feat(security): implement Phase 2 Modell A (Steganografischer Alibi-Carrier für Plausible Deniability)
This commit is contained in:
+993
@@ -0,0 +1,993 @@
|
||||
use std::collections::HashMap;
|
||||
use std::fmt::Debug;
|
||||
use std::io::SeekFrom;
|
||||
use std::sync::atomic::{AtomicU64, Ordering};
|
||||
use std::sync::{Arc, Mutex};
|
||||
use std::time::{Duration, SystemTime, UNIX_EPOCH};
|
||||
|
||||
use anyhow::{bail, Result};
|
||||
use bytes::{Buf, Bytes, BytesMut};
|
||||
use dav_server::{
|
||||
davpath::DavPath,
|
||||
fs::{
|
||||
DavDirEntry, DavFile, DavFileSystem, DavMetaData, FsError, FsFuture, FsStream,
|
||||
OpenOptions, ReadDirMeta,
|
||||
},
|
||||
};
|
||||
use futures_util::stream;
|
||||
use rand::rngs::OsRng;
|
||||
use rand::RngCore;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use tracing::error;
|
||||
use zeroize::Zeroizing;
|
||||
|
||||
use crate::crypto::{decrypt_chunk, encrypt_chunk, CHUNK_SIZE};
|
||||
use crate::storage::Database;
|
||||
use crate::vfs::{is_leak_file, SanctumDirEntry, SanctumMetaData};
|
||||
|
||||
pub const CARRIER_MAGIC: &[u8; 8] = b"SANCTCAR";
|
||||
pub const CARRIER_VERSION: u32 = 1;
|
||||
|
||||
/// Manifest für das steganografische Dateisystem innerhalb des Alibi-Carriers (Block 0).
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct CarrierManifest {
|
||||
pub magic: [u8; 8],
|
||||
pub version: u32,
|
||||
pub total_blocks: u32,
|
||||
pub free_blocks: Vec<u32>,
|
||||
pub next_inode_id: i64,
|
||||
pub inodes: HashMap<i64, CarrierInode>,
|
||||
}
|
||||
|
||||
impl CarrierManifest {
|
||||
pub fn new(total_blocks: u32) -> Self {
|
||||
let mut inodes = HashMap::new();
|
||||
let now = SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.map(|d| d.as_secs())
|
||||
.unwrap_or(0);
|
||||
|
||||
// Inode 1 ist das Wurzelverzeichnis '/'
|
||||
inodes.insert(
|
||||
1,
|
||||
CarrierInode {
|
||||
id: 1,
|
||||
parent_id: None,
|
||||
name: String::new(),
|
||||
is_dir: true,
|
||||
size: 0,
|
||||
created_at: now,
|
||||
modified_at: now,
|
||||
blocks: Vec::new(),
|
||||
},
|
||||
);
|
||||
|
||||
// Block 0 ist für das Manifest reserviert. Nutzblöcke sind 1..total_blocks-1.
|
||||
let free_blocks = (1..total_blocks).collect();
|
||||
|
||||
Self {
|
||||
magic: *CARRIER_MAGIC,
|
||||
version: CARRIER_VERSION,
|
||||
total_blocks,
|
||||
free_blocks,
|
||||
next_inode_id: 2,
|
||||
inodes,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Inode-Eintrag für Dateien und Verzeichnisse im Carrier-Dateisystem.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct CarrierInode {
|
||||
pub id: i64,
|
||||
pub parent_id: Option<i64>,
|
||||
pub name: String,
|
||||
pub is_dir: bool,
|
||||
pub size: u64,
|
||||
pub created_at: u64,
|
||||
pub modified_at: u64,
|
||||
pub blocks: Vec<u32>, // Indizes der 1-MB-Blöcke innerhalb der Trägerdatei (1..total_blocks-1)
|
||||
}
|
||||
|
||||
pub const CARRIER_BLOCK_PAYLOAD_SIZE: usize = CHUNK_SIZE - 64;
|
||||
|
||||
/// Liest einen Carrier-Block mit Zwei-Schichten-AEAD:
|
||||
/// 1. Äußere Entschlüsselung mit dek_outer (DEK_0)
|
||||
/// 2. Innere Entschlüsselung mit dek_inner (DEK_1)
|
||||
pub fn read_carrier_block(
|
||||
db: &Database,
|
||||
carrier_node_id: i64,
|
||||
block_idx: u32,
|
||||
dek_outer: &[u8; 32],
|
||||
dek_inner: &[u8; 32],
|
||||
format_version: u32,
|
||||
) -> Result<Vec<u8>> {
|
||||
let chunk_rec = db
|
||||
.read_chunk(carrier_node_id, block_idx)?
|
||||
.ok_or_else(|| anyhow::anyhow!("Carrier-Chunk #{} nicht gefunden", block_idx))?;
|
||||
|
||||
// 1. Äußere Schicht entschlüsseln (mit dek_outer = DEK_0)
|
||||
let outer_decrypted = decrypt_chunk(
|
||||
dek_outer,
|
||||
carrier_node_id,
|
||||
block_idx,
|
||||
&chunk_rec.ciphertext,
|
||||
&chunk_rec.nonce,
|
||||
&chunk_rec.tag,
|
||||
format_version,
|
||||
)?;
|
||||
|
||||
// Das outer_decrypted enthält: inner_nonce (12B) || inner_tag (16B) || inner_ct_len (4B LE) || inner_ct || CSPRNG-Padding
|
||||
if outer_decrypted.len() < 32 {
|
||||
bail!(
|
||||
"Carrier-Block #{}: Äußere Nutzdaten zu kurz (< 32 Bytes)",
|
||||
block_idx
|
||||
);
|
||||
}
|
||||
|
||||
let mut inner_nonce = [0u8; 12];
|
||||
inner_nonce.copy_from_slice(&outer_decrypted[0..12]);
|
||||
let mut inner_tag = [0u8; 16];
|
||||
inner_tag.copy_from_slice(&outer_decrypted[12..28]);
|
||||
let inner_ct_len = u32::from_le_bytes(outer_decrypted[28..32].try_into().unwrap()) as usize;
|
||||
if 32 + inner_ct_len > outer_decrypted.len() {
|
||||
bail!(
|
||||
"Carrier-Block #{}: Ungültige innere Ciphertext-Länge {} (verfügbar: {})",
|
||||
block_idx,
|
||||
inner_ct_len,
|
||||
outer_decrypted.len() - 32
|
||||
);
|
||||
}
|
||||
let inner_ciphertext = &outer_decrypted[32..32 + inner_ct_len];
|
||||
|
||||
// 2. Innere Schicht entschlüsseln (mit dek_inner = DEK_1)
|
||||
let inner_plaintext = decrypt_chunk(
|
||||
dek_inner,
|
||||
carrier_node_id,
|
||||
block_idx,
|
||||
inner_ciphertext,
|
||||
&inner_nonce,
|
||||
&inner_tag,
|
||||
format_version,
|
||||
)?;
|
||||
|
||||
Ok(inner_plaintext)
|
||||
}
|
||||
|
||||
/// Schreibt einen Carrier-Block mit Zwei-Schichten-AEAD:
|
||||
/// 1. Innere Verschlüsselung mit dek_inner (DEK_1)
|
||||
/// 2. Auffüllen auf exakt CHUNK_SIZE mit CSPRNG-Zufallsdaten
|
||||
/// 3. Äußere Verschlüsselung mit dek_outer (DEK_0)
|
||||
pub fn write_carrier_block(
|
||||
db: &Database,
|
||||
carrier_node_id: i64,
|
||||
block_idx: u32,
|
||||
dek_outer: &[u8; 32],
|
||||
dek_inner: &[u8; 32],
|
||||
plaintext: &[u8],
|
||||
format_version: u32,
|
||||
) -> Result<()> {
|
||||
// 1. Innere Schicht verschlüsseln (mit dek_inner = DEK_1)
|
||||
let (inner_ct, inner_nonce, inner_tag) = encrypt_chunk(
|
||||
dek_inner,
|
||||
carrier_node_id,
|
||||
block_idx,
|
||||
plaintext,
|
||||
format_version,
|
||||
)?;
|
||||
|
||||
let inner_ct_len = inner_ct.len() as u32;
|
||||
|
||||
// 2. Äußere Nutzlast vorbereiten: Exakt CHUNK_SIZE (1 MB) mit CSPRNG-Rauschen
|
||||
// Format: inner_nonce (12B) || inner_tag (16B) || inner_ct_len (4B LE) || inner_ct || CSPRNG-Padding
|
||||
let mut outer_plaintext = vec![0u8; CHUNK_SIZE];
|
||||
OsRng.fill_bytes(&mut outer_plaintext);
|
||||
|
||||
outer_plaintext[0..12].copy_from_slice(&inner_nonce);
|
||||
outer_plaintext[12..28].copy_from_slice(&inner_tag);
|
||||
outer_plaintext[28..32].copy_from_slice(&inner_ct_len.to_le_bytes());
|
||||
let ct_end = 32 + inner_ct.len();
|
||||
if ct_end > CHUNK_SIZE {
|
||||
bail!(
|
||||
"Carrier-Block #{}: Payload überschreitet Blockgröße ({} > {})",
|
||||
block_idx,
|
||||
ct_end,
|
||||
CHUNK_SIZE
|
||||
);
|
||||
}
|
||||
outer_plaintext[32..ct_end].copy_from_slice(&inner_ct);
|
||||
|
||||
// 3. Äußere Schicht verschlüsseln (mit dek_outer = DEK_0)
|
||||
let (outer_ct, outer_nonce, outer_tag) = encrypt_chunk(
|
||||
dek_outer,
|
||||
carrier_node_id,
|
||||
block_idx,
|
||||
&outer_plaintext,
|
||||
format_version,
|
||||
)?;
|
||||
|
||||
// 4. In SQLite schreiben (in-place Überschreiben des bestehenden Chunks)
|
||||
db.write_chunk(
|
||||
carrier_node_id,
|
||||
block_idx,
|
||||
&outer_nonce,
|
||||
&outer_tag,
|
||||
&outer_ct,
|
||||
)?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Überschreibt einen freigegebenen Carrier-Block mit frischem kryptografischen Rauschen
|
||||
/// (unter dek_outer verschlüsselt), sodass er weiterhin als 100% gültiger DEK_0-Chunk authentifiziert.
