1#!/bin/sh 2# $FreeBSD$ 3 4init_test() 5{ 6 cipher=$1 7 secsize=$2 8 ealgo=${cipher%%:*} 9 keylen=${cipher##*:} 10 11 atf_check -s exit:0 -e ignore \ 12 geli init -B none -e $ealgo -l $keylen -P -K keyfile \ 13 -s $secsize ${md} 14 atf_check geli attach -p -k keyfile ${md} 15 16 atf_check dd if=rnd of=/dev/${md}.eli bs=${secsize} count=${sectors} \ 17 status=none 18 19 md_rnd=`dd if=rnd bs=${secsize} count=${sectors} status=none | md5` 20 atf_check_equal 0 $? 21 md_ddev=`dd if=/dev/${md}.eli bs=${secsize} count=${sectors} status=none | md5` 22 atf_check_equal 0 $? 23 md_edev=`dd if=/dev/${md} bs=${secsize} count=${sectors} status=none | md5` 24 atf_check_equal 0 $? 25 26 if [ ${md_rnd} != ${md_ddev} ]; then 27 atf_fail "Miscompare for ealgo=${ealgo} keylen=${keylen} sec=${secsize}" 28 fi 29 if [ ${md_rnd} == ${md_edev} ]; then 30 atf_fail "Data was not encrypted for ealgo=${ealgo} keylen=${keylen} sec=${secsize}" 31 fi 32} 33atf_test_case init cleanup 34init_head() 35{ 36 atf_set "descr" "Basic I/O with geli" 37 atf_set "require.user" "root" 38 atf_set "timeout" 600 39} 40init_body() 41{ 42 . $(atf_get_srcdir)/conf.sh 43 44 sectors=32 45 46 atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none 47 atf_check dd if=/dev/random of=rnd bs=$MAX_SECSIZE count=${sectors} \ 48 status=none 49 for_each_geli_config_nointegrity init_test 50} 51init_cleanup() 52{ 53 . $(atf_get_srcdir)/conf.sh 54 geli_test_cleanup 55} 56 57atf_test_case init_B cleanup 58init_B_head() 59{ 60 atf_set "descr" "init -B can select an alternate backup metadata file" 61 atf_set "require.user" "root" 62} 63init_B_body() 64{ 65 . $(atf_get_srcdir)/conf.sh 66 67 sectors=100 68 69 atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none 70 71 md=$(attach_md -t malloc -s $sectors) 72 73 # -B none 74 rm -f /var/backups/${md}.eli 75 atf_check -s exit:0 -o ignore geli init -B none -P -K keyfile ${md} 76 if [ -f /var/backups/${md}.eli ]; then 77 atf_fail "geli created a backup file even with -B none" 78 fi 79 80 # no -B 81 rm -f /var/backups/${md}.eli 82 atf_check -s exit:0 -o ignore geli init -P -K keyfile ${md} 83 if [ ! -f /var/backups/${md}.eli ]; then 84 atf_fail "geli did not create a backup file" 85 fi 86 atf_check geli clear ${md} 87 atf_check -s not-exit:0 -e ignore geli attach -p -k keyfile ${md} 88 atf_check -s exit:0 -o ignore geli restore /var/backups/${md}.eli ${md} 89 atf_check -s exit:0 -o ignore geli attach -p -k keyfile ${md} 90 atf_check geli detach ${md} 91 rm -f /var/backups/${md}.eli 92 93 # -B file 94 rm -f backupfile 95 atf_check -s exit:0 -o ignore \ 96 geli init -B backupfile -P -K keyfile ${md} 97 if [ ! -f backupfile ]; then 98 atf_fail "geli init -B did not create a backup file" 99 fi 100 atf_check geli clear ${md} 101 atf_check -s not-exit:0 -e ignore geli attach -p -k keyfile ${md} 102 atf_check geli restore backupfile ${md} 103 atf_check geli attach -p -k keyfile ${md} 104} 105init_B_cleanup() 106{ 107 . $(atf_get_srcdir)/conf.sh 108 geli_test_cleanup 109} 110 111atf_test_case init_J cleanup 112init_J_head() 113{ 114 atf_set "descr" "init -J accepts a passfile" 115 atf_set "require.user" "root" 116} 117init_J_body() 118{ 119 . $(atf_get_srcdir)/conf.sh 120 121 sectors=100 122 md=$(attach_md -t malloc -s `expr $sectors + 1`) 123 124 atf_check dd if=/dev/random of=keyfile0 bs=512 count=16 status=none 125 atf_check dd if=/dev/random of=keyfile1 bs=512 count=16 status=none 126 dd if=/dev/random bs=512 count=16 status=none | sha1 > passfile0 127 atf_check_equal 0 $? 