aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-05-23nametransform: harden name decryption against invalid inputJakob Unterwurzacher
This fixes a few issues I have found reviewing the code: 1) Limit the amount of data ReadLongName() will read. Previously, you could send gocryptfs into out-of-memory by symlinking gocryptfs.diriv to /dev/zero. 2) Handle the empty input case in unPad16() by returning an error. Previously, it would panic with an out-of-bounds array read. It is unclear to me if this could actually be triggered. 3) Reject empty names after base64-decoding in DecryptName(). An empty name crashes emeCipher.Decrypt(). It is unclear to me if B64.DecodeString() can actually return a non-error empty result, but let's guard against it anyway.
2017-05-23main: downgrade panic log create failure from fatal error to warningJakob Unterwurzacher
Exiting with a fatal error just pushes users to use "-nosyslog", which is even worse than not having a paniclog.
2017-05-22nametransform: diriv cache: fall back to the grandparentJakob Unterwurzacher
When a user calls into a deep directory hierarchy, we often get a sequence like this from the kernel: LOOKUP a LOOKUP a/b LOOKUP a/b/c LOOKUP a/b/c/d The diriv cache was not effective for this pattern, because it was designed for this: LOOKUP a/a LOOKUP a/b LOOKUP a/c LOOKUP a/d By also using the cached entry of the grandparent we can avoid lots of diriv reads. This benchmark is against a large encrypted directory hosted on NFS: Before: $ time ls -R nfs-backed-mount > /dev/null real 1m35.976s user 0m0.248s sys 0m0.281s After: $ time ls -R nfs-backed-mount > /dev/null real 1m3.670s user 0m0.217s sys 0m0.403s
2017-05-22README: v1.3.1 will be called v1.4Jakob Unterwurzacher
2017-05-15README: start changelog for v1.3.1Jakob Unterwurzacher
2017-05-14doc: CLI_ABI.md: fix exitcodes.go linkJakob Unterwurzacher
Needs a leading "..".
2017-05-14doc: update CLI_ABI.md with new exit codesJakob Unterwurzacher
All exit codes that are likely to occour are listed.
2017-05-14exitcodes: specific codes for failure to read or write gocryptfs.confJakob Unterwurzacher
New codes: * OpenConf = 23 * WriteConf = 24
2017-05-14exitcodes: add code 22 for "password is empty"Jakob Unterwurzacher
Empty passwords are not allowed. Let's give the error it's own exit code.
2017-05-14exitcodes: get rid of generic "Mount" exit codeJakob Unterwurzacher
Instead, create three new specific exit codes: * FuseNewServer = 19 * CtlSock = 20 * PanicLogCreate = 21
2017-05-14main: password change: exit with code 12 on wrong passwordJakob Unterwurzacher
We used to return code 8, now we return code 12 as documented in the man page. Also adds a test.
2017-05-07exitcodes: pull all exit code definitions into the packageJakob Unterwurzacher
This commit defines all exit codes in one place in the exitcodes package. Also, it adds a test to verify the exit code on incorrect password, which is what SiriKali cares about the most. Fixes https://github.com/rfjakob/gocryptfs/issues/77 .
2017-05-07fusefrontend: implement path decryption via ctlsockJakob Unterwurzacher
Closes https://github.com/rfjakob/gocryptfs/issues/84 .
2017-05-07nametranform, fusefrontend: better errors on invalid namesJakob Unterwurzacher
nametransform.DecryptName() now always returns syscall.EBADMSG if the name was invalid. fusefrontend.OpenDir error messages have been normalized.
2017-05-07Fix typos found by MisspellJakob Unterwurzacher
Misspell Finds commonly misspelled English words gocryptfs/internal/configfile/scrypt.go Line 41: warning: "paramter" is a misspelling of "parameter" (misspell) gocryptfs/internal/ctlsock/ctlsock_serve.go Line 1: warning: "implementes" is a misspelling of "implements" (misspell) gocryptfs/tests/test_helpers/helpers.go Line 27: warning: "compatability" is a misspelling of "compatibility" (misspell)
2017-05-06main: more specific default values for GitVersion etcJakob Unterwurzacher
Now looks like this: $ ./gocryptfs -version gocryptfs [GitVersion not set - please compile using ./build.bash]; go-fuse [GitVersionFuse not set - please compile using ./build.bash]; 0000-00-00 go1.8 Hopefully easier to grep for.
