mirror of
https://gitlab.com/cryptsetup/cryptsetup.git
synced 2025-12-06 00:10:04 +01:00
Compare commits
1 Commits
doxygen-fi
...
v1_2_0
| Author | SHA1 | Date | |
|---|---|---|---|
|
22ce57e682 |
@@ -1,31 +0,0 @@
|
||||
name: "Cryptsetup CodeQL config"
|
||||
|
||||
query-filters:
|
||||
- exclude:
|
||||
id: cpp/fixme-comment
|
||||
- exclude:
|
||||
id: cpp/empty-block
|
||||
- exclude:
|
||||
id: cpp/poorly-documented-function
|
||||
- exclude:
|
||||
id: cpp/loop-variable-changed
|
||||
- exclude:
|
||||
id: cpp/empty-if
|
||||
- exclude:
|
||||
id: cpp/long-switch
|
||||
- exclude:
|
||||
id: cpp/complex-condition
|
||||
- exclude:
|
||||
id: cpp/commented-out-code
|
||||
|
||||
# These produce many false positives
|
||||
- exclude:
|
||||
id: cpp/uninitialized-local
|
||||
- exclude:
|
||||
id: cpp/path-injection
|
||||
- exclude:
|
||||
id: cpp/missing-check-scanf
|
||||
|
||||
# CodeQL should understand coverity [toctou] comments
|
||||
- exclude:
|
||||
id: cpp/toctou-race-condition
|
||||
29
.github/workflows/cibuild-setup-ubuntu.sh
vendored
29
.github/workflows/cibuild-setup-ubuntu.sh
vendored
@@ -1,29 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -ex
|
||||
|
||||
PACKAGES=(
|
||||
git make autoconf automake autopoint pkg-config libtool libtool-bin
|
||||
gettext libssl-dev libdevmapper-dev libpopt-dev uuid-dev libsepol-dev
|
||||
libjson-c-dev libssh-dev libblkid-dev tar libargon2-dev libpwquality-dev
|
||||
sharutils dmsetup jq xxd expect keyutils netcat-openbsd passwd openssh-client
|
||||
sshpass asciidoctor meson ninja-build
|
||||
)
|
||||
|
||||
COMPILER="${COMPILER:?}"
|
||||
COMPILER_VERSION="${COMPILER_VERSION:?}"
|
||||
RELEASE="$(lsb_release -cs)"
|
||||
|
||||
bash -c "echo 'deb-src http://archive.ubuntu.com/ubuntu/ $RELEASE main restricted universe multiverse' >>/etc/apt/sources.list"
|
||||
|
||||
# Latest gcc stack deb packages provided by
|
||||
# https://launchpad.net/~ubuntu-toolchain-r/+archive/ubuntu/test
|
||||
add-apt-repository -y ppa:ubuntu-toolchain-r/test
|
||||
PACKAGES+=(gcc-$COMPILER_VERSION)
|
||||
|
||||
# scsi_debug, gost crypto
|
||||
PACKAGES+=(dkms linux-headers-$(uname -r) linux-modules-extra-$(uname -r) gost-crypto-dkms)
|
||||
|
||||
apt-get -y update --fix-missing
|
||||
apt-get -y install "${PACKAGES[@]}"
|
||||
apt-get -y build-dep cryptsetup
|
||||
38
.github/workflows/cibuild.sh
vendored
38
.github/workflows/cibuild.sh
vendored
@@ -1,38 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
PHASES=(${@:-CONFIGURE MAKE CHECK})
|
||||
COMPILER="${COMPILER:?}"
|
||||
COMPILER_VERSION="${COMPILER_VERSION}"
|
||||
CFLAGS=(-O1 -g)
|
||||
CXXFLAGS=(-O1 -g)
|
||||
|
||||
CC="gcc${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
CXX="g++${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
|
||||
set -ex
|
||||
|
||||
for phase in "${PHASES[@]}"; do
|
||||
case $phase in
|
||||
CONFIGURE)
|
||||
opts=(
|
||||
--enable-libargon2
|
||||
)
|
||||
|
||||
sudo -E git clean -xdf
|
||||
|
||||
./autogen.sh
|
||||
CC="$CC" CXX="$CXX" CFLAGS="${CFLAGS[@]}" CXXFLAGS="${CXXFLAGS[@]}" ./configure "${opts[@]}"
|
||||
;;
|
||||
MAKE)
|
||||
make -j
|
||||
make -j -C tests check-programs
|
||||
;;
|
||||
CHECK)
|
||||
make check
|
||||
;;
|
||||
|
||||
*)
|
||||
echo >&2 "Unknown phase '$phase'"
|
||||
exit 1
|
||||
esac
|
||||
done
|
||||
29
.github/workflows/cibuild.yml
vendored
29
.github/workflows/cibuild.yml
vendored
@@ -1,29 +0,0 @@
|
||||
name: Build test
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- 'main'
|
||||
- 'wip-luks2'
|
||||
- 'v2.*.x'
|
||||
paths-ignore:
|
||||
- 'docs/**'
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
if: github.repository == 'mbroz/cryptsetup'
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
env:
|
||||
- { COMPILER: "gcc", COMPILER_VERSION: "14", RUN_SSH_PLUGIN_TEST: "1" }
|
||||
env: ${{ matrix.env }}
|
||||
steps:
|
||||
- name: Repository checkout
|
||||
uses: actions/checkout@v4
|
||||
- name: Ubuntu setup
|
||||
run: sudo -E .github/workflows/cibuild-setup-ubuntu.sh
|
||||
- name: Configure & Make
|
||||
run: .github/workflows/cibuild.sh CONFIGURE MAKE
|
||||
- name: Check
|
||||
run: sudo -E .github/workflows/cibuild.sh CHECK
|
||||
53
.github/workflows/codeql.yml
vendored
53
.github/workflows/codeql.yml
vendored
@@ -1,53 +0,0 @@
|
||||
name: "CodeQL"
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- 'main'
|
||||
- 'wip-luks2'
|
||||
- 'v2.*.x'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
analyze:
|
||||
name: Analyze
|
||||
runs-on: ubuntu-latest
|
||||
if: github.repository == 'mbroz/cryptsetup'
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ matrix.language }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
permissions:
|
||||
actions: read
|
||||
security-events: write
|
||||
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
language: [ 'cpp' ]
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@v3
|
||||
with:
|
||||
languages: ${{ matrix.language }}
|
||||
queries: +security-extended,security-and-quality
|
||||
config-file: .codeql-config.yml
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
sudo -E .github/workflows/cibuild-setup-ubuntu.sh
|
||||
# Force autoconf for now, meson is broken in analysis step
|
||||
rm meson.build
|
||||
|
||||
env: { COMPILER: "gcc", COMPILER_VERSION: "14", RUN_SSH_PLUGIN_TEST: "1" }
|
||||
|
||||
- name: Autobuild
|
||||
uses: github/codeql-action/autobuild@v3
|
||||
|
||||
- name: Perform CodeQL Analysis
|
||||
uses: github/codeql-action/analyze@v3
|
||||
48
.github/workflows/coverity.yml
vendored
48
.github/workflows/coverity.yml
vendored
@@ -1,48 +0,0 @@
|
||||
name: Coverity test
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- 'coverity_scan'
|
||||
paths-ignore:
|
||||
- 'docs/**'
|
||||
|
||||
jobs:
|
||||
latest:
|
||||
runs-on: ubuntu-latest
|
||||
if: github.repository == 'mbroz/cryptsetup'
|
||||
steps:
|
||||
- name: Repository checkout
|
||||
uses: actions/checkout@v4
|
||||
- name: Ubuntu setup
|
||||
run: sudo -E .github/workflows/cibuild-setup-ubuntu.sh
|
||||
env:
|
||||
COMPILER: "gcc"
|
||||
COMPILER_VERSION: "14"
|
||||
- name: Install Coverity
|
||||
run: |
|
||||
wget -q https://scan.coverity.com/download/cxx/linux64 --post-data "token=$TOKEN&project=mbroz/cryptsetup" -O cov-analysis-linux64.tar.gz
|
||||
mkdir cov-analysis-linux64
|
||||
tar xzf cov-analysis-linux64.tar.gz --strip 1 -C cov-analysis-linux64
|
||||
env:
|
||||
TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
|
||||
- name: Run autoconf & configure
|
||||
run: |
|
||||
./autogen.sh
|
||||
./configure
|
||||
- name: Run cov-build
|
||||
run: |
|
||||
export PATH=`pwd`/cov-analysis-linux64/bin:$PATH
|
||||
cov-build --dir cov-int make
|
||||
- name: Submit to Coverity Scan
|
||||
run: |
|
||||
tar czvf cryptsetup.tgz cov-int
|
||||
curl \
|
||||
--form project=mbroz/cryptsetup \
|
||||
--form token=$TOKEN \
|
||||
--form email=gmazyland@gmail.com \
|
||||
--form file=@cryptsetup.tgz \
|
||||
--form version=trunk \
|
||||
--form description="`./cryptsetup --version`" \
|
||||
https://scan.coverity.com/builds?project=mbroz/cryptsetup
|
||||
env:
|
||||
TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
|
||||
62
.gitignore
vendored
62
.gitignore
vendored
@@ -1,62 +0,0 @@
|
||||
po/*gmo
|
||||
*~
|
||||
Makefile
|
||||
Makefile.in
|
||||
Makefile.in.in
|
||||
*.lo
|
||||
*.la
|
||||
*.o
|
||||
*.so
|
||||
*.8
|
||||
**/*.dirstamp
|
||||
.deps/
|
||||
.libs/
|
||||
src/cryptsetup
|
||||
src/veritysetup
|
||||
ABOUT-NLS
|
||||
aclocal.m4
|
||||
autom4te.cache/
|
||||
compile
|
||||
compile_commands.json
|
||||
config.guess
|
||||
config.h
|
||||
config.h.in
|
||||
config.log
|
||||
config.rpath
|
||||
config.status
|
||||
config.sub
|
||||
configure
|
||||
cryptsetup
|
||||
cryptsetup-reencrypt
|
||||
cryptsetup-ssh
|
||||
depcomp
|
||||
install-sh
|
||||
integritysetup
|
||||
lib/libcryptsetup.pc
|
||||
libtool
|
||||
ltmain.sh
|
||||
m4/
|
||||
missing
|
||||
po/Makevars.template
|
||||
po/POTFILES
|
||||
po/Rules-quot
|
||||
po/*.header
|
||||
po/*.sed
|
||||
po/*.sin
|
||||
po/stamp-po
|
||||
scripts/cryptsetup.conf
|
||||
stamp-h1
|
||||
veritysetup
|
||||
tests/valglog.*
|
||||
*/*.dirstamp
|
||||
*-debug-luks2-backup*
|
||||
tests/api-test
|
||||
tests/api-test-2
|
||||
tests/differ
|
||||
tests/luks1-images
|
||||
tests/tcrypt-images
|
||||
tests/unit-utils-io
|
||||
tests/vectors-test
|
||||
tests/test-symbols-list.h
|
||||
tests/all-symbols-test
|
||||
tests/fuzz/LUKS2.pb*
|
||||
@@ -1,23 +0,0 @@
|
||||
stages:
|
||||
- test
|
||||
- test-opal
|
||||
|
||||
.fail_if_coredump_generated:
|
||||
after_script:
|
||||
- '[ "$(ls -A /var/coredumps)" ] && exit 1 || true'
|
||||
|
||||
include:
|
||||
- local: .gitlab/ci/debian.yml
|
||||
- local: .gitlab/ci/fedora.yml
|
||||
- local: .gitlab/ci/fedora-opal.yml
|
||||
- local: .gitlab/ci/centos.yml
|
||||
# - local: .gitlab/ci/annocheck.yml
|
||||
- local: .gitlab/ci/csmock.yml
|
||||
- local: .gitlab/ci/gitlab-shared-docker.yml
|
||||
- local: .gitlab/ci/compilation-various-disables.yml
|
||||
- local: .gitlab/ci/compilation-gcc.gitlab-ci.yml
|
||||
- local: .gitlab/ci/compilation-clang.gitlab-ci.yml
|
||||
- local: .gitlab/ci/compilation-spellcheck.yml
|
||||
- local: .gitlab/ci/alpinelinux.yml
|
||||
- local: .gitlab/ci/debian-i686.yml
|
||||
- local: .gitlab/ci/cifuzz.yml
|
||||
@@ -1,57 +0,0 @@
|
||||
.alpinelinux-dependencies:
|
||||
variables:
|
||||
DISTRO: cryptsetup-alpine-edge
|
||||
extends:
|
||||
- .fail_if_coredump_generated
|
||||
before_script:
|
||||
- >
|
||||
sudo apk add
|
||||
lvm2-dev openssl-dev popt-dev util-linux-dev json-c-dev
|
||||
argon2-dev device-mapper which sharutils gettext-dev argp-standalone automake
|
||||
autoconf libtool build-base keyutils tar jq expect git asciidoctor
|
||||
# Be sure we have updated basic tools and system
|
||||
- sudo apk upgrade gcc binutils build-base musl
|
||||
- ./autogen.sh
|
||||
- ./configure --prefix=/usr --libdir=/lib --sbindir=/sbin --disable-static --enable-libargon2 --with-crypto_backend=openssl --disable-external-tokens --disable-ssh-token --enable-asciidoc
|
||||
|
||||
test-main-commit-job-alpinelinux:
|
||||
extends:
|
||||
- .alpinelinux-dependencies
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-alpine-edge
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
RUN_SSH_PLUGIN_TEST: "0"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-mergerq-job-alpinelinux:
|
||||
extends:
|
||||
- .alpinelinux-dependencies
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-alpine-edge
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
RUN_SSH_PLUGIN_TEST: "0"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
@@ -1,18 +0,0 @@
|
||||
test-main-commit-job-annocheck:
|
||||
extends:
|
||||
- .fail_if_coredump_generated
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-rhel-9
|
||||
stage: test
|
||||
interruptible: true
|
||||
allow_failure: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-rhel-9
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- sudo /opt/run-annocheck.sh
|
||||
@@ -1,32 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
SAVED_PWD=$(pwd)
|
||||
GIT_DIR="$SAVED_PWD/upstream_git"
|
||||
SPEC="$GIT_DIR/misc/fedora/cryptsetup.spec"
|
||||
|
||||
rm -fr $GIT_DIR
|
||||
|
||||
git clone -q --depth 1 https://gitlab.com/cryptsetup/cryptsetup.git $GIT_DIR
|
||||
cd $GIT_DIR
|
||||
|
||||
GIT_COMMIT=$(git rev-parse --short=8 HEAD)
|
||||
[ -z "$GIT_COMMIT" ] && exit 1
|
||||
|
||||
sed -i "s/^AC_INIT.*/AC_INIT([cryptsetup],[$GIT_COMMIT])/" $GIT_DIR/configure.ac
|
||||
sed -i "s/^Version:.*/Version: $GIT_COMMIT/" $SPEC
|
||||
sed -i "s/%{version_no_tilde}/$GIT_COMMIT/" $SPEC
|
||||
sed -i "2i %global source_date_epoch_from_changelog 0" $SPEC
|
||||
sed -i "3i %define _unpackaged_files_terminate_build 0" $SPEC
|
||||
|
||||
./autogen.sh
|
||||
./configure
|
||||
make -j dist
|
||||
|
||||
rpmbuild --define "_sourcedir $GIT_DIR" --define "_srcrpmdir $SAVED_PWD" -bs $SPEC
|
||||
|
||||
cd $SAVED_PWD
|
||||
rm -fr $GIT_DIR
|
||||
|
||||
exit 0
|
||||
@@ -1,111 +0,0 @@
|
||||
.centos-openssl-backend:
|
||||
extends:
|
||||
- .fail_if_coredump_generated
|
||||
before_script:
|
||||
- sudo dnf clean all
|
||||
- >
|
||||
sudo dnf -y -q install
|
||||
autoconf automake device-mapper-devel gcc gettext-devel json-c-devel
|
||||
libblkid-devel libpwquality-devel libselinux-devel libssh-devel libtool
|
||||
libuuid-devel make popt-devel libsepol-devel nc openssh-clients passwd
|
||||
pkgconfig sharutils sshpass tar uuid-devel vim-common device-mapper
|
||||
expect gettext git jq keyutils openssl-devel openssl gem swtpm swtpm-tools
|
||||
tpm2-tools
|
||||
- sudo gem install asciidoctor
|
||||
- sudo -E git clean -xdf
|
||||
- ./autogen.sh
|
||||
- ./configure --enable-fips --enable-pwquality --with-crypto_backend=openssl --enable-asciidoc
|
||||
|
||||
# non-FIPS jobs
|
||||
|
||||
test-main-commit-centos-stream9:
|
||||
extends:
|
||||
- .centos-openssl-backend
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-centos-stream-9
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-centos-stream-9
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-mergerq-centos-stream9:
|
||||
extends:
|
||||
- .centos-openssl-backend
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-centos-stream-9
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-centos-stream-9
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-main-commit-centos-stream10:
|
||||
extends:
|
||||
- .centos-openssl-backend
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-centos-stream-10
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-centos-stream-10
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-mergerq-centos-stream10:
|
||||
extends:
|
||||
- .centos-openssl-backend
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-centos-stream-10
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-centos-stream-10
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
@@ -1,47 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -ex
|
||||
|
||||
PACKAGES=(
|
||||
git make autoconf automake autopoint pkg-config libtool libtool-bin
|
||||
gettext libssl-dev libdevmapper-dev libpopt-dev uuid-dev libsepol-dev
|
||||
libjson-c-dev libssh-dev libblkid-dev tar libargon2-dev libpwquality-dev
|
||||
sharutils dmsetup jq xxd expect keyutils netcat-openbsd passwd openssh-client
|
||||
sshpass asciidoctor
|
||||
)
|
||||
|
||||
COMPILER="${COMPILER:?}"
|
||||
COMPILER_VERSION="${COMPILER_VERSION:?}"
|
||||
|
||||
sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/ubuntu.sources
|
||||
|
||||
# use this on older Ubuntu
|
||||
# grep -E '^deb' /etc/apt/sources.list > /etc/apt/sources.list~
|
||||
# sed -Ei 's/^deb /deb-src /' /etc/apt/sources.list~
|
||||
# cat /etc/apt/sources.list~ >> /etc/apt/sources.list
|
||||
|
||||
apt-get -y update --fix-missing
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -yq install software-properties-common wget lsb-release
|
||||
RELEASE="$(lsb_release -cs)"
|
||||
|
||||
if [[ $COMPILER == "gcc" ]]; then
|
||||
# Latest gcc stack deb packages provided by
|
||||
# https://launchpad.net/~ubuntu-toolchain-r/+archive/ubuntu/test
|
||||
add-apt-repository -y ppa:ubuntu-toolchain-r/test
|
||||
PACKAGES+=(gcc-$COMPILER_VERSION)
|
||||
elif [[ $COMPILER == "clang" ]]; then
|
||||
wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | apt-key add -
|
||||
add-apt-repository -n "deb http://apt.llvm.org/${RELEASE}/ llvm-toolchain-${RELEASE}-${COMPILER_VERSION} main"
|
||||
|
||||
# scan-build
|
||||
PACKAGES+=(clang-tools-$COMPILER_VERSION clang-$COMPILER_VERSION lldb-$COMPILER_VERSION lld-$COMPILER_VERSION clangd-$COMPILER_VERSION)
|
||||
PACKAGES+=(perl)
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
|
||||
#apt-get -y update --fix-missing
|
||||
(r=3;while ! apt-get -y update --fix-missing ; do ((--r))||exit;sleep 5;echo "Retrying";done)
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -yq install "${PACKAGES[@]}"
|
||||
apt-get -y build-dep cryptsetup
|
||||
@@ -1,46 +0,0 @@
|
||||
cifuzz:
|
||||
variables:
|
||||
OSS_FUZZ_PROJECT_NAME: cryptsetup
|
||||
CFL_PLATFORM: gitlab
|
||||
CIFUZZ_DEBUG: "True"
|
||||
FUZZ_SECONDS: 300 # 5 minutes per fuzzer
|
||||
ARCHITECTURE: "x86_64"
|
||||
DRY_RUN: "False"
|
||||
LOW_DISK_SPACE: "True"
|
||||
BAD_BUILD_CHECK: "True"
|
||||
LANGUAGE: "c"
|
||||
DOCKER_HOST: "tcp://docker:2375"
|
||||
DOCKER_IN_DOCKER: "true"
|
||||
DOCKER_DRIVER: overlay2
|
||||
DOCKER_TLS_CERTDIR: ""
|
||||
image:
|
||||
name: gcr.io/oss-fuzz-base/cifuzz-base
|
||||
entrypoint: [""]
|
||||
services:
|
||||
- docker:dind
|
||||
|
||||
stage: test
|
||||
parallel:
|
||||
matrix:
|
||||
- SANITIZER: [address, undefined, memory]
|
||||
rules:
|
||||
# Default code change.
|
||||
# - if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
# variables:
|
||||
# MODE: "code-change"
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $BUILD_AND_RUN_FUZZERS != null
|
||||
before_script:
|
||||
# Get gitlab's container id.
|
||||
- export CFL_CONTAINER_ID=`cut -c9- < /proc/1/cpuset`
|
||||
script:
|
||||
# Will build and run the fuzzers.
|
||||
# We use a hack to override CI_JOB_ID, because otherwise a bad path is used
|
||||
# in GitLab CI environment
|
||||
- CI_JOB_ID="$CI_PROJECT_NAMESPACE/$CI_PROJECT_TITLE" python3 "/opt/oss-fuzz/infra/cifuzz/cifuzz_combined_entrypoint.py"
|
||||
artifacts:
|
||||
# Upload artifacts when a crash makes the job fail.
|
||||
when: always
|
||||
paths:
|
||||
- artifacts/
|
||||
@@ -1,48 +0,0 @@
|
||||
#!/bin/bash
|
||||
# clang -Wall plus other important warnings not included in -Wall
|
||||
|
||||
for arg in "$@"
|
||||
do
|
||||
case $arg in
|
||||
-O*) Wuninitialized=-Wuninitialized;; # only makes sense with `-O'
|
||||
esac
|
||||
done
|
||||
|
||||
CLANG="clang${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
|
||||
#PEDANTIC="-std=gnu99"
|
||||
#PEDANTIC="-pedantic -std=gnu99"
|
||||
#PEDANTIC="-pedantic -std=gnu99 -Wno-variadic-macros"
|
||||
#CONVERSION="-Wconversion"
|
||||
|
||||
EXTRA="\
|
||||
-Wextra \
|
||||
-Wsign-compare \
|
||||
-Wcast-align
|
||||
-Werror-implicit-function-declaration \
|
||||
-Wpointer-arith \
|
||||
-Wwrite-strings \
|
||||
-Wswitch \
|
||||
-Wmissing-format-attribute \
|
||||
-Winit-self \
|
||||
-Wold-style-definition \
|
||||
-Wno-missing-field-initializers \
|
||||
-Wunused-parameter \
|
||||
-Wno-long-long"
|
||||
|
||||
exec $CLANG $PEDANTIC $CONVERSION \
|
||||
-Wall $Wuninitialized \
|
||||
-Wno-switch \
|
||||
-Wdisabled-optimization \
|
||||
-Wwrite-strings \
|
||||
-Wpointer-arith \
|
||||
-Wbad-function-cast \
|
||||
-Wmissing-prototypes \
|
||||
-Wmissing-declarations \
|
||||
-Wstrict-prototypes \
|
||||
-Wnested-externs \
|
||||
-Wcomment \
|
||||
-Winline \
|
||||
-Wcast-qual \
|
||||
-Wredundant-decls $EXTRA \
|
||||
"$@"
|
||||
@@ -1,88 +0,0 @@
|
||||
test-clang-compilation:
|
||||
extends:
|
||||
- .gitlab-shared-clang
|
||||
script:
|
||||
- export CFLAGS="-Wall -Werror"
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure
|
||||
- make -j
|
||||
- make -j check-programs
|
||||
|
||||
test-clang-Wall-script-ubuntu:
|
||||
extends:
|
||||
- .gitlab-shared-clang
|
||||
script:
|
||||
- export CFLAGS="-g -O0"
|
||||
- export CC="$CI_PROJECT_DIR/.gitlab/ci/clang-Wall"
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure
|
||||
- make -j CFLAGS="-g -O0 -Werror"
|
||||
- make -j CFLAGS="-g -O0 -Werror" check-programs
|
||||
|
||||
test-clang-Wall-script-alpine:
|
||||
extends:
|
||||
- .gitlab-shared-clang-alpine
|
||||
allow_failure: true
|
||||
script:
|
||||
- export CFLAGS="-g -O0"
|
||||
- export CC="$CI_PROJECT_DIR/.gitlab/ci/clang-Wall"
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure
|
||||
- make -j CFLAGS="-g -O0 -Werror"
|
||||
- make -j CFLAGS="-g -O0 -Werror" check-programs
|
||||
|
||||
test-scan-build-ubuntu:
|
||||
extends:
|
||||
- .gitlab-shared-clang
|
||||
script:
|
||||
- ./autogen.sh
|
||||
- echo "scan-build${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} -V ./configure CFLAGS="-g -O0"
|
||||
- make clean
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j check-programs
|
||||
|
||||
test-scan-build-alpine:
|
||||
extends:
|
||||
- .gitlab-shared-clang-alpine
|
||||
allow_failure: true
|
||||
script:
|
||||
- ./autogen.sh
|
||||
- echo "scan-build${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} -V ./configure CFLAGS="-g -O0"
|
||||
- make clean
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j check-programs
|
||||
|
||||
test-scan-build-backends:
|
||||
extends:
|
||||
- .gitlab-shared-clang
|
||||
parallel:
|
||||
matrix:
|
||||
- BACKENDS: [
|
||||
"openssl",
|
||||
"gcrypt",
|
||||
"nss",
|
||||
"kernel",
|
||||
"nettle",
|
||||
"mbedtls"
|
||||
]
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
changes:
|
||||
- lib/crypto_backend/*
|
||||
script:
|
||||
- DEBIAN_FRONTEND=noninteractive apt-get -yq install libgcrypt20-dev libnss3-dev nettle-dev libmbedtls-dev
|
||||
- ./autogen.sh
|
||||
- echo "Configuring with crypto backend $BACKENDS"
|
||||
- echo "scan-build${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} -V ./configure CFLAGS="-g -O0" --with-crypto_backend=$BACKENDS
|
||||
- make clean
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j check-programs
|
||||
- ./tests/vectors-test
|
||||
@@ -1,85 +0,0 @@
|
||||
test-gcc-compilation:
|
||||
extends:
|
||||
- .gitlab-shared-gcc
|
||||
script:
|
||||
- export CFLAGS="-Wall -Werror"
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure
|
||||
- make -j
|
||||
- make -j check-programs
|
||||
|
||||
test-gcc-Wall-script-ubuntu:
|
||||
extends:
|
||||
- .gitlab-shared-gcc
|
||||
script:
|
||||
- export CFLAGS="-g -O0"
|
||||
- export CC="$CI_PROJECT_DIR/.gitlab/ci/gcc-Wall"
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure
|
||||
- make -j CFLAGS="-g -O0 -Werror"
|
||||
- make -j CFLAGS="-g -O0 -Werror" check-programs
|
||||
|
||||
test-gcc-Wall-script-alpine:
|
||||
extends:
|
||||
- .gitlab-shared-gcc-alpine
|
||||
allow_failure: true
|
||||
script:
|
||||
- export CFLAGS="-g -O0"
|
||||
- export CC="$CI_PROJECT_DIR/.gitlab/ci/gcc-Wall"
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure
|
||||
- make -j CFLAGS="-g -O0 -Werror"
|
||||
- make -j CFLAGS="-g -O0 -Werror" check-programs
|
||||
|
||||
test-gcc-fanalyzer-ubuntu:
|
||||
extends:
|
||||
- .gitlab-shared-gcc
|
||||
script:
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure CFLAGS="-Wall -Werror -g -O0 -fanalyzer -fdiagnostics-path-format=separate-events" --host=x86_64
|
||||
- make -j
|
||||
- make -j check-programs
|
||||
|
||||
test-gcc-fanalyzer-alpine:
|
||||
extends:
|
||||
- .gitlab-shared-gcc-alpine
|
||||
allow_failure: true
|
||||
script:
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure CFLAGS="-Wall -Werror -g -O0 -fanalyzer -fdiagnostics-path-format=separate-events -Wno-analyzer-fd-leak" --host=x86_64
|
||||
- make -j
|
||||
- make -j check-programs
|
||||
|
||||
test-gcc-fanalyzer-backends:
|
||||
extends:
|
||||
- .gitlab-shared-gcc
|
||||
parallel:
|
||||
matrix:
|
||||
- BACKENDS: [
|
||||
"openssl",
|
||||
"gcrypt",
|
||||
"nss",
|
||||
"kernel",
|
||||
"nettle",
|
||||
"mbedtls"
|
||||
]
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
changes:
|
||||
- lib/crypto_backend/*
|
||||
script:
|
||||
- DEBIAN_FRONTEND=noninteractive apt-get -yq install libgcrypt20-dev libnss3-dev nettle-dev libmbedtls-dev
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- echo "Configuring with crypto backend $BACKENDS"
|
||||
- ./configure CFLAGS="-Wall -Werror -g -O0 -fanalyzer -fdiagnostics-path-format=separate-events" --host=x86_64 --with-crypto_backend=$BACKENDS
|
||||
- make -j
|
||||
- make -j check-programs
|
||||
- ./tests/vectors-test
|
||||
@@ -1,20 +0,0 @@
|
||||
test-run-spellcheck:
|
||||
image: ubuntu:noble
|
||||
tags:
|
||||
- gitlab-org-docker
|
||||
stage: test
|
||||
interruptible: true
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
artifacts:
|
||||
name: "spellcheck-$CI_COMMIT_REF_NAME"
|
||||
paths:
|
||||
- _spellcheck
|
||||
before_script:
|
||||
- apt-get -y update --fix-missing
|
||||
- apt-get -y install git lintian codespell
|
||||
script:
|
||||
- echo "Running spellcheck"
|
||||
- .gitlab/ci/spellcheck
|
||||
@@ -1,33 +0,0 @@
|
||||
test-gcc-disable-compiles:
|
||||
extends:
|
||||
- .gitlab-shared-gcc
|
||||
parallel:
|
||||
matrix:
|
||||
- DISABLE_FLAGS: [
|
||||
"keyring",
|
||||
"external-tokens ssh-token",
|
||||
"luks2-reencryption",
|
||||
"cryptsetup veritysetup integritysetup",
|
||||
"kernel_crypto",
|
||||
"udev",
|
||||
"internal-argon2",
|
||||
"blkid",
|
||||
"hw-opal"
|
||||
]
|
||||
artifacts:
|
||||
name: "meson-build-logs-$CI_COMMIT_REF_NAME"
|
||||
paths:
|
||||
- meson_builddir/meson-logs
|
||||
script:
|
||||
- DEBIAN_FRONTEND=noninteractive apt-get -yq install meson ninja-build
|
||||
- export CFLAGS="-Wall -Werror"
|
||||
- ./autogen.sh
|
||||
- echo "Configuring with --disable-$DISABLE_FLAGS"
|
||||
- ./configure $(for i in $DISABLE_FLAGS; do echo "--disable-$i"; done)
|
||||
- make -j
|
||||
- make -j check-programs
|
||||
- git checkout -f && git clean -xdf
|
||||
- meson -v
|
||||
- echo "Configuring with -D$DISABLE_FLAGS=false"
|
||||
- meson setup meson_builddir $(for i in $DISABLE_FLAGS; do [ "$i" == "internal-argon2" ] && echo "-Dargon-implementation=internal" || echo "-D$i=false"; done)
|
||||
- ninja -C meson_builddir
|
||||
@@ -1,36 +0,0 @@
|
||||
.dnf-csmock:
|
||||
variables:
|
||||
DISTRO: cryptsetup-fedora-rawhide
|
||||
DISK_SIZE: 20
|
||||
extends:
|
||||
- .fail_if_coredump_generated
|
||||
before_script:
|
||||
- >
|
||||
sudo dnf -y -q install
|
||||
autoconf automake device-mapper-devel gcc gettext-devel json-c-devel
|
||||
libblkid-devel libpwquality-devel libselinux-devel
|
||||
libssh-devel libtool libuuid-devel make popt-devel
|
||||
libsepol-devel.x86_64 pkgconfig tar uuid-devel git
|
||||
openssl-devel asciidoctor meson ninja-build
|
||||
rpm-build csmock
|
||||
|
||||
test-commit-job-csmock:
|
||||
extends:
|
||||
- .dnf-csmock
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-fedora-rawhide
|
||||
stage: test
|
||||
interruptible: true
|
||||
allow_failure: true
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/ || $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- .gitlab/ci/build_srpm
|
||||
- .gitlab/ci/run_csmock
|
||||
artifacts:
|
||||
when: always
|
||||
paths:
|
||||
- cryptsetup-csmock-results.tar.xz
|
||||
@@ -1,43 +0,0 @@
|
||||
test-mergerq-job-debian-i686:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-12i686
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-12i686
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-main-commit-job-debian-i686:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-12i686
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-12i686
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
@@ -1,190 +0,0 @@
|
||||
.debian-prep:
|
||||
extends:
|
||||
- .fail_if_coredump_generated
|
||||
before_script:
|
||||
- sudo apt-get -y update
|
||||
- >
|
||||
sudo apt-get -y install -y -qq git gcc make autoconf automake autopoint
|
||||
pkgconf libtool libtool-bin gettext libssl-dev libdevmapper-dev
|
||||
libpopt-dev uuid-dev libsepol-dev libjson-c-dev libssh-dev libblkid-dev
|
||||
tar libargon2-dev libpwquality-dev sharutils dmsetup jq xxd expect
|
||||
keyutils netcat-openbsd passwd openssh-client sshpass asciidoctor
|
||||
swtpm meson ninja-build python3-jinja2 gperf libcap-dev libtss2-dev
|
||||
libmount-dev swtpm-tools tpm2-tools
|
||||
- sudo apt-get -y build-dep cryptsetup
|
||||
- sudo -E git clean -xdf
|
||||
- ./autogen.sh
|
||||
- ./configure --enable-libargon2 --enable-asciidoc
|
||||
|
||||
test-mergerq-job-debian:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-unstable
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-unstable
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-main-commit-job-debian:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-unstable
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-unstable
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-mergerq-job-debian12:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-12
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-12
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-main-commit-job-debian12:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-12
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-12
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
# meson tests
|
||||
test-mergerq-job-debian-meson:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-unstable
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-unstable
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- sudo apt-get -y install -y -qq meson ninja-build
|
||||
- meson setup build
|
||||
- ninja -C build
|
||||
- cd build && sudo -E meson test --verbose --print-errorlogs
|
||||
|
||||
test-main-commit-job-debian-meson:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-unstable
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-unstable
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- sudo apt-get -y install -y -qq meson ninja-build
|
||||
- meson setup build
|
||||
- ninja -C build
|
||||
- cd build && sudo -E meson test --verbose --print-errorlogs
|
||||
|
||||
test-mergerq-job-debian12-meson:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-12
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-12
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- sudo apt-get -y install -y -qq meson ninja-build
|
||||
- meson setup build
|
||||
- ninja -C build
|
||||
- cd build && sudo -E meson test --verbose --print-errorlogs
|
||||
|
||||
test-main-commit-job-debian12-meson:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-12
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-12
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- sudo apt-get -y install -y -qq meson ninja-build
|
||||
- meson setup build
|
||||
- ninja -C build
|
||||
- cd build && sudo -E meson test --verbose --print-errorlogs
|
||||
@@ -1,145 +0,0 @@
|
||||
.opal-template-fedora:
|
||||
extends:
|
||||
- .dnf-openssl-backend
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-fedora-rawhide
|
||||
stage: test-opal
|
||||
interruptible: false
|
||||
variables:
|
||||
OPAL2_DEV: "/dev/nvme0n1"
|
||||
OPAL2_PSID_FILE: "/home/gitlab-runner/psid.txt"
|
||||
VOLATILE: 1
|
||||
script:
|
||||
- sudo dnf install -y -q nvme-cli
|
||||
- sudo nvme list
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check TESTS="00modules-test compat-test-opal"
|
||||
|
||||
# Samsung SSD 980 500GB (on tiber machine)
|
||||
test-commit-rawhide-samsung980:
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
extends:
|
||||
- .opal-template-fedora
|
||||
tags:
|
||||
- tiber
|
||||
resource_group: samsung980-on-tiber
|
||||
interruptible: false
|
||||
variables:
|
||||
PCI_PASSTHROUGH_VENDOR_ID: "144d"
|
||||
PCI_PASSTHROUGH_DEVICE_ID: "a809"
|
||||
|
||||
test-mergerq-rawhide-samsung980:
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
extends:
|
||||
- .opal-template-fedora
|
||||
tags:
|
||||
- tiber
|
||||
resource_group: samsung980-on-tiber
|
||||
interruptible: false
|
||||
variables:
|
||||
PCI_PASSTHROUGH_VENDOR_ID: "144d"
|
||||
PCI_PASSTHROUGH_DEVICE_ID: "a809"
|
||||
|
||||
# WD PC SN740 SDDQNQD-512G-1014 (on tiber machine)
|
||||
# Disabled on 2025-03-20, seems broken
|
||||
#test-commit-rawhide-sn740:
|
||||
# rules:
|
||||
# - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
# when: never
|
||||
# - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
# extends:
|
||||
# - .opal-template-fedora
|
||||
# tags:
|
||||
# - tiber
|
||||
# resource_group: sn740-on-tiber
|
||||
# interruptible: false
|
||||
# variables:
|
||||
# PCI_PASSTHROUGH_VENDOR_ID: "15b7"
|
||||
# PCI_PASSTHROUGH_DEVICE_ID: "5017"
|
||||
#
|
||||
#test-mergerq-rawhide-sn740:
|
||||
# rules:
|
||||
# - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
# when: never
|
||||
# - if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
# extends:
|
||||
# - .opal-template-fedora
|
||||
# tags:
|
||||
# - tiber
|
||||
# resource_group: sn740-on-tiber
|
||||
# interruptible: false
|
||||
# variables:
|
||||
# PCI_PASSTHROUGH_VENDOR_ID: "15b7"
|
||||
# PCI_PASSTHROUGH_DEVICE_ID: "5017"
|
||||
|
||||
# Samsung SSD 980 PRO 1TB (on trantor machine)
|
||||
test-commit-rawhide-samsung980pro:
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
extends:
|
||||
- .opal-template-fedora
|
||||
tags:
|
||||
- trantor
|
||||
resource_group: samsung980pro-on-trantor
|
||||
interruptible: false
|
||||
variables:
|
||||
PCI_PASSTHROUGH_VENDOR_ID: "144d"
|
||||
PCI_PASSTHROUGH_DEVICE_ID: "a80a"
|
||||
|
||||
test-mergerq-rawhide-samsung980pro:
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
extends:
|
||||
- .opal-template-fedora
|
||||
tags:
|
||||
- trantor
|
||||
resource_group: samsung980pro-on-trantor
|
||||
interruptible: false
|
||||
variables:
|
||||
PCI_PASSTHROUGH_VENDOR_ID: "144d"
|
||||
PCI_PASSTHROUGH_DEVICE_ID: "a80a"
|
||||
|
||||
# # UMIS RPETJ256MGE2MDQ (on tiber machine)
|
||||
# test-commit-rawhide-umis:
|
||||
# rules:
|
||||
# - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
# when: never
|
||||
# - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
# extends:
|
||||
# - .opal-template-fedora
|
||||
# tags:
|
||||
# - tiber
|
||||
# resource_group: umis-on-tiber
|
||||
# stage: test
|
||||
# interruptible: false
|
||||
# variables:
|
||||
# PCI_PASSTHROUGH_VENDOR_ID: "1cc4"
|
||||
# PCI_PASSTHROUGH_DEVICE_ID: "6302"
|
||||
#
|
||||
# test-mergerq-rawhide-umis:
|
||||
# rules:
|
||||
# - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
# when: never
|
||||
# - if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
# extends:
|
||||
# - .opal-template-fedora
|
||||
# tags:
|
||||
# - tiber
|
||||
# resource_group: umis-on-tiber
|
||||
# stage: test
|
||||
# interruptible: false
|
||||
# variables:
|
||||
# PCI_PASSTHROUGH_VENDOR_ID: "1cc4"
|
||||
# PCI_PASSTHROUGH_DEVICE_ID: "6302"
|
||||
@@ -1,63 +0,0 @@
|
||||
.dnf-openssl-backend:
|
||||
variables:
|
||||
DISTRO: cryptsetup-fedora-rawhide
|
||||
PKGS: >-
|
||||
autoconf automake device-mapper-devel gcc gettext-devel json-c-devel
|
||||
libargon2-devel libblkid-devel libpwquality-devel libselinux-devel
|
||||
libssh-devel libtool libuuid-devel make popt-devel
|
||||
libsepol-devel.x86_64 netcat openssh-clients passwd pkgconfig sharutils
|
||||
sshpass tar uuid-devel vim-common device-mapper expect gettext git jq
|
||||
keyutils openssl-devel openssl asciidoctor swtpm meson ninja-build
|
||||
python3-jinja2 gperf libcap-devel tpm2-tss-devel libmount-devel swtpm-tools
|
||||
extends:
|
||||
- .fail_if_coredump_generated
|
||||
before_script:
|
||||
- sudo dnf clean all
|
||||
- (r=3;while ! sudo dnf -y -q install $PKGS ; do ((--r))||exit;sleep 5;echo "Retrying";done)
|
||||
- sudo -E git clean -xdf
|
||||
- ./autogen.sh
|
||||
- ./configure --enable-fips --enable-pwquality --enable-libargon2 --with-crypto_backend=openssl --enable-asciidoc
|
||||
|
||||
test-main-commit-job-rawhide:
|
||||
extends:
|
||||
- .dnf-openssl-backend
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-fedora-rawhide
|
||||
stage: test
|
||||
interruptible: true
|
||||
allow_failure: true
|
||||
variables:
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
RUN_SYSTEMD_PLUGIN_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-mergerq-job-rawhide:
|
||||
extends:
|
||||
- .dnf-openssl-backend
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-fedora-rawhide
|
||||
stage: test
|
||||
interruptible: true
|
||||
allow_failure: true
|
||||
variables:
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
RUN_SYSTEMD_PLUGIN_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
@@ -1,58 +0,0 @@
|
||||
#!/bin/bash
|
||||
# gcc -Wall plus other important warnings not included in -Wall
|
||||
|
||||
for arg in "$@"
|
||||
do
|
||||
case $arg in
|
||||
-O*) Wuninitialized=-Wuninitialized;; # only makes sense with `-O'
|
||||
esac
|
||||
done
|
||||
|
||||
GCC="gcc${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
|
||||
#PEDANTIC="-std=gnu99"
|
||||
#PEDANTIC="-pedantic -std=gnu99"
|
||||
#PEDANTIC="-pedantic -std=gnu99 -Wno-variadic-macros"
|
||||
#CONVERSION="-Wconversion"
|
||||
# -Wpacked \
|
||||
|
||||
# This does more than expected for gcc (mixed code with declarations)
|
||||
# -Wdeclaration-after-statement \
|
||||
|
||||
EXTRA="-Wextra \
|
||||
-Wsign-compare \
|
||||
-Werror-implicit-function-declaration \
|
||||
-Wpointer-arith \
|
||||
-Wwrite-strings \
|
||||
-Wswitch \
|
||||
-Wmissing-format-attribute \
|
||||
-Wstrict-aliasing=3 \
|
||||
-Winit-self \
|
||||
-Wunsafe-loop-optimizations \
|
||||
-Wold-style-definition \
|
||||
-Wno-missing-field-initializers \
|
||||
-Wunused-parameter \
|
||||
-Wno-long-long \
|
||||
-Wmaybe-uninitialized \
|
||||
-Wvla \
|
||||
-Wformat-overflow \
|
||||
-Wformat-truncation \
|
||||
-Wstringop-overread"
|
||||
|
||||
exec $GCC $PEDANTIC $CONVERSION \
|
||||
-Wall $Wuninitialized \
|
||||
-Wno-switch \
|
||||
-Wdisabled-optimization \
|
||||
-Wwrite-strings \
|
||||
-Wpointer-arith \
|
||||
-Wbad-function-cast \
|
||||
-Wmissing-prototypes \
|
||||
-Wmissing-declarations \
|
||||
-Wstrict-prototypes \
|
||||
-Wnested-externs \
|
||||
-Wcomment \
|
||||
-Winline \
|
||||
-Wcast-align=strict \
|
||||
-Wcast-qual \
|
||||
-Wredundant-decls $EXTRA \
|
||||
"$@"
|
||||
@@ -1,61 +0,0 @@
|
||||
# Ubuntu
|
||||
.gitlab-shared-docker-ubuntu:
|
||||
image: ubuntu:noble
|
||||
tags:
|
||||
- gitlab-org-docker
|
||||
stage: test
|
||||
interruptible: true
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
before_script:
|
||||
- .gitlab/ci/cibuild-setup-ubuntu.sh
|
||||
- export CC="${COMPILER}${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
- export CXX="${COMPILER}++${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
|
||||
# Alpine
|
||||
.gitlab-shared-docker-alpine:
|
||||
image: alpine:latest
|
||||
tags:
|
||||
- gitlab-org-docker
|
||||
stage: test
|
||||
interruptible: true
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
before_script:
|
||||
- apk add bash build-base clang clang-analyzer argp-standalone lvm2-dev openssl-dev popt-dev util-linux-dev json-c-dev device-mapper gettext-dev libssh-dev automake autoconf libtool tar asciidoctor
|
||||
- export CC="${COMPILER}${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
- export CXX="${COMPILER}++${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
|
||||
.gitlab-shared-gcc:
|
||||
extends:
|
||||
- .gitlab-shared-docker-ubuntu
|
||||
variables:
|
||||
COMPILER: "gcc"
|
||||
COMPILER_VERSION: "14"
|
||||
CC: "gcc-14"
|
||||
|
||||
.gitlab-shared-clang:
|
||||
extends:
|
||||
- .gitlab-shared-docker-ubuntu
|
||||
variables:
|
||||
COMPILER: "clang"
|
||||
COMPILER_VERSION: "20"
|
||||
CC: "clang-20"
|
||||
|
||||
.gitlab-shared-gcc-alpine:
|
||||
extends:
|
||||
- .gitlab-shared-docker-alpine
|
||||
variables:
|
||||
COMPILER: "gcc"
|
||||
CC: "gcc"
|
||||
|
||||
.gitlab-shared-clang-alpine:
|
||||
extends:
|
||||
- .gitlab-shared-docker-alpine
|
||||
variables:
|
||||
COMPILER: "clang"
|
||||
CC: "clang"
|
||||
@@ -1,22 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
CSMOCK="sudo /usr/bin/csmock"
|
||||
CSMOCK_TOOLS="gcc,clang,cppcheck,shellcheck"
|
||||
CSMOCK_TXZ="cryptsetup-csmock-results.tar.xz"
|
||||
CSMOCK_ERR="cryptsetup-csmock-results/scan-results.err"
|
||||
|
||||
$CSMOCK cryptsetup-*.src.rpm \
|
||||
--keep-going --force \
|
||||
--cswrap-timeout 300 \
|
||||
--skip-patches \
|
||||
--tools $CSMOCK_TOOLS \
|
||||
--output $CSMOCK_TXZ \
|
||||
--gcc-analyze \
|
||||
--cppcheck-add-flag=--check-level=exhaustive \
|
||||
|| { echo "csmock command failed"; exit 2; }
|
||||
|
||||
tar xJf $CSMOCK_TXZ $CSMOCK_ERR --strip-components 1 \
|
||||
&& test -s $CSMOCK_ERR \
|
||||
&& { echo "csmock discovered important errors"; echo 3; }
|
||||
|
||||
exit 0
|
||||
@@ -1,31 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
DIR="_spellcheck"
|
||||
|
||||
[ ! -d $DIR ] && mkdir $DIR
|
||||
|
||||
echo "[SPELLINTIAN]"
|
||||
git ls-tree -rz --name-only HEAD | grep -Evz -e '\.(pdf|xz)$' -e ^po/ | \
|
||||
xargs -r0 spellintian | \
|
||||
grep -v "(duplicate word)" | \
|
||||
grep -v "docs/" | tee $DIR/spell1.txt
|
||||
|
||||
echo "[CODESPELL]"
|
||||
git ls-tree -rz --name-only HEAD | grep -Evz -e '\.(pdf|xz)$' -e ^po/ | \
|
||||
xargs -r0 codespell | \
|
||||
grep -v "EXPCT" | \
|
||||
grep -v "params, prams" | \
|
||||
grep -v "pad, padded" | \
|
||||
grep -v "CIPHER, CHIP" | \
|
||||
grep -v "gost" | \
|
||||
grep -v "userA" | \
|
||||
grep -v "re-use" | \
|
||||
grep -v "fo ==" | \
|
||||
grep -v "docs/" | tee $DIR/spell2.txt
|
||||
|
||||
|
||||
[ -s $DIR/spell1.txt ] && exit 1
|
||||
[ -s $DIR/spell2.txt ] && exit 2
|
||||
|
||||
exit 0
|
||||
@@ -1,18 +0,0 @@
|
||||
### Issue description
|
||||
<!-- Please, shortly describe the issue here. -->
|
||||
|
||||
### Steps for reproducing the issue
|
||||
<!-- How it can be reproduced? Include all important steps. -->
|
||||
|
||||
### Additional info
|
||||
<!-- Please mention what distribution you are using. -->
|
||||
|
||||
### Debug log
|
||||
<!-- Paste a debug log of the failing command (add --debug option) between the markers below (to keep raw debug format).-->
|
||||
<!-- We need a lot of information from the debug log; without it, we cannot process your report. -->
|
||||
<!-- Debug log does not contain any private information. Do not paste private data; we'll ask you for more information if needed. -->
|
||||
```
|
||||
Output with --debug option:
|
||||
|
||||
```
|
||||
<!-- NOTE: WITHOUT DEBUG LOG, THE BUG REPORT WILL BE CLOSED. ALSO, PLEASE DO NOT TRY TO REMOVE PARTS OF THE DEBUG LOG! -->
|
||||
@@ -1,5 +0,0 @@
|
||||
### Documentation issue
|
||||
<!-- Please, shortly describe the issue in documentation here. -->
|
||||
|
||||
### Additional info
|
||||
<!-- Please mention what cryptsetup version you are using. -->
|
||||
@@ -1,5 +0,0 @@
|
||||
### New feature description
|
||||
<!-- Please, shortly describe the requested feature here. -->
|
||||
|
||||
### Additional info
|
||||
<!-- Please mention what distribution and cryptsetup version you are using. -->
|
||||
5
AUTHORS
5
AUTHORS
@@ -1,4 +1,3 @@
|
||||
Jana Saout <jana@saout.de>
|
||||
Christophe Saout <christophe@saout.de>
|
||||
Clemens Fruhwirth <clemens@endorphin.org>
|
||||
Milan Broz <gmazyland@gmail.com>
|
||||
Ondrej Kozina <okozina@redhat.com>
|
||||
Milan Broz <asi@ucw.cz>
|
||||
|
||||
158
CONTRIBUTING.md
158
CONTRIBUTING.md
@@ -1,158 +0,0 @@
|
||||
Contributing to cryptsetup
|
||||
==========================
|
||||
For basic information about the cryptsetup project, please read [README](README.md).
|
||||
|
||||
The Cryptsetup project uses free, open-source licenses; details are described in [licensing](README.licensing).
|
||||
|
||||
For contribution code or documentation to the cryptsetup project, you must have the necessary rights to the content, and your contribution must be provided under the required license.
|
||||
|
||||
We welcome contributions from everyone.
|
||||
|
||||
Cryptsetup is an independent project with much volunteer effort, and our resources are limited.
|
||||
Following the guidelines specified in this file makes it easier for us to process your issue.
|
||||
|
||||
Project maintainers can remove or reject abusive or otherwise unacceptable comments or code.
|
||||
|
||||
Git repository
|
||||
--------------
|
||||
The primary repository is located at [gitlab.com/cryptsetup/cryptsetup](https://gitlab.com/cryptsetup/cryptsetup).
|
||||
The development branch is ``main``; minor stable releases can use their branches with cherry-picked or backported patches.
|
||||
|
||||
There are backup mirrors located at [github.com/mbroz/cryptsetup](https://github.com/mbroz/cryptsetup) and [git.kernel.org/pub/scm/utils/cryptsetup/cryptsetup.git](https://git.kernel.org/pub/scm/utils/cryptsetup/cryptsetup.git).
|
||||
|
||||
How to make a bug report
|
||||
------------------------
|
||||
To report an issue or feature request, please use GitLab [cryptsetup issue tracker](https://gitlab.com/cryptsetup/cryptsetup/-/issues).
|
||||
|
||||
Before reporting an issue, please try to search documentation and existing issues. Always try to reproduce the problem on the latest supported release.
|
||||
Please *always* collect and attach ``--debug`` log and other information as instructed in the issue template.
|
||||
Even if you think the problem is obvious, we need logged information about the environment (like versions of kernel modules, etc.).
|
||||
|
||||
Please do not report distribution-specific issues if they are not present in the latest upstream release.
|
||||
For such reports, please use downstream distribution-specific trackers.
|
||||
If the issue is related to upstream, downstream maintainers will redirect you here, or upstream maintainers will join the discussion.
|
||||
|
||||
If you think that you found some security bug, please follow the instructions in the [SECURITY](SECURITY.md) file.
|
||||
|
||||
How to contribute changes to cryptsetup
|
||||
---------------------------------------
|
||||
The following notes are a very short introduction to cryptsetup internal processes and an overview of generic rules that should be followed for all changes.
|
||||
|
||||
Changes from developers and external contributors should go through the GitLab repository [merge reguests](https://gitlab.com/cryptsetup/cryptsetup/-/merge_requests).
|
||||
Alternatively (for trivial changes), you can send a patch to [cryptsetup mailing list](mailto:cryptsetup@lists.linux.dev).
|
||||
|
||||
Please do not write personal emails with questions or patches to maintainers and developers.
|
||||
|
||||
### Project structure
|
||||
Cryptsetup projects include a libcryptsetup library, tools, token plugins, documentation, and a test suite.
|
||||
|
||||
Cryptsetup library (libcryptsetup) exports [versioned symbols](lib/libcryptsetup.sym).
|
||||
Tools (cryptsetup, veritysetup, integritysetup) use libcryptsetup shared library.
|
||||
Some isolated parts in the lib directory can be reused for tools (the source is recompiled).
|
||||
|
||||
The basic directory structure in the repository is
|
||||
```
|
||||
├── docs - Documentation and release notes.
|
||||
├── lib - libcryptsetup implementation
|
||||
│ ├── bitlk - Bitlocker format
|
||||
│ ├── crypto_backend - Cryptography backend
|
||||
│ ├── fvault2 - FileVault2 format
|
||||
│ ├── integrity - Linux dm-integrity interface
|
||||
│ ├── loopaes - Linux LoopAES format
|
||||
│ ├── luks1 - LUKS1 format
|
||||
│ ├── luks2 - LUKS2 format including OPAL2 SED
|
||||
│ ├── tcrypt - TrueCrypt / VeraCrypt format
|
||||
│ └── verity - Linux dm-verity interface
|
||||
├── man - Manual pages (in AsciiDoc format)
|
||||
├── misc - Miscellaneous additions
|
||||
├── po - Translation files
|
||||
├── scripts - Scripts for system configuration
|
||||
├── src - Tools implementation
|
||||
├── tests - Testsuite (test units, regression tests, fuzzing)
|
||||
└── tokens - Token plugins
|
||||
```
|
||||
### Coordination with other projects
|
||||
The cryptsetup tools and library use low-level functions that depend on many other subsystems.
|
||||
Currently, the project is supported only for Linux (it will not work on Android or other systems).
|
||||
|
||||
Cryptsetup project requires some parts of the Linux kernel, notably the *Device Mapper* (dm-crypt, dm-integrity, dm-verity, dm-zero modules) and kernel *userspace cryptographic interface*.
|
||||
Missing kernel interface can significantly limit (or even disallow) cryptsetup functionality.
|
||||
|
||||
Integration in operating systems also depends on several other projects, most notably *systemd* (that implements its own tooling using libcryptsetup) and *util-Linux* (*blkid* parsing of supported format metadata). Some changes must be synchronized in all needed places (kernel, blkid, libcryptsetup).
|
||||
|
||||
Several other projects implement their own token metadata (either through binary token plugins or through generic libcryptsetup JSON token access functions).
|
||||
|
||||
### Used cryptography algorithms
|
||||
Cryptsetup avoids implementing cryptographic primitives but uses cryptographic libraries.
|
||||
Exceptions were PBKDF internal implementations - PBKDF2 and Argon2 until these were integrated into major cryptographic libraries.
|
||||
|
||||
Cryptsetup can be compiled with several cryptographic libraries backend (OpenSSL, libgcrypt, Nettle, NSS, and Linux kernel userspace API).
|
||||
OpenSSL is the default and strongly recommended configuration.
|
||||
|
||||
If the cryptographic library does not implement some cryptographic primitive (for example, if running in a FIPS-140 environment or just
|
||||
because it does not include it at all), functionality could be limited.
|
||||
|
||||
### Configuration and versioning
|
||||
Cryptsetup can be configured using *Autoconf* or *Meson*. Autoconf support is being deprecated in the long term.
|
||||
Currently, all new configuration options must be implemented in both systems.
|
||||
|
||||
Cryptsetup intentionally does not use a system configuration file (located in /etc).
|
||||
All functionality must be determined dynamically.
|
||||
|
||||
All related /etc configuration files (crypttab, fstab and others) are maintained by systemd (in some legacy distributions by cryptsetup downstream).
|
||||
|
||||
Cryptsetup uses [semantic versioning](https://semver.org/).
|
||||
Major and minor releases are always based on the main git branch; the minor stable (patch) versions can have some specific branch with backported or cherry-picked patches (from the main branch).
|
||||
Usually, minor releases happen twice per year and stable patch updates according to reported bugs (in 1-3 month intervals).
|
||||
|
||||
### Compilation and debugging
|
||||
The library and tools are written in C language; we require C99 and support gcc and Clang compilers.
|
||||
Manual pages are generated from AsciiDoc sources and libcryptsetup API documentation by Doxygen (from libcryptsetup.h comments).
|
||||
Testsuite is a combination of local C utilities, fuzzing implementation in C++, bash scripts, and uses many other system utilities.
|
||||
|
||||
All tools contain compiled-in debug messages that are available through --debug options.
|
||||
|
||||
With Autoconf and libtool, you can run the cryptsetup tool in the debugger without installation using this one-line script:
|
||||
```
|
||||
libtool --mode=execute gdb --args ./cryptsetup --debug $@
|
||||
```
|
||||
This will ensure that a properly compiled libcryptsetup file is used.
|
||||
|
||||
### Coding style
|
||||
Cryptsetup uses [Linux kernel coding style](https://cdn.kernel.org/doc/html/latest/process/coding-style.html) for libcryptsetup and tools (where applicable) with some additional notes:
|
||||
- Use tabulators for indentation; the line should not exceed 100 characters with an 8-character tabulator. Otherwise, use a tab of any length. :-).
|
||||
- The minimal C standard required is C99.
|
||||
- The ``goto`` use is allowed only for error path (``goto out`` for common code path, ``goto err`` for specific error code path).
|
||||
- Split patches per change; do not submit huge patches combining several changes.
|
||||
- Use an elaborative description in the patch header.
|
||||
- No need to use sign-off-by lines.
|
||||
- Use name prefixes (``crypt_``, ``LUKS2_`` and similar).
|
||||
- Avoid extensive preprocessor use (specifically conditional ``#if`` or ``#ifdef`` sections).
|
||||
- To check detected configuration options stored in config.h, always use ``#if SOMETHING`` (do NOT use ``#ifdef``).
|
||||
- Use output only through ``log_err, log_std, log_verbose, log_dbg`` macros.
|
||||
The ``log_dbg`` is always in English; the others should be wrapped in the ``_()`` macro for translation.
|
||||
- Use ``assert()`` but only for simple invariants and variables (avoid calling functions).
|
||||
Do not use assert for user-defined input (this should be a normal error path).
|
||||
- The code style is quite relaxed in testing scripts (code there is not intended for production use).
|
||||
|
||||
### General rules and testing
|
||||
- Cryptsetup should work on all architectures supported by the Linux kernel.
|
||||
Only very few functionalities require specific hardware (notably Opal SED support).
|
||||
If you want to introduce some specific hardware support, please discuss it with the maintainers first.
|
||||
|
||||
- All code changes should go through merge requests and reviews.
|
||||
Code can be merged after review approval (done by someone with the commit right to the development repository), but reviews from external people are very welcome, too.
|
||||
|
||||
- All new functionality must come with at least rudimentary coverage in the test suite.
|
||||
Always run the test suite before opening the merge request (``make check`` with root privilege).
|
||||
|
||||
- We have continuous integration (CI) that runs many tests automatically, but the output is not directly visible for external merge request authors (for security reasons).
|
||||
All CI scripts are available in .gitlab and .github folders in the project repository.
|
||||
|
||||
Maintainers will provide you log files if anything fails. Your code must produce no warnings before it is merged.
|
||||
|
||||
- We run compilation with many extended [gcc](.gitlab/ci/gcc-Wall) and [Clang](.gitlab/ci/clang-Wall) warnings and include some analyzers, notably
|
||||
- [Coverity](https://scan.coverity.com), GitHub CodeQL, Clang scan-build, and gcc static analyzer, and
|
||||
- fuzzing integrated in [OSS-fuzz project](https://github.com/google/oss-fuzz/tree/master/projects/cryptsetup).
|
||||
|
||||
- Testsuite can also partially run under Valgrind dynamic analyzer with ``make valgrind-check``.
|
||||
56
COPYING
56
COPYING
@@ -1,12 +1,12 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
|
||||
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
@@ -15,7 +15,7 @@ software--to make sure the software is free for all its users. This
|
||||
General Public License applies to most of the Free Software
|
||||
Foundation's software and to any other program whose authors commit to
|
||||
using it. (Some other Free Software Foundation software is covered by
|
||||
the GNU Lesser General Public License instead.) You can apply it to
|
||||
the GNU Library General Public License instead.) You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
@@ -55,8 +55,8 @@ patent must be licensed for everyone's free use or not licensed at all.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License applies to any program or other work which contains
|
||||
@@ -110,7 +110,7 @@ above, provided that you also meet all of these conditions:
|
||||
License. (Exception: if the Program itself is interactive but
|
||||
does not normally print such an announcement, your work based on
|
||||
the Program is not required to print an announcement.)
|
||||
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Program,
|
||||
and can be reasonably considered independent and separate works in
|
||||
@@ -168,7 +168,7 @@ access to copy from a designated place, then offering equivalent
|
||||
access to copy the source code from the same place counts as
|
||||
distribution of the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
|
||||
4. You may not copy, modify, sublicense, or distribute the Program
|
||||
except as expressly provided under this License. Any attempt
|
||||
otherwise to copy, modify, sublicense or distribute the Program is
|
||||
@@ -225,7 +225,7 @@ impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
|
||||
8. If the distribution and/or use of the Program is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Program under this License
|
||||
@@ -255,7 +255,7 @@ make exceptions for this. Our decision will be guided by the two goals
|
||||
of preserving the free status of all derivatives of our free software and
|
||||
of promoting the sharing and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
NO WARRANTY
|
||||
|
||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
@@ -277,9 +277,9 @@ YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
@@ -303,16 +303,17 @@ the "copyright" line and a pointer to where the full notice is found.