128 dd if=/dev/random bs=512 count=16 status=none | sha1 > passfile1 129 atf_check_equal 0 $? 130 131 for iter in -1 0 64; do 132 atf_check -s not-exit:0 -e ignore \ 133 geli init -i ${iter} -B none -J passfile0 -P ${md} 134 atf_check -s not-exit:0 -e ignore \ 135 geli init -i ${iter} -B none -J passfile0 -P -K keyfile0 ${md} 136 atf_check geli init -i ${iter} -B none -J passfile0 -K keyfile0 ${md} 137 atf_check -s not-exit:0 -e ignore \ 138 geli attach -k keyfile0 -p ${md} 139 atf_check -s not-exit:0 -e ignore \ 140 geli attach -j passfile0 ${md} 141 atf_check -s not-exit:0 -e ignore \ 142 geli attach -j keyfile0 ${md} 143 atf_check -s not-exit:0 -e ignore \ 144 geli attach -k passfile0 -p ${md} 145 atf_check -s not-exit:0 -e ignore \ 146 geli attach -j keyfile0 -k passfile0 ${md} 147 atf_check -s not-exit:0 -e ignore \ 148 geli attach -j keyfile0 -k keyfile0 ${md} 149 atf_check -s not-exit:0 -e ignore \ 150 geli attach -j passfile0 -k passfile0 ${md} 151 atf_check -s exit:0 -e ignore \ 152 geli attach -j passfile0 -k keyfile0 ${md} 153 atf_check -s exit:0 -e ignore geli detach ${md} 154 atf_check -s exit:0 -e ignore -x \ 155 "cat keyfile0 | geli attach -j passfile0 -k - ${md}" 156 atf_check -s exit:0 -e ignore geli detach ${md} 157 atf_check -s exit:0 -e ignore -x \ 158 "cat passfile0 | geli attach -j - -k keyfile0 ${md}" 159 atf_check -s exit:0 -e ignore geli detach ${md} 160 161 atf_check -s not-exit:0 -e ignore \ 162 geli init -i ${iter} -B none -J passfile0 -J passfile1 -P ${md} 163 atf_check -s not-exit:0 -e ignore \ 164 geli init -i ${iter} -B none -J passfile0 -J passfile1 -P -K keyfile0 -K keyfile1 ${md} 165 atf_check -s exit:0 -e ignore \ 166 geli init -i ${iter} -B none -J passfile0 -J passfile1 -K keyfile0 -K keyfile1 ${md} 167 atf_check -s not-exit:0 -e ignore \ 168 geli attach -k keyfile0 -p ${md} 169 atf_check -s not-exit:0 -e ignore \ 170 geli attach -k keyfile1 -p ${md} 171 atf_check -s not-exit:0 -e ignore \ 172 geli attach -j passfile0 ${md} 173 atf_check -s not-exit:0 -e ignore \ 174 geli attach -j passfile1 ${md} 175 atf_check -s not-exit:0 -e ignore \ 176 geli attach -k keyfile0 -k keyfile1 -p ${md} 177 atf_check -s not-exit:0 -e ignore \ 178 geli attach -j passfile0 -j passfile1 ${md} 179 atf_check -s not-exit:0 -e ignore \ 180 geli attach -k keyfile0 -j passfile0 ${md} 181 atf_check -s not-exit:0 -e ignore \ 182 geli attach -k keyfile0 -j passfile1 ${md} 183 atf_check -s not-exit:0 -e ignore \ 184 geli attach -k keyfile1 -j passfile0 ${md} 185 atf_check -s not-exit:0 -e ignore \ 186 geli attach -k keyfile1 -j passfile1 ${md} 187 atf_check -s not-exit:0 -e ignore \ 188 geli attach -k keyfile0 -j passfile0 -j passfile1 ${md} 189 atf_check -s not-exit:0 -e ignore \ 190 geli attach -k keyfile1 -j passfile0 -j passfile1 ${md} 191 atf_check -s not-exit:0 -e ignore \ 192 geli attach -k keyfile0 -k keyfile1 -j passfile0 ${md} 193 atf_check -s not-exit:0 -e ignore \ 194 geli attach -k keyfile0 -k keyfile1 -j passfile1 ${md} 195 atf_check -s not-exit:0 -e ignore \ 196 geli attach -k keyfile1 -k keyfile0 -j passfile0 -j passfile1 ${md} 197 atf_check -s not-exit:0 -e ignore \ 198 geli attach -k keyfile0 -k keyfile1 -j passfile1 -j passfile0 ${md} 199 atf_check -s not-exit:0 -e ignore \ 200 geli attach -k keyfile1 -k keyfile0 -j passfile1 -j passfile0 ${md} 201 atf_check -s exit:0 -e ignore \ 202 geli attach -j passfile0 -j passfile1 -k keyfile0 -k keyfile1 ${md} 203 atf_check -s exit:0 -e ignore geli detach ${md} 204 atf_check -s exit:0 -e ignore -x \ 205 "cat passfile0 | geli attach -j - -j passfile1 -k keyfile0 -k keyfile1 ${md}" 206 atf_check -s exit:0 -e ignore geli detach ${md} 207 atf_check -s exit:0 -e ignore -x \ 208 "cat passfile1 | geli attach -j passfile0 -j - -k keyfile0 -k keyfile1 ${md}" 209 atf_check -s exit:0 -e ignore geli detach ${md} 210 atf_check -s exit:0 -e ignore -x \ 211 "cat keyfile0 | geli attach -j passfile0 -j passfile1 -k - -k keyfile1 ${md}" 212 atf_check -s exit:0 -e ignore geli detach ${md} 213 atf_check -s exit:0 -e ignore -x \ 214 "cat keyfile1 | geli attach -j passfile0 -j passfile1 -k keyfile0 -k - ${md}" 215 atf_check -s exit:0 -e ignore geli detach ${md} 216 atf_check -s exit:0 -e ignore -x \ 217 "cat keyfile0 keyfile1 | geli attach -j passfile0 -j passfile1 -k - ${md}" 218 atf_check -s exit:0 -e ignore geli detach ${md} 219 atf_check -s exit:0 -e ignore -x \ 220 "cat passfile0 passfile1 | awk '{printf \"%s\", \$0}' | geli attach -j - -k keyfile0 -k keyfile1 ${md}" 221 atf_check -s exit:0 -e ignore geli detach ${md} 222 done 223} 224init_J_cleanup() 225{ 226 . $(atf_get_srcdir)/conf.sh 227 geli_test_cleanup 228} 229 230init_a_test() 231{ 232 cipher=$1 233 aalgo=$2 234 secsize=$3 235 ealgo=${cipher%%:*} 236 keylen=${cipher##*:} 237 238 atf_check -s exit:0 -e ignore \ 239 geli init -B none -a $aalgo -e $ealgo -l $keylen -P -K keyfile \ 240 -s $secsize ${md} 241 atf_check geli attach -p -k keyfile ${md} 242 243 atf_check dd if=rnd of=/dev/${md}.eli bs=${secsize} count=${sectors} status=none 244 245 md_rnd=`dd if=rnd bs=${secsize} count=${sectors} status=none | md5` 246 atf_check_equal 0 $? 247 md_ddev=`dd if=/dev/${md}.eli bs=${secsize} count=${sectors} status=none | md5` 248 atf_check_equal 0 $? 249 250 if [ ${md_rnd} != ${md_ddev} ]; then 251 atf_fail "Miscompare for aalgo=${aalgo} ealgo=${ealgo} keylen=${keylen} sec=${secsize}" 252 fi 253} 254atf_test_case init_a cleanup 255init_a_head() 256{ 257 atf_set "descr" "I/O with geli and HMACs" 258 atf_set "require.user" "root" 259 atf_set "timeout" 3600 260} 261init_a_body() 262{ 263 . $(atf_get_srcdir)/conf.sh 264 265 sectors=100 266 267 atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none 268 atf_check dd if=/dev/random of=rnd bs=$MAX_SECSIZE count=${sectors} \ 269 status=none 270 for_each_geli_config init_a_test 271 true 272} 273init_a_cleanup() 274{ 275 . $(atf_get_srcdir)/conf.sh 276 geli_test_cleanup 277} 278 279init_alias_test() { 280 ealgo=$1 281 keylen=$2 282 expected_ealgo=$3 283 