|
||||
pub fn shred_carrier_block(
|
||||
db: &Database,
|
||||
carrier_node_id: i64,
|
||||
block_idx: u32,
|
||||
dek_outer: &[u8; 32],
|
||||
format_version: u32,
|
||||
) -> Result<()> {
|
||||
let mut noise = vec![0u8; CHUNK_SIZE];
|
||||
OsRng.fill_bytes(&mut noise);
|
||||
|
||||
let (outer_ct, outer_nonce, outer_tag) = encrypt_chunk(
|
||||
dek_outer,
|
||||
carrier_node_id,
|
||||
block_idx,
|
||||
&noise,
|
||||
format_version,
|
||||
)?;
|
||||
|
||||
db.write_chunk(
|
||||
carrier_node_id,
|
||||
block_idx,
|
||||
&outer_nonce,
|
||||
&outer_tag,
|
||||
&outer_ct,
|
||||
)?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Interner Zustand des Carrier-Dateisystems.
|
||||
pub struct CarrierFsInner {
|
||||
pub db: Database,
|
||||
pub carrier_node_id: i64,
|
||||
pub dek_outer: Arc<Zeroizing<[u8; 32]>>,
|
||||
pub dek_inner: Arc<Zeroizing<[u8; 32]>>,
|
||||
pub format_version: u32,
|
||||
pub anti_leak: bool,
|
||||
pub manifest: CarrierManifest,
|
||||
pub last_activity: Arc<AtomicU64>,
|
||||
}
|
||||
|
||||
impl CarrierFsInner {
|
||||
pub fn save_manifest(&mut self) -> Result<()> {
|
||||
let manifest_bytes = serde_json::to_vec(&self.manifest)?;
|
||||
write_carrier_block(
|
||||
&self.db,
|
||||
self.carrier_node_id,
|
||||
0,
|
||||
&self.dek_outer,
|
||||
&self.dek_inner,
|
||||
&manifest_bytes,
|
||||
self.format_version,
|
||||
)?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn allocate_block(&mut self) -> Result<u32, FsError> {
|
||||
self.manifest
|
||||
.free_blocks
|
||||
.pop()
|
||||
.ok_or(FsError::InsufficientStorage)
|
||||
}
|
||||
|
||||
pub fn free_block(&mut self, block_idx: u32) -> Result<(), FsError> {
|
||||
let _ = shred_carrier_block(
|
||||
&self.db,
|
||||
self.carrier_node_id,
|
||||
block_idx,
|
||||
&self.dek_outer,
|
||||
self.format_version,
|
||||
);
|
||||
self.manifest.free_blocks.push(block_idx);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn resolve_path(&self, raw_path: &str) -> Option<CarrierInode> {
|
||||
let trimmed = raw_path.trim_matches('/');
|
||||
if trimmed.is_empty() {
|
||||
return self.manifest.inodes.get(&1).cloned();
|
||||
}
|
||||
|
||||
let segments: Vec<&str> = trimmed.split('/').filter(|s| !s.is_empty()).collect();
|
||||
let mut current_id = 1i64;
|
||||
|
||||
for (idx, segment) in segments.iter().enumerate() {
|
||||
let child = self.manifest.inodes.values().find(|inode| {
|
||||
inode.parent_id == Some(current_id) && inode.name.as_str() == *segment
|
||||
})?;
|
||||
|
||||
if idx + 1 < segments.len() && !child.is_dir {
|
||||
return None;
|
||||
}
|
||||
current_id = child.id;
|
||||
}
|
||||
|
||||
self.manifest.inodes.get(¤t_id).cloned()
|
||||
}
|
||||
|
||||
pub fn split_parent_and_name<'a>(&self, path: &'a str) -> (&'a str, &'a str) {
|
||||
let trimmed = path.trim_matches('/');
|
||||
match trimmed.rfind('/') {
|
||||
Some(pos) => (&trimmed[..pos], &trimmed[pos + 1..]),
|
||||
None => ("", trimmed),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// WebDAV-Filesystem-Treiber für den steganografischen Alibi-Carrier (Hidden Vault).
|
||||
#[derive(Clone)]
|
||||
pub struct CarrierFs {
|
||||
inner: Arc<Mutex<CarrierFsInner>>,
|
||||
}
|
||||
|
||||
impl CarrierFs {
|
||||
/// Lädt ein bestehendes Carrier-Dateisystem aus Block 0 der Trägerdatei.