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License along
|
||||
with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program; if not, write to the Free Software
|
||||
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program is interactive, make it output a short notice like this
|
||||
when it starts in an interactive mode:
|
||||
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
@@ -335,20 +336,5 @@ necessary. Here is a sample; alter the names:
|
||||
This General Public License does not permit incorporating your program into
|
||||
proprietary programs. If your program is a subroutine library, you may
|
||||
consider it more useful to permit linking proprietary applications with the
|
||||
library. If this is what you want to do, use the GNU Lesser General
|
||||
library. If this is what you want to do, use the GNU Library General
|
||||
Public License instead of this License.
|
||||
|
||||
-----
|
||||
In addition, as a special exception, the copyright holders give
|
||||
permission to link the code of portions of this program with the
|
||||
OpenSSL library under certain conditions as described in each
|
||||
individual source file, and distribute linked combinations
|
||||
including the two.
|
||||
|
||||
You must obey the GNU General Public License in all respects
|
||||
for all of the code used other than OpenSSL. If you modify
|
||||
file(s) with this exception, you may extend this exception to your
|
||||
version of the file(s), but you are not obligated to do so. If you
|
||||
do not wish to do so, delete this exception statement from your
|
||||
version. If you delete this exception statement from all source
|
||||
files in the program, then also delete it here.
|
||||
|
||||
@@ -1,219 +1,3 @@
|
||||
2012-12-21 Milan Broz <gmazyland@gmail.com>
|
||||
* Since version 1.6 This file is no longer maintained.
|
||||
* See version control log http://code.google.com/p/cryptsetup/source/list
|
||||
|
||||
2012-10-11 Milan Broz <gmazyland@gmail.com>
|
||||
* Added keyslot checker (by Arno Wagner).
|
||||
* Version 1.5.1.
|
||||
|
||||
2012-09-11 Milan Broz <gmazyland@gmail.com>
|
||||
* Add crypt_keyslot_area() API call.
|
||||
|
||||
2012-08-27 Milan Broz <gmazyland@gmail.com>
|
||||
* Optimize seek to keyfile-offset (Issue #135, thx to dreisner).
|
||||
* Fix luksHeaderBackup for very old v1.0 unaligned LUKS headers.
|
||||
|
||||
2012-08-12 Milan Broz <gmazyland@gmail.com>
|
||||
* Allocate loop device late (only when real block device needed).
|
||||
* Rework underlying device/file access functions.
|
||||
* Create hash image if doesn't exist in veritysetup format.
|
||||
* Provide better error message if running as non-root user (device-mapper, loop).
|
||||
|
||||
2012-07-10 Milan Broz <gmazyland@gmail.com>
|
||||
* Version 1.5.0.
|
||||
|
||||
2012-06-25 Milan Broz <gmazyland@gmail.com>
|
||||
* Add --device-size option for reencryption tool.
|
||||
* Switch to use unit suffix for --reduce-device-size option.
|
||||
* Remove open device debugging feature (no longer needed).
|
||||
* Fix library name for FIPS check.
|
||||
|
||||
2012-06-20 Milan Broz <gmazyland@gmail.com>
|
||||
* Version 1.5.0-rc2.
|
||||
|
||||
2012-06-18 Milan Broz <gmazyland@gmail.com>
|
||||
* Introduce cryptsetup-reencrypt - experimental offline LUKS reencryption tool.
|
||||
* Fix luks-header-from-active script (do not use LUKS header on-disk, add UUID).
|
||||
* Add --test-passphrase option for luksOpen (check passphrase only).
|
||||
|
||||
2012-06-11 Milan Broz <gmazyland@gmail.com>
|
||||
* Introduce veritysetup for dm-verity target management.
|
||||
* Version 1.5.0-rc1.
|
||||
|
||||
2012-06-10 Milan Broz <gmazyland@gmail.com>
|
||||
* Both data and header device can now be a file.
|
||||
* Loop is automatically allocated in crypt_set_data_device().
|
||||
* Require only up to last keyslot area for header device (ignore data offset).
|
||||
* Fix header backup and restore to work on files with large data offset.
|
||||
|
||||
2012-05-27 Milan Broz <gmazyland@gmail.com>
|
||||
* Fix readonly activation if underlying device is readonly (1.4.0).
|
||||
* Include stddef.h in libdevmapper.h (size_t definition).
|
||||
* Version 1.4.3.
|
||||
|
||||
2012-05-21 Milan Broz <gmazyland@gmail.com>
|
||||
* Add --enable-fips for linking with fipscheck library.
|
||||
* Initialize binary and library selfcheck if running in FIPS mode.
|
||||
* Use FIPS RNG in FIPS mode for KEY and SALT (only gcrypt backend supported).
|
||||
|
||||
2012-05-09 Milan Broz <gmazyland@gmail.com>
|
||||
* Fix keyslot removal (wipe keyslot) for device with 4k hw block (1.4.0).
|
||||
* Allow empty cipher (cipher_null) for testing.
|
||||
|
||||
2012-05-02 Milan Broz <gmazyland@gmail.com>
|
||||
* Fix loop mapping on readonly file.
|
||||
* Relax --shared test, allow mapping even for overlapping segments.
|
||||
* Support shared flag for LUKS devices (dangerous).
|
||||
* Switch on retry on device remove for libdevmapper.
|
||||
* Allow "private" activation (skip some udev global rules) flag.
|
||||
|
||||
2012-04-09 Milan Broz <gmazyland@gmail.com>
|
||||
* Fix header check to support old (cryptsetup 1.0.0) header alignment. (1.4.0)
|
||||
* Version 1.4.2.
|
||||
|
||||
2012-03-16 Milan Broz <gmazyland@gmail.com>
|
||||
* Add --keyfile-offset and --new-keyfile-offset parameters to API and CLI.
|
||||
* Add repair command and crypt_repair() for known LUKS metadata problems repair.
|
||||
* Allow one to specify --align-payload only for luksFormat.
|
||||
|
||||
2012-03-16 Milan Broz <mbroz@redhat.com>
|
||||
* Unify password verification option.
|
||||
* Support password verification with quiet flag if possible. (1.2.0)
|
||||
* Fix retry if entered passphrases (with verify option) do not match.
|
||||
* Support UUID=<LUKS_UUID> format for device specification.
|
||||
|
||||
2012-02-11 Milan Broz <mbroz@redhat.com>
|
||||
* Add --master-key-file option to luksOpen (open using volume key).
|
||||
|
||||
2012-01-12 Milan Broz <mbroz@redhat.com>
|
||||
* Fix use of empty keyfile.
|
||||
|
||||
2011-11-13 Milan Broz <mbroz@redhat.com>
|
||||
* Fix error message for luksClose and detached LUKS header.
|
||||
* Allow --header for status command to get full info with detached header.
|
||||
|
||||
2011-11-09 Milan Broz <mbroz@redhat.com>
|
||||
* Version 1.4.1.
|
||||
|
||||
2011-11-05 Milan Broz <mbroz@redhat.com>
|
||||
* Merge pycryptsetup (Python libcryptsetup bindings).
|
||||
* Fix stupid typo in set_iteration_time API call.
|
||||
* Fix cryptsetup status output if parameter is device path.
|
||||
|
||||
2011-10-27 Milan Broz <mbroz@redhat.com>
|
||||
* Fix crypt_get_volume_key_size() for plain device.
|
||||
* Fix FSF address in license text.
|
||||
|
||||
2011-10-25 Milan Broz <mbroz@redhat.com>
|
||||
* Print informative message in isLuks only in verbose mode.
|
||||
* Version 1.4.0.
|
||||
|
||||
2011-10-10 Milan Broz <mbroz@redhat.com>
|
||||
* Version 1.4.0-rc1.
|
||||
|
||||
2011-10-05 Milan Broz <mbroz@redhat.com>
|
||||
* Support Nettle 2.4 crypto backend (for ripemd160).
|
||||
* If device is not rotational, do not use Gutmann wipe method.
|
||||
* Add crypt_last_error() API call.
|
||||
* Fix luksKillSLot exit code if slot is inactive or invalid.
|
||||
* Fix exit code if passphrases do not match in luksAddKey.
|
||||
* Add LUKS on-disk format description into package.
|
||||
|
||||
2011-09-22 Milan Broz <mbroz@redhat.com>
|
||||
* Support key-slot option for luksOpen (use only explicit keyslot).
|
||||
|
||||
2011-08-22 Milan Broz <mbroz@redhat.com>
|
||||
* Add more paranoid checks for LUKS header and keyslot attributes.
|
||||
* Fix crypt_load to properly check device size.
|
||||
* Use new /dev/loop-control (kernel 3.1) if possible.
|
||||
* Enhance check of device size before writing LUKS header.
|
||||
* Do not allow context format of already formatted device.
|
||||
|
||||
2011-07-25 Milan Broz <mbroz@redhat.com>
|
||||
* Remove hash/hmac restart from crypto backend and make it part of hash/hmac final.
|
||||
* Improve check for invalid offset and size values.
|
||||
|
||||
2011-07-19 Milan Broz <mbroz@redhat.com>
|
||||
* Revert default initialisation of volume key in crypt_init_by_name().
|
||||
* Do not allow key retrieval while suspended (key could be wiped).
|
||||
* Do not allow suspend for non-LUKS devices.
|
||||
* Support retries and timeout parameters for luksSuspend.
|
||||
* Add --header option for detached metadata (on-disk LUKS header) device.
|
||||
* Add crypt_init_by_name_and_header() and crypt_set_data_device() to API.
|
||||
* Allow different data offset setting for detached header.
|
||||
|
||||
2011-07-07 Milan Broz <mbroz@redhat.com>
|
||||
* Remove old API functions (all functions using crypt_options).
|
||||
* Add --enable-discards option to allow discards/TRIM requests.
|
||||
* Add crypt_get_iv_offset() function to API.
|
||||
|
||||
2011-07-01 Milan Broz <mbroz@redhat.com>
|
||||
* Add --shared option for creating non-overlapping crypt segments.
|
||||
* Add shared flag to libcryptsetup api.
|
||||
* Fix plain crypt format parameters to include size option (API change).
|
||||
|
||||
2011-06-08 Milan Broz <mbroz@redhat.com>
|
||||
* Fix return code for status command when device doesn't exists.
|
||||
|
||||
2011-05-24 Milan Broz <mbroz@redhat.com>
|
||||
* Version 1.3.1.
|
||||
|
||||
2011-05-17 Milan Broz <mbroz@redhat.com>
|
||||
* Fix keyfile=- processing in create command (1.3.0).
|
||||
* Simplify device path status check.
|
||||
|
||||
2011-05-03 Milan Broz <mbroz@redhat.com>
|
||||
* Do not ignore size argument for create command (1.2.0).
|
||||
|
||||
2011-04-18 Milan Broz <mbroz@redhat.com>
|
||||
* Fix error paths in blockwise code and lseek_write call.
|
||||
* Add Nettle crypto backend support.
|
||||
|
||||
2011-04-05 Milan Broz <mbroz@redhat.com>
|
||||
* Version 1.3.0.
|
||||
|
||||
2011-03-22 Milan Broz <mbroz@redhat.com>
|
||||
* Also support --skip and --hash option for loopaesOpen.
|
||||
* Fix return code when passphrase is read from pipe.
|
||||
* Document cryptsetup exit codes.
|
||||
|
||||
2011-03-18 Milan Broz <mbroz@redhat.com>
|
||||
* Respect maximum keyfile size parameter.
|
||||
* Introduce maximum default keyfile size, add configure option.
|
||||
* Require the whole key read from keyfile in create command (broken in 1.2.0).
|
||||
* Fix offset option for loopaesOpen.
|
||||
* Lock memory also in luksDump command.
|
||||
* Version 1.3.0-rc2.
|
||||
|
||||
2011-03-14 Milan Broz <mbroz@redhat.com>
|
||||
* Version 1.3.0-rc1.
|
||||
|
||||
2011-03-11 Milan Broz <mbroz@redhat.com>
|
||||
* Add loop manipulation code and support mapping of images in file.
|
||||
* Add backing device loop info into status message.
|
||||
* Add luksChangeKey command.
|
||||
|
||||
2011-03-05 Milan Broz <mbroz@redhat.com>
|
||||
* Add exception to COPYING for binary distribution linked with OpenSSL library.
|
||||
* Set secure data flag (wipe all ioctl buffers) if devmapper library supports it.
|
||||
|
||||
2011-01-29 Milan Broz <mbroz@redhat.com>
|
||||
* Fix mapping removal if device disappeared but node still exists.
|
||||
* Fix luksAddKey return code if master key is used.
|
||||
|
||||
2011-01-25 Milan Broz <mbroz@redhat.com>
|
||||
* Add loop-AES handling (loopaesOpen and loopaesClose commands).
|
||||
(requires kernel 2.6.38 and above)
|
||||
|
||||
2011-01-05 Milan Broz <mbroz@redhat.com>
|
||||
* Fix static build (--disable-static-cryptsetup now works properly).
|
||||
|
||||
2010-12-30 Milan Broz <mbroz@redhat.com>
|
||||
* Add compile time crypto backends implementation
|
||||
(gcrypt, OpenSSL, NSS and userspace Linux kernel crypto api).
|
||||
* Currently NSS is lacking ripemd160, cannot provide full plain compatibility.
|
||||
* Use --with-crypto_backend=[gcrypt|openssl|nss|kernel] to configure.
|
||||
|
||||
2010-12-20 Milan Broz <mbroz@redhat.com>
|
||||
* Version 1.2.0.
|
||||
|
||||
@@ -228,7 +12,7 @@
|
||||
* Fix password callback call.
|
||||
* Fix default plain password entry from terminal in activate_by_passphrase.
|
||||
* Add --dump-master-key option for luksDump to allow volume key dump.
|
||||
* Allow one to activate by internally cached volume key
|
||||
* Allow to activate by internally cached volume key
|
||||
(format/activate without keyslots active - used for temporary devices).
|
||||
* Initialize volume key from active device in crypt_init_by_name()
|
||||
* Fix cryptsetup binary exitcodes.
|
||||
@@ -334,13 +118,13 @@
|
||||
* Version 1.1.0.
|
||||
|
||||
2010-01-10 Milan Broz <mbroz@redhat.com>
|
||||
* Fix initialisation of gcrypt during luksFormat.
|
||||
* Convert hash name to lower case in header (fix sha1 backward compatible header)
|
||||
* Fix initialisation of gcrypt duting luksFormat.
|
||||
* Convert hash name to lower case in header (fix sha1 backward comatible header)
|
||||
* Check for minimum required gcrypt version.
|
||||
|
||||
2009-12-30 Milan Broz <mbroz@redhat.com>
|
||||
* Fix key slot iteration count calculation (small -i value was the same as default).
|
||||
* The slot and key digest iteration minimum is now 1000.
|
||||
* The slot and key digest iteration minimun is now 1000.
|
||||
* The key digest iteration # is calculated from iteration time (approx 1/8 of that).
|
||||
* Version 1.1.0-rc4.
|
||||
|
||||
@@ -395,16 +179,16 @@
|
||||
* Require device device-mapper to build and do not use backend wrapper for dm calls.
|
||||
* Move memory locking and dm initialization to command layer.
|
||||
* Increase priority of process if memory is locked.
|
||||
* Add log macros and make logging more consistent.
|
||||
* Add log macros and make logging modre consitent.
|
||||
* Move command successful messages to verbose level.
|
||||
* Introduce --debug parameter.
|
||||
* Move device utils code and provide context parameter (for log).
|
||||
* Keyfile now must be provided by path, only stdin file descriptor is used (api only).
|
||||
* Do not call isatty() on closed keyfile descriptor.
|
||||
* Run performance check for PBKDF2 from LUKS code, do not mix hash algorithms results.
|
||||
* Run performance check for PBKDF2 from LUKS code, do not mix hash algoritms results.
|
||||
* Add ability to provide pre-generated master key and UUID in LUKS header format.
|
||||
* Add LUKS function to verify master key digest.
|
||||
* Move key slot manipulation function into LUKS specific code.
|
||||
* Move key slot manuipulation function into LUKS specific code.
|
||||
* Replace global options struct with separate parameters in helper functions.
|
||||
* Add new libcryptsetup API (documented in libcryptsetup.h).
|
||||
* Implement old API calls using new functions.
|
||||
@@ -412,7 +196,7 @@
|
||||
* Add --master-key-file option for luksFormat and luksAddKey.
|
||||
|
||||
2009-08-17 Milan Broz <mbroz@redhat.com>
|
||||
* Fix PBKDF2 speed calculation for large passphrases.
|
||||
* Fix PBKDF2 speed calculation for large passhrases.
|
||||
* Allow using passphrase provided in options struct for LuksOpen.
|
||||
* Allow restrict keys size in LuksOpen.
|
||||
|
||||
@@ -424,7 +208,7 @@
|
||||
* Switch PBKDF2 from internal SHA1 to libgcrypt, make hash algorithm not hardcoded to SHA1 here.
|
||||
* Add required parameters for changing hash used in LUKS key setup scheme.
|
||||
* Do not export simple XOR helper now used only inside AF functions.
|
||||
* Completely remove internal SHA1 implementation code, not needed anymore.
|
||||
* Completely remove internal SHA1 implementanion code, not needed anymore.
|
||||
* Enable hash algorithm selection for LUKS through -h luksFormat option.
|
||||
|
||||
2009-07-28 Milan Broz <mbroz@redhat.com>
|
||||
@@ -520,7 +304,7 @@
|
||||
* configure.in (AC_OUTPUT): Add m4/Makefile.
|
||||
(AM_GNU_GETTEXT_VERSION): Bump to 0.15.
|
||||
|
||||
2006-10-22 David Härdeman <david@hardeman.nu>
|
||||
2006-10-22 David Härdeman <david@hardeman.nu>
|
||||
|
||||
* Allow hashing of keys passed through stdin.
|
||||
|
||||
@@ -587,7 +371,7 @@
|
||||
|
||||
2006-08-04 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
|
||||
* lib/setup.c (get_key): Applied patch from David Härdeman
|
||||
* lib/setup.c (get_key): Applied patch from David Härdeman
|
||||
<david@2gen.com> for reading binary keys from stdin using
|
||||
the "-" as key file.
|
||||
|
||||
@@ -604,7 +388,7 @@
|
||||
|
||||
2006-07-23 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
|
||||
* Applied patches from David Härdeman <david@2gen.com> to fix 64
|
||||
* Applied patches from David Härdeman <david@2gen.com> to fix 64
|
||||
bit compiler warning issues.
|
||||
|
||||
2006-05-19 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
@@ -623,7 +407,7 @@
|
||||
|
||||
* configure.in: Release 1.0.3.
|
||||
|
||||
* Applied patch by Johannes Weißl for more meaningful exit codes
|
||||
* Applied patch by Johannes Weißl for more meaningful exit codes
|
||||
and password retries
|
||||
|
||||
2006-03-30 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
@@ -636,7 +420,7 @@
|
||||
|
||||
2006-03-15 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
|
||||
* configure.in: 1.0.3-rc3. Most displease release ever.
|
||||
* configure.in: 1.0.3-rc3. Most unplease release ever.
|
||||
* lib/setup.c (__crypt_create_device): More verbose error message.
|
||||
|
||||
2006-02-26 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
@@ -705,7 +489,7 @@
|
||||
|
||||
2005-12-06 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
|
||||
* man/cryptsetup.8: Correct "seconds" to "microseconds" in the explanation for -i.
|
||||
* man/cryptsetup.8: Correct "seconds" to "microseconds" in the explaination for -i.
|
||||
|
||||
2005-11-09 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
|
||||
@@ -726,7 +510,7 @@
|
||||
|
||||
2005-09-08 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
|
||||
* lib/setup.c (get_key): Fixed another incompatibility with
|
||||
* lib/setup.c (get_key): Fixed another incompatiblity with
|
||||
original cryptsetup.
|
||||
|
||||
2005-08-20 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
@@ -816,7 +600,7 @@
|
||||
|
||||
* man/cryptsetup.1: Add man page.
|
||||
|
||||
* lib/setup.c: Remove unnecessary LUKS_write_phdr call, so the
|
||||
* lib/setup.c: Remove unneccessary LUKS_write_phdr call, so the
|
||||
phdr is written after passphrase reading, so the user can change
|
||||
his mind, and not have a partial written LUKS header on it's disk.
|
||||
|
||||
@@ -834,16 +618,16 @@
|
||||
* lib/utils.c: Add read|write_blockwise functions, to use in
|
||||
O_DIRECT file accesses.
|
||||
|
||||
2004-03-11 Thursday 15:52 Jana Saout <jana@saout.de>
|
||||
2004-03-11 Thursday 15:52 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* lib/blockdev.h: BLKGETSIZE64 really uses size_t as third
|
||||
argument, the rest is wrong.
|
||||
|
||||
2004-03-10 Wednesday 17:50 Jana Saout <jana@saout.de>
|
||||
2004-03-10 Wednesday 17:50 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* lib/: libcryptsetup.h, libdevmapper.c: Small fixes.
|
||||
|
||||
2004-03-09 Tuesday 21:41 Jana Saout <jana@saout.de>
|
||||
2004-03-09 Tuesday 21:41 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* lib/internal.h, lib/libcryptsetup.h, lib/libdevmapper.c,
|
||||
lib/setup.c, po/de.po, src/cryptsetup.c: Added internal flags to
|
||||
@@ -851,7 +635,7 @@
|
||||
add a function to free the memory. Also add a readonly flag to
|
||||
libcryptsetup.
|
||||
|
||||
2004-03-09 Tuesday 16:03 Jana Saout <jana@saout.de>
|
||||
2004-03-09 Tuesday 16:03 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* ChangeLog, configure.in, setup-gettext, lib/Makefile.am,
|
||||
lib/backends.c, lib/blockdev.h, lib/gcrypt.c, lib/internal.h,
|
||||
@@ -859,7 +643,7 @@
|
||||
lib/utils.c, po/de.po, src/Makefile.am, src/cryptsetup.c: More
|
||||
reorganization work.
|
||||
|
||||
2004-03-08 Monday 01:38 Jana Saout <jana@saout.de>
|
||||
2004-03-08 Monday 01:38 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* ChangeLog, Makefile.am, acinclude.m4, configure.in,
|
||||
lib/Makefile.am, lib/backends.c, lib/blockdev.h, lib/gcrypt.c,
|
||||
@@ -867,19 +651,19 @@
|
||||
src/Makefile.am: BLKGETSIZE64 fixes and started modularity
|
||||
enhancements
|
||||
|
||||
2004-03-04 Thursday 21:06 Jana Saout <jana@saout.de>
|
||||
2004-03-04 Thursday 21:06 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* Makefile.am, po/de.po, src/cryptsetup.c, src/cryptsetup.h: First
|
||||
backward compatible working version.
|
||||
|
||||
2004-03-04 Thursday 00:42 Jana Saout <jana@saout.de>
|
||||
2004-03-04 Thursday 00:42 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* NEWS, AUTHORS, ChangeLog, Makefile.am, README, autogen.sh,
|
||||
configure.in, setup-gettext, po/ChangeLog, po/LINGUAS,
|
||||
po/POTFILES.in, po/de.po, src/cryptsetup.c, src/cryptsetup.h,
|
||||
src/Makefile.am (utags: initial): Initial checkin.
|
||||
|
||||
2004-03-04 Thursday 00:42 Jana Saout <jana@saout.de>
|
||||
2004-03-04 Thursday 00:42 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* NEWS, AUTHORS, ChangeLog, Makefile.am, README, autogen.sh,
|
||||
configure.in, setup-gettext, po/ChangeLog, po/LINGUAS,
|
||||
933
FAQ
Normal file
933
FAQ
Normal file
@@ -0,0 +1,933 @@
|
||||
Sections
|
||||
|
||||
1. General Questions
|
||||
2. Setup
|
||||
3. Common Problems
|
||||
4. Troubleshooting
|
||||
5. Security Aspects
|
||||
6. Backup and Data Recovery
|
||||
7. Issues with Specific Versions of cryptsetup
|
||||
A. Contributors
|
||||
|
||||
|
||||
1. General Questions
|
||||
|
||||
|
||||
* What is this?
|
||||
|
||||
This is the FAQ (Frequently Asked Questions) for cryptsetup. It
|
||||
covers Linux disk encryption with plain dm-crypt (one passphrase,
|
||||
no management, no descriptor on disk) and LUKS (multiple user keys
|
||||
with one master key, anti-forensics, descriptor block at start of
|
||||
device, ...). The latest version should usually be available at
|
||||
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
|
||||
|
||||
ATTENTION: If you are going to read just one thing, make it the
|
||||
section on Backup and Data Recovery. By far the most questions on
|
||||
the cryptsetup mailing list are from people that just managed to
|
||||
somehow format or overwrite the start of their LUKS partitions. In
|
||||
most cases, there is nothing that can be done to help these poor
|
||||
souls recover their data. Make sure you understand the problem and
|
||||
limitations imposed by the LUKS security model BEFORE you face such
|
||||
a disaster!
|
||||
|
||||
|
||||
* Who wrote this?
|
||||
|
||||
Current FAQ maintainer is Arno Wagner <arno@wagner.name>. Other
|
||||
contributors are listed at the end. If you want to contribute, send
|
||||
your article, including a descriptive headline, to the maintainer,
|
||||
or the dm-crypt mailing list with something like "FAQ ..." in the
|
||||
subject. Please note that by contributing to this FAQ, you accept
|
||||
the license described below.
|
||||
|
||||
This work is under the "Attribution-Share Alike 3.0 Unported"
|
||||
license, which means distribution is unlimited, you may create
|
||||
derived works, but attributions to original authors and this
|
||||
license statement must be retained and the derived work must be
|
||||
under the same license. See
|
||||
http://creativecommons.org/licenses/by-sa/3.0/ for more details of
|
||||
the license.
|
||||
|
||||
Side note: I did text license research some time ago and I think
|
||||
this license is best suited for the purpose at hand and creates the
|
||||
least problems.
|
||||
|
||||
|
||||
* Where is the project website?
|
||||
|
||||
There is the project website at http://code.google.com/p/cryptsetup/
|
||||
Please do not post questions there, nobody will read them. Use
|
||||
the mailing-list instead.
|
||||
|
||||
|
||||
* Is there a mailing-list?
|
||||
|
||||
Instructions on how to subscribe to the mailing-list are at on the
|
||||
project website. People are generally helpful and friendly on the
|
||||
list.
