src/backup/crypt_config.rs: remove encode_chunk, use encrypt_to instead

This commit is contained in:
Dietmar Maurer 2019-06-22 13:02:53 +02:00
parent ee8a7e8080
commit 0066c6d972
3 changed files with 63 additions and 70 deletions

View File

@ -106,61 +106,6 @@ impl CryptConfig {
Ok((iv, tag)) Ok((iv, tag))
} }
/// Compress and encrypt data using a random 16 byte IV.
///
/// Return the encrypted data, including IV and MAC (MAGIC || IV || MAC || ENC_DATA).
/// If compression does not help, we return the uncompresssed, encrypted data.
pub fn encode_chunk(
&self,
// The data you want to encode
data: &[u8],
// Whether try to compress data before encryption
compress: bool,
// Magic number used for uncompressed results
uncomp_magic: &[u8; 8],
// Magic number used for compressed results
comp_magic: &[u8; 8],
) -> Result<Vec<u8>, Error> {
let iv = proxmox::sys::linux::random_data(16)?;
let mut c = Crypter::new(self.cipher, Mode::Encrypt, &self.enc_key, Some(&iv))?;
c.aad_update(b"")?; //??
if compress {
let compr_data = zstd::block::compress(data, 1)?;
// Note: We only use compression if result is shorter
if compr_data.len() < data.len() {
let mut enc = vec![0; compr_data.len()+44+self.cipher.block_size()];
enc[0..8].copy_from_slice(comp_magic);
enc[8..12].copy_from_slice(&[0u8; 4]);
enc[12..28].copy_from_slice(&iv);
let count = c.update(&compr_data, &mut enc[44..])?;
let rest = c.finalize(&mut enc[(44+count)..])?;
enc.truncate(44 + count + rest);
c.get_tag(&mut enc[28..44])?;
return Ok(enc)
}
}
let mut enc = vec![0; data.len()+44+self.cipher.block_size()];
enc[0..8].copy_from_slice(uncomp_magic);
enc[8..12].copy_from_slice(&[0u8; 4]);
enc[12..28].copy_from_slice(&iv);
let count = c.update(data, &mut enc[44..])?;
let rest = c.finalize(&mut enc[(44+count)..])?;
enc.truncate(44 + count + rest);
c.get_tag(&mut enc[28..44])?;
Ok(enc)
}
/// Decompress and decrypt chunk, verify MAC. /// Decompress and decrypt chunk, verify MAC.
/// ///
/// Binrary ``data`` is expected to be in format returned by encode_chunk. The magic number /// Binrary ``data`` is expected to be in format returned by encode_chunk. The magic number

View File

@ -77,13 +77,38 @@ impl DataBlob {
if let Some(config) = config { if let Some(config) = config {
let enc_data = config.encode_chunk( let compr_data;
data, let (_compress, data, magic) = if compress {
compress, compr_data = zstd::block::compress(data, 1)?;
&ENCRYPTED_BLOB_MAGIC_1_0, // Note: We only use compression if result is shorter
&ENCR_COMPR_BLOB_MAGIC_1_0, if compr_data.len() < data.len() {
)?; (true, &compr_data[..], ENCR_COMPR_BLOB_MAGIC_1_0)
return Ok(DataBlob { raw_data: enc_data }); } else {
(false, data, ENCRYPTED_BLOB_MAGIC_1_0)
}
} else {
(false, data, ENCRYPTED_BLOB_MAGIC_1_0)
};
let header_len = std::mem::size_of::<EncryptedDataBlobHeader>();
let mut raw_data = Vec::with_capacity(data.len() + header_len);
let dummy_head = EncryptedDataBlobHeader {
head: DataBlobHeader { magic: [0u8; 8], crc: [0; 4] },
iv: [0u8; 16],
tag: [0u8; 16],
};
raw_data.write_value(&dummy_head)?;
let (iv, tag) = config.encrypt_to(data, &mut raw_data)?;
let head = EncryptedDataBlobHeader {
head: DataBlobHeader { magic, crc: [0; 4] }, iv, tag,
};
(&mut raw_data[0..header_len]).write_value(&head)?;
return Ok(DataBlob { raw_data });
} else { } else {
let max_data_len = data.len() + std::mem::size_of::<DataBlobHeader>(); let max_data_len = data.len() + std::mem::size_of::<DataBlobHeader>();

View File

@ -84,15 +84,38 @@ impl DataChunk {
if let Some(config) = config { if let Some(config) = config {
let enc_data = config.encode_chunk( let compr_data;
data, let (_compress, data, magic) = if compress {
compress, compr_data = zstd::block::compress(data, 1)?;
&ENCRYPTED_CHUNK_MAGIC_1_0, // Note: We only use compression if result is shorter
&ENCR_COMPR_CHUNK_MAGIC_1_0, if compr_data.len() < data.len() {
)?; (true, &compr_data[..], ENCR_COMPR_CHUNK_MAGIC_1_0)
let chunk = DataChunk { digest, raw_data: enc_data }; } else {
(false, data, ENCRYPTED_CHUNK_MAGIC_1_0)
}
} else {
(false, data, ENCRYPTED_CHUNK_MAGIC_1_0)
};
Ok(chunk) let header_len = std::mem::size_of::<EncryptedDataChunkHeader>();
let mut raw_data = Vec::with_capacity(data.len() + header_len);
let dummy_head = EncryptedDataChunkHeader {
head: DataChunkHeader { magic: [0u8; 8], crc: [0; 4] },
iv: [0u8; 16],
tag: [0u8; 16],
};
raw_data.write_value(&dummy_head)?;
let (iv, tag) = config.encrypt_to(data, &mut raw_data)?;
let head = EncryptedDataChunkHeader {
head: DataChunkHeader { magic, crc: [0; 4] }, iv, tag,
};
(&mut raw_data[0..header_len]).write_value(&head)?;
return Ok(DataChunk { digest, raw_data });
} else { } else {
let max_data_len = data.len() + std::mem::size_of::<DataChunkHeader>(); let max_data_len = data.len() + std::mem::size_of::<DataChunkHeader>();