Commit Graph

1622 Commits

Author SHA1 Message Date
Milan Broz
4faa9e9f45 Swtich default integritysetup crc32 alg to crc32c (that is hw accelerated in recent Intel CPUs). 2017-07-27 14:26:41 +02:00
Milan Broz
4bcba41d77 Fix crypt_init(cd, NULL) case in the previous commit. 2017-07-27 13:36:53 +02:00
Milan Broz
12040570ca Allow to open device without read check.
In some specific situation we do not want to read the devices
before initialization.

Here it is integrity checking that will produce warning, because
the device is not yet initialized.

Used only in wipe function (here we must use direct-io anyway)
and expect the device is capable of direct-io.
2017-07-27 12:56:07 +02:00
Milan Broz
5824e8d242 Simplify device block size check. 2017-07-26 14:53:37 +02:00
Milan Broz
d7a0d860b9 Use getvfs for block size of filesytem if available. 2017-07-26 14:32:21 +02:00
Milan Broz
dbdb611bcc Document crypt_params_integrity struct members. 2017-07-26 13:21:19 +02:00
Michal Virgovic
3b3e14d056 Update doxygen documentation for version 1.8. 2017-07-26 12:51:17 +02:00
Milan Broz
962bf58f8f Print error message if device exists but as other subsystem. 2017-07-26 12:42:58 +02:00
Milan Broz
6f2ff93519 Do not repeat password question if underlying function returns EINVAL.
This error code means invalid value, no point in repeating the whole sequence.
(If there is a situation that requires repeat, it should not return EINVAL.)
2017-07-26 10:44:42 +02:00
Milan Broz
e853aa2e7c Fix blockwise access functions for systems with big page size.
Initially cryptsetup expected underlying device that was, by definition,
always aligned to a sector size (and length was always multiple of sectors).

For the images in file, we can now access the image directly.
Expecting that the image is always aligned to the whole block is now false
(the last block in file image can be incomplete).

Moreover, we cannot easily detect underlying block device sector (block) size
(the storage stack can be complex with various RAID and loop block sizes),
so code uses systyem PAGE_SIZE in this situation (should be the safest way).

Unfortunately, PAGE_SIZE can be bigger (1MB) than device sector (4k) and
the blockwise functions then fails because the image in file is not
aligned to PAGE_SIZE multiple..

Fix it by checking that read/write for the last part of an image is
the exact requested size and not a full block.

(The problem is for example for an unaligned hidden Truecrypt header
on PPC64LE systems, where page size is 64k.)
2017-07-24 14:17:21 +02:00
Milan Broz
248e35036f Do not fail if wipe size is smaller than block size.
With big page size and image in file this can actually happen.

The command works in this situation but the code will be quite
ineffective (due to blockwise handling).
2017-07-24 14:15:42 +02:00
Ingo Franzki
96f1cdf687 Typo in man page
I guess this should be 'existing' not 'exiting'.

Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
2017-07-20 09:42:41 +02:00
Michal Virgovic
d483b6d25c Add nonroot tests for travis. 2017-07-19 11:59:24 +02:00
Milan Broz
293fa48884 Run part of test as non root user. 2017-07-19 11:57:55 +02:00
Michal Virgovic
45bd005be9 Enable python tests in travis. 2017-07-14 17:31:49 +02:00
Michal Virgovic
efe88d4979 Add tests for FEC area overlap detection. 2017-07-11 18:16:15 +02:00
Michal Virgovic
913c9aa3d3 FEC-area overlap detection. 2017-07-11 17:36:47 +02:00
Michal Virgovic
a36c53af99 Correction of integritysetup manual. 2017-07-11 11:54:58 +02:00
Michal Virgovic
8ff808c882 Update of integritysetup manual and typos correction.
[Heavily modified by mbroz]
2017-07-03 16:49:41 +02:00
Milan Broz
9ade110a25 Fix typo in tests. 2017-06-29 15:55:35 +02:00
Ondrej Kozina
2b3be9055a Disable conversion for legacy luks1 formats.
And export LUKS header size functions.
2017-06-29 15:50:42 +02:00
Ondrej Kozina
10bb186c76 lib: harden checks for null name in resume/suspend 2017-06-29 15:45:51 +02:00
Milan Broz
198f1d10c4 Point pdf links to kernel.org.
Some browsers seems to be already smarter than a 5th grader
and blocks the content on gitlab.
2017-06-29 12:19:32 +02:00
Milan Broz
5be69e92ce Check for interruption during passphrase retry. 2017-06-28 15:11:28 +02:00
Milan Broz
c80acbe4c8 Add back "Passphrase for (dev):" prompt. 2017-06-28 15:07:58 +02:00
Milan Broz
29681c0aa7 Fix access to devices under non-root user.
We cannot allocate loop device early in luksFormat,
use only device access check here.
2017-06-28 14:24:39 +02:00
Milan Broz
fdd6794ce3 Add some sleep to interactive prompt test.
Seems some distros use broken expect package.
2017-06-27 16:25:11 +02:00
Milan Broz
6c7e9608b9 Fix travis install line. 2017-06-27 15:53:41 +02:00
Milan Broz
5171f65c05 Return back password retry support for luksOpen.
Also add interactive test using expect utility.
2017-06-27 15:49:04 +02:00
Milan Broz
86f327d0f5 Add dmsetup remove retry to api test. 2017-06-27 14:14:20 +02:00
Milan Broz
b16fbde032 Add DM_UDEV_DISABLE_LIBRARY_FALLBACK to libdevmapper wrapper.
This call is required for deferred removal of device.

