fix(format-v3): harden system binding against replay and bypass attacks (F-01, F-02, F-03)
- F-02: Require restore_nonce token and explicit confirmation (--rebuild-mac) for PendingRebuild - F-01: Extend canonical MAC transcript to include chunk generation tuples (node_id, chunk_index, generation) and support transparent legacy migration - F-03: Make V2-to-V3 container upgrade atomic with transactional rollback and dual-slot version update - Bump version to 0.9.4 and update changelog and security docs
This commit is contained in:
@@ -5,6 +5,28 @@ Alle nennenswerten Änderungen an diesem Projekt werden in dieser Datei dokument
|
||||
Das Format basiert auf [Keep a Changelog](https://keepachangelog.com/de/1.1.0/)
|
||||
und dieses Projekt folgt den Richtlinien von [Semantic Versioning](https://semver.org/lang/de/).
|
||||
|
||||
## [0.9.4] - 2026-09-22
|
||||
|
||||
### Format-V3 Systembindung & Integritäts-Härtung (F-01, F-02, F-03)
|
||||
Dieses Patch-Release schließt kritische Bindungs- und Replay-Schwächen im Format-V3-Kryptosystem. Es behebt den PendingRebuild-Bypass bei Header-Wiederherstellungen (F-02), integriert Chunk-Generationen in das kanonische Metadaten-MAC-Transcript zur Abwehr von Content-Replay-Angriffen gleicher Dateigröße (F-01) und stellt die vollständige Transaktions-Atomarität des Format-Upgrades auf V3 sicher (F-03).
|
||||
|
||||
#### Sicherheits-Fixes
|
||||
- **F-02 (HOCH): Schließung des PendingRebuild-Bypasses bei manipuliertem Header**:
|
||||
- *Problem / Bypass in v0.9.2 und v0.9.3*: Die Prüfung `metadata_gen == 0 && metadata_mac IS NULL -> PendingRebuild` erlaubte einem Angreifer mit Schreibzugriff auf die Containerdatei, `meta` auf `NULL` zu setzen und Decoy-Dateien umzubenennen/zu verschieben. Der nächste legitime `sanctum mount` signierte die Manipulation stillschweigend.
|
||||
- *Fix*: Header-Wiederherstellungen via `restore_header_backup` erzeugen nun ein 32-Byte CSPRNG-Token `restore_nonce` in `meta`. `PendingRebuild` wird ausschließlich akzeptiert, wenn dieses Token vorhanden und `metadata_gen == 0` ist.
|
||||
- *Autorisierungszwang*: `sanctum mount` erfordert nach einem Restore zwingend das neue Flag `--rebuild-mac` oder eine explizite interaktive Eingabe von `JA` mit lauter Sicherheitswarnung. `-y` allein autorisiert keinen Rebuild. `NULL`-MAC ohne Restore-Token wird strikt als `Invalid` abgewiesen (`bail!`). Nach erfolgreichem Rebuild wird `restore_nonce` gelöscht.
|
||||
- **F-01 (HOCH): Chunk-Generation-Replay im Transcript & Transkript-Bindung**:
|
||||
- *Problem*: K-02 band die `generation` lediglich in die AAD der gleichen Zeile ein. Ein Angreifer konnte eine Datei gleicher Größe überschreiben und anschließend eine alte Chunk-Zeile (ct, nonce, tag, generation) zurückkopieren. Da das K-01 Transcript bisher nur `chunk_count` umfasste, blieb der Metadaten-MAC gültig und die AEAD-Entschlüsselung lieferte unbemerkt veralteten Klartext. K-02 ohne Transcript-Bindung war kein vollständiger Speicher-Replay-Schutz.
|
||||
- *Fix*: Das kanonische Transcript pro Vault wurde um sortierte Chunk-Tupel erweitert:
|
||||
`ORDER BY node_id, chunk_index: node_id LE64 ‖ chunk_index LE32 ‖ generation LE64` (kein Ciphertext im MAC).
|
||||
Jede Schreiboperation (`write_chunk_and_update_size`, Truncate, Delete) bindet die neuen Generationen in den Metadaten-MAC ein.
|
||||
- *Migration bestehender V3-Container (§7)*: Ältere v0.9.2/v0.9.3-Container werden gegen das bisherige Knoten-Transcript geprüft. Ist der alte MAC valide (`LegacyValid`), wird das Transcript beim ersten Mounten transparent auf das neue Format mit Chunk-Generationen aktualisiert. Bei ungültigem MAC bricht Sanctum fail-closed ab.
|
||||
- *Test-Präzisierung*: Der bestehende AAD-Test in `src/crypto.rs` wurde in `test_k02_chunk_generation_aead_binding` umbenannt, um klarzustellen, dass er nur die AEAD-Bindung im Header und nicht den Replay-Schutz gegen Zeilen-Ersetzung nachweist. Ein neuer End-to-End-Test verifiziert den Replay-Schutz gegen Zeilen-Ersetzung.
|
||||
- **F-03 (HOCH): upgrade_to_v3 Transaktions-Atomarität & Dual-Slot-Konsistenz**:
|
||||
- *Problem*: `upgrade_to_v3` übersprang fehlerhafte Chunks mit `if let Ok(...)` stumm, aktualisierte nur Slot 0 auf `version = 3`, ließ Slot 1 auf Version 2 zurück und meldete fälschlich Erfolg. Bei Hidden-Mounts führte die inkonsistente Slot-Version zu AAD-Fehlern.
|
||||
- *Fix*: Das gesamte Format-Upgrade läuft nun in einer einzigen atomaren SQLite-Transaktion. Fehler bei `decrypt_chunk` oder `encrypt_chunk` brechen sofort via `?` ab und rollen die Transaktion vollständig zurück (`version` bleibt 2, keine halben V3-Zeilen). Chunks, die nicht mit DEK_0 entschlüsseln, brechen fail-closed ab (bei Legacy-Hidden wird das zweite Passwort verlangt).
|
||||
- *Synchrone Versionierung*: Nach erfolgreichem Durchlauf wird `version = 3` synchron für Slot 0 und Slot 1 (sowie Dummy-Slots) gesetzt. Slot 0 Metadaten-MAC wird aufgebaut; Slot 1 nur, falls echte SQLite-Knoten unter Root 2 existieren. Carrier-Inner bleibt Carrier-AEAD.
|
||||
|
||||
## [0.9.3] - 2026-09-21
|
||||
|
||||
### Sicherheits-Governance, Supply-Chain-Audit & Dokumentationsabgleich
|
||||
|
||||
Generated
+1
-1
@@ -1457,7 +1457,7 @@ checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
|
||||
|
||||
[[package]]
|
||||
name = "sanctum"
|
||||
version = "0.9.3"
|
||||
version = "0.9.4"
|
||||
dependencies = [
|
||||
"aes-gcm",
|
||||
"anyhow",
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "sanctum"
|
||||
version = "0.9.3"
|
||||
version = "0.9.4"
|
||||
edition = "2021"
|
||||
authors = ["Harald Pansi <harald@pansi.eu>", "Sanctum Engineering Team"]
|
||||
description = "Verschlüsselter Ein-Datei-Container unter Windows im reinen Userland via WebDAV"
|
||||
|
||||
@@ -31,10 +31,10 @@ Sanctum ist eine eigenständige, speichersichere und hochperformante CLI-Anwendu
|
||||
Zufälliger 256-Bit Schlüssel via CSPRNG (`OsRng`). Der DEK wird mit dem KEK via AES-256-GCM verschlüsselt und im Header abgelegt.
|
||||
- **Speichersicherheit (Zeroize & VirtualLock)**:
|
||||
Alle Schlüsselstrukturen implementieren das `Zeroize`-Trait (`Zeroizing<[u8; 32]>`), um sensible Schlüsseldaten beim Verlassen des Gültigkeitsbereichs im RAM sofort sicher zu nullen. Schlüsseldaten werden mittels `VirtualLock` / `mlock` vor Paging geschützt.
|
||||
- **Chunk-Verschlüsselung (AES-256-GCM)**:
|
||||
Dateien werden in Blöcken von 1 MB verschlüsselt.
|
||||
- **Swap-Attack-Schutz**:
|
||||
Als Authenticated Associated Data (AAD) werden `node_id` (8 Bytes LE) und `chunk_index` (8 Bytes LE) an jeden Block gebunden. Ein Vertauschen von Chunks zwischen Dateien oder innerhalb einer Datei führt zum Authentifizierungsfehler.
|
||||
- **Chunk-Verschlüsselung (AES-256-GCM & 24-Byte AAD, K-02)**:
|
||||
Dateien werden in Blöcken von 1 MB verschlüsselt. Als Authenticated Associated Data (AAD) werden `node_id` (8 Bytes LE), `chunk_index` (8 Bytes LE) und `generation` (8 Bytes LE) an jeden Block gebunden. Ein Vertauschen oder Zurücksetzen von Chunks führt zum Authentifizierungsfehler.
|
||||
- **Metadaten-Authentifizierung & Replay-Schutz (HMAC-SHA256, K-01 / F-01)**:
|
||||
Ein kryptografischer HMAC-SHA256 (abgeleitet via HKDF `SANCTUM_META_MAC_V3`) bindet den gesamten Verzeichnisbaum deterministisch an den Datenschlüssel (DEK). Das kanonische Transcript sichert nicht nur Inode-Metadaten (Namen, Pfade, Größen, Zeitstempel), sondern auch die sortierte Sequenz aller Chunk-Generationen (`node_id LE64 ‖ chunk_index LE32 ‖ generation LE64`, F-01). Dies schließt Angriffe aus, bei denen ein Angreifer alte Datenbankzeilen gleicher Dateigröße wiederherstellt (Content-Replay).
|
||||
- **Dual-Vault (Multi-Slot & Carrier)**:
|
||||
Konstante 2-Slot-Architektur. Slot 0 dient als Standard-/Decoy-Vault, Slot 1 als Second Safe (Hidden Vault) oder CSPRNG-Dummy. Dient dem Schutz vor neugierigen Blicken oder beiläufigem Zwang im Alltag. (Hinweis: Die Trägerdatei besitzt hohe Entropie und ist forensisch nachweisbar; kein Anspruch auf juristisch unnachweisbare Abstreitbarkeit gegen behördliche Beschlagnahme).
|
||||
*Carrier-Format V2 mit Paged Manifest*: Das steganografische Dateisystem des Hidden Vaults nutzt eine skalierbare Paged-Manifest-Architektur. Blöcke 0 und 1 speichern den redundanten Superblock (C-02), während Inodes über dedizierte Inode-Pages (~1 MB Nutzdaten je Seite, ca. 4.500–7.000 Inodes pro Seite) dynamisch aus dem Blockpool verwaltet werden. Die Kapazität ist nicht mehr auf 7.000 Dateien limitiert, sondern skaliert dynamisch mit den verfügbaren Trägerblöcken. Robuste Fail-Soft-Resilienz (D-01) isoliert Seitenbeschädigungen, ein In-Memory Sekundärindex (D-02) beschleunigt Pfadoperationen auf O(Geschwister), und Sanctum warnt beim Einbinden automatisch bei Blockknappheit (< 20 freie Blöcke oder < 5% Restkapazität).