expected_keylen=$4 284 285 atf_check geli init -B none -e $ealgo -l $keylen -P -K keyfile ${md} 286 atf_check geli attach -p -k keyfile ${md} 287 real_ealgo=`geli list ${md}.eli | awk '/EncryptionAlgorithm/ {print $2}'` 288 real_keylen=`geli list ${md}.eli | awk '/KeyLength/ {print $2}'` 289 290 if [ "${real_ealgo}" != "${expected_ealgo}" ]; then 291 atf_fail "expected ${expected_ealgo} but got ${real_ealgo}" 292 fi 293 294 if [ "${real_keylen}" != "${expected_keylen}" ]; then 295 atf_fail "expected ${expected_keylen} but got ${real_keylen}" 296 fi 297 atf_check geli detach ${md} 298} 299atf_test_case init_alias cleanup 300init_alias_head() 301{ 302 atf_set "descr" "geli init accepts cipher aliases" 303 atf_set "require.user" "root" 304} 305init_alias_body() 306{ 307 . $(atf_get_srcdir)/conf.sh 308 309 md=$(attach_md -t malloc -s 1024k) 310 atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none 311 312 for spec in aes:0:AES-XTS:128 aes:128:AES-XTS:128 aes:256:AES-XTS:256 \ 313 3des:0:3DES-CBC:192 3des:192:3DES-CBC:192 \ 314 blowfish:0:Blowfish-CBC:128 blowfish:128:Blowfish-CBC:128 \ 315 blowfish:160:Blowfish-CBC:160 blowfish:192:Blowfish-CBC:192 \ 316 blowfish:224:Blowfish-CBC:224 blowfish:256:Blowfish-CBC:256 \ 317 blowfish:288:Blowfish-CBC:288 blowfish:352:Blowfish-CBC:352 \ 318 blowfish:384:Blowfish-CBC:384 blowfish:416:Blowfish-CBC:416 \ 319 blowfish:448:Blowfish-CBC:448 \ 320 camellia:0:CAMELLIA-CBC:128 camellia:128:CAMELLIA-CBC:128 \ 321 camellia:256:CAMELLIA-CBC:256 ; do 322 323 ealgo=`echo $spec | cut -d : -f 1` 324 keylen=`echo $spec | cut -d : -f 2` 325 expected_ealgo=`echo $spec | cut -d : -f 3` 326 expected_keylen=`echo $spec | cut -d : -f 4` 327 328 init_alias_test $ealgo $keylen $expected_ealgo $expected_keylen 329 done 330} 331init_alias_cleanup() 332{ 333 . $(atf_get_srcdir)/conf.sh 334 geli_test_cleanup 335} 336 337atf_test_case init_i_P cleanup 338init_i_P_head() 339{ 340 atf_set "descr" "geli: Options -i and -P are mutually exclusive" 341 atf_set "require.user" "root" 342} 343init_i_P_body() 344{ 345 . $(atf_get_srcdir)/conf.sh 346 347 sectors=100 348 md=$(attach_md -t malloc -s `expr $sectors + 1`) 349 350 atf_check dd if=/dev/random of=keyfile bs=512 count=16 status=none 351 352 atf_check -s not-exit:0 -e "match:Options -i and -P are mutually exclusive"\ 353 geli init -B none -i 64 -P -K keyfile $md 354} 355init_i_P_cleanup() 356{ 357 . $(atf_get_srcdir)/conf.sh 358 geli_test_cleanup 359} 360 361atf_test_case nokey cleanup 362nokey_head() 363{ 364 atf_set "descr" "geli init fails if called with no key component" 365 atf_set "require.user" "root" 366} 367nokey_body() 368{ 369 . $(atf_get_srcdir)/conf.sh 370 371 sectors=100 372 md=$(attach_md -t malloc -s `expr $sectors + 1`) 373 374 atf_check -s not-exit:0 -e match:"No key components given" \ 375 geli init -B none -P ${md} 376} 377nokey_cleanup() 378{ 379 . $(atf_get_srcdir)/conf.sh 380 geli_test_cleanup 381} 382 383atf_init_test_cases() 384{ 385 atf_add_test_case init 386 atf_add_test_case init_B 387 atf_add_test_case init_J 388 atf_add_test_case init_a 389 atf_add_test_case init_alias 390 atf_add_test_case init_i_P 391 atf_add_test_case nokey 392} 393