Commit 393a24a7 authored by Eric Biggers's avatar Eric Biggers
Browse files

fscrypt: split up fscrypt_supported_policy() by policy version 

Make fscrypt_supported_policy() call new functions
fscrypt_supported_v1_policy() and fscrypt_supported_v2_policy(), to
reduce the indentation level and make the code easier to read.

Also adjust the function comment to mention that whether the encryption
policy is supported can also depend on the inode.

No change in behavior.

Link: https://lore.kernel.org/r/20191209211829.239800-2-ebiggers@kernel.org


Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
parent 56dce717

fs/crypto/policy.c

+59 −57
Original line number Diff line number Diff line
@@ -63,23 +63,9 @@ static bool supported_iv_ino_lblk_64_policy( 
	return true;

}



/**

 * fscrypt_supported_policy - check whether an encryption policy is supported

 *

 * Given an encryption policy, check whether all its encryption modes and other

 * settings are supported by this kernel.  (But we don't currently don't check

 * for crypto API support here, so attempting to use an algorithm not configured

 * into the crypto API will still fail later.)

 *

 * Return: %true if supported, else %false

 */

bool fscrypt_supported_policy(const union fscrypt_policy *policy_u,

static bool fscrypt_supported_v1_policy(const struct fscrypt_policy_v1 *policy,

					const struct inode *inode)

{

	switch (policy_u->version) {

	case FSCRYPT_POLICY_V1: {

		const struct fscrypt_policy_v1 *policy = &policy_u->v1;



	if (!fscrypt_valid_enc_modes(policy->contents_encryption_mode,

				     policy->filenames_encryption_mode)) {

		fscrypt_warn(inode,
@@ -91,17 +77,17 @@ bool fscrypt_supported_policy(const union fscrypt_policy *policy_u, 


	if (policy->flags & ~(FSCRYPT_POLICY_FLAGS_PAD_MASK |

			      FSCRYPT_POLICY_FLAG_DIRECT_KEY)) {

			fscrypt_warn(inode,

				     "Unsupported encryption flags (0x%02x)",

		fscrypt_warn(inode, "Unsupported encryption flags (0x%02x)",

			     policy->flags);

		return false;

	}



	return true;

}

	case FSCRYPT_POLICY_V2: {

		const struct fscrypt_policy_v2 *policy = &policy_u->v2;



static bool fscrypt_supported_v2_policy(const struct fscrypt_policy_v2 *policy,

					const struct inode *inode)

{

	if (!fscrypt_valid_enc_modes(policy->contents_encryption_mode,

				     policy->filenames_encryption_mode)) {

		fscrypt_warn(inode,
@@ -112,8 +98,7 @@ bool fscrypt_supported_policy(const union fscrypt_policy *policy_u, 
	}



	if (policy->flags & ~FSCRYPT_POLICY_FLAGS_VALID) {

			fscrypt_warn(inode,

				     "Unsupported encryption flags (0x%02x)",

		fscrypt_warn(inode, "Unsupported encryption flags (0x%02x)",

			     policy->flags);

		return false;

	}
@@ -122,15 +107,32 @@ bool fscrypt_supported_policy(const union fscrypt_policy *policy_u, 
	    !supported_iv_ino_lblk_64_policy(policy, inode))

		return false;



		if (memchr_inv(policy->__reserved, 0,

			       sizeof(policy->__reserved))) {

			fscrypt_warn(inode,

				     "Reserved bits set in encryption policy");

	if (memchr_inv(policy->__reserved, 0, sizeof(policy->__reserved))) {

		fscrypt_warn(inode, "Reserved bits set in encryption policy");

		return false;

	}



	return true;

}



/**

 * fscrypt_supported_policy - check whether an encryption policy is supported

 *

 * Given an encryption policy, check whether all its encryption modes and other

 * settings are supported by this kernel on the given inode.  (But we don't

 * currently don't check for crypto API support here, so attempting to use an

 * algorithm not configured into the crypto API will still fail later.)

 *

 * Return: %true if supported, else %false

 */

bool fscrypt_supported_policy(const union fscrypt_policy *policy_u,

			      const struct inode *inode)

{

	switch (policy_u->version) {

	case FSCRYPT_POLICY_V1:

		return fscrypt_supported_v1_policy(&policy_u->v1, inode);

	case FSCRYPT_POLICY_V2:

		return fscrypt_supported_v2_policy(&policy_u->v2, inode);

	}

	return false;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE