From af0ae03db23f845dbcf8a6738057222ce7986bd8 Mon Sep 17 00:00:00 2001 From: Jakob Unterwurzacher Date: Mon, 7 Sep 2015 21:10:42 +0200 Subject: Rename frontend to "cluefs_frontend" Enables adding another frontend later --- cluefs_frontend/fe_checks.go | 31 ++++++++ cluefs_frontend/fe_dir.go | 180 +++++++++++++++++++++++++++++++++++++++++++ cluefs_frontend/fe_file.go | 152 ++++++++++++++++++++++++++++++++++++ cluefs_frontend/fe_fs.go | 46 +++++++++++ 4 files changed, 409 insertions(+) create mode 100644 cluefs_frontend/fe_checks.go create mode 100644 cluefs_frontend/fe_dir.go create mode 100644 cluefs_frontend/fe_file.go create mode 100644 cluefs_frontend/fe_fs.go (limited to 'cluefs_frontend') diff --git a/cluefs_frontend/fe_checks.go b/cluefs_frontend/fe_checks.go new file mode 100644 index 0000000..c555436 --- /dev/null +++ b/cluefs_frontend/fe_checks.go @@ -0,0 +1,31 @@ +package cluefs_frontend + +import ( + "bazil.org/fuse/fs" +) + +// Compile-time interface checks. +var _ fs.FS = (*FS)(nil) +var _ fs.FSStatfser = (*FS)(nil) + +var _ fs.Node = (*Dir)(nil) +var _ fs.NodeCreater = (*Dir)(nil) +var _ fs.NodeMkdirer = (*Dir)(nil) +var _ fs.NodeRemover = (*Dir)(nil) +var _ fs.NodeRenamer = (*Dir)(nil) +var _ fs.HandleReadDirAller = (*Dir)(nil) + +var _ fs.HandleReader = (*File)(nil) +var _ fs.HandleWriter = (*File)(nil) +var _ fs.Node = (*File)(nil) +var _ fs.NodeOpener = (*File)(nil) +var _ fs.NodeSetattrer = (*File)(nil) + +func foo(h fs.HandleReadDirAller) { + +} + +func init() { + var d Dir + foo(&d) +} diff --git a/cluefs_frontend/fe_dir.go b/cluefs_frontend/fe_dir.go new file mode 100644 index 0000000..65d92f1 --- /dev/null +++ b/cluefs_frontend/fe_dir.go @@ -0,0 +1,180 @@ +package cluefs_frontend + +// frontend sits between FUSE and ClueFS +// and uses cryptfs for all crypto operations +// +// cryptfs +// ^ +// | +// v +// FUSE <-> frontend <-> ClueFS +// +// This file handles directories + +import ( + "fmt" + "github.com/rfjakob/gocryptfs/cryptfs" + "github.com/rfjakob/cluefs/lib/cluefs" + "bazil.org/fuse" + fusefs "bazil.org/fuse/fs" + "golang.org/x/net/context" +) + +type Dir struct { + *cluefs.Dir + crfs *cryptfs.CryptFS +} + +func NewDir(parent string, name string, fs *FS) *Dir { + cryptfs.Debug.Printf("NewDir parent=%s name=%s\n", parent, name) + return &Dir { + Dir: cluefs.NewDir(parent, name, fs.ClueFS), + crfs: fs.CryptFS, + } +} + +func (d *Dir) Open(ctx context.Context, req *fuse.OpenRequest, resp *fuse.OpenResponse) (fusefs.Handle, error) { + cryptfs.Debug.Printf("Open\n") + h, err := d.Dir.Open(ctx, req, resp) + if err != nil { + return nil, err + } + clueDir := h.(*cluefs.Dir) + + return &Dir { + Dir: clueDir, + crfs: d.crfs, + }, nil +} + +func (d *Dir) Lookup(ctx context.Context, req *fuse.LookupRequest, resp *fuse.LookupResponse) (fusefs.Node, error) { + cryptfs.Debug.Printf("Lookup %s\n", req.Name) + req.Name = d.crfs.EncryptPath(req.Name) + node, err := d.Dir.Lookup(ctx, req, resp) + if err != nil { + return nil, err + } + clueDir, ok := node.(*cluefs.Dir) + if ok { + return &Dir { + Dir: clueDir, + crfs: d.crfs, + }, nil + } else { + resp.Attr.Size = d.crfs.PlainSize(resp.Attr.Size) + clueFile := node.(*cluefs.File) + return &File { + File: clueFile, + crfs: d.crfs, + }, nil + } +} + +func (d *Dir) ReadDirAll(ctx context.Context) ([]fuse.Dirent, error) { + cryptfs.Debug.Printf("ReadDirAll\n") + entries, err := d.Dir.ReadDirAll(ctx) + if err != nil { + return nil, err + } + var decrypted []fuse.Dirent + for _, e := range entries { + if e.Name == "." || e.Name == ".." { + decrypted = append(decrypted, e) + continue + } + newName, err := d.crfs.DecryptPath(e.Name) + if err != nil { + fmt.Printf("ReadDirAll: Error decoding \"%s\": %s\n", e.Name, err.Error()) + continue + } + e.Name = newName + decrypted = append(decrypted, e) + } + return decrypted, nil +} + +func (d *Dir) Mkdir(ctx context.Context, req *fuse.MkdirRequest) (fusefs.Node, error) { + cryptfs.Debug.Printf("Mkdir %s\n", req.Name) + req.Name = d.crfs.EncryptPath(req.Name) + n, err := d.Dir.Mkdir(ctx, req) + if err != nil { + return nil, err + } + clueDir := n.