|
||||
pub fn load(
|
||||
db: Database,
|
||||
carrier_node_id: i64,
|
||||
dek_outer: Arc<Zeroizing<[u8; 32]>>,
|
||||
dek_inner: Arc<Zeroizing<[u8; 32]>>,
|
||||
format_version: u32,
|
||||
anti_leak: bool,
|
||||
) -> Result<Self> {
|
||||
let manifest_bytes = read_carrier_block(
|
||||
&db,
|
||||
carrier_node_id,
|
||||
0,
|
||||
&dek_outer,
|
||||
&dek_inner,
|
||||
format_version,
|
||||
)?;
|
||||
|
||||
let manifest: CarrierManifest = serde_json::from_slice(&manifest_bytes)?;
|
||||
if manifest.magic != *CARRIER_MAGIC {
|
||||
bail!("Ungültige Carrier-Magic-Bytes in Block 0");
|
||||
}
|
||||
|
||||
let now = SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.map(|d| d.as_secs())
|
||||
.unwrap_or(0);
|
||||
|
||||
let inner = CarrierFsInner {
|
||||
db,
|
||||
carrier_node_id,
|
||||
dek_outer,
|
||||
dek_inner,
|
||||
format_version,
|
||||
anti_leak,
|
||||
manifest,
|
||||
last_activity: Arc::new(AtomicU64::new(now)),
|
||||
};
|
||||
|
||||
Ok(Self {
|
||||
inner: Arc::new(Mutex::new(inner)),
|
||||
})
|
||||
}
|
||||
|
||||
pub fn last_activity(&self) -> Arc<AtomicU64> {
|
||||
let inner = self.inner.lock().unwrap();
|
||||
inner.last_activity.clone()
|
||||
}
|
||||
|
||||
pub fn touch(&self) {
|
||||
let now = SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.map(|d| d.as_secs())
|
||||
.unwrap_or(0);
|
||||
let inner = self.inner.lock().unwrap();
|
||||
inner.last_activity.store(now, Ordering::Relaxed);
|
||||
}
|
||||
|
||||
fn path_to_str(path: &DavPath) -> String {
|
||||
String::from_utf8_lossy(path.as_bytes()).to_string()
|
||||
}
|
||||
}
|
||||
|
||||
impl DavFileSystem for CarrierFs {
|
||||
fn open<'a>(
|
||||
&'a self,
|
||||
path: &'a DavPath,
|
||||
options: OpenOptions,
|
||||
) -> FsFuture<'a, Box<dyn DavFile>> {
|
||||
Box::pin(async move {
|
||||
self.touch();
|
||||
let path_str = Self::path_to_str(path);
|
||||
|
||||
let mut inner = self.inner.lock().unwrap();
|
||||
let (parent_path, file_name) = inner.split_parent_and_name(&path_str);
|
||||
|
||||
if inner.anti_leak && is_leak_file(file_name) {
|
||||
if options.create
|
||||
|| options.create_new
|
||||
|| options.write
|
||||
|| options.append
|
||||
|| options.truncate
|
||||
{
|
||||
return Err(FsError::Forbidden);
|
||||
}
|
||||
}
|
||||
|
||||
let existing_node = inner.resolve_path(&path_str);
|
||||
|
||||
let inode = match existing_node {
|
||||
Some(mut n) => {
|
||||
if n.is_dir && (options.write || options.append) {
|
||||
return Err(FsError::Forbidden);
|
||||
}
|
||||
if options.create_new {
|
||||
return Err(FsError::Exists);
|
||||
}
|
||||
|
||||
if options.truncate {
|
||||
for b in n.blocks.drain(..) {
|
||||
let _ = shred_carrier_block(
|
||||
&inner.db,
|
||||
inner.carrier_node_id,
|
||||
b,
|
||||
&inner.dek_outer,
|
||||
inner.format_version,
|
||||
);
|
||||
inner.manifest.free_blocks.push(b);
|
||||
}
|
||||
let now = SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.map(|d| d.as_secs())
|
||||
.unwrap_or(0);
|
||||
n.size = 0;
|
||||
n.modified_at = now;
|
||||
inner.manifest.inodes.insert(n.id, n.clone());
|
||||
let _ = inner.save_manifest();
|
||||
}
|
||||
n
|
||||
}
|
||||
None => {
|
||||
if options.create || options.create_new {
|
||||
let parent = inner.resolve_path(parent_path).ok_or(FsError::NotFound)?;
|
||||
if !parent.is_dir {
|
||||
return Err(FsError::Forbidden);
|
||||
}
|
||||
|
||||
let now = SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.map(|d| d.as_secs())
|
||||
.unwrap_or(0);
|
||||
|
||||
let new_id = inner.manifest.next_inode_id;
|
||||
inner.manifest.next_inode_id += 1;
|
||||
|
||||
let new_inode = CarrierInode {
|
||||
id: new_id,
|
||||
parent_id: Some(parent.id),
|
||||
name: file_name.to_string(),
|
||||
is_dir: false,
