update typed-fuse dependency, add additional tests

Author: vgough

Cargo.lock

@@ -60,7 +60,7 @@ message BasicBlockCipher {
 
 // Width of the random per-file IV. FILE_IV_WIDTH_64 is the zero value so an
 // absent/omitted field (all configs written before this ADR) means 64-bit.
-// Leaves room for a future FILE_IV_WIDTH_128 without adding a new field;
+// Leaves room for future expansions;
 // any new value must be paired with a minimum_reader_version bump so old
 // readers fail closed instead of silently misreading it as 64-bit.
 enum FileIvWidth {

proto/encfs_config.proto

@@ -87,6 +87,46 @@ pub fn data_block_size(cfg: &LiveConfig) -> u64 {
     cfg.block_size - cfg.block_mac_bytes
 }
 
+/// Builds a fresh backing root holding a wide-file-IV V7 config — the same
+/// shape `encfsctl new` (no flags) produces. There is no `.encfs7` fixture
+/// checked in, so this generates one on the fly via
+/// `EncfsConfig::standard_v7()` + `set_v7_key`, exactly as `encfsctl new`
+/// does, rather than loading it from `tests/fixtures`.
+pub fn init_wide_v7_backing_root() -> Result<(PathBuf, LiveConfig)> {
+    let backing_root = unique_temp_dir("encfs_live_wide_v7_backing")?;
+
+    let mut config = EncfsConfig::standard_v7();
+    anyhow::ensure!(config.wide_file_iv, "standard_v7() must default to wide IV");
+    // Cheap KDF for test speed only; everything else is production defaults.
+    config.argon2_memory_cost = Some(8);
+    config.argon2_time_cost = Some(1);
+    config.argon2_parallelism = Some(1);
+    getrandom::fill(&mut config.salt).context("fill salt")?;
+
+    let key_len = (config.key_size / 8) as usize;
+    let mut volume_key_blob = vec![0u8; key_len + 16];
+    getrandom::fill(&mut volume_key_blob).context("fill volume key")?;
+
+    let password = "wide-v7-live-test";
+    config
+        .set_v7_key(password, &volume_key_blob)
+        .context("set_v7_key")?;
+    config
+        .save(&backing_root.join(".encfs7"))
+        .context("save V7 config")?;
+
+    let live_cfg = LiveConfig {
+        kind: LiveConfigKind::V7,
+        password: "wide-v7-live-test",
+        block_size: config.block_size as u64,
+        block_mac_bytes: config.block_mac_bytes as u64,
+        chained_name_iv: config.chained_name_iv,
+        external_iv_chaining: config.external_iv_chaining,
+    };
+
+    Ok((backing_root, live_cfg))
+}
+
 pub fn unique_temp_dir(prefix: &str) -> Result<PathBuf> {
     let pid = std::process::id();
     let n = TMP_COUNTER.fetch_add(1, Ordering::SeqCst);

