projects/linux·blob master · refs

629 lines · 17.2 KiB

1// SPDX-License-Identifier: GPL-2.0
2/*
3 * The base64 encode/decode code was copied from fscrypt:
4 * Copyright (C) 2015, Google, Inc.
5 * Copyright (C) 2015, Motorola Mobility
6 * Written by Uday Savagaonkar, 2014.
7 * Modified by Jaegeuk Kim, 2015.
8 */
9#include <linux/ceph/ceph_debug.h>
10#include <linux/xattr.h>
11#include <linux/fscrypt.h>
12#include <linux/ceph/striper.h>
13
14#include "super.h"
15#include "mds_client.h"
16#include "crypto.h"
17
18static int ceph_crypt_get_context(struct inode *inode, void *ctx, size_t len)
19{
20 struct ceph_inode_info *ci = ceph_inode(inode);
21 struct ceph_fscrypt_auth *cfa = (struct ceph_fscrypt_auth *)ci->fscrypt_auth;
22 u32 ctxlen;
23
24 /* Non existent or too short? */
25 if (!cfa || (ci->fscrypt_auth_len < (offsetof(struct ceph_fscrypt_auth, cfa_blob) + 1)))
26 return -ENOBUFS;
27
28 /* Some format we don't recognize? */
29 if (le32_to_cpu(cfa->cfa_version) != CEPH_FSCRYPT_AUTH_VERSION)
30 return -ENOBUFS;
31
32 ctxlen = le32_to_cpu(cfa->cfa_blob_len);
33 if (len < ctxlen)
34 return -ERANGE;
35
36 memcpy(ctx, cfa->cfa_blob, ctxlen);
37 return ctxlen;
38}
39
40static int ceph_crypt_set_context(struct inode *inode, const void *ctx,
41 size_t len, void *fs_data)
42{
43 int ret;
44 struct iattr attr = { };
45 struct ceph_iattr cia = { };
46 struct ceph_fscrypt_auth *cfa;
47
48 WARN_ON_ONCE(fs_data);
49
50 if (len > FSCRYPT_SET_CONTEXT_MAX_SIZE)
51 return -EINVAL;
52
53 cfa = kzalloc_obj(*cfa);
54 if (!cfa)
55 return -ENOMEM;
56
57 cfa->cfa_version = cpu_to_le32(CEPH_FSCRYPT_AUTH_VERSION);
58 cfa->cfa_blob_len = cpu_to_le32(len);
59 memcpy(cfa->cfa_blob, ctx, len);
60
61 cia.fscrypt_auth = cfa;
62
63 ret = __ceph_setattr(&nop_mnt_idmap, inode, &attr, &cia);
64 if (ret == 0)
65 inode_set_flags(inode, S_ENCRYPTED, S_ENCRYPTED);
66 kfree(cia.fscrypt_auth);
67 return ret;
68}
69
70static bool ceph_crypt_empty_dir(struct inode *inode)
71{
72 struct ceph_inode_info *ci = ceph_inode(inode);
73
74 return ci->i_rsubdirs + ci->i_rfiles == 1;
75}
76
77static const union fscrypt_policy *ceph_get_dummy_policy(struct super_block *sb)
78{
79 return ceph_sb_to_fs_client(sb)->fsc_dummy_enc_policy.policy;
80}
81
82static struct fscrypt_operations ceph_fscrypt_ops = {
83 .inode_info_offs = (int)offsetof(struct ceph_inode_info, i_crypt_info) -
84 (int)offsetof(struct ceph_inode_info, netfs.inode),
85 .needs_bounce_pages = 1,
86 .get_context = ceph_crypt_get_context,
87 .set_context = ceph_crypt_set_context,
88 .get_dummy_policy = ceph_get_dummy_policy,
89 .empty_dir = ceph_crypt_empty_dir,
90};
91
92void ceph_fscrypt_set_ops(struct super_block *sb)
93{
94 fscrypt_set_ops(sb, &ceph_fscrypt_ops);
95}
96
97void ceph_fscrypt_free_dummy_policy(struct ceph_fs_client *fsc)
98{
99 fscrypt_free_dummy_policy(&fsc->fsc_dummy_enc_policy);
100}
101
102int ceph_fscrypt_prepare_context(struct inode *dir, struct inode *inode,
103 struct ceph_acl_sec_ctx *as)
104{
105 int ret, ctxsize;
