metadata

package
v0.3.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 19, 2024 License: Apache-2.0 Imports: 20 Imported by: 8

Documentation

Overview

Package metadata contains all of the on disk structures. These structures are defined in metadata.proto. The package also contains functions for manipulating these structures, specifically:

  • Reading and Writing the Config file to disk
  • Getting and Setting Policies for directories
  • Reasonable defaults for a Policy's EncryptionOptions

Index

Constants

View Source 
const (
	// Length of policy descriptor (in hex chars) for v1 encryption policies
	PolicyDescriptorLenV1 = 2 * unix.FSCRYPT_KEY_DESCRIPTOR_SIZE
	// Length of protector descriptor (in hex chars)
	ProtectorDescriptorLen = PolicyDescriptorLenV1
	// Length of policy descriptor (in hex chars) for v2 encryption policies
	PolicyDescriptorLenV2 = 2 * unix.FSCRYPT_KEY_IDENTIFIER_SIZE
	// We always use 256-bit keys internally (compared to 512-bit policy keys).
	InternalKeyLen = 32
	IVLen          = 16
	SaltLen        = 16
	// We use SHA256 for the HMAC, and len(HMAC) == len(hash size).
	HMACLen = sha256.Size
	// PolicyKeyLen is the length of all keys passed directly to the Keyring
	PolicyKeyLen = unix.FSCRYPT_MAX_KEY_SIZE
)

Lengths for our keys, buffers, and strings used in fscrypt.

View Source 
const MaxParallelism = math.MaxUint8

MaxParallelism is the maximum allowed value for HashingCosts.Parallelism.

Variables

View Source 
var (
	// DefaultOptions use the supported encryption modes, max padding, and
	// policy version 1.
	DefaultOptions = &EncryptionOptions{
		Padding:       32,
		Contents:      EncryptionOptions_AES_256_XTS,
		Filenames:     EncryptionOptions_AES_256_CTS,
		PolicyVersion: 1,
	}
	// DefaultSource is the source we use if none is specified.
	DefaultSource = SourceType_custom_passphrase
)
View Source 
var (
	SourceType_name = map[int32]string{
		0: "default",
		1: "pam_passphrase",
		2: "custom_passphrase",
		3: "raw_key",
	}
	SourceType_value = map[string]int32{
		"default":           0,
		"pam_passphrase":    1,
		"custom_passphrase": 2,
		"raw_key":           3,
	}
)

Enum value maps for SourceType.

View Source 
var (
	EncryptionOptions_Mode_name = map[int32]string{
		0:  "default",
		1:  "AES_256_XTS",
		2:  "AES_256_GCM",
		3:  "AES_256_CBC",
		4:  "AES_256_CTS",
		5:  "AES_128_CBC",
		6:  "AES_128_CTS",
		9:  "Adiantum",
		10: "AES_256_HCTR2",
	}
	EncryptionOptions_Mode_value = map[string]int32{
		"default":       0,
		"AES_256_XTS":   1,
		"AES_256_GCM":   2,
		"AES_256_CBC":   3,
		"AES_256_CTS":   4,
		"AES_128_CBC":   5,
		"AES_128_CTS":   6,
		"Adiantum":      9,
		"AES_256_HCTR2": 10,
	}
)

Enum value maps for EncryptionOptions_Mode.

View Source 
var (
	// ErrEncryptionNotSupported indicates that encryption is not supported
	// on the given filesystem, and there is no way to enable it.
	ErrEncryptionNotSupported = errors.New("encryption not supported")

	// ErrEncryptionNotEnabled indicates that encryption is not supported on
	// the given filesystem, but there is a way to enable it.
	ErrEncryptionNotEnabled = errors.New("encryption not enabled")
)
View Source 
var File_metadata_metadata_proto protoreflect.FileDescriptor

Functions

func CheckSupport 

func CheckSupport(path string) error

CheckSupport returns an error if the filesystem containing path does not support filesystem encryption. This can be for many reasons including an incompatible kernel or filesystem or not enabling the right feature flags.

func SetPolicy 

func SetPolicy(path string, data *PolicyData) error

SetPolicy sets up the specified directory to be encrypted with the specified policy. Returns an error if we cannot set the policy for any reason (not a directory, invalid options or KeyDescriptor, etc).

