aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--fs/ecryptfs/crypto.c40
-rw-r--r--fs/ecryptfs/ecryptfs_kernel.h39
-rw-r--r--fs/ecryptfs/inode.c7
-rw-r--r--fs/ecryptfs/mmap.c2
4 files changed, 52 insertions, 36 deletions
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index 8e9b36df7881..9127b809044d 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -366,8 +366,8 @@ ecryptfs_extent_to_lwr_pg_idx_and_offset(unsigned long *lower_page_idx,
366 int extents_per_page; 366 int extents_per_page;
367 367
368 bytes_occupied_by_headers_at_front = 368 bytes_occupied_by_headers_at_front =
369 ( crypt_stat->header_extent_size 369 (crypt_stat->extent_size
370 * crypt_stat->num_header_extents_at_front ); 370 * crypt_stat->num_header_extents_at_front);
371 extents_occupied_by_headers_at_front = 371 extents_occupied_by_headers_at_front =
372 ( bytes_occupied_by_headers_at_front 372 ( bytes_occupied_by_headers_at_front
373 / crypt_stat->extent_size ); 373 / crypt_stat->extent_size );
@@ -376,8 +376,8 @@ ecryptfs_extent_to_lwr_pg_idx_and_offset(unsigned long *lower_page_idx,
376 (*lower_page_idx) = lower_extent_num / extents_per_page; 376 (*lower_page_idx) = lower_extent_num / extents_per_page;
377 extent_offset = lower_extent_num % extents_per_page; 377 extent_offset = lower_extent_num % extents_per_page;
378 (*byte_offset) = extent_offset * crypt_stat->extent_size; 378 (*byte_offset) = extent_offset * crypt_stat->extent_size;
379 ecryptfs_printk(KERN_DEBUG, " * crypt_stat->header_extent_size = " 379 ecryptfs_printk(KERN_DEBUG, " * crypt_stat->extent_size = "
380 "[%d]\n", crypt_stat->header_extent_size); 380 "[%d]\n", crypt_stat->extent_size);
381 ecryptfs_printk(KERN_DEBUG, " * crypt_stat->" 381 ecryptfs_printk(KERN_DEBUG, " * crypt_stat->"
382 "num_header_extents_at_front = [%d]\n", 382 "num_header_extents_at_front = [%d]\n",
383 crypt_stat->num_header_extents_at_front); 383 crypt_stat->num_header_extents_at_front);
@@ -899,15 +899,17 @@ void ecryptfs_set_default_sizes(struct ecryptfs_crypt_stat *crypt_stat)
899 crypt_stat->extent_size = ECRYPTFS_DEFAULT_EXTENT_SIZE; 899 crypt_stat->extent_size = ECRYPTFS_DEFAULT_EXTENT_SIZE;
900 set_extent_mask_and_shift(crypt_stat); 900 set_extent_mask_and_shift(crypt_stat);
901 crypt_stat->iv_bytes = ECRYPTFS_DEFAULT_IV_BYTES; 901 crypt_stat->iv_bytes = ECRYPTFS_DEFAULT_IV_BYTES;
902 if (PAGE_CACHE_SIZE <= ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE) {
903 crypt_stat->header_extent_size =
904 ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE;
905 } else
906 crypt_stat->header_extent_size = PAGE_CACHE_SIZE;
907 if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) 902 if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
908 crypt_stat->num_header_extents_at_front = 0; 903 crypt_stat->num_header_extents_at_front = 0;
909 else 904 else {
910 crypt_stat->num_header_extents_at_front = 1; 905 if (PAGE_CACHE_SIZE <= ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE)
906 crypt_stat->num_header_extents_at_front =
907 (ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE
908 / crypt_stat->extent_size);
909 else
910 crypt_stat->num_header_extents_at_front =
911 (PAGE_CACHE_SIZE / crypt_stat->extent_size);
912 }
911} 913}
912 914
913/** 915/**
@@ -1319,7 +1321,7 @@ ecryptfs_write_header_metadata(char *virt,
1319 u32 header_extent_size; 1321 u32 header_extent_size;
1320 u16 num_header_extents_at_front; 1322 u16 num_header_extents_at_front;
1321 1323
1322 header_extent_size = (u32)crypt_stat->header_extent_size; 1324 header_extent_size = (u32)crypt_stat->extent_size;