106 bool encrypted = false;
107 struct ceph_inode_info *ci = ceph_inode(inode);
108
109 ret = fscrypt_prepare_new_inode(dir, inode, &encrypted);
110 if (ret)
111 return ret;
112 if (!encrypted)
113 return 0;
114
115 as->fscrypt_auth = kzalloc_obj(*as->fscrypt_auth);
116 if (!as->fscrypt_auth)
117 return -ENOMEM;
118
119 ctxsize = fscrypt_context_for_new_inode(as->fscrypt_auth->cfa_blob,
120 inode);
121 if (ctxsize < 0)
122 return ctxsize;
123
124 as->fscrypt_auth->cfa_version = cpu_to_le32(CEPH_FSCRYPT_AUTH_VERSION);
125 as->fscrypt_auth->cfa_blob_len = cpu_to_le32(ctxsize);
126
127 WARN_ON_ONCE(ci->fscrypt_auth);
128 kfree(ci->fscrypt_auth);
129 ci->fscrypt_auth_len = ceph_fscrypt_auth_len(as->fscrypt_auth);
130 ci->fscrypt_auth = kmemdup(as->fscrypt_auth, ci->fscrypt_auth_len,
131 GFP_KERNEL);
132 if (!ci->fscrypt_auth)
133 return -ENOMEM;
134
135 inode->i_flags |= S_ENCRYPTED;
136
137 return 0;
138}
139
140void ceph_fscrypt_as_ctx_to_req(struct ceph_mds_request *req,
141 struct ceph_acl_sec_ctx *as)
142{
143 swap(req->r_fscrypt_auth, as->fscrypt_auth);
144}
145
146/*
147 * User-created snapshots can't start with '_'. Snapshots that start with this
148 * character are special (hint: there aren't real snapshots) and use the
149 * following format:
150 *
151 * _<SNAPSHOT-NAME>_<INODE-NUMBER>
152 *
153 * where:
154 * - <SNAPSHOT-NAME> - the real snapshot name that may need to be decrypted,
155 * - <INODE-NUMBER> - the inode number (in decimal) for the actual snapshot
156 *
157 * This function parses these snapshot names and returns the inode
158 * <INODE-NUMBER>. 'name_len' will also bet set with the <SNAPSHOT-NAME>
159 * length.
160 */
161static struct inode *parse_longname(const struct inode *parent,
162 const char *name, int *name_len)
163{
164 struct ceph_client *cl = ceph_inode_to_client(parent);
165 struct inode *dir = NULL;
166 struct ceph_vino vino = { .snap = CEPH_NOSNAP };
167 char *name_end, *inode_number;
168 int ret = -EIO;
169 /* Snapshot name must start with an underscore */
170 if (*name_len <= 0 || name[0] != '_')
171 return ERR_PTR(-EIO);
172 /* Skip initial '_' and NUL-terminate */
173 char *str __free(kfree) = kmemdup_nul(name + 1, *name_len - 1, GFP_KERNEL);
174 if (!str)
175 return ERR_PTR(-ENOMEM);
176 name_end = strrchr(str, '_');
177 if (!name_end) {
178 doutc(cl, "failed to parse long snapshot name: %s\n", str);
179 return ERR_PTR(-EIO);
180 }
181 *name_len = (name_end - str);
182 if (*name_len <= 0) {
183 pr_err_client(cl, "failed to parse long snapshot name\n");
184 return ERR_PTR(-EIO);
185 }
186
187 /* Get the inode number */
188 inode_number = name_end + 1;
189 ret = kstrtou64(inode_number, 10, &vino.ino);
190 if (ret) {
191 doutc(cl, "failed to parse inode number: %s\n", str);
192 return ERR_PTR(ret);
193 }
194
195 /* And finally the inode */
196 dir = ceph_find_inode(parent->i_sb, vino);
197 if (!dir) {
198 /* This can happen if we're not mounting cephfs on the root */
199 dir = ceph_get_inode(parent->i_sb, vino, NULL);
