diff mbox series

[v18,48/71] ceph: add infrastructure for file encryption and decryption

Message ID 20230412110930.176835-49-xiubli@redhat.com (mailing list archive)
State New, archived
Headers show
Series ceph+fscrypt: full support | expand

Commit Message

Xiubo Li April 12, 2023, 11:09 a.m. UTC
From: Jeff Layton <jlayton@kernel.org>

...and allow test_dummy_encryption to bypass content encryption
if mounted with test_dummy_encryption=clear.

Tested-by: Luís Henriques <lhenriques@suse.de>
Tested-by: Venky Shankar <vshankar@redhat.com>
Reviewed-by: Luís Henriques <lhenriques@suse.de>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
 fs/ceph/crypto.c | 177 +++++++++++++++++++++++++++++++++++++++++++++++
 fs/ceph/crypto.h |  71 +++++++++++++++++++
 fs/ceph/super.c  |   6 ++
 fs/ceph/super.h  |   1 +
 4 files changed, 255 insertions(+)

Comments

Ilya Dryomov April 16, 2023, 8:01 p.m. UTC | #1
On Wed, Apr 12, 2023 at 1:13 PM <xiubli@redhat.com> wrote:
>
> From: Jeff Layton <jlayton@kernel.org>
>
> ...and allow test_dummy_encryption to bypass content encryption
> if mounted with test_dummy_encryption=clear.
>
> Tested-by: Luís Henriques <lhenriques@suse.de>
> Tested-by: Venky Shankar <vshankar@redhat.com>
> Reviewed-by: Luís Henriques <lhenriques@suse.de>
> Reviewed-by: Xiubo Li <xiubli@redhat.com>
> Signed-off-by: Jeff Layton <jlayton@kernel.org>
> ---
>  fs/ceph/crypto.c | 177 +++++++++++++++++++++++++++++++++++++++++++++++
>  fs/ceph/crypto.h |  71 +++++++++++++++++++
>  fs/ceph/super.c  |   6 ++
>  fs/ceph/super.h  |   1 +
>  4 files changed, 255 insertions(+)
>
> diff --git a/fs/ceph/crypto.c b/fs/ceph/crypto.c
> index fe47fbdaead9..35e292045e9d 100644
> --- a/fs/ceph/crypto.c
> +++ b/fs/ceph/crypto.c
> @@ -9,6 +9,7 @@
>  #include <linux/ceph/ceph_debug.h>
>  #include <linux/xattr.h>
>  #include <linux/fscrypt.h>
> +#include <linux/ceph/striper.h>
>
>  #include "super.h"
>  #include "mds_client.h"
> @@ -354,3 +355,179 @@ int ceph_fscrypt_prepare_readdir(struct inode *dir)
>         }
>         return 0;
>  }
> +
> +int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
> +                                 struct page *page, unsigned int len,
> +                                 unsigned int offs, u64 lblk_num)
> +{
> +       struct ceph_mount_options *opt = ceph_inode_to_client(inode)->mount_options;
> +
> +       if (opt->flags & CEPH_MOUNT_OPT_DUMMY_ENC_CLEAR)
> +               return 0;
> +
> +       dout("%s: len %u offs %u blk %llu\n", __func__, len, offs, lblk_num);
> +       return fscrypt_decrypt_block_inplace(inode, page, len, offs, lblk_num);
> +}
> +
> +int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
> +                                 struct page *page, unsigned int len,
> +                                 unsigned int offs, u64 lblk_num, gfp_t gfp_flags)
> +{
> +       struct ceph_mount_options *opt = ceph_inode_to_client(inode)->mount_options;
> +
> +       if (opt->flags & CEPH_MOUNT_OPT_DUMMY_ENC_CLEAR)
> +               return 0;
> +
> +       dout("%s: len %u offs %u blk %llu\n", __func__, len, offs, lblk_num);
> +       return fscrypt_encrypt_block_inplace(inode, page, len, offs, lblk_num, gfp_flags);
> +}
> +
> +/**
> + * ceph_fscrypt_decrypt_pages - decrypt an array of pages
> + * @inode: pointer to inode associated with these pages
> + * @page: pointer to page array
> + * @off: offset into the file that the read data starts
> + * @len: max length to decrypt
> + *
> + * Decrypt an array of fscrypt'ed pages and return the amount of
> + * data decrypted. Any data in the page prior to the start of the
> + * first complete block in the read is ignored. Any incomplete
> + * crypto blocks at the end of the array are ignored (and should
> + * probably be zeroed by the caller).
> + *
> + * Returns the length of the decrypted data or a negative errno.
> + */
> +int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page, u64 off, int len)
> +{
> +       int i, num_blocks;
> +       u64 baseblk = off >> CEPH_FSCRYPT_BLOCK_SHIFT;
> +       int ret = 0;
> +
> +       /*
> +        * We can't deal with partial blocks on an encrypted file, so mask off
> +        * the last bit.
> +        */
> +       num_blocks = ceph_fscrypt_blocks(off, len & CEPH_FSCRYPT_BLOCK_MASK);
> +
> +       /* Decrypt each block */
> +       for (i = 0; i < num_blocks; ++i) {
> +               int blkoff = i << CEPH_FSCRYPT_BLOCK_SHIFT;
> +               int pgidx = blkoff >> PAGE_SHIFT;
> +               unsigned int pgoffs = offset_in_page(blkoff);
> +               int fret;
> +
> +               fret = ceph_fscrypt_decrypt_block_inplace(inode, page[pgidx],
> +                               CEPH_FSCRYPT_BLOCK_SIZE, pgoffs,
> +                               baseblk + i);
> +               if (fret < 0) {
> +                       if (ret == 0)
> +                               ret = fret;
> +                       break;
> +               }
> +               ret += CEPH_FSCRYPT_BLOCK_SIZE;
> +       }
> +       return ret;
> +}
> +
> +/**
> + * ceph_fscrypt_decrypt_extents: decrypt received extents in given buffer
> + * @inode: inode associated with pages being decrypted
> + * @page: pointer to page array
> + * @off: offset into the file that the data in page[0] starts
> + * @map: pointer to extent array
> + * @ext_cnt: length of extent array
> + *
> + * Given an extent map and a page array, decrypt the received data in-place,
> + * skipping holes. Returns the offset into buffer of end of last decrypted
> + * block.
> + */
> +int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page, u64 off,
> +                                struct ceph_sparse_extent *map, u32 ext_cnt)
> +{
> +       int i, ret = 0;
> +       struct ceph_inode_info *ci = ceph_inode(inode);
> +       u64 objno, objoff;
> +       u32 xlen;
> +
> +       /* Nothing to do for empty array */
> +       if (ext_cnt == 0) {
> +               dout("%s: empty array, ret 0\n", __func__);
> +               return 0;
> +       }
> +
> +       ceph_calc_file_object_mapping(&ci->i_layout, off, map[0].len,
> +                                     &objno, &objoff, &xlen);
> +
> +       for (i = 0; i < ext_cnt; ++i) {
> +               struct ceph_sparse_extent *ext = &map[i];
> +               int pgsoff = ext->off - objoff;
> +               int pgidx = pgsoff >> PAGE_SHIFT;
> +               int fret;
> +
> +               if ((ext->off | ext->len) & ~CEPH_FSCRYPT_BLOCK_MASK) {
> +                       pr_warn("%s: bad encrypted sparse extent idx %d off %llx len %llx\n",
> +                               __func__, i, ext->off, ext->len);
