Whamcloud - gitweb
LU-13717 sec: filename encryption 90/43390/15
authorSebastien Buisson <sbuisson@ddn.com>
Tue, 23 Mar 2021 13:58:50 +0000 (22:58 +0900)
committerOleg Drokin <green@whamcloud.com>
Sat, 11 Sep 2021 06:35:03 +0000 (06:35 +0000)
commit4d38566a004f6a636c37ec0c86f053be9b905bd7
treeebd718f5612234937c185cdaba662cebd4a3e689
parent7648c1c905b0976fc789cfd9c6bac382389385ee
LU-13717 sec: filename encryption

On client side, call the appropriate llcrypt primitives from llite,
to proceed with filename encryption before sending requests to servers
and filename decryption upon request receipt.
Note we need specific overlay functions to handle encoding and
decoding of encrypted filenames, as we do not want server side to deal
with binary names before they reach the backend file system layer.

On server side, mainly the OSD layer, we need to know the encryption
status of files being processed.
If an object belongs to an encrypted file, the filename has been
encoded by the client because it is binary, so it needs to be decoded
before being handed over to the backend file system layer.
And conversely, the filename of an encrypted file has to be encoded
before being sent over the wire.
Note server side is osd-ldiskfs only for now.

Signed-off-by: Sebastien Buisson <sbuisson@ddn.com>
Change-Id: I7ac9047f5a046b8bc63afdbbb1f28e78aa5c8c7e
Reviewed-on: https://review.whamcloud.com/43390
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
Reviewed-by: Patrick Farrell <pfarrell@whamcloud.com>
Reviewed-by: James Simmons <jsimmons@infradead.org>
14 files changed:
lustre/include/obd.h
lustre/llite/crypto.c
lustre/llite/dcache.c
lustre/llite/dir.c
lustre/llite/file.c
lustre/llite/llite_internal.h
lustre/llite/llite_lib.c
lustre/llite/namei.c
lustre/llite/statahead.c
lustre/mdc/mdc_lib.c
lustre/mdd/mdd_dir.c
lustre/osd-ldiskfs/osd_handler.c
lustre/ptlrpc/layout.c
lustre/tests/sanity-sec.sh