From 5dc7e44aa2cb6527b0e2f4e7108c8cbd7c2a72c1 Mon Sep 17 00:00:00 2001 From: Jakob Unterwurzacher Date: Sun, 11 Oct 2015 17:14:18 +0200 Subject: Move main files to top level dir This is in preparation of getting rid of the shell wrapper --- .gitignore | 2 +- build.bash | 1 - gocryptfs | 1 - gocryptfs_main/main.go | 233 ------------------------------------- gocryptfs_main/main_test.go | 277 -------------------------------------------- gocryptfs_main/masterkey.go | 53 --------- gocryptfs_main/password.go | 31 ----- gocryptfs_main/sendsig.go | 42 ------- main.go | 233 +++++++++++++++++++++++++++++++++++++ main_test.go | 277 ++++++++++++++++++++++++++++++++++++++++++++ masterkey.go | 53 +++++++++ password.go | 31 +++++ sendsig.go | 42 +++++++ 13 files changed, 637 insertions(+), 639 deletions(-) delete mode 120000 gocryptfs delete mode 100644 gocryptfs_main/main.go delete mode 100644 gocryptfs_main/main_test.go delete mode 100644 gocryptfs_main/masterkey.go delete mode 100644 gocryptfs_main/password.go delete mode 100644 gocryptfs_main/sendsig.go create mode 100644 main.go create mode 100644 main_test.go create mode 100644 masterkey.go create mode 100644 password.go create mode 100644 sendsig.go diff --git a/.gitignore b/.gitignore index 22ad0f7..69001ac 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,5 @@ # binary -/gocryptfs_main/gocryptfs_main +/gocryptfs # temporary files created by the tests /tmp diff --git a/build.bash b/build.bash index ab55293..8d985d0 100755 --- a/build.bash +++ b/build.bash @@ -2,5 +2,4 @@ set -eu -cd gocryptfs_main go build diff --git a/gocryptfs b/gocryptfs deleted file mode 120000 index 2e2bf98..0000000 --- a/gocryptfs +++ /dev/null @@ -1 +0,0 @@ -gocryptfs_main/gocryptfs \ No newline at end of file diff --git a/gocryptfs_main/main.go b/gocryptfs_main/main.go deleted file mode 100644 index 912ff72..0000000 --- a/gocryptfs_main/main.go +++ /dev/null @@ -1,233 +0,0 @@ -package main - -import ( - "flag" - "fmt" - "io/ioutil" - "os" - "path/filepath" - "runtime" - "runtime/pprof" - "time" - - "github.com/rfjakob/gocryptfs/cryptfs" - "github.com/rfjakob/gocryptfs/pathfs_frontend" - - "github.com/hanwen/go-fuse/fuse" - "github.com/hanwen/go-fuse/fuse/nodefs" - "github.com/hanwen/go-fuse/fuse/pathfs" -) - -const ( - USE_OPENSSL = true - PATHFS_DEBUG = false - - PROGRAM_NAME = "gocryptfs" - - // Exit codes - ERREXIT_USAGE = 1 - ERREXIT_NEWFS = 2 - ERREXIT_MOUNT = 3 - ERREXIT_SERVE = 4 - ERREXIT_MOUNT2 = 5 - ERREXIT_CIPHERDIR = 6 - ERREXIT_INIT = 7 - ERREXIT_LOADCONF = 8 - ERREXIT_PASSWORD = 9 -) - -func initDir(dirArg string) { - dir, _ := filepath.Abs(dirArg) - - if dirEmpty(dir) == false { - fmt.Printf("Error: Directory \"%s\" is not empty\n", dirArg) - os.Exit(ERREXIT_INIT) - } - - confName := filepath.Join(dir, cryptfs.ConfDefaultName) - fmt.Printf("Choose a password for protecting your files.\n") - password := readPasswordTwice() - err := cryptfs.CreateConfFile(confName, password) - if err != nil { - fmt.Println(err) - os.Exit(ERREXIT_INIT) - } - fmt.Printf("The filesystem is now ready for mounting.\n") - os.Exit(0) -} - -func usageText() { - fmt.Printf("Usage: %s [OPTIONS] CIPHERDIR MOUNTPOINT\n", PROGRAM_NAME) - fmt.Printf("\nOptions:\n") - flag.PrintDefaults() -} - -func main() { - runtime.GOMAXPROCS(4) - - // Parse command line arguments - var debug, init, zerokey, fusedebug, openssl, passwd bool - var masterkey string - - flag.Usage = usageText - flag.BoolVar(&debug, "debug", false, "Enable debug output") - flag.BoolVar(&fusedebug, "fusedebug", false, "Enable fuse library debug output") - flag.BoolVar(&init, "init", false, "Initialize encrypted directory") - flag.BoolVar(&zerokey, "zerokey", false, "Use all-zero dummy master key") - flag.BoolVar(&openssl, "openssl", true, "Use OpenSSL instead of built-in Go crypto") - flag.BoolVar(&passwd, "passwd", false, "Change password") - flag.StringVar(&masterkey, "masterkey", "", "Mount with explicit master key") - var cpuprofile = flag.String("cpuprofile", "", "Write cpu profile to specified file") - - flag.Parse() - if *cpuprofile != "" { - f, err := os.Create(*cpuprofile) - if err != nil { - fmt.Println(err) - os.Exit(ERREXIT_INIT) - } - fmt.Printf("Writing CPU profile to %s\n", *cpuprofile) - pprof.StartCPUProfile(f) - defer pprof.StopCPUProfile() - } - if debug { - cryptfs.Debug.Enable() - cryptfs.Debug.Printf("Debug output enabled\n") - } - if openssl == false { - fmt.Printf("Openssl disabled\n") - } - if init { - if flag.NArg() != 1 { - fmt.Printf("Usage: %s --init CIPHERDIR\n", PROGRAM_NAME) - os.Exit(ERREXIT_USAGE) - } - initDir(flag.Arg(0)) - } else if passwd { - if flag.NArg() != 1 { - fmt.Printf("Usage: %s --passwd CIPHERDIR\n", PROGRAM_NAME) - os.Exit(ERREXIT_USAGE) - } - } else if flag.NArg() < 2 { - usageText() - os.Exit(ERREXIT_USAGE) - } - cipherdir, _ := filepath.Abs(flag.Arg(0)) - mountpoint, _ := filepath.Abs(flag.Arg(1)) - cryptfs.Debug.Printf("cipherdir=%s\nmountpoint=%s\n", cipherdir, mountpoint) - - _, err := os.Stat(cipherdir) - if err != nil { - fmt.Printf("Cipherdir: %s\n", err.Error()) - os.Exit(ERREXIT_CIPHERDIR) - } - - var cf *cryptfs.ConfFile - var currentPassword string - key := make([]byte, cryptfs.KEY_LEN) - if zerokey { - fmt.Printf("Zerokey mode active: using all-zero dummy master key.\n") - } else if len(masterkey) > 0 { - key = parseMasterKey(masterkey) - fmt.Printf("Using explicit master key.\n") - } else { - cfname := filepath.Join(cipherdir, cryptfs.ConfDefaultName) - _, err = os.Stat(cfname) - if err != nil { - fmt.Printf("Error: %s not found in CIPHERDIR\n", cryptfs.ConfDefaultName) - fmt.Printf("Please run \"%s --init %s\" first\n", PROGRAM_NAME, flag.Arg(0)) - os.Exit(ERREXIT_LOADCONF) - } - if passwd == true { - fmt.Printf("Old password: ") - } else { - fmt.Printf("Password: ") - } - currentPassword = readPassword() - fmt.Printf("\nDecrypting master key... ") - cryptfs.Warn.Disable() // Silence DecryptBlock() error messages on incorrect password - key, cf, err = cryptfs.LoadConfFile(cfname, currentPassword) - cryptfs.Warn.Enable() - if err != nil { - fmt.Println(err) - fmt.Println("Password incorrect.") - os.Exit(ERREXIT_LOADCONF) - } - fmt.Printf("done.\n") - } - if passwd == true { - fmt.Printf("Please enter the new password.\n") - newPassword := readPasswordTwice() - if newPassword == currentPassword { - fmt.Printf("New and old passwords are identical\n") - os.Exit(1) - } - cf.EncryptKey(key, newPassword) - err := cf.WriteFile() - if err != nil { - fmt.Println(err) - os.Exit(ERREXIT_INIT) - } - fmt.Printf("Password changed.\n") - os.Exit(0) - } - - srv := pathfsFrontend(key, cipherdir, mountpoint, fusedebug, openssl) - - if zerokey == false && len(masterkey) == 0 { - printMasterKey(key) - } else if zerokey == true { - fmt.Printf("ZEROKEY MODE PROVIDES NO SECURITY AT ALL AND SHOULD ONLY BE USED FOR TESTING.\n") - } else if len(masterkey) > 0 { - fmt.Printf("THE MASTER KEY IS VISIBLE VIA \"ps -auxwww\", ONLY USE THIS MODE FOR EMERGENCIES.\n") - } - - fmt.Println("Filesystem ready.") - // Send notification to our parent - sendSig() - // Jump into server loop - srv.Serve() -} - -func dirEmpty(dir string) bool { - entries, err := ioutil.ReadDir(dir) - if err != nil { - fmt.Println(err) - os.Exit(ERREXIT_CIPHERDIR) - } - if len(entries) == 0 { - return true - } - return false -} - -func pathfsFrontend(key []byte, cipherdir string, mountpoint string, debug bool, openssl bool) *fuse.Server { - - finalFs := pathfs_frontend.NewFS(key, cipherdir, openssl) - pathFsOpts := &pathfs.PathNodeFsOptions{ClientInodes: true} - pathFs := pathfs.NewPathNodeFs(finalFs, pathFsOpts) - fuseOpts := &nodefs.Options{ - // These options are to be compatible with libfuse defaults, - // making benchmarking easier. - NegativeTimeout: time.Second, - AttrTimeout: time.Second, - EntryTimeout: time.Second, - } - conn := nodefs.NewFileSystemConnector(pathFs.Root(), fuseOpts) - var mOpts fuse.MountOptions - mOpts.AllowOther = false - // Set values shown in "df -T" and friends - // First column, "Filesystem" - mOpts.Options = append(mOpts.Options, "fsname="+cipherdir) - // Second column, "Type", will be shown as "fuse." + Name - mOpts.Name = "gocryptfs" - - srv, err := fuse.NewServer(conn.RawFS(), mountpoint, &mOpts) - if err != nil { - fmt.Printf("Mount failed: %v", err) - os.Exit(1) - } - srv.SetDebug(debug) - - return srv -} diff --git a/gocryptfs_main/main_test.go b/gocryptfs_main/main_test.go deleted file mode 100644 index f171a8c..0000000 --- a/gocryptfs_main/main_test.go +++ /dev/null @@ -1,277 +0,0 @@ -package main - -import ( - "bytes" - "crypto/md5" - "encoding/hex" - "fmt" - "io" - "io/ioutil" - "os" - "os/exec" - "testing" -) - -const tmpDir = "../tmp/" -const plainDir = tmpDir + "plain/" -const cipherDir = tmpDir + "cipher/" - -func mount(extraArgs ...string) { - var args []string - args = append(args, extraArgs...) - args = append(args, cipherDir) - args = append(args, plainDir) - c := exec.Command("../gocryptfs", args...) - c.Stdout = os.Stdout - c.Stderr = os.Stderr - err := c.Run() - if err != nil { - fmt.Println(err) - os.Exit(1) - } -} - -func unmount() error { - fu := exec.Command("fusermount", "-z", "-u", plainDir) - fu.Stdout = os.Stdout - fu.Stderr = os.Stderr - return fu.Run() -} - -func md5fn(filename string) string { - buf, err := ioutil.ReadFile(filename) - if err != nil { - fmt.Printf("ReadFile: %v\n", err) - return "" - } - rawHash := md5.Sum(buf) - hash := hex.EncodeToString(rawHash[:]) - return hash -} - -// This is the entry point for the tests -func TestMain(m *testing.M) { - - fu := exec.Command("fusermount", "-z", "-u", plainDir) - fu.Run() - - os.RemoveAll(tmpDir) - - err := os.MkdirAll(plainDir, 0777) - if err != nil { - panic("Could not create plainDir") - } - - err = os.MkdirAll(cipherDir, 0777) - if err != nil { - panic("Could not create cipherDir") - } - - mount("--zerokey", "--openssl=false") - r := m.Run() - unmount() - - mount("--zerokey") - r = m.Run() - unmount() - - os.Exit(r) -} - -func testWriteN(t *testing.T, fn string, n int) string { - file, err := os.Create(plainDir + fn) - if err != nil { - t.FailNow() - } - - d := make([]byte, n) - written, err := file.Write(d) - if err != nil || written != len(d) { - fmt.Printf("err=\"%s\", written=%d\n", err, written) - t.Fail() - } - file.Close() - - bin := md5.Sum(d) - hashWant := hex.EncodeToString(bin[:]) - - hashActual := md5fn(plainDir + fn) - - if hashActual != hashWant { - fmt.Printf("hashWant=%s hashActual=%s\n", hashWant, hashActual) - t.Fail() - } - - return hashActual -} - -func TestWrite10(t *testing.T) { - testWriteN(t, "10", 10) -} - -func TestWrite100(t *testing.T) { - testWriteN(t, "100", 100) -} - -func TestWrite1M(t *testing.T) { - testWriteN(t, "1M", 1024*1024) -} - -func TestWrite1Mx100(t *testing.T) { - hashWant := testWriteN(t, "1Mx100", 1024*1024) - // Read and check 100 times to catch race conditions - var i int - for i = 0; i < 100; i++ { - hashActual := md5fn(plainDir + "1M") - if hashActual != hashWant { - fmt.Printf("Read corruption in loop # %d\n", i) - t.FailNow() - } else { - //fmt.Print(".") - } - } -} - -func TestTruncate(t *testing.T) { - fn := plainDir + "truncate" - file, err := os.Create(fn) - if err != nil { - t.FailNow() - } - // Grow to two blocks - file.Truncate(7000) - if md5fn(fn) != "95d4ec7038e3e4fdbd5f15c34c3f0b34" { - t.Errorf("Fail 7000") - } - // Shrink - needs RMW - file.Truncate(6999) - if md5fn(fn) != "35fd15873ec6c35380064a41b9b9683b" { - t.Errorf("Fail 6999") - } - // Shrink to one partial block - file.Truncate(465) - if md5fn(fn) != "a1534d6e98a6b21386456a8f66c55260" { - t.Errorf("Fail 465") - } - // Grow to exactly one block - file.Truncate(4096) - if md5fn(fn) != "620f0b67a91f7f74151bc5be745b7110" { - t.Errorf("Fail 4096") - } -} - -func TestAppend(t *testing.T) { - fn := plainDir + "append" - file, err := os.Create(fn) - if err != nil { - t.FailNow() - } - data := []byte("testdata123456789") // length 17 - var buf bytes.Buffer - var hashWant string - for i := 0; i <= 500; i++ { - file.Write(data) - buf.Write(data) - bin := md5.Sum(buf.Bytes()) - hashWant = hex.EncodeToString(bin[:]) - hashActual := md5fn(fn) - if hashWant != hashActual { - t.FailNow() - } - } - - // Overwrite with the same data - // Hash must stay the same - file.Seek(0, 0) - for i := 0; i <= 500; i++ { - file.Write(data) - hashActual := md5fn(fn) - if hashWant != hashActual { - t.FailNow() - } - } -} - -// Create a file