2017-05-06main: add "-race" to the version stringJakob Unterwurzacher
...if we were compiled with "-race".
2017-05-03fusefrontend: log "too many open files" errorsJakob Unterwurzacher
This usually indicates that the open file limit for gocryptfs is too low. We should report this to the user.
2017-05-03main: RLIMIT_NOFILE: cap to 4096Jakob Unterwurzacher
We don't want to set the limit to unlimited if "Max" is unlimited. Hard-cap to 4096.
2017-05-02main: increase open file limit to 4096Jakob Unterwurzacher
Linux by default has a soft limit of 1024 and a hard limit of 4096 on open files. We can increase it so 4096 without root permissions. This should help reduce the risk of gocryptfs running out of file descriptors, as reported at https://github.com/rfjakob/gocryptfs/issues/82 .
2017-05-01tests: support encfs in the fsstress scriptJakob Unterwurzacher
May be helpful for https://github.com/vgough/encfs/issues/214 .
2017-05-01openfiletable: rename WriteLock to ContentLockJakob Unterwurzacher
...and IDLock to HeaderLock. This matches what the locks actually protect.
2017-05-01fusefrontend: rely on nodefs.defaultFile for no-op functionsJakob Unterwurzacher
Now that we embed nodefs.NewDefaultFile(), we can drop our own no-ops.
2017-05-01contentenc: downgrade "interrupted write?" warning to debugJakob Unterwurzacher
This can happen during normal operation, and is harmless since 14038a1644f17f50b113a05d09a2a0a3b3e973b2 "fusefrontend: readFileID: reject files that consist only of a header" causes dormant header-only files to be rewritten on the next write.
2017-05-01tests: add TestXfs124Jakob Unterwurzacher
This test reproduces the problem xfstests generic/124 uncovered. The warning itself is harmless, but we should either (1) add locking so that this cannot happen anymore or (2) drop the warning. Currently fails: $ go test -v === RUN Test1980Tar --- PASS: Test1980Tar (0.00s) === RUN TestCtlSock --- PASS: TestCtlSock (0.10s) === RUN TestOpenTruncateRead --- PASS: TestOpenTruncateRead (0.00s) === RUN TestWORead --- PASS: TestWORead (0.00s) === RUN TestXfs124 cipherSize 18 == header size: interrupted write? -wpanic turns this warning into a panic: cipherSize 18 == header size: interrupted write?
2017-05-01fusefrontend: drop writeOnly flagJakob Unterwurzacher
We do not have to track the writeOnly status because the kernel will not forward read requests on a write-only FD to us anyway. I have verified this behavoir manually on a 4.10.8 kernel and also added a testcase.
2017-05-01fusefronted, openfiletable: move the open file table to its own packageJakob Unterwurzacher
The open file table code needs some room to grow for the upcoming FD multiplexing implementation.
2017-04-30travis: upgrade Go 1.8 to 1.8.1Jakob Unterwurzacher
Go 1.8.1. has been released recently. Use it for the Go 1.8 branch.
2017-04-30golint.bash: fix exit codesJakob Unterwurzacher
We want to exit with 1 only if we we have complaints left after the greps.
2017-04-29fusefrontend: rename write_lock.go -> open_file_table.goJakob Unterwurzacher
The data structure was originally called write lock table, but is now simply called the open file table. Rename the file to reflect that.
2017-04-29README: set release date for v1.3v1.3Jakob Unterwurzacher
2017-04-29fusefronted: drop unused file.String() functionJakob Unterwurzacher
This is a very old leftover.
2017-04-29readpassword: increase max password size to 2048Jakob Unterwurzacher
This is the value EncFS uses, so let's follow suit. Suggested at https://github.com/rfjakob/gocryptfs/issues/77 .
2017-04-29main: "--" should also block "-o" parsingJakob Unterwurzacher
Includes test cases.
