fscrypt preparations for encryption+casefolding
Subsystems (5)
Eric Biggers
maintainerv5 cover fscrypt preparations for encryption+casefolding
This is a cleaned up and fixed version of the fscrypt patches to prepare for directories that are both encrypted and casefolded.
Patches 1-3 start deriving a SipHash key for the new dirhash method that will be used by encrypted+casefolded directories. To avoid unnecessary overhead, we only do this if the directory is actually casefolded.
Patch 4 fixes a bug in UBIFS where it didn't gracefully handle invalid hash values in fscrypt no-key names. This is an existing bug, but the new fscrypt no-key name format (patch 6) made it much easier to trigger; it started being hit by 'kvm-xfstests -c ubifs -g encrypt'.
Patch 5 updates UBIFS to make it ready for the new fscrypt no-key name format that always includes the dirhash.
Patch 6 modifies the fscrypt no-key names to always include the dirhash, since with the new dirhash method the dirhash will no longer be computable from the ciphertext filename without the key. It also fixes a longstanding issue where there could be collisions in the no-key names, due to not using a proper cryptographic hash to abbreviate names.
For more information see the main patch series, which includes the filesystem-specific changes:
https://lkml.kernel.org/linux-fscrypt/[email protected]/T/#u
This applies to fscrypt.git#master.
Changed v4 => v5:
- Fixed UBIFS encryption to work with the new no-key name format.
Daniel Rosenberg (3):
fscrypt: don't allow v1 policies with casefolding
fscrypt: derive dirhash key for casefolded directories
fscrypt: improve format of no-key names
Eric Biggers (3):
fscrypt: clarify what is meant by a per-file key
ubifs: don't trigger assertion on invalid no-key filename
ubifs: allow both hash and disk name to be provided in no-key names
Documentation/filesystems/fscrypt.rst | 40 +++-- fs/crypto/Kconfig | 1 + fs/crypto/fname.c | 239 ++++++++++++++++++++------ fs/crypto/fscrypt_private.h | 19 +- fs/crypto/hooks.c | 44 +++++ fs/crypto/keysetup.c | 81 ++++++--- fs/crypto/keysetup_v1.c | 4 +- fs/crypto/policy.c | 7 + fs/inode.c | 3 +- fs/ubifs/dir.c | 6 +- fs/ubifs/journal.c | 4 +- fs/ubifs/key.h | 1 - include/linux/fscrypt.h | 94 +++------- 13 files changed, 365 insertions(+), 178 deletions(-)
Signature · 1 line
2.25.0
Eric Biggers
maintainerPATCH v5 1/6 fscrypt: don't allow v1 policies with casefolding
From: Daniel Rosenberg <[email protected]>
Casefolded encrypted directories will use a new dirhash method that requires a secret key. If the directory uses a v2 encryption policy, it's easy to derive this key from the master key using HKDF. However, v1 encryption policies don't provide a way to derive additional keys.
Therefore, don't allow casefolding on directories that use a v1 policy. Specifically, make it so that trying to enable casefolding on a directory that has a v1 policy fails, trying to set a v1 policy on a casefolded directory fails, and trying to open a casefolded directory that has a v1 policy (if one somehow exists on-disk) fails.
--- Documentation/filesystems/fscrypt.rst | 4 +++- fs/crypto/hooks.c | 28 +++++++++++++++++++++++++++ fs/crypto/policy.c | 7 +++++++ fs/inode.c | 3 ++- include/linux/fscrypt.h | 9 +++++++++ 5 files changed, 49 insertions(+), 2 deletions(-)
Documentation/filesystems/fscrypt.rst +3 -1
@@ -513,7 +513,9 @@ FS_IOC_SET_ENCRYPTION_POLICY can fail with the following errors: - ``EEXIST``: the file is already encrypted with an encryption policy different from the one specified - ``EINVAL``: an invalid encryption policy was specified (invalid - version, mode(s), or flags; or reserved bits were set) + version, mode(s), or flags; or reserved bits were set); or a v1 + encryption policy was specified but the directory has the casefold + flag enabled (casefolding is incompatible with v1 policies). - ``ENOKEY``: a v2 encryption policy was specified, but the key with the specified ``master_key_identifier`` has not been added, nor does the process have the CAP_FOWNER capability in the initial user
fs/crypto/hooks.c +28 -0
