On Sun, 2023-04-16 at 22:01 +0200, Ilya Dryomov wrote:
> On Wed, Apr 12, 2023 at 1:13 PM <xiubli@xxxxxxxxxx> wrote:
> >
> > From: Jeff Layton <jlayton@xxxxxxxxxx>
> >
> > ...and allow test_dummy_encryption to bypass content encryption
> > if mounted with test_dummy_encryption=clear.
> >
> > Tested-by: Luís Henriques <lhenriques@xxxxxxx>
> > Tested-by: Venky Shankar <vshankar@xxxxxxxxxx>
> > Reviewed-by: Luís Henriques <lhenriques@xxxxxxx>
> > Reviewed-by: Xiubo Li <xiubli@xxxxxxxxxx>
> > Signed-off-by: Jeff Layton <jlayton@xxxxxxxxxx>
> > ---
> > fs/ceph/crypto.c | 177 +++++++++++++++++++++++++++++++++++++++++++++++
> > fs/ceph/crypto.h | 71 +++++++++++++++++++
> > fs/ceph/super.c | 6 ++
> > fs/ceph/super.h | 1 +
> > 4 files changed, 255 insertions(+)
> >
> > diff --git a/fs/ceph/crypto.c b/fs/ceph/crypto.c
> > index fe47fbdaead9..35e292045e9d 100644
> > --- a/fs/ceph/crypto.c
> > +++ b/fs/ceph/crypto.c
> > @@ -9,6 +9,7 @@
> > #include <linux/ceph/ceph_debug.h>
> > #include <linux/xattr.h>
> > #include <linux/fscrypt.h>
> > +#include <linux/ceph/striper.h>
> >
> > #include "super.h"
> > #include "mds_client.h"
> > @@ -354,3 +355,179 @@ int ceph_fscrypt_prepare_readdir(struct inode *dir)
> > }
> > return 0;
> > }
> > +
> > +int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
> > + struct page *page, unsigned int len,
> > + unsigned int offs, u64 lblk_num)
> > +{
> > + struct ceph_mount_options *opt = ceph_inode_to_client(inode)->mount_options;
> > +
> > + if (opt->flags & CEPH_MOUNT_OPT_DUMMY_ENC_CLEAR)
> > + return 0;
> > +
> > + dout("%s: len %u offs %u blk %llu\n", __func__, len, offs, lblk_num);
> > + return fscrypt_decrypt_block_inplace(inode, page, len, offs, lblk_num);
> > +}
> > +
> > +int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
> > + struct page *page, unsigned int len,
> > + unsigned int offs, u64 lblk_num, gfp_t gfp_flags)
> > +{
> > + struct ceph_mount_options *opt = ceph_inode_to_client(inode)->mount_options;
> > +
> > + if (opt->flags & CEPH_MOUNT_OPT_DUMMY_ENC_CLEAR)
> > + return 0;
> > +
> > + dout("%s: len %u offs %u blk %llu\n", __func__, len, offs, lblk_num);
> > + return fscrypt_encrypt_block_inplace(inode, page, len, offs, lblk_num, gfp_flags);
> > +}
> > +
> > +/**
> > + * ceph_fscrypt_decrypt_pages - decrypt an array of pages
> > + * @inode: pointer to inode associated with these pages
> > + * @page: pointer to page array
> > + * @off: offset into the file that the read data starts
> > + * @len: max length to decrypt
> > + *
> > + * Decrypt an array of fscrypt'ed pages and return the amount of
> > + * data decrypted. Any data in the page prior to the start of the
> > + * first complete block in the read is ignored. Any incomplete
> > + * crypto blocks at the end of the array are ignored (and should
> > + * probably be zeroed by the caller).
> > + *
> > + * Returns the length of the decrypted data or a negative errno.
> > + */
> > +int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page, u64 off, int len)
> > +{
> > + int i, num_blocks;
> > + u64 baseblk = off >> CEPH_FSCRYPT_BLOCK_SHIFT;
> > + int ret = 0;
> > +
> > + /*
> > + * We can't deal with partial blocks on an encrypted file, so mask off
> > + * the last bit.