> +                       return -EIO;
> +               }
> +               fret = ceph_fscrypt_decrypt_pages(inode, &page[pgidx],
> +                                                off + pgsoff, ext->len);
> +               dout("%s: [%d] 0x%llx~0x%llx fret %d\n", __func__, i,
> +                               ext->off, ext->len, fret);
> +               if (fret < 0) {
> +                       if (ret == 0)
> +                               ret = fret;
> +                       break;
> +               }
> +               ret = pgsoff + fret;
> +       }
> +       dout("%s: ret %d\n", __func__, ret);
> +       return ret;
> +}
> +
> +/**
> + * ceph_fscrypt_encrypt_pages - encrypt an array of pages
> + * @inode: pointer to inode associated with these pages
> + * @page: pointer to page array
> + * @off: offset into the file that the data starts
> + * @len: max length to encrypt
> + * @gfp: gfp flags to use for allocation
> + *
> + * Decrypt an array of cleartext pages and return the amount of
> + * data encrypted. Any data in the page prior to the start of the
> + * first complete block in the read is ignored. Any incomplete
> + * crypto blocks at the end of the array are ignored.
> + *
> + * Returns the length of the encrypted data or a negative errno.
> + */
> +int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page, u64 off,
> +                               int len, gfp_t gfp)
> +{
> +       int i, num_blocks;
> +       u64 baseblk = off >> CEPH_FSCRYPT_BLOCK_SHIFT;
> +       int ret = 0;
> +
> +       /*
> +        * We can't deal with partial blocks on an encrypted file, so mask off
> +        * the last bit.
> +        */
> +       num_blocks = ceph_fscrypt_blocks(off, len & CEPH_FSCRYPT_BLOCK_MASK);
> +
> +       /* Encrypt each block */
> +       for (i = 0; i < num_blocks; ++i) {
> +               int blkoff = i << CEPH_FSCRYPT_BLOCK_SHIFT;
> +               int pgidx = blkoff >> PAGE_SHIFT;
> +               unsigned int pgoffs = offset_in_page(blkoff);
> +               int fret;
> +
> +               fret = ceph_fscrypt_encrypt_block_inplace(inode, page[pgidx],
> +                               CEPH_FSCRYPT_BLOCK_SIZE, pgoffs,
> +                               baseblk + i, gfp);
> +               if (fret < 0) {
> +                       if (ret == 0)
> +                               ret = fret;
> +                       break;
> +               }
> +               ret += CEPH_FSCRYPT_BLOCK_SIZE;
> +       }
> +       return ret;
> +}
> diff --git a/fs/ceph/crypto.h b/fs/ceph/crypto.h
> index 80acb23d0bb4..887f191cc423 100644
> --- a/fs/ceph/crypto.h
> +++ b/fs/ceph/crypto.h
> @@ -100,6 +100,40 @@ int ceph_fname_to_usr(const struct ceph_fname *fname, struct fscrypt_str *tname,
>                         struct fscrypt_str *oname, bool *is_nokey);
>  int ceph_fscrypt_prepare_readdir(struct inode *dir);
>
> +static inline unsigned int ceph_fscrypt_blocks(u64 off, u64 len)
> +{
> +       /* crypto blocks cannot span more than one page */
> +       BUILD_BUG_ON(CEPH_FSCRYPT_BLOCK_SHIFT > PAGE_SHIFT);
> +
> +       return ((off+len+CEPH_FSCRYPT_BLOCK_SIZE-1) >> CEPH_FSCRYPT_BLOCK_SHIFT) -
> +               (off >> CEPH_FSCRYPT_BLOCK_SHIFT);
> +}
> +
> +/*
> + * If we have an encrypted inode then we must adjust the offset and
> + * range of the on-the-wire read to cover an entire encryption block.
> + * The copy will be done using the original offset and length, after
> + * we've decrypted the result.
> + */
> +static inline void ceph_fscrypt_adjust_off_and_len(struct inode *inode, u64 *off, u64 *len)
> +{
> +       if (IS_ENCRYPTED(inode)) {
> +               *len = ceph_fscrypt_blocks(*off, *len) * CEPH_FSCRYPT_BLOCK_SIZE;
> +               *off &= CEPH_FSCRYPT_BLOCK_MASK;
> +       }
> +}
> +
> +int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
> +                                 struct page *page, unsigned int len,
> +                                 unsigned int offs, u64 lblk_num);
> +int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
> +                                 struct page *page, unsigned int len,
> +                                 unsigned int offs, u64 lblk_num, gfp_t gfp_flags);
> +int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page, u64 off, int len);
> +int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page, u64 off,
> +                                struct ceph_sparse_extent *map, u32 ext_cnt);
> +int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page, u64 off,
> +                               int len, gfp_t gfp);
>  #else /* CONFIG_FS_ENCRYPTION */
>
>  static inline void ceph_fscrypt_set_ops(struct super_block *sb)
> @@ -157,6 +191,43 @@ static inline int ceph_fscrypt_prepare_readdir(struct inode *dir)
>  {
>         return 0;
>  }
> +
> +static inline void ceph_fscrypt_adjust_off_and_len(struct inode *inode, u64 *off, u64 *len)
> +{
> +}
> +
> +static inline int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
> +                                         struct page *page, unsigned int len,
> +                                         unsigned int offs, u64 lblk_num)
> +{
> +       return 0;
> +}
> +
> +static inline int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
> +                                 struct page *page, unsigned int len,
> +                                 unsigned int offs, u64 lblk_num, gfp_t gfp_flags)
> +{
> +       return 0;
> +}
> +
> +static inline int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page,
> +                                            u64 off, int len)
> +{
> +       return 0;
> +}
> +
> +static inline int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page,
> +                                       u64 off, struct ceph_sparse_extent *map,
> +                                       u32 ext_cnt)
> +{
> +       return 0;
> +}
> +
> +static inline int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page,
> +                                            u64 off, int len, gfp_t gfp)
> +{
> +       return 0;
> +}
>  #endif /* CONFIG_FS_ENCRYPTION */
>
>  #endif
> diff --git a/fs/ceph/super.c b/fs/ceph/super.c
> index b9dd2fa36d8b..4b0a070d5c6d 100644
> --- a/fs/ceph/super.c
> +++ b/fs/ceph/super.c
> @@ -591,6 +591,12 @@ static int ceph_parse_mount_param(struct fs_context *fc,
>                 break;
>         case Opt_test_dummy_encryption:
>  #ifdef CONFIG_FS_ENCRYPTION
> +               /* HACK: allow for cleartext "encryption" in files for testing */
> +               if (param->string && !strcmp(param->string, "clear")) {
> +                       fsopt->flags |= CEPH_MOUNT_OPT_DUMMY_ENC_CLEAR;

