authfs: create a chunked reader with fs-verity verification
The new chunked reader uses a Merkle tree to verify each chunk read of
the corresponding backing file. The reader also accepts an
autheneticator for signature verification, though it is currently a fake
implementation due to the lack of PKCS#7 signature support in BoringSSL
(b/170494765).
Test: atest authfs_host_test_src_lib
Bug: 171310075
Change-Id: Ibf4151ab2a93f7515ad8c9c0462df6c21c10d767
diff --git a/authfs/src/auth.rs b/authfs/src/auth.rs
new file mode 100644
index 0000000..71ad858
--- /dev/null
+++ b/authfs/src/auth.rs
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use std::io;
+
+// TODO(b/170494765): Implement an authenticator to verify a PKCS#7 signature. We only need to
+// verify the signature, not the full certificate chain.
+
+pub trait Authenticator {
+ fn verify(&self, signature: &[u8], signed_data: &[u8]) -> io::Result<bool>;
+}
+
+pub struct FakeAuthenticator {
+ should_allow: bool,
+}
+
+#[allow(dead_code)]
+impl FakeAuthenticator {
+ pub fn always_succeed() -> Self {
+ FakeAuthenticator { should_allow: true }
+ }
+
+ pub fn always_fail() -> Self {
+ FakeAuthenticator { should_allow: false }
+ }
+}
+
+impl Authenticator for FakeAuthenticator {
+ fn verify(&self, _signature_pem: &[u8], _signed_data: &[u8]) -> io::Result<bool> {
+ Ok(self.should_allow)
+ }
+}