diff options
-rw-r--r-- | fs/ecryptfs/crypto.c | 40 | ||||
-rw-r--r-- | fs/ecryptfs/ecryptfs_kernel.h | 39 | ||||
-rw-r--r-- | fs/ecryptfs/inode.c | 7 | ||||
-rw-r--r-- | fs/ecryptfs/mmap.c | 2 |
4 files changed, 52 insertions, 36 deletions
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c index 8e9b36df7881..9127b809044d 100644 --- a/fs/ecryptfs/crypto.c +++ b/fs/ecryptfs/crypto.c | |||
@@ -366,8 +366,8 @@ ecryptfs_extent_to_lwr_pg_idx_and_offset(unsigned long *lower_page_idx, | |||
366 | int extents_per_page; | 366 | int extents_per_page; |
367 | 367 | ||
368 | bytes_occupied_by_headers_at_front = | 368 | bytes_occupied_by_headers_at_front = |
369 | ( crypt_stat->header_extent_size | 369 | (crypt_stat->extent_size |
370 | * crypt_stat->num_header_extents_at_front ); | 370 | * crypt_stat->num_header_extents_at_front); |
371 | extents_occupied_by_headers_at_front = | 371 | extents_occupied_by_headers_at_front = |
372 | ( bytes_occupied_by_headers_at_front | 372 | ( bytes_occupied_by_headers_at_front |
373 | / crypt_stat->extent_size ); | 373 | / crypt_stat->extent_size ); |
@@ -376,8 +376,8 @@ ecryptfs_extent_to_lwr_pg_idx_and_offset(unsigned long *lower_page_idx, | |||
376 | (*lower_page_idx) = lower_extent_num / extents_per_page; | 376 | (*lower_page_idx) = lower_extent_num / extents_per_page; |
377 | extent_offset = lower_extent_num % extents_per_page; | 377 | extent_offset = lower_extent_num % extents_per_page; |
378 | (*byte_offset) = extent_offset * crypt_stat->extent_size; | 378 | (*byte_offset) = extent_offset * crypt_stat->extent_size; |
379 | ecryptfs_printk(KERN_DEBUG, " * crypt_stat->header_extent_size = " | 379 | ecryptfs_printk(KERN_DEBUG, " * crypt_stat->extent_size = " |
380 | "[%d]\n", crypt_stat->header_extent_size); | 380 | "[%d]\n", crypt_stat->extent_size); |
381 | ecryptfs_printk(KERN_DEBUG, " * crypt_stat->" | 381 | ecryptfs_printk(KERN_DEBUG, " * crypt_stat->" |
382 | "num_header_extents_at_front = [%d]\n", | 382 | "num_header_extents_at_front = [%d]\n", |
383 | crypt_stat->num_header_extents_at_front); | 383 | crypt_stat->num_header_extents_at_front); |
@@ -899,15 +899,17 @@ void ecryptfs_set_default_sizes(struct ecryptfs_crypt_stat *crypt_stat) | |||
899 | crypt_stat->extent_size = ECRYPTFS_DEFAULT_EXTENT_SIZE; | 899 | crypt_stat->extent_size = ECRYPTFS_DEFAULT_EXTENT_SIZE; |
900 | set_extent_mask_and_shift(crypt_stat); | 900 | set_extent_mask_and_shift(crypt_stat); |
901 | crypt_stat->iv_bytes = ECRYPTFS_DEFAULT_IV_BYTES; | 901 | crypt_stat->iv_bytes = ECRYPTFS_DEFAULT_IV_BYTES; |
902 | if (PAGE_CACHE_SIZE <= ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE) { | ||
903 | crypt_stat->header_extent_size = | ||
904 | ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE; | ||
905 | } else | ||
906 | crypt_stat->header_extent_size = PAGE_CACHE_SIZE; | ||
907 | if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) | 902 | if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) |
908 | crypt_stat->num_header_extents_at_front = 0; | 903 | crypt_stat->num_header_extents_at_front = 0; |
909 | else | 904 | else { |
910 | crypt_stat->num_header_extents_at_front = 1; | 905 | if (PAGE_CACHE_SIZE <= ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE) |