@@ -122,6 +122,34 @@ int __fscrypt_prepare_lookup(struct inode *dir, struct dentry *dentry, }EXPORT_SYMBOL_GPL (__fscrypt_prepare_lookup); +/** +* fscrypt_prepare_setflags() - prepare to change flags with FS_IOC_SETFLAGS +* @inode: the inode on which flags are being changed +* @oldflags: the old flags +* @flags: the new flags +* +* The caller should be holding i_rwsem for write. +* +* Return: 0 on success; -errno if the flags change isn't allowed or if +* another error occurs. +*/ +int fscrypt_prepare_setflags (struct inode *inode, +unsigned int oldflags,unsigned int flags) +{ +struct fscrypt_info *ci; +int err; + +if (IS_ENCRYPTED (inode) && (flags & ~oldflags &FS_CASEFOLD_FL )) { + err =fscrypt_require_key (inode); +if (err) +return err; + ci = inode->i_crypt_info; +if (ci->ci_policy.version !=FSCRYPT_POLICY_V2 ) +return -EINVAL ; + } +return 0 ; +} +int __fscrypt_prepare_symlink (struct inode *dir,unsigned int len,unsigned int max_len,struct fscrypt_str *disk_link)
fs/crypto/policy.c +7 -0
@@ -124,6 +124,13 @@ static bool fscrypt_supported_v1_policy(const struct fscrypt_policy_v1 *policy, policy->filenames_encryption_mode))return false; +if (IS_CASEFOLDED (inode)) { +/* With v1, there's no way to derive dirhash keys. */ +fscrypt_warn (inode, +"v1 policies can't be used on casefolded directories" ); +return false; + } +return true; }
fs/inode.c +2 -1
@@ -12,6 +12,7 @@#include <linux/security.h> #include <linux/cdev.h> #include <linux/memblock.h> +#include <linux/fscrypt.h> #include <linux/fsnotify.h> #include <linux/mount.h> #include <linux/posix_acl.h>
@@ -2252,7 +2253,7 @@ int vfs_ioc_setflags_prepare(struct inode *inode, unsigned int oldflags, !capable(CAP_LINUX_IMMUTABLE))return -EPERM ; -return 0 ; +return fscrypt_prepare_setflags (inode, oldflags, flags); }EXPORT_SYMBOL (vfs_ioc_setflags_prepare);
include/linux/fscrypt.h +9 -0
@@ -263,6 +263,8 @@ extern int __fscrypt_prepare_rename(struct inode *old_dir, unsigned int flags);extern int __fscrypt_prepare_lookup (struct inode *dir,struct dentry *dentry,struct fscrypt_name *fname); +extern int fscrypt_prepare_setflags (struct inode *inode, +unsigned int oldflags,unsigned int flags);extern int __fscrypt_prepare_symlink (struct inode *dir,unsigned int len,unsigned int max_len,struct fscrypt_str *disk_link);
@@ -519,6 +521,13 @@ static inline int __fscrypt_prepare_lookup(struct inode *dir,return -EOPNOTSUPP ; } +static inline int fscrypt_prepare_setflags (struct inode *inode, +unsigned int oldflags, +unsigned int flags) +{ +return 0 ; +} + static inline int __fscrypt_prepare_symlink(struct inode *dir, unsigned int len, unsigned int max_len,
base-commit: 50d9fad73a45a78f8b974b46307712556c9a42d3
Signature · 8 lines
2.25.0 _______________________________________________ Linux-f2fs-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
Eric Biggers
maintainerPATCH v5 2/6 fscrypt: derive dirhash key for casefolded directories
In reply to Eric BiggersFrom: Daniel Rosenberg <[email protected]>
When we allow indexed directories to use both encryption and casefolding, for the dirhash we can't just hash the ciphertext filenames that are stored on-disk (as is done currently) because the dirhash must be case insensitive, but the stored names are case-preserving. Nor can we hash the plaintext names with an unkeyed hash (or a hash keyed with a value stored on-disk like ext4's s_hash_seed), since that would leak information about the names that encryption is meant to protect.
Instead, if we can accept a dirhash that's only computable when the fscrypt key is available, we can hash the plaintext names with a keyed hash using a secret key derived from the directory's fscrypt master key. We'll use SipHash-2-4 for this purpose.
Prepare for this by deriving a SipHash key for each casefolded encrypted directory. Make sure to handle deriving the key not only when setting up the directory's fscrypt_info, but also in the case where the casefold flag is enabled after the fscrypt_info was already set up. (We could just always derive the key regardless of casefolding, but that would introduce unnecessary overhead for people not using casefolding.)
