From 44c2c7aeda3de09a405ed06aadacbc2c0c7f2a67 Mon Sep 17 00:00:00 2001 From: "Joe Richey joerichey@google.com" Date: Tue, 23 May 2017 18:38:38 -0700 Subject: metadata: reorganize and add consistency checks This commit adds in IsValid() checks for the metadata structures that let us enforce stronger invariants than those imposed by the protobuf package. The main uses of this will be to check that metadata is valid before writing it to the filesystem, and to check that the filesystem contains valid metadata before returning it to the user. These functions also will log the exact reason if the validity checks fail. To have these checks in the metadata package, all of the various constants have been moved to a single metadata/constants.go file. The uses of these constants were changed accordingly. Finally, this commit standardizes our use of errors so that they always begin with an appropriate prefix. Change-Id: I99008e2ee803ebe5f6236eb8d83fc83efcd22718 --- metadata/constants.go | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 metadata/constants.go (limited to 'metadata/constants.go') diff --git a/metadata/constants.go b/metadata/constants.go new file mode 100644 index 0000000..6e4a08d --- /dev/null +++ b/metadata/constants.go @@ -0,0 +1,51 @@ +/* + * constants.go - Some metadata constants used throughout fscrypt + * + * Copyright 2017 Google Inc. + * Author: Joe Richey (joerichey@google.com) + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may not + * use this file except in compliance with the License. You may obtain a copy of + * the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations under + * the License. + */ + +package metadata + +import ( + "crypto/sha256" + + "golang.org/x/sys/unix" +) + +// Lengths for our keys, buffers, and strings used in fscrypt. +const ( + // DescriptorLen is the length of all Protector and Policy descriptors. + DescriptorLen = 2 * unix.FS_KEY_DESCRIPTOR_SIZE + // We always use 256-bit keys internally (compared to 512-bit policy keys). + InternalKeyLen = 32 + IVLen = 16 + SaltLen = 16 + // We use SHA256 for the HMAC, and len(HMAC) == len(hash size). + HMACLen = sha256.Size + // PolicyKeyLen is the length of all keys passed directly to the Keyring + PolicyKeyLen = unix.FS_MAX_KEY_SIZE +) + +var ( + // DefaultOptions use the supported encryption modes and max padding. + DefaultOptions = &EncryptionOptions{ + Padding: 32, + Contents: EncryptionOptions_XTS, + Filenames: EncryptionOptions_CTS, + } + // DefaultSource is the source we use if none is specified. + DefaultSource = SourceType_custom_passphrase +) -- cgit v1.2.3