eessppeelllloo/cryptsetup
1
0
Fork 0
mirror of https://gitlab.com/cryptsetup/cryptsetup.git synced 2025-12-12 19:30:04 +01:00
Code Issues Packages Projects Releases Wiki Activity
2,050 Commits 13 Branches 79 Tags
4acac9a294c1cb15d08b061231d95b03927b56b0
Commit Graph

2050 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Ondrej Kozina
4acac9a294 Properly handle DM_LINEAR type while checking version or dmflags. 2019-03-01 20:28:43 +01:00
Ondrej Kozina
4adb06ae91 Add missing direction flag in dm_crypt_target_set. 
This bug may have caused memory corruption in dm_targets_free
later.
 2019-03-01 20:27:53 +01:00
Milan Broz
dce7a1e2aa Fix gcc warning in tests. 2019-02-24 12:35:54 +01:00
Milan Broz
a354b72546 Add some symmetric block ciphers vector tests for crypto backend. 2019-02-24 12:35:50 +01:00
Milan Broz
ac8f41404b Simplify and reformat hash/HMAC test vectors test. 2019-02-24 12:35:45 +01:00
Milan Broz
fc7b257bab Silence dmsetup removal messages. 2019-02-13 13:34:39 +01:00
Milan Broz
787066c292 Report error if no LUKS keyslots are available. 
Also fix LUKS1 keyslot function to proper return -ENOENT errno in this case.

This change means, that user can distinguish between bad passphrase and
no keyslot available. (But this information was avalilable with luksDump
even before the change.)
 2019-02-13 13:19:48 +01:00
Milan Broz
71ab6cb818 Fix other tests to not fail if keyring support is missing in kernel. 2019-02-12 16:16:56 +01:00
Milan Broz
1158ba453e Use better test for a bad loop descriptor. 2019-02-12 14:54:56 +01:00
Milan Broz
2e3f764272 Fix api-test-2 to properly detect missing keyring in kernel. 
Also properly cleanup after some failures.
 2019-02-12 14:49:21 +01:00
Milan Broz
2172f1d2cd Print PBKDF debug log in a better format. 
Fixes #439.
 2019-02-11 12:37:33 +01:00
Milan Broz
6efc1eae9f Update Readme.md. 2019-02-08 15:37:17 +01:00
Milan Broz
6a740033de Add 2.1. release notes. v2.1.0 2019-02-08 15:08:04 +01:00
Ondrej Kozina
d754598143 Preserve LUKS2 mdata & keyslots sizes after reencryption. 2019-02-08 12:00:24 +01:00
Ondrej Kozina
47f632263e Add missing crypt_free() in api test. 2019-02-08 11:56:52 +01:00
Milan Broz
98af0b0c77 Increase API version. 2019-02-07 18:42:17 +01:00
Ondrej Kozina
b9c6a62437 Do not call fallocate on image file that is already large enough. 2019-02-07 18:41:06 +01:00
Ondrej Kozina
57670eeeb7 Detect LUKS2 default alignmnet in align tests. 2019-02-07 18:40:48 +01:00
Ondrej Kozina
f26ee11913 Assert reasonable LUKS2 default header size. 2019-02-07 18:40:39 +01:00
Milan Broz
2435d76a39 Use 16MB LUKS2 header size by default. 2019-02-07 18:40:14 +01:00
Milan Broz
348d460ab7 Workarounds for larger LUKS2 header for tests. 2019-02-07 18:39:50 +01:00
Milan Broz
2b8b43b3db Fix file descriptor leak in error path. 2019-02-07 17:37:16 +01:00
Milan Broz
91b74b6896 Fix some compiler warnings. 2019-02-07 17:14:47 +01:00
Milan Broz
319fd19b5e Add implementation of crypt_keyslot_pbkdf(). 
This function allows to get PBKDF parameters per-keyslot.
 2019-02-07 12:55:12 +01:00
Milan Broz
4edd796509 Fix typo. 2019-02-06 21:48:29 +01:00
Ondrej Kozina
b0ced1bd2c Make compat-test2 work with 16M data offset. 2019-02-06 21:43:36 +01:00
Ondrej Kozina
6ed3a7774f Calculate keyslots size based on requested metadata size. 2019-02-06 21:42:51 +01:00
Ondrej Kozina
1ce3feb893 Add format test for detached header using last keyslot. 2019-02-06 21:41:43 +01:00
Milan Broz
ebbc5eceb8 Fix crypt_wipe to allocate space and not silently fail. 
This change will allocate space if underlying device is smaller file
and fail if it is block device.