200 if (IS_ERR(dir))
201 doutc(cl, "can't find inode %s (%s)\n", inode_number, name);
202 }
203 return dir;
204}
205
206int ceph_encode_encrypted_dname(struct inode *parent, char *buf, int elen)
207{
208 struct ceph_client *cl = ceph_inode_to_client(parent);
209 struct inode *dir = parent;
210 char *p = buf;
211 u32 len;
212 int name_len = elen;
213 int ret;
214 u8 *cryptbuf = NULL;
215
216 /* Handle the special case of snapshot names that start with '_' */
217 if (ceph_snap(dir) == CEPH_SNAPDIR && *p == '_') {
218 dir = parse_longname(parent, p, &name_len);
219 if (IS_ERR(dir))
220 return PTR_ERR(dir);
221 p++; /* skip initial '_' */
222 }
223
224 if (!fscrypt_has_encryption_key(dir))
225 goto out;
226
227 /*
228 * Convert cleartext d_name to ciphertext. If result is longer than
229 * CEPH_NOHASH_NAME_MAX, sha256 the remaining bytes
230 *
231 * See: fscrypt_setup_filename
232 */
233 if (!fscrypt_fname_encrypted_size(dir, name_len, NAME_MAX, &len)) {
234 elen = -ENAMETOOLONG;
235 goto out;
236 }
237
238 /* Allocate a buffer appropriate to hold the result */
239 cryptbuf = kmalloc(len > CEPH_NOHASH_NAME_MAX ? NAME_MAX : len,
240 GFP_KERNEL);
241 if (!cryptbuf) {
242 elen = -ENOMEM;
243 goto out;
244 }
245
246 ret = fscrypt_fname_encrypt(dir,
247 &(struct qstr)QSTR_INIT(p, name_len),
248 cryptbuf, len);
249 if (ret) {
250 elen = ret;
251 goto out;
252 }
253
254 /* hash the end if the name is long enough */
255 if (len > CEPH_NOHASH_NAME_MAX) {
256 u8 hash[SHA256_DIGEST_SIZE];
257 u8 *extra = cryptbuf + CEPH_NOHASH_NAME_MAX;
258
259 /*
260 * hash the extra bytes and overwrite crypttext beyond that
261 * point with it
262 */
263 sha256(extra, len - CEPH_NOHASH_NAME_MAX, hash);
264 memcpy(extra, hash, SHA256_DIGEST_SIZE);
265 len = CEPH_NOHASH_NAME_MAX + SHA256_DIGEST_SIZE;
266 }
267
268 /* base64 encode the encrypted name */
269 elen = base64_encode(cryptbuf, len, p, false, BASE64_IMAP);
270 doutc(cl, "base64-encoded ciphertext name = %.*s\n", elen, p);
271
272 /* To understand the 240 limit, see CEPH_NOHASH_NAME_MAX comments */
273 WARN_ON(elen > 240);
274 if (dir != parent) // leading _ is already there; append _<inum>
275 elen += 1 + sprintf(p + elen, "_%llu", dir->i_ino);
276
277out:
278 kfree(cryptbuf);
279 if (dir != parent) {
280 if ((inode_state_read_once(dir) & I_NEW))
281 discard_new_inode(dir);
282 else
283 iput(dir);
284 }
285 return elen;
286}
287
288/**
289 * ceph_fname_to_usr - convert a filename for userland presentation
290 * @fname: ceph_fname to be converted
291 * @tname: temporary name buffer to use for conversion (may be NULL)
292 * @oname: where converted name should be placed
293 * @is_nokey: set to true if key wasn't available during conversion (may be NULL)
294 *
295 * Given a filename (usually from the MDS), format it for presentation to
296 * userland. If @parent is not encrypted, just pass it back as-is.
297 *
298 * Otherwise, base64 decode the string, and then ask fscrypt to format it
299 * for userland presentation.
