[PATCH] ecryptfs: improved dependency checking and reporting

[PATCH] ecryptfs: improved dependency checking and reporting

[Dave Hansen]

So, I compiled a 2.6.31-rc5 kernel with ecryptfs and loaded its module.
When it came time to mount my filesystem, I got this in dmesg, and it
refused to mount:

[93577.776637] Unable to allocate crypto cipher with name [aes]; rc = [-2]
[93577.783280] Error attempting to initialize key TFM cipher with name = [aes]; rc = [-2]
[93577.791183] Error attempting to initialize cipher with name = [aes] and key size = [32]; rc = [-2]
[93577.800113] Error parsing options; rc = [-22]

I figured from the error message that I'd either forgotten to load "aes"
or that my key size was bogus.  Neither one of those was the case.  In
fact, I was missing the CRYPTO_ECB config option and the 'ecb' module.
Unfortunately, there's no trace of 'ecb' in that error message.

I've done two things to fix this.  First, I've modified ecryptfs's
Kconfig entry to select CRYPTO_ECB and CRYPTO_CBC.  I also took CRYPTO
out of the dependencies since the 'select' will take care of it for us.

I've also modified the error messages to print a string that should
contain both 'ecb' and 'aes' in my error case.  That will give any
future users a chance of finding the right modules and Kconfig options.

I also wonder if we should:

	select CRYPTO_AES if !EMBEDDED

since I think most ecryptfs users are using AES like me.

Signed-off-by: Dave Hansen <dave@linux.vnet.ibm.com>

diff --git a/fs/ecryptfs/Kconfig b/fs/ecryptfs/Kconfig
index 0c754e6..29c7f97 100644
--- a/fs/ecryptfs/Kconfig
+++ b/fs/ecryptfs/Kconfig
@@ -1,6 +1,8 @@
 config ECRYPT_FS
 	tristate "eCrypt filesystem layer support (EXPERIMENTAL)"
-	depends on EXPERIMENTAL && KEYS && CRYPTO && NET
+	depends on EXPERIMENTAL && KEYS && NET
+	select CRYPTO_ECB
+	select CRYPTO_CBC
 	help
 	  Encrypted filesystem that operates on the VFS layer.  See
 	  <file:Documentation/filesystems/ecryptfs.txt> to learn more about
@@ -9,3 +11,4 @@ config ECRYPT_FS
 
 	  To compile this file system support as a module, choose M here: the
 	  module will be called ecryptfs.
+
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index b91851f..5cda73d 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -1763,7 +1763,7 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
 	if (IS_ERR(*key_tfm)) {
 		rc = PTR_ERR(*key_tfm);
 		printk(KERN_ERR "Unable to allocate crypto cipher with name "
-		       "[%s]; rc = [%d]\n", cipher_name, rc);
+		       "[%s]; rc = [%d]\n", full_alg_name, rc);
 		goto out;
 	}
 	crypto_blkcipher_set_flags(*key_tfm, CRYPTO_TFM_REQ_WEAK_KEY);
@@ -1776,7 +1776,7 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
 	rc = crypto_blkcipher_setkey(*key_tfm, dummy_key, *key_size);
 	if (rc) {
 		printk(KERN_ERR "Error attempting to set key of size [%zd] for "
-		       "cipher [%s]; rc = [%d]\n", *key_size, cipher_name, rc);
+		       "cipher [%s]; rc = [%d]\n", *key_size, full_alg_name, rc);
 		rc = -EINVAL;
 		goto out;
 	}


-- 


-- Dave

Re: [PATCH] ecryptfs: improved dependency checking and reporting

[Tyler Hicks]

