From bc91ae17f682d2a0a6062101707e2707f965a9b2 Mon Sep 17 00:00:00 2001
From: Chong Cai <chongc@google.com>
Date: Tue, 27 Oct 2020 19:10:32 -0700
Subject: Add SHA512 to merkle tree library

PiperOrigin-RevId: 339377254
---
 pkg/sentry/fsimpl/verity/filesystem.go | 38 +++++++++++++++++++---------------
 pkg/sentry/fsimpl/verity/verity.go     | 20 +++++++++++-------
 2 files changed, 33 insertions(+), 25 deletions(-)

(limited to 'pkg/sentry')

diff --git a/pkg/sentry/fsimpl/verity/filesystem.go b/pkg/sentry/fsimpl/verity/filesystem.go
index 81dfed266..2f6050cfd 100644
--- a/pkg/sentry/fsimpl/verity/filesystem.go
+++ b/pkg/sentry/fsimpl/verity/filesystem.go
@@ -267,16 +267,18 @@ func (fs *filesystem) verifyChild(ctx context.Context, parent *dentry, child *de
 	// Verify returns with success.
 	var buf bytes.Buffer
 	if _, err := merkletree.Verify(&merkletree.VerifyParams{
-		Out:                   &buf,
-		File:                  &fdReader,
-		Tree:                  &fdReader,
-		Size:                  int64(parentSize),
-		Name:                  parent.name,
-		Mode:                  uint32(parentStat.Mode),
-		UID:                   parentStat.UID,
-		GID:                   parentStat.GID,
+		Out:  &buf,
+		File: &fdReader,
+		Tree: &fdReader,
+		Size: int64(parentSize),
+		Name: parent.name,
+		Mode: uint32(parentStat.Mode),
+		UID:  parentStat.UID,
+		GID:  parentStat.GID,
+		//TODO(b/156980949): Support passing other hash algorithms.
+		HashAlgorithms:        linux.FS_VERITY_HASH_ALG_SHA256,
 		ReadOffset:            int64(offset),
-		ReadSize:              int64(merkletree.DigestSize()),
+		ReadSize:              int64(merkletree.DigestSize(linux.FS_VERITY_HASH_ALG_SHA256)),
 		Expected:              parent.hash,
 		DataAndTreeInSameFile: true,
 	}); err != nil && err != io.EOF {
@@ -342,14 +344,16 @@ func (fs *filesystem) verifyStat(ctx context.Context, d *dentry, stat linux.Stat
 
 	var buf bytes.Buffer
 	params := &merkletree.VerifyParams{
-		Out:        &buf,
-		Tree:       &fdReader,
-		Size:       int64(size),
-		Name:       d.name,
-		Mode:       uint32(stat.Mode),
-		UID:        stat.UID,
-		GID:        stat.GID,
-		ReadOffset: 0,
+		Out:  &buf,
+		Tree: &fdReader,
+		Size: int64(size),
+		Name: d.name,
+		Mode: uint32(stat.Mode),
+		UID:  stat.UID,
+		GID:  stat.GID,
+		//TODO(b/156980949): Support passing other hash algorithms.
+		HashAlgorithms: linux.FS_VERITY_HASH_ALG_SHA256,
+		ReadOffset:     0,
 		// Set read size to 0 so only the metadata is verified.
 		ReadSize:              0,
 		Expected:              d.hash,
diff --git a/pkg/sentry/fsimpl/verity/verity.go b/pkg/sentry/fsimpl/verity/verity.go
index e2cbb206f..92ca6ca6b 100644
--- a/pkg/sentry/fsimpl/verity/verity.go
+++ b/pkg/sentry/fsimpl/verity/verity.go
@@ -600,6 +600,8 @@ func (fd *fileDescription) generateMerkle(ctx context.Context) ([]byte, uint64,
 	params := &merkletree.GenerateParams{
 		TreeReader: &merkleReader,
 		TreeWriter: &merkleWriter,
+		//TODO(b/156980949): Support passing other hash algorithms.
+		HashAlgorithms: linux.FS_VERITY_HASH_ALG_SHA256,
 	}
 
 	switch atomic.LoadUint32(&fd.d.mode) & linux.S_IFMT {
@@ -836,14 +838,16 @@ func (fd *fileDescription) PRead(ctx context.Context, dst usermem.IOSequence, of
 	}
 
 	n, err := merkletree.Verify(&merkletree.VerifyParams{
-		Out:                   dst.Writer(ctx),
-		File:                  &dataReader,
-		Tree:                  &merkleReader,
-		Size:                  int64(size),
-		Name:                  fd.d.name,
-		Mode:                  fd.d.mode,
-		UID:                   fd.d.uid,
-		GID:                   fd.d.gid,
+		Out:  dst.Writer(ctx),
+		File: &dataReader,
+		Tree: &merkleReader,
+		Size: int64(size),
+		Name: fd.d.name,
+		Mode: fd.d.mode,
+		UID:  fd.d.uid,
+		GID:  fd.d.gid,
+		//TODO(b/156980949): Support passing other hash algorithms.
+		HashAlgorithms:        linux.FS_VERITY_HASH_ALG_SHA256,
 		ReadOffset:            offset,
 		ReadSize:              dst.NumBytes(),
 		Expected:              fd.d.hash,
-- 
cgit v1.2.3