abd61d968d
contentenc: rename constant "IVBitLen" to "DefaultIVBits" and clarify comment
...
128-bit IVs are NOT used everywhere.
2016-09-25 18:40:29 +02:00
b883dd10a6
reverse: add symlink encryption and Readlink support
2016-09-25 18:01:24 +02:00
12808138ef
contentenc: add "ExternalNonce" mode
...
This will be used for strong symlink encryption in reverse mode.
2016-09-25 17:44:19 +02:00
32e55261ca
fusefrontend: handle Readlink directly
...
Calling into go-fuse's loopbackFileSystem does not add
any value here.
2016-09-25 17:01:39 +02:00
ffdb7cd47a
reverse: more thorough longname stat test
...
Now also verifies the returned file size.
2016-09-25 16:43:17 +02:00
2050c7f3b3
reverse: add gcmsiv flag and associated tests
2016-09-25 16:43:17 +02:00
f8da264222
tests: smarter error handling in ResetTmpDir
...
Look at the error code from os.Remove and decide about the
right thing to do.
Gets rid of spurious fusermount error messages.
2016-09-25 16:43:17 +02:00
7bbf6ad6ea
reverse: derive file ID and block IVs from file paths
2016-09-25 16:43:17 +02:00
3a9bd92754
xray: add "gocryptfs-xray", on-disk-format exploration tool
...
Example output for a file encrypted in reverse mode:
Header: Version: 2, Id: 0b7f5e2574e4afa859a9bb156a2e7772
Block 0: IV: 0b7f5e2574e4afa859a9bb156a2e7773, Tag: bf39279ac6b1ccd852567aaf26ee386b, Len: 4128
Block 1: IV: 0b7f5e2574e4afa859a9bb156a2e7774, Tag: a4f0f9cde7f70a752254aa8fe7718699, Len: 4128
Block 2: IV: 0b7f5e2574e4afa859a9bb156a2e7775, Tag: b467b153016fc1d531818b65ab9e24f6, Len: 4128
Block 3: IV: 0b7f5e2574e4afa859a9bb156a2e7776, Tag: 1fcb7ffd8f1816fbe807df8148718a5c, Len: 4128
Block 4: IV: 0b7f5e2574e4afa859a9bb156a2e7777, Tag: a217e7933ef434c9f03ad931bb5fde9b, Len: 4128
Block 5: IV: 0b7f5e2574e4afa859a9bb156a2e7778, Tag: f3e6240d75cd66371a0b301111d6f1fc, Len: 4128
Block 6: IV: 0b7f5e2574e4afa859a9bb156a2e7779, Tag: bc85d322ebc7761ae5ef114ea3903a56, Len: 4128
Block 7: IV: 0b7f5e2574e4afa859a9bb156a2e777a, Tag: efda01c6b794690f939a12d6d49ac3af, Len: 4128
Block 8: IV: 0b7f5e2574e4afa859a9bb156a2e777b, Tag: b198329d489d1392080f710206932ff0, Len: 2907
2016-09-25 16:43:17 +02:00
6c52c1a6e6
reverse: add longname benchmark
2016-09-25 16:43:17 +02:00
52a6f4f71e
reverse: add longnameParentCache
...
findLongnameParent has to read the whole directory to find the
right file; add a simple cache to avoid most directory scans.
2016-09-25 16:43:17 +02:00
6ffd07f02a
tests: extractloop: use tmp dir based on script name
...
This is how this should be done as well in future test scripts.
2016-09-25 16:43:17 +02:00
a6a7b424f8
reverse: resolve long names in Open and GetAttr
...
The last patch added functionality for generating gocryptfs.longname.*
files, this patch adds support for mapping them back to the full
filenames.
Note that resolving a long name needs a full readdir. A cache
will be implemented later on to improve performance.
2016-09-25 16:43:17 +02:00
35bcc2dca2
reverse: transform long names in OpenDir
2016-09-25 16:43:17 +02:00
b34a665da4
nametransform: implement ReadDirIV without Openat
...
As ReadDirIV operates on a path anyway, opening the directory
has no clear safety advantage w.r.t. concurrent renames.
If the backing directory is a reverse-mounted gocryptfs filesystem,
each directory open is an OPENDIR, and this causes a full directory
read!
This patch improves the "ls -lR" performance of an
DIR --> gocryptfs-reverse --> gocryptfs
chain by a factor of ~10.
OPENDIR counts for ls -lR:
Before 15570
After 2745
2016-09-25 16:43:17 +02:00
01c18dbcab
nametransform: return EINVAL on invalid padding
...
With the generic fmt.Errorf we trigger a warning from go-fuse:
2016/09/21 21:42:31 can't convert error type: Invalid padding
2016-09-25 16:43:17 +02:00
d76e7aadb4
reverse: use dynamic inode numbers
...
...with stable mappings for hard-linked files.
2016-09-25 16:43:17 +02:00
5f726aaa9d
contentenc: add GCM-SIV support
...
Also add ReverseDummyNonce nonce generation.
2016-09-25 16:43:17 +02:00
90f0bdc224
main: init: refuse overwriting .gocryptfs.reverse.conf
2016-09-25 16:43:17 +02:00
7f87ed78f2
cryptocore: add support for GCM-SIV
2016-09-25 16:43:17 +02:00
d1762c5b95
reverse: fix GetAttr for gocryptfs.conf
...
