openkylin
/
platform_system_core
mirror of https://gitee.com/openkylin/platform_system_core.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

fs_mgr: allow specifying HEH filenames encryption 

Make the fs_mgr changes needed to support specifying aes-256-heh
filenames encryption.  To do this, extend the "fileencryption" fstab
option to have the syntax
fileencryption=contents_encryption_mode[:filenames_encryption_mode].
The previous filenames encryption mode, aes-256-cts, remains supported
and will be used by default if no mode is explicitly specified.

For consistency, also make "aes-256-xts" an alias for the "software"
contents encryption mode.

Bug: 34712722
Change-Id: I74c0f5fe7cddde7055d7b031d96a2916ca611eb7
This commit is contained in:
Eric Biggers 2017-02-02 14:46:24 -08:00
parent df901ebf1e
commit b478f706d7
2 changed files with 77 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

99
fs_mgr/fs_mgr_fstab.cpp
View File

@ -34,7 +34,8 @@ struct fs_mgr_flag_values {
int max_comp_streams;
unsigned int zram_size;
uint64_t reserved_size;
unsigned int file_encryption_mode;
unsigned int file_contents_mode;
unsigned int file_names_mode;
unsigned int erase_blk_size;
unsigned int logical_blk_size;
};
@ -94,15 +95,51 @@ static struct flag_list fs_mgr_flags[] = {
{ 0, 0 },
};
#define EM_SOFTWARE 1
#define EM_ICE 2
#define EM_AES_256_XTS 1
#define EM_ICE 2
#define EM_AES_256_CTS 3
#define EM_AES_256_HEH 4
static struct flag_list encryption_modes[] = {
{"software", EM_SOFTWARE},
{"ice", EM_ICE},
{0, 0}
static const struct flag_list file_contents_encryption_modes[] = {
{"aes-256-xts", EM_AES_256_XTS},
{"software", EM_AES_256_XTS}, /* alias for backwards compatibility */
{"ice", EM_ICE}, /* hardware-specific inline cryptographic engine */
{0, 0},
};
static const struct flag_list file_names_encryption_modes[] = {
{"aes-256-cts", EM_AES_256_CTS},
{"aes-256-heh", EM_AES_256_HEH},
{0, 0},
};
static unsigned int encryption_mode_to_flag(const struct flag_list *list,
const char *mode, const char *type)
{
const struct flag_list *j;
for (j = list; j->name; ++j) {
if (!strcmp(mode, j->name)) {
return j->flag;
}
}
LERROR << "Unknown " << type << " encryption mode: " << mode;
return 0;
}
static const char *flag_to_encryption_mode(const struct flag_list *list,
unsigned int flag)
{
const struct flag_list *j;
for (j = list; j->name; ++j) {
if (flag == j->flag) {
return j->name;
}
}
return nullptr;
}
static uint64_t calculate_zram_size(unsigned int percentage)
{
uint64_t total;
@ -183,20 +220,28 @@ static int parse_flags(char *flags, struct flag_list *fl,
* location of the keys. Get it and return it.
*/
flag_vals->key_loc = strdup(strchr(p, '=') + 1);
flag_vals->file_encryption_mode = EM_SOFTWARE;
flag_vals->file_contents_mode = EM_AES_256_XTS;
flag_vals->file_names_mode = EM_AES_256_CTS;
} else if ((fl[i].flag == MF_FILEENCRYPTION) && flag_vals) {
/* The fileencryption flag is followed by an = and the
* type of the encryption. Get it and return it.
/* The fileencryption flag is followed by an = and
* the mode of contents encryption, then optionally a
* : and the mode of filenames encryption (defaults
* to aes-256-cts). Get it and return it.
*/
const struct flag_list *j;
const char *mode = strchr(p, '=') + 1;
for (j = encryption_modes; j->name; ++j) {
if (!strcmp(mode, j->name)) {
flag_vals->file_encryption_mode = j->flag;
}
char *mode = strchr(p, '=') + 1;
char *colon = strchr(mode, ':');
if (colon) {
*colon = '\0';
}
if (flag_vals->file_encryption_mode == 0) {
LERROR << "Unknown file encryption mode: " << mode;
flag_vals->file_contents_mode =
encryption_mode_to_flag(file_contents_encryption_modes,
mode, "file contents");
if (colon) {
flag_vals->file_names_mode =
encryption_mode_to_flag(file_names_encryption_modes,
colon + 1, "file names");
} else {
flag_vals->file_names_mode = EM_AES_256_CTS;
}
} else if ((fl[i].flag == MF_LENGTH) && flag_vals) {
/* The length flag is followed by an = and the
@ -406,7 +451,8 @@ struct fstab *fs_mgr_read_fstab_file(FILE *fstab_file)
fstab->recs[cnt].max_comp_streams = flag_vals.max_comp_streams;
fstab->recs[cnt].zram_size = flag_vals.zram_size;
fstab->recs[cnt].reserved_size = flag_vals.reserved_size;
fstab->recs[cnt].file_encryption_mode = flag_vals.file_encryption_mode;
fstab->recs[cnt].file_contents_mode = flag_vals.file_contents_mode;
fstab->recs[cnt].file_names_mode = flag_vals.file_names_mode;
fstab->recs[cnt].erase_blk_size = flag_vals.erase_blk_size;
fstab->recs[cnt].logical_blk_size = flag_vals.logical_blk_size;
cnt++;
@ -567,15 +613,14 @@ int fs_mgr_is_file_encrypted(const struct fstab_rec *fstab)
return fstab->fs_mgr_flags & MF_FILEENCRYPTION;
}
const char* fs_mgr_get_file_encryption_mode(const struct fstab_rec *fstab)
void fs_mgr_get_file_encryption_modes(const struct fstab_rec *fstab,
const char **contents_mode_ret,
const char **filenames_mode_ret)
{
const struct flag_list *j;
for (j = encryption_modes; j->name; ++j) {
if (fstab->file_encryption_mode == j->flag) {
return j->name;
}
}
return NULL;
*contents_mode_ret = flag_to_encryption_mode(file_contents_encryption_modes,
fstab->file_contents_mode);
*filenames_mode_ret = flag_to_encryption_mode(file_names_encryption_modes,
fstab->file_names_mode);
}
int fs_mgr_is_convertible_to_fbe(const struct fstab_rec *fstab)

7
fs_mgr/include/fs_mgr.h
View File

@ -76,7 +76,8 @@ struct fstab_rec {
int max_comp_streams;
unsigned int zram_size;
uint64_t reserved_size;
unsigned int file_encryption_mode;
unsigned int file_contents_mode;
unsigned int file_names_mode;
unsigned int erase_blk_size;
unsigned int logical_blk_size;
};
@ -118,7 +119,9 @@ int fs_mgr_is_nonremovable(const struct fstab_rec *fstab);
int fs_mgr_is_verified(const struct fstab_rec *fstab);
int fs_mgr_is_encryptable(const struct fstab_rec *fstab);
int fs_mgr_is_file_encrypted(const struct fstab_rec *fstab);
const char* fs_mgr_get_file_encryption_mode(const struct fstab_rec *fstab);
void fs_mgr_get_file_encryption_modes(const struct fstab_rec *fstab,
const char **contents_mode_ret,
const char **filenames_mode_ret);
int fs_mgr_is_convertible_to_fbe(const struct fstab_rec *fstab);
int fs_mgr_is_noemulatedsd(const struct fstab_rec *fstab);
int fs_mgr_is_notrim(struct fstab_rec *fstab);