Include file size in Merkle hash

The file size can now also be verified. Also, since we are zero-padding
the last block of the data, we cannot differentiate the cases between
zero-padded block from the blocks that are ends with zeroes. With the
size included this can be addressed, as those cases would have different
file size.

PiperOrigin-RevId: 340695510

2 files changed, 30 insertions, 13 deletions

diff --git a/pkg/merkletree/merkletree.go b/pkg/merkletree/merkletree.go
index 18457d287..e0a9e56c5 100644
--- a/pkg/merkletree/merkletree.go
+++ b/pkg/merkletree/merkletree.go
@@ -147,6 +147,7 @@ func (layout Layout) blockOffset(level int, index int64) int64 {
 // meatadata.
 type VerityDescriptor struct {
 	Name     string
+	FileSize int64
 	Mode     uint32
 	UID      uint32
 	GID      uint32
@@ -154,7 +155,7 @@ type VerityDescriptor struct {
 }
 
 func (d *VerityDescriptor) String() string {
-	return fmt.Sprintf("Name: %s, Mode: %d, UID: %d, GID: %d, RootHash: %v", d.Name, d.Mode, d.UID, d.GID, d.RootHash)
+	return fmt.Sprintf("Name: %s, Size: %d, Mode: %d, UID: %d, GID: %d, RootHash: %v", d.Name, d.FileSize, d.Mode, d.UID, d.GID, d.RootHash)
 }
 