|
||||
@@ -160,10 +160,29 @@ sanctum.exe backup --path "C:\Pfad\tresor.sanctum" --output "D:\Backup\tresor_ba
|
||||
# Container aus Backup wiederherstellen:
|
||||
sanctum.exe restore --path "D:\Backup\tresor_backup.sanctum" --output "C:\Pfad\tresor_restored.sanctum"
|
||||
|
||||
# Vollständige Integritätsprüfung (B-Tree, Knoten und AEAD-Tags aller Chunks):
|
||||
# Header in separate Sicherungsdatei (.sanctum.hdr) sichern:
|
||||
sanctum.exe backup-header --path "C:\Pfad\tresor.sanctum" --output "D:\Backup\tresor.hdr"
|
||||
|
||||
# Header aus Sicherungsdatei (.sanctum.hdr) wiederherstellen:
|
||||
sanctum.exe restore-header --path "C:\Pfad\tresor.sanctum" --header "D:\Backup\tresor.hdr"
|
||||
|
||||
# Nach Header-Wiederherstellung: Metadaten-MAC mit autorisierter Neubindung mounten (F-02):
|
||||
sanctum.exe mount --path "C:\Pfad\tresor.sanctum" --rebuild-mac
|
||||
|
||||
# Vollständige Integritätsprüfung (B-Tree, Knoten, Chunk-AEAD und Metadaten-MAC):
|
||||
sanctum.exe verify --path "C:\Pfad\tresor.sanctum"
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> **Sicherheitsgarantie bei Header-Wiederherstellungen (F-02)**: Nach einem `restore-header` setzt Sanctum ein einmaliges 32-Byte CSPRNG-Token (`restore_nonce`). Der nachfolgende `mount` verlangt zwingend `--rebuild-mac` (oder eine interaktive Bestätigung mit `JA`), um den Metadaten-MAC neu aufzubauen und das Token zu löschen. Ein stillschweigendes Signieren manipulierter Metadaten ist ausgeschlossen; `-y` allein autorisiert keinen Rebuild.
|
||||
|
||||
```powershell
|
||||
# Ältere V2-Container auf Format V3 aktualisieren (atomar & transaktional, F-03):
|
||||
sanctum.exe upgrade-format --path "C:\Pfad\tresor.sanctum"
|
||||
```
|
||||
> [!NOTE]
|
||||
> `upgrade-format` führt die Umschlüsselung aller Chunks von 16-Byte- auf 24-Byte-AAD und die Aktualisierung beider Header-Slots auf `version = 3` in einer **einzigen atomaren SQLite-Transaktion** durch. Bei Fehlern greift ein automatischer Rollback ohne inkonsistente Mischzustände.
|
||||
|
||||
---
|
||||
|
||||
### 6. Storage Compaction (Speicherbereinigung)
|
||||
|
||||
+1
-1
@@ -10,7 +10,7 @@ Sicherheitsupdates und Patches werden jeweils für die neueste Version von Sanct
|
||||
|
||||
| Version | Status | Sicherheits-Support |
|
||||
|:---:|:---:|:---:|
|
||||
| **v0.9.x** | **Aktiv (Aktuell: v0.9.2)** | **Vollständig unterstützt** |
|
||||
| **v0.9.x** | **Aktiv (Aktuell: v0.9.4)** | **Vollständig unterstützt** |
|
||||
| <= v0.8.x | Veraltet | Nicht mehr unterstützt (Upgrade empfohlen) |
|
||||
|
||||
---
|
||||
|
||||
+4
-1
@@ -920,8 +920,11 @@ mod tests {
|
||||
.is_err());
|
||||
}
|
||||
|
||||
// F-01: Prüft die kryptografische AEAD-Bindung der Generation im AAD (Fehler bei Generationsabweichung).
|
||||
// Hinweis: Dies beweist die AEAD-Bindung an den AAD-Header, NICHT jedoch den Schutz gegen Zeilen-Ersetzung
|
||||
// im persistenten Speicher (dieser wird durch die Aufnahme der Generationen in das Metadaten-MAC-Transcript in F-01 garantiert).
|
||||
#[test]
|
||||
fn test_k02_chunk_replay_protection_with_generation_aad() {
|
||||
fn test_k02_chunk_generation_aead_binding() {
|
||||
let dek = generate_dek();
|
||||
let plaintext_v1 = b"Original Chunk Data at Generation 1";
|
||||
let plaintext_v2 = b"Overwritten Chunk Data at Generation 2";
|
||||
|
||||
@@ -117,6 +117,10 @@ enum Commands {
|
||||
/// Aktiviert den lautlosen Stealth-Modus (keine Banner, Pfade, URLs oder Fortschrittsausgaben)
|
||||
#[arg(short, long, default_value_t = false)]
|
||||
stealth: bool,
|
||||
|
||||
/// Autorisiert den Neuaufbau des Metadaten-MAC nach einem Header-Restore (F-02)
|
||||
#[arg(long, default_value_t = false)]
|
||||
rebuild_mac: bool,
|
||||
},
|
||||
|
||||
/// Trennt ein eingebundenes Netzlaufwerk manuell
|
||||
@@ -1626,6 +1630,7 @@ async fn run() -> Result<()> {
|
||||
no_anti_leak,
|
||||
anti_leak_list,
|
||||
stealth,
|
||||
rebuild_mac,
|
||||
} => {
|
||||
let drive_char = match drive {
|
||||
Some(ref d) => parse_drive_letter(d)?,
|
||||
@@ -1679,6 +1684,7 @@ async fn run() -> Result<()> {
|
||||
anti_leak,
|
||||
anti_leak_list.as_deref(),
|
||||
stealth,
|
||||
rebuild_mac,
|
||||
)
|
||||
.await?;
|
||||
}
|
||||
|
||||
+41
-4
@@ -1,4 +1,5 @@
|
||||
use std::convert::Infallible;
|
||||
use std::io::IsTerminal;
|
||||
use std::net::SocketAddr;
|
||||
use std::path::Path;
|
||||
#[cfg(unix)]
|
||||
@@ -86,6 +87,7 @@ pub async fn mount_container(
|
||||
anti_leak: bool,
|
||||
anti_leak_list: Option<&Path>,
|
||||
stealth: bool,
|
||||
rebuild_mac: bool,
|
||||
) -> Result<()> {
|
||||
let drive_str = format_drive(drive_letter);
|
||||
let _ = &drive_str;
|
||||
@@ -187,7 +189,7 @@ pub async fn mount_container(
|
||||
// S-06: Advisory Lock setzen, um parallele Mounts und schreibende Sync-Läufe abzuwehren
|
||||
let _advisory_lock = db.acquire_advisory_lock_guard(false)?;
|
||||
|
||||
// K-01 / R-NEW-1: Metadaten-Integrität via HMAC-SHA256 validieren (Format V3)
|
||||
// K-01 / F-01 / F-02: Metadaten-Integrität via HMAC-SHA256 validieren (Format V3)
|
||||
if version >= crate::crypto::FORMAT_VERSION_V3 {
|
||||
match db.verify_metadata_mac_status_for_slot(vault_id, &dek) {
|
||||
Ok(crate::storage::MetadataMacStatus::Valid) => {
|
||||
@@ -197,19 +199,54 @@ pub async fn mount_container(
|
||||
);
|
||||
}
|
||||
}
|
||||
Ok(crate::storage::MetadataMacStatus::PendingRebuild) => {
|
||||
Ok(crate::storage::MetadataMacStatus::LegacyValid) => {
|
||||
if !stealth {
|
||||
println!(
|
||||
" • Metadaten-MAC: ℹ Metadaten-MAC nach Wiederherstellung neu aufgebaut"
|
||||
" • Metadaten-MAC: ℹ Format-V3 Metadaten-MAC auf neues Transcript migriert (F-01)"
|
||||
);
|
||||
}
|
||||
db.set_active_slot_and_dek(vault_id, dek.clone());
|
||||
db.update_metadata_mac()?;
|
||||
db.checkpoint()?;
|
||||
}
|
||||
Ok(crate::storage::MetadataMacStatus::PendingRebuild) => {
|
||||
let authorized = if rebuild_mac {
|
||||
true
|
||||
} else if std::io::stdin().is_terminal() {
|
||||
eprintln!();
|
||||
eprintln!(
|
||||
" [!] WARNUNG: METADATEN WERDEN NEU GEBUNDEN; MAC-HISTORIE ERLISCHT."
|
||||
);
|
||||
eprintln!(" Der Container-Header wurde wiederhergestellt. Die Metadaten-Integrität muss");
|
||||
eprintln!(" neu an den Tresor gebunden werden.");
|
||||
eprintln!(" Starten Sie mit '--rebuild-mac' oder bestätigen Sie die Operation interaktiv mit 'JA'.");
|
||||
eprint!(" Bestätigung ('JA' eingeben): ");
|
||||
let _ = std::io::Write::flush(&mut std::io::stderr());
|
||||
let mut input = String::new();
|
||||
std::io::stdin().read_line(&mut input).is_ok() && input.trim() == "JA"
|
||||
} else {
|
||||
false
|
||||
};
|
||||
|
||||
if !authorized {
|
||||
bail!(
|
||||
"Metadaten-MAC-Rebuild nicht autorisiert. Starten Sie mit '--rebuild-mac' oder tippen Sie 'JA'."
|
||||
);
|
||||
}
|
||||
|
||||
if !stealth {
|
||||
println!(
|
||||
" • Metadaten-MAC: ℹ Metadaten neu gebunden & MAC erfolgreich aufgebaut (F-02)"
|
||||
);
|
||||
}
|
||||
db.set_active_slot_and_dek(vault_id, dek.clone());
|
||||
db.update_metadata_mac()?;
|
||||
db.clear_restore_nonce(vault_id)?;
|
||||
db.checkpoint()?;
|
||||
}
|
||||
Ok(crate::storage::MetadataMacStatus::Invalid) => {
|
||||
bail!(
|
||||
"Metadaten-MAC-Verifikation fehlgeschlagen: Die Container-Metadaten wurden manipuliert oder sind beschädigt (K-01)."
|
||||
"Metadaten-MAC-Verifikation fehlgeschlagen: Die Container-Metadaten wurden manipuliert oder sind beschädigt (K-01 / F-01 / F-02)."
|
||||
);
|
||||
}
|
||||
Err(e) => {
|
||||
|
||||
+6
-1
@@ -3,6 +3,8 @@ use std::path::Path;
|
||||
use std::time::{SystemTime, UNIX_EPOCH};
|
||||
|
||||
use anyhow::{bail, Context, Result};
|
||||
use rand::rngs::OsRng;
|
||||
use rand::RngCore;
|
||||
use serde::{Deserialize, Serialize};
|
||||
|
||||
use crate::crypto::{
|
||||
@@ -276,7 +278,10 @@ pub fn restore_header_backup(container_path: &Path, backup_path: &Path) -> Resul
|
||||
|
||||
let db = Database::open(container_path).context("Konnte Ziel-Containerdatei nicht öffnen")?;
|
||||
|
||||
db.restore_meta(&meta)
|
||||
let mut restore_nonce = [0u8; 32];
|
||||
OsRng.fill_bytes(&mut restore_nonce);
|
||||
|
||||
db.restore_meta_with_nonce(&meta, Some(&restore_nonce))
|
||||
.context("Fehler beim Wiederherstellen der Header-Tabelle in der Datenbank")?;
|
||||
|
||||
db.checkpoint()
|
||||
|
||||
+208
-41
@@ -208,15 +208,18 @@ fn current_timestamp() -> u64 {
|
||||
.unwrap_or(0)
|
||||
}
|
||||
|
||||
/// Status der Metadaten-MAC-Integritätsprüfung (K-01 / R-NEW-1).
|
||||
/// Status der Metadaten-MAC-Integritätsprüfung (K-01 / F-01 / F-02).
