diff options
author | Eric Biggers <ebiggers@google.com> | 2022-10-18 11:00:20 -0700 |
---|---|---|
committer | Eric Biggers <ebiggers@google.com> | 2022-10-18 11:00:20 -0700 |
commit | 4cc971bee1192f3eae6dd0056b0f53a3e76ac9e6 (patch) | |
tree | 04a97b582e8bf150a49d3d6c93ca9dbb07664cce | |
parent | 4e7699eb24f2bc26c3f25a2f0a2e844ddc47c2b5 (diff) | |
download | xfstests-dev-wip-wrapped-keys.tar.gz |
generic: verify ciphertext with hardware-wrapped keyswip-wrapped-keys
Add two tests which verify that encrypted files are encrypted correctly
when a hardware-wrapped inline encryption key is used. The two tests
are identical except that one uses FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64
and the other uses FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32. These cover both
of the settings where hardware-wrapped keys currently may be used.
I've verified that these tests run and pass when all prerequisites are
met, namely:
- Hardware supporting the feature must be present. I tested this on the
SM8350 HDK (note: this currently requires a custom TrustZone image);
this hardware is compatible with both of IV_INO_LBLK_{64,32}.
- The kernel patches for hardware-wrapped key support must be applied.
- The filesystem must be ext4 or f2fs.
- The kernel must have CONFIG_FS_ENCRYPTION_INLINE_CRYPT=y.
- The fscryptctl program must be available, and must have patches for
hardware-wrapped key support applied.
Signed-off-by: Eric Biggers <ebiggers@google.com>
-rwxr-xr-x | tests/generic/900 | 30 | ||||
-rw-r--r-- | tests/generic/900.out | 6 | ||||
-rwxr-xr-x | tests/generic/901 | 30 | ||||
-rw-r--r-- | tests/generic/901.out | 6 |
4 files changed, 72 insertions, 0 deletions
diff --git a/tests/generic/900 b/tests/generic/900 new file mode 100755 index 0000000000..a021732e53 --- /dev/null +++ b/tests/generic/900 @@ -0,0 +1,30 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright 2022 Google LLC +# +# FS QA Test No. 900 +# +# Verify the ciphertext for encryption policies that use the HW_WRAPPED_KEY and +# IV_INO_LBLK_64 flags and that use AES-256-XTS to encrypt file contents and +# AES-256-CTS-CBC to encrypt file names. +# +. ./common/preamble +_begin_fstest auto quick encrypt + +# Import common functions. +. ./common/filter +. ./common/encrypt + +# real QA test starts here +_supported_fs generic + +# Hardware-wrapped keys require the inlinecrypt mount option. +_require_scratch_inlinecrypt +export MOUNT_OPTIONS="$MOUNT_OPTIONS -o inlinecrypt" + +_verify_ciphertext_for_encryption_policy AES-256-XTS AES-256-CTS-CBC \ + v2 iv_ino_lblk_64 hw_wrapped_key + +# success, all done +status=0 +exit diff --git a/tests/generic/900.out b/tests/generic/900.out new file mode 100644 index 0000000000..9edc012c70 --- /dev/null +++ b/tests/generic/900.out @@ -0,0 +1,6 @@ +QA output created by 900 + +Verifying ciphertext with parameters: + contents_encryption_mode: AES-256-XTS + filenames_encryption_mode: AES-256-CTS-CBC + options: v2 iv_ino_lblk_64 hw_wrapped_key diff --git a/tests/generic/901 b/tests/generic/901 new file mode 100755 index 0000000000..dd5c6e5fac --- /dev/null +++ b/tests/generic/901 @@ -0,0 +1,30 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright 2022 Google LLC +# +# FS QA Test No. 901 +# +# Verify the ciphertext for encryption policies that use the HW_WRAPPED_KEY and +# IV_INO_LBLK_32 flags and that use AES-256-XTS to encrypt file contents and +# AES-256-CTS-CBC to encrypt file names. +# +. ./common/preamble +_begin_fstest auto quick encrypt + +# Import common functions. +. ./common/filter +. ./common/encrypt + +# real QA test starts here +_supported_fs generic + +# Hardware-wrapped keys require the inlinecrypt mount option. +_require_scratch_inlinecrypt +export MOUNT_OPTIONS="$MOUNT_OPTIONS -o inlinecrypt" + +_verify_ciphertext_for_encryption_policy AES-256-XTS AES-256-CTS-CBC \ + v2 iv_ino_lblk_32 hw_wrapped_key + +# success, all done +status=0 +exit diff --git a/tests/generic/901.out b/tests/generic/901.out new file mode 100644 index 0000000000..2f92846502 --- /dev/null +++ b/tests/generic/901.out @@ -0,0 +1,6 @@ +QA output created by 901 + +Verifying ciphertext with parameters: + contents_encryption_mode: AES-256-XTS + filenames_encryption_mode: AES-256-CTS-CBC + options: v2 iv_ino_lblk_32 hw_wrapped_key |