Is "encfsctl cat" broken ?

[benrubson]

Hi,

I can't manage to make encfsctl cat work.

If I make :
encfsctl cat /encfs/root/dir foo
I get :
ERROR decode err: Filename too small to decode
unable to open foo

If I make :
encfsctl cat /encfs/root/dir qsSJgvkgIoFIDPS5RxbBcC3r
I get :
unable to open qsSJgvkgIoFIDPS5RxbBcC3r

Anything broken ?

Thank you 👍

[benrubson]

Taking code back from commit b28b979 make things work again. Strange !

[mouse07410]

Looking over (very briefly!) the offending commit - I'd revert it, as the benefits it provides appear to be small and not worth the headaches like the one described in this issue.

Having said that - I'm running the current Github master, and it does not seem to have encfsctl cat support at all. ???

[benrubson]

Strange, what does it return for you ?

[mouse07410]

Hmm... encfsctl does not seem to support [--]help, and its manual page doesn't mention cat at all. However when I actually tried it with parameters, I started getting something:

$ ll /opt/local/bin/encfsctl
-rwxr-xr-x  1 root  admin  795684 Mar 11 14:09 /opt/local/bin/encfsctl*
$ encfsctl cat ~/encfs-raw/
.encfs6.xml      sHk7g9vMMscCpg8  udw9KxyHISrk2v9 
$ encfsctl cat ~/encfs-raw udw9KxyHISrk2v9 
EncFS Password: 
unable to open udw9KxyHISrk2v9
$ $ encfs ~/encfs-raw/ ~/encfs-crypt/
EncFS Password: 
$ ll ~/encfs-crypt/
total 24
drwx------@   5 uri  staff    160 Mar 26  2017 ./
drwxr-xr-x+ 459 uri  staff  14688 Mar 13 11:18 ../
-rw-r--r--    1 uri  staff     11 Aug 27  2016 test1.txt
-rw-r--r--    1 uri  staff     12 Mar 26  2017 test2.txt
$ encfsctl cat ~/encfs-raw test1.txt
EncFS Password: 
2018-03-13 14:07:25,918 ERROR decode err: checksum mismatch in filename decode
unable to open test1.txt
$ encfs -u ~/encfs-crypt
Filesystem unmounting: /Users/uri/encfs-crypt/
$ encfsctl cat ~/encfs-raw sHk7g9vMMscCpg8
EncFS Password: 
unable to open sHk7g9vMMscCpg8
$

Let's revert that offending commit.

[mouse07410]

Oops, not so fast:

$ git revert b28b979
error: could not revert b28b979... fix encfsctl cat when iv chaining is enabled. Fixes issue #132
hint: after resolving the conflicts, mark the corrected paths
hint: with 'git add <paths>' or 'git rm <paths>'
hint: and commit the result with 'git commit'

$ encfsctl -v cat ~/encfs-raw sHk7g9vMMscCpg8
2018-03-13 14:15:08,971 VERBOSE skipping arg -v
2018-03-13 14:15:08,972 VERBOSE found new serialization format
2018-03-13 14:15:08,972 VERBOSE subVersion = 20100713
2018-03-13 14:15:08,972 VERBOSE checking if ssl/aes(3:0:2) implements ssl/aes(3:0)
2018-03-13 14:15:08,972 VERBOSE allocated cipher ssl/aes, keySize 24, ivlength 16
2018-03-13 14:15:08,972 VERBOSE useStdin: 0
EncFS Password: 
2018-03-13 14:15:11,963 VERBOSE checking if ssl/aes(3:0:2) implements ssl/aes(3:0)
2018-03-13 14:15:11,963 VERBOSE allocated cipher ssl/aes, keySize 24, ivlength 16
2018-03-13 14:15:12,550 VERBOSE cipher key size = 44
2018-03-13 14:15:12,550 VERBOSE checking if nameio/block(4:0:2) implements nameio/stream(2:1)
2018-03-13 14:15:12,550 VERBOSE checking if nameio/block32(4:0:2) implements nameio/stream(2:1)
2018-03-13 14:15:12,550 VERBOSE checking if nameio/null(1:0:0) implements nameio/stream(2:1)
2018-03-13 14:15:12,550 VERBOSE checking if nameio/stream(2:1:2) implements nameio/stream(2:1)
unable to open sHk7g9vMMscCpg8
$ encfsctl -v cat ~/encfs-raw test1.txt
2018-03-13 14:16:10,870 VERBOSE skipping arg -v
2018-03-13 14:16:10,871 VERBOSE found new serialization format
2018-03-13 14:16:10,871 VERBOSE subVersion = 20100713
2018-03-13 14:16:10,871 VERBOSE checking if ssl/aes(3:0:2) implements ssl/aes(3:0)
2018-03-13 14:16:10,871 VERBOSE allocated cipher ssl/aes, keySize 24, ivlength 16
2018-03-13 14:16:10,871 VERBOSE useStdin: 0
EncFS Password: 
2018-03-13 14:16:12,662 VERBOSE checking if ssl/aes(3:0:2) implements ssl/aes(3:0)
2018-03-13 14:16:12,662 VERBOSE allocated cipher ssl/aes, keySize 24, ivlength 16
2018-03-13 14:16:13,251 VERBOSE cipher key size = 44
2018-03-13 14:16:13,251 VERBOSE checking if nameio/block(4:0:2) implements nameio/stream(2:1)
2018-03-13 14:16:13,251 VERBOSE checking if nameio/block32(4:0:2) implements nameio/stream(2:1)
2018-03-13 14:16:13,251 VERBOSE checking if nameio/null(1:0:0) implements nameio/stream(2:1)
2018-03-13 14:16:13,251 VERBOSE checking if nameio/stream(2:1:2) implements nameio/stream(2:1)
2018-03-13 14:16:13,251 VERBOSE checksum mismatch: expected 47498, got 57968
2018-03-13 14:16:13,251 VERBOSE on decode of 4 bytes
2018-03-13 14:16:13,251 ERROR decode err: checksum mismatch in filename decode
unable to open test1.txt
$ 

[benrubson]

I don't have my working test right here but I think I did :
encfsctl -v cat ~/encfs-raw /test1.txt

[mouse07410]

I seem unable to revert that commit because the internals of EncFS changed. E.g., FileNode() constructor requires five arguments, not four that the replaced code had - one of those being FUSE something (flags? file handler?) - a uint_64 item.

