Whamcloud - gitweb
LU-13717 sec: filename encryption
authorSebastien Buisson <sbuisson@ddn.com>
Tue, 23 Mar 2021 13:58:50 +0000 (22:58 +0900)
committerAndreas Dilger <adilger@whamcloud.com>
Mon, 21 Mar 2022 18:28:49 +0000 (18:28 +0000)
commitafec2fef717926619f7636fd12bc6d3c475df025
tree5ca0b441b409eeff0f8d86a3e7e41018f1a0734c
parentba50f9a977730589a3857d6bbf1d37d1e25e77ef
LU-13717 sec: filename encryption

On client side, call the appropriate llcrypt primitives from llite,
to proceed with filename encryption before sending requests to servers
and filename decryption upon request receipt.
Note we need specific overlay functions to handle encoding and
decoding of encrypted filenames, as we do not want server side to deal
with binary names before they reach the backend file system layer.

On server side, mainly the OSD layer, we need to know the encryption
status of files being processed.
If an object belongs to an encrypted file, the filename has been
encoded by the client because it is binary, so it needs to be decoded
before being handed over to the backend file system layer.
And conversely, the filename of an encrypted file has to be encoded
before being sent over the wire.
Note server side is osd-ldiskfs only for now.

Lustre-change: https://review.whamcloud.com/43390
Lustre-commit: 4d38566a004f6a636c37ec0c86f053be9b905bd7

Signed-off-by: Sebastien Buisson <sbuisson@ddn.com>
Change-Id: I7ac9047f5a046b8bc63afdbbb1f28e78aa5c8c7e
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
Reviewed-by: Patrick Farrell <pfarrell@whamcloud.com>
Reviewed-on: https://review.whamcloud.com/45730
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
14 files changed:
lustre/include/obd.h
lustre/llite/crypto.c
lustre/llite/dcache.c
lustre/llite/dir.c
lustre/llite/file.c
lustre/llite/llite_internal.h
lustre/llite/llite_lib.c
lustre/llite/namei.c
lustre/llite/statahead.c
lustre/mdc/mdc_lib.c
lustre/mdd/mdd_dir.c
lustre/osd-ldiskfs/osd_handler.c
lustre/ptlrpc/layout.c
lustre/tests/sanity-sec.sh