[PATCH 0/3] xfstests: make fscrypt-crypt-util self-tests work with OpenSSL 3.0

[PATCH 0/3] xfstests: make fscrypt-crypt-util self-tests work with OpenSSL 3.0

[Eric Biggers]

This series makes the algorithm self-tests in fscrypt-crypt-util (which
are not compiled by default) work with OpenSSL 3.0.  Previously they
only worked with OpenSSL 1.1.

Eric Biggers (3):
  fscrypt-crypt-util: fix HKDF self-test with latest OpenSSL
  fscrypt-crypt-util: use OpenSSL EVP API for AES self-tests
  fscrypt-crypt-util: fix XTS self-test with latest OpenSSL

 src/fscrypt-crypt-util.c | 46 ++++++++++++++++++++++++++++++++--------
 1 file changed, 37 insertions(+), 9 deletions(-)

-- 
2.40.0

[PATCH 1/3] fscrypt-crypt-util: fix HKDF self-test with latest OpenSSL

[Eric Biggers]

From: Eric Biggers <ebiggers@google.com>

In OpenSSL 3.0, EVP_PKEY_derive() fails if the output is zero-length.
Therefore, update test_hkdf_sha512() to not test this case.

This only affects the algorithm self-tests within fscrypt-crypt-util,
which are not compiled by default.

Signed-off-by: Eric Biggers <ebiggers@google.com>
---
 src/fscrypt-crypt-util.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/fscrypt-crypt-util.c b/src/fscrypt-crypt-util.c
index 087ae09a..4bb4f4e5 100644
--- a/src/fscrypt-crypt-util.c
+++ b/src/fscrypt-crypt-util.c
@@ -975,7 +975,9 @@ static void test_hkdf_sha512(void)
 		size_t ikmlen = 1 + (rand() % sizeof(ikm));
 		size_t saltlen = rand() % (1 + sizeof(salt));
 		size_t infolen = rand() % (1 + sizeof(info));
-		size_t outlen = rand() % (1 + sizeof(actual_output));
+		// Don't test zero-length outputs, since OpenSSL 3.0 and later
+		// returns an error for those.
+		size_t outlen = 1 + (rand() % sizeof(actual_output));
 
 		rand_bytes(ikm, ikmlen);
 		rand_bytes(salt, saltlen);
-- 
2.40.0

[PATCH 2/3] fscrypt-crypt-util: use OpenSSL EVP API for AES self-tests

[Eric Biggers]

From: Eric Biggers <ebiggers@google.com>

OpenSSL 3.0 has deprecated the easy-to-use AES block cipher API in favor
of EVP.  EVP is also available in earlier OpenSSL versions.  Therefore,
update test_aes_keysize() to use the non-deprecated API to avoid
deprecation warnings when building the algorithm self-tests.

Signed-off-by: Eric Biggers <ebiggers@google.com>
---
 src/fscrypt-crypt-util.c | 32 +++++++++++++++++++++++++++-----
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/src/fscrypt-crypt-util.c b/src/fscrypt-crypt-util.c
index 4bb4f4e5..040b80c0 100644
--- a/src/fscrypt-crypt-util.c
+++ b/src/fscrypt-crypt-util.c
@@ -662,19 +662,37 @@ static void aes_decrypt(const struct aes_key *k, const u8 src[AES_BLOCK_SIZE],
 }
 
 #ifdef ENABLE_ALG_TESTS
-#include <openssl/aes.h>
+#include <openssl/evp.h>
 static void test_aes_keysize(int keysize)
 {
 	unsigned long num_tests = NUM_ALG_TEST_ITERATIONS;
+	const EVP_CIPHER *evp_cipher;
+	EVP_CIPHER_CTX *ctx;
+
+	switch (keysize) {
+	case 16:
+		evp_cipher = EVP_aes_128_ecb();
+		break;
+	case 24:
+		evp_cipher = EVP_aes_192_ecb();
+		break;
+	case 32:
+		evp_cipher = EVP_aes_256_ecb();
+		break;
+	default:
+		ASSERT(0);
+	}
 
+	ctx = EVP_CIPHER_CTX_new();
+	ASSERT(ctx != NULL);
 	while (num_tests--) {
 		struct aes_key k;
-		AES_KEY ref_k;
 		u8 key[AES_256_KEY_SIZE];
 		u8 ptext[AES_BLOCK_SIZE];
 		u8 ctext[AES_BLOCK_SIZE];
 		u8 ref_ctext[AES_BLOCK_SIZE];
 		u8 decrypted[AES_BLOCK_SIZE];
+		int outl, res;
 
 		rand_bytes(key, keysize);
 		rand_bytes(ptext, AES_BLOCK_SIZE);
@@ -682,14 +700,18 @@ static void test_aes_keysize(int keysize)
 		aes_setkey(&k, key, keysize);
 		aes_encrypt(&k, ptext, ctext);
 