with holes by writing to offset 0 (block #0) and -// offset 4096 (block #1). -func TestFileHoles(t *testing.T) { - fn := plainDir + "fileholes" - file, err := os.Create(fn) - if err != nil { - t.Errorf("file create failed") - } - foo := []byte("foo") - file.Write(foo) - file.WriteAt(foo, 4096) - _, err = ioutil.ReadFile(fn) - if err != nil { - t.Error(err) - } -} - -func BenchmarkStreamWrite(t *testing.B) { - buf := make([]byte, 1024*1024) - t.SetBytes(int64(len(buf))) - - file, err := os.Create(plainDir + "BenchmarkWrite") - if err != nil { - t.FailNow() - } - - t.ResetTimer() - var i int - for i = 0; i < t.N; i++ { - written, err := file.Write(buf) - if err != nil { - fmt.Printf("err=\"%s\", written=%d\n", err.Error(), written) - t.FailNow() - } - } - file.Close() -} - -func BenchmarkStreamRead(t *testing.B) { - buf := make([]byte, 1024*1024) - t.SetBytes(int64(len(buf))) - - fn := plainDir + "BenchmarkWrite" - fi, _ := os.Stat(fn) - mb := int(fi.Size() / 1024 / 1024) - - if t.N > mb { - // Grow file so we can satisfy the test - //fmt.Printf("Growing file to %d MB... ", t.N) - f2, err := os.OpenFile(fn, os.O_WRONLY|os.O_APPEND, 0666) - if err != nil { - fmt.Println(err) - t.FailNow() - } - for h := 0; h < t.N-mb; h++ { - _, err = f2.Write(buf) - if err != nil { - fmt.Println(err) - t.FailNow() - } - } - f2.Close() - //fmt.Printf("done\n") - } - - file, err := os.Open(plainDir + "BenchmarkWrite") - if err != nil { - t.FailNow() - } - t.ResetTimer() - var i int - for i = 0; i < t.N; i++ { - _, err := file.Read(buf) - if err == io.EOF { - fmt.Printf("Test file too small\n") - t.SkipNow() - } else if err != nil { - fmt.Println(err) - t.FailNow() - } - } - file.Close() -} diff --git a/gocryptfs_main/masterkey.go b/gocryptfs_main/masterkey.go deleted file mode 100644 index 69f268c..0000000 --- a/gocryptfs_main/masterkey.go +++ /dev/null @@ -1,53 +0,0 @@ -package main - -import ( - "encoding/hex" - "fmt" - "github.com/rfjakob/gocryptfs/cryptfs" - "os" - "strings" -) - -// printMasterKey - remind the user that he should store the master key in -// a safe place -func printMasterKey(key []byte) { - h := hex.EncodeToString(key) - var hChunked string - - // Try to make it less scary by splitting it up in chunks - for i := 0; i < len(h); i += 8 { - hChunked += h[i : i+8] - if i < 52 { - hChunked += "-" - } - if i == 24 { - hChunked += "\n " - } - } - - fmt.Printf(` -ATTENTION: - - Your master key is: %s - -If the gocryptfs.conf file becomes corrupted or you ever forget your password, -there is only one hope for recovery: The master key. Print it to a piece of -paper and store it in a drawer. - -`, hChunked) -} - -// Parse a hex-encoded master key that was passed on the command line -func parseMasterKey(masterkey string) []byte { - masterkey = strings.Replace(masterkey, "-", "", -1) - key, err := hex.DecodeString(masterkey) - if err != nil { - fmt.Printf("Could not parse master key: %v\n", err) - os.Exit(1) - } - if len(key) != cryptfs.KEY_LEN { - fmt.Printf("Master key has length %d but we require length %d\n", len(key), cryptfs.KEY_LEN) - os.Exit(1) - } - return key -} diff --git a/gocryptfs_main/password.go b/gocryptfs_main/password.go deleted file mode 100644 index 821ecb4..0000000 --- a/gocryptfs_main/password.go +++ /dev/null @@ -1,31 +0,0 @@ -package main - -import ( - "fmt" - "golang.org/x/crypto/ssh/terminal" - "os" -) - -func readPasswordTwice() string { - fmt.Printf("Password: ") - p1 := readPassword() - fmt.Printf("\nRepeat: ") - p2 := readPassword() - fmt.Printf("\n") - if p1 != p2 { - fmt.Printf("Passwords do not match\n") - os.Exit(ERREXIT_PASSWORD) - } - return p1 -} - -// Get password from terminal -func readPassword() string { - fd := int(os.Stdin.Fd()) - p, err := terminal.ReadPassword(fd) - if err != nil { - fmt.Printf("Error: Could not read password: %v\n", err) - os.Exit(ERREXIT_PASSWORD) - } - return string(p) -} diff --git a/gocryptfs_main/sendsig.go b/gocryptfs_main/sendsig.go deleted file mode 100644 index d0e1cbb..0000000 --- a/gocryptfs_main/sendsig.go +++ /dev/null @@ -1,42 +0,0 @@ -package main - -import ( - "bytes" - "fmt" - "io/ioutil" - "os" - "syscall" -) - -// cmdline