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum MetadataMacStatus {
|
||||
/// Metadaten-MAC ist vorhanden und stimmt mit den kanonischen Metadaten überein.
|
||||
/// Metadaten-MAC ist vorhanden und stimmt mit den kanonischen Metadaten inklusive Chunk-Generationen überein (F-01).
|
||||
Valid,
|
||||
/// Container-Header wurde frisch aus einem Backup restauriert (metadata_gen == 0 && metadata_mac IS NULL).
|
||||
/// Der MAC muss beim Mounten transparent mit dem aktiven DEK neu aufgebaut werden.
|
||||
/// Metadaten-MAC stimmt mit dem älteren V3-Transcript (nur Knoten-Metadaten, ohne Chunk-Generationen) überein.
|
||||
/// Wird beim Mounten transparent auf das neue V3.1-Transcript gebunden (F-01 Migration).
|
||||
LegacyValid,
|
||||
/// Container-Header wurde aus einem Backup restauriert (restore_nonce vorhanden und metadata_gen == 0 && metadata_mac IS NULL).
|
||||
/// Der MAC muss beim Mounten mit --rebuild-mac (oder interaktivem 'JA') neu aufgebaut werden (F-02).
|
||||
PendingRebuild,
|
||||
/// Metadaten-MAC fehlt (bei gen > 0) oder stimmt nicht mit den berechneten Daten überein (Manipulationsverdacht).
|
||||
/// Metadaten-MAC fehlt (ohne gültigen restore_nonce) oder stimmt nicht mit den berechneten Daten überein (Manipulationsverdacht).
|
||||
Invalid,
|
||||
}
|
||||
|
||||
@@ -480,6 +483,9 @@ impl Database {
|
||||
let _ = conn.execute("ALTER TABLE meta ADD COLUMN lock_host TEXT", []);
|
||||
let _ = conn.execute("ALTER TABLE meta ADD COLUMN lock_time INTEGER", []);
|
||||
|
||||
// Spalte restore_nonce in meta (Format V3 / F-02)
|
||||
let _ = conn.execute("ALTER TABLE meta ADD COLUMN restore_nonce BLOB", []);
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
@@ -646,6 +652,7 @@ impl Database {
|
||||
header_tag BLOB NOT NULL,
|
||||
metadata_mac BLOB,
|
||||
metadata_gen INTEGER NOT NULL DEFAULT 0,
|
||||
restore_nonce BLOB,
|
||||
lock_pid INTEGER,
|
||||
lock_host TEXT,
|
||||
lock_time INTEGER
|
||||
@@ -959,6 +966,7 @@ impl Database {
|
||||
header_tag BLOB NOT NULL,
|
||||
metadata_mac BLOB,
|
||||
metadata_gen INTEGER NOT NULL DEFAULT 0,
|
||||
restore_nonce BLOB,
|
||||
lock_pid INTEGER,
|
||||
lock_host TEXT,
|
||||
lock_time INTEGER
|
||||
@@ -2192,8 +2200,61 @@ impl Database {
|
||||
self.canonical_nodes_bytes_for_vault(0)
|
||||
}
|
||||
|
||||
/// Erzeugt die deterministische kanonische Byterepräsentation für einen spezifischen Vault.
|
||||
/// Erzeugt die deterministische kanonische Byterepräsentation für einen spezifischen Vault
|
||||
/// inklusive sortierter Chunk-Generationen (Format V3.1 / F-01).
|
||||
pub fn canonical_nodes_bytes_for_vault(&self, vault_id: u32) -> Result<Vec<u8>> {
|
||||
let mut buf = self.canonical_nodes_bytes_for_vault_legacy(vault_id)?;
|
||||
let conn = self.conn();
|
||||
|
||||
if vault_id == 1 {
|
||||
let mut stmt = conn.prepare(
|
||||
"WITH RECURSIVE vault1(id) AS (
|
||||
SELECT 2
|
||||
UNION ALL
|
||||
SELECT n.id FROM nodes n JOIN vault1 v ON n.parent_id = v.id
|
||||
)
|
||||
SELECT c.node_id, c.chunk_index, c.generation
|
||||
FROM chunks c
|
||||
WHERE c.node_id IN (SELECT id FROM vault1)
|
||||
ORDER BY c.node_id ASC, c.chunk_index ASC",
|
||||
)?;
|
||||
let mut rows = stmt.query([])?;
|
||||
while let Some(row) = rows.next()? {
|
||||
let node_id: i64 = row.get(0)?;
|
||||
let chunk_index: u32 = row.get(1)?;
|
||||
let generation: u64 = row.get(2)?;
|
||||
buf.extend_from_slice(&node_id.to_le_bytes());
|
||||
buf.extend_from_slice(&chunk_index.to_le_bytes());
|
||||
buf.extend_from_slice(&generation.to_le_bytes());
|
||||
}
|
||||
} else {
|
||||
let mut stmt = conn.prepare(
|
||||
"WITH RECURSIVE vault0(id) AS (
|
||||
SELECT 1
|
||||
UNION ALL
|
||||
SELECT n.id FROM nodes n JOIN vault0 v ON n.parent_id = v.id
|
||||
)
|
||||
SELECT c.node_id, c.chunk_index, c.generation
|
||||
FROM chunks c
|
||||
WHERE c.node_id = 2 OR c.node_id IN (SELECT id FROM vault0)
|
||||
ORDER BY c.node_id ASC, c.chunk_index ASC",
|
||||
)?;
|
||||
let mut rows = stmt.query([])?;
|
||||
while let Some(row) = rows.next()? {
|
||||
let node_id: i64 = row.get(0)?;
|
||||
let chunk_index: u32 = row.get(1)?;
|
||||
let generation: u64 = row.get(2)?;
|
||||
buf.extend_from_slice(&node_id.to_le_bytes());
|
||||
buf.extend_from_slice(&chunk_index.to_le_bytes());
|
||||
buf.extend_from_slice(&generation.to_le_bytes());
|
||||
}
|
||||
}
|
||||
|
||||
Ok(buf)
|
||||
}
|
||||
|
||||
/// Erzeugt die Legacy-Byterepräsentation ohne Chunk-Generationen (zur Migration bestehender V3-Container, F-01).
|
||||
pub fn canonical_nodes_bytes_for_vault_legacy(&self, vault_id: u32) -> Result<Vec<u8>> {
|
||||
let conn = self.conn();
|
||||
let mut buf = Vec::new();
|
||||
|
||||
@@ -2271,7 +2332,7 @@ impl Database {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Aktualisiert den Metadaten-MAC des aktiven Slots bei strukturellen Modifikationen (Format V3 / K-01).
|
||||
/// Aktualisiert den Metadaten-MAC des aktiven Slots bei strukturellen Modifikationen (Format V3 / K-01 & F-01).
|
||||
pub fn update_metadata_mac(&self) -> Result<()> {
|
||||
let session_opt = self
|
||||
.active_session
|
||||
@@ -2328,25 +2389,26 @@ impl Database {
|
||||
|
||||
/// Prüft die Integrität des Metadaten-MAC für einen spezifischen Slot (0: Decoy, 1: Hidden).
|
||||
pub fn verify_metadata_mac_for_slot(&self, slot_id: u32, dek: &[u8; 32]) -> Result<bool> {
|
||||
Ok(self.verify_metadata_mac_status_for_slot(slot_id, dek)? == MetadataMacStatus::Valid)
|
||||
let status = self.verify_metadata_mac_status_for_slot(slot_id, dek)?;
|
||||
Ok(status == MetadataMacStatus::Valid || status == MetadataMacStatus::LegacyValid)
|
||||
}
|
||||
|
||||
/// Prüft den detaillierten Integritätsstatus des Metadaten-MAC für einen spezifischen Slot (R-NEW-1).
|
||||
/// Prüft den detaillierten Integritätsstatus des Metadaten-MAC für einen spezifischen Slot (F-01 / F-02).
|
||||
pub fn verify_metadata_mac_status_for_slot(
|
||||
&self,
|
||||
slot_id: u32,
|
||||
dek: &[u8; 32],
|
||||
) -> Result<MetadataMacStatus> {
|
||||
let conn = self.conn();
|
||||
let meta_row: Option<(u32, Option<Vec<u8>>, u64)> = conn
|
||||
let meta_row: Option<(u32, Option<Vec<u8>>, u64, Option<Vec<u8>>)> = conn
|
||||
.query_row(
|
||||
"SELECT version, metadata_mac, metadata_gen FROM meta WHERE slot_id = ?1 LIMIT 1",
|
||||
"SELECT version, metadata_mac, metadata_gen, restore_nonce FROM meta WHERE slot_id = ?1 LIMIT 1",
|
||||
params![slot_id],
|
||||
|r| Ok((r.get(0)?, r.get(1).ok(), r.get(2).unwrap_or(0))),
|
||||
|r| Ok((r.get(0)?, r.get(1).ok(), r.get(2).unwrap_or(0), r.get(3).ok())),
|
||||
)
|
||||
.optional()?;
|
||||
|
||||
let Some((version, mac_opt, gen)) = meta_row else {
|
||||
let Some((version, mac_opt, gen, restore_nonce)) = meta_row else {
|
||||
return Ok(MetadataMacStatus::Invalid);
|
||||
};
|
||||
|
||||
@@ -2354,10 +2416,17 @@ impl Database {
|
||||
return Ok(MetadataMacStatus::Valid);
|
||||
}
|
||||
|
||||
// R-NEW-1: Frisch restaurierter Container (gen == 0 && mac_opt IS NULL)
|
||||
if gen == 0 && mac_opt.is_none() {
|
||||
// F-02: Wenn metadata_mac fehlt (NULL):
|
||||
// NUR wenn restore_nonce vorhanden ist (32 Bytes) UND gen == 0,
|
||||
// ist der Status PendingRebuild. Andernfalls strikt Invalid (Fail-Closed, K-01 / F-02).
|
||||
if mac_opt.is_none() {
|
||||
if let Some(ref nonce) = restore_nonce {
|
||||
if nonce.len() == 32 && gen == 0 {
|
||||
return Ok(MetadataMacStatus::PendingRebuild);
|
||||
}
|
||||
}
|
||||
return Ok(MetadataMacStatus::Invalid);
|
||||
}
|
||||
|
||||
let Some(mac_bytes) = mac_opt else {
|
||||
return Ok(MetadataMacStatus::Invalid);
|
||||
@@ -2371,18 +2440,33 @@ impl Database {
|
||||
expected_mac.copy_from_slice(&mac_bytes);
|
||||
drop(conn);
|
||||
|
||||
let canonical = self.canonical_nodes_bytes_for_vault(slot_id)?;
|
||||
let mac_key = derive_metadata_mac_key(dek);
|
||||
|
||||
// F-01: 1. Neues kanonisches Transcript prüfen (inklusive Chunk-Generationen)
|
||||
let canonical = self.canonical_nodes_bytes_for_vault(slot_id)?;
|
||||
if verify_metadata_mac(&mac_key, gen, &canonical, &expected_mac) {
|
||||
Ok(MetadataMacStatus::Valid)
|
||||
} else {
|
||||
Ok(MetadataMacStatus::Invalid)
|
||||
}
|
||||
return Ok(MetadataMacStatus::Valid);
|
||||
}
|
||||
|
||||
/// Führt ein Upgrade des Containerformats auf Format V3 durch (Format V3 / K-01 & K-02).