Morever, if the system reports that udev is running, we should not
try to "fix" problems by creating or removing nodes directly through libdevmapper.

(Non-udev case should still work.)
2017-06-27 09:12:05 +02:00
Milan Broz
9437035147 Use open/close syntax for veritysetup.
(but support create/remove aliases)
2017-06-26 15:31:47 +02:00
Milan Broz
f24fb2899e Use open/close syntax for integritysetup.
(but support create/remove aliases)
2017-06-26 15:24:58 +02:00
Milan Broz
19c5248675 Fix deferred test for old libdevmapper (deferred not compiled-in). 2017-06-24 20:05:26 +02:00
Milan Broz
2c3e0aee08 And check libdevmapper support for deferred flag as well. 2017-06-24 19:37:28 +02:00
Milan Broz
552e9c8408 Check DM support for deferred flag.
So it fails correctly on older systems.
2017-06-24 19:07:14 +02:00
Milan Broz
164bbdfcfc Add test for deferred removal.
Print more info in CLI command.
2017-06-24 10:32:48 +02:00
Milan Broz
3efa00d59a Revert deferred flag for keyslots and temp devices.
It could cause races later, replacing with error device is enough.
2017-06-24 09:57:22 +02:00
Milan Broz
ea694a4588 Fix force removal option. 2017-06-23 15:42:46 +02:00
Milan Broz
32d5e59ab6 Implement deferred removal of device.
This can be used in some automated systems and allows device
to be removed after the last user mapping closes it.
2017-06-23 14:41:54 +02:00
Milan Broz
a58ed1ada3 Better specify error codes from crypt_wipe. 2017-06-22 13:32:05 +02:00
Milan Broz
c80dbb2210 Fxi luksKill slot to work in batch mode in non-tty environment.
If there is no TTY on stdin (like nohup or service) then
batch mode should not fail to kill slot.

For more info see Issue#329.
2017-06-21 13:31:08 +02:00
Milan Broz
ce1e5374b9 Fix API tracker URL. 2017-06-18 09:00:11 +02:00
Ondrej Kozina
c4fa881303 luks1: cleanup for added checks
related to bef56af730
2017-06-16 11:09:41 +02:00
Milan Broz
d02b291e2f Remove TODO line. 2017-06-15 13:57:27 +02:00
Milan Broz
4d21f4673d Add Travis configuration file for automated testing. 2017-06-15 13:46:36 +02:00
Ondrej Kozina
6682e6b663 tests: add test for overlaping keyslots in luks1 image 2017-06-15 11:17:36 +02:00
Ondrej Kozina
bef56af730 luks1: harden checks for possibly corrupted headers
this patches improves two areas:

1) it checks for keyslot areas overlaping each other
2) it checks if all keyslot areas fit in header area of device
   (pre-data-offset area) or if it can fit file (detached header)
   it's being loaded from. Those new checks are based on real data
   found in header (offsets) rather than based on assumption calculated
   from key length
2017-06-15 11:17:28 +02:00
Milan Broz
c7de6939ae Fix ioctl argument for block size check. 2017-06-09 10:33:57 +02:00
Milan Broz
2059266a24 Never decrease device block size (for example after attaching loop device). 2017-06-08 16:22:53 +02:00