1. 23 Oct, 2018 15 commits
    • Sascha Hauer's avatar
      ubifs: Add authentication nodes to journal · 6a98bc46
      Sascha Hauer authored
      Nodes that are written to flash can only be authenticated through the
      index after the next commit. When a journal replay is necessary the
      nodes are not yet referenced by the index and thus can't be
      authenticated.
      
      This patch overcomes this situation by creating a hash over all nodes
      beginning from the commit start node over the reference node(s) and
      the buds themselves. From
      time to time we insert authentication nodes. Authentication nodes
      contain a HMAC from the current hash state, so that they can be
      used to authenticate a journal replay up to the point where the
      authentication node is. The hash is continued afterwards
      so that theoretically we would only have to check the HMAC of
      the last authentication node we find.
      
      Overall we get this picture:
      
      ,,,,,,,,
      ,......,...........................................
      ,. CS  ,               hash1.----.           hash2.----.
      ,.  |  ,                    .    |hmac            .    |hmac
      ,.  v  ,                    .    v                .    v
      ,.REF#0,-> bud -> bud -> bud.-> auth -> bud -> bud.-> auth ...
      ,..|...,...........................................
      ,  |   ,
      ,  |   ,,,,,,,,,,,,,,,
      .  |            hash3,----.
      ,  |                 ,    |hmac
      ,  v                 ,    v
      , REF#1 -> bud -> bud,-> auth ...
      ,,,|,,,,,,,,,,,,,,,,,,
         v
        REF#2 -> ...
         |
         V
        ...
      
      Note how hash3 covers CS, REF#0 and REF#1 so that it is not possible to
      exchange or skip any reference nodes. Unlike the picture suggests the
      auth nodes themselves are not hashed.
      
      With this it is possible for an offline attacker to cut each journal
      head or to drop the last reference node(s), but not to skip any journal
      heads or to reorder any operations.
      Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      6a98bc46
    • Sascha Hauer's avatar
      ubifs: authentication: Add hashes to index nodes · 16a26b20
      Sascha Hauer authored
      With this patch the hashes over the index nodes stored in the tree node
      cache are written to flash and are checked when read back from flash.
      The hash of the root index node is stored in the master node.
      
      During journal replay the hashes are regenerated from the read nodes
      and stored in the tree node cache. This means the nodes must previously
      be authenticated by other means. This is done in a later patch.
      Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      16a26b20
    • Sascha Hauer's avatar
      ubifs: Add hashes to the tree node cache · 823838a4
      Sascha Hauer authored
      As part of the UBIFS authentication support every branch in the index
      gets a hash covering the referenced node. To make that happen the tree
      node cache needs hashes over the nodes. This patch adds a hash argument
      to ubifs_tnc_add() and ubifs_tnc_add_nm(). The hashes are calculated
      from the callers of these functions which actually prepare the nodes.
      With this patch all the leaf nodes of the index tree get hashes, but
      currently nothing is done with these hashes, this is left for a later
      patch.
      Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      823838a4
    • Sascha Hauer's avatar
      ubifs: Create functions to embed a HMAC in a node · a384b47e
      Sascha Hauer authored
      With authentication support some nodes (master node, super block node)
      get a HMAC embedded into them. This patch adds functions to prepare and
      write such a node.
      The difficulty is that besides the HMAC the nodes also have a CRC which
      must stay valid. This means we first have to initialize all fields in
      the node, then calculate the HMAC (not covering the CRC) and finally
      calculate the CRC.
      Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      a384b47e
    • Sascha Hauer's avatar
      ubifs: Add helper functions for authentication support · 49525e5e
      Sascha Hauer authored
      This patch adds the various helper functions needed for authentication
      support. We need functions to hash nodes, to embed HMACs into a node and
      to compare hashes and HMACs. Most functions first check if this
      filesystem is authenticated and bail out early if not, which makes the
      functions safe to be called with disabled authentication.
      Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      49525e5e
    • Sascha Hauer's avatar
      ubifs: Add separate functions to init/crc a node · dead9726
      Sascha Hauer authored
      When adding authentication support we will embed a HMAC into some
      nodes. To prepare these nodes we have to first initialize the nodes,
      then add a HMAC and finally add a CRC. To accomplish this add separate
      ubifs_init_node/ubifs_crc_node functions.
      Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      dead9726
    • Sascha Hauer's avatar
      ubifs: Format changes for authentication support · 5125cfdf
      Sascha Hauer authored
      This patch adds the changes to the on disk format needed for
      authentication support. We'll add:
      
