1 // SPDX-License-Identifier: GPL-2.0
22  * which replaces '-' and '_' by '+' and ','.
38 			bits -= 6;  in ceph_base64_encode()
43 		*cp++ = base64_table[(ac << (6 - bits)) & 0x3f];  in ceph_base64_encode()
44 	return cp - dst;  in ceph_base64_encode()
58 			return -1;  in ceph_base64_decode()
59 		ac = (ac << 6) | (p - base64_table);  in ceph_base64_decode()
62 			bits -= 8;  in ceph_base64_decode()
66 	if (ac & ((1 << bits) - 1))  in ceph_base64_decode()
67 		return -1;  in ceph_base64_decode()
68 	return bp - dst;  in ceph_base64_decode()
74 	struct ceph_fscrypt_auth *cfa = (struct ceph_fscrypt_auth *)ci->fscrypt_auth;  in ceph_crypt_get_context()
78 	if (!cfa || (ci->fscrypt_auth_len < (offsetof(struct ceph_fscrypt_auth, cfa_blob) + 1)))  in ceph_crypt_get_context()
79 		return -ENOBUFS;  in ceph_crypt_get_context()
82 	if (le32_to_cpu(cfa->cfa_version) != CEPH_FSCRYPT_AUTH_VERSION)  in ceph_crypt_get_context()
83 		return -ENOBUFS;  in ceph_crypt_get_context()
85 	ctxlen = le32_to_cpu(cfa->cfa_blob_len);  in ceph_crypt_get_context()
87 		return -ERANGE;  in ceph_crypt_get_context()
89 	memcpy(ctx, cfa->cfa_blob, ctxlen);  in ceph_crypt_get_context()
104 		return -EINVAL;  in ceph_crypt_set_context()
108 		return -ENOMEM;  in ceph_crypt_set_context()
110 	cfa->cfa_version = cpu_to_le32(CEPH_FSCRYPT_AUTH_VERSION);  in ceph_crypt_set_context()
111 	cfa->cfa_blob_len = cpu_to_le32(len);  in ceph_crypt_set_context()
112 	memcpy(cfa->cfa_blob, ctx, len);  in ceph_crypt_set_context()
127 	return ci->i_rsubdirs + ci->i_rfiles == 1;  in ceph_crypt_empty_dir()
132 	return ceph_sb_to_fs_client(sb)->fsc_dummy_enc_policy.policy;  in ceph_get_dummy_policy()
136 	.inode_info_offs	= (int)offsetof(struct ceph_inode_info, i_crypt_info) -
138 	.needs_bounce_pages	= 1,
152 	fscrypt_free_dummy_policy(&fsc->fsc_dummy_enc_policy);  in ceph_fscrypt_free_dummy_policy()
168 	as->fscrypt_auth = kzalloc(sizeof(*as->fscrypt_auth), GFP_KERNEL);  in ceph_fscrypt_prepare_context()
169 	if (!as->fscrypt_auth)  in ceph_fscrypt_prepare_context()
170 		return -ENOMEM;  in ceph_fscrypt_prepare_context()
172 	ctxsize = fscrypt_context_for_new_inode(as->fscrypt_auth->cfa_blob,  in ceph_fscrypt_prepare_context()
177 	as->fscrypt_auth->cfa_version = cpu_to_le32(CEPH_FSCRYPT_AUTH_VERSION);  in ceph_fscrypt_prepare_context()
178 	as->fscrypt_auth->cfa_blob_len = cpu_to_le32(ctxsize);  in ceph_fscrypt_prepare_context()
180 	WARN_ON_ONCE(ci->fscrypt_auth);  in ceph_fscrypt_prepare_context()
181 	kfree(ci->fscrypt_auth);  in ceph_fscrypt_prepare_context()
182 	ci->fscrypt_auth_len = ceph_fscrypt_auth_len(as->fscrypt_auth);  in ceph_fscrypt_prepare_context()
183 	ci->fscrypt_auth = kmemdup(as->fscrypt_auth, ci->fscrypt_auth_len,  in ceph_fscrypt_prepare_context()
185 	if (!ci->fscrypt_auth)  in ceph_fscrypt_prepare_context()
186 		return -ENOMEM;  in ceph_fscrypt_prepare_context()
188 	inode->i_flags |= S_ENCRYPTED;  in ceph_fscrypt_prepare_context()
196 	swap(req->r_fscrypt_auth, as->fscrypt_auth);  in ceph_fscrypt_as_ctx_to_req()
200  * User-created snapshots can't start with '_'.  Snapshots that start with this
204  *   _<SNAPSHOT-NAME>_<INODE-NUMBER>
207  *  - <SNAPSHOT-NAME> - the real snapshot name that may need to be decrypted,
208  *  - <INODE-NUMBER> - the inode number (in decimal) for the actual snapshot
211  * <INODE-NUMBER>.  'name_len' will also bet set with the <SNAPSHOT-NAME>
221 	int ret = -EIO;  in parse_longname()
222 	/* NUL-terminate */  in parse_longname()
225 		return ERR_PTR(-ENOMEM);  in parse_longname()
231 		return ERR_PTR(-EIO);  in parse_longname()
233 	*name_len = (name_end - str);  in parse_longname()
236 		return ERR_PTR(-EIO);  in parse_longname()
240 	inode_number = name_end + 1;  in parse_longname()
248 	dir = ceph_find_inode(parent->i_sb, vino);  in parse_longname()
251 		dir = ceph_get_inode(parent->i_sb, vino, NULL);  in parse_longname()
286 		elen = -ENAMETOOLONG;  in ceph_encode_encrypted_dname()
294 		elen = -ENOMEM;  in ceph_encode_encrypted_dname()
315 		sha256(extra, len - CEPH_NOHASH_NAME_MAX, hash);  in ceph_encode_encrypted_dname()
322 	doutc(cl, "base64-encoded ciphertext name = %.*s\n", elen, p);  in ceph_encode_encrypted_dname()
327 		elen += 1 + sprintf(p + elen, "_%ld", dir->i_ino);  in ceph_encode_encrypted_dname()
332 		if ((dir->i_state & I_NEW))  in ceph_encode_encrypted_dname()
341  * ceph_fname_to_usr - convert a filename for userland presentation
348  * userland. If @parent is not encrypted, just pass it back as-is.