I really wonder whether this is still needed?  Having a mount option
that causes everything to be automatically encrypted with a dummy key
for testing purposes makes total sense.  Making it possible to disable
encryption through the same -- not so much.

Does any other fscrypt-enabled filesystem in mainline do this?

Thanks,

                Ilya
Jeff Layton April 16, 2023, 9:10 p.m. UTC | #2
On Sun, 2023-04-16 at 22:01 +0200, Ilya Dryomov wrote:
> On Wed, Apr 12, 2023 at 1:13 PM <xiubli@redhat.com> wrote:
> > 
> > From: Jeff Layton <jlayton@kernel.org>
> > 
> > ...and allow test_dummy_encryption to bypass content encryption
> > if mounted with test_dummy_encryption=clear.
> > 
> > Tested-by: Luís Henriques <lhenriques@suse.de>
> > Tested-by: Venky Shankar <vshankar@redhat.com>
> > Reviewed-by: Luís Henriques <lhenriques@suse.de>
> > Reviewed-by: Xiubo Li <xiubli@redhat.com>
> > Signed-off-by: Jeff Layton <jlayton@kernel.org>
> > ---
> >  fs/ceph/crypto.c | 177 +++++++++++++++++++++++++++++++++++++++++++++++
> >  fs/ceph/crypto.h |  71 +++++++++++++++++++
> >  fs/ceph/super.c  |   6 ++
> >  fs/ceph/super.h  |   1 +
> >  4 files changed, 255 insertions(+)
> > 
> > diff --git a/fs/ceph/crypto.c b/fs/ceph/crypto.c
> > index fe47fbdaead9..35e292045e9d 100644
> > --- a/fs/ceph/crypto.c
> > +++ b/fs/ceph/crypto.c
> > @@ -9,6 +9,7 @@
> >  #include <linux/ceph/ceph_debug.h>
> >  #include <linux/xattr.h>
> >  #include <linux/fscrypt.h>
> > +#include <linux/ceph/striper.h>
> > 
> >  #include "super.h"
> >  #include "mds_client.h"
> > @@ -354,3 +355,179 @@ int ceph_fscrypt_prepare_readdir(struct inode *dir)
> >         }
> >         return 0;
> >  }
> > +
> > +int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
> > +                                 struct page *page, unsigned int len,
> > +                                 unsigned int offs, u64 lblk_num)
> > +{
> > +       struct ceph_mount_options *opt = ceph_inode_to_client(inode)->mount_options;
> > +
> > +       if (opt->flags & CEPH_MOUNT_OPT_DUMMY_ENC_CLEAR)
> > +               return 0;
> > +
> > +       dout("%s: len %u offs %u blk %llu\n", __func__, len, offs, lblk_num);
> > +       return fscrypt_decrypt_block_inplace(inode, page, len, offs, lblk_num);
> > +}
> > +
> > +int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
> > +                                 struct page *page, unsigned int len,
> > +                                 unsigned int offs, u64 lblk_num, gfp_t gfp_flags)
> > +{
> > +       struct ceph_mount_options *opt = ceph_inode_to_client(inode)->mount_options;
> > +
> > +       if (opt->flags & CEPH_MOUNT_OPT_DUMMY_ENC_CLEAR)
> > +               return 0;
> > +
> > +       dout("%s: len %u offs %u blk %llu\n", __func__, len, offs, lblk_num);
> > +       return fscrypt_encrypt_block_inplace(inode, page, len, offs, lblk_num, gfp_flags);
> > +}
> > +
> > +/**
> > + * ceph_fscrypt_decrypt_pages - decrypt an array of pages
> > + * @inode: pointer to inode associated with these pages
> > + * @page: pointer to page array
> > + * @off: offset into the file that the read data starts
> > + * @len: max length to decrypt
> > + *
> > + * Decrypt an array of fscrypt'ed pages and return the amount of
> > + * data decrypted. Any data in the page prior to the start of the
> > + * first complete block in the read is ignored. Any incomplete
> > + * crypto blocks at the end of the array are ignored (and should
> > + * probably be zeroed by the caller).
> > + *
> > + * Returns the length of the decrypted data or a negative errno.
> > + */
> > +int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page, u64 off, int len)
> > +{
> > +       int i, num_blocks;
> > +       u64 baseblk = off >> CEPH_FSCRYPT_BLOCK_SHIFT;
> > +       int ret = 0;
> > +
> > +       /*
> > +        * We can't deal with partial blocks on an encrypted file, so mask off
> > +        * the last bit.
> > +        */
> > +       num_blocks = ceph_fscrypt_blocks(off, len & CEPH_FSCRYPT_BLOCK_MASK);
> > +
> > +       /* Decrypt each block */
> > +       for (i = 0; i < num_blocks; ++i) {
> > +               int blkoff = i << CEPH_FSCRYPT_BLOCK_SHIFT;
> > +               int pgidx = blkoff >> PAGE_SHIFT;
> > +               unsigned int pgoffs = offset_in_page(blkoff);
> > +               int fret;
> > +
> > +               fret = ceph_fscrypt_decrypt_block_inplace(inode, page[pgidx],
> > +                               CEPH_FSCRYPT_BLOCK_SIZE, pgoffs,
> > +                               baseblk + i);
> > +               if (fret < 0) {
> > +                       if (ret == 0)