|
||||
|
||||
The question of how to unsubscribe from the list does crop up
|
||||
sometimes. For this you need your list management URL, which is
|
||||
sent to you initially and once at the start of each month. Go to
|
||||
the URL mentioned in the email and select "unsubscribe". This page
|
||||
also allows you to request a password reminder.
|
||||
|
||||
Alternatively, you can send an Email to dm-crypt-request@saout.de
|
||||
with just the word "help" in the subject or message body. Make sure
|
||||
to send it from your list address.
|
||||
|
||||
|
||||
2. Setup
|
||||
|
||||
|
||||
* Can I encrypt an already existing, non-empty partition to use LUKS?
|
||||
|
||||
There is no converter, and it is not really needed. The way to do
|
||||
this is to make a backup of the device in question, securely wipe
|
||||
the device (as LUKS device initialization does not clear away old
|
||||
data), do a luksFormat, optionally overwrite the encrypted device,
|
||||
create a new filesystem and restore your backup on the now
|
||||
encrypted device. Also refer to sections "Security Aspects" and
|
||||
"Backup and Data Recovery".
|
||||
|
||||
For backup, plain GNU tar works well and backs up anything likely
|
||||
to be in a filesystem.
|
||||
|
||||
|
||||
* How do I use LUKS with a loop-device?
|
||||
|
||||
Just the same as with any block device. If you want, for example,
|
||||
to use a 100MiB file as LUKS container, do something like this:
|
||||
|
||||
head -c 100M /dev/zero > luksfile # create empty file
|
||||
losetup /dev/loop0 luksfile # map luksfile to /dev/loop0
|
||||
cryptsetup luksFormat /dev/loop0 # create LUKS on loop device
|
||||
|
||||
Afterwards just use /dev/loop0 as a you would use a LUKS partition.
|
||||
To unmap the file when done, use "losetup -d /dev/loop0".
|
||||
|
||||
|
||||
* When I add a new key-slot to LUKS, it asks for a passphrase but
|
||||
then complains about there not being a key-slot with that
|
||||
passphrase?
|
||||
|
||||
That is as intended. You are asked a passphrase of an existing
|
||||
key-slot first, before you can enter the passphrase for the new
|
||||
key-slot. Otherwise you could break the encryption by just adding a
|
||||
new key-slot. This way, you have to know the passphrase of one of
|
||||
the already configured key-slots in order to be able to configure a
|
||||
new key-slot.
|
||||
|
||||
|
||||
* How do I read a dm-crypt key from file?
|
||||
|
||||
Note that the file will still be hashed first, just like keyboard
|
||||
input. Use the --key-file option, like this:
|
||||
|
||||
cryptsetup create --key-file keyfile e1 /dev/loop0
|
||||
|
||||
|
||||
* How do I read a LUKS slot key from file?
|
||||
|
||||
What you really do here is to read a passphrase from file, just as
|
||||
you would with manual entry of a passphrase for a key-slot. You can
|
||||
add a new passphrase to a free key-slot, set the passphrase of an
|
||||
specific key-slot or put an already configured passphrase into a
|
||||
file. In the last case make sure no trailing newline (0x0a) is
|
||||
contained in the key file, or the passphrase will not work because
|
||||
the whole file is used as input.
|
||||
|
||||
To add a new passphrase to a free key slot from file, use something
|
||||
like this:
|
||||
|
||||
cryptsetup luksAddKey /dev/loop0 keyfile
|
||||
|
||||
To add a new passphrase to a specific key-slot, use something like
|
||||
this:
|
||||
|
||||
cryptsetup luksAddKey --key-slot 7 /dev/loop0 keyfile
|
||||
|
||||
To supply a key from file to any LUKS command, use the --key-file
|
||||
option, e.g. like this:
|
||||
|
||||
cryptsetup luksOpen --key-file keyfile /dev/loop0 e1
|
||||
|
||||
|
||||
* How do I read the LUKS master key from file?
|
||||
|
||||
The question you should ask yourself first, is why you would want
|
||||
to do this. The only legitimate reason I can think of is if you
|
||||
want to have two LUKS devices with the same master key. Even then,
|
||||
I think it would be preferable to just use key-slots with the same
|
||||
passphrase, or to use plain dm-crypt instead. If you really have a
|
||||
good reason, please tell me. If I am convinced, I will add how to
|
||||
do this here.
|
||||
|
||||
|
||||
* What are the security requirements for a key read from file?
|
||||
|
||||
A file-stored key or passphrase has the same security requirements
|
||||
as one entered interactively, however you can use random bytes and
|
||||
thereby use bytes you cannot type on the keyboard. You can use any
|
||||
file you like as key file, for example a plain text file with a
|
||||
human readable passphrase. To generate a file with random bytes,
|
||||
use something like this:
|
||||
|
||||
head -c 256 /dev/random > keyfile
|
||||
|
||||
|
||||
* If I map a journaled file system using dm-crypt/LUKS, does it still
|
||||
provide its usual transactional guarantees?
|
||||
|
||||
As far as I know it does (but I may be wrong), but please note that
|
||||
these "guarantees" are far weaker than they appear to be. For
|
||||
example, you not not get a hard flush to disk surface even on a
|
||||
call to fsync. In addition, the HDD itself may do independent
|
||||
write reordering. Some other things can go wrong as well. The
|
||||
filesystem developers are aware of these problems and typically
|
||||
can make it work anyways. That said, dm-crypt/LUKS should not make
|
||||
things worse.
|
||||
|
||||
Personally, I have several instances of ext3 on dm-crypt and have
|
||||
not noticed any specific problems.
|
||||
|
||||
Update: I did run into frequent small freezes (1-2 sec) when putting
|
||||
a vmware image on ext3 over dm-crypt. This does indicate that the
|
||||
transactional guarantees are in place, but at a cost. When I went
|
||||
back to ext2, the problem went away. This also seems to have gotten
|
||||
better with kernel 2.6.36 and the reworking of filesystem flush
|
||||
locking. Kernel 2.6.37 is expected to improve this even further.
|
||||
|
||||
|
||||
* Can I use LUKS or cryptsetup with a more secure (external) medium
|
||||
for key storage, e.g. TPM or a smartcard?
|
||||
|
||||
Yes, see the answers on using a file-supplied key. You do have to
|
||||
write the glue-logic yourself though. Basically you can have
|
||||
cryptsetup read the key from STDIN and write it there with your
|
||||
own tool that in turn gets the key from the more secure key
|
||||
storage.
|
||||
|
||||
|
||||
* Can I resize a dm-crypt or LUKS partition?
|
||||
|
||||
Yes, you can, as neither dm-crypt nor LUKS stores partition size.
|
||||
Whether you should is a different question. Personally I recommend
|
||||
backup, recreation of the encrypted partition with new size,
|
||||
recreation of the filesystem and restore. This gets around the
|
||||
tricky business of resizing the filesystem. The backup is really
|
||||
non-optional here, as a lot can go wrong, resulting in partial or
|
||||
complete data loss. Using something like gparted to resize an
|
||||
encrypted partition is slow, but pretty safe and should be fine.
|
||||
This will not change the size of the filesystem hidden under the
|
||||
encryption though.
|
||||
|
||||
You also need to be aware of size-based limitations. The one
|
||||
currently relevant is that aes-xts-plain should not be used for
|
||||
encrypted container sizes larger than 2TiB. Use aes-xts-plain64
|
||||
for that.
|
||||
|
||||
|
||||
3. Common Problems
|
||||
|
||||
|
||||
* My dm-crypt/LUKS mapping does not work! What general steps are
|
||||
there to investigate the problem?
|
||||
|
||||
If you get a specific error message, investigate what it claims
|
||||
first. If not, you may want to check the following things.
|
||||
|
||||
- Check that "/dev", including "/dev/mapper/control" is there. If it
|
||||
is missing, you may have a problem with the "/dev" tree itself or
|
||||
you may have broken udev rules.
|
||||
|
||||
- Check that you have the device mapper and the crypt target in your
|
||||
kernel. The output of "dmsetup targets" should list a "crypt"
|
||||
target. If it is not there or the command fails, add device mapper
|
||||
and crypt-target to the kernel.
|
||||
|
||||
- Check that the hash-functions and ciphers you want to use are in
|
||||
the kernel. The output of "cat /proc/crypto" needs to list them.
|
||||
|
||||
|
||||
* My dm-crypt mapping suddenly stopped when upgrading cryptsetup.
|
||||
|
||||
The default cipher, hash or mode may have changed (the mode changed
|
||||
from 1.0.x to 1.1.x). See under "Issues With Specific Versions of
|
||||
cryptsetup".
|
||||
|
||||
|
||||
* When I call cryptsetup from cron/CGI, I get errors about unknown
|
||||
features?
|
||||
|
||||
If you get errors about unknown parameters or the like that are not
|
||||
present when cryptsetup is called from the shell, make sure you
|
||||
have no older version of cryptsetup on your system that then gets
|
||||
called by cron/CGI.For example some distributions install
|
||||
cryptsetup into /usr/sbin, while a manual install could go to
|
||||
/usr/local/sbin. As a debugging aid, call "cryptsetup --version"
|
||||
from cron/CGI or the non-shell mechanism to be sure you have the
|
||||
right version.
|
||||
|
||||
|
||||
* Unlocking a LUKS device takes very long. Why?
|
||||
|
||||
The iteration time for a key-slot (see Section 5 for an explanation
|
||||
what iteration does) is calculated when setting a passphrase. By
|
||||
default it is 1 second on the machine where the passphrase is set.
|
||||
If you set a passphrase on a fast machine and then unlock it on a
|
||||
slow machine, the unlocking time can be much longer. Also take into
|
||||
account that up to 8 key-slots have to be tried in order to find the
|
||||
right one.
|
||||
|
||||
If this is problem, you can add another key-slot using the slow
|
||||
machine with the same passphrase and then remove the old key-slot.
|
||||
The new key-slot will have an iteration count adjusted to 1 second
|
||||
on the slow machine. Use luksKeyAdd and then luksKillSlot or
|
||||
luksRemoveKey.
|
||||
|
||||
However, this operation will not change volume key iteration count
|
||||
(MK iterations in output of "cryptsetup luksDump"). In order to
|
||||
change that, you will have to backup the data in the LUKS
|
||||
container, luksFormat on the slow machine and restore the data.
|
||||
Note that in the original LUKS specification this value was fixed
|
||||
to 10, but it is now derived from the PBKDF2 benchmark as well and
|
||||
set to iterations in 0.125 sec or 1000, whichever is larger.
|
||||
|
||||
|
||||
* "blkid" sees a LUKS UUID and an ext2/swap UUID on the same device.
|
||||
What is wrong?
|
||||
|
||||
Some old versions of cryptsetup have a bug where the header does
|
||||
not get completely wiped during LUKS format and an older ext2/swap
|
||||
signature remains on the device. This confuses blkid.
|
||||
|
||||
Fix: Wipe the unused header areas by doing a backup and restore of
|
||||
the header with cryptsetup 1.1.x:
|
||||
|
||||
cryptsetup luksHeaderBackup --header-backup-file <file> <device>
|
||||
cryptsetup luksHeaderRestore --header-backup-file <file> <device>
|
||||
|
||||
If you cannot use a 1.1.x cryptsetup, you can also do a manual wipe
|
||||
of the area in question with the command below. Be very, VERY,
|
||||
careful and make sure to do a backup of the header before. If you
|
||||
get this wrong, your device may become permanently inaccessible.
|
||||
|
||||
dd if=/dev/zero of=<device> bs=512 seek=2 count=6
|
||||
|
||||
|
||||
* cryptsetup segfaults on Gentoo amd64 hardened ...
|
||||
|
||||
There seems to be some inteference between the hardening and and
|
||||
the way cryptsetup benchmarks PBKDF2. The solution to this is
|
||||
currently not quite clear for an encrypted root filesystem. For
|
||||
other uses, you can apparently specify USE="dynamic" as compile
|
||||
flag, see http://bugs.gentoo.org/show_bug.cgi?id=283470
|
||||
|
||||
|
||||
4. Troubleshooting
|
||||
|
||||
|
||||
* Can a bad RAM module cause problems?
|
||||
|
||||
LUKS and dm-crypt can give the RAM quite a workout, especially when
|
||||
combined with software RAID. In particular the combination RAID5 +
|
||||
LUKS + XFS seems to uncover RAM problems that never caused obvious
|
||||
problems before. Symptoms vary, but often the problem manifest
|
||||
itself when copying large amounts of data, typically several times
|
||||
larger than your main memory.
|
||||
|
||||
Side note: One thing you should always do on large data movements is
|
||||
to run a verify, for example with the "-d" option of "tar" or by
|
||||
doing a set of MD5 checksums on the source or target with
|
||||
|
||||
find . -type f -exec md5sum \{\} \; > checksum-file
|
||||
|
||||
and then a "md5sum -c checksum-file" on the other side. If you get
|
||||
mismatches here, RAM is the primary suspect. A lesser suspect is
|
||||
an overclocked CPU. I have found countless hardware problems in
|
||||
verify runs after copying or making backups. Bit errors are much
|
||||
more common than most people think.
|
||||
|
||||
Some RAM issues are even worse and corrupt structures in one of the
|
||||
layers. This typically results in lockups, CPU state dumps in the
|
||||
system logs, kernel panic or other things. It is quite possible to
|
||||
have the problem with an encrypted device, but not with an
|
||||
otherwise the same unencrypted device. The reason for that is that
|
||||
encryption has an error amplification property: You flip one bit
|
||||
in an encrypted data block, and the decrypted version has half of
|
||||
its bits flipped. This is an important security property for modern
|
||||
ciphers. With the usual modes in cryptsetup (CBC, ESSIV, XTS), you
|
||||
get up to a completely changed 512 byte block per bit error. A
|
||||
corrupt block causes a lot more havoc than the occasionally
|
||||
flipped single bit and can result various obscure errors.
|
||||
|
||||
Note however that a verify run on copying between encrypted or
|
||||
unencrypted devices can also show you corruption when the copying
|
||||
itself did not report any problems. If you find defect RAM, assume
|
||||
all backups and copied data to be suspect, unless you did a verify.
|
||||
|
||||
|
||||
* How do I test RAM?
|
||||
|
||||
First you should know that overclocking often makes memory problems
|
||||
worse. So if you overclock (which I strongly recommend against in a
|
||||
system holding data that has some worth), run the tests with the
|
||||
overclocking active.
|
||||
|
||||
There are two good options. One is Memtest86+ and the other is
|
||||
"memtester" by Charles Cazabon. Memtest86+ requires a reboot and
|
||||
then takes over the machine, while memtester runs from a
|
||||
root-shell. Both use different testing methods and I have found
|
||||
problems fast with each one that the other needed long to find. I
|
||||
recommend running the following procedure until the first error is
|
||||
found:
|
||||
|
||||
- Run Memtest86+ for one cycle
|
||||
|
||||
- Run memterster for one cycle (shut down as many other applications
|
||||
as possible)
|
||||
|
||||
- Run Memtest86+ for 24h or more
|
||||
|
||||
- Run memtester for 24h or more
|
||||
|
||||
If all that does not produce error messages, your RAM may be sound,
|
||||
but I have had one weak bit that Memtest86+ needed around 60 hours
|
||||
to find. If you can reproduce the original problem reliably, a good
|
||||
additional test may be to remove half of the RAM (if you have more
|
||||
than one module) and try whether the problem is still there and if
|
||||
so, try with the other half. If you just have one module, get a
|
||||
different one and try with that. If you do overclocking, reduce
|
||||
the settings to the most conservative ones available and try with
|
||||
that.
|
||||
|
||||
|
||||
5. Security Aspects
|
||||
|
||||
|
||||
* Should I initialize (overwrite) a new LUKS/dm-crypt partition?
|
||||
|
||||
If you just create a filesystem on it, most of the old data will
|
||||
still be there. If the old data is sensitive, you should overwrite
|
||||
it before encrypting. In any case, not initializing will leave the
|
||||
old data there until the specific sector gets written. That may
|
||||
enable an attacker to determine how much and where on the
|
||||
partition data was written. If you think this is a risk, you can
|
||||
prevent this by overwriting the encrypted device (here assumed to
|
||||
be named "e1") with zeros like this:
|
||||
|
||||
dd_rescue -w /dev/zero /dev/mapper/e1
|
||||
|
||||
or alternatively with one of the following more standard commands:
|
||||
|
||||
cat /dev/zero > /dev/mapper/e1
|
||||
dd if=/dev/zero of=/dev/mapper/e1
|
||||
|
||||
|
||||
* How do I securely erase a LUKS (or other) partition?
|
||||
|
||||
For LUKS, if you are in a desperate hurry, overwrite the first few
|
||||
kilobytes of the LUKS partition. This erases the master key salt
|
||||
and makes access impossible. However a LUKS header backup or full
|
||||
backup will still grant access to most or all data, so make sure
|
||||
that an attacker does not have access to backups or destroy them as
|
||||
well.
|
||||
|
||||
To do this right, overwrite the whole LUKS partition with a single
|
||||
pass of zeros. This is enough for current HDDs. For SSDs you may
|
||||
want to erase the whole drive several times to be sure data is not
|
||||
retained by wear leveling. This is possibly still insecure as SSD
|
||||
technology is not fully understood in this regard. Still, due to
|
||||
the anti-forensic properties of the LUKS key-slots, a single
|
||||
overwrite of an SSD could be enough. If in doubt, use physical
|
||||
destruction in addition. Keep in mind to also erase all backups.
|
||||
|
||||
Example for a zero-overwrite erase of partition sda10 done with
|
||||
dd_rescue:
|
||||
|
||||
dd_rescue -w /dev/zero /dev/sda10
|
||||
|
||||
|
||||
* How do I securely erase a backup of a LUKS partition or header?
|
||||
|
||||
That depends on the medium it is stored on. For HDD and SSD, use
|
||||
overwrite with zeros. For an SSD, you may want to overwrite the
|
||||
complete SSD several times and use physical destruction in addition,
|
||||
see last item. Treat USB flash drives the same as SSDs. For
|
||||
re-writable CD/DVD, a single overwrite should also be enough, due
|
||||
to the anti-forensic properties of the LUKS keyslots. For
|
||||
write-once media, use physical destruction. For low security
|
||||
requirements, just cut the CD/DVD into several parts. For high
|
||||
security needs, shred or burn the medium. If your backup is on
|
||||
magnetic tape, I advise physical destruction by shredding or
|
||||
burning. The problem with magnetic tape is that it has a higher
|
||||
dynamic range than HDDs and older data may well be recoverable
|
||||
after overwrites. Also write-head alignment issues can lead to
|
||||
data not actually being deleted at all during overwrites.
|
||||
|
||||
|
||||
* What about backup? Does it compromise security?
|
||||
|
||||
That depends. See next section.
|
||||
|
||||
|
||||
* Why is all my data gone if I overwrite the LUKS header?
|
||||
|
||||
Overwriting the LUKS header in part or in full is the most common
|
||||
reason why access to LUKS containers is lost permanently.
|
||||
Overwriting can be done in a number of fashions, like creating a
|
||||
new filesystem on the raw LUKS partition, making the raw partition
|
||||
part of a raid array and just writing to the raw partition.
|
||||
|
||||
The LUKS header contains a 256 bit "salt" value and without that no
|
||||
decryption is possible. While the salt is not secret, it is
|
||||
key-grade material and cannot be reconstructed. This is a
|
||||
cryptographically strong "cannot". From observations on the
|
||||
cryptsetup mailing-list, people typically go though the usual
|
||||
stages of grief (Denial, Anger, Bargaining, Depression, Acceptance)
|
||||
when this happens to them. Observed times vary between 1 day and 2
|
||||
weeks to complete the cycle. Seeking help on the mailing-list is
|
||||
fine. Even if we usually cannot help with getting back your data,
|
||||
most people found the feedback comforting.
|
||||
|
||||
If your header does not contain an intact salt, best go directly
|
||||
to the last one ("Acceptance") and think about what to do now.
|
||||
There is one exception that I know of: If your LUKS container is
|
||||
still open, then it may be possible to extract the master key from
|
||||
the running system. Ask on the mailing-list on how to do that and
|
||||
make sure nobody switches off the machine.
|
||||
|
||||
|
||||
* What is a "salt"?
|
||||
|
||||
A salt is a random key-grade value added to the passphrase before
|
||||
it is processed. It is not kept secret. The reason for using salts
|
||||
is as follows: If an attacker wants to crack the password for a
|
||||
single LUKS container, then every possible passphrase has to be
|
||||
tried. Typically an attacker will not try every binary value, but
|
||||
will try words and sentences from a dictionary.
|
||||
|
||||
If an attacker wants to attack several LUKS containers with the
|
||||
same dictionary, then a different approach makes sense: Compute the
|
||||
resulting slot-key for each dictionary element and store it on
|
||||
disk. Then the test for each entry is just the slow unlocking with
|
||||
the slot key (say 0.00001 sec) instead of calculating the slot-key
|
||||
first (1 sec). For a single attack, this does not help. But if you
|
||||
have more than one container to attack, this helps tremendously,
|
||||
also because you can prepare your table before you even have the
|
||||
container to attack! The calculation is also very simple to
|
||||
parallelize. You could, for example, use the night-time unused CPU
|
||||
power of your desktop PCs for this.
|
||||
|
||||
This is where the salt comes in. If the salt is combined with the
|
||||
passphrase (in the simplest form, just appended to it), you
|
||||
suddenly need a separate table for each salt value. With a
|
||||
reasonably-sized salt value (256 bit, e.g.) this is quite
|
||||
infeasible.
|
||||
|
||||
|
||||
* Is LUKS secure with a low-entropy (bad) passphrase?
|
||||
|
||||
This needs a bit of theory. The quality of your passphrase is
|
||||
directly related to its entropy (information theoretic, not
|
||||
thermodynamic). The entropy says how many bits of "uncertainty" or
|
||||
"randomness" are in you passphrase. In other words, that is how
|
||||
difficult guessing the passphrase is.
|
||||
|
||||
Example: A random English sentence has about 1 bit of entropy per
|
||||
character. A random lowercase (or uppercase) character has about
|
||||
4.7 bit of entropy.
|
||||
|
||||
Now, if n is the number of bits of entropy in your passphrase and t
|
||||
is the time it takes to process a passphrase in order to open the
|
||||
LUKS container, then an attacker has to spend at maximum
|
||||
|
||||
attack_time_max = 2^n * t
|
||||
|
||||
time for a successful attack and on average half that. There is no
|
||||
way getting around that relationship. However, there is one thing
|
||||
that does help, namely increasing t, the time it takes to use a
|
||||
passphrase, see next FAQ item.
|
||||
|
||||
Still, if you want good security, a high-entropy passphrase is the
|
||||
only option. Use at least 64 bits for secret stuff. That is 64
|
||||
characters of English text (but only if randomly chosen) or a
|
||||
combination of 12 truly random letters and digits.
|
||||
|
||||
For passphrase generation, do not use lines from very well-known
|
||||
texts (religious texts, Harry potter, etc.) as they are to easy to
|
||||
guess. For example, the total Harry Potter has about 1'500'000
|
||||
words (my estimation). Trying every 64 character sequence starting
|
||||
and ending at a word boundary would take only something like 20
|
||||
days on a single CPU and is entirely feasible.
|
||||
|
||||
On the other hand, choosing 1.5 lines from, say, the Wheel of Time
|
||||
is in itself not more secure, but the book selection adds quite a
|
||||
bit of entropy. (Now that I have mentioned it here, don't use tWoT
|
||||
either!) If you add 2 or 3 typos or switch some words around, then
|
||||
this is good passphrase material.
|
||||
|
||||
|
||||
* What is "iteration count" and why is decreasing it a bad idea?
|
||||
|
||||
Iteration count is the number of PBKDF2 iterations a passphrase is
|
||||
put through before it is used to unlock a key-slot. Iterations are
|
||||
done with the explicit purpose to increase the time that it takes
|
||||
to unlock a key-slot. This provides some protection against use of
|
||||
low-entropy passphrases.
|
||||
|
||||
The idea is that an attacker has to try all possible passphrases.
|
||||
Even if the attacker knows the passphrase is low-entropy (see last
|
||||
item), it is possible to make each individual try take longer. The
|
||||
way to do this is to repeatedly hash the passphrase for a certain
|
||||
time. The attacker then has to spend the same time (given the same
|
||||
computing power) as the user per try. With LUKS, the default is 1
|
||||
second of PBKDF2 hashing.
|
||||
|
||||
Example 1: Lets assume we have a really bad passphrase (e.g. a
|
||||
girlfriends name) with 10 bits of entropy. With the same CPU, an
|
||||
attacker would need to spend around 500 seconds on average to
|
||||
break that passphrase. Without iteration, it would be more like
|
||||
0.0001 seconds on a modern CPU.
|
||||
|
||||
Example 2: The user did a bit better and has 32 chars of English
|
||||
text. That would give use about 32 bits of entropy. With 1 second
|
||||
iteration, that means an attacker on the same CPU needs around 136
|
||||
years. That is pretty impressive for such a weak passphrase.
|
||||
Without the iterations, it would be more like 50 days on a modern
|
||||
CPU, and possibly far less.
|
||||
|
||||
In addition, the attacker can both parallelize and use special
|
||||
hardware like GPUs to speed up the attack. The attack can also
|
||||
happen quite some time after the luksFormat operation and CPUs can
|
||||
have become faster and cheaper. For that reason you want a bit of
|
||||
extra security. Anyways, in Example 1 your are screwed. In example
|
||||
2, not necessarily. Even if the attack is faster, it still has a
|
||||
certain cost associated with it, say 10000 EUR/USD with iteration
|
||||
and 1 EUR/USD without iteration. The first can be prohibitively
|
||||
expensive, while the second is something you try even without
|
||||
solid proof that the decryption will yield something useful.
|
||||
|
||||
The numbers above are mostly made up, but show the idea. Of course
|
||||
the best thing is to have a high-entropy passphrase.
|
||||
|
||||
Would a 100 sec iteration time be even better? Yes and no.
|
||||
Cryptographically it would be a lot better, namely 100 times better.
|
||||
However, usability is a very important factor for security
|
||||
technology and one that gets overlooked surprisingly often. For
|
||||
LUKS, if you have to wait 2 minutes to unlock the LUKS container,
|
||||
most people will not bother and use less secure storage instead. It
|
||||
is better to have less protection against low-entropy passphrases
|
||||
and people actually use LUKS, than having them do without
|
||||
encryption altogether.
|
||||
|
||||
Now, what about decreasing the iteration time? This is generally a
|
||||
very bad idea, unless you know and can enforce that the users only
|
||||
use high-entropy passphrases. If you decrease the iteration time
|
||||
without ensuring that, then you put your users at increased risk,
|
||||
and considering how often LUKS containers are unlocked in a
|
||||
typical work-flow, you do so without a good reason. Don't do it.
|
||||
The iteration time is already low enough that some users will
|
||||
still chose passphrases with entropy low enough that they are
|
||||
vulnerable. Lowering it even further increases this danger
|
||||
significantly.
|
||||
|
||||
|
||||
* Is LUKS with default parameters less secure on a slow CPU?
|
||||
|
||||
Unfortunately, yes. However the only aspect affected is the
|
||||
protection for low-entropy passphrase or master-key. All other
|
||||
security aspects are independent of CPU speed.
|
||||
|
||||
The master key is less critical, as you really have to work at it
|
||||
to give it low entropy. One possibility is to supply the master key
|
||||
yourself. If that key is low-entropy, then you get what you
|
||||
deserve. The other known possibility is to use /dev/urandom for
|
||||
key generation in an entropy-startved situation (e.g. automatic
|
||||
installation on an embedded device without network and other entropy
|
||||
sources).
|
||||
|
||||
For the passphrase, don't use a low-entropy passphrase. If your
|
||||
passphrase is good, then a slow CPU will not matter. If you insist
|
||||
on a low-entropy passphrase on a slow CPU, use something like
|
||||
"--iter-time=10" or higher and wait a long time on each LUKS unlock
|
||||
and pray that the attacker does not find out in which way exactly
|
||||
your passphrase is low entropy. This also applies to low-entropy
|
||||
passphrases on fast CPUs. Technology can do only so much to
|
||||
compensate for problems in front of the keyboard.
|
||||
|
||||
|
||||
* Why was the default aes-cbc-plain replaced with aes-cbc-essiv?
|
||||
|
||||
The problem is that cbc-plain has a fingerprint vulnerability, where
|
||||
a specially crafted file placed into the crypto-container can be
|
||||
recognized from the outside. The issue here is that for cbc-plain
|
||||
the initialization vector (IV) is the sector number. The IV gets
|
||||
XORed to the first data chunk of the sector to be encrypted. If you
|
||||
make sure that the first data block to be stored in a sector
|
||||
contains the sector number as well, the first data block to be
|
||||
encrypted is all zeros and always encrypted to the same ciphertext.
|
||||
This also works if the first data chunk just has a constant XOR
|
||||
with the sector number. By having several shifted patterns you can
|
||||
take care of the case of a non-power-of-two start sector number of
|
||||
the file.
|
||||
|
||||
This mechanism allows you to create a pattern of sectors that have
|
||||
the same first ciphertext block and signal one bit per sector to the
|
||||
outside, allowing you to e.g. mark media files that way for
|
||||
recognition without decryption. For large files this is a
|
||||
practical attack. For small ones, you do not have enough blocks to
|
||||
signal and take care of different file starting offsets.
|
||||
|
||||
In order to prevent this attack, the default was changed to
|
||||
cbc-essiv. ESSIV uses a keyed hash of the sector number, with the
|
||||
encryption key as key. This makes the IV unpredictable without
|
||||
knowing the encryption key and the watermarking attack fails.
|
||||
|
||||
|
||||
* Are there any problems with "plain" IV? What is "plain64"?
|
||||
|
||||
First, "plain" and "plain64" are both not safe to use with CBC, see
|
||||
previous FAQ item.
|
||||
|
||||
However there are modes, like XTS, that are secure with "plain" IV.