And also don't return the encrypted version of
.gocryptfs.reverse.conf in readdir.
2016-09-25 16:43:17 +02:00
5fb6c5cf58
reverse: enable init functionality
2016-09-25 16:43:17 +02:00
72efa5c9b1
main: move initDir into its own file
2016-09-25 16:43:17 +02:00
9ad49088fa
main: add explicit exit after forkChild
...
Trying to make it more obvious what is happening.
2016-09-25 16:43:17 +02:00
d9db75ebd2
main: factor out cli arg parsing
...
The main function has gotten way too big.
2016-09-25 16:43:17 +02:00
3d59c7dd6a
reverse: add gocryptfs.conf passthrough
2016-09-25 16:43:17 +02:00
1932248446
reverse: get rid of debug message
2016-09-25 16:43:17 +02:00
ce22ab36e1
reverse: gocryptfs.diriv content was generated from wrong path
...
Should be derived from the directory name only.
2016-09-25 16:43:17 +02:00
7faa267bd4
reverse: rename readFile to clearer readBackingFile
...
Also refactor the header generation for nicer code.
2016-09-25 16:43:17 +02:00
be9dfe3a89
reverse: implement dynamic diriv
...
Introduce a unique per-directory diriv that is generated
by hashing the encrypted directory path.
2016-09-25 16:43:17 +02:00
10f38e8870
reverse: generate file header for Read()
...
Also create virtual gocryptfs.diriv entries (no content yet).
2016-09-25 16:43:17 +02:00
ac1221395e
nametransform: export DirIVLen constant
...
Will be needed by reverse mode.
2016-09-25 16:43:17 +02:00
e42ab3908d
reverse: print value in file offset panic
2016-09-25 16:43:17 +02:00
a34b447ad1
reverse: let the kernel enforce read-only mode
...
... and print a warning that reverse mode is experimental
2016-09-25 16:43:17 +02:00
777eb8e62f
reverse: rename types to reverseXYZ
...
...to prevent confusion with the forward variants.
FS -> reverseFS
file -> reverseFile
Also add an incomplete read implementation.
2016-09-25 16:43:17 +02:00
5931eea387
contentenc: add helpers for reverse mode
...
Add the reverse variant of DecryptBlocks etc:
* EncryptBlocks
* JointPlaintextRange
* ExplodeCipherRange
2016-09-25 16:43:17 +02:00
1d4c6288f2
main: initial support for reverse mode
2016-09-25 16:43:17 +02:00
1d62086742
conentenc: handle zero-sized files in PlainSizeToCipherSize
...
Previously caused an integer underflow.
2016-09-25 16:43:17 +02:00
9237b4f53e
reverse: add skeleton
...
Compiles but does not do much else.
2016-09-25 16:43:17 +02:00
f6d4d240e6
tests: skip the nanosecond compare for now
2016-09-25 16:42:29 +02:00
fca1b82417
fusefrontend: relay Utimens to go-fuse
...
Commit af5441dcd9https://github.com/rfjakob/gocryptfs/issues/35 )
that is fixed by this commit.
The go-fuse library by now has all the syscall wrappers in
place to correctly handle Utimens, also for symlinks.
Instead of duplicating the effort here just call into go-fuse.
Closes #35
2016-09-25 16:30:29 +02:00
8f1e51789d
tests: set the times on a symlink
...
This currently fails as reported in
https://github.com/rfjakob/gocryptfs/issues/35 .
Also remove the spurious sleep in the test.
2016-09-25 16:17:26 +02:00
af5441dcd9
fusefrontend: use NsecToTimespec() for Utimens
...
This fixes a build problem on 32-bit hosts:
internal/fusefrontend/file.go:400: cannot use a.Unix() (type int64) as
type int32 in assignment
internal/fusefrontend/file.go:406: cannot use m.Unix() (type int64) as
type int32 in assignment
It also enables full nanosecond timestamps for dates
after 1970.
2016-08-09 22:18:46 +02:00
fc0de96763
tests: add TestUtimesNano
...
Make sure setting nanoseconds works by path and fd.
2016-08-09 22:10:25 +02:00
7395b8e990
cryptocore: comment why 96-bit IVs are still supported
2016-07-31 13:36:38 +02:00
02aab5d21f
Drop obsolete .drone.yml
...
Drone CI may make sense in the future when I set up a private
instance that supports FUSE, but for now it provides no advantages
to Travis CI.
2016-07-21 21:33:10 +02:00
2e519b9609
Update README for v1.0
2016-07-17 12:19:50 +02:00
0a3225b1eb
tests: add RSS tracking to extractloop
...
This obsoletes loopback-mem.bash.
2016-07-16 21:20:54 +02:00
6b50f2debc
tests: factor out fs-agnostic benchmark script
...
"canonical-benchmarks.bash TESTDIR"
can now be used on any filesystem.
2016-07-16 18:08:01 +02:00
d3940c6263
tests: add maxlen.bash helper
...
Simple script that finds out the maximum supported filename
length.
2016-07-16 14:10:17 +02:00
Jakob Unterwurzacher