> > +                               ret = fret;
> > +                       break;
> > +               }
> > +               ret += CEPH_FSCRYPT_BLOCK_SIZE;
> > +       }
> > +       return ret;
> > +}
> > +
> > +/**
> > + * ceph_fscrypt_decrypt_extents: decrypt received extents in given buffer
> > + * @inode: inode associated with pages being decrypted
> > + * @page: pointer to page array
> > + * @off: offset into the file that the data in page[0] starts
> > + * @map: pointer to extent array
> > + * @ext_cnt: length of extent array
> > + *
> > + * Given an extent map and a page array, decrypt the received data in-place,
> > + * skipping holes. Returns the offset into buffer of end of last decrypted
> > + * block.
> > + */
> > +int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page, u64 off,
> > +                                struct ceph_sparse_extent *map, u32 ext_cnt)
> > +{
> > +       int i, ret = 0;
> > +       struct ceph_inode_info *ci = ceph_inode(inode);
> > +       u64 objno, objoff;
> > +       u32 xlen;
> > +
> > +       /* Nothing to do for empty array */
> > +       if (ext_cnt == 0) {
> > +               dout("%s: empty array, ret 0\n", __func__);
> > +               return 0;
> > +       }
> > +
> > +       ceph_calc_file_object_mapping(&ci->i_layout, off, map[0].len,
> > +                                     &objno, &objoff, &xlen);
> > +
> > +       for (i = 0; i < ext_cnt; ++i) {
> > +               struct ceph_sparse_extent *ext = &map[i];
> > +               int pgsoff = ext->off - objoff;
> > +               int pgidx = pgsoff >> PAGE_SHIFT;
> > +               int fret;
> > +
> > +               if ((ext->off | ext->len) & ~CEPH_FSCRYPT_BLOCK_MASK) {
> > +                       pr_warn("%s: bad encrypted sparse extent idx %d off %llx len %llx\n",
> > +                               __func__, i, ext->off, ext->len);
> > +                       return -EIO;
> > +               }
> > +               fret = ceph_fscrypt_decrypt_pages(inode, &page[pgidx],
> > +                                                off + pgsoff, ext->len);
> > +               dout("%s: [%d] 0x%llx~0x%llx fret %d\n", __func__, i,
> > +                               ext->off, ext->len, fret);
> > +               if (fret < 0) {
> > +                       if (ret == 0)
> > +                               ret = fret;
> > +                       break;
> > +               }
> > +               ret = pgsoff + fret;
> > +       }
> > +       dout("%s: ret %d\n", __func__, ret);
> > +       return ret;
> > +}
> > +
> > +/**
> > + * ceph_fscrypt_encrypt_pages - encrypt an array of pages
> > + * @inode: pointer to inode associated with these pages
> > + * @page: pointer to page array
> > + * @off: offset into the file that the data starts
> > + * @len: max length to encrypt
> > + * @gfp: gfp flags to use for allocation
> > + *
> > + * Decrypt an array of cleartext pages and return the amount of
> > + * data encrypted. Any data in the page prior to the start of the
> > + * first complete block in the read is ignored. Any incomplete
> > + * crypto blocks at the end of the array are ignored.
> > + *
> > + * Returns the length of the encrypted data or a negative errno.
> > + */
> > +int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page, u64 off,
> > +                               int len, gfp_t gfp)
> > +{
> > +       int i, num_blocks;
> > +       u64 baseblk = off >> CEPH_FSCRYPT_BLOCK_SHIFT;
> > +       int ret = 0;
> > +
> > +       /*
> > +        * We can't deal with partial blocks on an encrypted file, so mask off
> > +        * the last bit.
> > +        */
> > +       num_blocks = ceph_fscrypt_blocks(off, len & CEPH_FSCRYPT_BLOCK_MASK);
> > +
> > +       /* Encrypt each block */
> > +       for (i = 0; i < num_blocks; ++i) {
> > +               int blkoff = i << CEPH_FSCRYPT_BLOCK_SHIFT;
> > +               int pgidx = blkoff >> PAGE_SHIFT;
> > +               unsigned int pgoffs = offset_in_page(blkoff);
> > +               int fret;
> > +
> > +               fret = ceph_fscrypt_encrypt_block_inplace(inode, page[pgidx],
> > +                               CEPH_FSCRYPT_BLOCK_SIZE, pgoffs,
> > +                               baseblk + i, gfp);
> > +               if (fret < 0) {
> > +                       if (ret == 0)
> > +                               ret = fret;
> > +                       break;
> > +               }
> > +               ret += CEPH_FSCRYPT_BLOCK_SIZE;
> > +       }
> > +       return ret;
> > +}
> > diff --git a/fs/ceph/crypto.h b/fs/ceph/crypto.h
> > index 80acb23d0bb4..887f191cc423 100644