(*cluefs.Dir) + return &Dir { + Dir: clueDir, + crfs: d.crfs, + }, nil +} + +func (d *Dir) Remove(ctx context.Context, req *fuse.RemoveRequest) error { + cryptfs.Debug.Printf("Remove\n") + req.Name = d.crfs.EncryptPath(req.Name) + return d.Dir.Remove(ctx, req) +} + +func (d *Dir) Create(ctx context.Context, req *fuse.CreateRequest, resp *fuse.CreateResponse) (fusefs.Node, fusefs.Handle, error) { + cryptfs.Debug.Printf("Create\n") + req.Flags, _ = fixFlags(req.Flags) + req.Name = d.crfs.EncryptPath(req.Name) + n, _, err := d.Dir.Create(ctx, req, resp) + if err != nil { + return nil, nil, err + } + clueFile := n.(*cluefs.File) + cryptFile := &File { + File: clueFile, + crfs: d.crfs, + } + return cryptFile, cryptFile, nil +} +func (d *Dir) Symlink(ctx context.Context, req *fuse.SymlinkRequest) (fusefs.Node, error) { + req.Target = d.crfs.EncryptPath(req.Target) + req.NewName = d.crfs.EncryptPath(req.NewName) + node, err := d.Dir.Symlink(ctx, req) + if err != nil { + return nil, err + } + + clueDir, ok := node.(*cluefs.Dir) + if ok { + return &Dir { + Dir: clueDir, + crfs: d.crfs, + }, nil + } else { + clueFile := node.(*cluefs.File) + return &File { + File: clueFile, + crfs: d.crfs, + }, nil + } +} +// We need to overwrite Readlink for both Dir and File. Do both right here to keep them in sync. +func (d *Dir) Readlink(ctx context.Context, req *fuse.ReadlinkRequest) (string, error) { + dest, err := d.Dir.Readlink(ctx, req) + if err != nil { + return "", err + } + return d.crfs.DecryptPath(dest) +} +func (d *File) Readlink(ctx context.Context, req *fuse.ReadlinkRequest) (string, error) { + dest, err := d.File.Readlink(ctx, req) + if err != nil { + return "", err + } + return d.crfs.DecryptPath(dest) +} +// We need to overwrite Rename for both Dir and File. Do both right here to keep them in sync. +func (d *Dir) Rename(ctx context.Context, req *fuse.RenameRequest, newDir fusefs.Node) error { + req.OldName = d.crfs.EncryptPath(req.OldName) + req.NewName = d.crfs.EncryptPath(req.NewName) + destDir := newDir.(*Dir) + return d.Dir.Rename(ctx, req, destDir.Dir) +} +func (d *File) Rename(ctx context.Context, req *fuse.RenameRequest, newDir fusefs.Node) error { + req.OldName = d.crfs.EncryptPath(req.OldName) + req.NewName = d.crfs.EncryptPath(req.NewName) + destDir := newDir.(*Dir) + return d.File.Rename(ctx, req, destDir.Dir) +} diff --git a/cluefs_frontend/fe_file.go b/cluefs_frontend/fe_file.go new file mode 100644 index 0000000..4c4e38a --- /dev/null +++ b/cluefs_frontend/fe_file.go @@ -0,0 +1,152 @@ +package cluefs_frontend + +// frontend sits between FUSE and ClueFS +// and uses cryptfs for all crypto operations +// +// cryptfs +// ^ +// | +// v +// FUSE <-> frontend <-> ClueFS +// +// This file handles files access + +import ( + "fmt" + "github.com/rfjakob/gocryptfs/cryptfs" + "github.com/rfjakob/cluefs/lib/cluefs" + + "bazil.org/fuse" + fusefs "bazil.org/fuse/fs" + "golang.org/x/net/context" +) + +func fixFlags(flags fuse.OpenFlags) (fuse.OpenFlags, bool) { + cryptfs.Debug.Printf("fixFlags: Before: %s\n", flags.String()) + var writeOnly bool + // We always need read access to do read-modify-write cycles + if flags & fuse.OpenWriteOnly > 0 { + flags = flags &^ fuse.OpenWriteOnly + flags = flags | fuse.OpenReadWrite + writeOnly = true + } + // We also cannot open the file in append mode, we need to seek back for RMW + flags = flags &^ fuse.OpenAppend + cryptfs.Debug.Printf("fixFlags: After: %s\n", flags.String()) + return flags, writeOnly +} + +func max(x int, y int) int { + if x > y { + return x + } + return y +} + +type File struct { + *cluefs.File + crfs *cryptfs.CryptFS + // Remember if the file is supposed to be write-only + writeOnly bool +} + +func (f *File) Open(ctx context.Context, req *fuse.OpenRequest, resp *fuse.OpenResponse) (fusefs.Handle, error) { + cryptfs.Debug.Printf("File.Open\n") + + req.Flags, f.writeOnly = fixFlags(req.Flags) + + h, err := f.File.Open(ctx, req, resp) + if err != nil { + return nil, err + } + clueFile := h.