@@ -488,7 +488,7 @@ _add_fscrypt_provisioning_key()
# Retrieve the encryption nonce of the given inode as a hex string. The nonce
# was randomly generated by the filesystem and isn't exposed directly to
# userspace. But it can be read using the filesystem's debugging tools.
-_get_encryption_nonce()
+_get_encryption_file_nonce()
{
local device=$1
local inode=$2
@@ -532,15 +532,34 @@ _get_encryption_nonce()
}'
;;
*)
- _fail "_get_encryption_nonce() isn't implemented on $FSTYP"
+ _fail "_get_encryption_file_nonce() isn't implemented on $FSTYP"
;;
esac
}
-# Require support for _get_encryption_nonce()
+# Retrieve the encryption nonce used to encrypt the data of the given inode as
+# a hex string. The nonce was randomly generated by the filesystem and isn't
+# exposed directly to userspace. But it can be read using the filesystem's
+# debugging tools.
+_get_encryption_data_nonce()
+{
+ local device=$1
+ local inode=$2
+
+ case $FSTYP in
+ ext4|f2fs)
+ _get_encryption_file_nonce $device $inode
+ ;;
+ *)
+ _fail "_get_encryption_data_nonce() isn't implemented on $FSTYP"
+ ;;
+ esac
+}
+
+# Require support for _get_encryption_*nonce()
_require_get_encryption_nonce_support()
{
- echo "Checking for _get_encryption_nonce() support for $FSTYP" >> $seqres.full
+ echo "Checking for _get_encryption_*nonce() support for $FSTYP" >> $seqres.full
case $FSTYP in
ext4)
_require_command "$DEBUGFS_PROG" debugfs
@@ -554,7 +573,7 @@ _require_get_encryption_nonce_support()
# the test fail in that case, as it was an f2fs-tools bug...
;;
*)
- _notrun "_get_encryption_nonce() isn't implemented on $FSTYP"
+ _notrun "_get_encryption_*nonce() isn't implemented on $FSTYP"
;;
esac
}
@@ -760,7 +779,7 @@ _do_verify_ciphertext_for_encryption_policy()
echo "Verifying encrypted file contents" >> $seqres.full
for f in "${test_contents_files[@]}"; do
read -r src inode blocklist <<< "$f"
- nonce=$(_get_encryption_nonce $SCRATCH_DEV $inode)
+ nonce=$(_get_encryption_data_nonce $SCRATCH_DEV $inode)
_dump_ciphertext_blocks $SCRATCH_DEV $blocklist > $tmp.actual_contents
$crypt_contents_cmd $contents_encryption_mode $raw_key_hex \
--file-nonce=$nonce --block-size=$blocksize \
@@ -780,7 +799,7 @@ _do_verify_ciphertext_for_encryption_policy()
echo "Verifying encrypted file names" >> $seqres.full
for f in "${test_filenames_files[@]}"; do
read -r name inode dir_inode padding <<< "$f"
- nonce=$(_get_encryption_nonce $SCRATCH_DEV $dir_inode)
+ nonce=$(_get_encryption_file_nonce $SCRATCH_DEV $dir_inode)
_get_ciphertext_filename $SCRATCH_DEV $inode $dir_inode \
> $tmp.actual_name
echo -n "$name" | \
@@ -129,7 +129,7 @@ blocklist=$(_get_ciphertext_block_list $file)
_scratch_unmount
echo -e "\n# Getting file's encryption nonce"
-nonce=$(_get_encryption_nonce $SCRATCH_DEV $inode)
+nonce=$(_get_encryption_data_nonce $SCRATCH_DEV $inode)
echo -e "\n# Dumping the file's raw data"
_dump_ciphertext_blocks $SCRATCH_DEV $blocklist > $tmp.raw
@@ -68,10 +68,10 @@ echo -e "\n# Getting encryption nonces from inodes"
echo -n > $tmp.nonces_hex
echo -n > $tmp.nonces_bin
for inode in "${inodes[@]}"; do
- nonce=$(_get_encryption_nonce $SCRATCH_DEV $inode)
+ nonce=$(_get_encryption_data_nonce $SCRATCH_DEV $inode)
if (( ${#nonce} != 32 )) || [ -n "$(echo "$nonce" | tr -d 0-9a-fA-F)" ]
then
- _fail "Expected nonce to be 16 bytes (32 hex characters), but got \"$nonce\""
+ _fail "Expected nonce for inode $inode to be 16 bytes (32 hex characters), but got \"$nonce\""
fi
echo $nonce >> $tmp.nonces_hex
echo -ne "$(echo $nonce | sed 's/[0-9a-fA-F]\{2\}/\\x\0/g')" \
btrfs will have different inode and data nonces, so we need to be specific about which nonce each use needs. For now, there is no difference in the two functions. Signed-off-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me> --- common/encrypt | 33 ++++++++++++++++++++++++++------- tests/f2fs/002 | 2 +- tests/generic/613 | 4 ++-- 3 files changed, 29 insertions(+), 10 deletions(-)