e ignore -x \ 217 "cat keyfile0 keyfile1 | geli attach -j passfile0 -j passfile1 -k - ${md}" 218 atf_check -s exit:0 -e ignore geli detach ${md} 219 atf_check -s exit:0 -e ignore -x \ 220 "cat passfile0 passfile1 | awk '{printf \"%s\", \$0}' | geli attach -j - -k keyfile0 -k keyfile1 ${md}" 221 atf_check -s exit:0 -e ignore geli detach ${md} 222 done 223} 224init_J_cleanup() 225{ 226 geli_test_cleanup 227} 228 229init_a_test() 230{ 231 cipher=$1 232 aalgo=$2 233 secsize=$3 234 ealgo=${cipher%%:*} 235 keylen=${cipher##*:} 236 237 atf_check -s exit:0 -e ignore \ 238 geli init -B none -a $aalgo -e $ealgo -l $keylen -P -K keyfile \ 239 -s $secsize ${md} 240 atf_check geli attach -p -k keyfile ${md} 241 242 atf_check dd if=rnd of=/dev/${md}.eli bs=${secsize} count=${sectors} status=none 243 244 md_rnd=`dd if=rnd bs=${secsize} count=${sectors} status=none | md5` 245 atf_check_equal 0 $? 246 md_ddev=`dd if=/dev/${md}.eli bs=${secsize} count=${sectors} status=none | md5` 247 atf_check_equal 0 $? 248 249 if [ ${md_rnd} != ${md_ddev} ]; then 250 atf_fail "Miscompare for aalgo=${aalgo} ealgo=${ealgo} keylen=${keylen} sec=${secsize}" 251 fi 252} 253atf_test_case init_a cleanup 254init_a_head() 255{ 256 atf_set "descr" "I/O with geli and HMACs" 257 atf_set "require.user" "root" 258 atf_set "timeout" 3600 259} 260init_a_body() 261{ 262 geli_test_setup 263 264 sectors=100 265 266 atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none 267 atf_check dd if=/dev/random of=rnd bs=$MAX_SECSIZE count=${sectors} \ 268 status=none 269 for_each_geli_config init_a_test 270 true 271} 272init_a_cleanup() 273{ 274 geli_test_cleanup 275} 276 277init_alias_test() { 278 ealgo=$1 279 keylen=$2 280 expected_ealgo=$3 281 expected_keylen=$4 282 283 atf_check geli init -B none -e $ealgo -l $keylen -P -K keyfile ${md} 284 atf_check geli attach -p -k keyfile ${md} 285 real_ealgo=`geli list ${md}.eli | awk '/EncryptionAlgorithm/ {print $2}'` 286 real_keylen=`geli list ${md}.eli | awk '/KeyLength/ {print $2}'` 287 288 if [ "${real_ealgo}" != "${expected_ealgo}" ]; then 289 atf_fail "expected ${expected_ealgo} but got ${real_ealgo}" 290 fi 291 292 if [ "${real_keylen}" != "${expected_keylen}" ]; then 293 atf_fail "expected ${expected_keylen} but got ${real_keylen}" 294 fi 295 atf_check geli detach ${md} 296} 297atf_test_case init_alias cleanup 298init_alias_head() 299{ 300 atf_set "descr" "geli init accepts cipher aliases" 301 atf_set "require.user" "root" 302} 303init_alias_body() 304{ 305 geli_test_setup 306 307 md=$(attach_md -t malloc -s 1024k) 308 atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none 309 310 for spec in aes:0:AES-XTS:128 aes:128:AES-XTS:128 aes:256:AES-XTS:256 \ 311 camellia:0:CAMELLIA-CBC:128 camellia:128:CAMELLIA-CBC:128 \ 312 camellia:256:CAMELLIA-CBC:256 ; do 313 314 ealgo=`echo $spec | cut -d : -f 1` 315 keylen=`echo $spec | cut -d : -f 2` 316 expected_ealgo=`echo $spec | cut -d : -f 3` 317 expected_keylen=`echo $spec | cut -d : -f 4` 318 319 init_alias_test $ealgo $keylen $expected_ealgo $expected_keylen 320 done 321} 322init_alias_cleanup() 323{ 324 geli_test_cleanup 325} 326 327atf_test_case init_i_P cleanup 328init_i_P_head() 329{ 330 atf_set "descr" "geli: Options -i and -P are mutually exclusive" 331 atf_set "require.user" "root" 332} 333init_i_P_body() 334{ 335 geli_test_setup 336 337 sectors=100 338 md=$(attach_md -t malloc -s `expr $sectors + 1`) 339 340 atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none 341 342 atf_check -s not-exit:0 -e "match:Options -i and -P are mutually exclusive"\ 343 geli init -B none -i 64 -P -K keyfile $md 344} 345init_i_P_cleanup() 346{ 347 geli_test_cleanup 348} 349 350atf_test_case nokey cleanup 351nokey_head() 352{ 353 atf_set "descr" "geli init fails if called with no key component" 354 atf_set "require.user" "root" 355} 356nokey_body() 357{ 358 geli_test_setup 359 360 sectors=100 361 md=$(attach_md -t malloc -s `expr $sectors + 1`) 362 363 atf_check -s not-exit:0 -e match:"No key components given" \ 364 geli init -B none -P ${md} 365} 366nokey_cleanup() 367{ 368 geli_test_cleanup 369} 370 371atf_init_test_cases() 372{ 373 atf_add_test_case init 374 atf_add_test_case init_B 375 atf_add_test_case init_J 376 atf_add_test_case init_a 377 atf_add_test_case init_alias 378 atf_add_test_case init_i_P 379 atf_add_test_case nokey 380} 381