|
||||
// F-01 / §7: 2. Altes Transcript prüfen (nur Knoten, ohne Chunk-Generationen) für sichere Migration
|
||||
let canonical_legacy = self.canonical_nodes_bytes_for_vault_legacy(slot_id)?;
|
||||
if verify_metadata_mac(&mac_key, gen, &canonical_legacy, &expected_mac) {
|
||||
return Ok(MetadataMacStatus::LegacyValid);
|
||||
}
|
||||
|
||||
Ok(MetadataMacStatus::Invalid)
|
||||
}
|
||||
|
||||
/// Führt ein Upgrade des Containerformats auf Format V3 durch (Format V3 / K-01, K-02 & F-03).
|
||||
pub fn upgrade_to_v3(&self, dek: &[u8; 32]) -> Result<()> {
|
||||
let conn = self.conn();
|
||||
self.upgrade_to_v3_ext(dek, None)
|
||||
}
|
||||
|
||||
/// Führt ein transaktionales Upgrade des Containerformats auf Format V3 durch (F-03).
|
||||
/// Läuft in einer einzigen atomaren SQLite-Transaktion. Bei jeglichem Chunk-Fehler
|
||||
/// wird ein Rollback durchgeführt und der Fehler fail-closed propagiert.
|
||||
pub fn upgrade_to_v3_ext(&self, dek_0: &[u8; 32], dek_1: Option<&[u8; 32]>) -> Result<()> {
|
||||
let mut conn = self.conn();
|
||||
let version: u32 = conn.query_row(
|
||||
"SELECT version FROM meta WHERE slot_id = 0 LIMIT 1",
|
||||
[],
|
||||
@@ -2398,15 +2482,19 @@ impl Database {
|
||||
"ALTER TABLE meta ADD COLUMN metadata_gen INTEGER NOT NULL DEFAULT 0",
|
||||
[],
|
||||
);
|
||||
let _ = conn.execute("ALTER TABLE meta ADD COLUMN restore_nonce BLOB", []);
|
||||
let _ = conn.execute(
|
||||
"ALTER TABLE chunks ADD COLUMN generation INTEGER NOT NULL DEFAULT 0",
|
||||
[],
|
||||
);
|
||||
|
||||
// K-02: Alle bestehenden Chunks von alter 16-Byte-AAD auf Format V3 24-Byte-AAD (generation = 0) umverschlüsseln
|
||||
// F-03: Gesamte Migration in einer einzigen atomaren SQLite-Transaktion
|
||||
let tx = conn.transaction()?;
|
||||
|
||||
// Alle bestehenden Chunks von alter 16-Byte-AAD auf Format V3 24-Byte-AAD (generation = 0) umverschlüsseln
|
||||
{
|
||||
let mut chunk_stmt =
|
||||
conn.prepare("SELECT node_id, chunk_index, nonce, tag, ciphertext FROM chunks")?;
|
||||
tx.prepare("SELECT node_id, chunk_index, nonce, tag, ciphertext FROM chunks")?;
|
||||
let chunk_rows: Vec<(i64, u32, [u8; 12], [u8; 16], Vec<u8>)> = chunk_stmt
|
||||
.query_map([], |row| {
|
||||
let node_id: i64 = row.get(0)?;
|
||||
@@ -2428,8 +2516,8 @@ impl Database {
|
||||
drop(chunk_stmt);
|
||||
|
||||
for (node_id, chunk_index, nonce, tag, ct) in chunk_rows {
|
||||
if let Ok(plaintext) = crate::crypto::decrypt_chunk(
|
||||
dek,
|
||||
let (plaintext, chunk_dek) = match crate::crypto::decrypt_chunk(
|
||||
dek_0,
|
||||
node_id,
|
||||
chunk_index,
|
||||
&ct,
|
||||
@@ -2438,15 +2526,46 @@ impl Database {
|
||||
version,
|
||||
0,
|
||||
) {
|
||||
if let Ok((new_ct, new_nonce, new_tag)) = crate::crypto::encrypt_chunk(
|
||||
dek,
|
||||
Ok(pt) => (pt, dek_0),
|
||||
Err(e0) => {
|
||||
if let Some(d1) = dek_1 {
|
||||
match crate::crypto::decrypt_chunk(
|
||||
d1,
|
||||
node_id,
|
||||
chunk_index,
|
||||
&ct,
|
||||
&nonce,
|
||||
&tag,
|
||||
version,
|
||||
0,
|
||||
) {
|
||||
Ok(pt) => (pt, d1),
|
||||
Err(_) => {
|
||||
bail!(
|
||||
"Upgrade auf Format V3 abgebrochen: Chunk (Node {}, Index {}) konnte weder mit DEK_0 noch mit DEK_1 entschlüsselt werden.",
|
||||
node_id, chunk_index
|
||||
);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
bail!(
|
||||
"Upgrade auf Format V3 abgebrochen: Chunk (Node {}, Index {}) konnte mit DEK_0 nicht entschlüsselt werden ({}). Falls dieser Container einen Legacy-Hidden-Vault enthält, wird das zweite Passwort benötigt.",
|
||||
node_id, chunk_index, e0
|
||||
);
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
let (new_ct, new_nonce, new_tag) = crate::crypto::encrypt_chunk(
|
||||
chunk_dek,
|
||||
node_id,
|
||||
chunk_index,
|
||||
&plaintext,
|
||||
FORMAT_VERSION_V3,
|
||||
0,
|
||||
) {
|
||||
conn.execute(
|
||||
)?;
|
||||
|
||||
tx.execute(
|
||||
"UPDATE chunks SET nonce = ?1, tag = ?2, ciphertext = ?3, generation = 0 WHERE node_id = ?4 AND chunk_index = ?5",
|
||||
params![
|
||||
new_nonce.as_slice(),
|
||||
@@ -2458,19 +2577,42 @@ impl Database {
|
||||
)?;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
conn.execute(
|
||||
"UPDATE meta SET version = ?1, metadata_gen = 0 WHERE slot_id = 0",
|
||||
// F-03: Aktualisiere version = 3 für Slot 0 UND Slot 1 (inkl. Dummy-Slot)
|
||||
tx.execute(
|
||||
"UPDATE meta SET version = ?1, metadata_gen = 0",
|
||||
[FORMAT_VERSION_V3],
|
||||
)?;
|
||||
|
||||
tx.commit()?;
|
||||
drop(conn);
|
||||
|
||||
self.set_active_dek(Zeroizing::new(*dek));
|
||||
// Slot 0 Metadaten-MAC berechnen und persistieren
|
||||
self.set_active_slot_and_dek(0, Zeroizing::new(*dek_0));
|
||||
self.update_metadata_mac()?;
|
||||
|
||||
// Falls echte SQLite-Knoten unter Root 2 existieren (Legacy Hidden Vault) und dek_1 vorliegt,
|
||||
// auch Slot 1 MAC aktualisieren. (Bei Modell A bleibt Carrier-Inner Carrier-AEAD).
|
||||
let has_vault1_nodes: bool = {
|
||||
let conn = self.conn();
|
||||
conn.query_row(
|
||||
"SELECT 1 FROM nodes WHERE parent_id = 2 LIMIT 1",
|
||||
[],
|
||||
|_| Ok(true),
|
||||
)
|
||||
.optional()?
|
||||
.unwrap_or(false)
|
||||
};
|
||||
if has_vault1_nodes {
|
||||
if let Some(d1) = dek_1 {
|
||||
self.set_active_slot_and_dek(1, Zeroizing::new(*d1));
|
||||
self.update_metadata_mac()?;
|
||||
}
|
||||
}
|
||||
|
||||
// Aktive Session auf Slot 0 zurücksetzen
|
||||
self.set_active_slot_and_dek(0, Zeroizing::new(*dek_0));
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
@@ -2542,6 +2684,15 @@ impl Database {
|
||||
|
||||
/// Schreibt oder stellt die Metadaten in der `meta`-Tabelle wieder her (z. B. nach Restore oder Header-Neugenerierung).
|
||||
pub fn restore_meta(&self, meta: &ContainerMeta) -> Result<()> {
|
||||
self.restore_meta_with_nonce(meta, None)
|
||||
}
|
||||
|
||||
/// Schreibt oder stellt die Metadaten in der `meta`-Tabelle mit optionalem restore_nonce Token wieder her (F-02).
