Whamcloud - gitweb
LU-13717 sec: handle null algo for filename encryption 88/43388/6
authorSebastien Buisson <sbuisson@ddn.com>
Thu, 25 Mar 2021 16:55:35 +0000 (17:55 +0100)
committerOleg Drokin <green@whamcloud.com>
Tue, 27 Jul 2021 21:37:01 +0000 (21:37 +0000)
commitf18c87cb5362496a4baadaa14265471c992ca06a
tree962343f30e99b39bf34ca9bd22d16755842121e4
parent87c4535f7a5d239aad4e936545a72d0199ccd9ba
LU-13717 sec: handle null algo for filename encryption

Encrypted files created with Lustre 2.14 have clear text file names.
With new code implementing filename encryption, newly created files
will have cipher text names, unless they are in an encrypted directory
created in Lustre 2.14.

So we need to make sure llcrypt library can properly handle the "null"
algorithm for client side filename encryption, which is basically a
no-op.
Handling this "null" algo for filename encryption will not be possible
with the in-kernel fscrypt library, so modify the behaviour of
configure to build with embedded llcrypt by default, and only build
against in-kernel fscrypt if explicitly specified via
--enable-crypto=in-kernel configure option.

The objective is to urge users to convert their encrypted directories
to the new fashion that encrypts filenames.
However, with the new code some operations on encrypted files created
with 2.14 might not be possible, like migrate, so expressly forbid
migrate on files that use the "null" algorithm for client side
filename encryption.

Finally, we revert commit 11fcbfa9de4a5170abc2c5df2a6e4e02f0f84268
("LU-12275 sec: force file name encryption policy to null") so that
new encrypted directories will enforce filename encryption.

Signed-off-by: Sebastien Buisson <sbuisson@ddn.com>
Change-Id: I393945adc9b720a56544b5da0669cb2848507457
Reviewed-on: https://review.whamcloud.com/43388
Reviewed-by: James Simmons <jsimmons@infradead.org>
Reviewed-by: Patrick Farrell <pfarrell@whamcloud.com>
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: Oleg Drokin <green@whamcloud.com>
libcfs/include/libcfs/crypto/llcrypt.h
libcfs/libcfs/crypto/fname.c
libcfs/libcfs/crypto/hooks.c
libcfs/libcfs/crypto/keysetup.c
libcfs/libcfs/crypto/policy.c
lustre/autoconf/lustre-core.m4
lustre/include/lustre_crypto.h
lustre/llite/file.c