rc=$?
[[ $rc != 0 ]] && error "nodemap_add failed with $rc" && return 1
+ for (( i = 0; i < NODEMAP_COUNT; i++ )); do
+ local csum=${HOSTNAME_CHECKSUM}_${i}
+
+ if ! do_facet mgs $LCTL nodemap_modify --name $csum \
+ --property admin --value 0; then
+ rc=$((rc + 1))
+ fi
+ if ! do_facet mgs $LCTL nodemap_modify --name $csum \
+ --property trusted --value 0; then
+ rc=$((rc + 1))
+ fi
+ done
+ [[ $rc != 0 ]] && error "nodemap_modify failed with $rc" && return 1
+
rc=0
for ((i = 0; i < NODEMAP_COUNT; i++)); do
if ! add_range ${HOSTNAME_CHECKSUM}_${i} $i; then
nodemap_exercise_fileset() {
local nm="$1"
local loop=0
+ local check_proj=true
+
+ (( $MDS1_VERSION >= $(version_code 2.14.52) )) || check_proj=false
# setup
if [ "$nm" == "default" ]; then
do_facet mgs $LCTL nodemap_activate 1
wait_nm_sync active
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property admin --value 1
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property trusted --value 1
+ wait_nm_sync default admin_nodemap
+ wait_nm_sync default trusted_nodemap
+ check_proj=false
else
nodemap_test_setup
fi
error "unable to add fileset info to $nm nodemap for servers"
wait_nm_sync $nm fileset "nodemap.${nm}.fileset=/$subdir"
+ if $check_proj; then
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property admin --value 1
+ wait_nm_sync $nm admin_nodemap
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property trusted --value 0
+ wait_nm_sync $nm trusted_nodemap
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property map_mode --value projid
+ wait_nm_sync $nm map_mode
+ do_facet mgs $LCTL nodemap_add_idmap --name $nm \
+ --idtype projid --idmap 1:1
+ do_facet mgs $LCTL nodemap_modify --name $nm \
+ --property deny_unknown --value 1
+ wait_nm_sync $nm deny_unknown
+ fi
+
# re-mount client
zconf_umount_clients ${clients_arr[0]} $MOUNT ||
error "unable to umount client ${clients_arr[0]}"
do_node ${clients_arr[0]} test -f $MOUNT/this_is_$subdir ||
error "fileset not taken into account"
+ if $check_proj; then
+ do_node ${clients_arr[0]} $LFS setquota -p 1 -b 10000 -B 11000 \
+ -i 0 -I 0 $MOUNT || error "setquota -p 1 failed"
+ do_node ${clients_arr[0]} $LFS setquota -p 2 -b 10000 -B 11000 \
+ -i 0 -I 0 $MOUNT && error "setquota -p 2 should fail"
+ fi
+
# re-mount client with sub-subdir
zconf_umount_clients ${clients_arr[0]} $MOUNT ||
error "unable to umount client ${clients_arr[0]}"
fi
fileset_test_cleanup "$nm"
if [ "$nm" == "default" ]; then
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property admin --value 0
+ do_facet mgs $LCTL nodemap_modify --name default \
+ --property trusted --value 0
+ wait_nm_sync default admin_nodemap
+ wait_nm_sync default trusted_nodemap
do_facet mgs $LCTL nodemap_activate 0
wait_nm_sync active 0
trap 0
}
run_test 35 "Check permissions when accessing changelogs"
+setup_dummy_key() {
+ local mode='\x00\x00\x00\x00'
+ local raw="$(printf ""\\\\x%02x"" {0..63})"
+ local size
+ local key
+
+ [[ $(lscpu) =~ Byte\ Order.*Little ]] && size='\x40\x00\x00\x00' ||
+ size='\x00\x00\x00\x40'
+ key="${mode}${raw}${size}"
+ echo -n -e "${key}" | keyctl padd logon fscrypt:4242424242424242 @s
+}
+
setup_for_enc_tests() {
# remount client with test_dummy_encryption option
if is_mounted $MOUNT; then
}
cleanup_for_enc_tests() {
- rm -rf $DIR/$tdir
+ local dummy_key
+
+ rm -rf $DIR/$tdir $*
# remount client normally
if is_mounted $MOUNT; then
mount_client $MOUNT2 ${MOUNT_OPTS} ||
error "remount failed"
fi
+
+ # remove fscrypt key from keyring
+ dummy_key=$(keyctl show | awk '$7 ~ "^fscrypt:" {print $1}')
+ if [ -n "$dummy_key" ]; then
+ keyctl revoke $dummy_key
+ keyctl reap
+ fi
}
cleanup_nodemap_after_enc_tests() {
