Bound snapshot generation witness scans

Author: eldryoth

CHANGELOG.md

@@ -55,6 +55,9 @@ behavior when the change improves security or project direction.
 - Return snapshot crypto-provider failures to the administrative caller instead
   of aborting the process, and reject missing or replayed generation state when
   retained snapshot metadata proves a higher generation.
+- Verify generation freshness through bounded per-snapshot HMAC witnesses rather
+  than rereading and hashing every retained config under the store lock, and
+  remove the snapshot crate's unused direct logging dependency.
 - Make OpenSSL cipher allow-lists deterministic across protocol families:
   omitting all TLS 1.2 or TLS 1.3 suites now disables that protocol version
   instead of retaining Mozilla acceptor defaults. Use the current Mozilla v5

Cargo.lock

@@ -9,7 +9,6 @@ description = "Internal Fluxheim configuration snapshot store."
 
 [dependencies]
 fluxheim-config = { path = "../fluxheim-config" }
-log = "0.4.33"
 rustix = { version = "1.1.4", features = ["fs"] }
 sanitization = { version = "1.2.4", features = ["alloc"] }
 serde = { version = "1.0.228", features = ["derive"] }

crates/fluxheim-snapshot/Cargo.toml

@@ -1,8 +1,18 @@
+use std::fs;
+
 use serde::{Deserialize, Serialize};
 
-use crate::integrity::GENERATION_MAC_LABEL;
+use crate::integrity::{
+    GENERATION_MAC_LABEL, MAX_INTEGRITY_MANIFEST_BYTES, SnapshotIntegrityManifest,
+};
+use crate::metadata::{
+    MAX_SNAPSHOT_METADATA_BYTES, SnapshotMetadata, validate_snapshot_id, validate_snapshot_metadata,
+};
 use crate::store::{SnapshotError, SnapshotStore};
-use crate::store_fs::{read_optional_regular_file_to_string_with_limit, write_atomically};
+use crate::store_fs::{
+    read_optional_regular_file_to_string_with_limit, read_regular_file_to_string_with_limit,
+    regular_snapshot_file_exists, write_atomically,
+};
 
 const MAX_GENERATION_STATE_BYTES: usize = 4096;
 
@@ -112,11 +122,67 @@ impl SnapshotStore {
     }
 
     fn observed_max_generation(&self) -> Result<u64, SnapshotError> {
-        Ok(self
-            .list()?
-            .into_iter()
-            .map(|snapshot| snapshot.metadata.generation)
-            .max()
-            .unwrap_or(0))
+        if !self.safe_existing_configs_dir()? {
+            return Ok(0);
+        }
+        if let Some(key) = self.integrity.as_deref() {
+            return self.observed_authenticated_generation(key);
+        }
+        self.observed_unverified_generation()
+    }
+
+    fn observed_authenticated_generation(
+        &self,
+        key: &crate::integrity::SnapshotIntegrityKey,
+    ) -> Result<u64, SnapshotError> {
+        let mut maximum = 0;
+        for entry in fs::read_dir(self.configs_dir()).map_err(SnapshotError::Io)? {
+            let path = entry.map_err(SnapshotError::Io)?.path();
+            if path.extension().and_then(|extension| extension.to_str()) != Some("toml") {
+                continue;
+            }
+            let Some(id) = path.file_stem().and_then(|stem| stem.to_str()) else {
+                return Err(SnapshotError::GenerationStateInvalid);
+            };
+            if id.ends_with(".meta") || id.ends_with(".integrity") {
+                continue;
+            }
+            validate_snapshot_id(id).map_err(|_| SnapshotError::GenerationStateInvalid)?;
+            if !regular_snapshot_file_exists(&path)? {
+                return Err(SnapshotError::GenerationStateInvalid);
+            }
+            let raw = read_regular_file_to_string_with_limit(
+                &self.integrity_path(id),
+                MAX_INTEGRITY_MANIFEST_BYTES,
+            )?;
+            let manifest: SnapshotIntegrityManifest =
+                toml::from_str(&raw).map_err(|_| SnapshotError::GenerationStateInvalid)?;
+            let generation = key
+                .verify_generation_witness(id, &manifest)
+                .map_err(|_| SnapshotError::GenerationStateInvalid)?;
+            maximum = maximum.max(generation);
+        }
+        Ok(maximum)
+    }
+
+    fn observed_unverified_generation(&self) -> Result<u64, SnapshotError> {
+        let mut maximum = 0;
+        for entry in fs::read_dir(self.configs_dir()).map_err(SnapshotError::Io)? {
+            let path = entry.map_err(SnapshotError::Io)?.path();
+            let Some(name) = path.file_name().and_then(|name| name.to_str()) else {
+                return Err(SnapshotError::GenerationStateInvalid);
+            };
+            let Some(id) = name.strip_suffix(".meta.toml") else {
+                continue;
+            };
+            validate_snapshot_id(id).map_err(|_| SnapshotError::GenerationStateInvalid)?;
+            let raw = read_regular_file_to_string_with_limit(&path, MAX_SNAPSHOT_METADATA_BYTES)?;
+            let metadata: SnapshotMetadata =
+                toml::from_str(&raw).map_err(|_| SnapshotError::GenerationStateInvalid)?;
+            validate_snapshot_metadata(&metadata, id)
+                .map_err(|_| SnapshotError::GenerationStateInvalid)?;
+            maximum = maximum.max(metadata.generation);
+        }
+        Ok(maximum)
     }
 }