|
||||
size: 0,
|
||||
created_at: now,
|
||||
modified_at: now,
|
||||
blocks: Vec::new(),
|
||||
};
|
||||
|
||||
inner.manifest.inodes.insert(new_id, new_inode.clone());
|
||||
let _ = inner.save_manifest();
|
||||
new_inode
|
||||
} else {
|
||||
return Err(FsError::NotFound);
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
drop(inner);
|
||||
|
||||
let file = CarrierFile::new(inode, self.inner.clone());
|
||||
Ok(Box::new(file) as Box<dyn DavFile>)
|
||||
})
|
||||
}
|
||||
|
||||
fn read_dir<'a>(
|
||||
&'a self,
|
||||
path: &'a DavPath,
|
||||
_meta: ReadDirMeta,
|
||||
) -> FsFuture<'a, FsStream<Box<dyn DavDirEntry>>> {
|
||||
Box::pin(async move {
|
||||
self.touch();
|
||||
let path_str = Self::path_to_str(path);
|
||||
let inner = self.inner.lock().unwrap();
|
||||
|
||||
let node = inner.resolve_path(&path_str).ok_or(FsError::NotFound)?;
|
||||
if !node.is_dir {
|
||||
return Err(FsError::Forbidden);
|
||||
}
|
||||
|
||||
let entries: Vec<Result<Box<dyn DavDirEntry>, FsError>> = inner
|
||||
.manifest
|
||||
.inodes
|
||||
.values()
|
||||
.filter(|child| child.parent_id == Some(node.id))
|
||||
.filter(|child| !inner.anti_leak || !is_leak_file(&child.name))
|
||||
.map(|child| {
|
||||
Ok(Box::new(SanctumDirEntry {
|
||||
name: child.name.clone(),
|
||||
meta: SanctumMetaData {
|
||||
is_dir: child.is_dir,
|
||||
size: child.size,
|
||||
created_at: UNIX_EPOCH + Duration::from_secs(child.created_at),
|
||||
modified_at: UNIX_EPOCH + Duration::from_secs(child.modified_at),
|
||||
},
|
||||
}) as Box<dyn DavDirEntry>)
|
||||
})
|
||||
.collect();
|
||||
|
||||
Ok(Box::pin(stream::iter(entries)) as FsStream<Box<dyn DavDirEntry>>)
|
||||
})
|
||||
}
|
||||
|
||||
fn metadata<'a>(&'a self, path: &'a DavPath) -> FsFuture<'a, Box<dyn DavMetaData>> {
|
||||
Box::pin(async move {
|
||||
let path_str = Self::path_to_str(path);
|
||||
if path_str != "/" && !path_str.is_empty() {
|
||||
self.touch();
|
||||
}
|
||||
|
||||
let inner = self.inner.lock().unwrap();
|
||||
let node = inner.resolve_path(&path_str).ok_or(FsError::NotFound)?;
|
||||
|
||||
let meta = SanctumMetaData {
|
||||
is_dir: node.is_dir,
|
||||
size: node.size,
|
||||
created_at: UNIX_EPOCH + Duration::from_secs(node.created_at),
|
||||
modified_at: UNIX_EPOCH + Duration::from_secs(node.modified_at),
|
||||
};
|
||||
|
||||
Ok(Box::new(meta) as Box<dyn DavMetaData>)
|
||||
})
|
||||
}
|
||||
|
||||
fn symlink_metadata<'a>(&'a self, path: &'a DavPath) -> FsFuture<'a, Box<dyn DavMetaData>> {
|
||||
self.metadata(path)
|
||||
}
|
||||
|
||||
fn create_dir<'a>(&'a self, path: &'a DavPath) -> FsFuture<'a, ()> {
|
||||
Box::pin(async move {
|
||||
self.touch();
|
||||
let path_str = Self::path_to_str(path);
|
||||
let mut inner = self.inner.lock().unwrap();
|
||||
let (parent_path, dir_name) = inner.split_parent_and_name(&path_str);
|
||||
|
||||
if inner.anti_leak && is_leak_file(dir_name) {
|
||||
return Err(FsError::Forbidden);
|
||||
}
|
||||
|
||||
if inner.resolve_path(&path_str).is_some() {
|
||||
return Err(FsError::Exists);
|
||||
}
|
||||
|
||||
let parent = inner.resolve_path(parent_path).ok_or(FsError::NotFound)?;
|
||||
if !parent.is_dir {
|
||||
return Err(FsError::Forbidden);
|
||||
}
|
||||
|
||||
let now = SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.map(|d| d.as_secs())
|
||||
.unwrap_or(0);
|
||||
|
||||
let new_id = inner.manifest.next_inode_id;
|
||||
inner.manifest.next_inode_id += 1;
|
||||
|
||||
let new_dir = CarrierInode {
|
||||
id: new_id,
|
||||
parent_id: Some(parent.id),
|
||||
name: dir_name.to_string(),
|
||||
is_dir: true,
|
||||
size: 0,
|
||||
created_at: now,
|
||||
modified_at: now,
|
||||
blocks: Vec::new(),
|
||||
};
|
||||
|
||||
inner.manifest.inodes.insert(new_id, new_dir);