906 | crypt_stat->num_header_extents_at_front = | ||
907 | (ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE | ||
908 | / crypt_stat->extent_size); | ||
909 | else | ||
910 | crypt_stat->num_header_extents_at_front = | ||
911 | (PAGE_CACHE_SIZE / crypt_stat->extent_size); | ||
912 | } | ||
911 | } | 913 | } |
912 | 914 | ||
913 | /** | 915 | /** |
@@ -1319,7 +1321,7 @@ ecryptfs_write_header_metadata(char *virt, | |||
1319 | u32 header_extent_size; | 1321 | u32 header_extent_size; |
1320 | u16 num_header_extents_at_front; | 1322 | u16 num_header_extents_at_front; |
1321 | 1323 | ||
1322 | header_extent_size = (u32)crypt_stat->header_extent_size; | 1324 | header_extent_size = (u32)crypt_stat->extent_size; |
1323 | num_header_extents_at_front = | 1325 | num_header_extents_at_front = |
1324 | (u16)crypt_stat->num_header_extents_at_front; | 1326 | (u16)crypt_stat->num_header_extents_at_front; |
1325 | header_extent_size = cpu_to_be32(header_extent_size); | 1327 | header_extent_size = cpu_to_be32(header_extent_size); |
@@ -1415,7 +1417,7 @@ ecryptfs_write_metadata_to_contents(struct ecryptfs_crypt_stat *crypt_stat, | |||
1415 | set_fs(oldfs); | 1417 | set_fs(oldfs); |
1416 | goto out; | 1418 | goto out; |
1417 | } | 1419 | } |
1418 | header_pages = ((crypt_stat->header_extent_size | 1420 | header_pages = ((crypt_stat->extent_size |
1419 | * crypt_stat->num_header_extents_at_front) | 1421 | * crypt_stat->num_header_extents_at_front) |
1420 | / PAGE_CACHE_SIZE); | 1422 | / PAGE_CACHE_SIZE); |
1421 | memset(page_virt, 0, PAGE_CACHE_SIZE); | 1423 | memset(page_virt, 0, PAGE_CACHE_SIZE); |
@@ -1532,17 +1534,16 @@ static int parse_header_metadata(struct ecryptfs_crypt_stat *crypt_stat, | |||
1532 | virt += 4; | 1534 | virt += 4; |
1533 | memcpy(&num_header_extents_at_front, virt, 2); | 1535 | memcpy(&num_header_extents_at_front, virt, 2); |
1534 | num_header_extents_at_front = be16_to_cpu(num_header_extents_at_front); | 1536 | num_header_extents_at_front = be16_to_cpu(num_header_extents_at_front); |
1535 | crypt_stat->header_extent_size = (int)header_extent_size; | ||
1536 | crypt_stat->num_header_extents_at_front = | 1537 | crypt_stat->num_header_extents_at_front = |
1537 | (int)num_header_extents_at_front; | 1538 | (int)num_header_extents_at_front; |
1538 | (*bytes_read) = 6; | 1539 | (*bytes_read) = (sizeof(u32) + sizeof(u16)); |
1539 | if ((validate_header_size == ECRYPTFS_VALIDATE_HEADER_SIZE) | 1540 | if ((validate_header_size == ECRYPTFS_VALIDATE_HEADER_SIZE) |
1540 | && ((crypt_stat->header_extent_size | 1541 | && ((crypt_stat->extent_size |
1541 | * crypt_stat->num_header_extents_at_front) | 1542 | * crypt_stat->num_header_extents_at_front) |
1542 | < ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE)) { | 1543 | < ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE)) { |
1543 | rc = -EINVAL; | 1544 | rc = -EINVAL; |
1544 | ecryptfs_printk(KERN_WARNING, "Invalid header extent size: " | 1545 | printk(KERN_WARNING "Invalid number of header extents: [%zd]\n", |
1545 | "[%d]\n", crypt_stat->header_extent_size); | 1546 | crypt_stat->num_header_extents_at_front); |
1546 | } | 1547 | } |