> > + */
> > + num_blocks = ceph_fscrypt_blocks(off, len & CEPH_FSCRYPT_BLOCK_MASK);
> > +
> > + /* Decrypt each block */
> > + for (i = 0; i < num_blocks; ++i) {
> > + int blkoff = i << CEPH_FSCRYPT_BLOCK_SHIFT;
> > + int pgidx = blkoff >> PAGE_SHIFT;
> > + unsigned int pgoffs = offset_in_page(blkoff);
> > + int fret;
> > +
> > + fret = ceph_fscrypt_decrypt_block_inplace(inode, page[pgidx],
> > + CEPH_FSCRYPT_BLOCK_SIZE, pgoffs,
> > + baseblk + i);
> > + if (fret < 0) {
> > + if (ret == 0)
> > + ret = fret;
> > + break;
> > + }
> > + ret += CEPH_FSCRYPT_BLOCK_SIZE;
> > + }
> > + return ret;
> > +}
> > +
> > +/**
> > + * ceph_fscrypt_decrypt_extents: decrypt received extents in given buffer
> > + * @inode: inode associated with pages being decrypted
> > + * @page: pointer to page array
> > + * @off: offset into the file that the data in page[0] starts
> > + * @map: pointer to extent array
> > + * @ext_cnt: length of extent array
> > + *
> > + * Given an extent map and a page array, decrypt the received data in-place,
> > + * skipping holes. Returns the offset into buffer of end of last decrypted
> > + * block.
> > + */
> > +int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page, u64 off,
> > + struct ceph_sparse_extent *map, u32 ext_cnt)
> > +{
> > + int i, ret = 0;
> > + struct ceph_inode_info *ci = ceph_inode(inode);
> > + u64 objno, objoff;
> > + u32 xlen;
> > +
> > + /* Nothing to do for empty array */
> > + if (ext_cnt == 0) {
> > + dout("%s: empty array, ret 0\n", __func__);
> > + return 0;
> > + }
> > +
> > + ceph_calc_file_object_mapping(&ci->i_layout, off, map[0].len,
> > + &objno, &objoff, &xlen);
> > +
> > + for (i = 0; i < ext_cnt; ++i) {
> > + struct ceph_sparse_extent *ext = &map[i];
> > + int pgsoff = ext->off - objoff;
> > + int pgidx = pgsoff >> PAGE_SHIFT;
> > + int fret;
> > +
> > + if ((ext->off | ext->len) & ~CEPH_FSCRYPT_BLOCK_MASK) {
> > + pr_warn("%s: bad encrypted sparse extent idx %d off %llx len %llx\n",
> > + __func__, i, ext->off, ext->len);
> > + return -EIO;
> > + }
> > + fret = ceph_fscrypt_decrypt_pages(inode, &page[pgidx],
> > + off + pgsoff, ext->len);
> > + dout("%s: [%d] 0x%llx~0x%llx fret %d\n", __func__, i,
> > + ext->off, ext->len, fret);
> > + if (fret < 0) {
> > + if (ret == 0)
> > + ret = fret;
> > + break;
> > + }
> > + ret = pgsoff + fret;
> > + }
> > + dout("%s: ret %d\n", __func__, ret);
> > + return ret;
> > +}
> > +
> > +/**
> > + * ceph_fscrypt_encrypt_pages - encrypt an array of pages
> > + * @inode: pointer to inode associated with these pages
> > + * @page: pointer to page array
> > + * @off: offset into the file that the data starts
> > + * @len: max length to encrypt
> > + * @gfp: gfp flags to use for allocation
> > + *
> > + * Decrypt an array of cleartext pages and return the amount of
> > + * data encrypted. Any data in the page prior to the start of the
> > + * first complete block in the read is ignored. Any incomplete
> > + * crypto blocks at the end of the array are ignored.
> > + *
> > + * Returns the length of the encrypted data or a negative errno.
> > + */
> > +int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page, u64 off,
> > + int len, gfp_t gfp)
> > +{
> > + int i, num_blocks;
> > + u64 baseblk = off >> CEPH_FSCRYPT_BLOCK_SHIFT;
> > + int ret = 0;
> > +
> > + /*
> > + * We can't deal with partial blocks on an encrypted file, so mask off
> > + * the last bit.