|
||||
pub fn restore_meta_with_nonce(
|
||||
&self,
|
||||
meta: &ContainerMeta,
|
||||
restore_nonce: Option<&[u8; 32]>,
|
||||
) -> Result<()> {
|
||||
let conn = self.conn();
|
||||
|
||||
conn.execute_batch(
|
||||
@@ -2556,6 +2707,7 @@ impl Database {
|
||||
header_tag BLOB NOT NULL,
|
||||
metadata_mac BLOB,
|
||||
metadata_gen INTEGER NOT NULL DEFAULT 0,
|
||||
restore_nonce BLOB,
|
||||
lock_pid INTEGER,
|
||||
lock_host TEXT,
|
||||
lock_time INTEGER
|
||||
@@ -2564,6 +2716,8 @@ impl Database {
|
||||
|
||||
conn.execute("DELETE FROM meta", [])?;
|
||||
|
||||
let nonce_bytes = restore_nonce.map(|n| n.as_slice());
|
||||
|
||||
let mut has_slot1 = false;
|
||||
if !meta.slots.is_empty() {
|
||||
for slot in &meta.slots {
|
||||
@@ -2572,8 +2726,8 @@ impl Database {
|
||||
}
|
||||
let params_json = serde_json::to_string(&slot.kdf_params)?;
|
||||
conn.execute(
|
||||
"INSERT INTO meta (slot_id, magic, version, kdf_salt, kdf_params, wrapped_dek, header_nonce, header_tag, metadata_mac, metadata_gen)
|
||||
VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, NULL, 0)",
|
||||
"INSERT INTO meta (slot_id, magic, version, kdf_salt, kdf_params, wrapped_dek, header_nonce, header_tag, metadata_mac, metadata_gen, restore_nonce)
|
||||
VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, NULL, 0, ?9)",
|
||||
params![
|
||||
slot.slot_id,
|
||||
MAGIC_BYTES.as_slice(),
|
||||
@@ -2583,14 +2737,15 @@ impl Database {
|
||||
slot.wrapped_dek,
|
||||
slot.header_nonce.as_slice(),
|
||||
slot.header_tag.as_slice(),
|
||||
nonce_bytes,
|
||||
],
|
||||
)?;
|
||||
}
|
||||
} else {
|
||||
let params_json = serde_json::to_string(&meta.kdf_params)?;
|
||||
conn.execute(
|
||||
"INSERT INTO meta (slot_id, magic, version, kdf_salt, kdf_params, wrapped_dek, header_nonce, header_tag, metadata_mac, metadata_gen)
|
||||
VALUES (0, ?1, ?2, ?3, ?4, ?5, ?6, ?7, NULL, 0)",
|
||||
"INSERT INTO meta (slot_id, magic, version, kdf_salt, kdf_params, wrapped_dek, header_nonce, header_tag, metadata_mac, metadata_gen, restore_nonce)
|
||||
VALUES (0, ?1, ?2, ?3, ?4, ?5, ?6, ?7, NULL, 0, ?8)",
|
||||
params![
|
||||
MAGIC_BYTES.as_slice(),
|
||||
meta.version,
|
||||
@@ -2599,6 +2754,7 @@ impl Database {
|
||||
meta.wrapped_dek,
|
||||
meta.header_nonce.as_slice(),
|
||||
meta.header_tag.as_slice(),
|
||||
nonce_bytes,
|
||||
],
|
||||
)?;
|
||||
}
|
||||
@@ -2608,8 +2764,8 @@ impl Database {
|
||||
let (dummy_dek, dummy_nonce, dummy_tag, dummy_salt) = generate_dummy_slot();
|
||||
let dummy_params_json = serde_json::to_string(&KdfParams::default())?;
|
||||
conn.execute(
|
||||
"INSERT INTO meta (slot_id, magic, version, kdf_salt, kdf_params, wrapped_dek, header_nonce, header_tag, metadata_mac, metadata_gen)
|
||||
VALUES (1, ?1, ?2, ?3, ?4, ?5, ?6, ?7, NULL, 0)",
|
||||
"INSERT INTO meta (slot_id, magic, version, kdf_salt, kdf_params, wrapped_dek, header_nonce, header_tag, metadata_mac, metadata_gen, restore_nonce)
|
||||
VALUES (1, ?1, ?2, ?3, ?4, ?5, ?6, ?7, NULL, 0, ?8)",
|
||||
params![
|
||||
MAGIC_BYTES.as_slice(),
|
||||
FORMAT_VERSION,
|
||||
@@ -2618,6 +2774,7 @@ impl Database {
|
||||
dummy_dek.as_slice(),
|
||||
dummy_nonce.as_slice(),
|
||||
dummy_tag.as_slice(),
|
||||
nonce_bytes,
|
||||
],
|
||||
)?;
|
||||
}
|
||||
@@ -2625,6 +2782,16 @@ impl Database {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Löscht das Restore-Token nach erfolgreichem MAC-Rebuild (F-02).
|
||||
pub fn clear_restore_nonce(&self, slot_id: u32) -> Result<()> {
|
||||
let conn = self.conn();
|
||||
conn.execute(
|
||||
"UPDATE meta SET restore_nonce = NULL WHERE slot_id = ?1",
|
||||
params![slot_id],
|
||||
)?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Führt SQLite-eigene Integritäts- und Foreign-Key-Prüfungen aus.
|
||||
pub fn run_sqlite_integrity_check(&self) -> Result<Vec<String>> {
|
||||
let conn = self.conn();
|
||||
|
||||
@@ -0,0 +1,952 @@
|
||||
use rand::rngs::OsRng;
|
||||
use rand::RngCore;
|
||||
use sanctum::crypto::{
|
||||
decrypt_chunk, derive_kek, encrypt_chunk, generate_dek, generate_salt, wrap_dek,
|
||||
wrap_slot0_payload, wrap_slot1_payload, KdfParams, FORMAT_VERSION_V2, FORMAT_VERSION_V3,
|
||||
MAGIC_BYTES, MIN_MEMORY_COST_KIB, MIN_TIME_COST,
|
||||
};
|
||||
use sanctum::mount::{mount_container, ContainerAuth};
|
||||
use sanctum::recovery::{export_header_backup, restore_header_backup};
|
||||
use sanctum::storage::{Database, MetadataMacStatus};
|
||||
use std::path::PathBuf;
|
||||
use std::time::Duration;
|
||||
use zeroize::Zeroizing;
|
||||
|
||||
fn test_kdf_params() -> KdfParams {
|
||||
KdfParams {
|
||||
memory_cost: MIN_MEMORY_COST_KIB,
|
||||
time_cost: MIN_TIME_COST,
|
||||
parallelism: 1,
|
||||
}
|
||||
}
|
||||
|
||||
fn temp_container_path(prefix: &str) -> PathBuf {
|
||||
let mut path = std::env::temp_dir();
|
||||
let rand_val: u64 = OsRng.next_u64();
|
||||
path.push(format!("sanctum_{prefix}_{rand_val}.sanctum"));
|
||||
path
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// F-02 TESTS: PendingRebuild Token & Rebuild-MAC Autorisation
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_f02_pending_rebuild_without_token_fails() {
|
||||
let path = temp_container_path("f02_no_token");
|
||||
let password = "TestPasswordF02_1!";
|
||||
let salt = generate_salt();
|
||||
let kdf = test_kdf_params();
|
||||
let kek = derive_kek(password, &salt, &kdf).unwrap();
|
||||
let dek = generate_dek();
|
||||
let (wrapped, nonce, tag) = wrap_dek(&kek, &dek).unwrap();
|
||||
|
||||
let db = Database::open(&path).unwrap();
|
||||
db.init_schema(&salt, &kdf, &wrapped, &nonce, &tag).unwrap();
|
||||
db.set_active_slot_and_dek(0, dek.clone());
|
||||
let _ = db.create_node(1, "test.txt", false).unwrap();
|
||||
db.update_metadata_mac().unwrap();
|
||||
db.checkpoint().unwrap();
|
||||
drop(db);
|
||||
|
||||
// Angreifer manipuliert meta: metadata_mac = NULL, metadata_gen = 0 (ohne Token)
|
||||
{
|
||||
let conn = rusqlite::Connection::open(&path).unwrap();
|
||||
conn.execute(
|
||||
"UPDATE meta SET metadata_mac = NULL, metadata_gen = 0, restore_nonce = NULL WHERE slot_id = 0",
|
||||
[],
|
||||
)
|
||||
.unwrap();
|
||||
}
|
||||
|
||||
// 1. Status muss strikt Invalid sein (kein PendingRebuild!)
|
||||
let check_db = Database::open(&path).unwrap();
|
||||
let status = check_db
|
||||
.verify_metadata_mac_status_for_slot(0, &dek)
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
status,
|
||||
MetadataMacStatus::Invalid,
|
||||
"NULL-MAC ohne restore_nonce Token muss strikt Invalid sein (F-02 Bypass-Schutz)"
|
||||
);
|
||||
assert!(
|
||||
!check_db.verify_metadata_mac_for_slot(0, &dek).unwrap(),
|
||||
"verify_metadata_mac_for_slot muss false liefern"
|
||||
);
|
||||
drop(check_db);
|
||||
|
||||
// 2. Mount ohne Flag muss fehlschlagen
|
||||
let auth = ContainerAuth::Password(Zeroizing::new(password.to_string()));
|
||||
let res = mount_container(
|
||||
&path,
|
||||
'Z',
|
||||
None,
|
||||
Some(18101),
|
||||
auth,
|
||||
false,
|
||||
false,
|
||||
None,
|
||||
false,
|
||||
false,
|
||||
None,
|
||||
true,
|
||||
false,
|
||||
)
|
||||
.await;
|
||||
assert!(res.is_err(), "Mount muss bei Status Invalid abbrechen");
|
||||
|
||||
// 3. Selbst mit --rebuild-mac darf KEIN Rebuild erfolgen, wenn Status Invalid ist!
|
||||
let auth2 = ContainerAuth::Password(Zeroizing::new(password.to_string()));
|
||||
let res2 = mount_container(
|
||||
&path,
|
||||
'Z',
|
||||
None,
|
||||
Some(18102),
|
||||
auth2,
|
||||
false,
|
||||
false,
|
||||
None,
|
||||
false,
|
||||
false,
|
||||
None,
|
||||
true,
|
||||
true,
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
res2.is_err(),
|
||||
"Mount mit --rebuild-mac darf Invalid-Metadaten nicht neu signieren"
|
||||
);
|
||||
|
||||
// 4. Metadaten-MAC bleibt weiterhin ungesetzt
|
||||
let verify_db = Database::open(&path).unwrap();
|
||||
let status_after = verify_db
|
||||
.verify_metadata_mac_status_for_slot(0, &dek)
|
||||
.unwrap();
|
||||
assert_eq!(status_after, MetadataMacStatus::Invalid);
|
||||
|
||||
let _ = std::fs::remove_file(&path);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_f02_restore_header_without_flag_fails() {
|
||||
let path = temp_container_path("f02_restore_noflag");
|
||||
let backup_path = path.with_extension("hdr");
|
||||
let password = "TestPasswordF02_2!";
|
||||
let salt = generate_salt();
|
||||
let kdf = test_kdf_params();
|
||||
let kek = derive_kek(password, &salt, &kdf).unwrap();
|
||||
let dek = generate_dek();
|
||||
let (wrapped, nonce, tag) = wrap_dek(&kek, &dek).unwrap();
|
||||
|
||||
let db = Database::open(&path).unwrap();
|
||||
db.init_schema(&salt, &kdf, &wrapped, &nonce, &tag).unwrap();
|
||||
db.set_active_slot_and_dek(0, dek.clone());
|
||||
let _ = db.create_node(1, "file.txt", false).unwrap();
|
||||
db.update_metadata_mac().unwrap();
|
||||
db.checkpoint().unwrap();
|
||||
drop(db);
|
||||
|
||||
// Backup exportieren
|
||||
export_header_backup(&path, &backup_path).unwrap();
|
||||
|
||||
// Header zerstören und restaurieren
|
||||
{
|
||||
let conn = rusqlite::Connection::open(&path).unwrap();
|
||||
conn.execute("DELETE FROM meta", []).unwrap();
|
||||
}
|
||||
restore_header_backup(&path, &backup_path).unwrap();
|
||||
|
||||
// Status nach Restore muss PendingRebuild sein
|
||||
{
|
||||
let check_db = Database::open(&path).unwrap();
|
||||
let status = check_db
|
||||
.verify_metadata_mac_status_for_slot(0, &dek)
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
status,
|
||||
MetadataMacStatus::PendingRebuild,
|
||||
"Nach restore_header_backup muss Status PendingRebuild sein (restore_nonce gesetzt)"
|
||||
);
|
||||
}
|
||||
|
||||
// Mount ohne --rebuild-mac (und ohne stdin-Interaktion) muss abbrechen
|
||||
let auth = ContainerAuth::Password(Zeroizing::new(password.to_string()));
|
||||
let res = mount_container(
|
||||
&path,
|
||||
'Z',
|
||||
None,
|
||||
Some(18103),
|
||||
auth,
|
||||
false,
|
||||
false,
|
||||
None,
|
||||
false,
|
||||
false,
|
||||
None,
|
||||
true,
|
||||
false,
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
res.is_err(),
|
||||
"Mount ohne --rebuild-mac muss nach Header-Restore fail-closed abbrechen"
|
||||
);
|
||||
|
||||
// Nonce muss weiterhin existieren, MAC noch nicht gesetzt
|
||||
let check_db2 = Database::open(&path).unwrap();
|
||||
assert_eq!(
|
||||
check_db2
|
||||
.verify_metadata_mac_status_for_slot(0, &dek)
|
||||
.unwrap(),
|
||||
MetadataMacStatus::PendingRebuild
|
||||
);
|
||||
|
||||
let _ = std::fs::remove_file(&path);
|
||||
let _ = std::fs::remove_file(&backup_path);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_f02_restore_header_with_flag_succeeds() {
|
||||
let path = temp_container_path("f02_restore_flag");
|
||||
let backup_path = path.with_extension("hdr");
|
||||
let password = "TestPasswordF02_3!";
|
||||
let salt = generate_salt();
|
||||
let kdf = test_kdf_params();
|
||||
let kek = derive_kek(password, &salt, &kdf).unwrap();
|
||||
let dek = generate_dek();
|
||||
let (wrapped, nonce, tag) = wrap_dek(&kek, &dek).unwrap();
|
||||
|
||||
let db = Database::open(&path).unwrap();
|
||||
db.init_schema(&salt, &kdf, &wrapped, &nonce, &tag).unwrap();
|
||||
db.set_active_slot_and_dek(0, dek.clone());
|
||||
let _ = db.create_node(1, "restored_payload.pdf", false).unwrap();
|
||||
db.update_metadata_mac().unwrap();
|
||||
db.checkpoint().unwrap();
|
||||
drop(db);
|
||||
|
||||
export_header_backup(&path, &backup_path).unwrap();
|
||||
|
||||
{
|
||||
let conn = rusqlite::Connection::open(&path).unwrap();
|
||||
conn.execute("DELETE FROM meta", []).unwrap();
|
||||
}
|
||||
restore_header_backup(&path, &backup_path).unwrap();
|
||||
|
||||
// Mount mit rebuild_mac = true
|
||||
let auth = ContainerAuth::Password(Zeroizing::new(password.to_string()));
|
||||
let c_path = path.clone();
|
||||
let mount_task = tokio::spawn(async move {
|
||||
mount_container(
|
||||
&c_path,
|
||||
'Y',
|
||||
None,
|
||||
Some(18104),
|
||||
auth,
|
||||
false,
|
||||
false,
|
||||
None,
|
||||
false,
|
||||
false,
|
||||
None,
|
||||
true,
|
||||
true,
|
||||
)
|
||||
.await
|
||||
});
|
||||
|
||||
tokio::time::sleep(Duration::from_millis(250)).await;
|
||||
mount_task.abort();
|
||||
|
||||
// Nach Mount mit Flag: MAC ist Valid, restore_nonce gelöscht!