 // verify generates a hash from d, and compares it with expected.
@@ -289,6 +290,7 @@ func Generate(params *GenerateParams) ([]byte, error) {
 	}
 	descriptor := VerityDescriptor{
 		Name:     params.Name,
+		FileSize: params.Size,
 		Mode:     params.Mode,
 		UID:      params.UID,
 		GID:      params.GID,
@@ -342,6 +344,7 @@ func verifyMetadata(params *VerifyParams, layout *Layout) error {
 	}
 	descriptor := VerityDescriptor{
 		Name:     params.Name,
+		FileSize: params.Size,
 		Mode:     params.Mode,
 		UID:      params.UID,
 		GID:      params.GID,
@@ -401,10 +404,11 @@ func Verify(params *VerifyParams) (int64, error) {
 			}
 		}
 		descriptor := VerityDescriptor{
-			Name: params.Name,
-			Mode: params.Mode,
-			UID:  params.UID,
-			GID:  params.GID,
+			Name:     params.Name,
+			FileSize: params.Size,
+			Mode:     params.Mode,
+			UID:      params.UID,
+			GID:      params.GID,
 		}
 		if err := verifyBlock(params.Tree, &descriptor, &layout, buf, i, params.HashAlgorithms, params.Expected); err != nil {
 			return 0, err
diff --git a/pkg/merkletree/merkletree_test.go b/pkg/merkletree/merkletree_test.go
index 0782ca3e7..405204d94 100644
--- a/pkg/merkletree/merkletree_test.go
+++ b/pkg/merkletree/merkletree_test.go
@@ -185,42 +185,42 @@ func TestGenerate(t *testing.T) {
 		{
 			data:           bytes.Repeat([]byte{0}, usermem.PageSize),
 			hashAlgorithms: linux.FS_VERITY_HASH_ALG_SHA256,
-			expectedHash:   []byte{64, 253, 58, 72, 192, 131, 82, 184, 193, 33, 108, 142, 43, 46, 179, 134, 244, 21, 29, 190, 14, 39, 66, 129, 6, 46, 200, 211, 30, 247, 191, 252},
+			expectedHash:   []byte{39, 30, 12, 152, 185, 58, 32, 84, 218, 79, 74, 113, 104, 219, 230, 234, 25, 126, 147, 36, 212, 44, 76, 74, 25, 93, 228, 41, 243, 143, 59, 147},
 		},
 		{
 			data:           bytes.Repeat([]byte{0}, usermem.PageSize),
 			hashAlgorithms: linux.FS_VERITY_HASH_ALG_SHA512,
-			expectedHash:   []byte{14, 27, 126, 158, 9, 94, 163, 51, 243, 162, 82, 167, 183, 127, 93, 121, 221, 23, 184, 59, 104, 166, 111, 49, 161, 195, 229, 111, 121, 201, 233, 68, 10, 154, 78, 142, 154, 236, 170, 156, 110, 167, 15, 144, 155, 97, 241, 235, 202, 233, 246, 217, 138, 88, 152, 179, 238, 46, 247, 185, 125, 20, 101, 201},
+			expectedHash:   []byte{184, 76, 172, 204, 17, 136, 127, 75, 224, 42, 251, 181, 98, 149, 1, 44, 58, 148, 20, 187, 30, 174, 73, 87, 166, 9, 109, 169, 42, 96, 87, 202, 59, 82, 174, 80, 51, 95, 101, 100, 6, 246, 56, 120, 27, 166, 29, 59, 67, 115, 227, 121, 241, 177, 63, 238, 82, 157, 43, 107, 174, 180, 44, 84},
 		},
 		{
 			data:           bytes.Repeat([]byte{0}, 128*usermem.PageSize+1),
 			hashAlgorithms: linux.FS_VERITY_HASH_ALG_SHA256,
-			expectedHash:   []byte{182, 223, 218, 62, 65, 185, 160, 219, 93, 119, 186, 88, 205, 32, 122, 231, 173, 72, 78, 76, 65, 57, 177, 146, 159, 39, 44, 123, 230, 156, 97, 26},
+			expectedHash:   []byte{213, 221, 252, 9, 241, 250, 186, 1, 242, 132, 83, 77, 180, 207, 119, 48, 206, 113, 37, 253, 252, 159, 71, 70, 3, 53, 42, 244, 230, 244, 173, 143},
 		},
 		{
 			data:           bytes.Repeat([]byte{0}, 128*usermem.PageSize+1),
 			hashAlgorithms: linux.FS_VERITY_HASH_ALG_SHA512,
-			expectedHash:   []byte{55, 204, 240, 1, 224, 252, 58, 131, 251, 174, 45, 140, 107, 57, 118, 11, 18, 236, 203, 204, 19, 59, 27, 196, 3, 78, 21, 7, 22, 98, 197, 128, 17, 128, 90, 122, 54, 83, 253, 108, 156, 67, 59, 229, 236, 241, 69, 88, 99, 44, 127, 109, 204, 183, 150, 232, 187, 57, 228, 137, 209, 235, 241, 172},