1547 | return rc; | 1548 | return rc; |
1548 | } | 1549 | } |
@@ -1557,8 +1558,7 @@ static int parse_header_metadata(struct ecryptfs_crypt_stat *crypt_stat, | |||
1557 | */ | 1558 | */ |
1558 | static void set_default_header_data(struct ecryptfs_crypt_stat *crypt_stat) | 1559 | static void set_default_header_data(struct ecryptfs_crypt_stat *crypt_stat) |
1559 | { | 1560 | { |
1560 | crypt_stat->header_extent_size = 4096; | 1561 | crypt_stat->num_header_extents_at_front = 2; |
1561 | crypt_stat->num_header_extents_at_front = 1; | ||
1562 | } | 1562 | } |
1563 | 1563 | ||
1564 | /** | 1564 | /** |
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h index 78761e4bdab8..a618ab77642d 100644 --- a/fs/ecryptfs/ecryptfs_kernel.h +++ b/fs/ecryptfs/ecryptfs_kernel.h | |||
@@ -38,7 +38,7 @@ | |||
38 | /* Version verification for shared data structures w/ userspace */ | 38 | /* Version verification for shared data structures w/ userspace */ |
39 | #define ECRYPTFS_VERSION_MAJOR 0x00 | 39 | #define ECRYPTFS_VERSION_MAJOR 0x00 |
40 | #define ECRYPTFS_VERSION_MINOR 0x04 | 40 | #define ECRYPTFS_VERSION_MINOR 0x04 |
41 | #define ECRYPTFS_SUPPORTED_FILE_VERSION 0x02 | 41 | #define ECRYPTFS_SUPPORTED_FILE_VERSION 0x03 |
42 | /* These flags indicate which features are supported by the kernel | 42 | /* These flags indicate which features are supported by the kernel |
43 | * module; userspace tools such as the mount helper read | 43 | * module; userspace tools such as the mount helper read |
44 | * ECRYPTFS_VERSIONING_MASK from a sysfs handle in order to determine | 44 | * ECRYPTFS_VERSIONING_MASK from a sysfs handle in order to determine |
@@ -67,8 +67,7 @@ | |||
67 | #define ECRYPTFS_MAX_KEY_BYTES 64 | 67 | #define ECRYPTFS_MAX_KEY_BYTES 64 |
68 | #define ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES 512 | 68 | #define ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES 512 |
69 | #define ECRYPTFS_DEFAULT_IV_BYTES 16 | 69 | #define ECRYPTFS_DEFAULT_IV_BYTES 16 |
70 | #define ECRYPTFS_FILE_VERSION 0x02 | 70 | #define ECRYPTFS_FILE_VERSION 0x03 |
71 | #define ECRYPTFS_DEFAULT_HEADER_EXTENT_SIZE 8192 | ||
72 | #define ECRYPTFS_DEFAULT_EXTENT_SIZE 4096 | 71 | #define ECRYPTFS_DEFAULT_EXTENT_SIZE 4096 |
73 | #define ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE 8192 | 72 | #define ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE 8192 |
74 | #define ECRYPTFS_DEFAULT_MSG_CTX_ELEMS 32 | 73 | #define ECRYPTFS_DEFAULT_MSG_CTX_ELEMS 32 |
@@ -201,7 +200,7 @@ ecryptfs_get_key_payload_data(struct key *key) | |||
201 | #define ECRYPTFS_SALT_BYTES 2 | 200 | #define ECRYPTFS_SALT_BYTES 2 |
202 | #define MAGIC_ECRYPTFS_MARKER 0x3c81b7f5 | 201 | #define MAGIC_ECRYPTFS_MARKER 0x3c81b7f5 |
203 | #define MAGIC_ECRYPTFS_MARKER_SIZE_BYTES 8 /* 4*2 */ | 202 | #define MAGIC_ECRYPTFS_MARKER_SIZE_BYTES 8 /* 4*2 */ |
204 | #define ECRYPTFS_FILE_SIZE_BYTES 8 | 203 | #define ECRYPTFS_FILE_SIZE_BYTES (sizeof(u64)) |
205 | #define ECRYPTFS_DEFAULT_CIPHER "aes" | 204 | #define ECRYPTFS_DEFAULT_CIPHER "aes" |
206 | #define ECRYPTFS_DEFAULT_KEY_BYTES 16 | 205 | #define ECRYPTFS_DEFAULT_KEY_BYTES 16 |
207 | #define ECRYPTFS_DEFAULT_HASH "md5" | 206 | #define ECRYPTFS_DEFAULT_HASH "md5" |
