2016-02-06 19:20:54 +01:00
|
|
|
package nametransform
|
2015-11-27 00:03:10 +01:00
|
|
|
|
|
|
|
import (
|
2016-04-10 19:32:10 +02:00
|
|
|
"errors"
|
2015-11-27 22:18:36 +01:00
|
|
|
"io/ioutil"
|
2016-01-25 00:51:28 +01:00
|
|
|
"os"
|
2015-11-27 22:18:36 +01:00
|
|
|
"path/filepath"
|
2015-11-27 00:03:10 +01:00
|
|
|
"strings"
|
2016-02-07 14:02:09 +01:00
|
|
|
"syscall"
|
2016-02-06 19:20:54 +01:00
|
|
|
|
|
|
|
"github.com/rfjakob/gocryptfs/internal/cryptocore"
|
2016-07-03 20:17:40 +02:00
|
|
|
"github.com/rfjakob/gocryptfs/internal/syscallcompat"
|
2016-06-15 23:30:44 +02:00
|
|
|
"github.com/rfjakob/gocryptfs/internal/tlog"
|
2016-02-06 19:20:54 +01:00
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
|
|
|
// identical to AES block size
|
2016-09-02 23:39:50 +02:00
|
|
|
DirIVLen = 16
|
2016-02-06 19:20:54 +01:00
|
|
|
// dirIV is stored in this file. Exported because we have to ignore this
|
|
|
|
// name in directory listing.
|
2016-02-06 20:23:36 +01:00
|
|
|
DirIVFilename = "gocryptfs.diriv"
|
2015-11-27 00:03:10 +01:00
|
|
|
)
|
|
|
|
|
2016-02-06 22:54:14 +01:00
|
|
|
// ReadDirIV - read the "gocryptfs.diriv" file from "dir" (absolute ciphertext path)
|
2016-04-10 19:32:10 +02:00
|
|
|
// This function is exported because it allows for an efficient readdir implementation.
|
|
|
|
func ReadDirIV(dir string) (iv []byte, err error) {
|
2016-09-21 23:22:13 +02:00
|
|
|
fd, err := os.Open(filepath.Join(dir, DirIVFilename))
|
2016-04-10 19:32:10 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
2015-11-27 22:20:01 +01:00
|
|
|
}
|
2016-09-21 23:22:13 +02:00
|
|
|
defer fd.Close()
|
|
|
|
return fdReadDirIV(fd)
|
2016-04-10 19:32:10 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
// ReadDirIVAt reads "gocryptfs.diriv" from the directory that is opened as "dirfd".
|
|
|
|
// Using the dirfd makes it immune to concurrent renames of the directory.
|
|
|
|
func ReadDirIVAt(dirfd *os.File) (iv []byte, err error) {
|
2016-07-03 20:17:40 +02:00
|
|
|
fdRaw, err := syscallcompat.Openat(int(dirfd.Fd()), DirIVFilename, syscall.O_RDONLY, 0)
|
2016-04-10 19:32:10 +02:00
|
|
|
if err != nil {
|
2016-06-15 23:30:44 +02:00
|
|
|
tlog.Warn.Printf("ReadDirIVAt: opening %q in dir %q failed: %v",
|
2016-06-01 20:07:43 +02:00
|
|
|
DirIVFilename, dirfd.Name(), err)
|
2016-04-10 19:32:10 +02:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
fd := os.NewFile(uintptr(fdRaw), DirIVFilename)
|
|
|
|
defer fd.Close()
|
2016-09-21 23:22:13 +02:00
|
|
|
return fdReadDirIV(fd)
|
|
|
|
}
|
2016-04-10 19:32:10 +02:00
|
|
|
|
2016-09-21 23:22:13 +02:00
|
|
|
// fdReadDirIV reads and verifies the DirIV from an opened gocryptfs.diriv file.
|
|
|
|
func fdReadDirIV(fd *os.File) (iv []byte, err error) {
|
2016-09-02 23:39:50 +02:00
|
|
|
// We want to detect if the file is bigger than DirIVLen, so
|
|
|
|
// make the buffer 1 byte bigger than neccessary.
|
|
|
|
iv = make([]byte, DirIVLen+1)
|
2016-04-10 19:32:10 +02:00
|
|
|
n, err := fd.Read(iv)
|
|
|
|
if err != nil {
|
2016-06-15 23:30:44 +02:00
|
|
|
tlog.Warn.Printf("ReadDirIVAt: Read failed: %v", err)
|
2016-04-10 19:32:10 +02:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
iv = iv[0:n]
|
2016-09-02 23:39:50 +02:00
|
|
|
if len(iv) != DirIVLen {
|
|
|
|
tlog.Warn.Printf("ReadDirIVAt: wanted %d bytes, got %d", DirIVLen, len(iv))
|
2016-04-10 19:32:10 +02:00
|
|
|
return nil, errors.New("invalid iv length")
|
2015-11-27 22:20:01 +01:00
|
|
|
}
|
|
|
|
return iv, nil
|
2015-11-27 00:03:10 +01:00
|
|
|
}
|
|
|
|
|
2015-11-29 19:57:48 +01:00
|
|
|
// WriteDirIV - create diriv file inside "dir" (absolute ciphertext path)
|
2015-11-27 23:34:55 +01:00
|
|
|
// This function is exported because it is used from pathfs_frontend, main,
|
|
|
|
// and also the automated tests.