1323 num_header_extents_at_front = 1325 num_header_extents_at_front =
1324 (u16)crypt_stat->num_header_extents_at_front; 1326 (u16)crypt_stat->num_header_extents_at_front;
1325 header_extent_size = cpu_to_be32(header_extent_size); 1327 header_extent_size = cpu_to_be32(header_extent_size);
@@ -1415,7 +1417,7 @@ ecryptfs_write_metadata_to_contents(struct ecryptfs_crypt_stat *crypt_stat,
1415 set_fs(oldfs); 1417 set_fs(oldfs);
1416 goto out; 1418 goto out;
1417 } 1419 }
1418 header_pages = ((crypt_stat->header_extent_size 1420 header_pages = ((crypt_stat->extent_size
1419 * crypt_stat->num_header_extents_at_front) 1421 * crypt_stat->num_header_extents_at_front)
1420 / PAGE_CACHE_SIZE); 1422 / PAGE_CACHE_SIZE);
1421 memset(page_virt, 0, PAGE_CACHE_SIZE); 1423 memset(page_virt, 0, PAGE_CACHE_SIZE);
@@ -1532,17 +1534,16 @@ static int parse_header_metadata(struct ecryptfs_crypt_stat *crypt_stat,
1532 virt += 4; 1534 virt += 4;
1533 memcpy(&num_header_extents_at_front, virt, 2); 1535 memcpy(&num_header_extents_at_front, virt, 2);
1534 num_header_extents_at_front = be16_to_cpu(num_header_extents_at_front); 1536 num_header_extents_at_front = be16_to_cpu(num_header_extents_at_front);
1535 crypt_stat->header_extent_size = (int)header_extent_size;
1536 crypt_stat->num_header_extents_at_front = 1537 crypt_stat->num_header_extents_at_front =
1537 (int)num_header_extents_at_front; 1538 (int)num_header_extents_at_front;
1538 (*bytes_read) = 6; 1539 (*bytes_read) = (sizeof(u32) + sizeof(u16));
1539 if ((validate_header_size == ECRYPTFS_VALIDATE_HEADER_SIZE) 1540 if ((validate_header_size == ECRYPTFS_VALIDATE_HEADER_SIZE)
1540 && ((crypt_stat->header_extent_size 1541 && ((crypt_stat->extent_size
1541 * crypt_stat->num_header_extents_at_front) 1542 * crypt_stat->num_header_extents_at_front)
1542 < ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE)) { 1543 < ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE)) {
1543 rc = -EINVAL; 1544 rc = -EINVAL;
1544 ecryptfs_printk(KERN_WARNING, "Invalid header extent size: " 1545 printk(KERN_WARNING "Invalid number of header extents: [%zd]\n",
1545 "[%d]\n", crypt_stat->header_extent_size); 1546 crypt_stat->num_header_extents_at_front);
1546 } 1547 }
1547 return rc; 1548 return rc;
1548} 1549}
@@ -1557,8 +1558,7 @@ static int parse_header_metadata(struct ecryptfs_crypt_stat *crypt_stat,
1557 */ 1558 */
1558static void set_default_header_data(struct ecryptfs_crypt_stat *crypt_stat) 1559static void set_default_header_data(struct ecryptfs_crypt_stat *crypt_stat)
1559{ 1560{
1560 crypt_stat->header_extent_size = 4096; 1561 crypt_stat->num_header_extents_at_front = 2;
1561 crypt_stat->num_header_extents_at_front = 1;
1562} 1562}
1563 1563
1564/** 1564/**
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 78761e4bdab8..a618ab77642d 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -38,7 +38,7 @@
38/* Version verification for shared data structures w/ userspace */ 38/* Version verification for shared data structures w/ userspace */
39#define ECRYPTFS_VERSION_MAJOR 0x00 39#define ECRYPTFS_VERSION_MAJOR 0x00
40#define ECRYPTFS_VERSION_MINOR 0x04 40#define ECRYPTFS_VERSION_MINOR 0x04
41#define ECRYPTFS_SUPPORTED_FILE_VERSION 0x02 41#define ECRYPTFS_SUPPORTED_FILE_VERSION 0x03
42/* These flags indicate which features are supported by the kernel 42/* These flags indicate which features are supported by the kernel
43 * module; userspace tools such as the mount helper read 43 * module; userspace tools such as the mount helper read
44 * ECRYPTFS_VERSIONING_MASK from a sysfs handle in order to determine 44 * ECRYPTFS_VERSIONING_MASK from a sysfs handle in order to determine