300 *
301 * Though the fscrypt/crypto subsystems broadly expect all buffers to be in the
302 * linear-mapped region, this function slightly relaxes those requirements:
303 * fname->ctext, fname->name, and oname->name may be vmalloc(), but not tname.
304 *
305 * Returns 0 on success or negative error code on error.
306 */
307int ceph_fname_to_usr(const struct ceph_fname *fname, unsigned char *tname,
308 struct fscrypt_str *oname, bool *is_nokey)
309{
310 struct inode *dir = fname->dir;
311 struct fscrypt_str _tname = FSTR_INIT(NULL, 0);
312 struct fscrypt_str _oname;
313 struct fscrypt_str iname;
314 char *name = fname->name;
315 int name_len = fname->name_len;
316 int ret;
317
318 if (WARN_ON_ONCE(tname && is_vmalloc_addr(tname)))
319 return -EIO;
320
321 /* Sanity check that the resulting name will fit in the buffer */
322 if (fname->name_len > NAME_MAX || fname->ctext_len > NAME_MAX)
323 return -EIO;
324
325 /* Handle the special case of snapshot names that start with '_' */
326 if ((ceph_snap(dir) == CEPH_SNAPDIR) && (name_len > 0) &&
327 (name[0] == '_')) {
328 dir = parse_longname(dir, name, &name_len);
329 if (IS_ERR(dir))
330 return PTR_ERR(dir);
331 name++; /* skip initial '_' */
332 }
333
334 if (!IS_ENCRYPTED(dir)) {
335 oname->name = fname->name;
336 oname->len = fname->name_len;
337 ret = 0;
338 goto out_inode;
339 }
340
341 ret = ceph_fscrypt_prepare_readdir(dir);
342 if (ret)
343 goto out_inode;
344
345 /*
346 * Use the raw dentry name as sent by the MDS instead of
347 * generating a nokey name via fscrypt.
348 */
349 if (!fscrypt_has_encryption_key(dir)) {
350 if (fname->no_copy)
351 oname->name = fname->name;
352 else
353 memcpy(oname->name, fname->name, fname->name_len);
354 oname->len = fname->name_len;
355 if (is_nokey)
356 *is_nokey = true;
357 ret = 0;
358 goto out_inode;
359 }
360
361 if (!tname && (fname->ctext_len == 0 ||
362 unlikely(is_vmalloc_addr(fname->ctext)) ||
363 unlikely(is_vmalloc_addr(oname->name)))) {
364 ret = fscrypt_fname_alloc_buffer(NAME_MAX, &_tname);
365 if (ret)
366 goto out_inode;
367 tname = _tname.name;
368 }
369
370 if (fname->ctext_len == 0) {
371 int declen;
372
373 declen = base64_decode(name, name_len, tname, false, BASE64_IMAP);
374 if (declen <= 0) {
375 ret = -EIO;
376 goto out;
377 }
378 iname.name = tname;
379 iname.len = declen;
380 } else if (unlikely(is_vmalloc_addr(fname->ctext))) {
381 memcpy(tname, fname->ctext, fname->ctext_len);
382
383 iname.name = tname;
384 iname.len = fname->ctext_len;
385 } else {
386 iname.name = fname->ctext;
387 iname.len = fname->ctext_len;
388 }
389
390 _oname.name = unlikely(is_vmalloc_addr(oname->name)) ? tname : oname->name;
391 _oname.len = oname->len;
392
393 ret = fscrypt_fname_disk_to_usr(dir, 0, 0, &iname, &_oname);
394 if (ret)
395 goto out;
396
397 if (unlikely(is_vmalloc_addr(oname->name)))
398 memcpy(oname->name, _oname.name, _oname.len);
399 oname->len = _oname.len;
400
401 if (dir != fname->dir) {
402 char tmp_buf[BASE64_CHARS(NAME_MAX)];
403
404 name_len = snprintf(tmp_buf, sizeof(tmp_buf), "_%.*s_%llu",
405 oname->len, oname->name, dir->i_ino);
406 memcpy(oname->name, tmp_buf, name_len);
407 oname->len = name_len;
408 }
409
410out:
411 fscrypt_fname_free_buffer(&_tname);
412out_inode:
413 if (dir != fname->dir) {
414 if ((inode_state_read_once(dir) & I_NEW))
415 discard_new_inode(dir);
416 else
417 iput(dir);
418 }
419 return ret;
420}
421
422/**
423 * ceph_fscrypt_prepare_readdir - simple __fscrypt_prepare_readdir() wrapper
424 * @dir: directory inode for readdir prep
425 *
426 * Simple wrapper around __fscrypt_prepare_readdir() that will mark directory as
427 * non-complete if this call results in having the directory unlocked.