On 08/27/2009 11:47 AM, Dave Hansen wrote:
> So, I compiled a 2.6.31-rc5 kernel with ecryptfs and loaded its module.
> When it came time to mount my filesystem, I got this in dmesg, and it
> refused to mount:
> 
> [93577.776637] Unable to allocate crypto cipher with name [aes]; rc = [-2]
> [93577.783280] Error attempting to initialize key TFM cipher with name = [aes]; rc = [-2]
> [93577.791183] Error attempting to initialize cipher with name = [aes] and key size = [32]; rc = [-2]
> [93577.800113] Error parsing options; rc = [-22]
> 
> I figured from the error message that I'd either forgotten to load "aes"
> or that my key size was bogus.  Neither one of those was the case.  In
> fact, I was missing the CRYPTO_ECB config option and the 'ecb' module.
> Unfortunately, there's no trace of 'ecb' in that error message.
> 
> I've done two things to fix this.  First, I've modified ecryptfs's
> Kconfig entry to select CRYPTO_ECB and CRYPTO_CBC.  I also took CRYPTO
> out of the dependencies since the 'select' will take care of it for us.
> 
> I've also modified the error messages to print a string that should
> contain both 'ecb' and 'aes' in my error case.  That will give any
> future users a chance of finding the right modules and Kconfig options.
> 
> I also wonder if we should:
> 
> 	select CRYPTO_AES if !EMBEDDED
> 
> since I think most ecryptfs users are using AES like me.

I think this is a good idea, especially since our default is aes-128.
eCryptfs without a cipher available isn't very useful. :)  If you don't
beat me to it, I'll throw this change in over the next few days with
some other fixes that are coming down the pipe.

> 
> Signed-off-by: Dave Hansen <dave@linux.vnet.ibm.com>

Thanks for the patch!  Pushed to the eCryptfs next branch:
http://git.kernel.org/?p=linux/kernel/git/ecryptfs/ecryptfs-2.6.git;a=commit;h=55deb64a779567cc0ef4fcb8cd2be8923350af33

> 
> diff --git a/fs/ecryptfs/Kconfig b/fs/ecryptfs/Kconfig
> index 0c754e6..29c7f97 100644
> --- a/fs/ecryptfs/Kconfig
> +++ b/fs/ecryptfs/Kconfig
> @@ -1,6 +1,8 @@
>  config ECRYPT_FS
>  	tristate "eCrypt filesystem layer support (EXPERIMENTAL)"
> -	depends on EXPERIMENTAL && KEYS && CRYPTO && NET
> +	depends on EXPERIMENTAL && KEYS && NET
> +	select CRYPTO_ECB
> +	select CRYPTO_CBC
>  	help
>  	  Encrypted filesystem that operates on the VFS layer.  See
>  	  <file:Documentation/filesystems/ecryptfs.txt> to learn more about
> @@ -9,3 +11,4 @@ config ECRYPT_FS
> 
>  	  To compile this file system support as a module, choose M here: the
>  	  module will be called ecryptfs.
> +
> diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
> index b91851f..5cda73d 100644
> --- a/fs/ecryptfs/crypto.c
> +++ b/fs/ecryptfs/crypto.c
> @@ -1763,7 +1763,7 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
>  	if (IS_ERR(*key_tfm)) {
>  		rc = PTR_ERR(*key_tfm);
>  		printk(KERN_ERR "Unable to allocate crypto cipher with name "
> -		       "[%s]; rc = [%d]\n", cipher_name, rc);
> +		       "[%s]; rc = [%d]\n", full_alg_name, rc);
>  		goto out;
>  	}
>  	crypto_blkcipher_set_flags(*key_tfm, CRYPTO_TFM_REQ_WEAK_KEY);
> @@ -1776,7 +1776,7 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
>  	rc = crypto_blkcipher_setkey(*key_tfm, dummy_key, *key_size);
>  	if (rc) {
>  		printk(KERN_ERR "Error attempting to set key of size [%zd] for "
> -		       "cipher [%s]; rc = [%d]\n", *key_size, cipher_name, rc);
> +		       "cipher [%s]; rc = [%d]\n", *key_size, full_alg_name, rc);
>  		rc = -EINVAL;
>  		goto out;
>  	}
> 
>