@@ -67,8 +67,7 @@
67#define ECRYPTFS_MAX_KEY_BYTES 64 67#define ECRYPTFS_MAX_KEY_BYTES 64
68#define ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES 512 68#define ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES 512
69#define ECRYPTFS_DEFAULT_IV_BYTES 16 69#define ECRYPTFS_DEFAULT_IV_BYTES 16
70#define ECRYPTFS_FILE_VERSION 0x02 70#define ECRYPTFS_FILE_VERSION 0x03
71#define ECRYPTFS_DEFAULT_HEADER_EXTENT_SIZE 8192
72#define ECRYPTFS_DEFAULT_EXTENT_SIZE 4096 71#define ECRYPTFS_DEFAULT_EXTENT_SIZE 4096
73#define ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE 8192 72#define ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE 8192
74#define ECRYPTFS_DEFAULT_MSG_CTX_ELEMS 32 73#define ECRYPTFS_DEFAULT_MSG_CTX_ELEMS 32
@@ -201,7 +200,7 @@ ecryptfs_get_key_payload_data(struct key *key)
201#define ECRYPTFS_SALT_BYTES 2 200#define ECRYPTFS_SALT_BYTES 2
202#define MAGIC_ECRYPTFS_MARKER 0x3c81b7f5 201#define MAGIC_ECRYPTFS_MARKER 0x3c81b7f5
203#define MAGIC_ECRYPTFS_MARKER_SIZE_BYTES 8 /* 4*2 */ 202#define MAGIC_ECRYPTFS_MARKER_SIZE_BYTES 8 /* 4*2 */
204#define ECRYPTFS_FILE_SIZE_BYTES 8 203#define ECRYPTFS_FILE_SIZE_BYTES (sizeof(u64))
205#define ECRYPTFS_DEFAULT_CIPHER "aes" 204#define ECRYPTFS_DEFAULT_CIPHER "aes"
206#define ECRYPTFS_DEFAULT_KEY_BYTES 16 205#define ECRYPTFS_DEFAULT_KEY_BYTES 16
207#define ECRYPTFS_DEFAULT_HASH "md5" 206#define ECRYPTFS_DEFAULT_HASH "md5"
@@ -238,7 +237,6 @@ struct ecryptfs_crypt_stat {
238 u32 flags; 237 u32 flags;
239 unsigned int file_version; 238 unsigned int file_version;
240 size_t iv_bytes; 239 size_t iv_bytes;
241 size_t header_extent_size;
242 size_t num_header_extents_at_front; 240 size_t num_header_extents_at_front;
243 size_t extent_size; /* Data extent size; default is 4096 */ 241 size_t extent_size; /* Data extent size; default is 4096 */
244 size_t key_size; 242 size_t key_size;
@@ -273,6 +271,17 @@ struct ecryptfs_dentry_info {
273}; 271};
274 272
275/** 273/**
274 * ecryptfs_global_auth_tok - A key used to encrypt all new files under the mountpoint
275 * @flags: Status flags
276 * @mount_crypt_stat_list: These auth_toks hang off the mount-wide
277 * cryptographic context. Every time a new
278 * inode comes into existence, eCryptfs copies
279 * the auth_toks on that list to the set of
280 * auth_toks on the inode's crypt_stat
281 * @global_auth_tok_key: The key from the user's keyring for the sig
282 * @global_auth_tok: The key contents
283 * @sig: The key identifier
284 *
276 * ecryptfs_global_auth_tok structs refer to authentication token keys 285 * ecryptfs_global_auth_tok structs refer to authentication token keys
277 * in the user keyring that apply to newly created files. A list of 286 * in the user keyring that apply to newly created files. A list of
278 * these objects hangs off of the mount_crypt_stat struct for any 287 * these objects hangs off of the mount_crypt_stat struct for any
@@ -283,15 +292,21 @@ struct ecryptfs_dentry_info {
283struct ecryptfs_global_auth_tok { 292struct ecryptfs_global_auth_tok {
284#define ECRYPTFS_AUTH_TOK_INVALID 0x00000001 293#define ECRYPTFS_AUTH_TOK_INVALID 0x00000001
285 u32 flags; 294 u32 flags;
286 struct list_head mount_crypt_stat_list; /* Default auth_tok list for 295 struct list_head mount_crypt_stat_list;
287 * the mount_crypt_stat */ 296 struct key *global_auth_tok_key;
288 struct key *global_auth_tok_key; /* The key from the user's keyring for 297 struct ecryptfs_auth_tok *global_auth_tok;
289 * the sig */ 298 unsigned char sig[ECRYPTFS_SIG_SIZE_HEX + 1];