      * a HMAC covering super block node
      * a HMAC covering the master node
      * a hash over the root index node to the master node
      * a hash over the LPT to the master node
      * a flag to the filesystem flag indicating the filesystem is
        authenticated
      * an authentication node necessary to authenticate the nodes written
        to the journal heads while they are written.
      * a HMAC of a well known message to the super block node to be able
        to check if the correct key is provided
      
      And finally, not visible in this patch, nevertheless explained here:
      
      * hashes over the referenced child nodes in each branch of a index node
      Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      5125cfdf
    • Sascha Hauer's avatar
      ubifs: Store read superblock node · fd615005
      Sascha Hauer authored
      The superblock node is read/modified/written several times throughout
      the UBIFS code. Instead of reading it from the device each time just
      keep a copy in memory and write back the modified copy when necessary.
      This patch helps for authentication support, here we not only have to
      read the superblock node, but also have to authenticate it, which
      is easier if we do it once during initialization.
      Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      fd615005
    • Sascha Hauer's avatar
      ubifs: Drop write_node · 83407437
      Sascha Hauer authored
      write_node() is used only once and can easily be replaced with calls
      to ubifs_prepare_node()/write_head() which makes the code a bit shorter.
      Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      83407437
    • Sascha Hauer's avatar
      ubifs: Implement ubifs_lpt_lookup using ubifs_pnode_lookup · e635cf8c
      Sascha Hauer authored
      ubifs_lpt_lookup() starts by looking up the nth pnode in the LPT. We
      already have this functionality in ubifs_pnode_lookup(). Use this
      function rather than open coding its functionality.
      Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      e635cf8c
    • Sascha Hauer's avatar
      ubifs: Export pnode_lookup as ubifs_pnode_lookup · 0e26b6e2
      Sascha Hauer authored
      ubifs_lpt_lookup could be implemented using pnode_lookup. To make that
      possible move pnode_lookup from lpt.c to lpt_commit.c. Rename it to
      ubifs_pnode_lookup since it's now exported.
      Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      0e26b6e2
    • Sascha Hauer's avatar
      ubifs: Pass ubifs_zbranch to read_znode() · 22ceaa8c
      Sascha Hauer authored
      read_znode() takes len, lnum and offs arguments which the caller all
      extracts from the same struct ubifs_zbranch *. When adding authentication
      support we would have to add a pointer to a hash to the arguments which
      is also part of struct ubifs_zbranch. Pass the ubifs_zbranch * instead
      so that we do not have to add another argument.
      Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      22ceaa8c
    • Sascha Hauer's avatar
      ubifs: Pass ubifs_zbranch to try_read_node() · 545bc8f6
      Sascha Hauer authored
      try_read_node() takes len, lnum and offs arguments which the caller all
      extracts from the same struct ubifs_zbranch *. When adding authentication
      support we would have to add a pointer to a hash to the arguments which
      is also part of struct ubifs_zbranch. Pass the ubifs_zbranch * instead
      so that we do not have to add another argument.
      Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      545bc8f6
    • Sascha Hauer's avatar
      ubifs: Refactor create_default_filesystem() · c4de6d7e
      Sascha Hauer authored
      create_default_filesystem() allocates memory for a node, writes that
      node and frees the memory directly afterwards. With this patch we
      allocate memory for all nodes at the beginning of the function and
      free the memory at the end. This makes it easier to implement
      authentication support since with authentication support we'll need
      the contents of some nodes when creating other nodes.
      Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      c4de6d7e
    • Gustavo A. R. Silva's avatar
      ubi: Mark expected switch fall-throughs · 7e5583fd
      Gustavo A. R. Silva authored
      In preparation to enabling -Wimplicit-fallthrough, mark switch cases
      where we are expecting to fall through.
      
      Addresses-Coverity-ID: 1373884 ("Missing break in switch")
      Addresses-Coverity-ID: 114869 ("Missing break in switch")
      Addresses-Coverity-ID: 114870 ("Missing break in switch")
      Signed-off-by: default avatarGustavo A. R. Silva <gustavo@embeddedor.com>
      Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
      7e5583fd
  2. 22 Oct, 2018 8 commits
  3. 21 Oct, 2018 3 commits
  4. 20 Oct, 2018 11 commits
  5. 19 Oct, 2018 3 commits