zfsmstest

#!/bin/bash

typeset -r ZFSMS="${0%%/*}/zfsms"
typeset -r TMPZPOOL='ztest'
typeset -r INITKEY='initzkey'
typeset -r TMPDS="$TMPZPOOL/test"
typeset USERKEY
typeset USERKEY2

# shellcheck source=./zfsms
source "$ZFSMS"

function main() {
	teardown
	run_test "test_convert_default"
	run_test "test_convert_slot"
	run_test "test_convert_slot_with_iters"
	run_test "test_loadkey_default_nop"
	run_test "test_loadkey_default"
	run_test "test_listslots_default"
	run_test "test_addkey"
	run_test "test_removeslot"
	run_test "test_loadkey_explicit_slot2"
	run_test "test_loadkey_implicit_slot2"
	run_test "test_fail_remove_last_slot"
	run_test "test_removekey1"
	run_test "test_removekey2"
	run_test "test_keyfile"
	run_test "test_changekey"
	run_test "test_convert_subds"
	run_test "test_inherit"
	#run_test "test_nullbyte_key"
}

############
# Wrappers #
############

function run_test() {
	local -r red='\033[33;31m'
	local -r green='\033[33;32m'
	local -r reset='\e[0m'
	setup
	if "$1"; then
		printf "${green}passed${reset}: %s\n" "$1"
	else
		printf "${red}failed${reset}: %s (exit code: %d)\n" "$1" $?
	fi
	teardown
}

function setup() {
	typeset TMPDIR

	TMPDIR="$(mktemp --directory --tmpdir zfsms.XXXXXXXX)"
	truncate "$TMPDIR"/test.zpool --size 1G
	sudo zpool create \
		-o altroot="$TMPDIR" \
		-o cachefile="$TMPDIR/test.zcache" \
		"$TMPZPOOL" \
		"$TMPDIR/test.zpool"
	sudo zfs create \
		-o encryption=on \
		-o keyformat=passphrase \
		$TMPDS \
		<<< "$INITKEY"
}

function teardown() {
	local tempdir

	if zfs list "$TMPZPOOL" > /dev/null 2>&1; then
		if tempdir="$(get_tempdir)"; then
			sudo zpool destroy "$TMPZPOOL"
			rm -rf "$tempdir"
		else
			echo "zpool $TMPZPOOL exists but is not from the test script"
			exit 1
		fi
	fi
}

function get_tempdir() {
	local mp
	mp="$(zfs get -Ho value mountpoint "$TMPZPOOL")"
	[[ "$mp" == /tmp/zfsms.????????/$TMPZPOOL ]] && echo "${mp%/"$TMPZPOOL"}"
}

function getprop() {
	zfs get -Ho value "$1" "$TMPDS"
}

function validate_slot() {
	local slot="$1"
	local ukey="$2"
	local wrapped_key
	local iters

	if [[ -z "$ukey" ]]; then
		ukey="$(get-user-key "$(getprop keylocation:"$slot")")" || return 63
	fi
	wrapped_key="$(getprop wrappedkey:"$slot")"
	iters="$(getprop pbkdf2iters:"$slot")"

	base64 -d <<< "$wrapped_key" > /dev/null 2>&1 || return 62
	[[ "$iters" =~ ^[[:digit:]]+$ ]] || return 61
	[[ "$iters" != 0 ]] || return 60
	unwrap "$wrapped_key" \
		"$ukey" \
		"$iters" \
		> /dev/null \
		|| return 59
}

#########
# Tests #
#########

function test_convert_default() {
	USERKEY='asdfasdf'

	sudo "$ZFSMS" convert -L prompt "$TMPDS" <<< "$USERKEY" || return $?
	validate_slot 'default' "$USERKEY"
}

function test_convert_slot() {
	local slot='slot1'
	local ukey='f80908b6'

	sudo "$ZFSMS" convert -s "$slot" "$TMPDS" <<< "$ukey" || return $?
	validate_slot "$slot" "$ukey"
}

function test_convert_slot_with_iters() {
	local slot='slot1'
	local ukey='72e378ed'
	local iters=100000