290 struct ecryptfs_auth_tok *global_auth_tok; /* The key contents */
291 unsigned char sig[ECRYPTFS_SIG_SIZE_HEX + 1]; /* The key identifier */
292}; 299};
293 300
294/** 301/**
302 * ecryptfs_key_tfm - Persistent key tfm
303 * @key_tfm: crypto API handle to the key
304 * @key_size: Key size in bytes
305 * @key_tfm_mutex: Mutex to ensure only one operation in eCryptfs is
306 * using the persistent TFM at any point in time
307 * @key_tfm_list: Handle to hang this off the module-wide TFM list
308 * @cipher_name: String name for the cipher for this TFM
309 *
295 * Typically, eCryptfs will use the same ciphers repeatedly throughout 310 * Typically, eCryptfs will use the same ciphers repeatedly throughout
296 * the course of its operations. In order to avoid unnecessarily 311 * the course of its operations. In order to avoid unnecessarily
297 * destroying and initializing the same cipher repeatedly, eCryptfs 312 * destroying and initializing the same cipher repeatedly, eCryptfs
@@ -301,7 +316,7 @@ struct ecryptfs_key_tfm {
301 struct crypto_blkcipher *key_tfm; 316 struct crypto_blkcipher *key_tfm;
302 size_t key_size; 317 size_t key_size;
303 struct mutex key_tfm_mutex; 318 struct mutex key_tfm_mutex;
304 struct list_head key_tfm_list; /* The module's tfm list */ 319 struct list_head key_tfm_list;
305 unsigned char cipher_name[ECRYPTFS_MAX_CIPHER_NAME_SIZE + 1]; 320 unsigned char cipher_name[ECRYPTFS_MAX_CIPHER_NAME_SIZE + 1];
306}; 321};
307 322
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 131954b3fb98..abac91c58bfb 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -392,7 +392,8 @@ static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
392 dentry->d_sb)->mount_crypt_stat; 392 dentry->d_sb)->mount_crypt_stat;
393 if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) { 393 if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) {
394 if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) 394 if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
395 file_size = (crypt_stat->header_extent_size 395 file_size = ((crypt_stat->extent_size
396 * crypt_stat->num_header_extents_at_front)
396 + i_size_read(lower_dentry->d_inode)); 397 + i_size_read(lower_dentry->d_inode));
397 else 398 else
398 file_size = i_size_read(lower_dentry->d_inode); 399 file_size = i_size_read(lower_dentry->d_inode);
@@ -722,8 +723,8 @@ upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat,
722{ 723{
723 loff_t lower_size; 724 loff_t lower_size;
724 725
725 lower_size = ( crypt_stat->header_extent_size 726 lower_size = (crypt_stat->extent_size
726 * crypt_stat->num_header_extents_at_front ); 727 * crypt_stat->num_header_extents_at_front);
727 if (upper_size != 0) { 728 if (upper_size != 0) {
728 loff_t num_extents; 729 loff_t num_extents;
729 730
diff --git a/fs/ecryptfs/mmap.c b/fs/ecryptfs/mmap.c
index aaea55a61ea1..89dbbbbcce07 100644
--- a/fs/ecryptfs/mmap.c
+++ b/fs/ecryptfs/mmap.c
@@ -301,7 +301,7 @@ static int ecryptfs_readpage(struct file *file, struct page *page)
301 } else if (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED) { 301 } else if (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED) {
302 if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) { 302 if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
303 int num_pages_in_header_region = 303 int num_pages_in_header_region =
304 (crypt_stat->header_extent_size 304 (crypt_stat->extent_size
305 / PAGE_CACHE_SIZE); 305 / PAGE_CACHE_SIZE);
306 306
307 if (page->index < num_pages_in_header_region) { 307 if (page->index < num_pages_in_header_region) {