[EB: improved commit message, updated fscrypt.rst, squashed with change
that avoids unnecessarily deriving the key, and many other cleanups]
--- Documentation/filesystems/fscrypt.rst | 10 +++++ fs/crypto/fname.c | 21 +++++++++++ fs/crypto/fscrypt_private.h | 13 +++++++ fs/crypto/hooks.c | 16 ++++++++ fs/crypto/keysetup.c | 54 ++++++++++++++++++++------- include/linux/fscrypt.h | 9 +++++ 6 files changed, 109 insertions(+), 14 deletions(-)
Documentation/filesystems/fscrypt.rst +10 -0
@@ -302,6 +302,16 @@ For master keys used for v2 encryption policies, a unique 16-byte "key identifier" is also derived using the KDF. This value is stored in the clear, since it is needed to reliably identify the key itself. +Dirhash keys +------------ + +For directories that are indexed using a secret-keyed dirhash over the +plaintext filenames, the KDF is also used to derive a 128-bit +SipHash-2-4 key per directory in order to hash filenames. This works +just like deriving a per-file encryption key, except that a different +KDF context is used. Currently, only casefolded ("case-insensitive") +encrypted directories use this style of hashing. + Encryption modes and usage ==========================
fs/crypto/fname.c +21 -0
@@ -402,6 +402,27 @@ int fscrypt_setup_filename(struct inode *dir, const struct qstr *iname, }EXPORT_SYMBOL (fscrypt_setup_filename); +/** +* fscrypt_fname_siphash() - calculate the SipHash of a filename +* @dir: the parent directory +* @name: the filename to calculate the SipHash of +* +* Given a plaintext filename @name and a directory @dir which uses SipHash as +* its dirhash method and has had its fscrypt key set up, this function +* calculates the SipHash of that name using the directory's secret dirhash key. +* +* Return: the SipHash of @name using the hash key of @dir +*/ +u64 fscrypt_fname_siphash (const struct inode *dir,const struct qstr *name) +{ +const struct fscrypt_info *ci = dir->i_crypt_info; + +WARN_ON (!ci->ci_dirhash_key_initialized); + +return siphash (name->name, name->len, &ci->ci_dirhash_key); +} +EXPORT_SYMBOL_GPL (fscrypt_fname_siphash); +/* * Validate dentries in encrypted directories to make sure we aren't potentially * caching stale dentries after a key has been added.
fs/crypto/fscrypt_private.h +13 -0
@@ -12,6 +12,7 @@#define _FSCRYPT_PRIVATE_H#include <linux/fscrypt.h> +#include <linux/siphash.h> #include <crypto/hash.h> #define CONST_STRLEN (str) (sizeof(str) - 1)
@@ -188,6 +189,14 @@ struct fscrypt_info {*/ struct fscrypt_direct_key *ci_direct_key; +/* +* This inode's hash key for filenames. This is a 128-bit SipHash-2-4 +* key. This is only set for directories that use a keyed dirhash over +* the plaintext filenames -- currently just casefolded directories. +*/ +siphash_key_t ci_dirhash_key; +bool ci_dirhash_key_initialized; +/* The encryption policy used by this inode */ union fscrypt_policy ci_policy;
@@ -262,6 +271,7 @@ extern int fscrypt_init_hkdf(struct fscrypt_hkdf *hkdf, const u8 *master_key,#define HKDF_CONTEXT_PER_FILE_KEY 2#define HKDF_CONTEXT_DIRECT_KEY 3#define HKDF_CONTEXT_IV_INO_LBLK_64_KEY 4 +#define HKDF_CONTEXT_DIRHASH_KEY 5 extern int fscrypt_hkdf_expand(const struct fscrypt_hkdf *hkdf, u8 context, const u8 *info, unsigned int infolen,
@@ -433,6 +443,9 @@ fscrypt_allocate_skcipher(struct fscrypt_mode *mode, const u8 *raw_key,extern int fscrypt_set_derived_key (struct fscrypt_info *ci,const u8 *derived_key); +extern int fscrypt_derive_dirhash_key (struct fscrypt_info *ci, +const struct fscrypt_master_key *mk); +/* keysetup_v1.c */ extern void fscrypt_put_direct_key (struct fscrypt_direct_key *dk);
fs/crypto/hooks.c +16 -0
@@ -5,6 +5,8 @@* Encryption hooks for higher-level filesystem operations. */ +#include <linux/key.h> +#include "fscrypt_private.h" /**
@@ -137,8 +139,14 @@ int fscrypt_prepare_setflags(struct inode *inode, unsigned int oldflags, unsigned int flags) {struct fscrypt_info *ci; +struct fscrypt_master_key *mk;int err; +/* +* When the CASEFOLD flag is set on an encrypted directory, we must +* derive the secret key needed for the dirhash. This is only possible +* if the directory uses a v2 encryption policy. +*/ if (IS_ENCRYPTED (inode) && (flags & ~oldflags &FS_CASEFOLD_FL )) { err =fscrypt_require_key (inode);if (err)