|
||||
The next limit is that "plain" is 64 bit, with the upper 32 bit set
|
||||
to zero. This means that on volumes larger than 2TiB, the IV
|
||||
repeats, creating a vulnerability that potentially leaks some
|
||||
data. To avoid this, use "plain64", which uses the full sector
|
||||
number up to 64 bit. Note that "plain64" requires a kernel >=
|
||||
2.6.33. Also note that "plain64" is backwards compatible for
|
||||
volume sizes <= 2TiB, but not for those > 2TiB. Finally, "plain64"
|
||||
does not cause any performance penalty compared to "plain".
|
||||
|
||||
|
||||
* What about XTS mode?
|
||||
|
||||
XTS mode is potentially even more secure than cbc-essiv (but only if
|
||||
cbc-essiv is insecure in your scenario). It is a NIST standard and
|
||||
used, e.g. in Truecrypt. At the moment, if you want to use it, you
|
||||
have to specify it manually as "aes-xts-plain", i.e.
|
||||
|
||||
cryptsetup -c aes-xts-plain luksFormat <device>
|
||||
|
||||
For volumes >2TiB and kernels >= 2.6.33 use "plain64" (see FAQ
|
||||
item on "plain" and "plain64"):
|
||||
|
||||
cryptsetup -c aes-xts-plain64 luksFormat <device>
|
||||
|
||||
There is a potential security issue with XTS mode and large blocks.
|
||||
LUKS and dm-crypt always use 512B blocks and the issue does not
|
||||
apply.
|
||||
|
||||
|
||||
6. Backup and Data Recovery
|
||||
|
||||
|
||||
* Does a backup compromise security?
|
||||
|
||||
Depends on how you do it. First, a backup is non-optional with
|
||||
encrypted data just the same way it is with non-encrypted data.
|
||||
Disks do break and they do not care whether they make plain or
|
||||
encrypted data inaccessible.
|
||||
|
||||
However there are risks introduced by backups. For example if you
|
||||
change/disable a key-slot in LUKS, a binary backup of the partition
|
||||
will still have the old key-slot. To deal with this, you have to
|
||||
be able to change the key-slot on the backup as well, or use a
|
||||
different set-up. One option is to have a different passphrase on
|
||||
the backup and to make the backup with both containers open.
|
||||
Another one is to make a backup of the original, opened container to
|
||||
a single file, e.g. with tar, and to encrypt that file with
|
||||
public-key-cryptography, e.g. with GnuPG. You can then keep the
|
||||
secret key in a safe place, because it is only used to decrypt a
|
||||
backup. The key the backup is encrypted with can be stored without
|
||||
special security measures, as long as an attacker cannot replace
|
||||
it with his own key.
|
||||
|
||||
If you use dm-crypt, backup is simpler: As there is no key
|
||||
management, the main risk is that you cannot wipe the backup when
|
||||
wiping the original. However wiping the original for dm-crypt
|
||||
should consist of forgetting the passphrase and that you can do
|
||||
without actual access to the backup.
|
||||
|
||||
In both cases, there is an additional (usually small) risk: An
|
||||
attacker can see how many sectors and which ones have been changed
|
||||
since the backup. This is not possible with the public-key method
|
||||
though.
|
||||
|
||||
My personal advice is to use one USB disk (low value date) or three
|
||||
disks (high value data) in rotating order for backups, and either
|
||||
use different passphrases or keep them easily accessible in case
|
||||
you need to disable a key-slot. If you do network-backup or
|
||||
tape-backup, I strongly recommend to go the public-key path,
|
||||
especially as you typically cannot reliably delete data in these
|
||||
scenarios. (Well, you can burn the tape if it is under your
|
||||
control...)
|
||||
|
||||
|
||||
* What happens if I overwrite the start of a LUKS partition or damage
|
||||
the LUKS header or key-slots?
|
||||
|
||||
There are two critical components for decryption: The salt values
|
||||
in the header itself and the key-slots. If the salt values are
|
||||
overwritten or changed, nothing (in the cryptographically strong
|
||||
sense) can be done to access the data, unless there is a backup of
|
||||
the LUKS header. If a key-slot is damaged, the data can still be
|
||||
read with a different key-slot, if there is a remaining undamaged
|
||||
and used key-slot. Note that in order to make a key-slot
|
||||
unrecoverable in a cryptographically strong sense, changing about
|
||||
4-6 bits in random locations of its 128kiB size is quite enough.
|
||||
|
||||
|
||||
* What happens if I (quick) format a LUKS partition?
|
||||
|
||||
I have not tried the different ways to do this, but very likely you
|
||||
will have written a new boot-sector, which in turn overwrites the
|
||||
LUKS header, including the salts. You may also damage the key-slots
|
||||
in part or in full. See also last item.
|
||||
|
||||
|
||||
* What does the on-disk structure of dm-crypt look like?
|
||||
|
||||
There is none. dm-crypt takes a block device and gives encrypted
|
||||
access to each of its blocks with a key derived from the passphrase
|
||||
given. If you use a cipher different than the default, you have to
|
||||
specify that as a parameter to cryptsetup too. If you want to
|
||||
change the password, you basically have to create a second
|
||||
encrypted device with the new passphrase and copy your data over.
|
||||
On the plus side, if you accidentally overwrite any part of a
|
||||
dm-crypt device, the damage will be limited to the are you
|
||||
overwrote.
|
||||
|
||||
|
||||
* What does the on-disk structure of LUKS look like?
|
||||
|
||||
A LUKS partition consists of a header, followed by 8 key-slot
|
||||
descriptors, followed by 8 key slots, followed by the encrypted
|
||||
data area.
|
||||
|
||||
Header and key-slot descriptors fill the first 592 bytes. The
|
||||
key-slot size depends on the creation parameters, namely on the
|
||||
number of anti-forensic stripes and on key block alignment.
|
||||
|
||||
With 4000 stripes (the default), each key-slot is a bit less than
|
||||
128kiB in size. Due to sector alignment of the key-slot start,
|
||||
that means the key block 0 is at offset 0x1000-0x20400, key block
|
||||
1 at offset 0x21000-0x40400, and key block 7 at offset
|
||||
0xc1000-0xe0400. The space to the next full sector address is
|
||||
padded with zeros. Never used key-slots are filled with what the
|
||||
disk originally contained there, a key-slot removed with
|
||||
"luksRemoveKey" or "luksKillSlot" gets filled with 0xff. Start of
|
||||
bulk data (with the default 4000 stripes and 8 key-slots) is at
|
||||
0x101000, i.e. at 1'052'672 bytes, i.e. at 1MiB + 4096 bytes from
|
||||
the start of the partition. This is also the value given by command
|
||||
"luksDump" with "Payload offset: 2056", just multiply by the sector
|
||||
size (512 bytes). Incidentally, "luksHeaderBackup" dumps exactly
|
||||
the first 1'052'672 bytes to file and "luksHeaderRestore" restores
|
||||
them.
|
||||
|
||||
The exact specification of the format is here:
|
||||
http://code.google.com/p/cryptsetup/wiki/Specification
|
||||
|
||||
|
||||
* How do I backup a LUKS header?
|
||||
|
||||
While you could just copy the appropriate number of bytes from the
|
||||
start of the LUKS partition, the best way is to use command option
|
||||
"luksHeaderBackup" of cryptsetup. This protects also against errors
|
||||
when non-standard parameters have been used in LUKS partition
|
||||
creation. Example:
|
||||
|
||||
|
||||
cryptsetup luksHeaderBackup --header-backup-file h /dev/mapper/c1
|
||||
|
||||
|
||||
* How do I backup a LUKS partition?
|
||||
|
||||
You do a sector-image of the whole partition. This will contain the
|
||||
LUKS header, the keys-slots and the data ares. It can be done
|
||||
under Linux e.g. with dd_rescue (for a direct image copy) and with
|
||||
"cat" or "dd". Example:
|
||||
|
||||
cat /dev/sda10 > sda10.img
|
||||
dd_rescue /dev/sda10 sda10.img
|
||||
|
||||
You can also use any other backup software that is capable of making
|
||||
a sector image of a partition. Note that compression is
|
||||
ineffective for encrypted data, hence it does not sense to use it.
|
||||
|
||||
|
||||
* Do I need a backup of the full partition? Would the header and
|
||||
key-slots not be enough?
|
||||
|
||||
Backup protects you against two things: Disk loss or corruption and
|
||||
user error. By far the most questions on the dm-crypt mailing list
|
||||
about how to recover a damaged LUKS partition are related to user
|
||||
error. For example, if you create a new filesystem on a LUKS
|
||||
partition, chances are good that all data is lost permanently.
|
||||
|
||||
For this case, a header+key-slot backup would often be enough. But
|
||||
keep in mind that a HDD has roughly a failure risk of 5% per year.
|
||||
It is highly advisable to have a complete backup to protect against
|
||||
this case.
|
||||
|
||||
|
||||
* Are there security risks from a backup of the LUKS header or a
|
||||
whole LUKS partition?
|
||||
|
||||
Yes. One risk is that if you remove access rights for specific
|
||||
key-slots by deleting their contents, the data can still be
|
||||
accessed with invalidated passphrase and the backup. The other risk
|
||||
is that if you erase a LUKS partition, a backup could still grant
|
||||
access, especially if you only erased the LUKS header and not the
|
||||
whole partition.
|
||||
|
||||
|
||||
* I think this is overly complicated. Is there an alternative?
|
||||
|
||||
Yes, you can use plain dm-crypt. It does not allow multiple
|
||||
passphrases, but on the plus side, it has zero on disk description
|
||||
and if you overwrite some part of a plain dm-crypt partition,
|
||||
exactly the overwritten parts are lost (rounded up to sector
|
||||
borders).
|
||||
|
||||
|
||||
7. Issues with Specific Versions of cryptsetup
|
||||
|
||||
|
||||
* When using the create command for plain dm-crypt with cryptsetup
|
||||
1.1.x, the mapping is incompatible and my data is not accessible
|
||||
anymore!
|
||||
|
||||
With cryptsetup 1.1.x, the distro maintainer can define different
|
||||
default encryption modes for LUKS and plain devices. You can check
|
||||
these compiled-in defaults using "cryptsetup --help". Moreover, the
|
||||
plain device default changed because the old IV mode was
|
||||
vulnerable to a watermarking attack.
|
||||
|
||||
If you are using a plain device and you need a compatible mode, just
|
||||
specify cipher, key size and hash algorithm explicitly. For
|
||||
compatibility with cryptsetup 1.0.x defaults, simple use the
|
||||
following:
|
||||
|
||||
cryptsetup create -c aes-cbc-plain -s 256 -h ripemd160 <name> <dev>
|
||||
|
||||
LUKS stores cipher and mode in the metadata on disk, avoiding this
|
||||
problem.
|
||||
|
||||
|
||||
* cryptsetup on SLED 10 has problems...
|
||||
|
||||
SLED 10 is missing an essential kernel patch for dm-crypt, which
|
||||
is broken in its kernel as a result. There may be a very old
|
||||
version of cryptsetup (1.0.x) provided by SLED, which should also
|
||||
not be used anymore as well. My advice would be to drop SLED 10.
|
||||
|
||||
A. Contributors In no particular order:
|
||||
|
||||
- Arno Wagner
|
||||
|
||||
- Milan Broz
|
||||
|
||||
229
INSTALL
Normal file
229
INSTALL
Normal file
@@ -0,0 +1,229 @@
|
||||
Copyright 1994, 1995, 1996, 1999, 2000, 2001, 2002 Free Software
|
||||
Foundation, Inc.
|
||||
|
||||
This file is free documentation; the Free Software Foundation gives
|
||||
unlimited permission to copy, distribute and modify it.
|
||||
|
||||
Basic Installation
|
||||
==================
|
||||
|
||||
These are generic installation instructions.
|
||||
|
||||
The `configure' shell script attempts to guess correct values for
|
||||
various system-dependent variables used during compilation. It uses
|
||||
those values to create a `Makefile' in each directory of the package.
|
||||
It may also create one or more `.h' files containing system-dependent
|
||||
definitions. Finally, it creates a shell script `config.status' that
|
||||
you can run in the future to recreate the current configuration, and a
|
||||
file `config.log' containing compiler output (useful mainly for
|
||||
debugging `configure').
|
||||
|
||||
It can also use an optional file (typically called `config.cache'
|
||||
and enabled with `--cache-file=config.cache' or simply `-C') that saves
|
||||
the results of its tests to speed up reconfiguring. (Caching is
|
||||
disabled by default to prevent problems with accidental use of stale
|
||||
cache files.)
|
||||
|
||||
If you need to do unusual things to compile the package, please try
|
||||
to figure out how `configure' could check whether to do them, and mail
|
||||
diffs or instructions to the address given in the `README' so they can
|
||||
be considered for the next release. If you are using the cache, and at
|
||||
some point `config.cache' contains results you don't want to keep, you
|
||||
may remove or edit it.
|
||||
|
||||
The file `configure.ac' (or `configure.in') is used to create
|
||||
`configure' by a program called `autoconf'. You only need
|
||||
`configure.ac' if you want to change it or regenerate `configure' using
|
||||
a newer version of `autoconf'.
|
||||
|
||||
The simplest way to compile this package is:
|
||||
|
||||
1. `cd' to the directory containing the package's source code and type
|
||||
`./configure' to configure the package for your system. If you're
|
||||
using `csh' on an old version of System V, you might need to type
|
||||
`sh ./configure' instead to prevent `csh' from trying to execute
|
||||
`configure' itself.
|
||||
|
||||
Running `configure' takes awhile. While running, it prints some
|
||||
messages telling which features it is checking for.
|
||||
|
||||
2. Type `make' to compile the package.
|
||||
|
||||
3. Optionally, type `make check' to run any self-tests that come with
|
||||
the package.
|
||||
|
||||
4. Type `make install' to install the programs and any data files and
|
||||
documentation.
|
||||
|
||||
5. You can remove the program binaries and object files from the
|
||||
source code directory by typing `make clean'. To also remove the
|
||||
files that `configure' created (so you can compile the package for
|
||||
a different kind of computer), type `make distclean'. There is
|
||||
also a `make maintainer-clean' target, but that is intended mainly
|
||||
for the package's developers. If you use it, you may have to get
|
||||
all sorts of other programs in order to regenerate files that came
|
||||
with the distribution.
|
||||
|
||||
Compilers and Options
|
||||
=====================
|
||||
|
||||
Some systems require unusual options for compilation or linking that
|
||||
the `configure' script does not know about. Run `./configure --help'
|
||||
for details on some of the pertinent environment variables.
|
||||
|
||||
You can give `configure' initial values for configuration parameters
|
||||
by setting variables in the command line or in the environment. Here
|
||||
is an example:
|
||||
|
||||
./configure CC=c89 CFLAGS=-O2 LIBS=-lposix
|
||||
|
||||
*Note Defining Variables::, for more details.
|
||||
|
||||
Compiling For Multiple Architectures
|
||||
====================================
|
||||
|
||||
You can compile the package for more than one kind of computer at the
|
||||
same time, by placing the object files for each architecture in their
|
||||
own directory. To do this, you must use a version of `make' that
|
||||
supports the `VPATH' variable, such as GNU `make'. `cd' to the
|
||||
directory where you want the object files and executables to go and run
|
||||
the `configure' script. `configure' automatically checks for the
|
||||
source code in the directory that `configure' is in and in `..'.
|
||||
|
||||
If you have to use a `make' that does not support the `VPATH'
|
||||
variable, you have to compile the package for one architecture at a
|
||||
time in the source code directory. After you have installed the
|
||||
package for one architecture, use `make distclean' before reconfiguring
|
||||
for another architecture.
|
||||
|
||||
Installation Names
|
||||
==================
|
||||
|
||||
By default, `make install' will install the package's files in
|
||||
`/usr/local/bin', `/usr/local/man', etc. You can specify an
|
||||
installation prefix other than `/usr/local' by giving `configure' the
|
||||
option `--prefix=PATH'.
|
||||
|
||||
You can specify separate installation prefixes for
|
||||
architecture-specific files and architecture-independent files. If you
|
||||
give `configure' the option `--exec-prefix=PATH', the package will use
|
||||
PATH as the prefix for installing programs and libraries.
|
||||
Documentation and other data files will still use the regular prefix.
|
||||
|
||||
In addition, if you use an unusual directory layout you can give
|
||||
options like `--bindir=PATH' to specify different values for particular
|
||||
kinds of files. Run `configure --help' for a list of the directories
|
||||
you can set and what kinds of files go in them.
|
||||
|
||||
If the package supports it, you can cause programs to be installed
|
||||
with an extra prefix or suffix on their names by giving `configure' the
|
||||
option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'.
|
||||
|
||||
Optional Features
|
||||
=================
|
||||
|
||||
Some packages pay attention to `--enable-FEATURE' options to
|
||||
`configure', where FEATURE indicates an optional part of the package.
|
||||
They may also pay attention to `--with-PACKAGE' options, where PACKAGE
|
||||
is something like `gnu-as' or `x' (for the X Window System). The
|
||||
`README' should mention any `--enable-' and `--with-' options that the
|
||||
package recognizes.
|
||||
|
||||
For packages that use the X Window System, `configure' can usually
|
||||
find the X include and library files automatically, but if it doesn't,
|
||||
you can use the `configure' options `--x-includes=DIR' and
|
||||
`--x-libraries=DIR' to specify their locations.
|
||||
|
||||
Specifying the System Type
|
||||
==========================
|
||||
|
||||
There may be some features `configure' cannot figure out
|
||||
automatically, but needs to determine by the type of machine the package
|
||||
will run on. Usually, assuming the package is built to be run on the
|
||||
_same_ architectures, `configure' can figure that out, but if it prints
|
||||
a message saying it cannot guess the machine type, give it the
|
||||
`--build=TYPE' option. TYPE can either be a short name for the system
|
||||
type, such as `sun4', or a canonical name which has the form:
|
||||
|
||||
CPU-COMPANY-SYSTEM
|
||||
|
||||
where SYSTEM can have one of these forms:
|
||||
|
||||
OS KERNEL-OS
|
||||
|
||||
See the file `config.sub' for the possible values of each field. If
|
||||
`config.sub' isn't included in this package, then this package doesn't
|
||||
need to know the machine type.
|
||||
|
||||
If you are _building_ compiler tools for cross-compiling, you should
|
||||
use the `--target=TYPE' option to select the type of system they will
|
||||
produce code for.
|
||||
|
||||
If you want to _use_ a cross compiler, that generates code for a
|
||||
platform different from the build platform, you should specify the
|
||||
"host" platform (i.e., that on which the generated programs will
|
||||
eventually be run) with `--host=TYPE'.
|
||||
|
||||
Sharing Defaults
|
||||
================
|
||||
|
||||
If you want to set default values for `configure' scripts to share,
|
||||
you can create a site shell script called `config.site' that gives
|
||||
default values for variables like `CC', `cache_file', and `prefix'.
|
||||
`configure' looks for `PREFIX/share/config.site' if it exists, then
|
||||
`PREFIX/etc/config.site' if it exists. Or, you can set the
|
||||
`CONFIG_SITE' environment variable to the location of the site script.
|
||||
A warning: not all `configure' scripts look for a site script.
|
||||
|
||||
Defining Variables
|
||||
==================
|
||||
|
||||
Variables not defined in a site shell script can be set in the
|
||||
environment passed to `configure'. However, some packages may run
|
||||
configure again during the build, and the customized values of these
|
||||
variables may be lost. In order to avoid this problem, you should set
|
||||
them in the `configure' command line, using `VAR=value'. For example:
|
||||
|
||||
./configure CC=/usr/local2/bin/gcc
|
||||
|
||||
will cause the specified gcc to be used as the C compiler (unless it is
|
||||
overridden in the site shell script).
|
||||
|
||||
`configure' Invocation
|
||||
======================
|
||||
|
||||
`configure' recognizes the following options to control how it
|
||||
operates.
|
||||
|
||||
`--help'
|
||||
`-h'
|
||||
Print a summary of the options to `configure', and exit.
|
||||
|
||||
`--version'
|
||||
`-V'
|
||||
Print the version of Autoconf used to generate the `configure'
|
||||
script, and exit.
|
||||
|
||||
`--cache-file=FILE'
|
||||
Enable the cache: use and save the results of the tests in FILE,
|
||||
traditionally `config.cache'. FILE defaults to `/dev/null' to
|
||||
disable caching.
|
||||
|
||||
`--config-cache'
|
||||
`-C'
|
||||
Alias for `--cache-file=config.cache'.
|
||||
|
||||
`--quiet'
|
||||
`--silent'
|
||||
`-q'
|
||||
Do not print messages saying which checks are being made. To
|
||||
suppress all normal output, redirect it to `/dev/null' (any error
|
||||
messages will still be shown).
|
||||
|
||||
`--srcdir=DIR'
|
||||
Look for the package's source code in directory DIR. Usually
|
||||
`configure' can determine that directory automatically.
|
||||
|
||||
`configure' also accepts some other, not widely useful, options. Run
|
||||
`configure --help' for more details.
|
||||
|
||||
95
Makefile.am
95
Makefile.am
@@ -1,90 +1,9 @@
|
||||
EXTRA_DIST = README.md SECURITY.md README.licensing CONTRIBUTING.md FAQ.md docs misc autogen.sh
|
||||
EXTRA_DIST += meson_options.txt \
|
||||
meson.build \
|
||||
lib/crypto_backend/argon2/meson.build \
|
||||
lib/crypto_backend/meson.build \
|
||||
lib/meson.build \
|
||||
man/meson.build \
|
||||
po/meson.build \
|
||||
scripts/meson.build \
|
||||
src/meson.build \
|
||||
tests/meson.build \
|
||||
tests/fuzz/meson.build \
|
||||
tokens/meson.build \
|
||||
tokens/ssh/meson.build
|
||||
|
||||
SUBDIRS = po tests tests/fuzz
|
||||
CLEANFILES =
|
||||
DISTCLEAN_TARGETS =
|
||||
|
||||
AM_CPPFLAGS = \
|
||||
-include config.h \
|
||||
-I$(top_srcdir)/lib \
|
||||
-DDATADIR=\""$(datadir)"\" \
|
||||
-DLOCALEDIR=\""$(datadir)/locale"\" \
|
||||
-DLIBDIR=\""$(libdir)"\" \
|
||||
-DPREFIX=\""$(prefix)"\" \
|
||||
-DSYSCONFDIR=\""$(sysconfdir)"\" \
|
||||
-DVERSION=\""$(VERSION)"\"
|
||||
AM_CFLAGS = -Wall
|
||||
AM_CXXFLAGS = -Wall
|
||||
AM_LDFLAGS =
|
||||
|
||||
if ENABLE_FUZZ_TARGETS
|
||||
AM_CFLAGS += -fsanitize=fuzzer-no-link
|
||||
AM_CXXFLAGS += -fsanitize=fuzzer-no-link
|
||||
endif
|
||||
|
||||
LDADD = $(LTLIBINTL)
|
||||
|
||||
tmpfilesddir = @DEFAULT_TMPFILESDIR@
|
||||
|
||||
include_HEADERS =
|
||||
lib_LTLIBRARIES =
|
||||
noinst_LTLIBRARIES =
|
||||
sbin_PROGRAMS =
|
||||
man8_MANS =
|
||||
tmpfilesd_DATA =
|
||||
pkgconfig_DATA =
|
||||
dist_noinst_DATA =
|
||||
|
||||
include man/Makemodule.am
|
||||
|
||||
include scripts/Makemodule.am
|
||||
|
||||
if CRYPTO_INTERNAL_ARGON2
|
||||
include lib/crypto_backend/argon2/Makemodule.am
|
||||
endif
|
||||
include lib/crypto_backend/Makemodule.am
|
||||
include lib/Makemodule.am
|
||||
|
||||
include src/Makemodule.am
|
||||
include tokens/Makemodule.am
|
||||
EXTRA_DIST = FAQ
|
||||
SUBDIRS = \
|
||||
lib \
|
||||
src \
|
||||
man \
|
||||
tests \
|
||||
po
|
||||
|
||||
ACLOCAL_AMFLAGS = -I m4
|
||||
|
||||
DISTCHECK_CONFIGURE_FLAGS = \
|
||||
--with-tmpfilesdir=$$dc_install_base/usr/lib/tmpfiles.d \
|
||||
--enable-internal-argon2 --enable-internal-sse-argon2 \
|
||||
--enable-external-tokens --enable-ssh-token --enable-asciidoc
|
||||
|
||||
distclean-local:
|
||||
-find . -name \*~ -o -name \*.orig -o -name \*.rej | xargs rm -f
|
||||
rm -rf autom4te.cache
|
||||
|
||||
clean-local:
|
||||
-rm -rf docs/doxygen_api_docs libargon2.la
|
||||
|
||||
install-data-local:
|
||||
$(MKDIR_P) -m 0755 $(DESTDIR)/${EXTERNAL_LUKS2_TOKENS_PATH}
|
||||
|
||||
uninstall-local:
|
||||
rmdir $(DESTDIR)/${EXTERNAL_LUKS2_TOKENS_PATH} 2>/dev/null || :
|
||||
|
||||
check-programs: libcryptsetup.la
|
||||
$(MAKE) -C tests $@
|
||||
|
||||
if ENABLE_FUZZ_TARGETS
|
||||
fuzz-targets: libcryptsetup.la libcrypto_backend.la
|
||||
$(MAKE) -C tests/fuzz $@
|
||||
endif
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
The cryptsetup project does not use the same license for all of the code and documentation.
|
||||
|
||||
There is code and documentation under:
|
||||
|
||||
* GPL-2.0-or-later - GNU General Public License version 2, or any later version
|
||||
|
||||
* LGPL-2.1-or-later WITH cryptsetup-OpenSSL-exception
|
||||
* LGPL-2.1-or-later - GNU Lesser General Public License 2.1 or any later version,
|
||||
(with cryptsetup-OpenSSL-exception where applicable)
|
||||
|
||||
* Apache-2.0 - Apache License 2.0
|
||||
|
||||
* CC-BY-SA-4.0 - Creative Commons Attribution Share Alike 4.0 International
|
||||
|
||||
* Public Domain
|
||||
|
||||
Please, check the source code for more details.
|
||||
|
||||
The ./COPYING file (GPL-2.0-or-later) is the default license for code without
|
||||
an explicitly defined license.
|
||||
137
README.md
137
README.md
@@ -1,137 +0,0 @@
|
||||
|
||||
|
||||
What the ...?
|
||||
=============
|
||||
**Cryptsetup** is an open-source utility used to conveniently set up disk encryption based
|
||||
on the [dm-crypt](https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt) kernel module.
|
||||
|
||||
These formats are supported:
|
||||
* **plain** volumes,
|
||||
* **LUKS** volumes,
|
||||
* **loop-AES**,
|
||||
* **TrueCrypt** (including **VeraCrypt** extension),
|
||||
* **BitLocker**, and
|
||||
* **FileVault2**.
|
||||
|
||||
The project also includes a **veritysetup** utility used to conveniently setup
|
||||
[dm-verity](https://gitlab.com/cryptsetup/cryptsetup/wikis/DMVerity)
|
||||
block integrity checking kernel module and **integritysetup** to setup
|
||||
[dm-integrity](https://gitlab.com/cryptsetup/cryptsetup/wikis/DMIntegrity)
|
||||
block integrity kernel module.
|
||||
|
||||
LUKS Design
|
||||
-----------
|
||||
**LUKS** is the standard for Linux disk encryption. By providing a standardized on-disk format,
|
||||
it not only facilitate compatibility among distributions, but also enables secure management
|
||||
of multiple user passwords. LUKS stores all necessary setup information in the partition header,
|
||||
which enables users to transport or migrate data seamlessly.
|
||||
|
||||
### Specification and documentation
|
||||
* The latest version of the
|
||||
[LUKS2 format specification](https://gitlab.com/cryptsetup/LUKS2-docs).
|
||||
* The latest version of the
|
||||
[LUKS1 format specification](https://cdn.kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/on-disk-format.pdf).
|
||||
* [Project home page](https://gitlab.com/cryptsetup/cryptsetup/).
|
||||
* [Frequently asked questions (FAQ)](https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions)
|
||||
|
||||
Download
|
||||
--------
|
||||
Release notes and tarballs are available at
|
||||
[kernel.org](https://cdn.kernel.org/pub/linux/utils/cryptsetup/).
|
||||
|
||||
**The latest stable cryptsetup release version is 2.8.1**
|
||||
* [cryptsetup-2.8.1.tar.xz](https://cdn.kernel.org/pub/linux/utils/cryptsetup/v2.8/cryptsetup-2.8.1.tar.xz)
|
||||
* Signature [cryptsetup-2.8.1.tar.sign](https://cdn.kernel.org/pub/linux/utils/cryptsetup/v2.8/cryptsetup-2.8.1.tar.sign)
|
||||
_(You need to decompress file first to check signature.)_
|
||||
* [Cryptsetup 2.8.1 Release Notes](https://cdn.kernel.org/pub/linux/utils/cryptsetup/v2.8/v2.8.1-ReleaseNotes).
|
||||
|
||||
[Previous versions](https://cdn.kernel.org/pub/linux/utils/cryptsetup)
|
||||
|
||||
Source and API documentation
|
||||
----------------------------
|
||||
For development version code, please refer to the
|
||||
[source](https://gitlab.com/cryptsetup/cryptsetup/tree/master) page, with mirrors
|
||||
at [kernel.org](https://git.kernel.org/cgit/utils/cryptsetup/cryptsetup.git/) and
|
||||
[GitHub](https://github.com/mbroz/cryptsetup).
|
||||
|
||||
For libcryptsetup documentation see
|
||||
[libcryptsetup API](https://mbroz.fedorapeople.org/libcryptsetup_API/) page.
|
||||
|
||||
NLS PO files are maintained by
|
||||
[TranslationProject](https://translationproject.org/domain/cryptsetup.html).
|
||||
|
||||
Required packages
|
||||
-----------------
|
||||
All major Linux distributions provide cryptsetup as a bundled package. If you need
|
||||
to compile cryptsetup yourself, various additional packages are required.
|
||||
Any distribution-specific build tools are preferred when manually configuring cryptsetup.