local tmpfile=$TMP/abc
local tmpfile2=$TMP/abc2
local seek
+ local filesz
+ #define LUSTRE_ENCRYPTION_UNIT_SIZE (1 << 12)
+ local UNIT_SIZE=$((1 << 12))
+ local scrambledfile
$LCTL get_param mdc.*.import | grep -q client_encryption ||
skip "client encryption not supported"
cmp -bl $tmpfile $testfile ||
error "file $testfile is corrupted on server (5)"
+ filesz=$(stat --format=%s $testfile)
+ filesz=$(((filesz+UNIT_SIZE-1)/UNIT_SIZE * UNIT_SIZE))
+
+ sync ; echo 3 > /proc/sys/vm/drop_caches
+
+ # remove fscrypt key from keyring
+ keyctl revoke $(keyctl show | awk '$7 ~ "^fscrypt:" {print $1}')
+ keyctl reap
+
+ scrambledfile=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type f)
+ [ $(stat --format=%s $scrambledfile) -eq $filesz ] ||
+ error "file size without key should be rounded up"
+
rm -f $tmpfile
}
run_test 40 "exercise size of encrypted file"
local testfile=$testdir/myfile
local testdir2=$DIR/$tdir/mydirwithaveryverylongnametotestcodebehaviour0
local testfile2=$testdir/myfilewithaveryverylongnametotestcodebehaviour0
+ # testdir3, testfile3, testhl3 and testsl3 names are 255 bytes long
+ local testdir3=$testdir2/dir_abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz012345678
+ local testfile3=$testdir2/file_abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz01234567
+ local testhl3=$testdir2/hl_abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789
+ local testsl3=$testdir2/sl_abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789
local lsfile=$TMP/lsfile
local scrambleddir
local scrambledfile
else
mkdir $testdir2
fi
+ if [ "$mds1_FSTYPE" = ldiskfs ]; then
+ # For now, restrict this part of the test to ldiskfs backend,
+ # as osd-zfs does not support 255 byte-long encrypted names.
+ mkdir $testdir3 || error "cannot mkdir $testdir3"
+ touch $testfile3 || error "cannot touch $testfile3"
+ ln $testfile3 $testhl3 || error "cannot ln $testhl3"
+ ln -s $testfile3 $testsl3 || error "cannot ln $testsl3"
+ fi
sync ; echo 3 > /proc/sys/vm/drop_caches
# remove fscrypt key from keyring
# this is $testdir2
scrambleddir=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type d| grep _)
stat $scrambleddir || error "stat $scrambleddir failed"
+ if [ "$mds1_FSTYPE" = ldiskfs ]; then
+ stat $scrambleddir/* || error "cannot stat in $scrambleddir"
+ rm -rf $scrambleddir/* || error "cannot clean in $scrambleddir"
+ fi
rmdir $scrambleddir || error "rmdir $scrambleddir failed"
scrambleddir=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type d)
mkdir $dirname
trace_cmd stat $dirname
- trace_cmd touch $dirname/f1
+ trace_cmd echo a > $dirname/f1
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd stat $dirname/f1
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd cat $dirname/f1
dd if=/dev/zero of=$dirname/f1 bs=1M count=10 conv=fsync
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
MATCHING_STRING="get xattr 'security.c'" \
trace_cmd $TRUNCATE $dirname/f1 10240
trace_cmd $LFS setstripe -E -1 -S 4M $dirname/f2
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd $LFS migrate -E -1 -S 256K $dirname/f2
if [[ $MDSCOUNT -gt 1 ]]; then
trace_cmd $LFS setdirstripe -i 1 $dirname/d2
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd $LFS migrate -m 0 $dirname/d2
- touch $dirname/d2/subf
+ echo b > $dirname/d2/subf
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
# migrate a non-empty encrypted dir
trace_cmd $LFS migrate -m 1 $dirname/d2
$LFS setdirstripe -i 1 -c 1 $dirname/d3
dirname=$dirname/d3/subdir
mkdir $dirname
-
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd stat $dirname
- trace_cmd touch $dirname/f1
+ trace_cmd echo c > $dirname/f1
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd stat $dirname/f1