@@ -146,6 +154,14 @@ int fscrypt_prepare_setflags(struct inode *inode, ci = inode->i_crypt_info;if (ci->ci_policy.version !=FSCRYPT_POLICY_V2 )return -EINVAL ; + mk = ci->ci_master_key->payload.data[0 ]; +down_read (&mk->mk_secret_sem); +if (is_master_key_secret_present (&mk->mk_secret)) + err =fscrypt_derive_dirhash_key (ci, mk); +else + err = -ENOKEY ; +up_read (&mk->mk_secret_sem); +return err; }return 0 ; }
fs/crypto/keysetup.c +40 -14
79 lines not on this page · raw message
include/linux/fscrypt.h +9 -0
@@ -172,6 +172,8 @@ extern int fscrypt_fname_disk_to_usr(const struct inode *inode, u32 hash, u32 minor_hash, const struct fscrypt_str *iname, struct fscrypt_str *oname); +extern u64 fscrypt_fname_siphash (const struct inode *dir, +const struct qstr *name);#define FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE 32
@@ -479,6 +481,13 @@ static inline bool fscrypt_match_name(const struct fscrypt_name *fname,return !memcmp (de_name, fname->disk_name.name, fname->disk_name.len); } +static inline u64 fscrypt_fname_siphash (const struct inode *dir, +const struct qstr *name) +{ +WARN_ON_ONCE (1 ); +return 0 ; +} +/* bio.c */ static inline void fscrypt_decrypt_bio (struct bio *bio) {
Signature · 1 line
2.25.0
Eric Biggers
maintainerPATCH v5 3/6 fscrypt: clarify what is meant by a per-file key
In reply to Eric BiggersFrom: Eric Biggers <[email protected]>
Now that there's sometimes a second type of per-file key (the dirhash key), clarify some function names, macros, and documentation that specifically deal with per-file *encryption* keys.
--- Documentation/filesystems/fscrypt.rst | 24 ++++++++--------- fs/crypto/fscrypt_private.h | 6 ++--- fs/crypto/keysetup.c | 39 ++++++++++++++------------- fs/crypto/keysetup_v1.c | 4 +-- 4 files changed, 37 insertions(+), 36 deletions(-)
Documentation/filesystems/fscrypt.rst +12 -12
@@ -234,8 +234,8 @@ HKDF is more flexible, is nonreversible, and evenly distributes entropy from the master key. HKDF is also standardized and widely used by other software, whereas the AES-128-ECB based KDF is ad-hoc. -Per-file keys -------------- +Per-file encryption keys +------------------------ Since each master key can protect many files, it is necessary to "tweak" the encryption of each file so that the same plaintext in two
@@ -268,9 +268,9 @@ is greater than that of an AES-256-XTS key. Therefore, to improve performance and save memory, for Adiantum a "direct key" configuration is supported. When the user has enabled this by setting FSCRYPT_POLICY_FLAG_DIRECT_KEY in the fscrypt policy, -per-file keys are not used. Instead, whenever any data (contents or -filenames) is encrypted, the file's 16-byte nonce is included in the -IV. Moreover: +per-file encryption keys are not used. Instead, whenever any data +(contents or filenames) is encrypted, the file's 16-byte nonce is +included in the IV. Moreover: - For v1 encryption policies, the encryption is done directly with the master key. Because of this, users **must not** use the same master
@@ -335,11 +335,11 @@ used. Adiantum is a (primarily) stream cipher-based mode that is fast even on CPUs without dedicated crypto instructions. It's also a true wide-block mode, unlike XTS. It can also eliminate the need to derive -per-file keys. However, it depends on the security of two primitives, -XChaCha12 and AES-256, rather than just one. See the paper -"Adiantum: length-preserving encryption for entry-level processors" -(https://eprint.iacr.org/2018/720.pdf) for more details. To use -Adiantum, CONFIG_CRYPTO_ADIANTUM must be enabled. Also, fast +per-file encryption keys. However, it depends on the security of two +primitives, XChaCha12 and AES-256, rather than just one. See the +paper "Adiantum: length-preserving encryption for entry-level +processors" (https://eprint.iacr.org/2018/720.pdf) for more details. +To use Adiantum, CONFIG_CRYPTO_ADIANTUM must be enabled. Also, fast implementations of ChaCha and NHPoly1305 should be enabled, e.g. CONFIG_CRYPTO_CHACHA20_NEON and CONFIG_CRYPTO_NHPOLY1305_NEON for ARM.
@@ -1149,8 +1149,8 @@ The context structs contain the same information as the corresponding policy structs (see `Setting an encryption policy`_), except that the context structs also contain a nonce. The nonce is randomly generated by the kernel and is used as KDF input or as a tweak to cause -different files to be encrypted differently; see `Per-file keys`_ and -`DIRECT_KEY policies`_. +different files to be encrypted differently; see `Per-file encryption +keys`_ and `DIRECT_KEY policies`_. Data path changes -----------------
fs/crypto/fscrypt_private.h +3 -3
@@ -268,7 +268,7 @@ extern int fscrypt_init_hkdf(struct fscrypt_hkdf *hkdf, const u8 *master_key,* output doesn't reveal another. */ #define HKDF_CONTEXT_KEY_IDENTIFIER 1 -#define HKDF_CONTEXT_PER_FILE_KEY 2 +#define HKDF_CONTEXT_PER_FILE_ENC_KEY 2#define HKDF_CONTEXT_DIRECT_KEY 3#define HKDF_CONTEXT_IV_INO_LBLK_64_KEY 4#define HKDF_CONTEXT_DIRHASH_KEY 5
@@ -440,8 +440,8 @@ extern struct crypto_skcipher * fscrypt_allocate_skcipher(struct fscrypt_mode *mode, const u8 *raw_key, const struct inode *inode); -extern int fscrypt_set_derived_key (struct fscrypt_info *ci, -const u8 *derived_key); +extern int fscrypt_set_per_file_enc_key (struct fscrypt_info *ci, +const u8 *raw_key);extern int fscrypt_derive_dirhash_key (struct fscrypt_info *ci,const struct fscrypt_master_key *mk);
fs/crypto/keysetup.c +20 -19
@@ -107,12 +107,12 @@ struct crypto_skcipher *fscrypt_allocate_skcipher(struct fscrypt_mode *mode,return ERR_PTR (err); } -/* Given the per-file key, set up the file's crypto transform object */ -int fscrypt_set_derived_key (struct fscrypt_info *ci,const u8 *derived_key) +/* Given a per-file encryption key, set up the file's crypto transform object */ +int fscrypt_set_per_file_enc_key (struct fscrypt_info *ci,const u8 *raw_key) {struct crypto_skcipher *tfm; - tfm =fscrypt_allocate_skcipher (ci->ci_mode, derived_key, ci->ci_inode); + tfm =fscrypt_allocate_skcipher (ci->ci_mode, raw_key, ci->ci_inode);if (IS_ERR (tfm))return PTR_ERR (tfm);
@@ -121,10 +121,10 @@ int fscrypt_set_derived_key(struct fscrypt_info *ci, const u8 *derived_key)return 0 ; } -static int setup_per_mode_key (struct fscrypt_info *ci, -struct fscrypt_master_key *mk, -struct crypto_skcipher **tfms, -u8 hkdf_context,bool include_fs_uuid) +static int setup_per_mode_enc_key (struct fscrypt_info *ci, +struct fscrypt_master_key *mk, +struct crypto_skcipher **tfms, +u8 hkdf_context,bool include_fs_uuid) {const struct inode *inode = ci->ci_inode;const struct super_block *sb = inode->i_sb;
@@ -196,15 +196,15 @@ static int fscrypt_setup_v2_file_key(struct fscrypt_info *ci,if (ci->ci_policy.v2.flags &FSCRYPT_POLICY_FLAG_DIRECT_KEY ) {/* -* DIRECT_KEY: instead of deriving per-file keys, the per-file -* nonce will be included in all the IVs. But unlike v1 -* policies, for v2 policies in this case we don't encrypt with -* the master key directly but rather derive a per-mode key. -* This ensures that the master key is consistently used only -* for HKDF, avoiding key reuse issues. +* DIRECT_KEY: instead of deriving per-file encryption keys, the +* per-file nonce will be included in all the IVs. But unlike +* v1 policies, for v2 policies in this case we don't encrypt +* with the master key directly but rather derive a per-mode +* encryption key. This ensures that the master key is +* consistently used only for HKDF, avoiding key reuse issues. */ - err =setup_per_mode_key (ci, mk, mk->mk_direct_tfms, -HKDF_CONTEXT_DIRECT_KEY , false); + err =setup_per_mode_enc_key (ci, mk, mk->mk_direct_tfms, +HKDF_CONTEXT_DIRECT_KEY , false); }else if (ci->ci_policy.v2.flags &FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 ) {/*
@@ -213,20 +213,21 @@ static int fscrypt_setup_v2_file_key(struct fscrypt_info *ci,* the IVs. This format is optimized for use with inline * encryption hardware compliant with the UFS or eMMC standards. */ - err =setup_per_mode_key (ci, mk, mk->mk_iv_ino_lblk_64_tfms, -HKDF_CONTEXT_IV_INO_LBLK_64_KEY , true); + err =setup_per_mode_enc_key (ci, mk, mk->mk_iv_ino_lblk_64_tfms, +HKDF_CONTEXT_IV_INO_LBLK_64_KEY , + true); }else {u8 derived_key[FSCRYPT_MAX_KEY_SIZE ]; err =fscrypt_hkdf_expand (&mk->mk_secret.hkdf, -HKDF_CONTEXT_PER_FILE_KEY , +HKDF_CONTEXT_PER_FILE_ENC_KEY , ci->ci_nonce,FS_KEY_DERIVATION_NONCE_SIZE , derived_key, ci->ci_mode->keysize);if (err)return err; - err =fscrypt_set_derived_key (ci, derived_key); + err =fscrypt_set_per_file_enc_key (ci, derived_key);memzero_explicit (derived_key, ci->ci_mode->keysize); }if (err)
fs/crypto/keysetup_v1.c +2 -2
@@ -9,7 +9,7 @@* This file implements compatibility functions for the original encryption * policy version ("v1"), including: * -* - Deriving per-file keys using the AES-128-ECB based KDF +* - Deriving per-file encryption keys using the AES-128-ECB based KDF * (rather than the new method of using HKDF-SHA512) * * - Retrieving fscrypt master keys from process-subscribed keyrings
@@ -283,7 +283,7 @@ static int setup_v1_file_key_derived(struct fscrypt_info *ci,if (err) goto out; - err =fscrypt_set_derived_key (ci, derived_key); + err =fscrypt_set_per_file_enc_key (ci, derived_key); out:kzfree (derived_key);return err;
Signature · 1 line
2.25.0
Re: [PATCH v5 3/6] fscrypt: clarify what is meant by a per-file key
Quoted 8 lines · Eric Biggers
From: Eric Biggers <[email protected]>
Now that there's sometimes a second type of per-file key (the dirhash key), clarify some function names, macros, and documentation that specifically deal with per-file *encryption* keys.