|
||||
|
||||
Below are the packages needed to build for certain Linux distributions:
|
||||
|
||||
**For Fedora**:
|
||||
```
|
||||
git gcc make autoconf automake gettext-devel pkgconfig openssl-devel popt-devel device-mapper-devel libuuid-devel json-c-devel libblkid-devel findutils libtool libssh-devel tar rubygem-asciidoctor
|
||||
|
||||
Optionally: libargon2-devel libpwquality-devel
|
||||
```
|
||||
To run the internal testsuite (make check) you also need to install
|
||||
```
|
||||
sharutils device-mapper jq vim-common expect keyutils netcat shadow-utils openssh-clients openssh sshpass
|
||||
```
|
||||
|
||||
**For Debian and Ubuntu**:
|
||||
```
|
||||
git gcc make autoconf automake autopoint pkg-config libtool gettext libssl-dev libdevmapper-dev libpopt-dev uuid-dev libsepol-dev libjson-c-dev libssh-dev libblkid-dev tar asciidoctor
|
||||
|
||||
Optionally: libargon2-0-dev libpwquality-dev
|
||||
```
|
||||
To run the internal testsuite (make check) you also need to install
|
||||
```
|
||||
sharutils dmsetup jq xxd expect keyutils netcat-openbsd passwd openssh-client sshpass
|
||||
```
|
||||
|
||||
Note that the list may change as Linux distributions evolve.
|
||||
|
||||
Compilation
|
||||
-----------
|
||||
The cryptsetup project uses **automake** and **autoconf** system to generate all files needed to build.
|
||||
When building from a git snapshot,, use **./autogen.sh && ./configure && make**
|
||||
to compile the project. When building from a release **tar.xz** tarball, the configure script
|
||||
is pre-generated (no need to run **autoconf.sh**).
|
||||
See **./configure --help** and use the **--disable-[feature]** and **--enable-[feature]** options.
|
||||
|
||||
To run the test suite that come with the project, type **make check**.
|
||||
Note that most tests will need root user privileges and will run dangerous storage failure simulations.
|
||||
Do **not** run tests with root privilege on production systems! Some tests will need the **scsi_debug**
|
||||
kernel module to be installed.
|
||||
|
||||
For more details, please refer to the
|
||||
[automake](https://www.gnu.org/software/automake/manual/automake.html) and
|
||||
[autoconf](https://www.gnu.org/savannah-checkouts/gnu/autoconf/manual/autoconf.html) documentation.
|
||||
|
||||
Help!
|
||||
-----
|
||||
### Documentation
|
||||
Please read the following before posting questions to the mailing list so that
|
||||
you can ask better questions and better understand answers.
|
||||
|
||||
* [Frequently asked questions (FAQ)](https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions),
|
||||
* [LUKS Specifications](#specification-and-documentation), and
|
||||
* manuals (aka man page, man pages, man-page)
|
||||
|
||||
The FAQ is available online and in the source code for the project. The specifications are
|
||||
referenced above in this document. The man pages live within the source tree and should be
|
||||
available after installation using standard man commands, e.g. **man cryptsetup**.
|
||||
|
||||
### Mailing List
|
||||
For cryptsetup and LUKS related questions, please use the cryptsetup mailing list
|
||||
[cryptsetup@lists.linux.dev](mailto:cryptsetup@lists.linux.dev),
|
||||
hosted at [kernel.org subspace](https://subspace.kernel.org/lists.linux.dev.html).
|
||||
To subscribe send an empty email message to
|
||||
[cryptsetup+subscribe@lists.linux.dev](mailto:cryptsetup+subscribe@lists.linux.dev).
|
||||
|
||||
You can also browse and/or search the mailing [list archive](https://lore.kernel.org/cryptsetup/).
|
||||
USEnet News (NNTP), Atom feed and git access to the public inbox is available through
|
||||
[lore.kernel.org](https://lore.kernel.org) service.
|
||||
|
||||
The former **dm-crypt** [list archive](https://lore.kernel.org/dm-crypt/) is also available.
|
||||
10
SECURITY.md
10
SECURITY.md
@@ -1,10 +0,0 @@
|
||||
# Reporting a Security Bug in cryptsetup project
|
||||
|
||||
If you think you have discovered a security issue, please report it through
|
||||
the project issue tracker [New issue](https://gitlab.com/cryptsetup/cryptsetup/issues)
|
||||
as a confidential issue (select confidential checkbox).
|
||||
|
||||
An alternative is to send PGP encrypted mail to the cryptsetup maintainer.
|
||||
Current maintainer is [Milan Broz](mailto:gmazyland@gmail.com), use PGP key
|
||||
with fingerprint 2A29 1824 3FDE 4664 8D06 86F9 D9B0 577B D93E 98FC.
|
||||
|
||||
53
acinclude.m4
Normal file
53
acinclude.m4
Normal file
@@ -0,0 +1,53 @@
|
||||
dnl MODULE_HELPER(NAME, HELP, DEFAULT, COMMANDS)
|
||||
AC_DEFUN([MODULE_HELPER],[
|
||||
unset have_module
|
||||
AC_ARG_ENABLE([$1], [$2],,[
|
||||
if test "x${enable_all}" = "xdefault"; then
|
||||
enable_[$1]=[$3]
|
||||
else
|
||||
enable_[$1]="${enable_all}"
|
||||
fi
|
||||
])
|
||||
if test "x${enable_[$1]}" != "xno"; then
|
||||
$4
|
||||
AC_MSG_CHECKING([whether to build $1 module])
|
||||
if test -n "${have_module+set}"; then
|
||||
if test "x${enable_[$1]}" = "xauto"; then
|
||||
if test "x${enable_plugins}" != "xno"; then
|
||||
AC_MSG_RESULT([yes, as plugin])
|
||||
build_static=no
|
||||
build_shared=yes
|
||||
else
|
||||
AC_MSG_RESULT([yes])
|
||||
build_static=yes
|
||||
build_shared=no
|
||||
fi
|
||||
elif test "x${enable_[$1]}" = "xshared"; then
|
||||
if test "x${enable_plugins}" != "xno"; then
|
||||
AC_MSG_RESULT([yes, as plugin])
|
||||
build_static=no
|
||||
build_shared=yes
|
||||
else
|
||||
AC_MSG_RESULT([no])
|
||||
AC_MSG_ERROR([Can't build [$1] module, plugins are disabled])
|
||||
fi
|
||||
else
|
||||
AC_MSG_RESULT([yes])
|
||||
build_static=yes
|
||||
build_shared=no
|
||||
fi
|
||||
elif test "x${enable_[$1]}" != "xauto"; then
|
||||
AC_MSG_RESULT([no])
|
||||
AC_MSG_ERROR([Unable to build $1 plugin, see messages above])
|
||||
else
|
||||
AC_MSG_RESULT([no])
|
||||
build_static=no
|
||||
build_shared=no
|
||||
fi
|
||||
else
|
||||
AC_MSG_CHECKING([whether to build $1 module])
|
||||
AC_MSG_RESULT([no])
|
||||
build_static=no
|
||||
build_shared=no
|
||||
fi
|
||||
])
|
||||
50
autogen.sh
50
autogen.sh
@@ -9,31 +9,25 @@ DIE=0
|
||||
(autopoint --version) < /dev/null > /dev/null 2>&1 || {
|
||||
echo
|
||||
echo "**Error**: You must have autopoint installed."
|
||||
echo "Download the appropriate package for your distribution."
|
||||
echo "Download the appropriate package for your distribution,"
|
||||
echo "or see http://www.gnu.org/software/gettext"
|
||||
DIE=1
|
||||
}
|
||||
|
||||
|
||||
(msgfmt --version) < /dev/null > /dev/null 2>&1 || {
|
||||
echo
|
||||
echo "**Warning**: You should have gettext installed."
|
||||
echo "Download the appropriate package for your distribution."
|
||||
echo "To disable translation, you can also use --disable-nls"
|
||||
echo "configure option."
|
||||
}
|
||||
|
||||
(autoconf --version) < /dev/null > /dev/null 2>&1 || {
|
||||
echo
|
||||
echo "**Error**: You must have autoconf installed."
|
||||
echo "Download the appropriate package for your distribution."
|
||||
echo "**Error**: You must have autoconf installed to."
|
||||
echo "Download the appropriate package for your distribution,"
|
||||
echo "or get the source tarball at ftp://ftp.gnu.org/pub/gnu/"
|
||||
DIE=1
|
||||
}
|
||||
|
||||
(grep "^LT_INIT" $srcdir/configure.ac >/dev/null) && {
|
||||
(libtoolize --version) < /dev/null > /dev/null 2>&1 || {
|
||||
(grep "^AM_PROG_LIBTOOL" $srcdir/configure.in >/dev/null) && {
|
||||
(libtool --version) < /dev/null > /dev/null 2>&1 || {
|
||||
echo
|
||||
echo "**Error**: You must have libtoolize installed."
|
||||
echo "Download the appropriate package for your distribution."
|
||||
echo "**Error**: You must have libtool installed."
|
||||
echo "Get ftp://ftp.gnu.org/pub/gnu/"
|
||||
echo "(or a newer version if it is available)"
|
||||
DIE=1
|
||||
}
|
||||
}
|
||||
@@ -41,7 +35,8 @@ DIE=0
|
||||
(automake --version) < /dev/null > /dev/null 2>&1 || {
|
||||
echo
|
||||
echo "**Error**: You must have automake installed."
|
||||
echo "Download the appropriate package for your distribution."
|
||||
echo "Get ftp://ftp.gnu.org/pub/gnu/"
|
||||
echo "(or a newer version if it is available)"
|
||||
DIE=1
|
||||
NO_AUTOMAKE=yes
|
||||
}
|
||||
@@ -52,6 +47,8 @@ test -n "$NO_AUTOMAKE" || (aclocal --version) < /dev/null > /dev/null 2>&1 || {
|
||||
echo
|
||||
echo "**Error**: Missing aclocal. The version of automake"
|
||||
echo "installed doesn't appear recent enough."
|
||||
echo "Get ftp://ftp.gnu.org/pub/gnu/"
|
||||
echo "(or a newer version if it is available)"
|
||||
DIE=1
|
||||
}
|
||||
|
||||
@@ -59,6 +56,13 @@ if test "$DIE" -eq 1; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if test -z "$*"; then
|
||||
echo
|
||||
echo "**Warning**: I am going to run 'configure' with no arguments."
|
||||
echo "If you wish to pass any to it, please specify them on the"
|
||||
echo \'$0\'" command line."
|
||||
fi
|
||||
|
||||
echo
|
||||
echo "Generate build-system by:"
|
||||
echo " autopoint: $(autopoint --version | head -1)"
|
||||
@@ -74,9 +78,13 @@ autopoint --force $AP_OPTS
|
||||
libtoolize --force --copy
|
||||
aclocal -I m4 $AL_OPTS
|
||||
autoheader $AH_OPTS
|
||||
automake --force-missing --add-missing --copy --gnu $AM_OPTS
|
||||
automake --add-missing --gnu $AM_OPTS
|
||||
autoconf $AC_OPTS
|
||||
|
||||
echo
|
||||
echo "Now type '$srcdir/configure' and 'make' to compile."
|
||||
echo
|
||||
if test x$NOCONFIGURE = x; then
|
||||
echo Running $srcdir/configure $conf_flags "$@" ...
|
||||
$srcdir/configure $conf_flags "$@" \
|
||||
&& echo Now type \`make\' to compile $PKG_NAME
|
||||
else
|
||||
echo Skipping configure process.
|
||||
fi
|
||||
|
||||
890
configure.ac
890
configure.ac
@@ -1,890 +0,0 @@
|
||||
AC_PREREQ([2.67])
|
||||
AC_INIT([cryptsetup],[2.9.0-git])
|
||||
|
||||
dnl library version from <major>.<minor>.<release>[-<suffix>]
|
||||
LIBCRYPTSETUP_VERSION=$(echo $PACKAGE_VERSION | cut -f1 -d-)
|
||||
LIBCRYPTSETUP_VERSION_INFO=23:0:11
|
||||
|
||||
AM_SILENT_RULES([yes])
|
||||
AC_CONFIG_SRCDIR(src/cryptsetup.c)
|
||||
AC_CONFIG_MACRO_DIR([m4])
|
||||
|
||||
AC_CONFIG_HEADERS([config.h:config.h.in])
|
||||
|
||||
# We do not want to run test in parallel. Really.
|
||||
# http://lists.gnu.org/archive/html/automake/2013-01/msg00060.html
|
||||
|
||||
# For old automake use this
|
||||
#AM_INIT_AUTOMAKE(dist-xz subdir-objects)
|
||||
AM_INIT_AUTOMAKE([dist-xz 1.12 serial-tests subdir-objects foreign])
|
||||
|
||||
if test "x$prefix" = "xNONE"; then
|
||||
sysconfdir=/etc
|
||||
fi
|
||||
AC_PREFIX_DEFAULT(/usr)
|
||||
|
||||
AC_CANONICAL_HOST
|
||||
AC_USE_SYSTEM_EXTENSIONS
|
||||
AC_PROG_CC
|
||||
AM_PROG_CC_C_O
|
||||
AC_PROG_CPP
|
||||
AC_PROG_CXX
|
||||
AC_PROG_INSTALL
|
||||
AC_PROG_MAKE_SET
|
||||
AC_PROG_MKDIR_P
|
||||
AC_ENABLE_STATIC(no)
|
||||
LT_INIT
|
||||
PKG_PROG_PKG_CONFIG
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl define PKG_CHECK_VAR for old pkg-config <= 0.28
|
||||
m4_ifndef([AS_VAR_COPY],
|
||||
[m4_define([AS_VAR_COPY],
|
||||
[AS_LITERAL_IF([$1[]$2], [$1=$$2], [eval $1=\$$2])])
|
||||
])
|
||||
m4_ifndef([PKG_CHECK_VAR], [
|
||||
AC_DEFUN([PKG_CHECK_VAR],
|
||||
[AC_REQUIRE([PKG_PROG_PKG_CONFIG])
|
||||
AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])
|
||||
|
||||
_PKG_CONFIG([$1], [variable="][$3]["], [$2])
|
||||
AS_VAR_COPY([$1], [pkg_cv_][$1])
|
||||
|
||||
AS_VAR_IF([$1], [""], [$5], [$4])
|
||||
])
|
||||
])
|
||||
dnl ==========================================================================
|
||||
dnl AsciiDoc manual pages
|
||||
|
||||
AC_ARG_ENABLE([asciidoc],
|
||||
AS_HELP_STRING([--disable-asciidoc], [do not generate man pages from asciidoc]),
|
||||
[], [enable_asciidoc=yes]
|
||||
)
|
||||
|
||||
AC_PATH_PROG([ASCIIDOCTOR], [asciidoctor])
|
||||
if test "x$enable_asciidoc" = xyes -a "x$ASCIIDOCTOR" = x; then
|
||||
AC_MSG_ERROR([Building man pages requires asciidoctor installed.])
|
||||
fi
|
||||
AM_CONDITIONAL([ENABLE_ASCIIDOC], [test "x$enable_asciidoc" = xyes])
|
||||
|
||||
have_manpages=no
|
||||
AS_IF([test -f "$srcdir/man/cryptsetup-open.8"], [
|
||||
AC_MSG_NOTICE([re-use already generated man-pages.])
|
||||
have_manpages=yes]
|
||||
)
|
||||
AM_CONDITIONAL([HAVE_MANPAGES], [test "x$have_manpages" = xyes])
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
AC_C_RESTRICT
|
||||
|
||||
AC_HEADER_DIRENT
|
||||
AC_CHECK_HEADERS(fcntl.h malloc.h inttypes.h uchar.h sys/ioctl.h sys/mman.h \
|
||||
sys/sysmacros.h sys/statvfs.h ctype.h unistd.h locale.h byteswap.h endian.h stdint.h)
|
||||
AC_CHECK_DECLS([O_CLOEXEC],,[AC_DEFINE([O_CLOEXEC],[0], [Defined to 0 if not provided])],
|
||||
[[
|
||||
#ifdef HAVE_FCNTL_H
|
||||
# include <fcntl.h>
|
||||
#endif
|
||||
]])
|
||||
|
||||
AC_CHECK_HEADERS(uuid/uuid.h,,[AC_MSG_ERROR([You need the uuid library.])])
|
||||
AC_CHECK_HEADER(libdevmapper.h,,[AC_MSG_ERROR([You need the device-mapper library.])])
|
||||
|
||||
AC_ARG_ENABLE([keyring],
|
||||
AS_HELP_STRING([--disable-keyring], [disable kernel keyring support and builtin kernel keyring token]),
|
||||
[], [enable_keyring=yes])
|
||||
if test "x$enable_keyring" = "xyes"; then
|
||||
AC_CHECK_HEADERS(linux/keyctl.h,,[AC_MSG_ERROR([You need Linux kernel headers with kernel keyring service compiled.])])
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl check whether kernel is compiled with kernel keyring service syscalls
|
||||
AC_CHECK_DECL(__NR_add_key,,[AC_MSG_ERROR([The kernel is missing add_key syscall.])], [#include <syscall.h>])
|
||||
AC_CHECK_DECL(__NR_keyctl,,[AC_MSG_ERROR([The kernel is missing keyctl syscall.])], [#include <syscall.h>])
|
||||
AC_CHECK_DECL(__NR_request_key,,[AC_MSG_ERROR([The kernel is missing request_key syscall.])], [#include <syscall.h>])
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl check that key_serial_t hasn't been adopted yet in stdlib
|
||||
AC_CHECK_TYPES([key_serial_t], [], [], [
|
||||
AC_INCLUDES_DEFAULT
|
||||
#ifdef HAVE_LINUX_KEYCTL_H
|
||||
# include <linux/keyctl.h>
|
||||
#endif
|
||||
])
|
||||
|
||||
AC_DEFINE(KERNEL_KEYRING, 1, [Enable kernel keyring service support])
|
||||
fi
|
||||
AM_CONDITIONAL(KERNEL_KEYRING, test "x$enable_keyring" = "xyes")
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(uuid, uuid_clear, ,[AC_MSG_ERROR([You need the uuid library.])])
|
||||
AC_SUBST(UUID_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
AC_SEARCH_LIBS([clock_gettime],[rt posix4])
|
||||
AC_CHECK_FUNCS([posix_memalign clock_gettime posix_fallocate explicit_bzero])
|
||||
|
||||
if test "x$enable_largefile" = "xno"; then
|
||||
AC_MSG_ERROR([Building with --disable-largefile is not supported, it can cause data corruption.])
|
||||
fi
|
||||
|
||||
AC_C_BIGENDIAN
|
||||
AC_TYPE_OFF_T
|
||||
AC_SYS_LARGEFILE
|
||||
AC_FUNC_FSEEKO
|
||||
AC_FUNC_STRERROR_R
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl LUKS2 external tokens
|
||||
|
||||
AC_ARG_ENABLE([external-tokens],
|
||||
AS_HELP_STRING([--disable-external-tokens], [disable external LUKS2 tokens]),
|
||||
[], [enable_external_tokens=yes])
|
||||
if test "x$enable_external_tokens" = "xyes"; then
|
||||
AC_DEFINE(USE_EXTERNAL_TOKENS, 1, [Use external tokens])
|
||||
dnl we need dynamic library loading here
|
||||
saved_LIBS=$LIBS
|
||||
AC_SEARCH_LIBS([dlsym],[dl])
|
||||
AC_CHECK_FUNCS([dlvsym])
|
||||
AC_SUBST(DL_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
fi
|
||||
AM_CONDITIONAL(EXTERNAL_TOKENS, test "x$enable_external_tokens" = "xyes")
|
||||
|
||||
AC_ARG_ENABLE([ssh-token],
|
||||
AS_HELP_STRING([--disable-ssh-token], [disable LUKS2 ssh-token]),
|
||||
[], [enable_ssh_token=yes])
|
||||
AM_CONDITIONAL(SSHPLUGIN_TOKEN, test "x$enable_ssh_token" = "xyes")
|
||||
|
||||
if test "x$enable_ssh_token" = "xyes" -a "x$enable_external_tokens" = "xno"; then
|
||||
AC_MSG_ERROR([Requested LUKS2 ssh-token build, but external tokens are disabled.])
|
||||
fi
|
||||
|
||||
dnl LUKS2 online reencryption
|
||||
AC_ARG_ENABLE([luks2-reencryption],
|
||||
AS_HELP_STRING([--disable-luks2-reencryption], [disable LUKS2 online reencryption extension]),
|
||||
[], [enable_luks2_reencryption=yes])
|
||||
if test "x$enable_luks2_reencryption" = "xyes"; then
|
||||
AC_DEFINE(USE_LUKS2_REENCRYPTION, 1, [Use LUKS2 online reencryption extension])
|
||||
fi
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
AM_GNU_GETTEXT([external],[need-ngettext])
|
||||
AM_GNU_GETTEXT_VERSION([0.18.3])
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(popt, poptConfigFileToString,,
|
||||
[AC_MSG_ERROR([You need popt 1.7 or newer to compile.])])
|
||||
AC_SUBST(POPT_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl FIPS extensions
|
||||
AC_ARG_ENABLE([fips],
|
||||
AS_HELP_STRING([--enable-fips], [enable FIPS mode restrictions]))
|
||||
if test "x$enable_fips" = "xyes"; then
|
||||
AC_DEFINE(ENABLE_FIPS, 1, [Enable FIPS mode restrictions])
|
||||
|
||||
if test "x$enable_static" = "xyes" -o "x$enable_static_cryptsetup" = "xyes" ; then
|
||||
AC_MSG_ERROR([Static build is not compatible with FIPS.])
|
||||
fi
|
||||
fi
|
||||
|
||||
AC_DEFUN([NO_FIPS], [
|
||||
if test "x$enable_fips" = "xyes"; then
|
||||
AC_MSG_ERROR([This option is not compatible with FIPS.])
|
||||
fi
|
||||
])
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl pwquality library (cryptsetup CLI only)
|
||||
AC_ARG_ENABLE([pwquality],
|
||||
AS_HELP_STRING([--enable-pwquality], [enable password quality checking using pwquality library]))
|
||||
|
||||
if test "x$enable_pwquality" = "xyes"; then
|
||||
AC_DEFINE(ENABLE_PWQUALITY, 1, [Enable password quality checking using pwquality library])
|
||||
PKG_CHECK_MODULES([PWQUALITY], [pwquality >= 1.0.0],,
|
||||
AC_MSG_ERROR([You need pwquality library.]))
|
||||
|
||||
dnl FIXME: this is really hack for now
|
||||
PWQUALITY_STATIC_LIBS="$PWQUALITY_LIBS -lcrack -lz"
|
||||
fi
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl fuzzers, it requires own static library compilation later
|
||||
AC_ARG_ENABLE([fuzz-targets],
|
||||
AS_HELP_STRING([--enable-fuzz-targets], [enable building fuzz targets]))
|
||||
AM_CONDITIONAL(ENABLE_FUZZ_TARGETS, test "x$enable_fuzz_targets" = "xyes")
|
||||
|
||||
if test "x$enable_fuzz_targets" = "xyes"; then
|
||||
AX_CHECK_COMPILE_FLAG([-fsanitize=fuzzer-no-link],,
|
||||
AC_MSG_ERROR([Required compiler options not supported; use clang.]), [-Werror])
|
||||
fi
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl passwdqc library (cryptsetup CLI only)
|
||||
AC_ARG_ENABLE([passwdqc],
|
||||
AS_HELP_STRING([--enable-passwdqc@<:@=CONFIG_PATH@:>@],
|
||||
[enable password quality checking using passwdqc library (optionally with CONFIG_PATH)]))
|
||||
|
||||
case "$enable_passwdqc" in
|
||||
""|yes|no) use_passwdqc_config="" ;;
|
||||
/*) use_passwdqc_config="$enable_passwdqc"; enable_passwdqc=yes ;;
|
||||
*) AC_MSG_ERROR([Unrecognized --enable-passwdqc parameter.]) ;;
|
||||
esac
|
||||
AC_DEFINE_UNQUOTED([PASSWDQC_CONFIG_FILE], ["$use_passwdqc_config"], [passwdqc library config file])
|
||||
|
||||
if test "x$enable_passwdqc" = "xyes"; then
|
||||
AC_DEFINE(ENABLE_PASSWDQC, 1, [Enable password quality checking using passwdqc library])
|
||||
|
||||
saved_LIBS="$LIBS"
|
||||
AC_SEARCH_LIBS([passwdqc_check], [passwdqc])
|
||||
case "$ac_cv_search_passwdqc_check" in
|
||||
no) AC_MSG_ERROR([failed to find passwdqc_check]) ;;
|
||||
-l*) PASSWDQC_LIBS="$ac_cv_search_passwdqc_check" ;;
|
||||
*) PASSWDQC_LIBS= ;;
|
||||
esac
|
||||
AC_CHECK_FUNCS([passwdqc_params_free])
|
||||
LIBS="$saved_LIBS"
|
||||
fi
|
||||
|
||||
if test "x$enable_pwquality$enable_passwdqc" = "xyesyes"; then
|
||||
AC_MSG_ERROR([--enable-pwquality and --enable-passwdqc are mutually incompatible.])
|
||||
fi
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl Crypto backend functions
|
||||
|
||||
AC_DEFUN([CONFIGURE_GCRYPT], [
|
||||
if test "x$enable_fips" = "xyes"; then
|
||||
GCRYPT_REQ_VERSION=1.4.5
|
||||
else
|
||||
GCRYPT_REQ_VERSION=1.1.42
|
||||
fi
|
||||
|
||||
use_internal_pbkdf2=0
|
||||
use_internal_argon2=1
|
||||
|
||||
dnl libgcrypt rejects to use pkgconfig, use AM_PATH_LIBGCRYPT from gcrypt-devel here.
|
||||
dnl Do not require gcrypt-devel if other crypto backend is used.
|
||||
m4_ifdef([AM_PATH_LIBGCRYPT],[
|
||||
AC_ARG_ENABLE([gcrypt-pbkdf2],
|
||||
dnl Check if we can use gcrypt PBKDF2 (1.6.0 supports empty password)
|
||||
AS_HELP_STRING([--enable-gcrypt-pbkdf2], [force enable internal gcrypt PBKDF2]),
|
||||
if test "x$enableval" = "xyes"; then
|
||||
[use_internal_pbkdf2=0]
|
||||
else
|
||||
[use_internal_pbkdf2=1]
|
||||
fi,
|
||||
[AM_PATH_LIBGCRYPT([1.6.1], [use_internal_pbkdf2=0], [use_internal_pbkdf2=1])])
|
||||
AM_PATH_LIBGCRYPT($GCRYPT_REQ_VERSION,,[AC_MSG_ERROR([You need the gcrypt library.])])],
|
||||
AC_MSG_ERROR([Missing support for gcrypt: install gcrypt and regenerate configure.]))
|
||||
|
||||
AC_MSG_CHECKING([if internal cryptsetup PBKDF2 is compiled-in])
|
||||
if test $use_internal_pbkdf2 = 0; then
|
||||
AC_MSG_RESULT([no])
|
||||
else
|
||||
AC_MSG_RESULT([yes])
|
||||
NO_FIPS([])
|
||||
fi
|
||||
|
||||
m4_ifdef([AM_PATH_LIBGCRYPT],[
|
||||
AC_ARG_ENABLE([gcrypt-argon2],
|
||||
dnl Check if we can use gcrypt Argon2 (1.11.0 supports empty password)
|
||||
AS_HELP_STRING([--disable-gcrypt-argon2], [force disable internal gcrypt Argon2]),
|
||||
[],
|
||||
[AM_PATH_LIBGCRYPT([1.11.0], [use_internal_argon2=0], [use_internal_argon2=1])])
|
||||
AM_PATH_LIBGCRYPT($GCRYPT_REQ_VERSION,,[AC_MSG_ERROR([You need the gcrypt library.])])],
|
||||
AC_MSG_ERROR([Missing support for gcrypt: install gcrypt and regenerate configure.]))
|
||||
|
||||
AC_MSG_CHECKING([if internal cryptsetup Argon2 is compiled-in])
|
||||
if test $use_internal_argon2 = 0; then
|
||||
AC_MSG_RESULT([no])
|
||||
else
|
||||
AC_MSG_RESULT([yes])
|
||||
fi
|
||||
|
||||
AC_CHECK_DECLS([GCRY_CIPHER_MODE_XTS], [], [], [#include <gcrypt.h>])
|
||||
AC_CHECK_DECLS([GCRY_KDF_ARGON2], [], [], [#include <gcrypt.h>])
|
||||
|
||||
if test "x$enable_static_cryptsetup" = "xyes"; then
|
||||
saved_LIBS=$LIBS
|
||||
LIBS="$saved_LIBS $LIBGCRYPT_LIBS -static"
|
||||
AC_CHECK_LIB(gcrypt, gcry_check_version,,
|
||||
AC_MSG_ERROR([Cannot find static gcrypt library.]),
|
||||
[-lgpg-error])
|
||||
LIBGCRYPT_STATIC_LIBS="$LIBGCRYPT_LIBS -lgpg-error"
|
||||
LIBS=$saved_LIBS
|
||||
fi
|
||||
|
||||
CRYPTO_CFLAGS=$LIBGCRYPT_CFLAGS
|
||||
CRYPTO_LIBS=$LIBGCRYPT_LIBS
|
||||
CRYPTO_STATIC_LIBS=$LIBGCRYPT_STATIC_LIBS
|
||||
|
||||
AC_DEFINE_UNQUOTED(GCRYPT_REQ_VERSION, ["$GCRYPT_REQ_VERSION"], [Requested gcrypt version])
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_OPENSSL], [
|
||||
PKG_CHECK_MODULES([LIBCRYPTO], [libcrypto >= 0.9.8],,
|
||||
AC_MSG_ERROR([You need openssl library.]))
|
||||
CRYPTO_CFLAGS=$LIBCRYPTO_CFLAGS
|
||||
CRYPTO_LIBS=$LIBCRYPTO_LIBS
|
||||
use_internal_pbkdf2=0
|
||||
use_internal_argon2=1
|
||||
|
||||
if test "x$enable_static_cryptsetup" = "xyes"; then
|
||||
saved_PKG_CONFIG=$PKG_CONFIG
|
||||
PKG_CONFIG="$PKG_CONFIG --static"
|
||||
PKG_CHECK_MODULES([LIBCRYPTO_STATIC], [libcrypto])
|
||||
CRYPTO_STATIC_LIBS=$LIBCRYPTO_STATIC_LIBS
|
||||
PKG_CONFIG=$saved_PKG_CONFIG
|
||||
fi
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_DECLS([OSSL_get_max_threads], [], [], [#include <openssl/thread.h>])
|
||||
AC_CHECK_DECLS([OSSL_KDF_PARAM_ARGON2_VERSION], [use_internal_argon2=0], [], [#include <openssl/core_names.h>])
|
||||
LIBS=$saved_LIBS
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_NSS], [
|
||||
if test "x$enable_static_cryptsetup" = "xyes"; then
|
||||
AC_MSG_ERROR([Static build of cryptsetup is not supported with NSS.])
|
||||
fi
|
||||
|
||||
AC_MSG_WARN([NSS backend does NOT provide backward compatibility (missing ripemd160 hash).])
|
||||
|
||||
PKG_CHECK_MODULES([NSS], [nss],,
|
||||
AC_MSG_ERROR([You need nss library.]))
|
||||
|
||||
saved_CFLAGS=$CFLAGS
|
||||
CFLAGS="$CFLAGS $NSS_CFLAGS"
|
||||
AC_CHECK_DECLS([NSS_GetVersion], [], [], [#include <nss.h>])
|
||||
CFLAGS=$saved_CFLAGS
|
||||
|
||||
CRYPTO_CFLAGS=$NSS_CFLAGS
|
||||
CRYPTO_LIBS=$NSS_LIBS
|
||||
use_internal_pbkdf2=1
|
||||
use_internal_argon2=1
|
||||
NO_FIPS([])
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_KERNEL], [
|
||||
AC_CHECK_HEADERS(linux/if_alg.h,,
|
||||
[AC_MSG_ERROR([You need Linux kernel headers with userspace crypto interface.])])
|
||||
# AC_CHECK_DECLS([AF_ALG],,
|
||||
# [AC_MSG_ERROR([You need Linux kernel with userspace crypto interface.])],
|
||||
# [#include <sys/socket.h>])
|
||||
use_internal_pbkdf2=1
|
||||
use_internal_argon2=1
|
||||
NO_FIPS([])
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_NETTLE], [
|
||||
AC_CHECK_HEADERS(nettle/sha.h,,
|
||||
[AC_MSG_ERROR([You need Nettle cryptographic library.])])
|
||||
AC_CHECK_HEADERS(nettle/version.h)
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(nettle, nettle_pbkdf2_hmac_sha256,,
|
||||
[AC_MSG_ERROR([You need Nettle library version 2.6 or more recent.])])
|
||||
CRYPTO_LIBS=$LIBS
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
CRYPTO_STATIC_LIBS=$CRYPTO_LIBS
|
||||
use_internal_pbkdf2=0
|
||||
use_internal_argon2=1
|
||||
NO_FIPS([])
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_MBEDTLS], [
|
||||
AC_CHECK_HEADERS(mbedtls/version.h,,
|
||||
[AC_MSG_ERROR([You need mbedTLS cryptographic library.])])
