generic: verify ciphertext with hardware-wrapped keys

Add two tests which verify that encrypted files are encrypted correctly
when a hardware-wrapped inline encryption key is used.  The two tests
are identical except that one uses FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64
and the other uses FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32.  These cover both
of the settings where hardware-wrapped keys may be used.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Zorro Lang <zlang@redhat.com>
Signed-off-by: Zorro Lang <zlang@kernel.org>

diff --git a/tests/generic/368 b/tests/generic/368
new file mode 100755 (executable)
index 0000000..38c149e
--- /dev/null
+++ b/tests/generic/368
@@ -0,0 +1,24 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright 2024 Google LLC
+#
+# FS QA Test No. 368
+#
+# Verify the ciphertext for encryption policies that use a hardware-wrapped
+# inline encryption key, the IV_INO_LBLK_64 flag, and AES-256-XTS.
+#
+. ./common/preamble
+_begin_fstest auto quick encrypt
+
+. ./common/filter
+. ./common/encrypt
+
+# Hardware-wrapped keys require the inlinecrypt mount option.
+_require_scratch_inlinecrypt
+export MOUNT_OPTIONS="$MOUNT_OPTIONS -o inlinecrypt"
+
+_verify_ciphertext_for_encryption_policy AES-256-XTS AES-256-CTS-CBC \
+       v2 iv_ino_lblk_64 hw_wrapped_key
+
+status=0
+exit

diff --git a/tests/generic/368.out b/tests/generic/368.out
new file mode 100644 (file)
index 0000000..5041d28
--- /dev/null
+++ b/tests/generic/368.out
@@ -0,0 +1,6 @@
+QA output created by 368
+
+Verifying ciphertext with parameters:
+       contents_encryption_mode: AES-256-XTS
+       filenames_encryption_mode: AES-256-CTS-CBC
+       options: v2 iv_ino_lblk_64 hw_wrapped_key

diff --git a/tests/generic/369 b/tests/generic/369
new file mode 100755 (executable)
index 0000000..f5b6d02
--- /dev/null
+++ b/tests/generic/369
@@ -0,0 +1,24 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright 2024 Google LLC
+#
+# FS QA Test No. 369
+#
+# Verify the ciphertext for encryption policies that use a hardware-wrapped
+# inline encryption key, the IV_INO_LBLK_32 flag, and AES-256-XTS.
+#
+. ./common/preamble
+_begin_fstest auto quick encrypt
+
+. ./common/filter
+. ./common/encrypt
+
+# Hardware-wrapped keys require the inlinecrypt mount option.
+_require_scratch_inlinecrypt
+export MOUNT_OPTIONS="$MOUNT_OPTIONS -o inlinecrypt"
+
+_verify_ciphertext_for_encryption_policy AES-256-XTS AES-256-CTS-CBC \
+       v2 iv_ino_lblk_32 hw_wrapped_key
+
+status=0
+exit

diff --git a/tests/generic/369.out b/tests/generic/369.out
new file mode 100644 (file)
index 0000000..3dd14b8
--- /dev/null
+++ b/tests/generic/369.out
@@ -0,0 +1,6 @@
+QA output created by 369
+
+Verifying ciphertext with parameters:
+       contents_encryption_mode: AES-256-XTS
+       filenames_encryption_mode: AES-256-CTS-CBC
+       options: v2 iv_ino_lblk_32 hw_wrapped_key