Signed-off-by Eric Biggers <[email protected]>
Looks good to me. Feel free to add
Eric Biggers
maintainerPATCH v5 4/6 ubifs: don't trigger assertion on invalid no-key filename
In reply to Eric BiggersFrom: Eric Biggers <[email protected]>
If userspace provides an invalid fscrypt no-key filename which encodes a hash value with any of the UBIFS node type bits set (i.e. the high 3 bits), gracefully report ENOENT rather than triggering ubifs_assert().
Test case with kvm-xfstests shell:
. fs/ubifs/config
. ~/xfstests/common/encrypt dev=$(__blkdev_to_ubi_volume /dev/vdc) ubiupdatevol $dev -t
mount $dev /mnt -t ubifs
mkdir /mnt/edir
xfs_io -c set_encpolicy /mnt/edir
rm /mnt/edir/_,,,,,DAAAAAAAAAAAAAAAAAAAAAAAAAA
With the bug, the following assertion fails on the 'rm' command:
[ 19.066048] UBIFS error (ubi0:0 pid 379): ubifs_assert_failed: UBIFS assert failed: !(hash & ~UBIFS_S_KEY_HASH_MASK), in fs/ubifs/key.h:170
--- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ubifs/dir.c +2 -0
@@ -228,6 +228,8 @@ static struct dentry *ubifs_lookup(struct inode *dir, struct dentry *dentry,if (nm.hash) {ubifs_assert (c,fname_len (&nm) ==0 );ubifs_assert (c,fname_name (&nm) ==NULL ); +if (nm.hash & ~UBIFS_S_KEY_HASH_MASK ) + goto done;/* ENOENT */ dent_key_init_hash (c, &key, dir->i_ino, nm.hash); err =ubifs_tnc_lookup_dh (c, &key, dent, nm.minor_hash); }else {
Signature · 8 lines
2.25.0 _______________________________________________ Linux-f2fs-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
Eric Biggers
maintainerRe: [PATCH v5 4/6] ubifs: don't trigger assertion on invalid no-key filename
Quoted 17 lines · Eric Biggers
From: Eric Biggers <[email protected]>
If userspace provides an invalid fscrypt no-key filename which encodes a hash value with any of the UBIFS node type bits set (i.e. the high 3 bits), gracefully report ENOENT rather than triggering
ubifs_assert().Test case with kvm-xfstests shell:
.
fs/ubifs/config
. ~/xfstests/common/encrypt dev=$(__blkdev_to_ubi_volume/dev/vdc) ubiupdatevol $dev -t
mount $dev /mnt -t ubifs
mkdir/mnt/edir
xfs_io-cset_encpolicy/mnt/edir
rm/mnt/edir/_,,,,,DAAAAAAAAAAAAAAAAAAAAAAAAAA
Quoted 7 lines
With the bug, the following assertion fails on the 'rm' command:
[ 19.066048] UBIFS error (ubi0:0 pid 379): ubifs_assert_failed: UBIFS assert failed: !(hash & ~UBIFS_S_KEY_HASH_MASK), in fs/ubifs/key.h:170Fixes f4f61d2cc6d8 ("ubifs: Implement encrypted filenames")Cc <[email protected]> # v4.10+Signed-off-by Eric Biggers <[email protected]>
Richard, can you review the two UBIFS patches in this series, and if you're okay with them, provide Acked-by's so that we can take them through the fscrypt tree? They don't conflict with anything currently in the UBIFS tree.