> > --- a/fs/ceph/crypto.h
> > +++ b/fs/ceph/crypto.h
> > @@ -100,6 +100,40 @@ int ceph_fname_to_usr(const struct ceph_fname *fname, struct fscrypt_str *tname,
> >                         struct fscrypt_str *oname, bool *is_nokey);
> >  int ceph_fscrypt_prepare_readdir(struct inode *dir);
> > 
> > +static inline unsigned int ceph_fscrypt_blocks(u64 off, u64 len)
> > +{
> > +       /* crypto blocks cannot span more than one page */
> > +       BUILD_BUG_ON(CEPH_FSCRYPT_BLOCK_SHIFT > PAGE_SHIFT);
> > +
> > +       return ((off+len+CEPH_FSCRYPT_BLOCK_SIZE-1) >> CEPH_FSCRYPT_BLOCK_SHIFT) -
> > +               (off >> CEPH_FSCRYPT_BLOCK_SHIFT);
> > +}
> > +
> > +/*
> > + * If we have an encrypted inode then we must adjust the offset and
> > + * range of the on-the-wire read to cover an entire encryption block.
> > + * The copy will be done using the original offset and length, after
> > + * we've decrypted the result.
> > + */
> > +static inline void ceph_fscrypt_adjust_off_and_len(struct inode *inode, u64 *off, u64 *len)
> > +{
> > +       if (IS_ENCRYPTED(inode)) {
> > +               *len = ceph_fscrypt_blocks(*off, *len) * CEPH_FSCRYPT_BLOCK_SIZE;
> > +               *off &= CEPH_FSCRYPT_BLOCK_MASK;
> > +       }
> > +}
> > +
> > +int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
> > +                                 struct page *page, unsigned int len,
> > +                                 unsigned int offs, u64 lblk_num);
> > +int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
> > +                                 struct page *page, unsigned int len,
> > +                                 unsigned int offs, u64 lblk_num, gfp_t gfp_flags);
> > +int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page, u64 off, int len);
> > +int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page, u64 off,
> > +                                struct ceph_sparse_extent *map, u32 ext_cnt);
> > +int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page, u64 off,
> > +                               int len, gfp_t gfp);
> >  #else /* CONFIG_FS_ENCRYPTION */
> > 
> >  static inline void ceph_fscrypt_set_ops(struct super_block *sb)
> > @@ -157,6 +191,43 @@ static inline int ceph_fscrypt_prepare_readdir(struct inode *dir)
> >  {
> >         return 0;
> >  }
> > +
> > +static inline void ceph_fscrypt_adjust_off_and_len(struct inode *inode, u64 *off, u64 *len)
> > +{
> > +}
> > +
> > +static inline int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
> > +                                         struct page *page, unsigned int len,
> > +                                         unsigned int offs, u64 lblk_num)
> > +{
> > +       return 0;
> > +}
> > +
> > +static inline int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
> > +                                 struct page *page, unsigned int len,
> > +                                 unsigned int offs, u64 lblk_num, gfp_t gfp_flags)
> > +{
> > +       return 0;
> > +}
> > +
> > +static inline int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page,
> > +                                            u64 off, int len)
> > +{
> > +       return 0;
> > +}
> > +
> > +static inline int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page,
> > +                                       u64 off, struct ceph_sparse_extent *map,
> > +                                       u32 ext_cnt)
> > +{
> > +       return 0;
> > +}
> > +
> > +static inline int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page,
> > +                                            u64 off, int len, gfp_t gfp)
> > +{
> > +       return 0;
> > +}
> >  #endif /* CONFIG_FS_ENCRYPTION */
> > 
> >  #endif
> > diff --git a/fs/ceph/super.c b/fs/ceph/super.c
> > index b9dd2fa36d8b..4b0a070d5c6d 100644
> > --- a/fs/ceph/super.c
> > +++ b/fs/ceph/super.c
> > @@ -591,6 +591,12 @@ static int ceph_parse_mount_param(struct fs_context *fc,
> >                 break;
> >         case Opt_test_dummy_encryption:
> >  #ifdef CONFIG_FS_ENCRYPTION
> > +               /* HACK: allow for cleartext "encryption" in files for testing */
> > +               if (param->string && !strcmp(param->string, "clear")) {
> > +                       fsopt->flags |= CEPH_MOUNT_OPT_DUMMY_ENC_CLEAR;
> 
> I really wonder whether this is still needed?  Having a mount option
> that causes everything to be automatically encrypted with a dummy key
> for testing purposes makes total sense.  Making it possible to disable
> encryption through the same -- not so much.
> 
> Does any other fscrypt-enabled filesystem in mainline do this?
> 