tests/live/mod.rs

@@ -1461,3 +1461,109 @@ fn live_tar_extract_single_file() -> Result<()> {
 
     Ok(())
 }
+
+/// Regression test for the "backing file created but no data written"
+/// report: `cp` between two paths *within the same EncFS mount*.
+///
+/// Root cause, bisected to a single upstream commit: fixed in typed-fuse
+/// commit `5a07205` ("fix statfs on darwin"), picked up here via the
+/// `Cargo.lock` bump in this same change. Before that fix, macOS's
+/// `fuse_reply_statfs` binding built a `struct statfs` and handed its
+/// pointer to `fuse_reply_statfs_vanilla`, which actually expects `struct
+/// statvfs*` — a different, differently-laid-out type. Every
+/// `statfs()`/`statvfs()` on any file in the mount therefore returned
+/// reinterpreted garbage, independently confirmed by `stat -f`: two very
+/// differently sized files in the mount reported identical, nonsensical
+/// `st_blocks`, matching the mountpoint's own volume-level number. Exactly
+/// how `cp`'s data-copy path consumes that garbage to end up writing zero
+/// bytes while still exiting 0 was not isolated (would need
+/// `fs_usage`/`dtruss`, which need root) — what's verified is the A/B: the
+/// same `cp` invocation loses data at the pre-fix commit and doesn't at the
+/// post-fix one, with no other functional change in between. `dd`, a
+/// single-call Python `write()`, `rsync`, and `cp` from an *external* source
+/// into the mount were all unaffected even pre-fix.
+///
+/// This is deliberately config-independent (V6 `Standard` fixture and a
+/// fresh wide-file-IV V7 volume both exercise it) because the bug reproduced
+/// identically on both before the fix: it is a macOS/FUSE-binding-layer bug
+/// with no dependency on file-IV width, header size, or block mode, and it
+/// predates the 96-bit-IV work that first surfaced it (that work simply made
+/// this the new default happy path people would immediately test with `cp`).
+fn run_internal_copy_same_mount(
+    mount: &MountGuard,
+    header_size: u64,
+    expected_physical_size: u64,
+) -> Result<()> {
+    let src = mount.mount_point.join("cp_src_internal.bin");
+    let dst = mount.mount_point.join("cp_dst_internal.bin");
+    let payload = pattern_bytes(400_000);
+    fs::write(&src, &payload).context("write source inside mount")?;
+
+    let before = live::list_non_dot_entries_recursive(&mount.backing_root)?
+        .into_iter()
+        .collect::<std::collections::BTreeSet<_>>();
+
+    let status = Command::new("cp")
+        .arg(&src)
+        .arg(&dst)
+        .status()
+        .context("spawn cp")?;
+    anyhow::ensure!(status.success(), "cp exited with {status}");
+
+    let after = live::list_non_dot_entries_recursive(&mount.backing_root)?;
+    let new_backing_file = after
+        .iter()
+        .find(|p| !before.contains(*p))
+        .context("no new backing file appeared for the cp destination")?;
+    let backing_len = fs::metadata(new_backing_file)
+        .context("stat new backing file")?
+        .len();
+
+    let got = fs::read(&dst).context("read cp destination")?;
+    assert_eq!(
+        (backing_len, got.len()),
+        (expected_physical_size, payload.len()),
+        "cp between two paths on the same EncFS mount lost data: backing file is \
+         {backing_len} bytes (header alone is {header_size}, full copy should be \
+         {expected_physical_size}), mounted read returned {} bytes, expected {} bytes of payload",
+        got.len(),
+        payload.len()
+    );
+    assert_eq!(got, payload, "cp destination content mismatch");
+    Ok(())
+}
+
+#[test]
+#[ignore]
+fn live_internal_copy_same_mount_standard() -> Result<()> {
+    require_live();
+    if !live_enabled() {
+        return Ok(());
+    }
+    let cfg = load_live_config(live::LiveConfigKind::Standard)?;
+    let mount = MountGuard::mount(cfg, false)?;
+    // Standard fixture: uniqueIV=1, wideFileIV unset (narrow) => 8-byte
+    // header; blockMACBytes=0 => no per-block overhead.
+    run_internal_copy_same_mount(&mount, 8, 8 + 400_000)
+}
+
+#[test]
+#[ignore]
+fn live_internal_copy_same_mount_wide_v7() -> Result<()> {
+    require_live();
+    if !live_enabled() {
+        return Ok(());
+    }
+    let (backing_root, cfg) = live::init_wide_v7_backing_root()?;
+    // standard_v7() defaults: uniqueIV=1, wideFileIV=1 => 12-byte header,
+    // AES-GCM-SIV block mode => 16-byte per-block tag overhead.
+    let expected = encfs::crypto::file::FileEncoder::<fs::File>::calculate_physical_size_with_mode(
+        400_000,
+        12,
+        cfg.block_size,
+        cfg.block_mac_bytes,
+        encfs::crypto::block::BlockMode::AesGcmSiv,
+    );
+    let mount = MountGuard::mount_existing_backing_root(cfg, false, backing_root)?;
+    run_internal_copy_same_mount(&mount, 12, expected)
+}