Thanks!
- Eric
Eric Biggers
maintainerRe: [PATCH v5 4/6] ubifs: don't trigger assertion on invalid no-key filename
Quoted 22 lines · Eric Biggers
Quoted 21 lines · Eric Biggers
From: Eric Biggers <[email protected]>
If userspace provides an invalid fscrypt no-key filename which encodes a hash value with any of the UBIFS node type bits set (i.e. the high 3 bits), gracefully report ENOENT rather than triggering
ubifs_assert().Test case with kvm-xfstests shell:
.
fs/ubifs/config
. ~/xfstests/common/encrypt dev=$(__blkdev_to_ubi_volume/dev/vdc) ubiupdatevol $dev -t
mount $dev /mnt -t ubifs
mkdir/mnt/edir
xfs_io-cset_encpolicy/mnt/edir
rm/mnt/edir/_,,,,,DAAAAAAAAAAAAAAAAAAAAAAAAAAWith the bug, the following assertion fails on the 'rm' command:
[ 19.066048] UBIFS error (ubi0:0 pid 379): ubifs_assert_failed: UBIFS assert failed: !(hash & ~UBIFS_S_KEY_HASH_MASK), in fs/ubifs/key.h:170
Quoted 8 lines
Quoted 3 lines
Fixes f4f61d2cc6d8 ("ubifs: Implement encrypted filenames")Cc <[email protected]> # v4.10+Signed-off-by Eric Biggers <[email protected]>Richard, can you review the two UBIFS patches in this series, and if you're okay with them, provide Acked-by's so that we can take them through the fscrypt tree? They don't conflict with anything currently in the UBIFS tree.
Richard, any objection to us taking these patches through the fscrypt tree?
- Eric
Eric Biggers
maintainerPATCH v5 5/6 ubifs: allow both hash and disk name to be provided in no-key names
In reply to Eric BiggersFrom: Eric Biggers <[email protected]>
In order to support a new dirhash method that is a secret-keyed hash over the plaintext filenames (which will be used by encrypted+casefolded directories on ext4 and f2fs), fscrypt will be switching to a new no-key name format that always encodes the dirhash in the name.
UBIFS isn't happy with this because it has assertions that verify that either the hash or the disk name is provided, not both.
Change it to use the disk name if one is provided, even if a hash is available too; else use the hash.
--- fs/ubifs/dir.c | 4 +--- fs/ubifs/journal.c | 4 ++-- fs/ubifs/key.h | 1 - 3 files changed, 3 insertions(+), 6 deletions(-)
fs/ubifs/dir.c +1 -3
@@ -225,9 +225,7 @@ static struct dentry *ubifs_lookup(struct inode *dir, struct dentry *dentry, goto done; } -if (nm.hash) { -ubifs_assert (c,fname_len (&nm) ==0 ); -ubifs_assert (c,fname_name (&nm) ==NULL ); +if (fname_name (&nm) ==NULL ) {if (nm.hash & ~UBIFS_S_KEY_HASH_MASK ) goto done;/* ENOENT */ dent_key_init_hash (c, &key, dir->i_ino, nm.hash);
fs/ubifs/journal.c +2 -2
@@ -588,7 +588,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,if (!xent) { dent->ch.node_type =UBIFS_DENT_NODE ; -if (nm->hash) +if (fname_name (nm) ==NULL )dent_key_init_hash (c, &dent_key, dir->i_ino, nm->hash);else dent_key_init (c, &dent_key, dir->i_ino, nm);
@@ -646,7 +646,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,ubifs_add_auth_dirt (c, lnum);if (deletion) { -if (nm->hash) +if (fname_name (nm) ==NULL ) err =ubifs_tnc_remove_dh (c, &dent_key, nm->minor_hash);else err =ubifs_tnc_remove_nm (c, &dent_key, nm);
fs/ubifs/key.h +0 -1
@@ -150,7 +150,6 @@ static inline void dent_key_init(const struct ubifs_info *c,uint32_t hash = c->key_hash (fname_name (nm),fname_len (nm));ubifs_assert (c, !(hash & ~UBIFS_S_KEY_HASH_MASK )); -ubifs_assert (c, !nm->hash && !nm->minor_hash); key->u32[0 ] = inum; key->u32[1 ] = hash | (UBIFS_DENT_KEY <<UBIFS_S_KEY_HASH_BITS ); }
Signature · 1 line
2.25.0
Eric Biggers
maintainerPATCH v5 6/6 fscrypt: improve format of no-key names
In reply to Eric BiggersFrom: Daniel Rosenberg <[email protected]>
When an encrypted directory is listed without the key, the filesystem must show "no-key names" that uniquely identify directory entries, are at most 255 (NAME_MAX) bytes long, and don't contain '/' or '\0'. Currently, for short names the no-key name is the base64 encoding of the ciphertext filename, while for long names it's the base64 encoding of the ciphertext filename's dirhash and second-to-last 16-byte block.