I doubt it. It was totally a hack that I had in place to help debugging
when I was developing this. My intention was always to remove this
before merging it. I think doing that now would be a good idea.
Xiubo Li April 17, 2023, 1:04 a.m. UTC | #3
On 4/17/23 05:10, Jeff Layton wrote:
> On Sun, 2023-04-16 at 22:01 +0200, Ilya Dryomov wrote:
>> On Wed, Apr 12, 2023 at 1:13 PM <xiubli@redhat.com> wrote:
[...]
>>>   #endif
>>> diff --git a/fs/ceph/super.c b/fs/ceph/super.c
>>> index b9dd2fa36d8b..4b0a070d5c6d 100644
>>> --- a/fs/ceph/super.c
>>> +++ b/fs/ceph/super.c
>>> @@ -591,6 +591,12 @@ static int ceph_parse_mount_param(struct fs_context *fc,
>>>                  break;
>>>          case Opt_test_dummy_encryption:
>>>   #ifdef CONFIG_FS_ENCRYPTION
>>> +               /* HACK: allow for cleartext "encryption" in files for testing */
>>> +               if (param->string && !strcmp(param->string, "clear")) {
>>> +                       fsopt->flags |= CEPH_MOUNT_OPT_DUMMY_ENC_CLEAR;
>> I really wonder whether this is still needed?  Having a mount option
>> that causes everything to be automatically encrypted with a dummy key
>> for testing purposes makes total sense.  Making it possible to disable
>> encryption through the same -- not so much.
>>
>> Does any other fscrypt-enabled filesystem in mainline do this?
>>
> I doubt it. It was totally a hack that I had in place to help debugging
> when I was developing this. My intention was always to remove this
> before merging it. I think doing that now would be a good idea.

Yeah, no this for other FSs and I will remove this option.

Thanks

- Xiubo
diff mbox series

Patch

diff --git a/fs/ceph/crypto.c b/fs/ceph/crypto.c
index fe47fbdaead9..35e292045e9d 100644
--- a/fs/ceph/crypto.c
+++ b/fs/ceph/crypto.c
@@ -9,6 +9,7 @@ 
 #include <linux/ceph/ceph_debug.h>
 #include <linux/xattr.h>
 #include <linux/fscrypt.h>
+#include <linux/ceph/striper.h>
 
