1 /*
2 * Copyright (C) 2019 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <linux/fscrypt.h>
18
19 #include <fscrypt/fscrypt.h>
20
21 #include <gtest/gtest.h>
22
23 using namespace android::fscrypt;
24
25 /* modes not supported by upstream kernel, so not in <linux/fscrypt.h> */
26 #define FSCRYPT_MODE_AES_256_HEH 126
27 #define FSCRYPT_MODE_PRIVATE 127
28
TestString(unsigned int first_api_level,const std::string instring,const std::string outstring)29 const EncryptionOptions TestString(unsigned int first_api_level, const std::string instring,
30 const std::string outstring) {
31 EncryptionOptions options;
32 std::string options_string;
33
34 EXPECT_TRUE(ParseOptionsForApiLevel(first_api_level, instring, &options));
35 EXPECT_TRUE(OptionsToStringForApiLevel(first_api_level, options, &options_string));
36 EXPECT_EQ(outstring, options_string);
37 return options;
38 }
39
40 #define TEST_STRING(first_api_level, instring, outstring) \
41 SCOPED_TRACE(instring); \
42 auto options = TestString(first_api_level, instring, outstring);
43
TEST(fscrypt,ParseOptions)44 TEST(fscrypt, ParseOptions) {
45 EncryptionOptions dummy_options;
46
47 std::vector<std::string> defaults = {
48 "software",
49 "",
50 ":",
51 "::",
52 "aes-256-xts",
53 "aes-256-xts:",
54 "aes-256-xts::",
55 "aes-256-xts:aes-256-cts",
56 "aes-256-xts:aes-256-cts:",
57 ":aes-256-cts",
58 ":aes-256-cts:",
59 };
60 for (const auto& d : defaults) {
61 TEST_STRING(29, d, "aes-256-xts:aes-256-cts:v1");
62 EXPECT_EQ(1, options.version);
63 EXPECT_EQ(FSCRYPT_MODE_AES_256_XTS, options.contents_mode);
64 EXPECT_EQ(FSCRYPT_MODE_AES_256_CTS, options.filenames_mode);
65 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_4, options.flags);
66 EXPECT_FALSE(options.dusize_4k);
67 }
68 for (const auto& d : defaults) {
69 TEST_STRING(30, d, "aes-256-xts:aes-256-cts:v2");
70 EXPECT_TRUE(ParseOptionsForApiLevel(30, d, &dummy_options));
71 EXPECT_EQ(2, options.version);
72 EXPECT_EQ(FSCRYPT_MODE_AES_256_XTS, options.contents_mode);
73 EXPECT_EQ(FSCRYPT_MODE_AES_256_CTS, options.filenames_mode);
74 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_16, options.flags);
75 EXPECT_FALSE(options.dusize_4k);
76 }
77
78 EXPECT_FALSE(ParseOptionsForApiLevel(29, "blah", &dummy_options));
79 EXPECT_FALSE(ParseOptionsForApiLevel(30, "blah", &dummy_options));
80
81 {
82 TEST_STRING(29, "::v1", "aes-256-xts:aes-256-cts:v1");
83 EXPECT_EQ(1, options.version);
84 EXPECT_EQ(FSCRYPT_MODE_AES_256_XTS, options.contents_mode);
85 EXPECT_EQ(FSCRYPT_MODE_AES_256_CTS, options.filenames_mode);
86 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_4, options.flags);
87 }
88 {
89 TEST_STRING(30, "::v1", "aes-256-xts:aes-256-cts:v1");
90 EXPECT_EQ(1, options.version);
91 EXPECT_EQ(FSCRYPT_MODE_AES_256_XTS, options.contents_mode);
92 EXPECT_EQ(FSCRYPT_MODE_AES_256_CTS, options.filenames_mode);
93 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_16, options.flags);
94 }
95 {
96 TEST_STRING(29, "::v2", "aes-256-xts:aes-256-cts:v2");
97 EXPECT_EQ(2, options.version);
