Merge "Moves all backup chunk-model related classes over to the framework."

/*

 * Copyright (C) 2018 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License

 */

syntax = "proto2";

package com.android.server.backup.encryption.chunk;

option java_outer_classname = "ChunksMetadataProto";

// Cipher type with which the chunks are encrypted. For now we only support AES/GCM/NoPadding, but

// this is for backwards-compatibility in case we need to change the default Cipher in the future.

enum CipherType {

    UNKNOWN_CIPHER_TYPE = 0;

    // Chunk is prefixed with a 12-byte nonce. The tag length is 16 bytes.

    AES_256_GCM = 1;

}

// Checksum type with which the plaintext is verified.

enum ChecksumType {

    UNKNOWN_CHECKSUM_TYPE = 0;

    SHA_256 = 1;

}

enum ChunkOrderingType {

    CHUNK_ORDERING_TYPE_UNSPECIFIED = 0;

    // The chunk ordering contains a list of the start position of each chunk in the encrypted file,

    // ordered as in the plaintext file. This allows us to recreate the original plaintext file

    // during decryption. We use this mode for full backups where the order of the data in the file

    // is important.

    EXPLICIT_STARTS = 1;

    // The chunk ordering does not contain any start positions, and instead each encrypted chunk in

    // the backup file is prefixed with its length. This allows us to decrypt each chunk but does

    // not give any information about the order. However, we use this mode for key value backups

    // where the order does not matter.

    INLINE_LENGTHS = 2;

}

// Chunk entry (for local state)

message Chunk {

    // SHA-256 MAC of the plaintext of the chunk

    optional bytes hash = 1;

    // Number of bytes in encrypted chunk

    optional int32 length = 2;

}

// List of the chunks in the blob, along with the length of each chunk. From this is it possible to

// extract individual chunks. (i.e., start position is equal to the sum of the lengths of all

// preceding chunks.)

//

// This is local state stored on the device. It is never sent to the backup server. See

// ChunkOrdering for how the device restores the chunks in the correct order.

// Next tag : 6

message ChunkListing {

    repeated Chunk chunks = 1;

    // Cipher algorithm with which the chunks are encrypted.

    optional CipherType cipher_type = 2;

    // Defines the type of chunk order used to encode the backup file on the server, so that we can

    // consistently use the same type between backups. If unspecified this backup file was created

    // before INLINE_LENGTHS was supported, thus assume it is EXPLICIT_STARTS.

    optional ChunkOrderingType chunk_ordering_type = 5;

    // The document ID returned from Scotty server after uploading the blob associated with this

    // listing. This needs to be sent when uploading new diff scripts.

    optional string document_id = 3;

    // Fingerprint mixer salt used for content defined chunking. This is randomly generated for each

    // package during the initial non-incremental backup and reused for incremental backups.

    optional bytes fingerprint_mixer_salt = 4;

}

// Ordering information about plaintext and checksum. This is used on restore to reconstruct the

// blob in its correct order. (The chunk order is randomized so as to give the server less

// information about which parts of the backup are changing over time.) This proto is encrypted

// before being uploaded to the server, with a key unknown to the server.

message ChunkOrdering {

    // For backups where ChunksMetadata#chunk_ordering_type = EXPLICIT STARTS:

    // Ordered start positions of chunks. i.e., the file is the chunk starting at this position,

    // followed by the chunk starting at this position, followed by ... etc. You can compute the

    // lengths of the chunks by sorting this list then looking at the start position of the next

    // chunk after the chunk you care about. This is guaranteed to work as all chunks are

    // represented in this list.

    //

    // For backups where ChunksMetadata#chunk_ordering_type = INLINE_LENGTHS:

    // This field is unused. See ChunkOrderingType#INLINE_LENGTHS.

    repeated int32 starts = 1 [packed = true];

    // Checksum of plaintext content. (i.e., in correct order.)

