diff options
| author | Eric Biggers <ebiggers@google.com> | 2022-03-12 17:05:59 -0800 |
|---|---|---|
| committer | Eryu Guan <guaneryu@gmail.com> | 2022-04-10 20:40:55 +0800 |
| commit | 1e516c86003021861734a6b14628059316b1c455 (patch) | |
| tree | 5f30b31a311391611ef56c9fe4e89e2e01855dca | |
| parent | 775e2763a39264adba5c33482db89ef2b0634ac3 (diff) | |
| download | xfstests-dev-1e516c86003021861734a6b14628059316b1c455.tar.gz | |
common/encrypt: verify the key identifiers
As part of all the ciphertext verification tests, verify that the
filesystem correctly computed the key identifier from the key the test
generated. This uses fscrypt-crypt-util to compute the key identifier.
Previously this was only being tested indirectly, via the tests that
happen to use the hardcoded $TEST_RAW_KEY and $TEST_KEY_IDENTIFIER.
The new check provides better coverage.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
| -rw-r--r-- | common/encrypt | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/common/encrypt b/common/encrypt index cf40257032..78a574bd09 100644 --- a/common/encrypt +++ b/common/encrypt @@ -812,6 +812,7 @@ _verify_ciphertext_for_encryption_policy() local crypt_util_args="" local crypt_util_contents_args="" local crypt_util_filename_args="" + local expected_identifier shift 2 for opt; do @@ -902,6 +903,18 @@ _verify_ciphertext_for_encryption_policy() fi local raw_key_hex=$(echo "$raw_key" | tr -d '\\x') + if (( policy_version > 1 )); then + echo "Verifying key identifier" >> $seqres.full + expected_identifier=$($here/src/fscrypt-crypt-util \ + --dump-key-identifier "$raw_key_hex" \ + $crypt_util_args) + if [ "$expected_identifier" != "$keyspec" ]; then + echo "KEY IDENTIFIER MISMATCH!" + echo " Expected: $expected_identifier" + echo " Actual: $keyspec" + fi + fi + echo echo -e "Verifying ciphertext with parameters:" echo -e "\tcontents_encryption_mode: $contents_encryption_mode" |