-		ASSERT(AES_set_encrypt_key(key, keysize*8, &ref_k) == 0);
-		AES_encrypt(ptext, ref_ctext, &ref_k);
-
+		res = EVP_EncryptInit_ex(ctx, evp_cipher, NULL, key, NULL);
+		ASSERT(res > 0);
+		res = EVP_EncryptUpdate(ctx, ref_ctext, &outl, ptext,
+					AES_BLOCK_SIZE);
+		ASSERT(res > 0);
+		ASSERT(outl == AES_BLOCK_SIZE);
 		ASSERT(memcmp(ctext, ref_ctext, AES_BLOCK_SIZE) == 0);
 
 		aes_decrypt(&k, ctext, decrypted);
 		ASSERT(memcmp(ptext, decrypted, AES_BLOCK_SIZE) == 0);
 	}
+	EVP_CIPHER_CTX_free(ctx);
 }
 
 static void test_aes(void)
-- 
2.40.0

[PATCH 3/3] fscrypt-crypt-util: fix XTS self-test with latest OpenSSL

[Eric Biggers]

From: Eric Biggers <ebiggers@google.com>

In OpenSSL 3.0, XTS encryption fails if the message is zero-length.
Therefore, update test_aes_256_xts() to not test this case.

This only affects the algorithm self-tests within fscrypt-crypt-util,
which are not compiled by default.

Signed-off-by: Eric Biggers <ebiggers@google.com>
---
 src/fscrypt-crypt-util.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/fscrypt-crypt-util.c b/src/fscrypt-crypt-util.c
index 040b80c0..6edf0047 100644
--- a/src/fscrypt-crypt-util.c
+++ b/src/fscrypt-crypt-util.c
@@ -1107,12 +1107,16 @@ static void test_aes_256_xts(void)
 	while (num_tests--) {
 		u8 key[2 * AES_256_KEY_SIZE];
 		u8 iv[AES_BLOCK_SIZE];
-		u8 ptext[512];
+		u8 ptext[32 * AES_BLOCK_SIZE];
 		u8 ctext[sizeof(ptext)];
 		u8 ref_ctext[sizeof(ptext)];
 		u8 decrypted[sizeof(ptext)];
-		const size_t datalen = ROUND_DOWN(rand() % (1 + sizeof(ptext)),
-						  AES_BLOCK_SIZE);
+		// Don't test message lengths that aren't a multiple of the AES
+		// block size, since support for that is not implemented here.
+		// Also don't test zero-length messages, since OpenSSL 3.0 and
+		// later returns an error for those.
+		const size_t datalen = AES_BLOCK_SIZE *
+			(1 + rand() % (sizeof(ptext) / AES_BLOCK_SIZE));
 		int outl, res;
 
 		rand_bytes(key, sizeof(key));
-- 
2.40.0

Re: [PATCH 0/3] xfstests: make fscrypt-crypt-util self-tests work with OpenSSL 3.0

[Zorro Lang]

On Sun, Mar 19, 2023 at 12:38:44PM -0700, Eric Biggers wrote:
> This series makes the algorithm self-tests in fscrypt-crypt-util (which
> are not compiled by default) work with OpenSSL 3.0.  Previously they
> only worked with OpenSSL 1.1.
> 
> Eric Biggers (3):
>   fscrypt-crypt-util: fix HKDF self-test with latest OpenSSL
>   fscrypt-crypt-util: use OpenSSL EVP API for AES self-tests
>   fscrypt-crypt-util: fix XTS self-test with latest OpenSSL
> 
>  src/fscrypt-crypt-util.c | 46 ++++++++++++++++++++++++++++++++--------
>  1 file changed, 37 insertions(+), 9 deletions(-)
> 
> -- 

I'm not familiar with fscrypt changes, but from the commit log of 3 patches,
this patchset looks good to me. If there's not more review points from
linux-fscrypt@, I'll merge this patchset.

Just one tiny review point, I'd like to keep using same comment format, especially
in same source file. As src/fscrypt-crypt-util.c generally use "/* ... */", so
I'll change your "//..." to "/* ... */" when I merge it, if you don't mind.

Thanks,
Zorro

> 2.40.0
> 

Re: [PATCH 0/3] xfstests: make fscrypt-crypt-util self-tests work with OpenSSL 3.0

[Eric Biggers]

On Mon, Mar 20, 2023 at 10:03:50PM +0800, Zorro Lang wrote:
> Just one tiny review point, I'd like to keep using same comment format, especially
> in same source file. As src/fscrypt-crypt-util.c generally use "/* ... */", so
> I'll change your "//..." to "/* ... */" when I merge it, if you don't mind.

Yes that's fine.

- Eric