From: Eric Biggers <ebiggers@kernel.org>
To: fstests@vger.kernel.org
Cc: linux-fscrypt@vger.kernel.org
Subject: [PATCH v2 5/5] common/encrypt: verify the key identifiers
Date: Sat, 12 Mar 2022 17:05:59 -0800 [thread overview]
Message-ID: <20220313010559.545995-6-ebiggers@kernel.org> (raw)
In-Reply-To: <20220313010559.545995-1-ebiggers@kernel.org>
From: Eric Biggers <ebiggers@google.com>
As part of all the ciphertext verification tests, verify that the
filesystem correctly computed the key identifier from the key the test
generated. This uses fscrypt-crypt-util to compute the key identifier.
Previously this was only being tested indirectly, via the tests that
happen to use the hardcoded $TEST_RAW_KEY and $TEST_KEY_IDENTIFIER.
The new check provides better coverage.
Signed-off-by: Eric Biggers <ebiggers@google.com>
---
common/encrypt | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/common/encrypt b/common/encrypt
index cf402570..78a574bd 100644
--- a/common/encrypt
+++ b/common/encrypt
@@ -812,6 +812,7 @@ _verify_ciphertext_for_encryption_policy()
local crypt_util_args=""
local crypt_util_contents_args=""
local crypt_util_filename_args=""
+ local expected_identifier
shift 2
for opt; do
@@ -902,6 +903,18 @@ _verify_ciphertext_for_encryption_policy()
fi
local raw_key_hex=$(echo "$raw_key" | tr -d '\\x')
+ if (( policy_version > 1 )); then
+ echo "Verifying key identifier" >> $seqres.full
+ expected_identifier=$($here/src/fscrypt-crypt-util \
+ --dump-key-identifier "$raw_key_hex" \
+ $crypt_util_args)
+ if [ "$expected_identifier" != "$keyspec" ]; then
+ echo "KEY IDENTIFIER MISMATCH!"
+ echo " Expected: $expected_identifier"
+ echo " Actual: $keyspec"
+ fi
+ fi
+
echo
echo -e "Verifying ciphertext with parameters:"
echo -e "\tcontents_encryption_mode: $contents_encryption_mode"
--
2.35.1
prev parent reply other threads:[~2022-03-13 1:06 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-13 1:05 [PATCH v2 0/5] xfstests: fscrypt test cleanups Eric Biggers
2022-03-13 1:05 ` [PATCH v2 1/5] fscrypt-crypt-util: use an explicit --direct-key option Eric Biggers
2022-03-13 1:05 ` [PATCH v2 2/5] fscrypt-crypt-util: refactor get_key_and_iv() Eric Biggers
2022-03-13 1:05 ` [PATCH v2 3/5] fscrypt-crypt-util: add support for dumping key identifier Eric Biggers
2022-03-13 1:05 ` [PATCH v2 4/5] common/encrypt: log full ciphertext verification params Eric Biggers
2022-03-13 1:05 ` Eric Biggers [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220313010559.545995-6-ebiggers@kernel.org \
--to=ebiggers@kernel.org \
--cc=fstests@vger.kernel.org \
--cc=linux-fscrypt@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.