|
||||
inner
|
||||
.save_manifest()
|
||||
.map_err(|_| FsError::GeneralFailure)?;
|
||||
|
||||
Ok(())
|
||||
})
|
||||
}
|
||||
|
||||
fn remove_dir<'a>(&'a self, path: &'a DavPath) -> FsFuture<'a, ()> {
|
||||
Box::pin(async move {
|
||||
self.touch();
|
||||
let path_str = Self::path_to_str(path);
|
||||
let mut inner = self.inner.lock().unwrap();
|
||||
|
||||
let node = inner.resolve_path(&path_str).ok_or(FsError::NotFound)?;
|
||||
if !node.is_dir {
|
||||
return Err(FsError::Forbidden);
|
||||
}
|
||||
if node.id == 1 {
|
||||
// Wurzelknoten darf nicht gelöscht werden
|
||||
return Err(FsError::Forbidden);
|
||||
}
|
||||
|
||||
// Prüfe, ob das Verzeichnis leer ist
|
||||
let has_children = inner
|
||||
.manifest
|
||||
.inodes
|
||||
.values()
|
||||
.any(|child| child.parent_id == Some(node.id));
|
||||
|
||||
if has_children {
|
||||
return Err(FsError::Forbidden);
|
||||
}
|
||||
|
||||
inner.manifest.inodes.remove(&node.id);
|
||||
inner
|
||||
.save_manifest()
|
||||
.map_err(|_| FsError::GeneralFailure)?;
|
||||
|
||||
Ok(())
|
||||
})
|
||||
}
|
||||
|
||||
fn remove_file<'a>(&'a self, path: &'a DavPath) -> FsFuture<'a, ()> {
|
||||
Box::pin(async move {
|
||||
self.touch();
|
||||
let path_str = Self::path_to_str(path);
|
||||
let mut inner = self.inner.lock().unwrap();
|
||||
|
||||
let node = inner.resolve_path(&path_str).ok_or(FsError::NotFound)?;
|
||||
if node.is_dir {
|
||||
return Err(FsError::Forbidden);
|
||||
}
|
||||
|
||||
for b in node.blocks {
|
||||
let _ = shred_carrier_block(
|
||||
&inner.db,
|
||||
inner.carrier_node_id,
|
||||
b,
|
||||
&inner.dek_outer,
|
||||
inner.format_version,
|
||||
);
|
||||
inner.manifest.free_blocks.push(b);
|
||||
}
|
||||
|
||||
inner.manifest.inodes.remove(&node.id);
|
||||
inner
|
||||
.save_manifest()
|
||||
.map_err(|_| FsError::GeneralFailure)?;
|
||||
|
||||
Ok(())
|
||||
})
|
||||
}
|
||||
|
||||
fn rename<'a>(&'a self, from: &'a DavPath, to: &'a DavPath) -> FsFuture<'a, ()> {
|
||||
Box::pin(async move {
|
||||
self.touch();
|
||||
let from_str = Self::path_to_str(from);
|
||||
let to_str = Self::path_to_str(to);
|
||||
|
||||
let mut inner = self.inner.lock().unwrap();
|
||||
let node = inner.resolve_path(&from_str).ok_or(FsError::NotFound)?;
|
||||
|
||||
let (to_parent_path, to_name) = inner.split_parent_and_name(&to_str);
|
||||
if inner.anti_leak && is_leak_file(to_name) {
|
||||
return Err(FsError::Forbidden);
|
||||
}
|
||||
|
||||
let to_parent = inner
|
||||
.resolve_path(to_parent_path)
|
||||
.ok_or(FsError::NotFound)?;
|
||||
if !to_parent.is_dir {
|
||||
return Err(FsError::Forbidden);
|
||||
}
|
||||
|
||||
// Falls Zieldatei existiert und kein Verzeichnis ist: überschreiben
|
||||
if let Some(dest) = inner.resolve_path(&to_str) {
|
||||
if dest.is_dir {
|
||||
return Err(FsError::Forbidden);
|
||||
}
|
||||
for b in dest.blocks {
|
||||
let _ = shred_carrier_block(
|
||||
&inner.db,
|
||||
inner.carrier_node_id,
|
||||
b,
|
||||
&inner.dek_outer,
|
||||
inner.format_version,
|
||||
);
|
||||
inner.manifest.free_blocks.push(b);
|
||||
}
|
||||
inner.manifest.inodes.remove(&dest.id);
|
||||
}
|
||||
|
||||
let now = SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.map(|d| d.as_secs())
|
||||
.unwrap_or(0);
|
||||
|
||||
if let Some(inode) = inner.manifest.inodes.get_mut(&node.id) {
|
||||
inode.parent_id = Some(to_parent.id);
|
||||
inode.name = to_name.to_string();
|
||||
inode.modified_at = now;
|
||||
}
|
||||
|
||||
inner
|
||||
.save_manifest()
|
||||
.map_err(|_| FsError::GeneralFailure)?;
|
||||
|
||||
Ok(())
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
/// Datei-Handle für Dateien innerhalb des Carrier-Dateisystems mit Streaming und Chunk-Pufferung.