 #include "super.h"
 #include "mds_client.h"
@@ -354,3 +355,179 @@  int ceph_fscrypt_prepare_readdir(struct inode *dir)
 	}
 	return 0;
 }
+
+int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
+				  struct page *page, unsigned int len,
+				  unsigned int offs, u64 lblk_num)
+{
+	struct ceph_mount_options *opt = ceph_inode_to_client(inode)->mount_options;
+
+	if (opt->flags & CEPH_MOUNT_OPT_DUMMY_ENC_CLEAR)
+		return 0;
+
+	dout("%s: len %u offs %u blk %llu\n", __func__, len, offs, lblk_num);
+	return fscrypt_decrypt_block_inplace(inode, page, len, offs, lblk_num);
+}
+
+int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
+				  struct page *page, unsigned int len,
+				  unsigned int offs, u64 lblk_num, gfp_t gfp_flags)
+{
+	struct ceph_mount_options *opt = ceph_inode_to_client(inode)->mount_options;
+
+	if (opt->flags & CEPH_MOUNT_OPT_DUMMY_ENC_CLEAR)
+		return 0;
+
+	dout("%s: len %u offs %u blk %llu\n", __func__, len, offs, lblk_num);
+	return fscrypt_encrypt_block_inplace(inode, page, len, offs, lblk_num, gfp_flags);
+}
+
+/**
+ * ceph_fscrypt_decrypt_pages - decrypt an array of pages
+ * @inode: pointer to inode associated with these pages
+ * @page: pointer to page array
+ * @off: offset into the file that the read data starts
+ * @len: max length to decrypt
+ *
+ * Decrypt an array of fscrypt'ed pages and return the amount of
+ * data decrypted. Any data in the page prior to the start of the
+ * first complete block in the read is ignored. Any incomplete
+ * crypto blocks at the end of the array are ignored (and should
+ * probably be zeroed by the caller).
+ *
+ * Returns the length of the decrypted data or a negative errno.
+ */
+int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page, u64 off, int len)
+{
+	int i, num_blocks;
+	u64 baseblk = off >> CEPH_FSCRYPT_BLOCK_SHIFT;
+	int ret = 0;
+
+	/*
+	 * We can't deal with partial blocks on an encrypted file, so mask off
+	 * the last bit.
+	 */
+	num_blocks = ceph_fscrypt_blocks(off, len & CEPH_FSCRYPT_BLOCK_MASK);
+
+	/* Decrypt each block */
+	for (i = 0; i < num_blocks; ++i) {
+		int blkoff = i << CEPH_FSCRYPT_BLOCK_SHIFT;
+		int pgidx = blkoff >> PAGE_SHIFT;
+		unsigned int pgoffs = offset_in_page(blkoff);
+		int fret;
+
+		fret = ceph_fscrypt_decrypt_block_inplace(inode, page[pgidx],
+				CEPH_FSCRYPT_BLOCK_SIZE, pgoffs,
+				baseblk + i);
+		if (fret < 0) {
+			if (ret == 0)
+				ret = fret;
+			break;
+		}
+		ret += CEPH_FSCRYPT_BLOCK_SIZE;
+	}
+	return ret;
+}
+
+/**
+ * ceph_fscrypt_decrypt_extents: decrypt received extents in given buffer
+ * @inode: inode associated with pages being decrypted
+ * @page: pointer to page array
+ * @off: offset into the file that the data in page[0] starts
+ * @map: pointer to extent array
+ * @ext_cnt: length of extent array
+ *
+ * Given an extent map and a page array, decrypt the received data in-place,
+ * skipping holes. Returns the offset into buffer of end of last decrypted
+ * block.
+ */
+int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page, u64 off,
+				 struct ceph_sparse_extent *map, u32 ext_cnt)
+{
+	int i, ret = 0;
+	struct ceph_inode_info *ci = ceph_inode(inode);
+	u64 objno, objoff;
+	u32 xlen;
+
+	/* Nothing to do for empty array */
+	if (ext_cnt == 0) {
+		dout("%s: empty array, ret 0\n", __func__);
+		return 0;
+	}
+
+	ceph_calc_file_object_mapping(&ci->i_layout, off, map[0].len,
+				      &objno, &objoff, &xlen);
+
+	for (i = 0; i < ext_cnt; ++i) {
+		struct ceph_sparse_extent *ext = &map[i];
+		int pgsoff = ext->off - objoff;
+		int pgidx = pgsoff >> PAGE_SHIFT;
+		int fret;
+
+		if ((ext->off | ext->len) & ~CEPH_FSCRYPT_BLOCK_MASK) {
+			pr_warn("%s: bad encrypted sparse extent idx %d off %llx len %llx\n",
+				__func__, i, ext->off, ext->len);
+			return -EIO;
+		}
+		fret = ceph_fscrypt_decrypt_pages(inode, &page[pgidx],
+						 off + pgsoff, ext->len);
+		dout("%s: [%d] 0x%llx~0x%llx fret %d\n", __func__, i,
+				ext->off, ext->len, fret);
+		if (fret < 0) {
+			if (ret == 0)
+				ret = fret;
+			break;
+		}
+		ret = pgsoff + fret;
+	}
+	dout("%s: ret %d\n", __func__, ret);
+	return ret;
+}
+
+/**
+ * ceph_fscrypt_encrypt_pages - encrypt an array of pages
+ * @inode: pointer to inode associated with these pages
+ * @page: pointer to page array
+ * @off: offset into the file that the data starts
+ * @len: max length to encrypt
+ * @gfp: gfp flags to use for allocation
+ *
+ * Decrypt an array of cleartext pages and return the amount of
+ * data encrypted. Any data in the page prior to the start of the
+ * first complete block in the read is ignored. Any incomplete
+ * crypto blocks at the end of the array are ignored.
+ *
+ * Returns the length of the encrypted data or a negative errno.
+ */
+int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page, u64 off,
+				int len, gfp_t gfp)
+{
+	int i, num_blocks;
+	u64 baseblk = off >> CEPH_FSCRYPT_BLOCK_SHIFT;
+	int ret = 0;
+
+	/*
+	 * We can't deal with partial blocks on an encrypted file, so mask off
+	 * the last bit.
+	 */
+	num_blocks = ceph_fscrypt_blocks(off, len & CEPH_FSCRYPT_BLOCK_MASK);
+
+	/* Encrypt each block */
+	for (i = 0; i < num_blocks; ++i) {
+		int blkoff = i << CEPH_FSCRYPT_BLOCK_SHIFT;
+		int pgidx = blkoff >> PAGE_SHIFT;
+		unsigned int pgoffs = offset_in_page(blkoff);
+		int fret;
+
+		fret = ceph_fscrypt_encrypt_block_inplace(inode, page[pgidx],
+				CEPH_FSCRYPT_BLOCK_SIZE, pgoffs,
+				baseblk + i, gfp);
+		if (fret < 0) {
+			if (ret == 0)
+				ret = fret;
+			break;
+		}
+		ret += CEPH_FSCRYPT_BLOCK_SIZE;
+	}
+	return ret;
+}
diff --git a/fs/ceph/crypto.h b/fs/ceph/crypto.h
index 80acb23d0bb4..887f191cc423 100644
--- a/fs/ceph/crypto.h
+++ b/fs/ceph/crypto.h
@@ -100,6 +100,40 @@  int ceph_fname_to_usr(const struct ceph_fname *fname, struct fscrypt_str *tname,
 			struct fscrypt_str *oname, bool *is_nokey);
 int ceph_fscrypt_prepare_readdir(struct inode *dir);
 