|
||||
let check_db = Database::open(&path).unwrap();
|
||||
let status = check_db
|
||||
.verify_metadata_mac_status_for_slot(0, &dek)
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
status,
|
||||
MetadataMacStatus::Valid,
|
||||
"Nach Mount mit --rebuild-mac muss Status Valid sein"
|
||||
);
|
||||
assert!(check_db.verify_metadata_mac_for_slot(0, &dek).unwrap());
|
||||
|
||||
// Prüfen, ob restore_nonce gelöscht wurde
|
||||
let conn = check_db.conn();
|
||||
let nonce_opt: Option<Option<Vec<u8>>> = conn
|
||||
.query_row(
|
||||
"SELECT restore_nonce FROM meta WHERE slot_id = 0",
|
||||
[],
|
||||
|r| r.get(0),
|
||||
)
|
||||
.ok();
|
||||
assert!(
|
||||
nonce_opt.flatten().is_none(),
|
||||
"restore_nonce muss nach erfolgreichem Rebuild gelöscht sein"
|
||||
);
|
||||
|
||||
let _ = std::fs::remove_file(&path);
|
||||
let _ = std::fs::remove_file(&backup_path);
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// F-01 TESTS: Chunk-Generation-Replay im Transcript & Migration
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_f01_chunk_generation_replay_attack() {
|
||||
let path = temp_container_path("f01_replay_attack");
|
||||
let password = "TestPasswordF01!";
|
||||
let salt = generate_salt();
|
||||
let kdf = test_kdf_params();
|
||||
let kek = derive_kek(password, &salt, &kdf).unwrap();
|
||||
let dek = generate_dek();
|
||||
let (wrapped, nonce, tag) = wrap_dek(&kek, &dek).unwrap();
|
||||
|
||||
let db = Database::open(&path).unwrap();
|
||||
db.init_schema(&salt, &kdf, &wrapped, &nonce, &tag).unwrap();
|
||||
db.set_active_slot_and_dek(0, dek.clone());
|
||||
|
||||
// 1. Datei schreiben mit Zustand 1 (Generation 1, z. B. 34 Bytes)
|
||||
let file = db.create_node(1, "financial_report.txt", false).unwrap();
|
||||
let data_v1 = b"State 1: Balance is 1000 EUR.";
|
||||
let gen1 = db.next_chunk_generation(file.id, 0).unwrap();
|
||||
assert_eq!(gen1, 1);
|
||||
let (ct1, nonce1, tag1) =
|
||||
encrypt_chunk(&dek, file.id, 0, data_v1, FORMAT_VERSION_V3, gen1).unwrap();
|
||||
db.write_chunk_and_update_size(
|
||||
file.id,
|
||||
0,
|
||||
gen1,
|
||||
&nonce1,
|
||||
&tag1,
|
||||
&ct1,
|
||||
data_v1.len() as u64,
|
||||
1000,
|
||||
)
|
||||
.unwrap();
|
||||
db.checkpoint().unwrap();
|
||||
|
||||
// Gespeicherte Zeile aus chunks sichern
|
||||
let chunk_v1 = db.read_chunk(file.id, 0).unwrap().unwrap();
|
||||
assert_eq!(chunk_v1.generation, 1);
|
||||
assert_eq!(
|
||||
db.verify_metadata_mac_status_for_slot(0, &dek).unwrap(),
|
||||
MetadataMacStatus::Valid
|
||||
);
|
||||
|
||||
// 2. Datei mit exakt gleicher Größe überschreiben mit Zustand 2 (Generation 2, selbe Länge)
|
||||
let data_v2 = b"State 2: Balance is 9999 EUR.";
|
||||
assert_eq!(data_v1.len(), data_v2.len());
|
||||
let gen2 = db.next_chunk_generation(file.id, 0).unwrap();
|
||||
assert_eq!(gen2, 2);
|
||||
let (ct2, nonce2, tag2) =
|
||||
encrypt_chunk(&dek, file.id, 0, data_v2, FORMAT_VERSION_V3, gen2).unwrap();
|
||||
db.write_chunk_and_update_size(
|
||||
file.id,
|
||||
0,
|
||||
gen2,
|
||||
&nonce2,
|
||||
&tag2,
|
||||
&ct2,
|
||||
data_v2.len() as u64,
|
||||
2000,
|
||||
)
|
||||
.unwrap();
|
||||
db.checkpoint().unwrap();
|
||||
|
||||
assert_eq!(
|
||||
db.verify_metadata_mac_status_for_slot(0, &dek).unwrap(),
|
||||
MetadataMacStatus::Valid
|
||||
);
|
||||
drop(db);
|
||||
|
||||
// 3. Angriff: Angreifer restauriert alte Chunk-Zeile (inkl. generation = 1) in SQLite
|
||||
// Größe und chunk_count des Knotens sind unverändert!
|
||||
{
|
||||
let conn = rusqlite::Connection::open(&path).unwrap();
|
||||
conn.execute(
|
||||
"UPDATE chunks SET nonce = ?1, tag = ?2, ciphertext = ?3, generation = ?4 WHERE node_id = ?5 AND chunk_index = 0",
|
||||
rusqlite::params![
|
||||
chunk_v1.nonce.as_slice(),
|
||||
chunk_v1.tag.as_slice(),
|
||||
chunk_v1.ciphertext,
|
||||
chunk_v1.generation,
|
||||
file.id,
|
||||
],
|
||||
)
|
||||
.unwrap();
|
||||
}
|
||||
|
||||
// 4. Verifikation des Replay-Schutzes (F-01):
|
||||
let attack_db = Database::open(&path).unwrap();
|
||||
|
||||
// Hinweis: Die AEAD-Entschlüsselung für sich allein würde hier gelingen,
|
||||
// da die Zeile generation=1 enthält. ABER das Metadaten-Transcript bindet die Generation!
|
||||
let replayed = attack_db.read_chunk(file.id, 0).unwrap().unwrap();
|
||||
let aead_decrypt = decrypt_chunk(
|
||||
&dek,
|
||||
file.id,
|
||||
0,
|
||||
&replayed.ciphertext,
|
||||
&replayed.nonce,
|
||||
&replayed.tag,
|
||||
FORMAT_VERSION_V3,
|
||||
replayed.generation,
|
||||
);
|
||||
assert!(
|
||||
aead_decrypt.is_ok(),
|
||||
"AEAD mit replayed Zeile gelingt, weil generation in der gleichen Zeile liegt"
|
||||
);
|
||||
|
||||
// Genau deshalb MUSS der Metadaten-MAC den Replay-Angriff stoppen:
|
||||
let mac_status = attack_db
|
||||
.verify_metadata_mac_status_for_slot(0, &dek)
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
mac_status,
|
||||
MetadataMacStatus::Invalid,
|
||||
"F-01: Metadaten-MAC MUSS den Replay-Angriff durch abweichende Generation abwehren!"
