github.com/cockroachdb/cockroach@v20.2.0-alpha.1+incompatible/pkg/cli/interactive_tests/test_encryption.tcl (about)

     1  #! /usr/bin/env expect -f
     2  #
     3  source [file join [file dirname $argv0] common.tcl]
     4  
     5  set storedir "encryption_store"
     6  set keydir "$storedir/keys"
     7  
     8  spawn /bin/bash
     9  send "PS1=':''/# '\r"
    10  eexpect ":/# "
    11  
    12  proc file_has_size {filepath size} {
    13    if {! [file exist $filepath]} {
    14      report "MISSING EXPECTED FILE: $filepath"
    15      exit 1
    16    }
    17    set fsize [file size $filepath]
    18    if { $fsize != $size } {
    19  		report "WRONG FILE SIZE FOR: $filepath. EXPECTED $size, GOT $fsize"
    20  		exit 1
    21  	}
    22  }
    23  
    24  start_test "Generate encryption keys."
    25  send "mkdir -p $keydir\n"
    26  send "$argv gen encryption-key -s 128 $keydir/aes-128.key\r"
    27  eexpect "successfully created AES-128 key: $keydir/aes-128.key"
    28  send "$argv gen encryption-key -s 192 $keydir/aes-192.key\r"
    29  eexpect "successfully created AES-192 key: $keydir/aes-192.key"
    30  send "$argv gen encryption-key -s 256 $keydir/aes-256.key\r"
    31  eexpect "successfully created AES-256 key: $keydir/aes-256.key"
    32  file_has_size "$keydir/aes-128.key" "48"
    33  file_has_size "$keydir/aes-192.key" "56"
    34  file_has_size "$keydir/aes-256.key" "64"
    35  end_test
    36  
    37  start_test "Start normal node."
    38  send "$argv start-single-node --insecure --store=$storedir\r"
    39  eexpect "node starting"
    40  interrupt
    41  eexpect "shutdown completed"
    42  send "$argv debug encryption-status $storedir\r"
    43  eexpect ""
    44  end_test
    45  
    46  start_test "Restart with plaintext."
    47  send "$argv start-single-node --insecure --store=$storedir --enterprise-encryption=path=$storedir,key=plain,old-key=plain\r"
    48  eexpect "node starting"
    49  interrupt
    50  eexpect "shutdown completed"
    51  send "$argv debug encryption-status $storedir --enterprise-encryption=path=$storedir,key=plain,old-key=plain\r"
    52  eexpect "    \"Active\": true,\r\n    \"Type\": \"Plaintext\","
    53  # Try starting without the encryption flag.
    54  send "$argv start-single-node --insecure --store=$storedir\r"
    55  eexpect "encryption was used on this store before, but no encryption flags specified."
    56  end_test
    57  
    58  start_test "Restart with AES-128."
    59  send "$argv start-single-node --insecure --store=$storedir --enterprise-encryption=path=$storedir,key=$keydir/aes-128.key,old-key=plain\r"
    60  eexpect "node starting"
    61  interrupt
    62  eexpect "shutdown completed"
    63  send "$argv debug encryption-status $storedir --enterprise-encryption=path=$storedir,key=$keydir/aes-128.key,old-key=plain\r"
    64  eexpect "    \"Active\": true,\r\n    \"Type\": \"AES128_CTR\","
    65  # Try starting without the encryption flag.
    66  send "$argv start-single-node --insecure --store=$storedir\r"
    67  eexpect "encryption was used on this store before, but no encryption flags specified."
    68  # Try with the wrong key.
    69  send "$argv start-single-node --insecure --store=$storedir --enterprise-encryption=path=$storedir,key=$keydir/aes-192.key,old-key=plain\r"
    70  eexpect "store key ID * was not found"
    71  end_test
    72  
    73  start_test "Restart with AES-256."
    74  send "$argv start-single-node --insecure --store=$storedir --enterprise-encryption=path=$storedir,key=$keydir/aes-256.key,old-key=$keydir/aes-128.key\r"
    75  eexpect "node starting"
    76  interrupt
    77  eexpect "shutdown completed"
    78  send "$argv debug encryption-status $storedir --enterprise-encryption=path=$storedir,key=$keydir/aes-256.key,old-key=plain\r"
    79  eexpect "    \"Active\": true,\r\n    \"Type\": \"AES256_CTR\","
    80  # Startup again, but don't specify the old key, it's no longer in use.
    81  send "$argv start-single-node --insecure --store=$storedir --enterprise-encryption=path=$storedir,key=$keydir/aes-256.key,old-key=plain\r"
    82  eexpect "node starting"
    83  interrupt
    84  # Try starting without the encryption flag.
    85  send "$argv start-single-node --insecure --store=$storedir\r"
    86  eexpect "encryption was used on this store before, but no encryption flags specified."
    87  # Try with the wrong key.
    88  send "$argv start-single-node --insecure --store=$storedir --enterprise-encryption=path=$storedir,key=$keydir/aes-192.key,old-key=plain\r"
    89  eexpect "store key ID * was not found"
    90  end_test