428 *
429 * Returns:
430 * 1 - if directory was locked and key is now loaded (i.e. dir is unlocked)
431 * 0 - if directory is still locked
432 * < 0 - if __fscrypt_prepare_readdir() fails
433 */
434int ceph_fscrypt_prepare_readdir(struct inode *dir)
435{
436 bool had_key = fscrypt_has_encryption_key(dir);
437 int err;
438
439 if (!IS_ENCRYPTED(dir))
440 return 0;
441
442 err = __fscrypt_prepare_readdir(dir);
443 if (err)
444 return err;
445 if (!had_key && fscrypt_has_encryption_key(dir)) {
446 /* directory just got unlocked, mark it as not complete */
447 ceph_dir_clear_complete(dir);
448 return 1;
449 }
450 return 0;
451}
452
453int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
454 struct page *page, unsigned int len,
455 unsigned int offs, u64 lblk_num)
456{
457 struct ceph_client *cl = ceph_inode_to_client(inode);
458
459 doutc(cl, "%p %llx.%llx len %u offs %u blk %llu\n", inode,
460 ceph_vinop(inode), len, offs, lblk_num);
461 return fscrypt_decrypt_block_inplace(inode, page, len, offs, lblk_num);
462}
463
464int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
465 struct page *page, unsigned int len,
466 unsigned int offs, u64 lblk_num)
467{
468 struct ceph_client *cl = ceph_inode_to_client(inode);
469
470 doutc(cl, "%p %llx.%llx len %u offs %u blk %llu\n", inode,
471 ceph_vinop(inode), len, offs, lblk_num);
472 return fscrypt_encrypt_block_inplace(inode, page, len, offs, lblk_num);
473}
474
475/**
476 * ceph_fscrypt_decrypt_pages - decrypt an array of pages
477 * @inode: pointer to inode associated with these pages
478 * @page: pointer to page array
479 * @off: offset into the file that the read data starts
480 * @len: max length to decrypt
481 *
482 * Decrypt an array of fscrypt'ed pages and return the amount of
483 * data decrypted. Any data in the page prior to the start of the
484 * first complete block in the read is ignored. Any incomplete
485 * crypto blocks at the end of the array are ignored (and should
486 * probably be zeroed by the caller).
487 *
488 * Returns the length of the decrypted data or a negative errno.
489 */
490int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page,
491 u64 off, int len)
492{
493 int i, num_blocks;
494 u64 baseblk = off >> CEPH_FSCRYPT_BLOCK_SHIFT;
495 int ret = 0;
496
497 /*
498 * We can't deal with partial blocks on an encrypted file, so mask off
499 * the last bit.
500 */
501 num_blocks = ceph_fscrypt_blocks(off, len & CEPH_FSCRYPT_BLOCK_MASK);
502
503 /* Decrypt each block */
504 for (i = 0; i < num_blocks; ++i) {
505 int blkoff = i << CEPH_FSCRYPT_BLOCK_SHIFT;
506 int pgidx = blkoff >> PAGE_SHIFT;
507 unsigned int pgoffs = offset_in_page(blkoff);
508 int fret;
509
510 fret = ceph_fscrypt_decrypt_block_inplace(inode, page[pgidx],
511 CEPH_FSCRYPT_BLOCK_SIZE, pgoffs,
512 baseblk + i);
513 if (fret < 0) {
514 if (ret == 0)
515 ret = fret;
516 break;
517 }
518 ret += CEPH_FSCRYPT_BLOCK_SIZE;
519 }
520 return ret;
521}
522
523/**
524 * ceph_fscrypt_decrypt_extents: decrypt received extents in given buffer
525 * @inode: inode associated with pages being decrypted
526 * @page: pointer to page array
527 * @off: offset into the file that the data in page[0] starts
528 * @map: pointer to extent array
529 * @ext_cnt: length of extent array
530 *
531 * Given an extent map and a page array, decrypt the received data in-place,
532 * skipping holes. Returns the offset into buffer of end of last decrypted
533 * block.