func WriteConfig 

func WriteConfig(config *Config, out io.Writer) error

WriteConfig outputs the Config data as nicely formatted JSON

Types

type Config 

type Config struct {
	Source                    SourceType         `protobuf:"varint,1,opt,name=source,proto3,enum=metadata.SourceType" json:"source,omitempty"`
	HashCosts                 *HashingCosts      `protobuf:"bytes,2,opt,name=hash_costs,json=hashCosts,proto3" json:"hash_costs,omitempty"`
	Options                   *EncryptionOptions `protobuf:"bytes,4,opt,name=options,proto3" json:"options,omitempty"`
	UseFsKeyringForV1Policies bool               `` /* 145-byte string literal not displayed */
	AllowCrossUserMetadata    bool               `` /* 132-byte string literal not displayed */
	// contains filtered or unexported fields
}

Data stored in the config file

func ReadConfig 

func ReadConfig(in io.Reader) (*Config, error)

ReadConfig writes the JSON data into the config structure

func (*Config) CheckValidity 

func (c *Config) CheckValidity() error

CheckValidity ensures the Config has all the necessary info for its Source.

func (*Config) Descriptor deprecated 

func (*Config) Descriptor() ([]byte, []int)

Deprecated: Use Config.ProtoReflect.Descriptor instead.

func (*Config) GetAllowCrossUserMetadata added in v0.3.3 

func (x *Config) GetAllowCrossUserMetadata() bool

func (*Config) GetHashCosts 

func (x *Config) GetHashCosts() *HashingCosts

func (*Config) GetOptions 

func (x *Config) GetOptions() *EncryptionOptions

func (*Config) GetSource 

func (x *Config) GetSource() SourceType

func (*Config) GetUseFsKeyringForV1Policies added in v0.2.6 

func (x *Config) GetUseFsKeyringForV1Policies() bool

func (*Config) ProtoMessage 

func (*Config) ProtoMessage()

func (*Config) ProtoReflect added in v0.3.4 

func (x *Config) ProtoReflect() protoreflect.Message

func (*Config) Reset 

func (x *Config) Reset()

func (*Config) String 

func (x *Config) String() string

type EncryptionOptions 

type EncryptionOptions struct {
	Padding       int64                  `protobuf:"varint,1,opt,name=padding,proto3" json:"padding,omitempty"`
	Contents      EncryptionOptions_Mode `protobuf:"varint,2,opt,name=contents,proto3,enum=metadata.EncryptionOptions_Mode" json:"contents,omitempty"`
	Filenames     EncryptionOptions_Mode `protobuf:"varint,3,opt,name=filenames,proto3,enum=metadata.EncryptionOptions_Mode" json:"filenames,omitempty"`
	PolicyVersion int64                  `protobuf:"varint,4,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"`
	// contains filtered or unexported fields
}

Encryption policy specifics, corresponds to the fscrypt_policy struct

func (*EncryptionOptions) CheckValidity 

func (e *EncryptionOptions) CheckValidity() error

CheckValidity ensures each of the options is valid.

func (*EncryptionOptions) Descriptor deprecated 

func (*EncryptionOptions) Descriptor() ([]byte, []int)

Deprecated: Use EncryptionOptions.ProtoReflect.Descriptor instead.

func (*EncryptionOptions) GetContents 

func (x *EncryptionOptions) GetContents() EncryptionOptions_Mode

func (*EncryptionOptions) GetFilenames 

func (x *EncryptionOptions) GetFilenames() EncryptionOptions_Mode

func (*EncryptionOptions) GetPadding 

func (x *EncryptionOptions) GetPadding() int64

func (*EncryptionOptions) GetPolicyVersion added in v0.2.6 

func (x *EncryptionOptions) GetPolicyVersion() int64

func (*EncryptionOptions) ProtoMessage 

func (*EncryptionOptions) ProtoMessage()

func (*EncryptionOptions) ProtoReflect added in v0.3.4 

func (x *EncryptionOptions) ProtoReflect() protoreflect.Message

func (*EncryptionOptions) Reset 

func (x *EncryptionOptions) Reset()

func (*EncryptionOptions) String 

func (x *EncryptionOptions) String() string

type EncryptionOptions_Mode 

type EncryptionOptions_Mode int32

Type of encryption; should match declarations of unix.FSCRYPT_MODE 

const (
	EncryptionOptions_default       EncryptionOptions_Mode = 0
	EncryptionOptions_AES_256_XTS   EncryptionOptions_Mode = 1
	EncryptionOptions_AES_256_GCM   EncryptionOptions_Mode = 2
	EncryptionOptions_AES_256_CBC   EncryptionOptions_Mode = 3
	EncryptionOptions_AES_256_CTS   EncryptionOptions_Mode = 4
	EncryptionOptions_AES_128_CBC   EncryptionOptions_Mode = 5
	EncryptionOptions_AES_128_CTS   EncryptionOptions_Mode = 6
	EncryptionOptions_Adiantum      EncryptionOptions_Mode = 9
	EncryptionOptions_AES_256_HCTR2 EncryptionOptions_Mode = 10
)

func (EncryptionOptions_Mode) CheckValidity 

func (m EncryptionOptions_Mode) CheckValidity() error

CheckValidity ensures the mode has a name and isn't empty.