|
||||
pub struct CarrierFile {
|
||||
inode_id: i64,
|
||||
file_size: u64,
|
||||
cursor: u64,
|
||||
blocks: Vec<u32>,
|
||||
inner_fs: Arc<Mutex<CarrierFsInner>>,
|
||||
meta: SanctumMetaData,
|
||||
// (block_index_in_file, decrypted_payload, is_dirty)
|
||||
cached_block: Option<(usize, Vec<u8>, bool)>,
|
||||
}
|
||||
|
||||
impl Debug for CarrierFile {
|
||||
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
||||
f.debug_struct("CarrierFile")
|
||||
.field("inode_id", &self.inode_id)
|
||||
.field("file_size", &self.file_size)
|
||||
.field("cursor", &self.cursor)
|
||||
.finish()
|
||||
}
|
||||
}
|
||||
|
||||
impl CarrierFile {
|
||||
pub fn new(inode: CarrierInode, inner_fs: Arc<Mutex<CarrierFsInner>>) -> Self {
|
||||
let meta = SanctumMetaData {
|
||||
is_dir: inode.is_dir,
|
||||
size: inode.size,
|
||||
created_at: UNIX_EPOCH + Duration::from_secs(inode.created_at),
|
||||
modified_at: UNIX_EPOCH + Duration::from_secs(inode.modified_at),
|
||||
};
|
||||
|
||||
Self {
|
||||
inode_id: inode.id,
|
||||
file_size: inode.size,
|
||||
cursor: 0,
|
||||
blocks: inode.blocks,
|
||||
inner_fs,
|
||||
meta,
|
||||
cached_block: None,
|
||||
}
|
||||
}
|
||||
|
||||
fn touch(&self) {
|
||||
let now = SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.map(|d| d.as_secs())
|
||||
.unwrap_or(0);
|
||||
let inner = self.inner_fs.lock().unwrap();
|
||||
inner.last_activity.store(now, Ordering::Relaxed);
|
||||
}
|
||||
|
||||
fn flush_cached_block(&mut self) -> Result<(), FsError> {
|
||||
if let Some((block_idx_in_file, ref data, true)) = self.cached_block {
|
||||
let mut inner = self.inner_fs.lock().unwrap();
|
||||
|
||||
// Allokiere Blöcke bis zum aktuellen Index falls nötig
|
||||
while self.blocks.len() <= block_idx_in_file {
|
||||
let new_block = inner.allocate_block()?;
|
||||
self.blocks.push(new_block);
|
||||
}
|
||||
|
||||
let carrier_block_idx = self.blocks[block_idx_in_file];
|
||||
write_carrier_block(
|
||||
&inner.db,
|
||||
inner.carrier_node_id,
|
||||
carrier_block_idx,
|
||||
&inner.dek_outer,
|
||||
&inner.dek_inner,
|
||||
data,
|
||||
inner.format_version,
|
||||
)
|
||||
.map_err(|e| {
|
||||
error!("Fehler beim Schreiben des Carrier-Blocks: {e}");
|
||||
FsError::GeneralFailure
|
||||
})?;
|
||||
|
||||
if let Some((_, _, ref mut dirty)) = self.cached_block {
|
||||
*dirty = false;
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn ensure_block_loaded(&mut self, block_idx_in_file: usize) -> Result<&mut Vec<u8>, FsError> {
|
||||
if let Some((cached_idx, _, _)) = self.cached_block {
|
||||
if cached_idx == block_idx_in_file {
|
||||
return Ok(&mut self.cached_block.as_mut().unwrap().1);
|
||||
}
|
||||
}
|
||||
|
||||
self.flush_cached_block()?;
|
||||
|
||||
let data = if block_idx_in_file < self.blocks.len() {
|
||||
let carrier_block_idx = self.blocks[block_idx_in_file];
|
||||
let inner = self.inner_fs.lock().unwrap();
|
||||
match read_carrier_block(
|
||||
&inner.db,
|
||||
inner.carrier_node_id,
|
||||
carrier_block_idx,
|
||||
&inner.dek_outer,
|
||||
&inner.dek_inner,
|
||||
inner.format_version,
|
||||
) {
|
||||
Ok(bytes) => bytes,
|
||||
Err(e) => {
|
||||
error!("Fehler beim Lesen des Carrier-Blocks: {e}");
|
||||
return Err(FsError::GeneralFailure);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
Vec::new()
|
||||
};
|
||||
|
||||
self.cached_block = Some((block_idx_in_file, data, false));
|
||||
Ok(&mut self.cached_block.as_mut().unwrap().1)
|
||||
}
|
||||
}
|
||||
|
||||
impl DavFile for CarrierFile {
|
||||
fn metadata(&mut self) -> FsFuture<'_, Box<dyn DavMetaData>> {
|
||||
let meta = self.meta.clone();
|
||||
Box::pin(async move { Ok(Box::new(meta) as Box<dyn DavMetaData>) })
|
||||
}
|
||||
|
||||
fn read_bytes(&mut self, count: usize) -> FsFuture<'_, Bytes> {
|
||||
self.touch();
|
||||
Box::pin(async move {
|
||||
if self.cursor >= self.file_size {
|
||||
return Ok(Bytes::new());
|
||||
}
|
||||
|
||||
let available = (self.file_size - self.cursor) as usize;
