system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-10-03 18:00:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

ceph: add infrastructure for file encryption and decryption

Browse source 
...and allow test_dummy_encryption to bypass content encryption
if mounted with test_dummy_encryption=clear.

[ xiubli: remove test_dummy_encryption=clear support per Ilya ]

Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Reviewed-and-tested-by: Luís Henriques <lhenriques@suse.de>
Reviewed-by: Milind Changire <mchangir@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
This commit is contained in:
Jeff Layton 2022-08-25 09:31:14 -04:00 committed by Ilya Dryomov
parent 0d91f0ad6a
commit 77cdb7e17e
2 changed files with 251 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

171
fs/ceph/crypto.c
View file

@ -9,6 +9,7 @@
#include <linux/ceph/ceph_debug.h>
#include <linux/xattr.h>
#include <linux/fscrypt.h>
#include <linux/ceph/striper.h>
#include "super.h"
#include "mds_client.h"
@ -365,3 +366,173 @@ int ceph_fscrypt_prepare_readdir(struct inode *dir)
}
return 0;
}
int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
struct page *page, unsigned int len,
unsigned int offs, u64 lblk_num)
{
dout("%s: len %u offs %u blk %llu\n", __func__, len, offs, lblk_num);
return fscrypt_decrypt_block_inplace(inode, page, len, offs, lblk_num);
}
int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
struct page *page, unsigned int len,
unsigned int offs, u64 lblk_num,
gfp_t gfp_flags)
{
dout("%s: len %u offs %u blk %llu\n", __func__, len, offs, lblk_num);
return fscrypt_encrypt_block_inplace(inode, page, len, offs, lblk_num,
gfp_flags);
}
/**
* ceph_fscrypt_decrypt_pages - decrypt an array of pages
* @inode: pointer to inode associated with these pages
* @page: pointer to page array
* @off: offset into the file that the read data starts
* @len: max length to decrypt
*
* Decrypt an array of fscrypt'ed pages and return the amount of
* data decrypted. Any data in the page prior to the start of the
* first complete block in the read is ignored. Any incomplete
* crypto blocks at the end of the array are ignored (and should
* probably be zeroed by the caller).
*
* Returns the length of the decrypted data or a negative errno.
*/
int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page,
u64 off, int len)
{
int i, num_blocks;
u64 baseblk = off >> CEPH_FSCRYPT_BLOCK_SHIFT;
int ret = 0;
/*
* We can't deal with partial blocks on an encrypted file, so mask off
* the last bit.
*/
num_blocks = ceph_fscrypt_blocks(off, len & CEPH_FSCRYPT_BLOCK_MASK);
/* Decrypt each block */
for (i = 0; i < num_blocks; ++i) {
int blkoff = i << CEPH_FSCRYPT_BLOCK_SHIFT;
int pgidx = blkoff >> PAGE_SHIFT;
unsigned int pgoffs = offset_in_page(blkoff);
int fret;
fret = ceph_fscrypt_decrypt_block_inplace(inode, page[pgidx],
CEPH_FSCRYPT_BLOCK_SIZE, pgoffs,
baseblk + i);
if (fret < 0) {
if (ret == 0)
ret = fret;
break;
}
ret += CEPH_FSCRYPT_BLOCK_SIZE;
}
return ret;
}
/**
* ceph_fscrypt_decrypt_extents: decrypt received extents in given buffer
* @inode: inode associated with pages being decrypted
* @page: pointer to page array
* @off: offset into the file that the data in page[0] starts
* @map: pointer to extent array
* @ext_cnt: length of extent array
*
* Given an extent map and a page array, decrypt the received data in-place,
* skipping holes. Returns the offset into buffer of end of last decrypted
* block.
*/
int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page,
u64 off, struct ceph_sparse_extent *map,
u32 ext_cnt)
{
int i, ret = 0;
struct ceph_inode_info *ci = ceph_inode(inode);
u64 objno, objoff;
u32 xlen;
/* Nothing to do for empty array */
if (ext_cnt == 0) {
dout("%s: empty array, ret 0\n", __func__);
return 0;
}
ceph_calc_file_object_mapping(&ci->i_layout, off, map[0].len,
&objno, &objoff, &xlen);
for (i = 0; i < ext_cnt; ++i) {
struct ceph_sparse_extent *ext = &map[i];
int pgsoff = ext->off - objoff;
int pgidx = pgsoff >> PAGE_SHIFT;
int fret;
if ((ext->off | ext->len) & ~CEPH_FSCRYPT_BLOCK_MASK) {
pr_warn("%s: bad encrypted sparse extent idx %d off %llx len %llx\n",
__func__, i, ext->off, ext->len);
return -EIO;
}
fret = ceph_fscrypt_decrypt_pages(inode, &page[pgidx],
off + pgsoff, ext->len);
dout("%s: [%d] 0x%llx~0x%llx fret %d\n", __func__, i,
ext->off, ext->len, fret);
if (fret < 0) {
if (ret == 0)
ret = fret;
break;
}
ret = pgsoff + fret;
}
dout("%s: ret %d\n", __func__, ret);
return ret;
}
/**
* ceph_fscrypt_encrypt_pages - encrypt an array of pages
* @inode: pointer to inode associated with these pages
* @page: pointer to page array
* @off: offset into the file that the data starts
* @len: max length to encrypt
* @gfp: gfp flags to use for allocation
*
* Decrypt an array of cleartext pages and return the amount of
* data encrypted. Any data in the page prior to the start of the
* first complete block in the read is ignored. Any incomplete
* crypto blocks at the end of the array are ignored.
*
* Returns the length of the encrypted data or a negative errno.
*/
int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page, u64 off,
int len, gfp_t gfp)
{
int i, num_blocks;
u64 baseblk = off >> CEPH_FSCRYPT_BLOCK_SHIFT;
int ret = 0;
/*
* We can't deal with partial blocks on an encrypted file, so mask off
* the last bit.
*/
num_blocks = ceph_fscrypt_blocks(off, len & CEPH_FSCRYPT_BLOCK_MASK);
/* Encrypt each block */
for (i = 0; i < num_blocks; ++i) {
int blkoff = i << CEPH_FSCRYPT_BLOCK_SHIFT;
int pgidx = blkoff >> PAGE_SHIFT;
unsigned int pgoffs = offset_in_page(blkoff);
int fret;
fret = ceph_fscrypt_encrypt_block_inplace(inode, page[pgidx],
CEPH_FSCRYPT_BLOCK_SIZE, pgoffs,
baseblk + i, gfp);
if (fret < 0) {
if (ret == 0)
ret = fret;
break;
}
ret += CEPH_FSCRYPT_BLOCK_SIZE;
}
return ret;
}