looks like this: /bin/bash \0 /path/to/gocryptfs \0 --zerokey \0 ... -const ( - WRAPPER_PREFIX = "/bin/bash\000" - WRAPPER_CONTAINS = "gocryptfs\000" -) - -// Send USR1 to the "gocryptfs" wrapper shell script. This notifies it that the -// mounting has completed sucessfully. -// -// Checks /proc/$PPID/cmdline to make sure we do not kill an unrelated process. -func sendSig() { - ppid := os.Getppid() - fn := fmt.Sprintf("/proc/%d/cmdline", ppid) - cmdline, err := ioutil.ReadFile(fn) - if err != nil { - fmt.Printf("sendSig: ReadFile: %v\n", err) - return - } - if bytes.HasPrefix(cmdline, []byte(WRAPPER_PREFIX)) && bytes.Contains(cmdline, []byte(WRAPPER_CONTAINS)) { - p, err := os.FindProcess(ppid) - if err != nil { - fmt.Printf("sendSig: FindProcess: %v\n", err) - return - } - err = p.Signal(syscall.SIGUSR1) - if err != nil { - fmt.Printf("sendSig: Signal: %v\n", err) - } - } else { - fmt.Printf("Not running under the gocryptfs wrapper - will not daemonize\n") - } -} diff --git a/main.go b/main.go new file mode 100644 index 0000000..912ff72 --- /dev/null +++ b/main.go @@ -0,0 +1,233 @@ +package main + +import ( + "flag" + "fmt" + "io/ioutil" + "os" + "path/filepath" + "runtime" + "runtime/pprof" + "time" + + "github.com/rfjakob/gocryptfs/cryptfs" + "github.com/rfjakob/gocryptfs/pathfs_frontend" + + "github.com/hanwen/go-fuse/fuse" + "github.com/hanwen/go-fuse/fuse/nodefs" + "github.com/hanwen/go-fuse/fuse/pathfs" +) + +const ( + USE_OPENSSL = true + PATHFS_DEBUG = false + + PROGRAM_NAME = "gocryptfs" + + // Exit codes + ERREXIT_USAGE = 1 + ERREXIT_NEWFS = 2 + ERREXIT_MOUNT = 3 + ERREXIT_SERVE = 4 + ERREXIT_MOUNT2 = 5 + ERREXIT_CIPHERDIR = 6 + ERREXIT_INIT = 7 + ERREXIT_LOADCONF = 8 + ERREXIT_PASSWORD = 9 +) + +func initDir(dirArg string) { + dir, _ := filepath.Abs(dirArg) + + if dirEmpty(dir) == false { + fmt.Printf("Error: Directory \"%s\" is not empty\n", dirArg) + os.Exit(ERREXIT_INIT) + } + + confName := filepath.Join(dir, cryptfs.ConfDefaultName) + fmt.Printf("Choose a password for protecting your files.\n") + password := readPasswordTwice() + err := cryptfs.CreateConfFile(confName, password) + if err != nil { + fmt.Println(err) + os.Exit(ERREXIT_INIT) + } + fmt.Printf("The filesystem is now ready for mounting.\n") + os.Exit(0) +} + +func usageText() { + fmt.Printf("Usage: %s [OPTIONS] CIPHERDIR MOUNTPOINT\n", PROGRAM_NAME) + fmt.Printf("\nOptions:\n") + flag.PrintDefaults() +} + +func main() { + runtime.GOMAXPROCS(4) + + // Parse command line arguments + var debug, init, zerokey, fusedebug, openssl, passwd bool + var masterkey string + + flag.Usage = usageText + flag.BoolVar(&debug, "debug", false, "Enable debug output") + flag.BoolVar(&fusedebug, "fusedebug", false, "Enable fuse library debug output") + flag.BoolVar(&init, "init", false, "Initialize encrypted directory") + flag.BoolVar(&zerokey, "zerokey", false, "Use all-zero dummy master key") + flag.BoolVar(&openssl, "openssl", true, "Use OpenSSL instead of built-in Go crypto") + flag.BoolVar(&passwd, "passwd", false, "Change password") + flag.StringVar(&masterkey, "masterkey", "", "Mount with explicit master key") + var cpuprofile = flag.String("cpuprofile", "", "Write cpu profile to specified file") + + flag.Parse() + if *cpuprofile != "" { + f, err := os.Create(*cpuprofile) + if err != nil { + fmt.Println(err) + os.Exit(ERREXIT_INIT) + } + fmt.Printf("Writing CPU profile to %s\n", *cpuprofile) + pprof.StartCPUProfile(f) + defer pprof.StopCPUProfile() + } + if debug { + cryptfs.Debug.Enable() + cryptfs.Debug.Printf("Debug output enabled\n") + } + if openssl == false { + fmt.Printf("Openssl disabled\n") + } + if init { + if flag.NArg() != 1 { + fmt.Printf("Usage: %s --init CIPHERDIR\n", PROGRAM_NAME) + os.Exit(ERREXIT_USAGE) + } + initDir(flag.Arg(0)) + } else if passwd { + if flag.NArg() != 1 { + fmt.Printf("Usage: %s --passwd CIPHERDIR\n", PROGRAM_NAME) + os.Exit(ERREXIT_USAGE) + } + } else if flag.NArg() < 2 { + usageText() + os.Exit(ERREXIT_USAGE) + } + cipherdir, _ := filepath.Abs(flag.Arg(0)) + mountpoint, _ := filepath.Abs(flag.Arg(1)) + cryptfs.Debug.Printf("cipherdir=%s\nmountpoint=%s\n", cipherdir, mountpoint) + + _, err := os.Stat(cipherdir) + if err != nil { + fmt.Printf("Cipherdir: %s\n", err.Error()) + os.Exit(ERREXIT_CIPHERDIR) + } + + var cf *cryptfs.ConfFile + var currentPassword string + key := make([]byte, cryptfs.KEY_LEN) + if zerokey { + fmt.Printf("Zerokey mode active: using all-zero dummy master key.