+			expectedHash:   []byte{40, 231, 187, 28, 3, 171, 168, 36, 177, 244, 118, 131, 218, 226, 106, 55, 245, 157, 244, 147, 144, 57, 41, 182, 65, 6, 13, 49, 38, 66, 237, 117, 124, 110, 250, 246, 248, 132, 201, 156, 195, 201, 142, 179, 122, 128, 195, 194, 187, 240, 129, 171, 168, 182, 101, 58, 194, 155, 99, 147, 49, 130, 161, 178},
 		},
 		{
 			data:           []byte{'a'},
 			hashAlgorithms: linux.FS_VERITY_HASH_ALG_SHA256,
-			expectedHash:   []byte{28, 201, 8, 36, 150, 178, 111, 5, 193, 212, 129, 205, 206, 124, 211, 90, 224, 142, 81, 183, 72, 165, 243, 240, 242, 241, 76, 127, 101, 61, 63, 11},
+			expectedHash:   []byte{182, 25, 170, 240, 16, 153, 234, 4, 101, 238, 197, 154, 182, 168, 171, 96, 177, 33, 171, 117, 73, 78, 124, 239, 82, 255, 215, 121, 156, 95, 121, 171},
 		},
 		{
 			data:           []byte{'a'},
 			hashAlgorithms: linux.FS_VERITY_HASH_ALG_SHA512,
-			expectedHash:   []byte{207, 233, 114, 94, 113, 212, 243, 160, 59, 232, 226, 77, 28, 81, 176, 61, 211, 213, 222, 190, 148, 196, 90, 166, 237, 56, 113, 148, 230, 154, 23, 105, 14, 97, 144, 211, 12, 122, 226, 207, 167, 203, 136, 193, 38, 249, 227, 187, 92, 238, 101, 97, 170, 255, 246, 209, 246, 98, 241, 150, 175, 253, 173, 206},
+			expectedHash:   []byte{121, 28, 140, 244, 32, 222, 61, 255, 184, 65, 117, 84, 132, 197, 122, 214, 95, 249, 164, 77, 211, 192, 217, 59, 109, 255, 249, 253, 27, 142, 110, 29, 93, 153, 92, 211, 178, 198, 136, 34, 61, 157, 141, 94, 145, 191, 201, 134, 141, 138, 51, 26, 33, 187, 17, 196, 113, 234, 125, 219, 4, 41, 57, 120},
 		},
 		{
 			data:           bytes.Repeat([]byte{'a'}, usermem.PageSize),
 			hashAlgorithms: linux.FS_VERITY_HASH_ALG_SHA256,
-			expectedHash:   []byte{106, 58, 160, 152, 41, 68, 38, 108, 245, 74, 177, 84, 64, 193, 19, 176, 249, 86, 27, 193, 85, 164, 99, 240, 79, 104, 148, 222, 76, 46, 191, 79},
+			expectedHash:   []byte{17, 40, 99, 150, 206, 124, 196, 184, 41, 40, 50, 91, 113, 47, 8, 204, 2, 102, 202, 86, 157, 92, 218, 53, 151, 250, 234, 247, 191, 121, 113, 246},
 		},
 		{
 			data:           bytes.Repeat([]byte{'a'}, usermem.PageSize),
 			hashAlgorithms: linux.FS_VERITY_HASH_ALG_SHA512,
-			expectedHash:   []byte{110, 103, 29, 250, 27, 211, 235, 119, 112, 65, 49, 156, 6, 92, 66, 105, 133, 1, 187, 172, 169, 13, 186, 34, 105, 72, 252, 131, 12, 159, 91, 188, 79, 184, 240, 227, 40, 164, 72, 193, 65, 31, 227, 153, 191, 6, 117, 42, 82, 122, 33, 255, 92, 215, 215, 249, 2, 131, 170, 134, 39, 192, 222, 33},
+			expectedHash:   []byte{100, 22, 249, 78, 47, 163, 220, 231, 228, 165, 226, 192, 221, 77, 106, 69, 115, 104, 208, 155, 124, 206, 225, 233, 98, 249, 232, 225, 114, 119, 110, 216, 117, 106, 85, 7, 200, 206, 139, 81, 116, 37, 215, 158, 89, 110, 74, 86, 66, 95, 117, 237, 70, 56, 62, 175, 48, 147, 162, 122, 253, 57, 123, 84},
 		},
 	}
 
@@ -275,6 +275,7 @@ func TestVerify(t *testing.T) {
 		// fail, otherwise Verify should still succeed.
 		modifyByte    int64
 		modifyName    bool
+		modifySize    bool
 		modifyMode    bool
 		modifyUID     bool
 		modifyGID     bool
@@ -323,6 +324,15 @@ func TestVerify(t *testing.T) {
 			modifyName:    true,
 			shouldSucceed: false,
 		},
+		// Modified size should fail verification.
+		{
+			dataSize:      usermem.PageSize,
+			verifyStart:   0,
+			verifySize:    0,
+			modifyByte:    0,
+			modifySize:    true,
+			shouldSucceed: false,
+		},
 		// Modified mode should fail verification.
 		{
 			dataSize:      usermem.PageSize,
@@ -482,6 +492,9 @@ func TestVerify(t *testing.T) {
 					if tc.modifyName {
 						verifyParams.Name = defaultName + "abc"
 					}
+					if tc.modifySize {
+						verifyParams.Size--
+					}
 					if tc.modifyMode {
 						verifyParams.Mode = defaultMode + 1
 					}