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(mbedcrypto, mbedtls_md_init,,
|
||||
[AC_MSG_ERROR([You need mbedTLS cryptographic library.])])
|
||||
AC_CHECK_FUNCS(mbedtls_pkcs5_pbkdf2_hmac_ext)
|
||||
CRYPTO_LIBS=$LIBS
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
CRYPTO_STATIC_LIBS=$CRYPTO_LIBS
|
||||
use_internal_pbkdf2=0
|
||||
use_internal_argon2=1
|
||||
NO_FIPS([])
|
||||
])
|
||||
|
||||
dnl ==========================================================================
|
||||
saved_LIBS=$LIBS
|
||||
|
||||
AC_ARG_ENABLE([static-cryptsetup],
|
||||
AS_HELP_STRING([--enable-static-cryptsetup], [enable build of static version of tools]))
|
||||
if test "x$enable_static_cryptsetup" = "xyes"; then
|
||||
if test "x$enable_static" = "xno"; then
|
||||
AC_MSG_WARN([Requested static cryptsetup build, enabling static library.])
|
||||
enable_static=yes
|
||||
fi
|
||||
fi
|
||||
AM_CONDITIONAL(STATIC_TOOLS, test "x$enable_static_cryptsetup" = "xyes")
|
||||
|
||||
AC_ARG_ENABLE([cryptsetup],
|
||||
AS_HELP_STRING([--disable-cryptsetup], [disable cryptsetup support]),
|
||||
[], [enable_cryptsetup=yes])
|
||||
AM_CONDITIONAL(CRYPTSETUP, test "x$enable_cryptsetup" = "xyes")
|
||||
|
||||
AC_ARG_ENABLE([veritysetup],
|
||||
AS_HELP_STRING([--disable-veritysetup], [disable veritysetup support]),
|
||||
[], [enable_veritysetup=yes])
|
||||
AM_CONDITIONAL(VERITYSETUP, test "x$enable_veritysetup" = "xyes")
|
||||
|
||||
AC_ARG_ENABLE([integritysetup],
|
||||
AS_HELP_STRING([--disable-integritysetup], [disable integritysetup support]),
|
||||
[], [enable_integritysetup=yes])
|
||||
AM_CONDITIONAL(INTEGRITYSETUP, test "x$enable_integritysetup" = "xyes")
|
||||
|
||||
AC_ARG_ENABLE([selinux],
|
||||
AS_HELP_STRING([--disable-selinux], [disable selinux support [default=auto]]),
|
||||
[], [enable_selinux=yes])
|
||||
|
||||
AC_ARG_ENABLE([udev],
|
||||
AS_HELP_STRING([--disable-udev], [disable udev support]),
|
||||
[], [enable_udev=yes])
|
||||
|
||||
dnl Try to use pkg-config for devmapper, but fallback to old detection
|
||||
PKG_CHECK_MODULES([DEVMAPPER], [devmapper >= 1.02.03],, [
|
||||
AC_CHECK_LIB(devmapper, dm_task_set_name,,
|
||||
[AC_MSG_ERROR([You need the device-mapper library.])])
|
||||
AC_CHECK_LIB(devmapper, dm_task_set_message,,
|
||||
[AC_MSG_ERROR([The device-mapper library on your system is too old.])])
|
||||
DEVMAPPER_LIBS=$LIBS
|
||||
])
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
LIBS="$LIBS $DEVMAPPER_LIBS"
|
||||
AC_CHECK_DECLS([dm_task_secure_data], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([dm_task_retry_remove], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([dm_task_deferred_remove], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([dm_device_has_mounted_fs], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([dm_device_has_holders], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([dm_device_get_name], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([DM_DEVICE_GET_TARGET_VERSION], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([DM_UDEV_DISABLE_DISK_RULES_FLAG], [have_cookie=yes], [have_cookie=no], [#include <libdevmapper.h>])
|
||||
if test "x$enable_udev" = xyes; then
|
||||
if test "x$have_cookie" = xno; then
|
||||
AC_MSG_WARN([The device-mapper library on your system has no udev support, udev support disabled.])
|
||||
else
|
||||
AC_DEFINE(USE_UDEV, 1, [Try to use udev synchronisation?])
|
||||
fi
|
||||
fi
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
dnl Check for JSON-C used in LUKS2
|
||||
PKG_CHECK_MODULES([JSON_C], [json-c])
|
||||
AC_CHECK_DECLS([json_object_object_add_ex], [], [], [#include <json-c/json.h>])
|
||||
AC_CHECK_DECLS([json_object_deep_copy], [], [], [#include <json-c/json.h>])
|
||||
|
||||
dnl Check for libssh and argp for SSH plugin
|
||||
if test "x$enable_ssh_token" = "xyes"; then
|
||||
PKG_CHECK_MODULES([LIBSSH], [libssh])
|
||||
AC_CHECK_DECLS([ssh_session_is_known_server], [], [], [#include <libssh/libssh.h>])
|
||||
AC_CHECK_HEADER([argp.h], [], AC_MSG_ERROR([You need argp library.]))
|
||||
saved_LIBS=$LIBS
|
||||
AC_SEARCH_LIBS([argp_parse],[argp])
|
||||
AC_SUBST(ARGP_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
fi
|
||||
|
||||
dnl Crypto backend configuration.
|
||||
AC_ARG_WITH([crypto_backend],
|
||||
AS_HELP_STRING([--with-crypto_backend=BACKEND], [crypto backend (gcrypt/openssl/nss/kernel/nettle/mbedtls) [openssl]]),
|
||||
[], [with_crypto_backend=openssl])
|
||||
|
||||
dnl Kernel crypto API backend needed for benchmark and tcrypt
|
||||
AC_ARG_ENABLE([kernel_crypto],
|
||||
AS_HELP_STRING([--disable-kernel_crypto], [disable kernel userspace crypto (no benchmark and tcrypt)]),
|
||||
[], [enable_kernel_crypto=yes])
|
||||
|
||||
if test "x$enable_kernel_crypto" = "xyes"; then
|
||||
AC_CHECK_HEADERS(linux/if_alg.h,,
|
||||
[AC_MSG_ERROR([You need Linux kernel headers with userspace crypto interface. (Or use --disable-kernel_crypto.)])])
|
||||
AC_DEFINE(ENABLE_AF_ALG, 1, [Enable using of kernel userspace crypto])
|
||||
fi
|
||||
|
||||
case $with_crypto_backend in
|
||||
gcrypt) CONFIGURE_GCRYPT([]) ;;
|
||||
openssl) CONFIGURE_OPENSSL([]) ;;
|
||||
nss) CONFIGURE_NSS([]) ;;
|
||||
kernel) CONFIGURE_KERNEL([]) ;;
|
||||
nettle) CONFIGURE_NETTLE([]) ;;
|
||||
mbedtls) CONFIGURE_MBEDTLS([]) ;;
|
||||
*) AC_MSG_ERROR([Unknown crypto backend.]) ;;
|
||||
esac
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_GCRYPT, test "$with_crypto_backend" = "gcrypt")
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_OPENSSL, test "$with_crypto_backend" = "openssl")
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_NSS, test "$with_crypto_backend" = "nss")
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_KERNEL, test "$with_crypto_backend" = "kernel")
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_NETTLE, test "$with_crypto_backend" = "nettle")
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_MBEDTLS, test "$with_crypto_backend" = "mbedtls")
|
||||
|
||||
AM_CONDITIONAL(CRYPTO_INTERNAL_PBKDF2, test $use_internal_pbkdf2 = 1)
|
||||
AC_DEFINE_UNQUOTED(USE_INTERNAL_PBKDF2, [$use_internal_pbkdf2], [Use internal PBKDF2])
|
||||
|
||||
dnl Argon2 implementation
|
||||
AC_ARG_ENABLE([internal-argon2],
|
||||
AS_HELP_STRING([--disable-internal-argon2], [disable internal implementation of Argon2 PBKDF]),
|
||||
[], [enable_internal_argon2=yes])
|
||||
|
||||
AC_ARG_ENABLE([libargon2],
|
||||
AS_HELP_STRING([--enable-libargon2], [enable external libargon2 (PHC) library (disables internal bundled version)]))
|
||||
|
||||
if test $use_internal_argon2 = 0 || ( test "x$enable_internal_argon2" = "xno" && test "x$enable_libargon2" != "xyes" ); then
|
||||
if test "x$enable_internal_argon2" = "xyes" || test "x$enable_libargon2" = "xyes"; then
|
||||
AC_MSG_NOTICE([Argon2 in $with_crypto_backend lib is used; internal Argon2 options are ignored.])
|
||||
fi
|
||||
enable_internal_argon2=no
|
||||
enable_internal_sse_argon2=no
|
||||
enable_libargon2=no
|
||||
use_internal_argon2=0
|
||||
elif test "x$enable_libargon2" = "xyes" ; then
|
||||
AC_CHECK_HEADERS(argon2.h,,
|
||||
[AC_MSG_ERROR([You need libargon2 development library installed.])])
|
||||
AC_CHECK_DECL(Argon2_id,,[AC_MSG_ERROR([You need more recent Argon2 library with support for Argon2id.])], [#include <argon2.h>])
|
||||
PKG_CHECK_MODULES([LIBARGON2], [libargon2],,[LIBARGON2_LIBS="-largon2"])
|
||||
enable_internal_argon2=no
|
||||
use_internal_argon2=0
|
||||
else
|
||||
AC_MSG_WARN([Argon2 bundled (slow) reference implementation will be used, please consider to use system library with --enable-libargon2.])
|
||||
|
||||
AC_ARG_ENABLE([internal-sse-argon2],
|
||||
AS_HELP_STRING([--enable-internal-sse-argon2], [enable internal SSE implementation of Argon2 PBKDF]))
|
||||
|
||||
if test "x$enable_internal_sse_argon2" = "xyes"; then
|
||||
AC_MSG_CHECKING(if Argon2 SSE optimization can be used)
|
||||
AC_LINK_IFELSE([AC_LANG_PROGRAM([[
|
||||
#include <emmintrin.h>
|
||||
__m128i testfunc(__m128i *a, __m128i *b) {
|
||||
return _mm_xor_si128(_mm_loadu_si128(a), _mm_loadu_si128(b));
|
||||
}
|
||||
]])],,[enable_internal_sse_argon2=no])
|
||||
AC_MSG_RESULT($enable_internal_sse_argon2)
|
||||
fi
|
||||
fi
|
||||
|
||||
AM_CONDITIONAL(CRYPTO_INTERNAL_ARGON2, test "x$enable_internal_argon2" = "xyes")
|
||||
AM_CONDITIONAL(CRYPTO_INTERNAL_SSE_ARGON2, test "x$enable_internal_sse_argon2" = "xyes")
|
||||
dnl If libargon is in use, we have defined HAVE_ARGON2_H
|
||||
AC_DEFINE_UNQUOTED(USE_INTERNAL_ARGON2, [$use_internal_argon2], [Use internal Argon2])
|
||||
|
||||
dnl Link with blkid to check for other device types
|
||||
AC_ARG_ENABLE([blkid],
|
||||
AS_HELP_STRING([--disable-blkid], [disable use of blkid for device signature detection and wiping]),
|
||||
[], [enable_blkid=yes])
|
||||
|
||||
if test "x$enable_blkid" = "xyes"; then
|
||||
PKG_CHECK_MODULES([BLKID], [blkid],[AC_DEFINE([HAVE_BLKID], 1, [Define to 1 to use blkid for detection of disk signatures.])],[LIBBLKID_LIBS="-lblkid"])
|
||||
|
||||
AC_CHECK_HEADERS(blkid/blkid.h,,[AC_MSG_ERROR([You need blkid development library installed.])])
|
||||
AC_CHECK_DECL([blkid_do_wipe],
|
||||
[ AC_DEFINE([HAVE_BLKID_WIPE], 1, [Define to 1 to use blkid_do_wipe.])
|
||||
enable_blkid_wipe=yes
|
||||
],,
|
||||
[#include <blkid/blkid.h>])
|
||||
AC_CHECK_DECL([blkid_probe_step_back],
|
||||
[ AC_DEFINE([HAVE_BLKID_STEP_BACK], 1, [Define to 1 to use blkid_probe_step_back.])
|
||||
enable_blkid_step_back=yes
|
||||
],,
|
||||
[#include <blkid/blkid.h>])
|
||||
AC_CHECK_DECLS([ blkid_reset_probe,
|
||||
blkid_probe_set_device,
|
||||
blkid_probe_filter_superblocks_type,
|
||||
blkid_do_safeprobe,
|
||||
blkid_do_probe,
|
||||
blkid_probe_lookup_value
|
||||
],,
|
||||
[AC_MSG_ERROR([Can not compile with blkid support, disable it by --disable-blkid.])],
|
||||
[#include <blkid/blkid.h>])
|
||||
fi
|
||||
AM_CONDITIONAL(HAVE_BLKID, test "x$enable_blkid" = "xyes")
|
||||
AM_CONDITIONAL(HAVE_BLKID_WIPE, test "x$enable_blkid_wipe" = "xyes")
|
||||
AM_CONDITIONAL(HAVE_BLKID_STEP_BACK, test "x$enable_blkid_step_back" = "xyes")
|
||||
|
||||
AC_ARG_ENABLE([hw-opal],
|
||||
AS_HELP_STRING([--disable-hw-opal], [disable use of hardware-backed OPAL for device encryption]),
|
||||
[],
|
||||
[enable_hw_opal=yes])
|
||||
|
||||
if test "x$enable_hw_opal" = "xyes"; then
|
||||
have_opal=yes
|
||||
AC_CHECK_DECLS([ OPAL_FL_SUM_SUPPORTED,
|
||||
IOC_OPAL_GET_LR_STATUS,
|
||||
IOC_OPAL_GET_GEOMETRY
|
||||
],
|
||||
[],
|
||||
[have_opal=no],
|
||||
[#include <linux/sed-opal.h>])
|
||||
if test "x$have_opal" = "xyes"; then
|
||||
AC_DEFINE([HAVE_HW_OPAL], 1, [Define to 1 to enable OPAL support.])
|
||||
else
|
||||
AC_MSG_WARN([Can not compile with OPAL support, kernel headers are too old, requires v6.4.])
|
||||
fi
|
||||
fi
|
||||
|
||||
dnl Magic for cryptsetup.static build.
|
||||
if test "x$enable_static_cryptsetup" = "xyes"; then
|
||||
saved_PKG_CONFIG=$PKG_CONFIG
|
||||
PKG_CONFIG="$PKG_CONFIG --static"
|
||||
|
||||
LIBS="$saved_LIBS -static"
|
||||
AC_CHECK_LIB(popt, poptGetContext,,
|
||||
AC_MSG_ERROR([Cannot find static popt library.]))
|
||||
|
||||
dnl Try to detect needed device-mapper static libraries, try pkg-config first.
|
||||
LIBS="$saved_LIBS -static"
|
||||
PKG_CHECK_MODULES([DEVMAPPER_STATIC], [devmapper >= 1.02.27],,[
|
||||
DEVMAPPER_STATIC_LIBS=$DEVMAPPER_LIBS
|
||||
if test "x$enable_selinux" = "xyes"; then
|
||||
AC_CHECK_LIB(sepol, sepol_bool_set)
|
||||
AC_CHECK_LIB(selinux, is_selinux_enabled)
|
||||
DEVMAPPER_STATIC_LIBS="$DEVMAPPER_STATIC_LIBS $LIBS"
|
||||
fi
|
||||
])
|
||||
LIBS="$saved_LIBS $DEVMAPPER_STATIC_LIBS"
|
||||
AC_CHECK_LIB(devmapper, dm_task_set_uuid,,
|
||||
AC_MSG_ERROR([Cannot link with static device-mapper library.]))
|
||||
|
||||
dnl Try to detect uuid static library.
|
||||
LIBS="$saved_LIBS -static"
|
||||
AC_CHECK_LIB(uuid, uuid_generate,,
|
||||
AC_MSG_ERROR([Cannot find static uuid library.]))
|
||||
|
||||
LIBS=$saved_LIBS
|
||||
PKG_CONFIG=$saved_PKG_CONFIG
|
||||
fi
|
||||
|
||||
dnl Check compiler support for symver function attribute
|
||||
AC_MSG_CHECKING([for symver attribute support])
|
||||
saved_CFLAGS=$CFLAGS
|
||||
CFLAGS="-O0 -Werror"
|
||||
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
|
||||
void _test_sym(void);
|
||||
__attribute__((__symver__("sym@VERSION_4.2"))) void _test_sym(void) {}
|
||||
]],
|
||||
[[ _test_sym() ]]
|
||||
)],[
|
||||
AC_DEFINE([HAVE_ATTRIBUTE_SYMVER], 1, [Define to 1 to use __attribute__((symver))])
|
||||
AC_MSG_RESULT([yes])
|
||||
], [
|
||||
AC_MSG_RESULT([no])
|
||||
])
|
||||
CFLAGS=$saved_CFLAGS
|
||||
|
||||
dnl Force compiler to use zero_call_used_regs("used") to check for the function attribute support.
|
||||
dnl Otherwise the compiler may falsely advertise it with __has_attribute operator, even though
|
||||
dnl it does not implement it on some archs.
|
||||
AC_MSG_CHECKING([for zero_call_used_regs(user)])
|
||||
saved_CFLAGS=$CFLAGS
|
||||
CFLAGS="-O0 -Werror"
|
||||
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
|
||||
void _test_function(void);
|
||||
__attribute__((zero_call_used_regs("used"))) void _test_function(void) {
|
||||
volatile int *i; volatile int j = 0; if (j) *i = 0;
|
||||
}
|
||||
]],
|
||||
[[ _test_function() ]]
|
||||
)],[
|
||||
AC_DEFINE([HAVE_ATTRIBUTE_ZEROCALLUSEDREGS], 1, [Define to 1 to use __attribute__((zero_call_used_regs("used")))])
|
||||
AC_MSG_RESULT([yes])
|
||||
], [
|
||||
AC_MSG_RESULT([no])
|
||||
])
|
||||
CFLAGS=$saved_CFLAGS
|
||||
|
||||
AC_MSG_CHECKING([for systemd tmpfiles config directory])
|
||||
if test "x$prefix" != "xNONE"; then
|
||||
saved_PKG_CONFIG=$PKG_CONFIG
|
||||
PKG_CONFIG="$PKG_CONFIG --define-variable=prefix='${prefix}'"
|
||||
PKG_CHECK_VAR([systemd_tmpfilesdir], [systemd], [tmpfilesdir], [], [systemd_tmpfilesdir=no])
|
||||
PKG_CONFIG=$saved_PKG_CONFIG
|
||||
else
|
||||
PKG_CHECK_VAR([systemd_tmpfilesdir], [systemd], [tmpfilesdir], [], [systemd_tmpfilesdir=no])
|
||||
fi
|
||||
AC_MSG_RESULT([$systemd_tmpfilesdir])
|
||||
|
||||
AC_SUBST([DEVMAPPER_LIBS])
|
||||
AC_SUBST([DEVMAPPER_STATIC_LIBS])
|
||||
|
||||
AC_SUBST([PWQUALITY_LIBS])
|
||||
AC_SUBST([PWQUALITY_STATIC_LIBS])
|
||||
|
||||
AC_SUBST([PASSWDQC_LIBS])
|
||||
|
||||
AC_SUBST([CRYPTO_CFLAGS])
|
||||
AC_SUBST([CRYPTO_LIBS])
|
||||
AC_SUBST([CRYPTO_STATIC_LIBS])
|
||||
|
||||
AC_SUBST([JSON_C_LIBS])
|
||||
AC_SUBST([LIBARGON2_LIBS])
|
||||
AC_SUBST([BLKID_LIBS])
|
||||
|
||||
AC_SUBST([LIBSSH_LIBS])
|
||||
|
||||
AC_SUBST([LIBCRYPTSETUP_VERSION])
|
||||
AC_SUBST([LIBCRYPTSETUP_VERSION_INFO])
|
||||
|
||||
dnl Set Requires.private for libcryptsetup.pc
|
||||
dnl pwquality is used only by tools
|
||||
PKGMODULES="uuid devmapper json-c"
|
||||
case $with_crypto_backend in
|
||||
gcrypt) PKGMODULES="$PKGMODULES libgcrypt" ;;
|
||||
openssl) PKGMODULES="$PKGMODULES openssl" ;;
|
||||
nss) PKGMODULES="$PKGMODULES nss" ;;
|
||||
nettle) PKGMODULES="$PKGMODULES nettle" ;;
|
||||
esac
|
||||
if test "x$enable_libargon2" = "xyes"; then
|
||||
PKGMODULES="$PKGMODULES libargon2"
|
||||
fi
|
||||
if test "x$enable_blkid" = "xyes"; then
|
||||
PKGMODULES="$PKGMODULES blkid"
|
||||
fi
|
||||
AC_SUBST([PKGMODULES])
|
||||
dnl ==========================================================================
|
||||
AC_ARG_ENABLE([dev-random],
|
||||
AS_HELP_STRING([--enable-dev-random], [use /dev/random by default for key generation (otherwise use /dev/urandom)]))
|
||||
if test "x$enable_dev_random" = "xyes"; then
|
||||
default_rng=/dev/random
|
||||
else
|
||||
default_rng=/dev/urandom
|
||||
fi
|
||||
AC_DEFINE_UNQUOTED(DEFAULT_RNG, ["$default_rng"], [default RNG type for key generator])
|
||||
|
||||
dnl ==========================================================================
|
||||
AC_DEFUN([CS_DEFINE],
|
||||
[AC_DEFINE_UNQUOTED(DEFAULT_[]m4_translit([$1], [-a-z], [_A-Z]), [$2], [$3])
|
||||
])
|
||||
|
||||
AC_DEFUN([CS_STR_WITH], [AC_ARG_WITH([$1],
|
||||
[AS_HELP_STRING(--with-[$1], [default $2 [$3]])],
|
||||
[CS_DEFINE([$1], ["$withval"], [$2])],
|
||||
[CS_DEFINE([$1], ["$3"], [$2])]
|
||||
)])
|
||||
|
||||
AC_DEFUN([CS_NUM_WITH], [AC_ARG_WITH([$1],
|
||||
[AS_HELP_STRING(--with-[$1], [default $2 [$3]])],
|
||||
[CS_DEFINE([$1], [$withval], [$2])],
|
||||
[CS_DEFINE([$1], [$3], [$2])]
|
||||
)])
|
||||
|
||||
AC_DEFUN([CS_ABSPATH], [
|
||||
case "$1" in
|
||||
/*) ;;
|
||||
*) AC_MSG_ERROR([$2 argument must be an absolute path.]);;
|
||||
esac
|
||||
])
|
||||
|
||||
dnl ==========================================================================
|
||||
CS_STR_WITH([plain-hash], [password hashing function for plain mode], [sha256])
|
||||
CS_STR_WITH([plain-cipher], [cipher for plain mode], [aes])
|
||||
CS_STR_WITH([plain-mode], [cipher mode for plain mode], [xts-plain64])
|
||||
CS_NUM_WITH([plain-keybits],[key length in bits for plain mode], [256])
|
||||
|
||||
CS_STR_WITH([luks1-hash], [hash function for LUKS1 header], [sha256])
|
||||
CS_STR_WITH([luks1-cipher], [cipher for LUKS1], [aes])
|
||||
CS_STR_WITH([luks1-mode], [cipher mode for LUKS1], [xts-plain64])
|
||||
CS_NUM_WITH([luks1-keybits],[key length in bits for LUKS1], [256])
|
||||
|
||||
AC_ARG_ENABLE([luks_adjust_xts_keysize], AS_HELP_STRING([--disable-luks-adjust-xts-keysize],
|
||||
[XTS mode requires two keys, double default LUKS keysize if needed]),
|
||||
[], [enable_luks_adjust_xts_keysize=yes])
|
||||
if test "x$enable_luks_adjust_xts_keysize" = "xyes"; then
|
||||
AC_DEFINE(ENABLE_LUKS_ADJUST_XTS_KEYSIZE, 1, [XTS mode - double default LUKS keysize if needed])
|
||||
fi
|
||||
|
||||
CS_STR_WITH([luks2-pbkdf], [Default PBKDF algorithm (pbkdf2 or argon2i/argon2id) for LUKS2], [argon2id])
|
||||
CS_NUM_WITH([luks1-iter-time], [PBKDF2 iteration time for LUKS1 (in ms)], [2000])
|
||||
CS_NUM_WITH([luks2-iter-time], [Argon2 PBKDF iteration time for LUKS2 (in ms)], [2000])
|
||||
CS_NUM_WITH([luks2-memory-kb], [Argon2 PBKDF memory cost for LUKS2 (in kB)], [1048576])
|
||||
CS_NUM_WITH([luks2-parallel-threads],[Argon2 PBKDF max parallel cost for LUKS2 (if CPUs available)], [4])
|
||||
|
||||
CS_STR_WITH([luks2-keyslot-cipher], [fallback cipher for LUKS2 keyslot (if data encryption is incompatible)], [aes-xts-plain64])
|
||||
CS_NUM_WITH([luks2-keyslot-keybits],[fallback key size for LUKS2 keyslot (if data encryption is incompatible)], [512])
|
||||
|
||||
CS_STR_WITH([loopaes-cipher], [cipher for loop-AES mode], [aes])
|
||||
CS_NUM_WITH([loopaes-keybits],[key length in bits for loop-AES mode], [256])
|
||||
|
||||
CS_NUM_WITH([keyfile-size-maxkb],[maximum keyfile size (in KiB)], [8192])
|
||||
CS_NUM_WITH([integrity-keyfile-size-maxkb],[maximum integritysetup keyfile size (in KiB)], [4])
|
||||
CS_NUM_WITH([passphrase-size-max],[maximum passphrase size (in characters)], [512])
|
||||
|
||||
CS_STR_WITH([verity-hash], [hash function for verity mode], [sha256])
|
||||
CS_NUM_WITH([verity-data-block], [data block size for verity mode], [4096])
|
||||
CS_NUM_WITH([verity-hash-block], [hash block size for verity mode], [4096])
|
||||
CS_NUM_WITH([verity-salt-size], [salt size for verity mode], [32])
|
||||
CS_NUM_WITH([verity-fec-roots], [parity bytes for verity FEC], [2])
|
||||
|
||||
AC_ARG_WITH([tmpfilesdir],
|
||||
AS_HELP_STRING([--with-tmpfilesdir=DIR], [override default path to directory with systemd temporary files]),
|
||||
[], [with_tmpfilesdir=$systemd_tmpfilesdir])
|
||||
test "x$with_tmpfilesdir" = "xno" || {
|
||||
CS_ABSPATH([${with_tmpfilesdir}],[with-tmpfilesdir])
|
||||
DEFAULT_TMPFILESDIR=$with_tmpfilesdir
|
||||
AC_SUBST(DEFAULT_TMPFILESDIR)
|
||||
}
|
||||
AM_CONDITIONAL(CRYPTSETUP_TMPFILE, test -n "$DEFAULT_TMPFILESDIR")
|
||||
|
||||
CS_STR_WITH([luks2-lock-path], [path to directory for LUKSv2 locks], [/run/cryptsetup])
|
||||
test -z "$with_luks2_lock_path" && with_luks2_lock_path=/run/cryptsetup
|
||||
CS_ABSPATH([${with_luks2_lock_path}],[with-luks2-lock-path])
|
||||
DEFAULT_LUKS2_LOCK_PATH=$with_luks2_lock_path
|
||||
AC_SUBST(DEFAULT_LUKS2_LOCK_PATH)
|
||||
|
||||
CS_NUM_WITH([luks2-lock-dir-perms], [default luks2 locking directory permissions], [0700])
|
||||
test -z "$with_luks2_lock_dir_perms" && with_luks2_lock_dir_perms=0700
|
||||
DEFAULT_LUKS2_LOCK_DIR_PERMS=$with_luks2_lock_dir_perms
|
||||
AC_SUBST(DEFAULT_LUKS2_LOCK_DIR_PERMS)
|
||||
|
||||
AC_ARG_WITH([luks2-external-tokens-path],
|
||||
AS_HELP_STRING([--with-luks2-external-tokens-path=DIR], [path to directory with LUKSv2 external token handlers (plugins)]),
|
||||
[], [with_luks2_external_tokens_path=""])
|
||||
if test -n "$with_luks2_external_tokens_path"; then
|
||||
CS_ABSPATH([${with_luks2_external_tokens_path}],[with-luks2-external-tokens-path])
|
||||
EXTERNAL_LUKS2_TOKENS_PATH=$with_luks2_external_tokens_path
|
||||
else
|
||||
EXTERNAL_LUKS2_TOKENS_PATH="\${libdir}/cryptsetup"
|
||||
fi
|
||||
AC_SUBST(EXTERNAL_LUKS2_TOKENS_PATH)
|
||||
dnl We need to define expanded EXTERNAL_LUKS2_TOKENS_PATH, but some other code can depend on prefix=NONE.
