hardcoresushi/libgocryptfs
1
0
Fork 0
Code Issues Pull Requests Releases Activity

nametransform: fix Raw64 not affecting symlink targets

Browse Source 
The symlink functions incorrectly hardcoded the padded
base64 variant.
This commit is contained in:
Jakob Unterwurzacher 2017-03-05 22:59:25 +01:00
parent 5b54577d2e
commit 445b5019e3
4 changed files with 10 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
internal/fusefrontend/fs.go
View File

@ -4,7 +4,6 @@ package fusefrontend
// FUSE operations on paths // FUSE operations on paths
import ( import (
"encoding/base64"
"os" "os"
"path/filepath" "path/filepath"
"sync" "sync"
@ -298,7 +297,7 @@ func (fs *FS) Readlink(path string, context *fuse.Context) (out string, status f
return cTarget, fuse.OK return cTarget, fuse.OK
} }
// Symlinks are encrypted like file contents (GCM) and base64-encoded // Symlinks are encrypted like file contents (GCM) and base64-encoded
cBinTarget, err := base64.URLEncoding.DecodeString(cTarget) cBinTarget, err := fs.nameTransform.B64.DecodeString(cTarget)
if err != nil { if err != nil {
tlog.Warn.Printf("Readlink: %v", err) tlog.Warn.Printf("Readlink: %v", err)
return "", fuse.EIO return "", fuse.EIO
@ -362,7 +361,7 @@ func (fs *FS) Symlink(target string, linkName string, context *fuse.Context) (co
} }
// Symlinks are encrypted like file contents (GCM) and base64-encoded // Symlinks are encrypted like file contents (GCM) and base64-encoded
cBinTarget := fs.contentEnc.EncryptBlock([]byte(target), 0, nil) cBinTarget := fs.contentEnc.EncryptBlock([]byte(target), 0, nil)
cTarget := base64.URLEncoding.EncodeToString(cBinTarget) cTarget := fs.nameTransform.B64.EncodeToString(cBinTarget)
// Handle long file name // Handle long file name
cName := filepath.Base(cPath) cName := filepath.Base(cPath)
if nametransform.IsLongContent(cName) { if nametransform.IsLongContent(cName) {

3
internal/fusefrontend_reverse/rfs.go
View File

@ -1,7 +1,6 @@
package fusefrontend_reverse package fusefrontend_reverse
import ( import (
"encoding/base64"
"fmt" "fmt"
"log" "log"
"os" "os"
@ -355,6 +354,6 @@ func (rfs *ReverseFS) Readlink(cipherPath string, context *fuse.Context) (string
nonce := derivePathIV(cipherPath, ivPurposeSymlinkIV) nonce := derivePathIV(cipherPath, ivPurposeSymlinkIV)
// Symlinks are encrypted like file contents and base64-encoded // Symlinks are encrypted like file contents and base64-encoded
cBinTarget := rfs.contentEnc.EncryptBlockNonce([]byte(plainTarget), 0, nil, nonce) cBinTarget := rfs.contentEnc.EncryptBlockNonce([]byte(plainTarget), 0, nil, nonce)
cTarget := base64.URLEncoding.EncodeToString(cBinTarget) cTarget := rfs.nameTransform.B64.EncodeToString(cBinTarget)
return cTarget, fuse.OK return cTarget, fuse.OK
} }

2
internal/nametransform/longnames.go
View File

@ -25,7 +25,7 @@ const (
// "gocryptfs.longname.[sha256]" // "gocryptfs.longname.[sha256]"
func (n *NameTransform) HashLongName(name string) string { func (n *NameTransform) HashLongName(name string) string {
hashBin := sha256.Sum256([]byte(name)) hashBin := sha256.Sum256([]byte(name))
hashBase64 := n.b64.EncodeToString(hashBin[:]) hashBase64 := n.B64.EncodeToString(hashBin[:])
return longNamePrefix + hashBase64 return longNamePrefix + hashBase64
} }

11
internal/nametransform/names.go
View File

@ -16,8 +16,9 @@ type NameTransform struct {
emeCipher *eme.EMECipher emeCipher *eme.EMECipher
longNames bool longNames bool
DirIVCache dirIVCache DirIVCache dirIVCache
// b64 = either base64.URLEncoding or base64.RawURLEncoding // B64 = either base64.URLEncoding or base64.RawURLEncoding, depeding
b64 *base64.Encoding // on the Raw64 feature flag
B64 *base64.Encoding
} }
// New returns a new NameTransform instance. // New returns a new NameTransform instance.
@ -29,7 +30,7 @@ func New(e *eme.EMECipher, longNames bool, raw64 bool) *NameTransform {
return &NameTransform{ return &NameTransform{
emeCipher: e, emeCipher: e,
longNames: longNames, longNames: longNames,
b64: b64, B64: b64,
} }
} }
@ -38,7 +39,7 @@ func New(e *eme.EMECipher, longNames bool, raw64 bool) *NameTransform {
// This function is exported because it allows for a very efficient readdir // This function is exported because it allows for a very efficient readdir
// implementation (read IV once, decrypt all names using this function). // implementation (read IV once, decrypt all names using this function).
func (n *NameTransform) DecryptName(cipherName string, iv []byte) (string, error) { func (n *NameTransform) DecryptName(cipherName string, iv []byte) (string, error) {
bin, err := n.b64.DecodeString(cipherName) bin, err := n.B64.DecodeString(cipherName)
if err != nil { if err != nil {
return "", err return "", err
} }
@ -69,6 +70,6 @@ func (n *NameTransform) EncryptName(plainName string, iv []byte) (cipherName64 s
bin := []byte(plainName) bin := []byte(plainName)
bin = pad16(bin) bin = pad16(bin)
bin = n.emeCipher.Encrypt(iv, bin) bin = n.emeCipher.Encrypt(iv, bin)
cipherName64 = n.b64.EncodeToString(bin) cipherName64 = n.B64.EncodeToString(bin)
return cipherName64 return cipherName64
} }