@@ -238,7 +237,6 @@ struct ecryptfs_crypt_stat { | |||
238 | u32 flags; | 237 | u32 flags; |
239 | unsigned int file_version; | 238 | unsigned int file_version; |
240 | size_t iv_bytes; | 239 | size_t iv_bytes; |
241 | size_t header_extent_size; | ||
242 | size_t num_header_extents_at_front; | 240 | size_t num_header_extents_at_front; |
243 | size_t extent_size; /* Data extent size; default is 4096 */ | 241 | size_t extent_size; /* Data extent size; default is 4096 */ |
244 | size_t key_size; | 242 | size_t key_size; |
@@ -273,6 +271,17 @@ struct ecryptfs_dentry_info { | |||
273 | }; | 271 | }; |
274 | 272 | ||
275 | /** | 273 | /** |
274 | * ecryptfs_global_auth_tok - A key used to encrypt all new files under the mountpoint | ||
275 | * @flags: Status flags | ||
276 | * @mount_crypt_stat_list: These auth_toks hang off the mount-wide | ||
277 | * cryptographic context. Every time a new | ||
278 | * inode comes into existence, eCryptfs copies | ||
279 | * the auth_toks on that list to the set of | ||
280 | * auth_toks on the inode's crypt_stat | ||
281 | * @global_auth_tok_key: The key from the user's keyring for the sig | ||
282 | * @global_auth_tok: The key contents | ||
283 | * @sig: The key identifier | ||
284 | * | ||
276 | * ecryptfs_global_auth_tok structs refer to authentication token keys | 285 | * ecryptfs_global_auth_tok structs refer to authentication token keys |
277 | * in the user keyring that apply to newly created files. A list of | 286 | * in the user keyring that apply to newly created files. A list of |
278 | * these objects hangs off of the mount_crypt_stat struct for any | 287 | * these objects hangs off of the mount_crypt_stat struct for any |
@@ -283,15 +292,21 @@ struct ecryptfs_dentry_info { | |||
283 | struct ecryptfs_global_auth_tok { | 292 | struct ecryptfs_global_auth_tok { |
284 | #define ECRYPTFS_AUTH_TOK_INVALID 0x00000001 | 293 | #define ECRYPTFS_AUTH_TOK_INVALID 0x00000001 |
285 | u32 flags; | 294 | u32 flags; |
286 | struct list_head mount_crypt_stat_list; /* Default auth_tok list for | 295 | struct list_head mount_crypt_stat_list; |
287 | * the mount_crypt_stat */ | 296 | struct key *global_auth_tok_key; |
288 | struct key *global_auth_tok_key; /* The key from the user's keyring for | 297 | struct ecryptfs_auth_tok *global_auth_tok; |
289 | * the sig */ | 298 | unsigned char sig[ECRYPTFS_SIG_SIZE_HEX + 1]; |
290 | struct ecryptfs_auth_tok *global_auth_tok; /* The key contents */ | ||
291 | unsigned char sig[ECRYPTFS_SIG_SIZE_HEX + 1]; /* The key identifier */ | ||
292 | }; | 299 | }; |
293 | 300 | ||
294 | /** | 301 | /** |
302 | * ecryptfs_key_tfm - Persistent key tfm | ||
303 | * @key_tfm: crypto API handle to the key | ||
304 | * @key_size: Key size in bytes | ||
305 | * @key_tfm_mutex: Mutex to ensure only one operation in eCryptfs is | ||
306 | * using the persistent TFM at any point in time | ||
307 | * @key_tfm_list: Handle to hang this off the module-wide TFM list | ||
308 | * @cipher_name: String name for the cipher for this TFM | ||
309 | * | ||
295 | * Typically, eCryptfs will use the same ciphers repeatedly throughout | 310 | * Typically, eCryptfs will use the same ciphers repeatedly throughout |
