From 9e496ff6f1b9eec05c5901ab9d072def67d11cdc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= Date: Mon, 3 Aug 2020 14:10:44 +0200 Subject: [PATCH] sync: verify chunk size and digest, if possible MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit for encrypted chunks this is currently not possible, as we need the key to decode the chunk. Signed-off-by: Fabian Grünbichler --- src/client/pull.rs | 10 ++++++---- src/client/remote_chunk_reader.rs | 4 ++-- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/src/client/pull.rs b/src/client/pull.rs index fc193a8d..629e8266 100644 --- a/src/client/pull.rs +++ b/src/client/pull.rs @@ -27,16 +27,18 @@ async fn pull_index_chunks( for pos in 0..index.index_count() { - let digest = index.index_digest(pos).unwrap(); - let chunk_exists = target.cond_touch_chunk(digest, false)?; + let info = index.chunk_info(pos).unwrap(); + let chunk_exists = target.cond_touch_chunk(&info.digest, false)?; if chunk_exists { //worker.log(format!("chunk {} exists {}", pos, proxmox::tools::digest_to_hex(digest))); continue; } //worker.log(format!("sync {} chunk {}", pos, proxmox::tools::digest_to_hex(digest))); - let chunk = chunk_reader.read_raw_chunk(&digest).await?; + let chunk = chunk_reader.read_raw_chunk(&info.digest).await?; - target.insert_chunk(&chunk, &digest)?; + chunk.verify_unencrypted(info.size() as usize, &info.digest)?; + + target.insert_chunk(&chunk, &info.digest)?; } Ok(()) diff --git a/src/client/remote_chunk_reader.rs b/src/client/remote_chunk_reader.rs index 4db11477..b30d0567 100644 --- a/src/client/remote_chunk_reader.rs +++ b/src/client/remote_chunk_reader.rs @@ -35,6 +35,8 @@ impl RemoteChunkReader { } } + /// Downloads raw chunk. This only verifies the (untrusted) CRC32, use + /// DataBlob::verify_unencrypted or DataBlob::decode before storing/processing further. pub async fn read_raw_chunk(&self, digest: &[u8; 32]) -> Result { let mut chunk_data = Vec::with_capacity(4 * 1024 * 1024); @@ -43,8 +45,6 @@ impl RemoteChunkReader { .await?; let chunk = DataBlob::load_from_reader(&mut &chunk_data[..])?; - - // fixme: verify digest? Ok(chunk) }