\n") + } else if len(masterkey) > 0 { + key = parseMasterKey(masterkey) + fmt.Printf("Using explicit master key.\n") + } else { + cfname := filepath.Join(cipherdir, cryptfs.ConfDefaultName) + _, err = os.Stat(cfname) + if err != nil { + fmt.Printf("Error: %s not found in CIPHERDIR\n", cryptfs.ConfDefaultName) + fmt.Printf("Please run \"%s --init %s\" first\n", PROGRAM_NAME, flag.Arg(0)) + os.Exit(ERREXIT_LOADCONF) + } + if passwd == true { + fmt.Printf("Old password: ") + } else { + fmt.Printf("Password: ") + } + currentPassword = readPassword() + fmt.Printf("\nDecrypting master key... ") + cryptfs.Warn.Disable() // Silence DecryptBlock() error messages on incorrect password + key, cf, err = cryptfs.LoadConfFile(cfname, currentPassword) + cryptfs.Warn.Enable() + if err != nil { + fmt.Println(err) + fmt.Println("Password incorrect.") + os.Exit(ERREXIT_LOADCONF) + } + fmt.Printf("done.\n") + } + if passwd == true { + fmt.Printf("Please enter the new password.\n") + newPassword := readPasswordTwice() + if newPassword == currentPassword { + fmt.Printf("New and old passwords are identical\n") + os.Exit(1) + } + cf.EncryptKey(key, newPassword) + err := cf.WriteFile() + if err != nil { + fmt.Println(err) + os.Exit(ERREXIT_INIT) + } + fmt.Printf("Password changed.\n") + os.Exit(0) + } + + srv := pathfsFrontend(key, cipherdir, mountpoint, fusedebug, openssl) + + if zerokey == false && len(masterkey) == 0 { + printMasterKey(key) + } else if zerokey == true { + fmt.Printf("ZEROKEY MODE PROVIDES NO SECURITY AT ALL AND SHOULD ONLY BE USED FOR TESTING.\n") + } else if len(masterkey) > 0 { + fmt.Printf("THE MASTER KEY IS VISIBLE VIA \"ps -auxwww\", ONLY USE THIS MODE FOR EMERGENCIES.\n") + } + + fmt.Println("Filesystem ready.") + // Send notification to our parent + sendSig() + // Jump into server loop + srv.Serve() +} + +func dirEmpty(dir string) bool { + entries, err := ioutil.ReadDir(dir) + if err != nil { + fmt.Println(err) + os.Exit(ERREXIT_CIPHERDIR) + } + if len(entries) == 0 { + return true + } + return false +} + +func pathfsFrontend(key []byte, cipherdir string, mountpoint string, debug bool, openssl bool) *fuse.Server { + + finalFs := pathfs_frontend.NewFS(key, cipherdir, openssl) + pathFsOpts := &pathfs.PathNodeFsOptions{ClientInodes: true} + pathFs := pathfs.NewPathNodeFs(finalFs, pathFsOpts) + fuseOpts := &nodefs.Options{ + // These options are to be compatible with libfuse defaults, + // making benchmarking easier. + NegativeTimeout: time.Second, + AttrTimeout: time.Second, + EntryTimeout: time.Second, + } + conn := nodefs.NewFileSystemConnector(pathFs.Root(), fuseOpts) + var mOpts fuse.MountOptions + mOpts.AllowOther = false + // Set values shown in "df -T" and friends + // First column, "Filesystem" + mOpts.Options = append(mOpts.Options, "fsname="+cipherdir) + // Second column, "Type", will be shown as "fuse." + Name + mOpts.Name = "gocryptfs" + + srv, err := fuse.NewServer(conn.RawFS(), mountpoint, &mOpts) + if err != nil { + fmt.Printf("Mount failed: %v", err) + os.Exit(1) + } + srv.SetDebug(debug) + + return srv +} diff --git a/main_test.go b/main_test.go new file mode 100644 index 0000000..f171a8c --- /dev/null +++ b/main_test.go @@ -0,0 +1,277 @@ +package main + +import ( + "bytes" + "crypto/md5" + "encoding/hex" + "fmt" + "io" + "io/ioutil" + "os" + "os/exec" + "testing" +) + +const tmpDir = "../tmp/" +const plainDir = tmpDir + "plain/" +const cipherDir = tmpDir + "cipher/" + +func mount(extraArgs ...string) { + var args []string + args = append(args, extraArgs...) + args = append(args, cipherDir) + args = append(args, plainDir) + c := exec.Command("../gocryptfs", args...) + c.Stdout = os.Stdout + c.Stderr = os.Stderr + err := c.Run() + if err != nil { + fmt.Println(err) + os.Exit(1) + } +} + +func unmount() error { + fu := exec.Command("fusermount", "-z", "-u", plainDir) + fu.Stdout = os.Stdout + fu.Stderr = os.Stderr + return fu.Run() +} + +func md5fn(filename string) string { + buf, err := ioutil.ReadFile(filename) + if err != nil { + fmt.Printf("ReadFile: %v\n", err) + return "" + } + rawHash := md5.Sum(buf) + hash := hex.EncodeToString(rawHash[:]) + return hash +} + +// This is the entry point for the tests +func TestMain(m *testing.M) { + + fu := exec.Command("fusermount", "-z", "-u", plainDir) + fu.Run() + + os.RemoveAll(tmpDir) + + err := os.MkdirAll(plainDir, 0777) + if err != nil { + panic("Could not create plainDir") + } + + err = os.MkdirAll(cipherDir, 0777) + if err != nil { + panic("Could not create cipherDir") + } + + mount("--zerokey", "--openssl=false") + r := m.Run() + unmount() + + mount("--zerokey") + r = m.Run() + unmount() + + os.Exit(r) +} + +func testWriteN(t *testing.T, fn string, n int) string { + file, err := os.Create(plainDir + fn) + if err != nil { + t.FailNow() + } + + d := make([]byte, n) + written, err := file.Write(d) + if err != nil || written != len(d) { + fmt.Printf("err=\"%s\", written=%d\n", err, written) + t.Fail() + } + file.Close() + + bin := md5.Sum(d) + hashWant := hex.EncodeToString(bin[:]) + + hashActual := md5fn(plainDir + fn) + + if hashActual != hashWant { + fmt.Printf("hashWant=%s hashActual=%s\n", hashWant, hashActual) + t.Fail() + } + + return hashActual +} + +func TestWrite10(t *testing.T) { + testWriteN(t, "10", 10) +} + +func TestWrite100(t *testing.T) { + testWriteN(t, "100", 100) +} + +func TestWrite1M(t *testing.T) { + testWriteN(t, "1M", 1024*1024) +} + +func TestWrite1Mx100(t *testing.T) { + hashWant := testWriteN(t, "1Mx100", 1024*1024) + // Read and check 100 times to catch race conditions + var i int + for i = 0; i < 100; i++ { + hashActual := md5fn(plainDir + "1M") + if hashActual != hashWant { + fmt.Printf("Read corruption in loop # %d\n", i) + t.FailNow() + } else { + //fmt.Print(".") + } + } +} + +func TestTruncate(t *testing.T) { + fn := plainDir + "truncate" + file, err := os.Create(fn) + if err != nil { + t.FailNow() + } + // Grow to two blocks + file.Truncate(7000) + if md5fn(fn) != "95d4ec7038e3e4fdbd5f15c34c3f0b34" { + t.Errorf("Fail 7000") + } + // Shrink - needs RMW + file.Truncate(6999) + if md5fn(fn) != "35fd15873ec6c35380064a41b9b9683b" { + t.Errorf("Fail 6999") + } + // Shrink to one partial block + file.Truncate(465) + if md5fn(fn) != "a1534d6e98a6b21386456a8f66c55260" { + t.Errorf("Fail 465") + } + // Grow to exactly one block + file.Truncate(4096) + if md5fn(fn) != "620f0b67a91f7f74151bc5be745b7110" { + t.Errorf("Fail 4096") + } +} + +func TestAppend(t *testing.T) { + fn := plainDir + "append" + file, err := os.Create(fn) + if err != nil { + t.FailNow() + } + data := []byte("testdata123456789") // length 17 + var buf bytes.Buffer + var hashWant string + for i := 0; i <= 500; i++ { + file.Write(data) + buf.Write(data) + bin := md5.Sum(buf.Bytes()) + hashWant = hex.EncodeToString(bin[:]) + hashActual := md5fn(fn) + if hashWant != hashActual { + t.FailNow() + } + } + + // Overwrite with the same data + // Hash must stay the same + file.Seek(0, 0) + for i := 0; i <= 500; i++ { + file.Write(data) + hashActual := md5fn(fn) + if hashWant != hashActual { + t.FailNow() + } + } +} + +// Create a file with holes by writing to offset 0 (block #0) and +// offset 4096 (block #1). +func TestFileHoles(t *testing.T) { + fn := plainDir + "fileholes" + file, err := os.Create(fn) + if err != nil { + t.Errorf("file create failed") + } + foo := []byte("foo") + file.Write(foo) + file.WriteAt(foo, 4096) + _, err = ioutil.ReadFile(fn) + if err != nil { + t.Error(err) + } +} + +func BenchmarkStreamWrite(t *testing.B) { + buf := make([]byte, 1024*1024) + t.SetBytes(int64(len(buf))) + + file, err := os.Create(plainDir + "BenchmarkWrite") + if err != nil { + t.FailNow() + } + + t.ResetTimer() + var i int + for i = 0; i < t.N; i++ { + written, err := file.Write(buf) + if err != nil { + fmt.Printf("err=\"%s\", written=%d\n", err.Error(), written) + t.FailNow() + } + } + file.Close() +} + +func BenchmarkStreamRead(t *testing.B) { + buf := make([]byte, 