	sudo "$ZFSMS" convert -s "$slot" -I "$iters" "$TMPDS"<<< "$ukey" || return $?
	[[ "$(getprop pbkdf2iters:$slot)" == "$iters" ]] || return 127
	validate_slot "$slot" "$ukey" || return 126
	unwrap "$(getprop wrappedkey:$slot)" "$ukey" "$iters" \
		| sudo zfs load-key -n "$TMPDS" \
		> /dev/null 2>&1 \
		|| return 125
}

function test_loadkey_default_nop() {
	test_convert_default || return 128
	sudo "$ZFSMS" load-key -n "$TMPDS" > /dev/null 2>&1 <<< "$USERKEY"
}

function test_loadkey_default() {
	test_convert_default || return 128
	sudo zfs umount $TMPZPOOL || return 129
	sudo zfs unload-key $TMPDS || return 130
	sudo "$ZFSMS" load-key "$TMPDS" <<< "$USERKEY"
}

function test_loadkey_explicit_slot2() {
	test_addkey || return 128
	sudo "$ZFSMS" load-key -n -s slot2 "$TMPDS" > /dev/null <<< "$USERKEY2"
}

function test_loadkey_implicit_slot2() {
	test_addkey || return 128
	sudo "$ZFSMS" load-key -n "$TMPDS" > /dev/null <<< "$USERKEY2"
}

function test_listslots_default() {
	test_convert_default || return 128
	[[ "$($ZFSMS list-slots ztest/test)" == "default" ]]
}

function test_addkey() {
	local expected
	local actual
	USERKEY2='zxcvfdsa'

	test_convert_default || return 128
	printf '%s\n%s\n' "$USERKEY" "$USERKEY2" \
		| sudo "$ZFSMS" add-key \
			-s "slot2" \
			-u "default" \
			"$TMPDS" \
		> /dev/null \
		|| return $?
	expected="$(printf 'default\nslot2')"
	actual="$("$ZFSMS" list-slots "$TMPDS" | sort)" || return 129
	[[ "$expected" == "$actual" ]] || return 127
	validate_slot 'slot2' "$USERKEY2"
}

function test_removeslot() {
	local expected
	local actual

	test_addkey || return 128
	sudo "$ZFSMS" remove-slot -s slot2 $TMPDS || return 129

	expected='default'
	actual="$("$ZFSMS" list-slots $TMPDS)"
	[[ "$expected" == "$actual" ]] || return 130

	expected='-'
	actual="$(getprop  "wrappedkey:slot2")"
	[[ "$expected" == "$actual" ]] || return 1

	actual="$(getprop "pbkdf2iters:slot2")"
	[[ "$expected" == "$actual" ]] || return 2
}

function test_fail_remove_last_slot() {
	local expected
	local actual

	test_convert_default || return 128
	# Next line should fail
	sudo "$ZFSMS" remove-slot -s default "$TMPDS" \
		> /dev/null 2>&1 \
		&& return 1
	[[ "$(getprop "wrappedkey:default")" != '-' ]] || return 2
	[[ "$(getprop "pbkdf2iters:default")" != '-' ]] || return 3
}

function test_removekey1() {
	local expected
	local actual

	test_addkey || return 128
	sudo "$ZFSMS" remove-key "$TMPDS" <<< "$USERKEY" || return $?

	expected='slot2'
	actual="$("$ZFSMS" list-slots "$TMPDS")" || return 129
	[[ "$expected" == "$actual" ]] || return 127

	expected='-'
	actual="$(getprop "wrappedkey:default")"
	[[ "$expected" == "$actual" ]] || return 126

	actual="$(getprop "pbkdf2iters:default")"
	[[ "$expected" == "$actual" ]] || return 125
}

function test_removekey2() {
	local expected
	local actual

	test_addkey || return 128
	sudo "$ZFSMS" remove-key "$TMPDS" <<< "$USERKEY2" || return $?