(*cluefs.File) + return &File { + File: clueFile, + crfs: f.crfs, + }, nil +} + +func (f *File) Read(ctx context.Context, req *fuse.ReadRequest, resp *fuse.ReadResponse) error { + + cryptfs.Debug.Printf("Read: o=%d l=%d\n", req.Offset, req.Size) + + // Read the backing ciphertext in one go + iblocks := f.crfs.SplitRange(uint64(req.Offset), uint64(req.Size)) + var cipherReq fuse.ReadRequest + var cipherResp fuse.ReadResponse + o, l := f.crfs.JoinCiphertextRange(iblocks) + cipherResp.Data = make([]byte, int(l)) + cipherReq.Offset = int64(o) + cipherReq.Size = int(l) + cryptfs.Debug.Printf("Read: cipherReq o=%d l=%d\n", o, l) + err := f.File.Read(ctx, &cipherReq, &cipherResp) + if err != nil { + return err + } + + // Decrypt it + plaintext, err := f.crfs.DecryptBlocks(cipherResp.Data) + if err != nil { + resp.Data = plaintext + return err + } + // Crop down to relevant part + resp.Data = f.crfs.CropPlaintext(plaintext, iblocks) + + return nil +} + +func (f *File) Write(ctx context.Context, req *fuse.WriteRequest, resp *fuse.WriteResponse) error { + cryptfs.Debug.Printf("File.Write\n") + resp.Size = 0 + iblocks := f.crfs.SplitRange(uint64(req.Offset), uint64(len(req.Data))) + var blockData []byte + for _, ib := range iblocks { + if ib.IsPartial() { + // RMW + cryptfs.Debug.Printf("RMW\n") + blockData = make([]byte, f.crfs.PlainBS()) + var readReq fuse.ReadRequest + var readResp fuse.ReadResponse + o, l := ib.PlaintextRange() + readReq.Offset = int64(o) + readReq.Size = int(l) + err := f.Read(ctx, &readReq, &readResp) + if err != nil { + return err + } + copy(blockData, readResp.Data) + copy(blockData[ib.Offset:ib.Offset+ib.Length], req.Data) + blockLen := max(len(readResp.Data), int(ib.Offset+ib.Length)) + blockData = blockData[0:blockLen] + } else { + blockData = req.Data[0:f.crfs.PlainBS()] + } + ciphertext := f.crfs.EncryptBlock(blockData) + var partReq fuse.WriteRequest + var partResp fuse.WriteResponse + o, _ := ib.CiphertextRange() + partReq.Data = ciphertext + partReq.Offset = int64(o) + err := f.File.Write(ctx, &partReq, &partResp) + if err != nil { + fmt.Printf("Write failure: %s\n", err.Error()) + return err + } + // Remove written data from the front of the request + cryptfs.Debug.Printf("req.Data[%d:%d]\n", int(ib.Length), len(req.Data)) + req.Data = req.Data[int(ib.Length):len(req.Data)] + resp.Size += int(ib.Length) + } + return nil +} + +func (f *File) Attr(ctx context.Context, attr *fuse.Attr) error { + cryptfs.Debug.Printf("Attr\n") + err := f.File.Node.Attr(ctx, attr) + if err != nil { + return err + } + attr.Size = f.crfs.PlainSize(attr.Size) + return nil +} diff --git a/cluefs_frontend/fe_fs.go b/cluefs_frontend/fe_fs.go new file mode 100644 index 0000000..2b12da6 --- /dev/null +++ b/cluefs_frontend/fe_fs.go @@ -0,0 +1,46 @@ +package cluefs_frontend + +// frontend sits between FUSE and ClueFS +// and uses cryptfs for all crypto operations +// +// cryptfs +// ^ +// | +// v +// FUSE <-> frontend <-> ClueFS +// +// This file handles just the root directory + +import ( + "github.com/rfjakob/gocryptfs/cryptfs" + "github.com/rfjakob/cluefs/lib/cluefs" + fusefs "bazil.org/fuse/fs" +) + +type FS struct { + *cryptfs.CryptFS + *cluefs.ClueFS + backing string +} + +type nullTracer struct {} + +func (nullTracer) Trace(op cluefs.FsOperTracer) {} + +func NewFS(key [16]byte, backing string, useOpenssl bool) (*FS, error) { + var tracer nullTracer + clfs, err := cluefs.NewClueFS(backing, tracer) + if err != nil { + return nil, err + } + return &FS { + CryptFS: cryptfs.NewCryptFS(key, useOpenssl), + ClueFS: clfs, + backing: backing, + }, nil +} + +func (fs *FS) Root() (fusefs.Node, error) { + cryptfs.Debug.Printf("Root\n") + return NewDir("", fs.backing, fs), nil +} -- cgit v1.2.3