|
||||
let to_read = count.min(available);
|
||||
let mut result = BytesMut::with_capacity(to_read);
|
||||
let mut remaining = to_read;
|
||||
|
||||
while remaining > 0 {
|
||||
let block_idx = (self.cursor / CARRIER_BLOCK_PAYLOAD_SIZE as u64) as usize;
|
||||
let offset_in_block = (self.cursor % CARRIER_BLOCK_PAYLOAD_SIZE as u64) as usize;
|
||||
let space_in_block = CARRIER_BLOCK_PAYLOAD_SIZE - offset_in_block;
|
||||
let bytes_from_block = remaining.min(space_in_block);
|
||||
|
||||
let block_data = self.ensure_block_loaded(block_idx)?;
|
||||
|
||||
if offset_in_block < block_data.len() {
|
||||
let end = (offset_in_block + bytes_from_block).min(block_data.len());
|
||||
result.extend_from_slice(&block_data[offset_in_block..end]);
|
||||
let actually_read = end - offset_in_block;
|
||||
self.cursor += actually_read as u64;
|
||||
remaining -= actually_read;
|
||||
if actually_read < bytes_from_block {
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
Ok(result.freeze())
|
||||
})
|
||||
}
|
||||
|
||||
fn write_bytes(&mut self, buf: Bytes) -> FsFuture<'_, ()> {
|
||||
self.touch();
|
||||
Box::pin(async move {
|
||||
let mut src = &buf[..];
|
||||
|
||||
while !src.is_empty() {
|
||||
let block_idx = (self.cursor / CARRIER_BLOCK_PAYLOAD_SIZE as u64) as usize;
|
||||
let offset_in_block = (self.cursor % CARRIER_BLOCK_PAYLOAD_SIZE as u64) as usize;
|
||||
let space_in_block = CARRIER_BLOCK_PAYLOAD_SIZE - offset_in_block;
|
||||
let to_write = src.len().min(space_in_block);
|
||||
|
||||
let block_data = self.ensure_block_loaded(block_idx)?;
|
||||
|
||||
if block_data.len() < offset_in_block {
|
||||
block_data.resize(offset_in_block, 0);
|
||||
}
|
||||
if block_data.len() < offset_in_block + to_write {
|
||||
block_data.resize(offset_in_block + to_write, 0);
|
||||
}
|
||||
|
||||
block_data[offset_in_block..offset_in_block + to_write]
|
||||
.copy_from_slice(&src[..to_write]);
|
||||
|
||||
if let Some((_, _, ref mut dirty)) = self.cached_block {
|
||||
*dirty = true;
|
||||
}
|
||||
|
||||
self.cursor += to_write as u64;
|
||||
if self.cursor > self.file_size {
|
||||
self.file_size = self.cursor;
|
||||
}
|
||||
|
||||
if self
|
||||
.cached_block
|
||||
.as_ref()
|
||||
.map(|(_, d, _)| d.len() >= CARRIER_BLOCK_PAYLOAD_SIZE)
|
||||
.unwrap_or(false)
|
||||
{
|
||||
self.flush_cached_block()?;
|
||||
}
|
||||
|
||||
src = &src[to_write..];
|
||||
}
|
||||
|
||||
Ok(())
|
||||
})
|
||||
}
|
||||
|
||||
fn write_buf(&mut self, mut buf: Box<dyn Buf + Send>) -> FsFuture<'_, ()> {
|
||||
let bytes = buf.copy_to_bytes(buf.remaining());
|
||||
self.write_bytes(bytes)
|
||||
}
|
||||
|
||||
fn seek(&mut self, pos: SeekFrom) -> FsFuture<'_, u64> {
|
||||
self.touch();
|
||||
Box::pin(async move {
|
||||
let new_cursor = match pos {
|
||||
SeekFrom::Start(offset) => offset as i64,
|
||||
SeekFrom::End(offset) => self.file_size as i64 + offset,
|
||||
SeekFrom::Current(offset) => self.cursor as i64 + offset,
|
||||
};
|
||||
|
||||
if new_cursor < 0 {
|
||||
return Err(FsError::GeneralFailure);
|
||||
}
|
||||
|
||||
self.cursor = new_cursor as u64;
|
||||
Ok(self.cursor)
|
||||
})
|
||||
}
|
||||
|
||||
fn flush(&mut self) -> FsFuture<'_, ()> {
|
||||
self.touch();
|
||||
Box::pin(async move {
|
||||
self.flush_cached_block()?;
|
||||
let now = SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.map(|d| d.as_secs())
|
||||
.unwrap_or(0);
|
||||
|
||||
let mut inner = self.inner_fs.lock().unwrap();
|
||||
if let Some(inode) = inner.manifest.inodes.get_mut(&self.inode_id) {
|
||||
inode.size = self.file_size;
|
||||
inode.blocks = self.blocks.clone();
|
||||
inode.modified_at = now;
|
||||
}
|
||||
|
||||
inner
|
||||
.save_manifest()
|
||||
.map_err(|_| FsError::GeneralFailure)?;
|
||||
|
||||
self.meta.size = self.file_size;
|
||||
self.meta.modified_at = UNIX_EPOCH + Duration::from_secs(now);
|
||||
Ok(())
|
||||
})
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user