+static inline unsigned int ceph_fscrypt_blocks(u64 off, u64 len)
+{
+	/* crypto blocks cannot span more than one page */
+	BUILD_BUG_ON(CEPH_FSCRYPT_BLOCK_SHIFT > PAGE_SHIFT);
+
+	return ((off+len+CEPH_FSCRYPT_BLOCK_SIZE-1) >> CEPH_FSCRYPT_BLOCK_SHIFT) -
+		(off >> CEPH_FSCRYPT_BLOCK_SHIFT);
+}
+
+/*
+ * If we have an encrypted inode then we must adjust the offset and
+ * range of the on-the-wire read to cover an entire encryption block.
+ * The copy will be done using the original offset and length, after
+ * we've decrypted the result.
+ */
+static inline void ceph_fscrypt_adjust_off_and_len(struct inode *inode, u64 *off, u64 *len)
+{
+	if (IS_ENCRYPTED(inode)) {
+		*len = ceph_fscrypt_blocks(*off, *len) * CEPH_FSCRYPT_BLOCK_SIZE;
+		*off &= CEPH_FSCRYPT_BLOCK_MASK;
+	}
+}
+
+int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
+				  struct page *page, unsigned int len,
+				  unsigned int offs, u64 lblk_num);
+int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
+				  struct page *page, unsigned int len,
+				  unsigned int offs, u64 lblk_num, gfp_t gfp_flags);
+int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page, u64 off, int len);
+int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page, u64 off,
+				 struct ceph_sparse_extent *map, u32 ext_cnt);
+int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page, u64 off,
+				int len, gfp_t gfp);
 #else /* CONFIG_FS_ENCRYPTION */
 
 static inline void ceph_fscrypt_set_ops(struct super_block *sb)
@@ -157,6 +191,43 @@  static inline int ceph_fscrypt_prepare_readdir(struct inode *dir)
 {
 	return 0;
 }
+
+static inline void ceph_fscrypt_adjust_off_and_len(struct inode *inode, u64 *off, u64 *len)
+{
+}
+
+static inline int ceph_fscrypt_decrypt_block_inplace(const struct inode *inode,
+					  struct page *page, unsigned int len,
+					  unsigned int offs, u64 lblk_num)
+{
+	return 0;
+}
+
+static inline int ceph_fscrypt_encrypt_block_inplace(const struct inode *inode,
+				  struct page *page, unsigned int len,
+				  unsigned int offs, u64 lblk_num, gfp_t gfp_flags)
+{
+	return 0;
+}
+
+static inline int ceph_fscrypt_decrypt_pages(struct inode *inode, struct page **page,
+					     u64 off, int len)
+{
+	return 0;
+}
+
+static inline int ceph_fscrypt_decrypt_extents(struct inode *inode, struct page **page,
+					u64 off, struct ceph_sparse_extent *map,
+					u32 ext_cnt)
+{
+	return 0;
+}
+
+static inline int ceph_fscrypt_encrypt_pages(struct inode *inode, struct page **page,
+					     u64 off, int len, gfp_t gfp)
+{
+	return 0;
+}
 #endif /* CONFIG_FS_ENCRYPTION */
 
 #endif
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index b9dd2fa36d8b..4b0a070d5c6d 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -591,6 +591,12 @@  static int ceph_parse_mount_param(struct fs_context *fc,
 		break;
 	case Opt_test_dummy_encryption:
 #ifdef CONFIG_FS_ENCRYPTION
+		/* HACK: allow for cleartext "encryption" in files for testing */
+		if (param->string && !strcmp(param->string, "clear")) {
+			fsopt->flags |= CEPH_MOUNT_OPT_DUMMY_ENC_CLEAR;
+			kfree(param->string);
+			param->string = NULL;
+		}
 		fscrypt_free_dummy_policy(&fsopt->dummy_enc_policy);
 		ret = fscrypt_parse_test_dummy_encryption(param,
 						&fsopt->dummy_enc_policy);
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index f4659b2a4731..e23bfd9191b3 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -44,6 +44,7 @@ 
 #define CEPH_MOUNT_OPT_ASYNC_DIROPS    (1<<15) /* allow async directory ops */
 #define CEPH_MOUNT_OPT_NOPAGECACHE     (1<<16) /* bypass pagecache altogether */
 #define CEPH_MOUNT_OPT_SPARSEREAD      (1<<17) /* always do sparse reads */
+#define CEPH_MOUNT_OPT_DUMMY_ENC_CLEAR (1<<18) /* don't actually encrypt content */
 
 #define CEPH_MOUNT_OPT_DEFAULT			\
 	(CEPH_MOUNT_OPT_DCACHE |		\