358 	struct inode *dir = fname->dir;  in ceph_fname_to_usr()
361 	char *name = fname->name;  in ceph_fname_to_usr()
362 	int name_len = fname->name_len;  in ceph_fname_to_usr()
366 	if (fname->name_len > NAME_MAX || fname->ctext_len > NAME_MAX)  in ceph_fname_to_usr()
367 		return -EIO;  in ceph_fname_to_usr()
379 		oname->name = fname->name;  in ceph_fname_to_usr()
380 		oname->len = fname->name_len;  in ceph_fname_to_usr()
394 		if (fname->no_copy)  in ceph_fname_to_usr()
395 			oname->name = fname->name;  in ceph_fname_to_usr()
397 			memcpy(oname->name, fname->name, fname->name_len);  in ceph_fname_to_usr()
398 		oname->len = fname->name_len;  in ceph_fname_to_usr()
405 	if (fname->ctext_len == 0) {  in ceph_fname_to_usr()
415 		declen = ceph_base64_decode(name, name_len, tname->name);  in ceph_fname_to_usr()
417 			ret = -EIO;  in ceph_fname_to_usr()
420 		iname.name = tname->name;  in ceph_fname_to_usr()
423 		iname.name = fname->ctext;  in ceph_fname_to_usr()
424 		iname.len = fname->ctext_len;  in ceph_fname_to_usr()
428 	if (!ret && (dir != fname->dir)) {  in ceph_fname_to_usr()
432 				    oname->len, oname->name, dir->i_ino);  in ceph_fname_to_usr()
433 		memcpy(oname->name, tmp_buf, name_len);  in ceph_fname_to_usr()
434 		oname->len = name_len;  in ceph_fname_to_usr()
440 	if (dir != fname->dir) {  in ceph_fname_to_usr()
441 		if ((dir->i_state & I_NEW))  in ceph_fname_to_usr()
450  * ceph_fscrypt_prepare_readdir - simple __fscrypt_prepare_readdir() wrapper
454  * non-complete if this call results in having the directory unlocked.
457  *     1 - if directory was locked and key is now loaded (i.e. dir is unlocked)
458  *     0 - if directory is still locked
459  *   < 0 - if __fscrypt_prepare_readdir() fails
475 		return 1;  in ceph_fscrypt_prepare_readdir()
503  * ceph_fscrypt_decrypt_pages - decrypt an array of pages
558  * Given an extent map and a page array, decrypt the received data in-place,
570 	u32 xlen;  in ceph_fscrypt_decrypt_extents()  local
579 	ceph_calc_file_object_mapping(&ci->i_layout, off, map[0].len,  in ceph_fscrypt_decrypt_extents()
580 				      &objno, &objoff, &xlen);  in ceph_fscrypt_decrypt_extents()
584 		int pgsoff = ext->off - objoff;  in ceph_fscrypt_decrypt_extents()
588 		if ((ext->off | ext->len) & ~CEPH_FSCRYPT_BLOCK_MASK) {  in ceph_fscrypt_decrypt_extents()
592 				inode, ceph_vinop(inode), i, ext->off,  in ceph_fscrypt_decrypt_extents()
593 				ext->len);  in ceph_fscrypt_decrypt_extents()
594 			return -EIO;  in ceph_fscrypt_decrypt_extents()
597 						 off + pgsoff, ext->len);  in ceph_fscrypt_decrypt_extents()
599 		      ceph_vinop(inode), i, ext->off, ext->len, fret);  in ceph_fscrypt_decrypt_extents()
612  * ceph_fscrypt_encrypt_pages - encrypt an array of pages