hardcoresushi
/
libgocryptfs
1
0
Fork 0
Code Issues Pull Requests Releases Activity

nametransform: hide detailed padding error behind the debug flag 

unPad16 returns detailed errors including the position of the
incorrect bytes. Kill a possible padding oracle by lumping
everything into a generic error.

The detailed error is only logged if debug is active.
This commit is contained in:
Jakob Unterwurzacher 2016-07-03 15:35:58 +02:00
parent d5b7eb33da
commit e574a6cc1f
2 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
internal/fusefrontend/fs_dir.go
View File

@ -265,7 +265,7 @@ func (fs *FS) OpenDir(dirName string, context *fuse.Context) ([]fuse.DirEntry, f
if isLong == nametransform.LongNameContent { if isLong == nametransform.LongNameContent {
cNameLong, err := nametransform.ReadLongName(filepath.Join(cDirAbsPath, cName)) cNameLong, err := nametransform.ReadLongName(filepath.Join(cDirAbsPath, cName))
if err != nil { if err != nil {
tlog.Warn.Printf("Skipping file %q in dir %q: Could not read .name: %v", tlog.Warn.Printf("Skipping entry %q in dir %q: Could not read .name: %v",
cName, cDirName, err) cName, cDirName, err)
errorCount++ errorCount++
continue continue
@ -278,7 +278,7 @@ func (fs *FS) OpenDir(dirName string, context *fuse.Context) ([]fuse.DirEntry, f
name, err := fs.nameTransform.DecryptName(cName, cachedIV) name, err := fs.nameTransform.DecryptName(cName, cachedIV)
if err != nil { if err != nil {
tlog.Warn.Printf("Skipping invalid name %q in dir %q: %s", tlog.Warn.Printf("Skipping entry %q in dir %q: %s",
cName, cDirName, err) cName, cDirName, err)
errorCount++ errorCount++
continue continue

7
internal/nametransform/names.go
View File

@ -10,6 +10,7 @@ import (
"github.com/rfjakob/eme" "github.com/rfjakob/eme"
"github.com/rfjakob/gocryptfs/internal/cryptocore" "github.com/rfjakob/gocryptfs/internal/cryptocore"
"github.com/rfjakob/gocryptfs/internal/tlog"
) )
type NameTransform struct { type NameTransform struct {
@ -42,7 +43,11 @@ func (n *NameTransform) DecryptName(cipherName string, iv []byte) (string, error
bin = eme.Transform(n.cryptoCore.BlockCipher, iv, bin, eme.DirectionDecrypt) bin = eme.Transform(n.cryptoCore.BlockCipher, iv, bin, eme.DirectionDecrypt)
bin, err = unPad16(bin) bin, err = unPad16(bin)
if err != nil { if err != nil {
return "", err tlog.Debug.Printf("pad16 error detail: %v", err)
// unPad16 returns detailed errors including the position of the
// incorrect bytes. Kill the padding oracle by lumping everything into
// a generic error.
return "", fmt.Errorf("Invalid padding")
} }
plain := string(bin) plain := string(bin)
return plain, err return plain, err