296 | * the course of its operations. In order to avoid unnecessarily | 311 | * the course of its operations. In order to avoid unnecessarily |
297 | * destroying and initializing the same cipher repeatedly, eCryptfs | 312 | * destroying and initializing the same cipher repeatedly, eCryptfs |
@@ -301,7 +316,7 @@ struct ecryptfs_key_tfm { | |||
301 | struct crypto_blkcipher *key_tfm; | 316 | struct crypto_blkcipher *key_tfm; |
302 | size_t key_size; | 317 | size_t key_size; |
303 | struct mutex key_tfm_mutex; | 318 | struct mutex key_tfm_mutex; |
304 | struct list_head key_tfm_list; /* The module's tfm list */ | 319 | struct list_head key_tfm_list; |
305 | unsigned char cipher_name[ECRYPTFS_MAX_CIPHER_NAME_SIZE + 1]; | 320 | unsigned char cipher_name[ECRYPTFS_MAX_CIPHER_NAME_SIZE + 1]; |
306 | }; | 321 | }; |
307 | 322 | ||
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c index 131954b3fb98..abac91c58bfb 100644 --- a/fs/ecryptfs/inode.c +++ b/fs/ecryptfs/inode.c | |||
@@ -392,7 +392,8 @@ static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry, | |||
392 | dentry->d_sb)->mount_crypt_stat; | 392 | dentry->d_sb)->mount_crypt_stat; |
393 | if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) { | 393 | if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) { |
394 | if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) | 394 | if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) |
395 | file_size = (crypt_stat->header_extent_size | 395 | file_size = ((crypt_stat->extent_size |
396 | * crypt_stat->num_header_extents_at_front) | ||
396 | + i_size_read(lower_dentry->d_inode)); | 397 | + i_size_read(lower_dentry->d_inode)); |
397 | else | 398 | else |
398 | file_size = i_size_read(lower_dentry->d_inode); | 399 | file_size = i_size_read(lower_dentry->d_inode); |
@@ -722,8 +723,8 @@ upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat, | |||
722 | { | 723 | { |
723 | loff_t lower_size; | 724 | loff_t lower_size; |
724 | 725 | ||
725 | lower_size = ( crypt_stat->header_extent_size | 726 | lower_size = (crypt_stat->extent_size |
726 | * crypt_stat->num_header_extents_at_front ); | 727 | * crypt_stat->num_header_extents_at_front); |
727 | if (upper_size != 0) { | 728 | if (upper_size != 0) { |
728 | loff_t num_extents; | 729 | loff_t num_extents; |
729 | 730 | ||
diff --git a/fs/ecryptfs/mmap.c b/fs/ecryptfs/mmap.c index aaea55a61ea1..89dbbbbcce07 100644 --- a/fs/ecryptfs/mmap.c +++ b/fs/ecryptfs/mmap.c | |||
@@ -301,7 +301,7 @@ static int ecryptfs_readpage(struct file *file, struct page *page) | |||
301 | } else if (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED) { | 301 | } else if (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED) { |
302 | if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) { | 302 | if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) { |
303 | int num_pages_in_header_region = | 303 | int num_pages_in_header_region = |
304 | (crypt_stat->header_extent_size | 304 | (crypt_stat->extent_size |
305 | / PAGE_CACHE_SIZE); | 305 | / PAGE_CACHE_SIZE); |
306 | 306 | ||
307 | if (page->index < num_pages_in_header_region) { | 307 | if (page->index < num_pages_in_header_region) { |