metadata: reorganize and add consistency checks

This commit adds in IsValid() checks for the metadata structures that
let us enforce stronger invariants than those imposed by the protobuf
package. The main uses of this will be to check that metadata is valid
before writing it to the filesystem, and to check that the filesystem
contains valid metadata before returning it to the user. These functions
also will log the exact reason if the validity checks fail.

To have these checks in the metadata package, all of the various
constants have been moved to a single metadata/constants.go file. The
uses of these constants were changed accordingly.

Finally, this commit standardizes our use of errors so that they always
begin with an appropriate prefix.

Change-Id: I99008e2ee803ebe5f6236eb8d83fc83efcd22718

1 files changed, 16 insertions, 15 deletions

diff --git a/metadata/metadata.proto b/metadata/metadata.proto
index f3103f8..f402fa1 100644
--- a/metadata/metadata.proto
+++ b/metadata/metadata.proto
@@ -38,7 +38,7 @@ message WrappedKeyData {
 
 // Specifies the method in which an outside secret is obtained for a Protector
 enum SourceType {
-  none = 0;
+  default = 0;
   pam_passphrase = 1;
   custom_passphrase = 2;
   raw_key = 3;
@@ -47,10 +47,10 @@ enum SourceType {
 // The associated data for each protector
 message ProtectorData {
   string protector_descriptor = 1;
-  string name = 2;
-  SourceType source = 3;
+  SourceType source = 2;
 
   // These are only used by some of the protector types
+  string name = 3;
   HashingCosts costs = 4;
   bytes salt = 5;
   int64 uid = 6;
@@ -58,20 +58,21 @@ message ProtectorData {
   WrappedKeyData wrapped_key = 7;
 }
 
-// Type of encryption, should match the declarations of unix.FS_ENCRYPTION_MODE
-enum EncryptionMode {
-  default = 0;
-  XTS = 1;
-  GCM = 2;
-  CBC = 3;
-  CTS = 4;
-}
-
-// Encryption policy specifics, should match struct fscrypt_policy
+// Encryption policy specifics, corresponds to the fscrypt_policy struct
 message EncryptionOptions {
   int64 padding = 1;
-  EncryptionMode contents_mode = 2;
-  EncryptionMode filenames_mode = 3;
+
+  // Type of encryption; should match declarations of unix.FS_ENCRYPTION_MODE
+  enum Mode {
+    default = 0;
+    XTS = 1;
+    GCM = 2;
+    CBC = 3;
+    CTS = 4;
+  }
+
+  Mode contents = 2;
+  Mode filenames = 3;
 }
 
 message WrappedPolicyKey {