This format has the following problems:
- Since it doesn't always include the dirhash, it's incompatible with directories that will use a secret-keyed dirhash over the plaintext filenames. In this case, the dirhash won't be computable from the ciphertext name without the key, so it instead must be retrieved from the directory entry and always included in the no-key name. Casefolded encrypted directories will use this type of dirhash.
- It's ambiguous: it's possible to craft two filenames that map to the same no-key name, since the method used to abbreviate long filenames doesn't use a proper cryptographic hash function.
Solve both these problems by switching to a new no-key name format that is the base64 encoding of a variable-length structure that contains the dirhash, up to 149 bytes of the ciphertext filename, and (if any bytes remain) the SHA-256 of the remaining bytes of the ciphertext filename.
This ensures that each no-key name contains everything needed to find the directory entry again, contains only legal characters, doesn't exceed NAME_MAX, is unambiguous unless there's a SHA-256 collision, and that we only take the performance hit of SHA-256 on very long filenames.
Note: this change does *not* address the existing issue where users can modify the 'dirhash' part of a no-key name and the filesystem may still accept the name.
[EB: improved comments and commit message, fixed checking return value
of base64_decode(), check for SHA-256 error, continue to set disk_name for short names to keep matching simpler, and many other cleanups]
--- Documentation/filesystems/fscrypt.rst | 2 +- fs/crypto/Kconfig | 1 + fs/crypto/fname.c | 218 ++++++++++++++++++++------ include/linux/fscrypt.h | 76 +-------- 4 files changed, 171 insertions(+), 126 deletions(-)
Documentation/filesystems/fscrypt.rst +1 -1
@@ -1202,7 +1202,7 @@ filesystem-specific hash(es) needed for directory lookups. This allows the filesystem to still, with a high degree of confidence, map the filename given in ->lookup() back to a particular directory entry that was previously listed by readdir(). See :c:type:`struct -fscrypt_digested_name` in the source for more details. +fscrypt_nokey_name` in the source for more details. Note that the precise way that filenames are presented to userspace without the key is subject to change in the future. It is only meant
fs/crypto/Kconfig +1 -0
@@ -21,5 +21,6 @@ config FS_ENCRYPTION_ALGS select CRYPTO_CTS select CRYPTO_ECB select CRYPTO_HMAC + select CRYPTO_SHA256 select CRYPTO_SHA512 select CRYPTO_XTS
fs/crypto/fname.c +167 -51
287 lines not on this page · raw message
include/linux/fscrypt.h +2 -74
85 lines not on this page · raw message
Signature · 1 line
2.25.0
Eric Biggers
maintainerQuoted 21 lines · Eric Biggers
This is a cleaned up and fixed version of the fscrypt patches to prepare for directories that are both encrypted and casefolded.
Patches 1-3 start deriving a SipHash key for the new dirhash method that will be used by encrypted+casefolded directories. To avoid unnecessary overhead, we only do this if the directory is actually casefolded.
Patch 4 fixes a bug in UBIFS where it didn't gracefully handle invalid hash values in fscrypt no-key names. This is an existing bug, but the new fscrypt no-key name format (patch 6) made it much easier to trigger; it started being hit by 'kvm-xfstests -c ubifs -g encrypt'.
Patch 5 updates UBIFS to make it ready for the new fscrypt no-key name format that always includes the dirhash.
Patch 6 modifies the fscrypt no-key names to always include the dirhash, since with the new dirhash method the dirhash will no longer be computable from the ciphertext filename without the key. It also fixes a longstanding issue where there could be collisions in the no-key names, due to not using a proper cryptographic hash to abbreviate names.
Quoted 8 lines
For more information see the main patch series, which includes the filesystem-specific changes:
https://lkml.kernel.org/linux-fscrypt/[email protected]/T/#uThis applies to fscrypt.git#master.
Changed v4 => v5:
- Fixed UBIFS encryption to work with the new no-key name format.
I've applied this series to fscrypt.git#master; however I'd still like Acked-bys from the UBIFS maintainers on the two UBIFS patches, as well as more Reviewed-bys from anyone interested. If I don't hear anything from anyone, I might drop these to give more time, especially if there isn't an v5.5-rc8.
- Eric
Quoted 7 lines · Eric Biggers
I've applied this series to fscrypt.git#master; however I'd still like Acked-bys from the UBIFS maintainers on the two UBIFS patches, as well as more Reviewed-bys from anyone interested. If I don't hear anything from anyone, I might drop these to give more time, especially if there isn't an v5.5-rc8.
- Eric
The patches look good to me. Thanks for the fixups. -Daniel