    //

    // Each chunk also has a MAC, as generated by GCM, so this is NOT Mac-then-Encrypt, which has

    // security implications. This is an additional checksum to verify that once the chunks have

    // been reordered, that the file matches the expected plaintext. This prevents the device

    // restoring garbage data in case of a mismatch between the ChunkOrdering and the backup blob.

    optional bytes checksum = 2;

}

// Additional metadata about a backup blob that needs to be synced to the server. This is used on

// restore to reconstruct the blob in its correct order. (The chunk order is randomized so as to

// give the server less information about which parts of the backup are changing over time.) This

// data structure is only ever uploaded to the server encrypted with a key unknown to the server.

// Next tag : 6

message ChunksMetadata {

    // Cipher algorithm with which the chunk listing and chunks are encrypted.

    optional CipherType cipher_type = 1;

    // Defines the type of chunk order this metadata contains. If unspecified this backup file was

    // created before INLINE_LENGTHS was supported, thus assume it is EXPLICIT_STARTS.

    optional ChunkOrderingType chunk_ordering_type = 5

    [default = CHUNK_ORDERING_TYPE_UNSPECIFIED];

    // Encrypted bytes of ChunkOrdering

    optional bytes chunk_ordering = 2;

    // The type of algorithm used for the checksum of the plaintext. (See ChunkOrdering.) This is

    // for forwards compatibility in case we change the algorithm in the future. For now, always

    // SHA-256.

    optional ChecksumType checksum_type = 3;

    // This used to be the plaintext tertiary key. No longer used.

    reserved 4;

}

 No newline at end of file

package com.android.server.backup.encryption.chunk;

import android.util.proto.ProtoInputStream;

import java.io.IOException;

/**

 * Information about a chunk entry in a protobuf. Only used for reading from a {@link

 * ProtoInputStream}.

 */

public class Chunk {

    /**

     * Reads a Chunk from a {@link ProtoInputStream}. Expects the message to be of format {@link

     * ChunksMetadataProto.Chunk}.

     *

     * @param inputStream currently at a {@link ChunksMetadataProto.Chunk} message.

     * @throws IOException when the message is not structured as expected or a field can not be

     *     read.

     */

    static Chunk readFromProto(ProtoInputStream inputStream) throws IOException {

        Chunk result = new Chunk();

        while (inputStream.nextField() != ProtoInputStream.NO_MORE_FIELDS) {

            switch (inputStream.getFieldNumber()) {

                case (int) ChunksMetadataProto.Chunk.HASH:

                    result.mHash = inputStream.readBytes(ChunksMetadataProto.Chunk.HASH);

                    break;

                case (int) ChunksMetadataProto.Chunk.LENGTH:

                    result.mLength = inputStream.readInt(ChunksMetadataProto.Chunk.LENGTH);

                    break;

            }

        }

        return result;

    }

    private int mLength;

    private byte[] mHash;

    /** Private constructor. This class should only be instantiated by calling readFromProto. */

    private Chunk() {

        // Set default values for fields in case they are not available in the proto.

        mHash = new byte[]{};

        mLength = 0;

    }

    public int getLength() {

        return mLength;

    }

    public byte[] getHash() {

        return mHash;

    }

}

 No newline at end of file

/*

 * Copyright (C) 2018 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License

 */

package com.android.server.backup.encryption.chunk;

import android.annotation.Nullable;

import android.util.proto.ProtoInputStream;

import java.io.IOException;

import java.util.Collections;

import java.util.HashMap;

import java.util.Map;

/**

 * Chunk listing in a format optimized for quick look-up of chunks via their hash keys. This is

 * useful when building an incremental backup. After a chunk has been produced, the algorithm can

 * quickly look up whether the chunk existed in the previous backup by checking this chunk listing.

 * It can then tell the server to use that chunk, through telling it the position and length of the

 * chunk in the previous backup's blob.

 */

public class ChunkListing {

    /**

     * Reads a ChunkListing from a {@link ProtoInputStream}. Expects the message to be of format

     * {@link ChunksMetadataProto.ChunkListing}.

     *

     * @param inputStream Currently at a {@link ChunksMetadataProto.ChunkListing} message.

     * @throws IOException when the message is not structured as expected or a field can not be

     *     read.