Previously smaller device was quietly ignored, leading to keyslot
access failure with older dm-crypt mapped keyslot encryption
(disabled kernel user crypto API).
 2019-02-06 21:39:26 +01:00
Ondrej Kozina
0cac4a4e0c Make api test run with any defalt LUKS2 header size. 2019-02-06 11:48:47 +01:00
Milan Broz
1908403324 Prepare change for default LUKS2 keyslot area size. 2019-02-06 11:48:34 +01:00
Ondrej Kozina
faa07b71f9 Fix debug message when zeroing rest of data device. 
The debug message printed wrong expected value and
also remained silent if expected value differed from
real bytes written to the data device.
 2019-02-06 11:48:24 +01:00
Ondrej Kozina
e9dcf6b8dd Simplify create_empty_header in cryptsetup-reencrypt. 
In most cases we do not need to create large files for new headers.
crypt_format already allocates enough space for all keyslots in files
during internal header wipe.

Fixes #410.
 2019-02-06 11:48:07 +01:00
Milan Broz
3ea60ea0ae Update po files. 2019-02-06 11:46:37 +01:00
Milan Broz
54171dfdd3 Fix api-test to detect kernel without needed crypto module for tcrypt test. 2019-01-31 16:32:11 +01:00
Milan Broz
dc8db34155 Run keyring test only for recent kernels. 2019-01-31 16:31:09 +01:00
Milan Broz
a68f3939cf Use min memory limit from PBKDF struct in Argon benchmark. 2019-01-31 10:53:51 +01:00
Milan Broz
ae90497762 Switch to default LUKS2 format in configure. 2019-01-31 09:30:04 +01:00
Rafael Fontenelle
2b55f6420a Fix misspellings 2019-01-28 08:40:20 -02:00
Milan Broz
6d3545624d Fix typo in API documentation. 2019-01-26 12:44:31 +01:00
Milan Broz
46dc5beee9 Increase LUKS keysize if XTS mode is used (two internal keys). 2019-01-25 13:56:21 +01:00
Milan Broz
943cc16020 Fix test to print exit line and use explicit key size. 2019-01-25 13:38:24 +01:00
Milan Broz
a6f5ce8c7b Update copyright year. 
And unify name copyright format.
 2019-01-25 09:45:57 +01:00
Milan Broz
bc3d0feb5c Switch default cryptographic backend to OpenSSL. 
Cryptsetup/libcryptsetup currently supports several cryptographic
library backends.

The fully supported are libgcrypt, OpenSSL and kernel crypto API.

FIPS mode extensions are maintained only for libgcrypt and OpenSSL.

(Nettle and NSS are usable only for some subset of algorithms and
cannot provide full backward compatibility.)

For years, OpenSSL provided better performance for PBKDF.

Since this commit, cryptsetup uses OpenSSL as the default backend.

You can always switch to other backend by using a configure switch,
for libgcrypt (compatibility for older distributions) use:
--with-crypto_backend=gcrypt
 2019-01-25 08:24:10 +01:00
Milan Broz
580f0f1a28 Add some FIPS mode workarounds. 
We cannot (yet) use Argon2 in FIPS mode, hack scripts and library
to use PBKDF2 or skip tests and fix tests to run in FIPS mode.
 2019-01-24 17:04:13 +01:00
Milan Broz
715b0c9b6c Switch to fetching default PBKDF values from library. 2019-01-23 14:15:23 +01:00
Milan Broz
388afa07f4 Cleunup devices before running mode-test. 2019-01-23 14:14:45 +01:00
Milan Broz
1def60cd2c Do not allow conversion to LUKS1 if hash algorithms differs (digest,AF). 2019-01-22 14:19:58 +01:00
Milan Broz
cdb4816fbb Allow setting of hash function in LUKS2 PBKDF2 digest. 
For now, the hash was set to sha256 (except for converted LUKS1 header).

This patch adds the same logic as in LUKS1 - hash aglorithms is
loaded from PBKDF setting.

Fixes #396.
 2019-01-22 12:45:01 +01:00
Milan Broz
be46588cf0 Allow LUKS2 keyslots area to increase if data offset allows it. 
ALso deprecate align-plauload option and add more debugging code
to understand internal calculation of metadata and keyslots area sizes.

Fixes #436.
 2019-01-22 09:23:49 +01:00