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd cat $dirname/f1
dd if=/dev/zero of=$dirname/f1 bs=1M count=10 conv=fsync
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
MATCHING_STRING="get xattr 'security.c'" \
trace_cmd $TRUNCATE $dirname/f1 10240
trace_cmd $LFS setstripe -E -1 -S 4M $dirname/f2
+ sync ; sync ; echo 3 > /proc/sys/vm/drop_caches
trace_cmd $LFS migrate -E -1 -S 256K $dirname/f2
else
skip_noexit "2nd part needs >= 2 MDTs"
[[ $OSTCOUNT -lt 2 ]] && skip_env "needs >= 2 OSTs"
- stack_trap cleanup_for_enc_tests EXIT
+ stack_trap "cleanup_for_enc_tests $tmpfile $mirror1 $mirror2" EXIT
setup_for_enc_tests
dd if=/dev/urandom of=$tmpfile bs=5000 count=1 conv=fsync
cancel_lru_locks
cmp -bl $tmpfile $testfile ||
error "extended/split file is corrupted"
-
- rm -f $tmpfile $mirror1 $mirror2
}
run_test 52 "Mirrored encrypted file"
echo 3 > /proc/sys/vm/drop_caches
sleep 10
- ls -ailR $MOUNT > /dev/null || error "fail to ls"
+ ls -ailR $DIR/$tdir > /dev/null || error "fail to ls"
}
run_test 58 "access to enc file's xattrs"
+insert_enc_key() {
+ sync ; echo 3 > /proc/sys/vm/drop_caches
+ setup_dummy_key
+}
+
+remove_env_key() {
+ cancel_lru_locks
+ sync ; echo 3 > /proc/sys/vm/drop_caches
+ keyctl revoke $(keyctl show | awk '$7 ~ "^fscrypt:" {print $1}')
+ keyctl reap
+}
+
+verify_mirror() {
+ local mirror1=$TMP/$tfile.mirror1
+ local mirror2=$TMP/$tfile.mirror2
+ local testfile=$1
+ local reffile=$2
+
+ $LFS mirror verify -vvv $testfile ||
+ error "verifying mirror failed (1)"
+ if [ $($LFS mirror verify -v $testfile 2>&1 |
+ grep -ci "only valid") -ne 0 ]; then
+ error "verifying mirror failed (2)"
+ fi
+
+ $LFS mirror read -N 1 -o $mirror1 $testfile ||
+ error "read from mirror 1 failed"
+ cmp -bl $reffile $mirror1 ||
+ error "corruption of mirror 1"
+ $LFS mirror read -N 2 -o $mirror2 $testfile ||
+ error "read from mirror 2 failed"
+ cmp -bl $reffile $mirror2 ||
+ error "corruption of mirror 2"
+}
+
+test_59a() {
+ local testfile=$DIR/$tdir/$tfile
+ local tmpfile=$TMP/$tfile
+ local mirror1=$TMP/$tfile.mirror1
+ local mirror2=$TMP/$tfile.mirror2
+ local scrambledfile
+
+ $LCTL get_param mdc.*.import | grep -q client_encryption ||
+ skip "client encryption not supported"
+
+ mount.lustre --help |& grep -q "test_dummy_encryption:" ||
+ skip "need dummy encryption support"
+
+ [[ $OSTCOUNT -lt 2 ]] && skip_env "needs >= 2 OSTs"
+
+ stack_trap "cleanup_for_enc_tests $tmpfile $mirror1 $mirror2" EXIT
+ setup_for_enc_tests
+
+ dd if=/dev/urandom of=$tmpfile bs=5000 count=1 conv=fsync
+
+ $LFS mirror create -N -i0 -N -i1 $testfile ||
+ error "could not create mirror"
+ dd if=$tmpfile of=$testfile bs=5000 count=1 conv=fsync ||
+ error "could not write to $testfile"
+ $LFS getstripe $testfile
+
+ # now, without the key
+ remove_env_key
+ scrambledfile=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type f)
+ $LFS mirror resync $scrambledfile ||
+ error "could not resync mirror"
+
+ $LFS mirror verify -vvv $scrambledfile ||
+ error "mirror verify failed (1)"
+ if [ $($LFS mirror verify -v $scrambledfile 2>&1 |
+ grep -ci "only valid") -ne 0 ]; then
+ error "mirror verify failed (2)"
+ fi
+
+ $LFS mirror read -N 1 -o $mirror1 $scrambledfile &&
+ error "read from mirror should fail"
+
+ # now, with the key
+ insert_enc_key
+ verify_mirror $testfile $tmpfile
+}
+run_test 59a "mirror resync of encrypted files without key"
+
+test_59b() {
+ local testfile=$DIR/$tdir/$tfile
+ local tmpfile=$TMP/$tfile
+ local mirror1=$TMP/$tfile.mirror1
+ local mirror2=$TMP/$tfile.mirror2
+ local scrambledfile
+
+ $LCTL get_param mdc.*.import | grep -q client_encryption ||