	expected='default'
	actual="$("$ZFSMS" list-slots "$TMPDS")" || return 129
	[[ "$expected" == "$actual" ]] || return 127

	expected='-'
	actual="$(getprop "wrappedkey:slot2")"
	[[ "$expected" == "$actual" ]] || return 126

	actual="$(getprop "pbkdf2iters:slot2")"
	[[ "$expected" == "$actual" ]] || return 125
}

function test_keyfile() {
	local expected
	local actual
	local keyfile

	test_convert_default || return 128
	keyfile="$(mktemp)"
	printf 'foobarbaz' > "$keyfile"
	printf '%s\n' "$USERKEY" \
		| sudo "$ZFSMS" add-key \
			-s "slot2" \
			-u "default" \
			-L "file://$keyfile" \
			"$TMPDS" \
		> /dev/null \
		|| { rm "$keyfile"; return $?; }
	expected="$(printf 'default\nslot2')"
	actual="$("$ZFSMS" list-slots "$TMPDS" | sort)" || return 127
	[[ "$expected" == "$actual" ]] || return 126
	printf 'foobarbaz' \
		| sudo "$ZFSMS" load-key \
			-n \
			-s slot2 \
			-L prompt \
			"$TMPDS" \
		> /dev/null
	sudo "$ZFSMS" load-key \
		-n \
		-s slot2 \
		"$TMPDS" \
		> /dev/null
	rm -rf "$keyfile"
}

function test_changekey() {
	local actual
	local keyfile

	test_convert_default || return 128
	keyfile="$(mktemp)"
	printf 'c99e3c7291c303c5' > "$keyfile"
	echo "$USERKEY" \
		| sudo "$ZFSMS" change-key \
			-s default \
			-L "file://$keyfile" \
			-I 100000 \
			"$TMPDS" \
		> /dev/null \
		|| { rm "$keyfile"; return $?; }
	actual="$("$ZFSMS" list-slots "$TMPDS")" || return 129
	[[ 'default' == "$actual" ]] || return 127
	[[ "file://$keyfile" == "$(getprop 'keylocation:default')" ]] || return 126
	validate_slot 'default' || return $?
}

function test_convert_subds() {
	local tempdir
	local mp

	tempdir="$(get_tempdir)"
	mp="$tempdir/sub"
	mkdir "$mp"
	sudo zfs create \
		-o encryption=on \
		-o keyformat=passphrase \
		"$TMPDS/sub" \
		<<< "$INITKEY"
	USERKEY='becbb556f845e4e2'
	sudo "$ZFSMS" convert "$TMPDS/sub" <<< "$USERKEY" || return $?
	unwrap "$(zfs get -Ho value wrappedkey:default "$TMPDS/sub")" \
		"$USERKEY" \
		"$(zfs get -Ho value pbkdf2iters:default "$TMPDS/sub")" \
		> /dev/null \
		|| return 127
}

function test_inherit() {
	test_convert_subds || return 128
	sudo "$ZFSMS" inherit "$TMPDS/sub"
	[[ "$(sudo zfs get -Ho value pbkdf2iters:default "$TMPDS/sub")" == '-' ]] || return 127
	[[ "$(sudo zfs get -Ho value keylocation:default "$TMPDS/sub")" == '-' ]] || return 126
	[[ "$(sudo zfs get -Ho value wrappedkey:default "$TMPDS/sub")" == '-' ]] || return 125
	sudo zfs load-key -n "$TMPDS" <<< "$INITKEY" > /dev/null 2>&1 || return 124
}

function test_nullbyte_key() {
	local expected
	local actual
	local keyfile

	test_convert_default || return 128
	keyfile="$(mktemp)"
	printf 'foo\0bar\0baz' > "$keyfile"
	printf '%s\n' "$USERKEY" \
		| sudo "$ZFSMS" add-key \
			-s "slot2" \
			-u "default" \
			-L "file://$keyfile" \
			"$TMPDS" \
		> /dev/null \
		|| { rm "$keyfile"; return $?; }
	rm -rf "$keyfile"
	expected="$(printf 'default\nslot2')"
	actual="$("$ZFSMS" list-slots "$TMPDS" | sort)" || return 127
	[[ "$expected" == "$actual" ]] || return 126
	printf 'foo\0bar\0baz' \
		| sudo "$ZFSMS" load-key \
			-n \
			-s slot2 \
			-L prompt \
			"$TMPDS" \
		> /dev/null
	printf 'foobarbaz' \
		| sudo "$ZFSMS" load-key \
			-n \
			-s slot2 \
			-L prompt \
			"$TMPDS" \
		> /dev/null \
		&& return 125 # This should NOT work
}

main "$@"

# vim: noexpandtab sts=8 sw=8 colorcolumn=81 textwidth=80 foldmethod=indent