crates/fluxheim-snapshot/src/generation.rs

@@ -12,9 +12,11 @@ use crate::store_fs::require_private_regular_file;
 pub(crate) const MAX_INTEGRITY_KEY_BYTES: u64 = 4096;
 const MIN_INTEGRITY_KEY_BYTES: usize = 32;
 const SNAPSHOT_MAC_LABEL: &[u8] = b"fluxheim-snapshot-v1\0";
+const GENERATION_WITNESS_MAC_LABEL: &[u8] = b"fluxheim-snapshot-generation-witness-v1\0";
 const RECOVERY_MAC_LABEL: &[u8] = b"fluxheim-snapshot-recovery-v1\0";
 pub(crate) const GENERATION_MAC_LABEL: &[u8] = b"fluxheim-snapshot-generation-v1\0";
 pub(crate) const PRUNE_BOUNDARY_MAC_LABEL: &[u8] = b"fluxheim-snapshot-prune-boundary-v1\0";
+pub(crate) const MAX_INTEGRITY_MANIFEST_BYTES: u64 = 4096;
 
 pub trait SnapshotCryptoProvider: std::fmt::Debug + Send + Sync {
     fn label(&self) -> &'static str;
@@ -38,6 +40,8 @@ pub(crate) struct SnapshotIntegrityManifest {
     pub key_id: String,
     pub config_sha256: String,
     pub metadata_hmac_sha256: String,
+    pub generation: u64,
+    pub generation_hmac_sha256: String,
 }
 
 impl SnapshotIntegrityKey {
@@ -89,17 +93,21 @@ impl SnapshotIntegrityKey {
         id: &str,
         config: &[u8],
         metadata: &[u8],
+        generation: u64,
     ) -> Result<SnapshotIntegrityManifest, SnapshotError> {
         let config_digest = self
             .provider
             .sha256(&[config])
             .map_err(SnapshotError::CryptoProvider)?;
         let signature = self.sign_result(id, config, metadata)?;
+        let generation_signature = self.sign_generation_witness(id, generation)?;
         Ok(SnapshotIntegrityManifest {
             algorithm: "hmac-sha256".to_owned(),
             key_id: self.key_id.clone(),
             config_sha256: hex(&config_digest),
             metadata_hmac_sha256: hex(&signature),
+            generation,
+            generation_hmac_sha256: hex(&generation_signature),
         })
     }
 
@@ -153,6 +161,7 @@ impl SnapshotIntegrityKey {
         id: &str,
         config: &[u8],
         metadata: &[u8],
+        generation: u64,
         manifest: &SnapshotIntegrityManifest,
     ) -> Result<(), SnapshotError> {
         if manifest.algorithm != "hmac-sha256" || manifest.key_id != self.key_id {
@@ -166,6 +175,10 @@ impl SnapshotIntegrityKey {
         if config_digest != manifest.config_sha256 {
             return Err(SnapshotError::IntegrityVerificationFailed { id: id.to_owned() });
         }
+        if manifest.generation != generation {
+            return Err(SnapshotError::IntegrityVerificationFailed { id: id.to_owned() });
+        }
+        self.verify_generation_witness(id, manifest)?;
         let expected = decode_hex_32(&manifest.metadata_hmac_sha256)
             .ok_or_else(|| SnapshotError::IntegrityVerificationFailed { id: id.to_owned() })?;
         if self
@@ -179,6 +192,49 @@ impl SnapshotIntegrityKey {
         }
     }
 
+    pub(crate) fn verify_generation_witness(
+        &self,
+        id: &str,
+        manifest: &SnapshotIntegrityManifest,
+    ) -> Result<u64, SnapshotError> {
+        crate::metadata::validate_snapshot_id(id)?;
+        if manifest.algorithm != "hmac-sha256" || manifest.key_id != self.key_id {
+            return Err(SnapshotError::IntegrityVerificationFailed { id: id.to_owned() });
+        }
+        let expected = decode_hex_32(&manifest.generation_hmac_sha256)
+            .ok_or_else(|| SnapshotError::IntegrityVerificationFailed { id: id.to_owned() })?;
+        if self
+            .sign_generation_witness(id, manifest.generation)?
+            .ct_eq(&expected)
+            .declassify("snapshot generation witness result is public")
+        {
+            Ok(manifest.generation)
+        } else {
+            Err(SnapshotError::IntegrityVerificationFailed { id: id.to_owned() })
+        }
+    }
+
+    fn sign_generation_witness(
+        &self,
+        id: &str,
+        generation: u64,
+    ) -> Result<[u8; 32], SnapshotError> {
+        let id_length = encoded_length(id.len())?;
+        self.secret
+            .with_secret(|secret| {
+                self.provider.hmac_sha256(
+                    secret,
+                    &[
+                        GENERATION_WITNESS_MAC_LABEL,
+                        &id_length,
+                        id.as_bytes(),
+                        &generation.to_be_bytes(),
+                    ],
+                )
+            })
+            .map_err(SnapshotError::CryptoProvider)
+    }
+
     fn sign_result(
         &self,
         id: &str,

crates/fluxheim-snapshot/src/integrity.rs

@@ -4,6 +4,7 @@ use crate::store::SnapshotError;
 
 pub const MAX_SNAPSHOT_ID_BYTES: usize = 128;
 pub const MAX_SNAPSHOT_MESSAGE_BYTES: usize = 4096;
+pub(crate) const MAX_SNAPSHOT_METADATA_BYTES: u64 = 16 * 1024;
 
 #[derive(Debug, Clone, Default, Eq, PartialEq, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]