98 EXPECT_EQ(FSCRYPT_MODE_AES_256_XTS, options.contents_mode);
99 EXPECT_EQ(FSCRYPT_MODE_AES_256_CTS, options.filenames_mode);
100 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_16, options.flags);
101 }
102 {
103 TEST_STRING(29, "ice", "ice:aes-256-cts:v1");
104 EXPECT_EQ(1, options.version);
105 EXPECT_EQ(FSCRYPT_MODE_PRIVATE, options.contents_mode);
106 EXPECT_EQ(FSCRYPT_MODE_AES_256_CTS, options.filenames_mode);
107 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_4, options.flags);
108 }
109 EXPECT_FALSE(ParseOptionsForApiLevel(29, "ice:blah", &dummy_options));
110
111 {
112 TEST_STRING(29, "ice:aes-256-cts", "ice:aes-256-cts:v1");
113 EXPECT_EQ(1, options.version);
114 EXPECT_EQ(FSCRYPT_MODE_PRIVATE, options.contents_mode);
115 EXPECT_EQ(FSCRYPT_MODE_AES_256_CTS, options.filenames_mode);
116 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_4, options.flags);
117 }
118
119 {
120 TEST_STRING(29, "ice:aes-256-heh", "ice:aes-256-heh:v1");
121 EXPECT_EQ(1, options.version);
122 EXPECT_EQ(FSCRYPT_MODE_PRIVATE, options.contents_mode);
123 EXPECT_EQ(FSCRYPT_MODE_AES_256_HEH, options.filenames_mode);
124 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_16, options.flags);
125 }
126 {
127 TEST_STRING(29, "adiantum", "adiantum:adiantum:v1");
128 EXPECT_EQ(1, options.version);
129 EXPECT_EQ(FSCRYPT_MODE_ADIANTUM, options.contents_mode);
130 EXPECT_EQ(FSCRYPT_MODE_ADIANTUM, options.filenames_mode);
131 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_16 | FSCRYPT_POLICY_FLAG_DIRECT_KEY, options.flags);
132 }
133 {
134 TEST_STRING(30, "adiantum", "adiantum:adiantum:v2");
135 EXPECT_EQ(2, options.version);
136 EXPECT_EQ(FSCRYPT_MODE_ADIANTUM, options.contents_mode);
137 EXPECT_EQ(FSCRYPT_MODE_ADIANTUM, options.filenames_mode);
138 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_16 | FSCRYPT_POLICY_FLAG_DIRECT_KEY, options.flags);
139 }
140 EXPECT_FALSE(ParseOptionsForApiLevel(29, "adiantum:aes-256-cts", &dummy_options));
141 EXPECT_FALSE(ParseOptionsForApiLevel(30, "adiantum:aes-256-cts", &dummy_options));
142 EXPECT_FALSE(ParseOptionsForApiLevel(29, "aes-256-xts:adiantum", &dummy_options));
143 EXPECT_FALSE(ParseOptionsForApiLevel(30, "aes-256-xts:adiantum", &dummy_options));
144 {
145 TEST_STRING(30, "::inlinecrypt_optimized",
146 "aes-256-xts:aes-256-cts:v2+inlinecrypt_optimized");
147 EXPECT_EQ(2, options.version);
148 EXPECT_EQ(FSCRYPT_MODE_AES_256_XTS, options.contents_mode);
149 EXPECT_EQ(FSCRYPT_MODE_AES_256_CTS, options.filenames_mode);
150 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_16 | FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64, options.flags);
151 }
152 {
153 TEST_STRING(30, "aes-256-xts:aes-256-cts:v2+inlinecrypt_optimized",
154 "aes-256-xts:aes-256-cts:v2+inlinecrypt_optimized");
155 EXPECT_EQ(2, options.version);
156 EXPECT_EQ(FSCRYPT_MODE_AES_256_XTS, options.contents_mode);
157 EXPECT_EQ(FSCRYPT_MODE_AES_256_CTS, options.filenames_mode);
158 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_16 | FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64, options.flags);
159 }
160