tests/live_mount.rs

@@ -0,0 +1,110 @@
+//! Live FUSE-mount coverage for the 96-bit wide file IV (V7/AES-GCM-SIV,
+//! `wide_file_iv = true`), the config `encfsctl new` produces by default.
+//!
+//! `tests/wide_file_iv_test.rs` drives `EncFs` directly (no FUSE) and
+//! `tests/live_mount.rs` only mounts V6 fixtures (`LiveConfigKind::Standard`
+//! / `Paranoia`). Every wide-file-IV volume actually reachable in practice —
+//! via `encfsctl new` with default flags, then `encfs` — goes through a real
+//! FUSE mount, which neither existing suite exercised before this file. It
+//! uses the same `MountGuard` harness as `live_mount.rs`, generating the V7
+//! config on the fly via `live::init_wide_v7_backing_root()` (there is no
+//! `.encfs7` fixture checked in), exactly as `encfsctl new` does.
+//!
+//! The config-independent "cp between two paths on the same mount silently
+//! drops data" bug (see `tests/live_mount.rs::live_internal_copy_same_mount_*`)
+//! is *not* re-tested here: it reproduces identically under a plain V6
+//! config, so it isn't specific to wide file IVs and doesn't belong in this
+//! file. What belongs here is proof that the wide-IV read/write/header path
+//! itself is sound end-to-end through a real mount.
+
+mod live;
+
+use anyhow::{Context, Result};
+use live::{MountGuard, live_enabled};
+use std::fs;
+use std::process::Command;
+
+fn require_live() {
+    if !live_enabled() {
+        eprintln!("skipping live mount test (set ENCFS_LIVE_TESTS=1 to enable)");
+    }
+}
+
+fn ciphertext_files_total_len(backing_root: &std::path::Path) -> Result<u64> {
+    let files = live::list_non_dot_entries_recursive(backing_root)?;
+    let mut total = 0u64;
+    for f in files {
+        if f.is_file() {
+            total += fs::metadata(&f)?.len();
+        }
+    }
+    Ok(total)
+}
+
+/// Plain write-then-read through a fresh wide-IV mount, checking the backing
+/// ciphertext's *physical* size (not the mounted logical size, which reads
+/// back as 0 for a missing, empty, and header-only file alike and so can't
+/// distinguish "no data persisted" from "no file").
+#[test]
+#[ignore]
+fn live_wide_file_iv_basic_write_readback() -> Result<()> {
+    require_live();
+    if !live_enabled() {
+        return Ok(());
+    }
+
+    let (backing_root, cfg) = live::init_wide_v7_backing_root()?;
+    let mount = MountGuard::mount_existing_backing_root(cfg, false, backing_root)?;
+
+    let p = mount.mount_point.join("hello.txt");
+    let payload = b"hello wide-iv encfs, written through a real FUSE mount\n";
+    fs::write(&p, payload).context("write through mount")?;
+
+    let got = fs::read(&p).context("read back through mount")?;
+    assert_eq!(got, payload);
+
+    let physical = ciphertext_files_total_len(&mount.backing_root)?;
+    // Header alone is 12 bytes; a real write must push this well past that.
+    assert!(
+        physical > 12,
+        "backing ciphertext is only {physical} bytes; file data was not persisted \
+         (this is the reported wide-file-IV bug: header-only backing file, no data)"
+    );
+
+    Ok(())
+}
+
+/// Copies a multi-block file *from outside the mount* into a fresh wide-IV
+/// mount via the real `cp` binary, matching a realistic `cp src dest-inside-mount`.
+/// (This is the external-source case; see `live_mount.rs` for the same-mount
+/// case, which fails for reasons unrelated to wide IVs.)
+#[test]
+#[ignore]
+fn live_wide_file_iv_multi_block_copy() -> Result<()> {
+    require_live();
+    if !live_enabled() {
+        return Ok(());
+    }
+
+    let (backing_root, cfg) = live::init_wide_v7_backing_root()?;
+    let mount = MountGuard::mount_existing_backing_root(cfg, false, backing_root)?;
+
+    let src_dir = live::unique_temp_dir("encfs_live_wide_v7_src")?;
+    let src = src_dir.join("payload.bin");
+    let payload: Vec<u8> = (0..200_000u32).map(|i| (i % 251) as u8).collect();
+    fs::write(&src, &payload).context("write source payload")?;
+
+    let dst = mount.mount_point.join("payload.bin");
+    let status = Command::new("cp")
+        .arg(&src)
+        .arg(&dst)
+        .status()
+        .context("spawn cp")?;
+    anyhow::ensure!(status.success(), "cp exited with {status}");
+
+    let got = fs::read(&dst).context("read back copied file")?;
+    assert_eq!(got.len(), payload.len(), "copied file size mismatch");
+    assert_eq!(got, payload, "copied file content mismatch");
+
+    Ok(())
+}