> > + */
> > + num_blocks = ceph_fscrypt_blocks(off, len & CEPH_FSCRYPT_BLOCK_MASK);
> > +
> > + /* Encrypt each block */
> > + for (i = 0; i < num_blocks; ++i) {
> > + int blkoff = i << CEPH_FSCRYPT_BLOCK_SHIFT;
> > + int pgidx = blkoff >> PAGE_SHIFT;
> > + unsigned int pgoffs = offset_in_page(blkoff);
> > + int fret;
> > +
> > + fret = ceph_fscrypt_encrypt_block_inplace(inode, page[pgidx],
> > + CEPH_FSCRYPT_BLOCK_SIZE, pgoffs,
> > + baseblk + i, gfp);
> > + if (fret < 0) {
> > + if (ret == 0)
> > + ret = fret;
> > + break;
> > + }
> > + ret += CEPH_FSCRYPT_BLOCK_SIZE;
> > + }
> > + return ret;
> > +}
> > diff --git a/fs/ceph/crypto.h b/fs/ceph/crypto.h
> > index 80acb23d0bb4..887f191cc423 100644
> > --- a/fs/ceph/crypto.h
> > +++ b/fs/ceph/crypto.h
> > @@ -100,6 +100,40 @@ int ceph_fname_to_usr(const struct ceph_fname *fname, struct fscrypt_str *tname,
> > struct fscrypt_str *oname, bool *is_nokey);
> > int ceph_fscrypt_prepare_readdir(struct inode *dir);
> >
> > +static inline unsigned int ceph_fscrypt_blocks(u64 off, u64 len)
> > +{
> > + /* crypto blocks cannot span more than one page */
> > + BUILD_BUG_ON(CEPH_FSCRYPT_BLOCK_SHIFT > PAGE_SHIFT);
> > +
> > + return ((off+len+CEPH_FSCRYPT_BLOCK_SIZE-1) >> CEPH_FSCRYPT_BLOCK_SHIFT) -
> > + (off >> CEPH_FSCRYPT_BLOCK_SHIFT);
> > +}
> > +
> > +/*
> > + * If we have an encrypted inode then we must adjust the offset and
> > + * range of the on-the-wire read to cover an entire encryption block.
> > + * The copy will be done using the original offset and length, after
> > + * we've decrypted the result.
> > + */
> > +static inline void ceph_fscrypt_adjust_off_and_len(struct inode *inode, u64 *off, u64 *len)
> > +{
> > + if (IS_ENCRYPTED(inode)) {
> > + *len = ceph_fscrypt_blocks(*off, *len) * CEPH_FSCRYPT_BLOCK_SIZE;
> > + *off &= CEPH_FSCRYPT_BLOCK_MASK;
> > + }
> > +}
> > +
> > +int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
> > + struct page *page, unsigned int len,
> > + unsigned int offs, u64 lblk_num);
> > +int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
> > + struct page *page, unsigned int len,
> > + unsigned int offs, u64 lblk_num, gfp_t gfp_flags);
> > +int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page, u64 off, int len);
> > +int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page, u64 off,
> > + struct ceph_sparse_extent *map, u32 ext_cnt);
> > +int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page, u64 off,
> > + int len, gfp_t gfp);
> > #else /* CONFIG_FS_ENCRYPTION */
> >
> > static inline void ceph_fscrypt_set_ops(struct super_block *sb)
> > @@ -157,6 +191,43 @@ static inline int ceph_fscrypt_prepare_readdir(struct inode *dir)
> > {
> > return 0;
> > }
> > +
> > +static inline void ceph_fscrypt_adjust_off_and_len(struct inode *inode, u64 *off, u64 *len)
> > +{
> > +}
> > +
> > +static inline int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
> > + struct page *page, unsigned int len,
> > + unsigned int offs, u64 lblk_num)
> > +{
> > + return 0;
> > +}
> > +
> > +static inline int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
> > + struct page *page, unsigned int len,
> > + unsigned int offs, u64 lblk_num, gfp_t gfp_flags)
> > +{
> > + return 0;
> > +}
> > +
> > +static inline int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page,
> > + u64 off, int len)
> > +{
> > + return 0;
> > +}
> > +
> > +static inline int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page,
> > + u64 off, struct ceph_sparse_extent *map,
> > + u32 ext_cnt)
> > +{
> > + return 0;
> > +}
> > +
> > +static inline int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page,
> > + u64 off, int len, gfp_t gfp)
> > +{
> > + return 0;
> > +}
> > #endif /* CONFIG_FS_ENCRYPTION */
> >
> > #endif
> > diff --git a/fs/ceph/super.c b/fs/ceph/super.c
> > index b9dd2fa36d8b..4b0a070d5c6d 100644
> > --- a/fs/ceph/super.c
> > +++ b/fs/ceph/super.c
> > @@ -591,6 +591,12 @@ static int ceph_parse_mount_param(struct fs_context *fc,
> > break;
> > case Opt_test_dummy_encryption:
> > #ifdef CONFIG_FS_ENCRYPTION
> > + /* HACK: allow for cleartext "encryption" in files for testing */
> > + if (param->string && !strcmp(param->string, "clear")) {
> > + fsopt->flags |= CEPH_MOUNT_OPT_DUMMY_ENC_CLEAR;
>
> I really wonder whether this is still needed? Having a mount option
> that causes everything to be automatically encrypted with a dummy key
> for testing purposes makes total sense. Making it possible to disable
> encryption through the same -- not so much.
>
> Does any other fscrypt-enabled filesystem in mainline do this?
>
I doubt it. It was totally a hack that I had in place to help debugging
when I was developing this. My intention was always to remove this
before merging it. I think doing that now would be a good idea.
--
Jeff Layton <jlayton@xxxxxxxxxx>