|
||||
);
|
||||
assert!(
|
||||
!attack_db.verify_metadata_mac_for_slot(0, &dek).unwrap(),
|
||||
"verify_metadata_mac_for_slot muss false liefern"
|
||||
);
|
||||
drop(attack_db);
|
||||
|
||||
// 5. Mount bricht fail-closed ab, kein alter Klartext wird offengelegt
|
||||
let auth = ContainerAuth::Password(Zeroizing::new(password.to_string()));
|
||||
let res = mount_container(
|
||||
&path,
|
||||
'Z',
|
||||
None,
|
||||
Some(18105),
|
||||
auth,
|
||||
false,
|
||||
false,
|
||||
None,
|
||||
false,
|
||||
false,
|
||||
None,
|
||||
true,
|
||||
false,
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
res.is_err(),
|
||||
"Mount muss bei manipuliertem Chunk-Replay fail-closed abbrechen"
|
||||
);
|
||||
|
||||
let _ = std::fs::remove_file(&path);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_f01_migration_existing_v3_container() {
|
||||
let path = temp_container_path("f01_migration");
|
||||
let password = "TestPasswordF01_Mig!";
|
||||
let salt = generate_salt();
|
||||
let kdf = test_kdf_params();
|
||||
let kek = derive_kek(password, &salt, &kdf).unwrap();
|
||||
let dek = generate_dek();
|
||||
let (wrapped, nonce, tag) = wrap_dek(&kek, &dek).unwrap();
|
||||
|
||||
let db = Database::open(&path).unwrap();
|
||||
db.init_schema(&salt, &kdf, &wrapped, &nonce, &tag).unwrap();
|
||||
db.set_active_slot_and_dek(0, dek.clone());
|
||||
let file = db.create_node(1, "legacy_v3_doc.txt", false).unwrap();
|
||||
let data = b"V3 Legacy Container Content";
|
||||
let gen = db.next_chunk_generation(file.id, 0).unwrap();
|
||||
let (ct, n, t) = encrypt_chunk(&dek, file.id, 0, data, FORMAT_VERSION_V3, gen).unwrap();
|
||||
db.write_chunk_and_update_size(file.id, 0, gen, &n, &t, &ct, data.len() as u64, 1000)
|
||||
.unwrap();
|
||||
|
||||
// Simuliere v0.9.3 Zustand: Metadaten-MAC wurde NUR über Knoten berechnet (ohne Chunks)
|
||||
let legacy_canonical = db.canonical_nodes_bytes_for_vault_legacy(0).unwrap();
|
||||
let mac_key = sanctum::crypto::derive_metadata_mac_key(&dek);
|
||||
let legacy_mac = sanctum::crypto::compute_metadata_mac(&mac_key, 1, &legacy_canonical);
|
||||
{
|
||||
let conn = db.conn();
|
||||
conn.execute(
|
||||
"UPDATE meta SET metadata_mac = ?1, metadata_gen = 1 WHERE slot_id = 0",
|
||||
rusqlite::params![legacy_mac.as_slice()],
|
||||
)
|
||||
.unwrap();
|
||||
}
|
||||
db.checkpoint().unwrap();
|
||||
|
||||
// Status muss LegacyValid sein
|
||||
let status_before = db.verify_metadata_mac_status_for_slot(0, &dek).unwrap();
|
||||
assert_eq!(
|
||||
status_before,
|
||||
MetadataMacStatus::LegacyValid,
|
||||
"Alter V3-Container muss als LegacyValid erkannt werden"
|
||||
);
|
||||
assert!(db.verify_metadata_mac_for_slot(0, &dek).unwrap());
|
||||
drop(db);
|
||||
|
||||
// Mounten migriert transparent auf neues Transcript
|
||||
let auth = ContainerAuth::Password(Zeroizing::new(password.to_string()));
|
||||
let c_path = path.clone();
|
||||
let mount_task = tokio::spawn(async move {
|
||||
mount_container(
|
||||
&c_path,
|
||||
'Y',
|
||||
None,
|
||||
Some(18106),
|
||||
auth,
|
||||
false,
|
||||
false,
|
||||
None,
|
||||
false,
|
||||
false,
|
||||
None,
|
||||
true,
|
||||
false,
|
||||
)
|
||||
.await
|
||||
});
|
||||
|
||||
tokio::time::sleep(Duration::from_millis(250)).await;
|
||||
mount_task.abort();
|
||||
|
||||
// Nach Mount: Status muss nun Valid unter neuem Transcript sein!
|
||||
let db_after = Database::open(&path).unwrap();
|
||||
let status_after = db_after
|
||||
.verify_metadata_mac_status_for_slot(0, &dek)
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
status_after,
|
||||
MetadataMacStatus::Valid,
|
||||
"Nach Mount muss der MAC auf das neue Format-V3.1 Transcript migriert sein"
|
||||
);
|
||||
|
||||
let _ = std::fs::remove_file(&path);
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// F-03 TESTS: upgrade_to_v3 Atomarität & Konsistenz
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
#[test]
|
||||
fn test_f03_v2_upgrade_single_file_success() {
|
||||
let path = temp_container_path("f03_single_success");
|
||||
let salt = generate_salt();
|
||||
let kdf = test_kdf_params();
|
||||
let dek = generate_dek();
|
||||
|
||||
// Erstelle manuell einen V2-Container
|
||||
{
|
||||
let conn = rusqlite::Connection::open(&path).unwrap();
|
||||
conn.execute_batch(
|
||||
"CREATE TABLE meta (
|
||||
slot_id INTEGER PRIMARY KEY,
|
||||
magic BLOB NOT NULL,
|
||||
version INTEGER NOT NULL,
|
||||
kdf_salt BLOB NOT NULL,
|
||||
kdf_params TEXT NOT NULL,
|
||||
wrapped_dek BLOB NOT NULL,
|
||||
header_nonce BLOB NOT NULL,
|
||||
header_tag BLOB NOT NULL
|
||||
);
|
||||
CREATE TABLE nodes (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
parent_id INTEGER,
|
||||
name TEXT NOT NULL,
|
||||
is_dir INTEGER NOT NULL,
|
||||
size INTEGER NOT NULL DEFAULT 0,
|
||||
created_at INTEGER NOT NULL,
|
||||
modified_at INTEGER NOT NULL,
|
||||
is_carrier INTEGER NOT NULL DEFAULT 0
|
||||
);
|
||||
CREATE TABLE chunks (
|
||||
node_id INTEGER NOT NULL,
|
||||
chunk_index INTEGER NOT NULL,
|
||||
nonce BLOB NOT NULL,
|
||||
tag BLOB NOT NULL,
|
||||
ciphertext BLOB NOT NULL,
|
||||
PRIMARY KEY (node_id, chunk_index)
|
||||
);",
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
let kek = derive_kek("TestV2!", &salt, &kdf).unwrap();
|
||||
let (wrapped, h_nonce, h_tag) = wrap_dek(&kek, &dek).unwrap();
|
||||
let params_json = serde_json::to_string(&kdf).unwrap();
|
||||
conn.execute(
|
||||
"INSERT INTO meta VALUES (0, ?1, 2, ?2, ?3, ?4, ?5, ?6)",
|
||||
rusqlite::params![
|
||||
MAGIC_BYTES.as_slice(),
|
||||
salt.as_slice(),
|
||||
params_json,
|
||||
wrapped,
|
||||
h_nonce.as_slice(),
|
||||
h_tag.as_slice(),
|
||||
],
|
||||
)
|
||||
.unwrap();
|
||||
conn.execute(
|
||||
"INSERT INTO meta VALUES (1, ?1, 2, ?2, ?3, ?4, ?5, ?6)",
|
||||
rusqlite::params![
|
||||
MAGIC_BYTES.as_slice(),
|
||||
salt.as_slice(),
|
||||
params_json,
|
||||
wrapped,
|
||||
h_nonce.as_slice(),
|
||||
h_tag.as_slice(),
|
||||
],
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
conn.execute(
|
||||
"INSERT INTO nodes VALUES (1, NULL, '', 1, 0, 100, 100, 0), (2, NULL, '', 1, 0, 100, 100, 0), (3, 1, 'file.txt', 0, 12, 100, 100, 0)",
|
||||
[],
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
// Chunk in V2 verschlüsseln (16-Byte AAD, generation wird ignoriert)
|
||||
let plaintext = b"Hello V2 Upgrade!";
|
||||
let (ct, n, t) = encrypt_chunk(&dek, 3, 0, plaintext, FORMAT_VERSION_V2, 0).unwrap();
|
||||
conn.execute(
|
||||
"INSERT INTO chunks VALUES (3, 0, ?1, ?2, ?3)",
|
||||
rusqlite::params![n.as_slice(), t.as_slice(), ct],
|
||||
)
|
||||
.unwrap();
|
||||
}
|
||||
|
||||
let db = Database::open(&path).unwrap();
|
||||
let meta_before = db.read_meta().unwrap();
|
||||
assert_eq!(meta_before.version, 2);
|
||||
|
||||
// Upgrade ausführen
|
||||
db.upgrade_to_v3(&dek).unwrap();
|
||||
db.checkpoint().unwrap();
|
||||
|
||||
// 1. Beide Slots in meta müssen version == 3 haben!
|
||||
let conn = db.conn();
|
||||
let v0: u32 = conn
|
||||
.query_row("SELECT version FROM meta WHERE slot_id = 0", [], |r| {
|
||||
r.get(0)
|
||||
})
|
||||
.unwrap();
|
||||
let v1: u32 = conn
|
||||
.query_row("SELECT version FROM meta WHERE slot_id = 1", [], |r| {
|
||||
r.get(0)
|
||||
})
|
||||
.unwrap();
|
||||
assert_eq!(v0, 3, "Slot 0 version muss 3 sein");
|
||||
assert_eq!(v1, 3, "Slot 1 version muss 3 sein (F-03)");
|
||||
drop(conn);
|
||||
|
||||
// 2. Chunks müssen generation = 0 haben und mit V3 24-Byte AAD entschlüsselbar sein
|
||||
let chunk = db.read_chunk(3, 0).unwrap().unwrap();
|
||||
assert_eq!(chunk.generation, 0);
|
||||
let decrypted = decrypt_chunk(
|
||||
&dek,
|
||||
3,
|
||||
0,
|
||||
&chunk.ciphertext,
|
||||
&chunk.nonce,
|
||||
&chunk.tag,
|
||||
FORMAT_VERSION_V3,
|
||||
chunk.generation,
|
||||
)
|
||||
.unwrap();
|
||||
assert_eq!(decrypted, b"Hello V2 Upgrade!");
|
||||
|
||||
// 3. Metadaten-MAC muss Valid sein
|
||||
assert_eq!(
|
||||
db.verify_metadata_mac_status_for_slot(0, &dek).unwrap(),
|
||||
MetadataMacStatus::Valid
|
||||
);
|
||||
|
||||
let _ = std::fs::remove_file(&path);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_f03_v2_upgrade_corrupted_chunk_rollback() {
|
||||
let path = temp_container_path("f03_rollback");
|
||||
let salt = generate_salt();
|
||||
let kdf = test_kdf_params();
|
||||
let dek = generate_dek();
|
||||
|
||||
{
|
||||
let conn = rusqlite::Connection::open(&path).unwrap();
|
||||
conn.execute_batch(
|
||||
"CREATE TABLE meta (
|
||||
slot_id INTEGER PRIMARY KEY,
|
||||
magic BLOB NOT NULL,
|
||||
version INTEGER NOT NULL,
|
||||
kdf_salt BLOB NOT NULL,
|
||||
kdf_params TEXT NOT NULL,
|
||||
wrapped_dek BLOB NOT NULL,
|
||||
header_nonce BLOB NOT NULL,
|
||||
header_tag BLOB NOT NULL