1024*1024) + t.SetBytes(int64(len(buf))) + + fn := plainDir + "BenchmarkWrite" + fi, _ := os.Stat(fn) + mb := int(fi.Size() / 1024 / 1024) + + if t.N > mb { + // Grow file so we can satisfy the test + //fmt.Printf("Growing file to %d MB... ", t.N) + f2, err := os.OpenFile(fn, os.O_WRONLY|os.O_APPEND, 0666) + if err != nil { + fmt.Println(err) + t.FailNow() + } + for h := 0; h < t.N-mb; h++ { + _, err = f2.Write(buf) + if err != nil { + fmt.Println(err) + t.FailNow() + } + } + f2.Close() + //fmt.Printf("done\n") + } + + file, err := os.Open(plainDir + "BenchmarkWrite") + if err != nil { + t.FailNow() + } + t.ResetTimer() + var i int + for i = 0; i < t.N; i++ { + _, err := file.Read(buf) + if err == io.EOF { + fmt.Printf("Test file too small\n") + t.SkipNow() + } else if err != nil { + fmt.Println(err) + t.FailNow() + } + } + file.Close() +} diff --git a/masterkey.go b/masterkey.go new file mode 100644 index 0000000..69f268c --- /dev/null +++ b/masterkey.go @@ -0,0 +1,53 @@ +package main + +import ( + "encoding/hex" + "fmt" + "github.com/rfjakob/gocryptfs/cryptfs" + "os" + "strings" +) + +// printMasterKey - remind the user that he should store the master key in +// a safe place +func printMasterKey(key []byte) { + h := hex.EncodeToString(key) + var hChunked string + + // Try to make it less scary by splitting it up in chunks + for i := 0; i < len(h); i += 8 { + hChunked += h[i : i+8] + if i < 52 { + hChunked += "-" + } + if i == 24 { + hChunked += "\n " + } + } + + fmt.Printf(` +ATTENTION: + + Your master key is: %s + +If the gocryptfs.conf file becomes corrupted or you ever forget your password, +there is only one hope for recovery: The master key. Print it to a piece of +paper and store it in a drawer. + +`, hChunked) +} + +// Parse a hex-encoded master key that was passed on the command line +func parseMasterKey(masterkey string) []byte { + masterkey = strings.Replace(masterkey, "-", "", -1) + key, err := hex.DecodeString(masterkey) + if err != nil { + fmt.Printf("Could not parse master key: %v\n", err) + os.Exit(1) + } + if len(key) != cryptfs.KEY_LEN { + fmt.Printf("Master key has length %d but we require length %d\n", len(key), cryptfs.KEY_LEN) + os.Exit(1) + } + return key +} diff --git a/password.go b/password.go new file mode 100644 index 0000000..821ecb4 --- /dev/null +++ b/password.go @@ -0,0 +1,31 @@ +package main + +import ( + "fmt" + "golang.org/x/crypto/ssh/terminal" + "os" +) + +func readPasswordTwice() string { + fmt.Printf("Password: ") + p1 := readPassword() + fmt.Printf("\nRepeat: ") + p2 := readPassword() + fmt.Printf("\n") + if p1 != p2 { + fmt.Printf("Passwords do not match\n") + os.Exit(ERREXIT_PASSWORD) + } + return p1 +} + +// Get password from terminal +func readPassword() string { + fd := int(os.Stdin.Fd()) + p, err := terminal.ReadPassword(fd) + if err != nil { + fmt.Printf("Error: Could not read password: %v\n", err) + os.Exit(ERREXIT_PASSWORD) + } + return string(p) +} diff --git a/sendsig.go b/sendsig.go new file mode 100644 index 0000000..d0e1cbb --- /dev/null +++ b/sendsig.go @@ -0,0 +1,42 @@ +package main + +import ( + "bytes" + "fmt" + "io/ioutil" + "os" + "syscall" +) + +// cmdline looks like this: /bin/bash \0 /path/to/gocryptfs \0 --zerokey \0 ... +const ( + WRAPPER_PREFIX = "/bin/bash\000" + WRAPPER_CONTAINS = "gocryptfs\000" +) + +// Send USR1 to the "gocryptfs" wrapper shell script. This notifies it that the +// mounting has completed sucessfully. +// +// Checks /proc/$PPID/cmdline to make sure we do not kill an unrelated process. +func sendSig() { + ppid := os.Getppid() + fn := fmt.Sprintf("/proc/%d/cmdline", ppid) + cmdline, err := ioutil.ReadFile(fn) + if err != nil { + fmt.Printf("sendSig: ReadFile: %v\n", err) + return + } + if bytes.HasPrefix(cmdline, []byte(WRAPPER_PREFIX)) && bytes.Contains(cmdline, []byte(WRAPPER_CONTAINS)) { + p, err := os.FindProcess(ppid) + if err != nil { + fmt.Printf("sendSig: FindProcess: %v\n", err) + return + } + err = p.Signal(syscall.SIGUSR1) + if err != nil { + fmt.Printf("sendSig: Signal: %v\n", err) + } + } else { + fmt.Printf("Not running under the gocryptfs wrapper - will not daemonize\n") + } +} -- cgit v1.2.3