161 {
162 TEST_STRING(30, "::emmc_optimized", "aes-256-xts:aes-256-cts:v2+emmc_optimized");
163 EXPECT_EQ(2, options.version);
164 EXPECT_EQ(FSCRYPT_MODE_AES_256_XTS, options.contents_mode);
165 EXPECT_EQ(FSCRYPT_MODE_AES_256_CTS, options.filenames_mode);
166 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_16 | FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32, options.flags);
167 }
168 EXPECT_FALSE(
169 ParseOptionsForApiLevel(30, "::inlinecrypt_optimized+emmc_optimized", &dummy_options));
170 EXPECT_FALSE(ParseOptionsForApiLevel(30, "adiantum::inlinecrypt_optimized", &dummy_options));
171 EXPECT_FALSE(ParseOptionsForApiLevel(30, "adiantum::emmc_optimized", &dummy_options));
172
173 EXPECT_FALSE(ParseOptionsForApiLevel(29, "aes-256-xts:aes-256-cts:v2:", &dummy_options));
174 EXPECT_FALSE(ParseOptionsForApiLevel(29, "aes-256-xts:aes-256-cts:v2:foo", &dummy_options));
175 EXPECT_FALSE(ParseOptionsForApiLevel(29, "aes-256-xts:aes-256-cts:blah", &dummy_options));
176 EXPECT_FALSE(ParseOptionsForApiLevel(29, "aes-256-xts:aes-256-cts:vblah", &dummy_options));
177 EXPECT_FALSE(ParseOptionsForApiLevel(30, "aes-256-xts:aes-256-cts:v2:", &dummy_options));
178 EXPECT_FALSE(ParseOptionsForApiLevel(30, "aes-256-xts:aes-256-cts:v2:foo", &dummy_options));
179 EXPECT_FALSE(ParseOptionsForApiLevel(30, "aes-256-xts:aes-256-cts:blah", &dummy_options));
180 EXPECT_FALSE(ParseOptionsForApiLevel(30, "aes-256-xts:aes-256-cts:vblah", &dummy_options));
181
182 {
183 TEST_STRING(34, ":aes-256-hctr2", "aes-256-xts:aes-256-hctr2:v2");
184 EXPECT_EQ(2, options.version);
185 EXPECT_EQ(FSCRYPT_MODE_AES_256_XTS, options.contents_mode);
186 EXPECT_EQ(FSCRYPT_MODE_AES_256_HCTR2, options.filenames_mode);
187 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_16, options.flags);
188 }
189
190 {
191 TEST_STRING(34, "::dusize_4k", "aes-256-xts:aes-256-cts:v2+dusize_4k");
192 EXPECT_EQ(2, options.version);
193 EXPECT_EQ(FSCRYPT_MODE_AES_256_XTS, options.contents_mode);
194 EXPECT_EQ(FSCRYPT_MODE_AES_256_CTS, options.filenames_mode);
195 EXPECT_EQ(FSCRYPT_POLICY_FLAGS_PAD_16, options.flags);
196 EXPECT_TRUE(options.dusize_4k);
197 }
198 }
199
TEST(fscrypt,ComparePolicies)200 TEST(fscrypt, ComparePolicies) {
201 #define TEST_INEQUALITY(foo, field, value) \
202 { \
203 auto bar = foo; \
204 bar.field = value; \
205 EXPECT_NE(foo, bar); \
206 }
207 EncryptionPolicy foo;
208 foo.key_raw_ref = "foo";
209 EncryptionOptions foo_options;
210 foo_options.version = 1;
211 foo_options.contents_mode = 1;
212 foo_options.filenames_mode = 1;
213 foo_options.flags = 1;
214 foo_options.use_hw_wrapped_key = true;
215 foo_options.dusize_4k = true;
216 foo.options = foo_options;
217 EXPECT_EQ(foo, foo);
218 TEST_INEQUALITY(foo, key_raw_ref, "bar");
219 TEST_INEQUALITY(foo, options.version, 2);
220 TEST_INEQUALITY(foo, options.contents_mode, -1);
221 TEST_INEQUALITY(foo, options.filenames_mode, 3);
222 TEST_INEQUALITY(foo, options.flags, 0);
223 TEST_INEQUALITY(foo, options.use_hw_wrapped_key, false);
224 TEST_INEQUALITY(foo, options.dusize_4k, false);
225 }
226