|
||||
);
|
||||
CREATE TABLE nodes (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
parent_id INTEGER,
|
||||
name TEXT NOT NULL,
|
||||
is_dir INTEGER NOT NULL,
|
||||
size INTEGER NOT NULL DEFAULT 0,
|
||||
created_at INTEGER NOT NULL,
|
||||
modified_at INTEGER NOT NULL,
|
||||
is_carrier INTEGER NOT NULL DEFAULT 0
|
||||
);
|
||||
CREATE TABLE chunks (
|
||||
node_id INTEGER NOT NULL,
|
||||
chunk_index INTEGER NOT NULL,
|
||||
nonce BLOB NOT NULL,
|
||||
tag BLOB NOT NULL,
|
||||
ciphertext BLOB NOT NULL,
|
||||
PRIMARY KEY (node_id, chunk_index)
|
||||
);",
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
let kek = derive_kek("TestV2!", &salt, &kdf).unwrap();
|
||||
let (wrapped, h_nonce, h_tag) = wrap_dek(&kek, &dek).unwrap();
|
||||
let params_json = serde_json::to_string(&kdf).unwrap();
|
||||
conn.execute(
|
||||
"INSERT INTO meta VALUES (0, ?1, 2, ?2, ?3, ?4, ?5, ?6)",
|
||||
rusqlite::params![
|
||||
MAGIC_BYTES.as_slice(),
|
||||
salt.as_slice(),
|
||||
params_json,
|
||||
wrapped,
|
||||
h_nonce.as_slice(),
|
||||
h_tag.as_slice(),
|
||||
],
|
||||
)
|
||||
.unwrap();
|
||||
conn.execute(
|
||||
"INSERT INTO meta VALUES (1, ?1, 2, ?2, ?3, ?4, ?5, ?6)",
|
||||
rusqlite::params![
|
||||
MAGIC_BYTES.as_slice(),
|
||||
salt.as_slice(),
|
||||
params_json,
|
||||
wrapped,
|
||||
h_nonce.as_slice(),
|
||||
h_tag.as_slice(),
|
||||
],
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
conn.execute(
|
||||
"INSERT INTO nodes VALUES (1, NULL, '', 1, 0, 100, 100, 0), (2, NULL, '', 1, 0, 100, 100, 0), (3, 1, 'corrupt.txt', 0, 100, 100, 100, 0)",
|
||||
[],
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
// Gültiger Chunk 0
|
||||
let (ct0, n0, t0) =
|
||||
encrypt_chunk(&dek, 3, 0, b"Valid chunk 0", FORMAT_VERSION_V2, 0).unwrap();
|
||||
conn.execute(
|
||||
"INSERT INTO chunks VALUES (3, 0, ?1, ?2, ?3)",
|
||||
rusqlite::params![n0.as_slice(), t0.as_slice(), ct0],
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
// Beschädigter Chunk 1 (manipulierter Tag)
|
||||
let (ct1, n1, mut t1) =
|
||||
encrypt_chunk(&dek, 3, 1, b"Valid chunk 1", FORMAT_VERSION_V2, 0).unwrap();
|
||||
t1[0] ^= 0xff; // Tag korrumpieren
|
||||
conn.execute(
|
||||
"INSERT INTO chunks VALUES (3, 1, ?1, ?2, ?3)",
|
||||
rusqlite::params![n1.as_slice(), t1.as_slice(), ct1],
|
||||
)
|
||||
.unwrap();
|
||||
}
|
||||
|
||||
let db = Database::open(&path).unwrap();
|
||||
|
||||
// Upgrade MUSS abbrechen
|
||||
let res = db.upgrade_to_v3(&dek);
|
||||
assert!(
|
||||
res.is_err(),
|
||||
"Upgrade muss bei beschädigtem Chunk abbrechen"
|
||||
);
|
||||
let err_msg = res.unwrap_err().to_string();
|
||||
assert!(
|
||||
err_msg.contains("Node 3") && err_msg.contains("Index 1"),
|
||||
"Fehler muss Node und Index benennen: {err_msg}"
|
||||
);
|
||||
|
||||
// Rollback-Verifikation:
|
||||
let conn = db.conn();
|
||||
let v0: u32 = conn
|
||||
.query_row("SELECT version FROM meta WHERE slot_id = 0", [], |r| {
|
||||
r.get(0)
|
||||
})
|
||||
.unwrap();
|
||||
let v1: u32 = conn
|
||||
.query_row("SELECT version FROM meta WHERE slot_id = 1", [], |r| {
|
||||
r.get(0)
|
||||
})
|
||||
.unwrap();
|
||||
assert_eq!(v0, 2, "Nach Rollback muss Version 2 bleiben");
|
||||
assert_eq!(v1, 2, "Nach Rollback muss Version 2 bleiben");
|
||||
|
||||
// Chunk 0 darf nicht umverschlüsselt zurückgeblieben sein (muss weiterhin mit V2 entschlüsselbar sein)
|
||||
drop(conn);
|
||||
let chunk0 = db.read_chunk(3, 0).unwrap().unwrap();
|
||||
let dec0 = decrypt_chunk(
|
||||
&dek,
|
||||
3,
|
||||
0,
|
||||
&chunk0.ciphertext,
|
||||
&chunk0.nonce,
|
||||
&chunk0.tag,
|
||||
FORMAT_VERSION_V2,
|
||||
0,
|
||||
);
|
||||
assert!(
|
||||
dec0.is_ok(),
|
||||
"Chunk 0 muss unverändert im V2-Zustand geblieben sein"
|
||||
);
|
||||
|
||||
let _ = std::fs::remove_file(&path);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_f03_dual_vault_v2_upgrade_carrier() {
|
||||
let path = temp_container_path("f03_dual_carrier");
|
||||
let pass_decoy = "DecoyPassword2026!";
|
||||
let pass_hidden = "HiddenPassword2026!";
|
||||
let kdf = test_kdf_params();
|
||||
|
||||
let salt_0 = generate_salt();
|
||||
let kek_0 = derive_kek(pass_decoy, &salt_0, &kdf).unwrap();
|
||||
let dek_0 = generate_dek();
|
||||
|
||||
let salt_1 = generate_salt();
|
||||
let kek_1 = derive_kek(pass_hidden, &salt_1, &kdf).unwrap();
|
||||
let dek_1 = generate_dek();
|
||||
|
||||
let carrier_node_id = 3i64;
|
||||
let (wrapped_0, nonce_0, tag_0) = wrap_slot0_payload(&kek_0, &dek_0, carrier_node_id).unwrap();
|
||||
let (wrapped_1, nonce_1, tag_1) =
|
||||
wrap_slot1_payload(&kek_1, &dek_1, &dek_0, carrier_node_id).unwrap();
|
||||
|
||||
let carrier_size: u64 = 10 * 1024 * 1024; // 10 MB
|
||||
|
||||
let db = Database::open(&path).unwrap();
|
||||
db.init_schema_with_carrier(
|
||||
&salt_0,
|
||||
&kdf,
|
||||
&wrapped_0,
|
||||
&nonce_0,
|
||||
&tag_0,
|
||||
Some((
|
||||
"carrier.dat",
|
||||
carrier_size,
|
||||
&salt_1,
|
||||
&kdf,
|
||||
&wrapped_1,
|
||||
&nonce_1,
|
||||
&tag_1,
|
||||
&dek_0,
|
||||
&dek_1,
|
||||
)),
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
// Simuliere V2-Zustand für beide Slots und Chunks
|
||||
{
|
||||
let conn = db.conn();
|
||||
conn.execute("UPDATE meta SET version = 2", []).unwrap();
|
||||
// Verschlüssele Carrier-Chunks mit V2 (16-Byte AAD) um
|
||||
let mut stmt = conn
|
||||
.prepare("SELECT chunk_index, nonce, tag, ciphertext FROM chunks WHERE node_id = ?1")
|
||||
.unwrap();
|
||||
let chunks: Vec<(u32, [u8; 12], [u8; 16], Vec<u8>)> = stmt
|
||||
.query_map([carrier_node_id], |r| {
|
||||
let idx: u32 = r.get(0)?;
|
||||
let n: Vec<u8> = r.get(1)?;
|
||||
let t: Vec<u8> = r.get(2)?;
|
||||
let c: Vec<u8> = r.get(3)?;
|
||||
let mut n_arr = [0u8; 12];
|
||||
let mut t_arr = [0u8; 16];
|
||||
n_arr.copy_from_slice(&n);
|
||||
t_arr.copy_from_slice(&t);
|
||||
Ok((idx, n_arr, t_arr, c))
|
||||
})
|
||||
.unwrap()
|
||||
.collect::<std::result::Result<Vec<_>, _>>()
|
||||
.unwrap();
|
||||
drop(stmt);
|
||||
|
||||
for (idx, n, t, c) in chunks {
|
||||
let pt = decrypt_chunk(
|
||||
&dek_0,
|
||||
carrier_node_id,
|
||||
idx,
|
||||
&c,
|
||||
&n,
|
||||
&t,
|
||||
FORMAT_VERSION_V3,
|
||||
0,
|
||||
)
|
||||
.unwrap();
|
||||
let (v2_ct, v2_n, v2_t) =
|
||||
encrypt_chunk(&dek_0, carrier_node_id, idx, &pt, FORMAT_VERSION_V2, 0).unwrap();
|
||||
conn.execute(
|
||||
"UPDATE chunks SET nonce = ?1, tag = ?2, ciphertext = ?3, generation = 0 WHERE node_id = ?4 AND chunk_index = ?5",
|
||||
rusqlite::params![v2_n.as_slice(), v2_t.as_slice(), v2_ct, carrier_node_id, idx],
|
||||
)
|
||||
.unwrap();
|
||||
}
|
||||
}
|
||||
db.checkpoint().unwrap();
|
||||
|
||||
// Verifiziere V2-Ausgangszustand
|
||||
let meta_v2 = db.read_meta().unwrap();
|
||||
assert_eq!(meta_v2.version, 2);
|
||||
|
||||
// Upgrade mit Decoy-Passwort (DEK_0) durchführen
|
||||
db.upgrade_to_v3(&dek_0).unwrap();
|
||||
db.checkpoint().unwrap();
|
||||
|
||||
// Prüfen: Beide Slots müssen version == 3 sein!
|
||||
{
|
||||
let conn = db.conn();
|
||||
let v0: u32 = conn
|
||||
.query_row("SELECT version FROM meta WHERE slot_id = 0", [], |r| {
|
||||
r.get(0)
|
||||
})
|
||||
.unwrap();
|
||||
let v1: u32 = conn
|
||||
.query_row("SELECT version FROM meta WHERE slot_id = 1", [], |r| {
|
||||
r.get(0)
|
||||
})
|
||||
.unwrap();
|
||||
assert_eq!(v0, 3, "Slot 0 version muss 3 sein");
|
||||
assert_eq!(v1, 3, "Slot 1 version muss 3 sein (F-03)");
|
||||
}
|
||||
drop(db);
|
||||
|
||||
// Hidden-Mount mit pass_hidden ausführen: Muss Carrier-Chunks fehlerfrei unter DEK_0 mit Version 3 lesen
|
||||
let auth_hidden = ContainerAuth::Password(Zeroizing::new(pass_hidden.to_string()));
|
||||
let c_path = path.clone();
|
||||
let mount_task = tokio::spawn(async move {
|
||||
mount_container(
|
||||
&c_path,
|
||||
'Y',
|
||||
None,
|
||||
Some(18107),
|
||||
auth_hidden,
|
||||
false,
|
||||
false,
|
||||
None,
|
||||
false,
|
||||
false,
|
||||
None,
|
||||
true,
|
||||
false,
|
||||
)
|
||||
.await
|
||||
});
|
||||
|
||||
tokio::time::sleep(Duration::from_millis(300)).await;
|
||||
mount_task.abort();
|
||||
|
||||
let _ = std::fs::remove_file(&path);
|
||||
}
|
||||
@@ -375,6 +375,7 @@ async fn test_mount_rejects_tampered_metadata_mac() {
|
||||
false,
|
||||
None,
|
||||
true,
|
||||
false,
|
||||
)
|
||||
.await;
|
||||
|
||||
@@ -472,6 +473,7 @@ async fn test_mount_succeeds_and_rebuilds_mac_after_header_file_restore() {
|
||||
false,
|
||||
None,
|
||||
true,
|
||||
true,
|
||||
)
|
||||
.await
|
||||
});
|
||||
@@ -577,6 +579,7 @@ async fn test_mount_succeeds_after_recovery_key_restore_slot0() {
|
||||
false,
|
||||
None,
|
||||
true,
|
||||
false,
|
||||
)
|
||||
.await
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user