summaryrefslogtreecommitdiff
path: root/internal
diff options
context:
space:
mode:
authorJakob Unterwurzacher2016-09-25 18:01:24 +0200
committerJakob Unterwurzacher2016-09-25 18:01:24 +0200
commitb883dd10a62eb8d7ddf589e2878d8e0f65a90e83 (patch)
treebd500c18f8c7bd8095617011eb0ea3dace11ac5c /internal
parent12808138ef105824de97924a585ad66bacb3a18b (diff)
reverse: add symlink encryption and Readlink support
Diffstat (limited to 'internal')
-rw-r--r--internal/fusefrontend_reverse/rfs.go21
-rw-r--r--internal/fusefrontend_reverse/rpath.go6
-rw-r--r--internal/nametransform/names.go4
3 files changed, 29 insertions, 2 deletions
diff --git a/internal/fusefrontend_reverse/rfs.go b/internal/fusefrontend_reverse/rfs.go
index 6089d41..cfe23b6 100644
--- a/internal/fusefrontend_reverse/rfs.go
+++ b/internal/fusefrontend_reverse/rfs.go
@@ -1,6 +1,7 @@
package fusefrontend_reverse
import (
+ "encoding/base64"
"fmt"
"os"
"path/filepath"
@@ -275,3 +276,23 @@ func (rfs *reverseFS) OpenDir(cipherPath string, context *fuse.Context) ([]fuse.
func (rfs *reverseFS) StatFs(name string) *fuse.StatfsOut {
return rfs.loopbackfs.StatFs(name)
}
+
+// Readlink - FUSE call
+func (rfs *reverseFS) Readlink(cipherPath string, context *fuse.Context) (string, fuse.Status) {
+ absPath, err := rfs.abs(rfs.decryptPath(cipherPath))
+ if err != nil {
+ return "", fuse.ToStatus(err)
+ }
+ plainTarget, err := os.Readlink(absPath)
+ if err != nil {
+ return "", fuse.ToStatus(err)
+ }
+ if rfs.args.PlaintextNames {
+ return plainTarget, fuse.OK
+ }
+ nonce := derivePathIV(cipherPath)
+ // Symlinks are encrypted like file contents and base64-encoded
+ cBinTarget := rfs.contentEnc.EncryptBlock([]byte(plainTarget), 0, nil, contentenc.ExternalNonce, nonce)
+ cTarget := base64.URLEncoding.EncodeToString(cBinTarget)
+ return cTarget, fuse.OK
+}
diff --git a/internal/fusefrontend_reverse/rpath.go b/internal/fusefrontend_reverse/rpath.go
index c603cad..6d418e0 100644
--- a/internal/fusefrontend_reverse/rpath.go
+++ b/internal/fusefrontend_reverse/rpath.go
@@ -47,6 +47,12 @@ func (rfs *reverseFS) decryptPath(relPath string) (string, error) {
if _, ok := err.(base64.CorruptInputError); ok {
return "", syscall.ENOENT
}
+ // Stat attempts on the link target of encrypted symlinks.
+ // These are always valid base64 but the length is not a
+ // multiple of 16.
+ if err == syscall.EINVAL {
+ return "", syscall.ENOENT
+ }
return "", err
}
} else if nameType == nametransform.LongNameContent {
diff --git a/internal/nametransform/names.go b/internal/nametransform/names.go
index e9fe87d..4df3430 100644
--- a/internal/nametransform/names.go
+++ b/internal/nametransform/names.go
@@ -4,7 +4,6 @@ package nametransform
import (
"crypto/aes"
"encoding/base64"
- "fmt"
"syscall"
"github.com/rfjakob/eme"
@@ -38,7 +37,8 @@ func (n *NameTransform) DecryptName(cipherName string, iv []byte) (string, error
return "", err
}
if len(bin)%aes.BlockSize != 0 {
- return "", fmt.Errorf("Decoded length %d is not a multiple of the AES block size", len(bin))
+ tlog.Warn.Printf("DecryptName %q: decoded length %d is not a multiple of 16", cipherName, len(bin))
+ return "", syscall.EINVAL
}
bin = eme.Transform(n.cryptoCore.BlockCipher, iv, bin, eme.DirectionDecrypt)
bin, err = unPad16(bin)