     */

    public static ChunkListing readFromProto(ProtoInputStream inputStream) throws IOException {

        Map<ChunkHash, Entry> entries = new HashMap();

        long start = 0;

        while (inputStream.nextField() != ProtoInputStream.NO_MORE_FIELDS) {

            if (inputStream.getFieldNumber() == (int) ChunksMetadataProto.ChunkListing.CHUNKS) {

                long chunkToken = inputStream.start(ChunksMetadataProto.ChunkListing.CHUNKS);

                Chunk chunk = Chunk.readFromProto(inputStream);

                entries.put(new ChunkHash(chunk.getHash()), new Entry(start, chunk.getLength()));

                start += chunk.getLength();

                inputStream.end(chunkToken);

            }

        }

        return new ChunkListing(entries);

    }

    private final Map<ChunkHash, Entry> mChunksByHash;

    private ChunkListing(Map<ChunkHash, Entry> chunksByHash) {

        mChunksByHash = Collections.unmodifiableMap(new HashMap<>(chunksByHash));

    }

    /** Returns {@code true} if there is a chunk with the given SHA-256 MAC key in the listing. */

    public boolean hasChunk(ChunkHash hash) {

        return mChunksByHash.containsKey(hash);

    }

    /**

     * Returns the entry for the chunk with the given hash.

     *

     * @param hash The SHA-256 MAC of the plaintext of the chunk.

     * @return The entry, containing position and length of the chunk in the backup blob, or null if

     *     it does not exist.

     */

    @Nullable

    public Entry getChunkEntry(ChunkHash hash) {

        return mChunksByHash.get(hash);

    }

    /** Returns the number of chunks in this listing. */

    public int getChunkCount() {

        return mChunksByHash.size();

    }

    /** Information about a chunk entry in a backup blob - i.e., its position and length. */

    public static final class Entry {

        private final int mLength;

        private final long mStart;

        private Entry(long start, int length) {

            mStart = start;

            mLength = length;

        }

        /** Returns the length of the chunk in bytes. */

        public int getLength() {

            return mLength;

        }

        /** Returns the start position of the chunk in the backup blob, in bytes. */

        public long getStart() {

            return mStart;

        }

    }

}

/*

 * Copyright (C) 2018 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License

 */

package com.android.server.backup.encryption.chunk;

import java.util.Arrays;

/**

 * Holds the bytes of an encrypted {@link ChunksMetadataProto.ChunkOrdering}.

 *

 * <p>TODO(b/116575321): After all code is ported, remove the factory method and rename

 * encryptedChunkOrdering() to getBytes().

 */

public class EncryptedChunkOrdering {

    /**

     * Constructs a new object holding the given bytes of an encrypted {@link

     * ChunksMetadataProto.ChunkOrdering}.

     *

     * <p>Note that this just holds an ordering which is already encrypted, it does not encrypt the

     * ordering.

     */

    public static EncryptedChunkOrdering create(byte[] encryptedChunkOrdering) {

        return new EncryptedChunkOrdering(encryptedChunkOrdering);

    }

    private final byte[] mEncryptedChunkOrdering;

    public byte[] encryptedChunkOrdering() {

        return mEncryptedChunkOrdering;

    }

    @Override

    public boolean equals(Object o) {

        if (this == o) {

            return true;

        }

        if (!(o instanceof EncryptedChunkOrdering)) {

            return false;

        }

        EncryptedChunkOrdering encryptedChunkOrdering = (EncryptedChunkOrdering) o;

        return Arrays.equals(

                mEncryptedChunkOrdering, encryptedChunkOrdering.mEncryptedChunkOrdering);

    }

    @Override

    public int hashCode() {

        return Arrays.hashCode(mEncryptedChunkOrdering);

    }

    private EncryptedChunkOrdering(byte[] encryptedChunkOrdering) {

        mEncryptedChunkOrdering = encryptedChunkOrdering;

    }

}

    $(call all-Iaidl-files-under, $(INTERNAL_BACKUP)) \

    $(call all-java-files-under, ../../core/java/android/app/backup) \

    $(call all-Iaidl-files-under, ../../core/java/android/app/backup) \

    $(call all-java-files-under, ../../core/java/android/util/proto) \

    ../../core/java/android/content/pm/PackageInfo.java \

    ../../core/java/android/app/IBackupAgent.aidl \

    ../../core/java/android/util/KeyValueSettingObserver.java \