Is there a way to get better debugging output from encfsctl? How/why does the checksum mismatch occur? What file is it trying to open (including complete path)? Etc...

The way I understand the code - your example should not work, because encfsctl cat with DirNode::directLookup() should work only with encrypted file name as a parameter, and not with the plaintext file name...

[benrubson]

You should be able to pass 0 / nullptr as fuse is not involved in this case.

[mouse07410]

Yeah - but it did not work even with the last parameter being 0. Something is broken badly enough there - and without decent debugging output it's darn hard to pinpoint (especially if one doesn't have infinite time on his hands ;).

[benrubson]

Yes you're right, this is even written in the code removed by b28b979 :
open a cipher file directly
So you may have tried :
encfsctl cat ~/encfs-raw /sHk7g9vMMscCpg8

[mouse07410]

That's exactly what I tried - and it failed, as the log above shows.

"cat" command is neither well-documented (actually, I could find no documentation at all), nor well-implemented, AFAICT. I'm surprised you got it working at all.

[benrubson]

I think we need the leading / or full path to the ciper file.

[mouse07410]

I think we need the leading / or full path to the cipher file.

That may be so, but it does not help (and the debugging output doesn't help either - at least it did not help me):

$ encfsctl cat /Users/uri/encfs-raw sHk7g9vMMscCpg8
EncFS Password: 
unable to open sHk7g9vMMscCpg8
$ encfsctl -v cat /Users/uri/encfs-raw sHk7g9vMMscCpg8
2018-03-14 16:09:03,277 VERBOSE skipping arg -v
2018-03-14 16:09:03,277 VERBOSE found new serialization format
2018-03-14 16:09:03,277 VERBOSE subVersion = 20100713
2018-03-14 16:09:03,277 VERBOSE checking if ssl/aes(3:0:2) implements ssl/aes(3:0)
2018-03-14 16:09:03,277 VERBOSE allocated cipher ssl/aes, keySize 24, ivlength 16
2018-03-14 16:09:03,278 VERBOSE useStdin: 0
EncFS Password: 
2018-03-14 16:09:05,246 VERBOSE checking if ssl/aes(3:0:2) implements ssl/aes(3:0)
2018-03-14 16:09:05,246 VERBOSE allocated cipher ssl/aes, keySize 24, ivlength 16
2018-03-14 16:09:06,315 VERBOSE cipher key size = 44
2018-03-14 16:09:06,315 VERBOSE checking if nameio/block(4:0:2) implements nameio/stream(2:1)
2018-03-14 16:09:06,315 VERBOSE checking if nameio/block32(4:0:2) implements nameio/stream(2:1)
2018-03-14 16:09:06,315 VERBOSE checking if nameio/null(1:0:0) implements nameio/stream(2:1)
2018-03-14 16:09:06,315 VERBOSE checking if nameio/stream(2:1:2) implements nameio/stream(2:1)
unable to open sHk7g9vMMscCpg8
$ encfsctl -v cat /Users/uri/encfs-raw /Users/uri/encfs-raw/sHk7g9vMMscCpg8
2018-03-14 16:12:44,485 VERBOSE skipping arg -v
2018-03-14 16:12:44,486 VERBOSE found new serialization format
2018-03-14 16:12:44,486 VERBOSE subVersion = 20100713
2018-03-14 16:12:44,486 VERBOSE checking if ssl/aes(3:0:2) implements ssl/aes(3:0)
2018-03-14 16:12:44,486 VERBOSE allocated cipher ssl/aes, keySize 24, ivlength 16
2018-03-14 16:12:44,486 VERBOSE useStdin: 0
EncFS Password: 
2018-03-14 16:12:45,949 VERBOSE checking if ssl/aes(3:0:2) implements ssl/aes(3:0)
2018-03-14 16:12:45,949 VERBOSE allocated cipher ssl/aes, keySize 24, ivlength 16
2018-03-14 16:12:46,641 VERBOSE cipher key size = 44
2018-03-14 16:12:46,642 VERBOSE checking if nameio/block(4:0:2) implements nameio/stream(2:1)
2018-03-14 16:12:46,642 VERBOSE checking if nameio/block32(4:0:2) implements nameio/stream(2:1)
2018-03-14 16:12:46,642 VERBOSE checking if nameio/null(1:0:0) implements nameio/stream(2:1)
2018-03-14 16:12:46,642 VERBOSE checking if nameio/stream(2:1:2) implements nameio/stream(2:1)
2018-03-14 16:12:46,642 VERBOSE checksum mismatch: expected 8366, got 27573
2018-03-14 16:12:46,642 VERBOSE on decode of 1 bytes
2018-03-14 16:12:46,642 ERROR decode err: checksum mismatch in filename decode
unable to open /Users/uri/encfs-raw/sHk7g9vMMscCpg8
$