2017-04-29fix golint complaintsJakob Unterwurzacher
2017-04-29nametransform: WriteDirIV: replace ioutil.WriteFileJakob Unterwurzacher
As reported at https://github.com/rfjakob/gocryptfs/issues/105 , the "ioutil.WriteFile(file, iv, 0400)" call causes "permissions denied" errors on an NFSv4 setup. "strace"ing diriv creation and gocryptfs.conf creation shows this: conf (works on the user's NFSv4 mount): openat(AT_FDCWD, "/tmp/a/gocryptfs.conf.tmp", O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0400) = 3 diriv (fails): openat(AT_FDCWD, "/tmp/a/gocryptfs.diriv", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0400) = 3 This patch creates the diriv file with the same flags that are used for creating the conf: openat(AT_FDCWD, "/tmp/a/gocryptfs.diriv", O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0400) = 3 Closes https://github.com/rfjakob/gocryptfs/issues/105
2017-04-24forcedecode: tighten checksJakob Unterwurzacher
...and fix a few golint issues and print a scary warning message on mount. Also, force the fs to ro,noexec.
2017-04-23Add -forcedecodedanim7
Force decode of encrypted files even if the integrity check fails, instead of failing with an IO error. Warning messages are still printed to syslog if corrupted files are encountered. It can be useful to recover files from disks with bad sectors or other corrupted media. Closes https://github.com/rfjakob/gocryptfs/pull/102 .
2017-04-23Fix Flock build breakageJakob Unterwurzacher
go-fuse has added a new method to the nodefs.File interface that caused this build error: internal/fusefrontend/file.go:75: cannot use file literal (type *file) as type nodefs.File in return argument: *file does not implement nodefs.File (missing Flock method) Fixes https://github.com/rfjakob/gocryptfs/issues/104 and prevents the problem from happening again.
2017-04-01README: add 64-bit inode numbers to changelogJakob Unterwurzacher
2017-04-01fusefrontend_reverse: switch to stable inode numbersJakob Unterwurzacher
The volatile inode numbers that we used before cause "find" to complain and error out. Virtual inode numbers are derived from their parent file inode number by adding 10^19, which is hopefully large enough no never cause problems in practice. If the backing directory contains inode numbers higher than that, stat() on these files will return EOVERFLOW. Example directory lising after this change: $ ls -i 926473 gocryptfs.conf 1000000000000926466 gocryptfs.diriv 944878 gocryptfs.longname.hmZojMqC6ns47eyVxLlH2ailKjN9bxfosi3C-FR8mjA 1000000000000944878 gocryptfs.longname.hmZojMqC6ns47eyVxLlH2ailKjN9bxfosi3C-FR8mjA.name 934408 Tdfbf02CKsTaGVYnAsSypA
2017-04-01fusefrontend_reverse: drop unused dirIVAttr functionJakob Unterwurzacher
This has long been replaced by virtualFile.GetAttr().
2017-04-01fusefrontend_reverse: convert fmt.Printf calls to tlogJakob Unterwurzacher
The fmt.Printfs output would end up in the paniclog.
2017-04-01benchmark-reverse: add file readsJakob Unterwurzacher
Note: find currently complains like this: find: failed to read file names from file system at or below ‘/tmp/linux-3.0.reverse.mnt.vNI’: No such file or directory I have analyzed this and it is caused by the non-stable inode numbers that gocryptfs -reverse uses. Will be fixed in a later commit.
2017-04-01fusefrontend_reverse: add comment to newVirtualFileJakob Unterwurzacher
...and improve and comment variable naming in findLongnameParent. No semantic changes.
2017-04-01README: link to auditJakob Unterwurzacher
2017-03-28fusefrontend_reverse: consistent file owners for .diriv, .name filesdanim7
This PR addresses the Issue #95, about "Confusing file owner for longname files in reverse mode". It affects only the reverse mode, and introduces two modifications: 1) The "gocryptfs.longname.XXXX.name" files are assigned the owner and group of the underlying plaintext file. Therefore it is consistent with the file "gocryptfs.longname.XXXX" that has the encrypted contents of the plaintext file. 2) The two virtual files mentioned above are given -r--r--r-- permissions. This is consistent with the behavior described in function Access in internal/fusefrontend_reverse/rfs.go where all virtual files are always readable. Behavior also observed in point c) in #95 . Issue #95 URL: https://github.com/rfjakob/gocryptfs/issues/95 Pull request URL: https://github.com/rfjakob/gocryptfs/pull/97
2017-03-28README: mention OpenSSL header installJakob Unterwurzacher
https://github.com/rfjakob/gocryptfs/issues/98
2017-03-28MANPAGE: reformat to GFM (github flavored markdown)Jakob Unterwurzacher
This makes it render properly on the github webinterface.
2017-03-25MANPAGE: fix alphabetical order and expand scryptn explainationJakob Unterwurzacher
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-17 12:53:45 +0000