func (EncryptionOptions_Mode) Descriptor added in v0.3.4 

func (EncryptionOptions_Mode) Descriptor() protoreflect.EnumDescriptor

func (EncryptionOptions_Mode) Enum added in v0.3.4 

func (x EncryptionOptions_Mode) Enum() *EncryptionOptions_Mode

func (EncryptionOptions_Mode) EnumDescriptor deprecated 

func (EncryptionOptions_Mode) EnumDescriptor() ([]byte, []int)

Deprecated: Use EncryptionOptions_Mode.Descriptor instead.

func (EncryptionOptions_Mode) Number added in v0.3.4 

func (x EncryptionOptions_Mode) Number() protoreflect.EnumNumber

func (EncryptionOptions_Mode) String 

func (x EncryptionOptions_Mode) String() string

func (EncryptionOptions_Mode) Type added in v0.3.4 

func (EncryptionOptions_Mode) Type() protoreflect.EnumType

type ErrAlreadyEncrypted added in v0.2.8 

type ErrAlreadyEncrypted struct {
	Path string
}

ErrAlreadyEncrypted indicates that the path is already encrypted.

func (*ErrAlreadyEncrypted) Error added in v0.2.8 

func (err *ErrAlreadyEncrypted) Error() string

type ErrBadEncryptionOptions 

type ErrBadEncryptionOptions struct {
	Path    string
	Options *EncryptionOptions
}

ErrBadEncryptionOptions indicates that unsupported encryption options were given.

func (*ErrBadEncryptionOptions) Error added in v0.2.8 

func (err *ErrBadEncryptionOptions) Error() string

type ErrDirectoryNotOwned added in v0.2.8 

type ErrDirectoryNotOwned struct {
	Path  string
	Owner uint32
}

ErrDirectoryNotOwned indicates a directory can't be encrypted because it's owned by another user.

func (*ErrDirectoryNotOwned) Error added in v0.2.8 

func (err *ErrDirectoryNotOwned) Error() string

type ErrLockedRegularFile added in v0.3.5 

type ErrLockedRegularFile struct {
	Path string
}

ErrLockedRegularFile indicates that the path is a locked regular file.

func (*ErrLockedRegularFile) Error added in v0.3.5 

func (err *ErrLockedRegularFile) Error() string

type ErrNotEncrypted 

type ErrNotEncrypted struct {
	Path string
}

ErrNotEncrypted indicates that the path is not encrypted.

func (*ErrNotEncrypted) Error added in v0.2.8 

func (err *ErrNotEncrypted) Error() string

type HashingCosts 

type HashingCosts struct {
	Time        int64 `protobuf:"varint,2,opt,name=time,proto3" json:"time,omitempty"`
	Memory      int64 `protobuf:"varint,3,opt,name=memory,proto3" json:"memory,omitempty"`
	Parallelism int64 `protobuf:"varint,4,opt,name=parallelism,proto3" json:"parallelism,omitempty"`
	// If true, parallelism should no longer be truncated to 8 bits.
	TruncationFixed bool `protobuf:"varint,5,opt,name=truncation_fixed,json=truncationFixed,proto3" json:"truncation_fixed,omitempty"`
	// contains filtered or unexported fields
}

Cost parameters to be used in our hashing functions.

func (*HashingCosts) CheckValidity 

func (h *HashingCosts) CheckValidity() error

CheckValidity ensures the hash costs will be accepted by Argon2.

func (*HashingCosts) Descriptor deprecated 

func (*HashingCosts) Descriptor() ([]byte, []int)

Deprecated: Use HashingCosts.ProtoReflect.Descriptor instead.

func (*HashingCosts) GetMemory 

func (x *HashingCosts) GetMemory() int64

func (*HashingCosts) GetParallelism 

func (x *HashingCosts) GetParallelism() int64

func (*HashingCosts) GetTime 

func (x *HashingCosts) GetTime() int64

func (*HashingCosts) GetTruncationFixed added in v0.3.4 

func (x *HashingCosts) GetTruncationFixed() bool

func (*HashingCosts) ProtoMessage 

func (*HashingCosts) ProtoMessage()

func (*HashingCosts) ProtoReflect added in v0.3.4 

func (x *HashingCosts) ProtoReflect() protoreflect.Message

func (*HashingCosts) Reset 

func (x *HashingCosts) Reset()

func (*HashingCosts) String 

func (x *HashingCosts) String() string

type Metadata 

type Metadata interface {
	CheckValidity() error
	proto.Message
}

Metadata is the interface to all of the protobuf structures that can be checked for validity.

