eCryptfs: Filename encryption only supports password auth tokens

commit df6ad33ba1b9846bd5f0e2b9016c30c20bc2d948 upstream.

Returns -ENOTSUPP when attempting to use filename encryption with
something other than a password authentication token, such as a private
token from openssl.  Using filename encryption with a userspace eCryptfs
key module is a future goal.  Until then, this patch handles the
situation a little better than simply using a BUG_ON().

Acked-by: Serge Hallyn <serue@us.ibm.com>
Cc: ecryptfs-devel@lists.launchpad.net
Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index 274214098db2007e3409dd2967616e997e03a0b7..f0b53dfcccfca8ff5d2ff0c8cfdb40f8814cf836 100644 (file)
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -1703,7 +1703,7 @@ ecryptfs_encrypt_filename(struct ecryptfs_filename *filename,
        } else {
                printk(KERN_ERR "%s: No support for requested filename "
                       "encryption method in this release\n", __func__);
-               rc = -ENOTSUPP;
+               rc = -EOPNOTSUPP;
                goto out;
        }
 out:
@@ -2167,7 +2167,7 @@ int ecryptfs_encrypt_and_encode_filename(
                        (*encoded_name)[(*encoded_name_size)] = '\0';
                        (*encoded_name_size)++;
                } else {
-                       rc = -ENOTSUPP;
+                       rc = -EOPNOTSUPP;
                }
                if (rc) {
                        printk(KERN_ERR "%s: Error attempting to encode "

diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 194d801d8d8cb467c4c00bf6ac3ea4b3286a3f8c..9fbc9a1d6a90983f513de784a5360b04f11d5a79 100644 (file)
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -612,7 +612,12 @@ ecryptfs_write_tag_70_packet(char *dest, size_t *remaining_bytes,
        }
        /* TODO: Support other key modules than passphrase for
         * filename encryption */
-       BUG_ON(s->auth_tok->token_type != ECRYPTFS_PASSWORD);
+       if (s->auth_tok->token_type != ECRYPTFS_PASSWORD) {
+               rc = -EOPNOTSUPP;
+               printk(KERN_INFO "%s: Filename encryption only supports "
+                      "password tokens\n", __func__);
+               goto out_free_unlock;
+       }
        sg_init_one(
                &s->hash_sg,
                (u8 *)s->auth_tok->token.password.session_key_encryption_key,
@@ -910,7 +915,12 @@ ecryptfs_parse_tag_70_packet(char **filename, size_t *filename_size,
        }
        /* TODO: Support other key modules than passphrase for
         * filename encryption */
-       BUG_ON(s->auth_tok->token_type != ECRYPTFS_PASSWORD);
+       if (s->auth_tok->token_type != ECRYPTFS_PASSWORD) {
+               rc = -EOPNOTSUPP;
+               printk(KERN_INFO "%s: Filename encryption only supports "
+                      "password tokens\n", __func__);
+               goto out_free_unlock;
+       }
        rc = crypto_blkcipher_setkey(
                s->desc.tfm,
                s->auth_tok->token.password.session_key_encryption_key,