|
|
|
|
func WriteDirIV(dir string) error {
|
2016-09-02 23:39:50 +02:00
|
|
|
iv := cryptocore.RandBytes(DirIVLen)
|
2016-02-06 19:20:54 +01:00
|
|
|
file := filepath.Join(dir, DirIVFilename)
|
2016-04-10 19:32:10 +02:00
|
|
|
err := ioutil.WriteFile(file, iv, 0400)
|
|
|
|
if err != nil {
|
2016-06-15 23:30:44 +02:00
|
|
|
tlog.Warn.Printf("WriteDirIV: %v", err)
|
2016-04-10 19:32:10 +02:00
|
|
|
}
|
|
|
|
return err
|
2015-11-27 21:48:58 +01:00
|
|
|
}
|
|
|
|
|
2016-02-07 14:02:09 +01:00
|
|
|
// EncryptPathDirIV - encrypt relative plaintext path using EME with DirIV.
|
2016-04-10 19:32:10 +02:00
|
|
|
// Components that are longer than 255 bytes are hashed if be.longnames == true.
|
2016-02-06 19:20:54 +01:00
|
|
|
func (be *NameTransform) EncryptPathDirIV(plainPath string, rootDir string) (cipherPath string, err error) {
|
2015-11-27 00:03:10 +01:00
|
|
|
// Empty string means root directory
|
|
|
|
if plainPath == "" {
|
|
|
|
return plainPath, nil
|
|
|
|
}
|
2016-02-07 14:02:09 +01:00
|
|
|
// Reject names longer than 255 bytes already here. This relieves everybody
|
|
|
|
// who uses hashed long names from checking for that later.
|
|
|
|
baseName := filepath.Base(plainPath)
|
|
|
|
if len(baseName) > syscall.NAME_MAX {
|
|
|
|
return "", syscall.ENAMETOOLONG
|
|
|
|
}
|
2015-11-29 21:41:38 +01:00
|
|
|
// Check if the DirIV is cached
|
|
|
|
parentDir := filepath.Dir(plainPath)
|
2016-02-06 12:27:09 +01:00
|
|
|
found, iv, cParentDir := be.DirIVCache.lookup(parentDir)
|
2015-11-29 21:41:38 +01:00
|
|
|
if found {
|
2016-02-06 22:54:14 +01:00
|
|
|
cBaseName := be.EncryptName(baseName, iv)
|
|
|
|
if be.longNames && len(cBaseName) > syscall.NAME_MAX {
|
|
|
|
cBaseName = HashLongName(cBaseName)
|
|
|
|
}
|
2015-12-08 16:13:29 +01:00
|
|
|
cipherPath = cParentDir + "/" + cBaseName
|
|
|
|
return cipherPath, nil
|
2015-11-29 21:41:38 +01:00
|
|
|
}
|
2016-02-07 14:02:09 +01:00
|
|
|
// Not cached - walk the directory tree
|
2015-11-27 00:03:10 +01:00
|
|
|
var wd = rootDir
|
|
|
|
var encryptedNames []string
|
|
|
|
plainNames := strings.Split(plainPath, "/")
|
|
|
|
for _, plainName := range plainNames {
|
2016-02-06 22:54:14 +01:00
|
|
|
iv, err = ReadDirIV(wd)
|
2015-11-27 00:03:10 +01:00
|
|
|
if err != nil {
|
|
|
|
return "", err
|
|
|
|
}
|
2016-02-06 22:54:14 +01:00
|
|
|
encryptedName := be.EncryptName(plainName, iv)
|
|
|
|
if be.longNames && len(encryptedName) > syscall.NAME_MAX {
|
|
|
|
encryptedName = HashLongName(encryptedName)
|
|
|
|
}
|
2015-11-27 00:03:10 +01:00
|
|
|
encryptedNames = append(encryptedNames, encryptedName)
|
|
|
|
wd = filepath.Join(wd, encryptedName)
|
|
|
|
}
|
2015-12-08 16:13:29 +01:00
|
|
|
cipherPath = strings.Join(encryptedNames, "/")
|
2016-02-06 22:54:14 +01:00
|
|
|
// Cache the final DirIV
|
2015-12-08 16:13:29 +01:00
|
|
|
cParentDir = filepath.Dir(cipherPath)
|
2016-02-06 12:27:09 +01:00
|
|
|
be.DirIVCache.store(parentDir, iv, cParentDir)
|
2015-12-08 16:13:29 +01:00
|
|
|
return cipherPath, nil
|
2015-11-27 00:03:10 +01:00
|
|
|
}
|