type PolicyData 

type PolicyData struct {
	KeyDescriptor     string              `protobuf:"bytes,1,opt,name=key_descriptor,json=keyDescriptor,proto3" json:"key_descriptor,omitempty"`
	Options           *EncryptionOptions  `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
	WrappedPolicyKeys []*WrappedPolicyKey `protobuf:"bytes,3,rep,name=wrapped_policy_keys,json=wrappedPolicyKeys,proto3" json:"wrapped_policy_keys,omitempty"`
	// contains filtered or unexported fields
}

The associated data for each policy

func GetPolicy 

func GetPolicy(path string) (*PolicyData, error)

GetPolicy returns the Policy data for the given directory or file (includes the KeyDescriptor and the encryption options). Returns an error if the path is not encrypted or the policy couldn't be retrieved.

func (*PolicyData) CheckValidity 

func (p *PolicyData) CheckValidity() error

CheckValidity ensures the fields and each wrapped key are valid.

func (*PolicyData) Descriptor deprecated 

func (*PolicyData) Descriptor() ([]byte, []int)

Deprecated: Use PolicyData.ProtoReflect.Descriptor instead.

func (*PolicyData) GetKeyDescriptor 

func (x *PolicyData) GetKeyDescriptor() string

func (*PolicyData) GetOptions 

func (x *PolicyData) GetOptions() *EncryptionOptions

func (*PolicyData) GetWrappedPolicyKeys 

func (x *PolicyData) GetWrappedPolicyKeys() []*WrappedPolicyKey

func (*PolicyData) ProtoMessage 

func (*PolicyData) ProtoMessage()

func (*PolicyData) ProtoReflect added in v0.3.4 

func (x *PolicyData) ProtoReflect() protoreflect.Message

func (*PolicyData) Reset 

func (x *PolicyData) Reset()

func (*PolicyData) String 

func (x *PolicyData) String() string

type ProtectorData 

type ProtectorData struct {
	ProtectorDescriptor string     `protobuf:"bytes,1,opt,name=protector_descriptor,json=protectorDescriptor,proto3" json:"protector_descriptor,omitempty"`
	Source              SourceType `protobuf:"varint,2,opt,name=source,proto3,enum=metadata.SourceType" json:"source,omitempty"`
	// These are only used by some of the protector types
	Name       string          `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
	Costs      *HashingCosts   `protobuf:"bytes,4,opt,name=costs,proto3" json:"costs,omitempty"`
	Salt       []byte          `protobuf:"bytes,5,opt,name=salt,proto3" json:"salt,omitempty"`
	Uid        int64           `protobuf:"varint,6,opt,name=uid,proto3" json:"uid,omitempty"`
	WrappedKey *WrappedKeyData `protobuf:"bytes,7,opt,name=wrapped_key,json=wrappedKey,proto3" json:"wrapped_key,omitempty"`
	// contains filtered or unexported fields
}

The associated data for each protector

func (*ProtectorData) CheckValidity 

func (p *ProtectorData) CheckValidity() error

CheckValidity ensures our ProtectorData has the correct fields for its source.

func (*ProtectorData) Descriptor deprecated 

func (*ProtectorData) Descriptor() ([]byte, []int)

Deprecated: Use ProtectorData.ProtoReflect.Descriptor instead.

func (*ProtectorData) GetCosts 

func (x *ProtectorData) GetCosts() *HashingCosts

func (*ProtectorData) GetName 

func (x *ProtectorData) GetName() string

func (*ProtectorData) GetProtectorDescriptor 

func (x *ProtectorData) GetProtectorDescriptor() string

func (*ProtectorData) GetSalt 

func (x *ProtectorData) GetSalt() []byte

func (*ProtectorData) GetSource 

func (x *ProtectorData) GetSource() SourceType

func (*ProtectorData) GetUid 

func (x *ProtectorData) GetUid() int64

func (*ProtectorData) GetWrappedKey 

func (x *ProtectorData) GetWrappedKey() *WrappedKeyData

func (*ProtectorData) ProtoMessage 

func (*ProtectorData) ProtoMessage()

func (*ProtectorData) ProtoReflect added in v0.3.4 

func (x *ProtectorData) ProtoReflect() protoreflect.Message

func (*ProtectorData) Reset 

func (x *ProtectorData) Reset()

func (*ProtectorData) String 

func (x *ProtectorData) String() string

type SourceType 

type SourceType int32

Specifies the method in which an outside secret is obtained for a Protector 

const (
	SourceType_default           SourceType = 0
	SourceType_pam_passphrase    SourceType = 1
	SourceType_custom_passphrase SourceType = 2
	SourceType_raw_key           SourceType = 3
)

func (SourceType) CheckValidity 

func (s SourceType) CheckValidity() error

CheckValidity ensures the source has a name and isn't empty.