534 */
535int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page,
536 u64 off, struct ceph_sparse_extent *map,
537 u32 ext_cnt)
538{
539 struct ceph_client *cl = ceph_inode_to_client(inode);
540 int i, ret = 0;
541 struct ceph_inode_info *ci = ceph_inode(inode);
542 u64 objno, objoff;
543 u32 xlen;
544
545 /* Nothing to do for empty array */
546 if (ext_cnt == 0) {
547 doutc(cl, "%p %llx.%llx empty array, ret 0\n", inode,
548 ceph_vinop(inode));
549 return 0;
550 }
551
552 ceph_calc_file_object_mapping(&ci->i_layout, off, map[0].len,
553 &objno, &objoff, &xlen);
554
555 for (i = 0; i < ext_cnt; ++i) {
556 struct ceph_sparse_extent *ext = &map[i];
557 int pgsoff = ext->off - objoff;
558 int pgidx = pgsoff >> PAGE_SHIFT;
559 int fret;
560
561 if ((ext->off | ext->len) & ~CEPH_FSCRYPT_BLOCK_MASK) {
562 pr_warn_client(cl,
563 "%p %llx.%llx bad encrypted sparse extent "
564 "idx %d off %llx len %llx\n",
565 inode, ceph_vinop(inode), i, ext->off,
566 ext->len);
567 return -EIO;
568 }
569 fret = ceph_fscrypt_decrypt_pages(inode, &page[pgidx],
570 off + pgsoff, ext->len);
571 doutc(cl, "%p %llx.%llx [%d] 0x%llx~0x%llx fret %d\n", inode,
572 ceph_vinop(inode), i, ext->off, ext->len, fret);
573 if (fret < 0) {
574 if (ret == 0)
575 ret = fret;
576 break;
577 }
578 ret = pgsoff + fret;
579 }
580 doutc(cl, "ret %d\n", ret);
581 return ret;
582}
583
584/**
585 * ceph_fscrypt_encrypt_pages - encrypt an array of pages
586 * @inode: pointer to inode associated with these pages
587 * @page: pointer to page array
588 * @off: offset into the file that the data starts
589 * @len: max length to encrypt
590 *
591 * Encrypt an array of cleartext pages and return the amount of
592 * data encrypted. Any data in the page prior to the start of the
593 * first complete block in the read is ignored. Any incomplete
594 * crypto blocks at the end of the array are ignored.
595 *
596 * Returns the length of the encrypted data or a negative errno.
597 */
598int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page, u64 off,
599 int len)
600{
601 int i, num_blocks;
602 u64 baseblk = off >> CEPH_FSCRYPT_BLOCK_SHIFT;
603 int ret = 0;
604
605 /*
606 * We can't deal with partial blocks on an encrypted file, so mask off
607 * the last bit.
608 */
609 num_blocks = ceph_fscrypt_blocks(off, len & CEPH_FSCRYPT_BLOCK_MASK);
610
611 /* Encrypt each block */
612 for (i = 0; i < num_blocks; ++i) {
613 int blkoff = i << CEPH_FSCRYPT_BLOCK_SHIFT;
614 int pgidx = blkoff >> PAGE_SHIFT;
615 unsigned int pgoffs = offset_in_page(blkoff);
616 int fret;
617
618 fret = ceph_fscrypt_encrypt_block_inplace(inode, page[pgidx],
619 CEPH_FSCRYPT_BLOCK_SIZE, pgoffs,
620 baseblk + i);
621 if (fret < 0) {
622 if (ret == 0)
623 ret = fret;
624 break;
625 }
626 ret += CEPH_FSCRYPT_BLOCK_SIZE;
627 }
628 return ret;
629}