80
fs/ceph/crypto.h
View file

@ -105,6 +105,44 @@ int ceph_fname_to_usr(const struct ceph_fname *fname, struct fscrypt_str *tname,
struct fscrypt_str *oname, bool *is_nokey);
int ceph_fscrypt_prepare_readdir(struct inode *dir);
static inline unsigned int ceph_fscrypt_blocks(u64 off, u64 len)
{
/* crypto blocks cannot span more than one page */
BUILD_BUG_ON(CEPH_FSCRYPT_BLOCK_SHIFT > PAGE_SHIFT);
return ((off+len+CEPH_FSCRYPT_BLOCK_SIZE-1) >> CEPH_FSCRYPT_BLOCK_SHIFT) -
(off >> CEPH_FSCRYPT_BLOCK_SHIFT);
}
/*
* If we have an encrypted inode then we must adjust the offset and
* range of the on-the-wire read to cover an entire encryption block.
* The copy will be done using the original offset and length, after
* we've decrypted the result.
*/
static inline void ceph_fscrypt_adjust_off_and_len(struct inode *inode,
u64 *off, u64 *len)
{
if (IS_ENCRYPTED(inode)) {
*len = ceph_fscrypt_blocks(*off, *len) * CEPH_FSCRYPT_BLOCK_SIZE;
*off &= CEPH_FSCRYPT_BLOCK_MASK;
}
}
int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
struct page *page, unsigned int len,
unsigned int offs, u64 lblk_num);
int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
struct page *page, unsigned int len,
unsigned int offs, u64 lblk_num,
gfp_t gfp_flags);
int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page,
u64 off, int len);
int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page,
u64 off, struct ceph_sparse_extent *map,
u32 ext_cnt);
int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page, u64 off,
int len, gfp_t gfp);
#else /* CONFIG_FS_ENCRYPTION */
static inline void ceph_fscrypt_set_ops(struct super_block *sb)
@ -166,6 +204,48 @@ static inline int ceph_fscrypt_prepare_readdir(struct inode *dir)
{
return 0;
}
static inline void ceph_fscrypt_adjust_off_and_len(struct inode *inode,
u64 *off, u64 *len)
{
}
static inline int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
struct page *page, unsigned int len,
unsigned int offs, u64 lblk_num)
{
return 0;
}
static inline int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
struct page *page, unsigned int len,
unsigned int offs, u64 lblk_num,
gfp_t gfp_flags)
{
return 0;
}
static inline int ceph_fscrypt_decrypt_pages(struct inode *inode,
struct page **page, u64 off,
int len)
{
return 0;
}
static inline int ceph_fscrypt_decrypt_extents(struct inode *inode,
struct page **page, u64 off,
struct ceph_sparse_extent *map,
u32 ext_cnt)
{
return 0;
}
static inline int ceph_fscrypt_encrypt_pages(struct inode *inode,
struct page **page, u64 off,
int len, gfp_t gfp)
{
return 0;
}
#endif /* CONFIG_FS_ENCRYPTION */
#endif