Merge lp:~tyhicks/ecryptfs/reject-empty-passphrases into lp:ecryptfs

[Tyler Hicks]

While testing the read-v1-wrapped-passphrase-regression branch, I discovered that ecryptfs_wrap_passphrase() and generate_passphrase_sig() will accept zero-length strings as passphrases. I feel like there is no valid use case for using an empty string and that a minimum should be put in place in order to catch errors.

This patch imposes a minimum of 1 valid character in order to be considered a valid passphrase. A higher minimum would be more ideal but this is the first step in catching empty passphrases being incorrectly used.

=== modified file 'debian/changelog'
--- debian/changelog	2015-03-25 15:42:30 +0000
+++ debian/changelog	2015-03-25 17:27:05 +0000
@@ -7,15 +7,30 @@
   * debian/control:
     - build depend on distro-info, which we use in our release script
 
-  [ Tyler Hicks ]
-  * src/libecryptfs/key_management.c:
-    - Fix a regression when reading version 1 wrapped passphrase files. A
-      return code indicating success was always returned even when an error
-      was encountered. The impact is low since the error situation is still
-      caught when validating either the wrapping password's signature or the
-      wrapped passphrase's signature. Thanks to László Böszörményi for
-      catching this mistake.
-
+<<<<<<< TREE
+  [ Tyler Hicks ]
+  * src/libecryptfs/key_management.c:
+    - Fix a regression when reading version 1 wrapped passphrase files. A
+      return code indicating success was always returned even when an error
+      was encountered. The impact is low since the error situation is still
+      caught when validating either the wrapping password's signature or the
+      wrapped passphrase's signature. Thanks to László Böszörményi for
+      catching this mistake.
+
+=======
+  [ Tyler Hicks ]
+  * src/libecryptfs/key_management.c:
+    - Fix a regression when reading version 1 wrapped passphrase files. A
+      return code indicating success was always returned even when an error
+      was encountered. The impact is low since the error situation is still
+      caught when validating either the wrapping password's signature or the
+      wrapped passphrase's signature. Thanks to László Böszörményi for
+      catching this mistake.
+    - Reject empty passphrases passed into ecryptfs_wrap_passphrase()
+  * src/libecryptfs/main.c:
+    - Reject empty wrapping passphrases passed into generate_passphrase_sig()
+
+>>>>>>> MERGE-SOURCE
  -- Dustin Kirkland <[e-mail]>  Wed, 11 Mar 2015 18:39:43 -0500
 
 ecryptfs-utils (106) utopic; urgency=medium

=== modified file 'src/libecryptfs/key_management.c'
--- src/libecryptfs/key_management.c	2015-03-25 15:42:30 +0000
+++ src/libecryptfs/key_management.c	2015-03-25 17:27:05 +0000
@@ -587,9 +587,9 @@
 	int rc;
 
 	decrypted_passphrase_bytes = strlen(decrypted_passphrase);
-	if (decrypted_passphrase_bytes > ECRYPTFS_MAX_PASSPHRASE_BYTES) {
-		syslog(LOG_ERR, "Decrypted passphrase is [%d] bytes long; "
-		       "[%d] is the max\n", decrypted_passphrase_bytes,
+	if (decrypted_passphrase_bytes < 1 ||
+	    decrypted_passphrase_bytes > ECRYPTFS_MAX_PASSPHRASE_BYTES) {
+		syslog(LOG_ERR, "Decrypted passphrase size is invalid; [1] to [%d] is the valid range\n",
 		       ECRYPTFS_MAX_PASSPHRASE_BYTES);
 		rc = -EIO;
 		goto out;

=== modified file 'src/libecryptfs/main.c'
--- src/libecryptfs/main.c	2013-10-25 19:45:09 +0000
+++ src/libecryptfs/main.c	2015-03-25 17:27:05 +0000
@@ -224,10 +224,11 @@
 	int rc = 0;
 
 	passphrase_size = strlen(passphrase);
-	if (passphrase_size > ECRYPTFS_MAX_PASSPHRASE_BYTES) {
+	if (passphrase_size < 1 ||
+	    passphrase_size > ECRYPTFS_MAX_PASSPHRASE_BYTES) {
 		passphrase_sig = NULL;
-		syslog(LOG_ERR, "Passphrase too large (%d bytes)\n",
-		       passphrase_size);
+		syslog(LOG_ERR, "Passphrase size is invalid; [1] to [%d] is the valid range\n",
+		       ECRYPTFS_MAX_PASSPHRASE_BYTES);
 		return -EINVAL;
 	}
 	memcpy(salt_and_passphrase, salt, ECRYPTFS_SALT_SIZE);

=== modified file 'tests/userspace/wrap-unwrap/test.c'
--- tests/userspace/wrap-unwrap/test.c	2013-10-27 16:52:03 +0000
+++ tests/userspace/wrap-unwrap/test.c	2015-03-25 17:27:05 +0000
@@ -106,6 +106,21 @@
 		rc = 1;
 		goto out;
 	}
+
+	/* Ensure that an empty passphrase is rejected */
+	if ((rc = ecryptfs_wrap_passphrase(path, "testwrappw", salt, "")) == 0) {
+		fprintf(stderr, "ecryptfs_wrap_passphrase() wrapped an empty passphrase\n");
+		rc = 1;
+		goto out;
+	}
+
+	/* Ensure that an empty wrapping passphrase is rejected */
+	if ((rc = ecryptfs_wrap_passphrase(path, "", salt, "testpassphrase")) == 0) {
+		fprintf(stderr, "ecryptfs_wrap_passphrase() used an empty wrapping passphrase\n");
+		rc = 1;
+		goto out;
+	}
+
 	rc = 0;
 out:
 	return rc;