func (SourceType) Descriptor added in v0.3.4 

func (SourceType) Descriptor() protoreflect.EnumDescriptor

func (SourceType) Enum added in v0.3.4 

func (x SourceType) Enum() *SourceType

func (SourceType) EnumDescriptor deprecated 

func (SourceType) EnumDescriptor() ([]byte, []int)

Deprecated: Use SourceType.Descriptor instead.

func (SourceType) Number added in v0.3.4 

func (x SourceType) Number() protoreflect.EnumNumber

func (SourceType) String 

func (x SourceType) String() string

func (SourceType) Type added in v0.3.4 

func (SourceType) Type() protoreflect.EnumType

type WrappedKeyData 

type WrappedKeyData struct {
	IV           []byte `protobuf:"bytes,1,opt,name=IV,proto3" json:"IV,omitempty"`
	EncryptedKey []byte `protobuf:"bytes,2,opt,name=encrypted_key,json=encryptedKey,proto3" json:"encrypted_key,omitempty"`
	Hmac         []byte `protobuf:"bytes,3,opt,name=hmac,proto3" json:"hmac,omitempty"`
	// contains filtered or unexported fields
}

This structure is used for our authenticated wrapping/unwrapping of keys.

func (*WrappedKeyData) CheckValidity 

func (w *WrappedKeyData) CheckValidity() error

CheckValidity ensures our buffers are the correct length.

func (*WrappedKeyData) Descriptor deprecated 

func (*WrappedKeyData) Descriptor() ([]byte, []int)

Deprecated: Use WrappedKeyData.ProtoReflect.Descriptor instead.

func (*WrappedKeyData) GetEncryptedKey 

func (x *WrappedKeyData) GetEncryptedKey() []byte

func (*WrappedKeyData) GetHmac 

func (x *WrappedKeyData) GetHmac() []byte

func (*WrappedKeyData) GetIV 

func (x *WrappedKeyData) GetIV() []byte

func (*WrappedKeyData) ProtoMessage 

func (*WrappedKeyData) ProtoMessage()

func (*WrappedKeyData) ProtoReflect added in v0.3.4 

func (x *WrappedKeyData) ProtoReflect() protoreflect.Message

func (*WrappedKeyData) Reset 

func (x *WrappedKeyData) Reset()

func (*WrappedKeyData) String 

func (x *WrappedKeyData) String() string

type WrappedPolicyKey 

type WrappedPolicyKey struct {
	ProtectorDescriptor string          `protobuf:"bytes,1,opt,name=protector_descriptor,json=protectorDescriptor,proto3" json:"protector_descriptor,omitempty"`
	WrappedKey          *WrappedKeyData `protobuf:"bytes,2,opt,name=wrapped_key,json=wrappedKey,proto3" json:"wrapped_key,omitempty"`
	// contains filtered or unexported fields
}

func (*WrappedPolicyKey) CheckValidity 

func (w *WrappedPolicyKey) CheckValidity() error

CheckValidity ensures the fields are valid and have the correct lengths.

func (*WrappedPolicyKey) Descriptor deprecated 

func (*WrappedPolicyKey) Descriptor() ([]byte, []int)

Deprecated: Use WrappedPolicyKey.ProtoReflect.Descriptor instead.

func (*WrappedPolicyKey) GetProtectorDescriptor 

func (x *WrappedPolicyKey) GetProtectorDescriptor() string

func (*WrappedPolicyKey) GetWrappedKey 

func (x *WrappedPolicyKey) GetWrappedKey() *WrappedKeyData

func (*WrappedPolicyKey) ProtoMessage 

func (*WrappedPolicyKey) ProtoMessage()

func (*WrappedPolicyKey) ProtoReflect added in v0.3.4 

func (x *WrappedPolicyKey) ProtoReflect() protoreflect.Message

func (*WrappedPolicyKey) Reset 

func (x *WrappedPolicyKey) Reset()

func (*WrappedPolicyKey) String 

func (x *WrappedPolicyKey) String() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.