From: Eric Biggers Date: Fri, 13 Dec 2024 05:28:39 +0000 (-0800) Subject: generic: verify ciphertext with hardware-wrapped keys X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=59e3354dd1f7a11b457fee3e529dedfba7134a9b;p=users%2Fhch%2Fxfstests-dev.git generic: verify ciphertext with hardware-wrapped keys Add two tests which verify that encrypted files are encrypted correctly when a hardware-wrapped inline encryption key is used. The two tests are identical except that one uses FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 and the other uses FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32. These cover both of the settings where hardware-wrapped keys may be used. Signed-off-by: Eric Biggers Reviewed-by: Zorro Lang Signed-off-by: Zorro Lang --- diff --git a/tests/generic/368 b/tests/generic/368 new file mode 100755 index 000000000..38c149e2b --- /dev/null +++ b/tests/generic/368 @@ -0,0 +1,24 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright 2024 Google LLC +# +# FS QA Test No. 368 +# +# Verify the ciphertext for encryption policies that use a hardware-wrapped +# inline encryption key, the IV_INO_LBLK_64 flag, and AES-256-XTS. +# +. ./common/preamble +_begin_fstest auto quick encrypt + +. ./common/filter +. ./common/encrypt + +# Hardware-wrapped keys require the inlinecrypt mount option. +_require_scratch_inlinecrypt +export MOUNT_OPTIONS="$MOUNT_OPTIONS -o inlinecrypt" + +_verify_ciphertext_for_encryption_policy AES-256-XTS AES-256-CTS-CBC \ + v2 iv_ino_lblk_64 hw_wrapped_key + +status=0 +exit diff --git a/tests/generic/368.out b/tests/generic/368.out new file mode 100644 index 000000000..5041d2877 --- /dev/null +++ b/tests/generic/368.out @@ -0,0 +1,6 @@ +QA output created by 368 + +Verifying ciphertext with parameters: + contents_encryption_mode: AES-256-XTS + filenames_encryption_mode: AES-256-CTS-CBC + options: v2 iv_ino_lblk_64 hw_wrapped_key diff --git a/tests/generic/369 b/tests/generic/369 new file mode 100755 index 000000000..f5b6d02bc --- /dev/null +++ b/tests/generic/369 @@ -0,0 +1,24 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright 2024 Google LLC +# +# FS QA Test No. 369 +# +# Verify the ciphertext for encryption policies that use a hardware-wrapped +# inline encryption key, the IV_INO_LBLK_32 flag, and AES-256-XTS. +# +. ./common/preamble +_begin_fstest auto quick encrypt + +. ./common/filter +. ./common/encrypt + +# Hardware-wrapped keys require the inlinecrypt mount option. +_require_scratch_inlinecrypt +export MOUNT_OPTIONS="$MOUNT_OPTIONS -o inlinecrypt" + +_verify_ciphertext_for_encryption_policy AES-256-XTS AES-256-CTS-CBC \ + v2 iv_ino_lblk_32 hw_wrapped_key + +status=0 +exit diff --git a/tests/generic/369.out b/tests/generic/369.out new file mode 100644 index 000000000..3dd14b8b5 --- /dev/null +++ b/tests/generic/369.out @@ -0,0 +1,6 @@ +QA output created by 369 + +Verifying ciphertext with parameters: + contents_encryption_mode: AES-256-XTS + filenames_encryption_mode: AES-256-CTS-CBC + options: v2 iv_ino_lblk_32 hw_wrapped_key