• Sascha Hauer's avatar
    ubifs: Add authentication nodes to journal · 6a98bc46
    Sascha Hauer authored
    Nodes that are written to flash can only be authenticated through the
    index after the next commit. When a journal replay is necessary the
    nodes are not yet referenced by the index and thus can't be
    authenticated.
    
    This patch overcomes this situation by creating a hash over all nodes
    beginning from the commit start node over the reference node(s) and
    the buds themselves. From
    time to time we insert authentication nodes. Authentication nodes
    contain a HMAC from the current hash state, so that they can be
    used to authenticate a journal replay up to the point where the
    authentication node is. The hash is continued afterwards
    so that theoretically we would only have to check the HMAC of
    the last authentication node we find.
    
    Overall we get this picture:
    
    ,,,,,,,,
    ,......,...........................................
    ,. CS  ,               hash1.----.           hash2.----.
    ,.  |  ,                    .    |hmac            .    |hmac
    ,.  v  ,                    .    v                .    v
    ,.REF#0,-> bud -> bud -> bud.-> auth -> bud -> bud.-> auth ...
    ,..|...,...........................................
    ,  |   ,
    ,  |   ,,,,,,,,,,,,,,,
    .  |            hash3,----.
    ,  |                 ,    |hmac
    ,  v                 ,    v
    , REF#1 -> bud -> bud,-> auth ...
    ,,,|,,,,,,,,,,,,,,,,,,
       v
      REF#2 -> ...
       |
       V
      ...
    
    Note how hash3 covers CS, REF#0 and REF#1 so that it is not possible to
    exchange or skip any reference nodes. Unlike the picture suggests the
    auth nodes themselves are not hashed.
    
    With this it is possible for an offline attacker to cut each journal
    head or to drop the last reference node(s), but not to skip any journal
    heads or to reorder any operations.
    Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
    Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
    6a98bc46
log.c 19.9 KB