+ skip "client encryption not supported"
+
+ mount.lustre --help |& grep -q "test_dummy_encryption:" ||
+ skip "need dummy encryption support"
+
+ [[ $OSTCOUNT -lt 2 ]] && skip_env "needs >= 2 OSTs"
+
+ stack_trap "cleanup_for_enc_tests $tmpfile $mirror1 $mirror2" EXIT
+ setup_for_enc_tests
+
+ tr '\0' '2' < /dev/zero |
+ dd of=$tmpfile bs=1 count=9000 conv=fsync
+
+ $LFS setstripe -c1 -i0 $testfile
+ dd if=$tmpfile of=$testfile bs=9000 count=1 conv=fsync ||
+ error "write to $testfile failed"
+ $LFS getstripe $testfile
+
+ # now, without the key
+ remove_env_key
+ scrambledfile=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type f)
+ $LFS migrate -i1 $scrambledfile ||
+ error "migrate $scrambledfile failed"
+ $LFS getstripe $scrambledfile
+ stripe=$($LFS getstripe -i $scrambledfile)
+ [ $stripe -eq 1 ] || error "migrate file $scrambledfile failed"
+ cancel_lru_locks
+
+ # now, with the key
+ insert_enc_key
+ cmp -bl $tmpfile $testfile ||
+ error "migrated file is corrupted"
+
+ # now, without the key
+ remove_env_key
+ $LFS mirror extend -N -i0 $scrambledfile ||
+ error "mirror extend $scrambledfile failed (1)"
+ $LFS getstripe $scrambledfile
+ mirror_count=$($LFS getstripe -N $scrambledfile)
+ [ $mirror_count -eq 2 ] ||
+ error "mirror extend file $scrambledfile failed (2)"
+ stripe=$($LFS getstripe --mirror-id=1 -i $scrambledfile)
+ [ $stripe -eq 1 ] ||
+ error "mirror extend file $scrambledfile failed (3)"
+ stripe=$($LFS getstripe --mirror-id=2 -i $scrambledfile)
+ [ $stripe -eq 0 ] ||
+ error "mirror extend file $scrambledfile failed (4)"
+
+ $LFS mirror verify -vvv $scrambledfile ||
+ error "mirror verify failed (1)"
+ if [ $($LFS mirror verify -v $scrambledfile 2>&1 |
+ grep -ci "only valid") -ne 0 ]; then
+ error "mirror verify failed (2)"
+ fi
+
+ # now, with the key
+ insert_enc_key
+ verify_mirror $testfile $tmpfile
+
+ # now, without the key
+ remove_env_key
+ $LFS mirror split --mirror-id 1 -d $scrambledfile ||
+ error "mirror split file $scrambledfile failed (1)"
+ $LFS getstripe $scrambledfile
+ mirror_count=$($LFS getstripe -N $scrambledfile)
+ [ $mirror_count -eq 1 ] ||
+ error "mirror split file $scrambledfile failed (2)"
+ stripe=$($LFS getstripe --mirror-id=1 -i $scrambledfile)
+ [ -z "$stripe" ] || error "mirror split file $scrambledfile failed (3)"
+ stripe=$($LFS getstripe --mirror-id=2 -i $scrambledfile)
+ [ $stripe -eq 0 ] || error "mirror split file $scrambledfile failed (4)"
+
+ # now, with the key
+ insert_enc_key
+ cancel_lru_locks
+ cmp -bl $tmpfile $testfile ||
+ error "extended/split file is corrupted"
+}
+run_test 59b "migrate/extend/split of encrypted files without key"
+
+test_59c() {
+ local dirname=$DIR/$tdir/subdir
+ local scrambleddir
+
+ $LCTL get_param mdc.*.import | grep -q client_encryption ||
+ skip "client encryption not supported"
+
+ mount.lustre --help |& grep -q "test_dummy_encryption:" ||
+ skip "need dummy encryption support"
+
+ [[ $MDSCOUNT -ge 2 ]] || skip_env "needs >= 2 MDTs"
+
+ stack_trap "cleanup_for_enc_tests" EXIT
+ setup_for_enc_tests
+
+ $LFS setdirstripe -i 0 $dirname
+ echo b > $dirname/subf
+
+ # now, without the key
+ remove_env_key
+ scrambleddir=$(find $DIR/$tdir/ -maxdepth 1 -mindepth 1 -type d)
+
+ # migrate a non-empty encrypted dir
+ $LFS migrate -m 1 $scrambleddir ||
+ error "migrate $scrambleddir between MDTs failed (1)"
+
+ stripe=$($LFS getdirstripe -i $scrambleddir)
+ [ $stripe -eq 1 ] ||
+ error "migrate $scrambleddir between MDTs failed (2)"
+}
+run_test 59c "MDT migrate of encrypted files without key"
+
log "cleanup: ======================================================"
sec_unsetup() {
git://git.whamcloud.com / fs / lustre-release.git / blobdiff