|
||||
dnl Pretend you do not see this hack :-)
|
||||
saved_prefix=$prefix
|
||||
saved_exec_prefix=$exec_prefix
|
||||
test "x$prefix" = "xNONE" && prefix="$ac_default_prefix"
|
||||
test "x$exec_prefix" = "xNONE" && exec_prefix="$prefix"
|
||||
expanded_EXTERNAL_LUKS2_TOKENS_PATH=$(eval echo "$EXTERNAL_LUKS2_TOKENS_PATH")
|
||||
expanded_EXTERNAL_LUKS2_TOKENS_PATH=$(eval echo "$expanded_EXTERNAL_LUKS2_TOKENS_PATH")
|
||||
AC_DEFINE_UNQUOTED([EXTERNAL_LUKS2_TOKENS_PATH], ["$expanded_EXTERNAL_LUKS2_TOKENS_PATH"], [path to directory with LUKSv2 external token handlers (plugins)])
|
||||
prefix=$saved_prefix
|
||||
exec_prefix=$saved_exec_prefix
|
||||
|
||||
dnl Override default LUKS format version (for cryptsetup or cryptsetup-reencrypt format actions only).
|
||||
AC_ARG_WITH([default_luks_format],
|
||||
AS_HELP_STRING([--with-default-luks-format=FORMAT], [default LUKS format version (LUKS1/LUKS2) [LUKS2]]),
|
||||
[], [with_default_luks_format=LUKS2])
|
||||
|
||||
case $with_default_luks_format in
|
||||
LUKS1) default_luks=CRYPT_LUKS1 ;;
|
||||
LUKS2) default_luks=CRYPT_LUKS2 ;;
|
||||
*) AC_MSG_ERROR([Unknown default LUKS format. Use LUKS1 or LUKS2 only.]) ;;
|
||||
esac
|
||||
AC_DEFINE_UNQUOTED([DEFAULT_LUKS_FORMAT], [$default_luks], [default LUKS format version])
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
AC_CONFIG_FILES([ Makefile
|
||||
lib/libcryptsetup.pc
|
||||
po/Makefile.in
|
||||
scripts/cryptsetup.conf
|
||||
tests/Makefile
|
||||
tests/fuzz/Makefile
|
||||
])
|
||||
AC_OUTPUT
|
||||
193
configure.in
Normal file
193
configure.in
Normal file
@@ -0,0 +1,193 @@
|
||||
AC_PREREQ([2.67])
|
||||
AC_INIT([cryptsetup],[1.2.0])
|
||||
|
||||
dnl library version from <major>.<minor>.<release>[-<suffix>]
|
||||
LIBCRYPTSETUP_VERSION=$(echo $PACKAGE_VERSION | cut -f1 -d-)
|
||||
LIBCRYPTSETUP_VERSION_INFO=2:0:1
|
||||
|
||||
AC_CONFIG_SRCDIR(src/cryptsetup.c)
|
||||
AC_CONFIG_MACRO_DIR([m4])
|
||||
|
||||
AC_CONFIG_HEADERS([config.h:config.h.in])
|
||||
AM_INIT_AUTOMAKE(dist-bzip2)
|
||||
|
||||
if test "x$prefix" = "xNONE"; then
|
||||
sysconfdir=/etc
|
||||
fi
|
||||
AC_PREFIX_DEFAULT(/usr)
|
||||
|
||||
AC_CANONICAL_HOST
|
||||
AC_USE_SYSTEM_EXTENSIONS
|
||||
AC_PROG_CC
|
||||
AM_PROG_CC_C_O
|
||||
AC_PROG_CPP
|
||||
AC_PROG_INSTALL
|
||||
AC_PROG_MAKE_SET
|
||||
AC_ENABLE_STATIC(no)
|
||||
LT_INIT
|
||||
|
||||
AC_HEADER_DIRENT
|
||||
AC_HEADER_STDC
|
||||
AC_CHECK_HEADERS(fcntl.h malloc.h inttypes.h sys/ioctl.h sys/mman.h \
|
||||
ctype.h unistd.h locale.h)
|
||||
|
||||
AC_CHECK_HEADERS(uuid/uuid.h,,[AC_MSG_ERROR('You need the uuid library')])
|
||||
AC_CHECK_HEADER(libdevmapper.h,,[AC_MSG_ERROR('You need the device-mapper library')])
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(uuid, uuid_clear, ,[AC_MSG_ERROR('You need the uuid library')])
|
||||
AC_SUBST(UUID_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
|
||||
AM_PATH_LIBGCRYPT(1.1.42,,[AC_MSG_ERROR('You need the gcrypt library')])
|
||||
|
||||
AC_CHECK_FUNCS([posix_memalign])
|
||||
|
||||
AC_C_CONST
|
||||
AC_C_BIGENDIAN
|
||||
AC_TYPE_OFF_T
|
||||
AC_SYS_LARGEFILE
|
||||
|
||||
AC_PROG_GCC_TRADITIONAL
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
AM_GNU_GETTEXT([external],[need-ngettext])
|
||||
AM_GNU_GETTEXT_VERSION([0.15])
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(popt, poptConfigFileToString,,
|
||||
[AC_MSG_ERROR([You need popt 1.7 or newer to compile.])])
|
||||
AC_SUBST(POPT_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
dnl ==========================================================================
|
||||
saved_LIBS=$LIBS
|
||||
|
||||
AC_ARG_ENABLE([static-cryptsetup],
|
||||
AS_HELP_STRING([--enable-static-cryptsetup],
|
||||
[enable build of static cryptsetup binary]), [
|
||||
if test x$enable_static = xno; then
|
||||
AC_MSG_WARN([Requested static cryptsetup build, enabling static library.])
|
||||
enable_static=yes
|
||||
fi
|
||||
enable_static_cryptsetup=yes])
|
||||
AM_CONDITIONAL(STATIC_CRYPTSETUP, test x$enable_static_cryptsetup = xyes)
|
||||
|
||||
AC_ARG_ENABLE(selinux,
|
||||
AS_HELP_STRING([--disable-selinux],
|
||||
[disable selinux support [default=auto]]),[], [])
|
||||
|
||||
AC_ARG_ENABLE([udev],
|
||||
AS_HELP_STRING([--disable-udev],
|
||||
[disable udev support]),[], enable_udev=yes)
|
||||
|
||||
dnl Try to use pkg-config for devmapper, but fallback to old detection
|
||||
PKG_CHECK_MODULES([DEVMAPPER], [devmapper >= 1.02.03],, [
|
||||
AC_CHECK_LIB(devmapper, dm_task_set_name,,
|
||||
[AC_MSG_ERROR([You need the device-mapper library.])])
|
||||
AC_CHECK_LIB(devmapper, dm_task_set_message,,
|
||||
[AC_MSG_ERROR([The device-mapper library on your system is too old.])])
|
||||
DEVMAPPER_LIBS=$LIBS
|
||||
])
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
LIBS="$LIBS $DEVMAPPER_LIBS"
|
||||
AC_CHECK_DECLS([DM_UDEV_DISABLE_DISK_RULES_FLAG], [have_cookie=yes], [have_cookie=no], [#include <libdevmapper.h>])
|
||||
if test "x$enable_udev" = xyes; then
|
||||
if test "x$have_cookie" = xno; then
|
||||
AC_MSG_WARN([The device-mapper library on your system has no udev support, udev support disabled.])
|
||||
else
|
||||
AC_DEFINE(USE_UDEV, 1, [Try to use udev synchronisation?])
|
||||
fi
|
||||
fi
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
dnl Magic for cryptsetup.static build.
|
||||
if test x$enable_static_cryptsetup = xyes; then
|
||||
saved_PKG_CONFIG=$PKG_CONFIG
|
||||
PKG_CONFIG="$PKG_CONFIG --static"
|
||||
|
||||
LIBS="$saved_LIBS $LIBGCRYPT_LIBS -static"
|
||||
AC_CHECK_LIB(gcrypt, gcry_check_version,,
|
||||
AC_MSG_ERROR([Cannot find static gcrypt library.]),
|
||||
[-lgpg-error])
|
||||
LIBGCRYPT_STATIC_LIBS="$LIBGCRYPT_LIBS -lgpg-error"
|
||||
|
||||
LIBS="$saved_LIBS -static"
|
||||
AC_CHECK_LIB(popt, poptGetContext,,
|
||||
AC_MSG_ERROR([Cannot find static popt library.]))
|
||||
|
||||
dnl Try to detect needed device-mapper static libraries, try pkg-config first.
|
||||
LIBS="$saved_LIBS -static"
|
||||
PKG_CHECK_MODULES([DEVMAPPER_STATIC], [devmapper >= 1.02.27],,[
|
||||
DEVMAPPER_STATIC_LIBS=$DEVMAPPER_LIBS
|
||||
if test "x$enable_selinux" != xno; then
|
||||
AC_CHECK_LIB(sepol, sepol_bool_set)
|
||||
AC_CHECK_LIB(selinux, is_selinux_enabled)
|
||||
DEVMAPPER_STATIC_LIBS="$DEVMAPPER_STATIC_LIBS $LIBS"
|
||||
fi
|
||||
])
|
||||
LIBS="$saved_LIBS $DEVMAPPER_STATIC_LIBS"
|
||||
AC_CHECK_LIB(devmapper, dm_task_set_uuid,,
|
||||
AC_MSG_ERROR([Cannot link with static device-mapper library.]))
|
||||
|
||||
LIBS=$saved_LIBS
|
||||
PKG_CONFIG=$saved_PKG_CONFIG
|
||||
fi
|
||||
|
||||
AC_SUBST([DEVMAPPER_LIBS])
|
||||
AC_SUBST([DEVMAPPER_STATIC_LIBS])
|
||||
AC_SUBST([LIBGCRYPT_STATIC_LIBS])
|
||||
AC_SUBST([LIBCRYPTSETUP_VERSION])
|
||||
AC_SUBST([LIBCRYPTSETUP_VERSION_INFO])
|
||||
|
||||
dnl ==========================================================================
|
||||
AC_ARG_ENABLE([dev-random], AS_HELP_STRING([--enable-dev-random],
|
||||
[use blocking /dev/random by default for key generator (otherwise use /dev/urandom)]),
|
||||
[default_rng=/dev/random], [default_rng=/dev/urandom])
|
||||
AC_DEFINE_UNQUOTED(DEFAULT_RNG, ["$default_rng"], [default RNG type for key generator])
|
||||
|
||||
dnl ==========================================================================
|
||||
AC_DEFUN([CS_DEFINE],
|
||||
[AC_DEFINE_UNQUOTED(DEFAULT_[]m4_translit([$1], [-a-z], [_A-Z]), [$2], [$3])
|
||||
])
|
||||
|
||||
AC_DEFUN([CS_STR_WITH], [AC_ARG_WITH([$1],
|
||||
[AS_HELP_STRING(--with-[$1], [default $2 [$3]])],
|
||||
[CS_DEFINE([$1], ["$withval"], [$2])],
|
||||
[CS_DEFINE([$1], ["$3"], [$2])]
|
||||
)])
|
||||
|
||||
AC_DEFUN([CS_NUM_WITH], [AC_ARG_WITH([$1],
|
||||
[AS_HELP_STRING(--with-[$1], [default $2 [$3]])],
|
||||
[CS_DEFINE([$1], [$withval], [$2])],
|
||||
[CS_DEFINE([$1], [$3], [$2])]
|
||||
)])
|
||||
|
||||
CS_STR_WITH([plain-hash], [password hashing function for plain mode], [ripemd160])
|
||||
CS_STR_WITH([plain-cipher], [cipher for plain mode], [aes])
|
||||
CS_STR_WITH([plain-mode], [cipher mode for plain mode], [cbc-essiv:sha256])
|
||||
CS_NUM_WITH([plain-keybits],[key length in bits for plain mode], [256])
|
||||
|
||||
CS_STR_WITH([luks1-hash], [hash function for LUKS1 header], [sha1])
|
||||
CS_STR_WITH([luks1-cipher], [cipher for LUKS1], [aes])
|
||||
CS_STR_WITH([luks1-mode], [cipher mode for LUKS1], [cbc-essiv:sha256])
|
||||
CS_NUM_WITH([luks1-keybits],[key length in bits for LUKS1], [256])
|
||||
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
AC_CONFIG_FILES([ Makefile
|
||||
lib/Makefile
|
||||
lib/libcryptsetup.pc
|
||||
lib/luks1/Makefile
|
||||
src/Makefile
|
||||
po/Makefile.in
|
||||
man/Makefile
|
||||
tests/Makefile
|
||||
])
|
||||
AC_OUTPUT
|
||||
@@ -1,79 +0,0 @@
|
||||
Integration with kernel keyring service
|
||||
---------------------------------------
|
||||
|
||||
We have two different use cases for kernel keyring service:
|
||||
|
||||
I) Volume keys
|
||||
|
||||
Since upstream kernel 4.10 dm-crypt device mapper target allows loading volume
|
||||
key (VK) in kernel keyring service. The key offloaded in kernel keyring service
|
||||
is only referenced (by key description) in dm-crypt target and the VK is therefore
|
||||
no longer stored directly in dm-crypt target. Starting with cryptsetup 2.0 we
|
||||
load VK in kernel keyring by default for LUKSv2 devices (when dm-crypt with the
|
||||
feature is available).
|
||||
|
||||
Currently, cryptsetup loads VK in 'logon' type kernel key so that VK is passed in
|
||||
the kernel and can't be read from userspace afterwards. Also, cryptsetup loads VK in
|
||||
the thread keyring (before passing the reference to dm-crypt target) so that the key
|
||||
lifetime is directly bound to the process that performs the dm-crypt setup. When
|
||||
cryptsetup process exits (for whatever reason) the key gets unlinked in the kernel
|
||||
automatically. In summary, the key description visible in dm-crypt table line is
|
||||
a reference to VK that usually no longer exists in kernel keyring service if you
|
||||
used cryptsetup for device activation.
|
||||
|
||||
Using this feature dm-crypt no longer maintains a direct key copy (but there's
|
||||
always at least one copy in the kernel crypto layer).
|
||||
|
||||
Additionally, libcryptsetup supports the linking of volume keys to
|
||||
user-specified kernel keyring with crypt_set_keyring_to_link(). The user may
|
||||
specify keyring name, key type ('user' or 'logon') and key description where
|
||||
libcryptsetup should link the verified volume key upon subsequent device
|
||||
activation (or key verification alone).
|
||||
|
||||
The volume key(s) (provided the key type is 'user') linked in the user keyring
|
||||
can be later used to activate the device via crypt_activate_by_keyslot_context()
|
||||
with CRYPT_KC_TYPE_VK_KEYRING type keyslot context
|
||||
(acquired by crypt_keyslot_context_init_by_vk_in_keyring()).
|
||||
|
||||
Example of how to use volume key linked in custom user keyring from cryptsetup
|
||||
utility:
|
||||
|
||||
1) Open the device and store the volume key to the session keyring:
|
||||
# cryptsetup open <device> --link-vk-to-keyring "@s::%user:testkey" tst
|
||||
|
||||
2) Add a keyslot using the stored volume key in a keyring:
|
||||
# cryptsetup luksAddKey <device> --volume-key-keyring "%user:testkey"
|
||||
|
||||
3) Activate the device using the volume key cached in a keyring ('user' type key)
|
||||
# cryptsetup open <device> <active_name> --volume-key-keyring "testkey"
|
||||
|
||||
II) Keyslot passphrase
|
||||
The second use case for kernel keyring is to allow cryptsetup reading the keyslot
|
||||
passphrase stored in kernel keyring instead. The user may load the passphrase in the kernel
|
||||
keyring and notify cryptsetup to read it from there later. Currently, cryptsetup
|
||||
cli supports kernel keyring for passphrase only via LUKS2 internal token
|
||||
(luks2-keyring). The library also provides a general method for device activation by
|
||||
reading the passphrase from the keyring: crypt_activate_by_keyring(). The key type
|
||||
for use case II) must always be 'user' since we need to read the actual key
|
||||
data from userspace unlike with VK in I). The ability to read keyslot passphrases
|
||||
from kernel keyring also allows easy auto-activate LUKS2 devices.
|
||||
|
||||
Simple example of how to use kernel keyring for keyslot passphrase:
|
||||
|
||||
1) create LUKS2 keyring token for keyslot 0 (in LUKS2 device/image)
|
||||
cryptsetup token add --key-description my:key -S 0 /dev/device
|
||||
|
||||
2) Load keyslot passphrase in user keyring
|
||||
read -s -p "Keyslot passphrase: "; echo -n $REPLY | keyctl padd user my:key @u
|
||||
|
||||
3) Activate the device using the passphrase stored in the kernel keyring
|
||||
cryptsetup open /dev/device my_unlocked_device
|
||||
|
||||
4a) unlink the key when no longer needed by
|
||||
keyctl unlink %user:my:key @u
|
||||
|
||||
4b) or revoke it immediately by
|
||||
keyctl revoke %user:my:key
|
||||
|
||||
If cryptsetup asks for a passphrase in step 3) something went wrong with keyring
|
||||
activation. See --debug output then.
|
||||
@@ -1,97 +0,0 @@
|
||||
LUKS2 device locking overview
|
||||
=============================
|
||||
|
||||
Why
|
||||
~~~
|
||||
|
||||
LUKS2 format keeps two identical copies of metadata stored consecutively
|
||||
at the head of the metadata device (file or bdev). The metadata
|
||||
area (both copies) must be updated in a single atomic operation to avoid
|
||||
header corruption during concurrent write.
|
||||
|
||||
While with LUKS1 users may have clear knowledge of when a LUKS header is
|
||||
being updated (written to) or when it's being read solely the need for
|
||||
locking with legacy format was not so obvious as it is with the LUKSv2 format.
|
||||
|
||||
With LUKS2 the boundary between read-only and read-write is blurry and what
|
||||
used to be the exclusively read-only operation (i.e., cryptsetup open command) may
|
||||
easily become read-update operation silently without the user's knowledge.
|
||||
A major feature of the LUKS2 format is resilience against accidental
|
||||
corruption of metadata (i.e., partial header overwrite by parted or cfdisk
|
||||
while creating a partition on a mistaken block device).
|
||||
Such header corruption is detected early on the header read and the auto-recovery
|
||||
procedure takes place (the corrupted header with checksum mismatch is being
|
||||
replaced by the secondary one if that one is intact).
|
||||
On current Linux systems header load operation may be triggered without the user
|
||||
direct intervention for example by an udev rule or from a systemd service.
|
||||
Such a clash of header read and auto-recovery procedure could have severe
|
||||
consequences with the worst case of having a LUKS2 device inaccessible or being
|
||||
broken beyond repair.
|
||||
|
||||
The whole locking of LUKSv2 device headers split into two categories depending
|
||||
what backend the header is stored on:
|
||||
|
||||
I) block device
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
We perform flock() on file descriptors of files stored in a private
|
||||
directory (by default /run/lock/cryptsetup). The file name is derived
|
||||
from major:minor couple of the affected block device. Note we recommend
|
||||
that access to the private locking directory is supposed to be limited
|
||||
to the superuser only. For this method to work the distribution needs
|
||||
to install the locking directory with appropriate access rights.
|
||||
|
||||
II) regular files
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
A first notable difference between headers stored in a file
|
||||
vs. headers stored in a block device is that headers in a file may be
|
||||
manipulated by the regular user, unlike headers on block devices. Therefore
|
||||
we perform flock() protection on file with the luks2 header directly.
|
||||
|
||||
Limitations
|
||||
~~~~~~~~~~~
|
||||
|
||||
a) In general, the locking model provides serialization of I/Os targeting
|
||||
the header only. It means the header is always written or read at once
|
||||
while locking is enabled.
|
||||
We do not suppress any other negative effect that two or more concurrent
|
||||
writers of the same header may cause.
|
||||
|
||||
b) The locking is not cluster-aware in any way.
|
||||
|
||||
Additional LUKS2 locks
|
||||
======================
|
||||
|
||||
LUKS2 reencryption device lock
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Device in LUKS2 reencryption is protected by an exclusive lock placed in the default
|
||||
locking directory. The lock's purpose is to exclude multiple processes from
|
||||
performing reencryption on the same device (identified by LUKS uuid). The lock
|
||||
is taken no matter the LUKS2 reencryption mode (online or offline).
|
||||
|
||||
LUKS2 memory hard global lock
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
An optional global lock that makes libcryptsetup serialize memory hard
|
||||
pbkdf function when deriving a key encryption key from passphrase on unlocking
|
||||
LUKS2 keyslot. The lock has to be enabled via the CRYPT_ACTIVATE_SERIALIZE_MEMORY_HARD_PBKDF
|
||||
flag. The lock is placed in the default locking directory.
|
||||
|
||||
LUKS2 OPAL lock
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Exclusive per device lock taken when manipulating LUKS2 device configured for use with
|
||||
SED OPAL2 locking range.
|
||||
|
||||
Lock ordering
|
||||
=============
|
||||
|
||||
To avoid a deadlock following rules must apply:
|
||||
|
||||
- LUKS2 reencrytpion lock must be taken before LUKS2 OPAL lock.
|
||||
|
||||
- LUKS2 OPAL lock must be taken before LUKS2 metadata lock.
|
||||
|
||||
- LUKS2 memory hard global lock can not be used with other locks.
|
||||
351
docs/doxyfile
351
docs/doxyfile
@@ -1,351 +0,0 @@
|
||||
# Doxyfile 1.9.8
|
||||
|
||||
#---------------------------------------------------------------------------
|
||||
# Project related configuration options
|
||||
#---------------------------------------------------------------------------
|
||||
DOXYFILE_ENCODING = UTF-8
|
||||
PROJECT_NAME = "cryptsetup API"
|
||||
PROJECT_NUMBER =
|
||||
PROJECT_BRIEF = "Public cryptsetup API"
|
||||
PROJECT_LOGO =
|
||||
OUTPUT_DIRECTORY = doxygen_api_docs
|
||||
CREATE_SUBDIRS = NO
|
||||
CREATE_SUBDIRS_LEVEL = 8
|
||||
ALLOW_UNICODE_NAMES = NO
|
||||
OUTPUT_LANGUAGE = English
|
||||
BRIEF_MEMBER_DESC = YES
|
||||
REPEAT_BRIEF = YES
|
||||
ABBREVIATE_BRIEF =
|
||||
ALWAYS_DETAILED_SEC = NO
|
||||
INLINE_INHERITED_MEMB = NO
|
||||
FULL_PATH_NAMES = YES
|
||||
STRIP_FROM_PATH =
|
||||
STRIP_FROM_INC_PATH =
|
||||
SHORT_NAMES = NO
|
||||
JAVADOC_AUTOBRIEF = NO
|
||||
JAVADOC_BANNER = NO
|
||||
QT_AUTOBRIEF = NO
|
||||
MULTILINE_CPP_IS_BRIEF = NO
|
||||
PYTHON_DOCSTRING = YES
|
||||
INHERIT_DOCS = YES
|
||||
SEPARATE_MEMBER_PAGES = NO
|
||||
TAB_SIZE = 8
|
||||
ALIASES =
|
||||
OPTIMIZE_OUTPUT_FOR_C = YES
|
||||
OPTIMIZE_OUTPUT_JAVA = NO
|
||||
OPTIMIZE_FOR_FORTRAN = NO
|
||||
OPTIMIZE_OUTPUT_VHDL = NO
|
||||
OPTIMIZE_OUTPUT_SLICE = NO
|
||||
EXTENSION_MAPPING =
|
||||
MARKDOWN_SUPPORT = YES
|
||||
TOC_INCLUDE_HEADINGS = 5
|
||||
MARKDOWN_ID_STYLE = DOXYGEN
|
||||
AUTOLINK_SUPPORT = YES
|
||||
BUILTIN_STL_SUPPORT = NO
|
||||
CPP_CLI_SUPPORT = NO
|
||||
SIP_SUPPORT = NO
|
||||
IDL_PROPERTY_SUPPORT = YES
|
||||
DISTRIBUTE_GROUP_DOC = NO
|
||||
GROUP_NESTED_COMPOUNDS = NO
|
||||
SUBGROUPING = YES
|
||||
INLINE_GROUPED_CLASSES = NO
|
||||
INLINE_SIMPLE_STRUCTS = NO
|
||||
TYPEDEF_HIDES_STRUCT = YES
|
||||
LOOKUP_CACHE_SIZE = 0
|
||||
NUM_PROC_THREADS = 1
|
||||
TIMESTAMP = NO
|
||||
#---------------------------------------------------------------------------
|
||||
# Build related configuration options
|
||||
#---------------------------------------------------------------------------
|
||||
EXTRACT_ALL = NO
|
||||
EXTRACT_PRIVATE = NO
|
||||
EXTRACT_PRIV_VIRTUAL = NO
|
||||
EXTRACT_PACKAGE = NO
|
||||
EXTRACT_STATIC = NO
|
||||
EXTRACT_LOCAL_CLASSES = YES
|
||||
EXTRACT_LOCAL_METHODS = NO
|
||||
EXTRACT_ANON_NSPACES = NO
|
||||
RESOLVE_UNNAMED_PARAMS = YES
|
||||
HIDE_UNDOC_MEMBERS = NO
|
||||
HIDE_UNDOC_CLASSES = NO
|
||||
HIDE_FRIEND_COMPOUNDS = NO
|
||||
HIDE_IN_BODY_DOCS = NO
|
||||
INTERNAL_DOCS = NO
|
||||
CASE_SENSE_NAMES = YES
|
||||
HIDE_SCOPE_NAMES = NO
|
||||
HIDE_COMPOUND_REFERENCE= NO
|
||||
SHOW_HEADERFILE = YES
|
||||
SHOW_INCLUDE_FILES = YES
|
||||
SHOW_GROUPED_MEMB_INC = NO
|
||||
FORCE_LOCAL_INCLUDES = NO
|
||||
INLINE_INFO = YES
|
||||
SORT_MEMBER_DOCS = YES
|
||||
SORT_BRIEF_DOCS = NO
|
||||
SORT_MEMBERS_CTORS_1ST = NO
|
||||
SORT_GROUP_NAMES = NO
|
||||
SORT_BY_SCOPE_NAME = NO
|
||||
STRICT_PROTO_MATCHING = NO
|
||||
GENERATE_TODOLIST = YES
|
||||
GENERATE_TESTLIST = YES
|
||||
GENERATE_BUGLIST = YES
|
||||
GENERATE_DEPRECATEDLIST= YES
|
||||
ENABLED_SECTIONS =
|
||||
MAX_INITIALIZER_LINES = 30
|
||||
SHOW_USED_FILES = YES
|
||||
SHOW_FILES = YES
|
||||
SHOW_NAMESPACES = YES
|
||||
FILE_VERSION_FILTER =
|
||||
LAYOUT_FILE =
|
||||
CITE_BIB_FILES =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to warning and progress messages
|
||||
#---------------------------------------------------------------------------
|
||||
QUIET = NO
|
||||
WARNINGS = YES
|
||||
WARN_IF_UNDOCUMENTED = YES
|
||||
WARN_IF_DOC_ERROR = YES
|
||||
WARN_IF_INCOMPLETE_DOC = YES
|
||||
WARN_NO_PARAMDOC = NO
|
||||
WARN_IF_UNDOC_ENUM_VAL = NO
|
||||
WARN_AS_ERROR = NO
|
||||
WARN_FORMAT = "$file:$line: $text"
|
||||
WARN_LINE_FORMAT = "at line $line of file $file"
|
||||
WARN_LOGFILE =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the input files
|
||||
#---------------------------------------------------------------------------
|
||||
INPUT = doxygen_index.h \
|
||||
../lib/libcryptsetup.h
|
||||
INPUT_ENCODING = UTF-8
|
||||
INPUT_FILE_ENCODING =
|
||||
FILE_PATTERNS =
|
||||
RECURSIVE = NO
|
||||
EXCLUDE =
|
||||
EXCLUDE_SYMLINKS = NO
|
||||
EXCLUDE_PATTERNS =
|
||||
EXCLUDE_SYMBOLS =
|
||||
EXAMPLE_PATH = examples
|
||||
EXAMPLE_PATTERNS =
|
||||
EXAMPLE_RECURSIVE = NO
|
||||
IMAGE_PATH =
|
||||
INPUT_FILTER =
|
||||
FILTER_PATTERNS =
|
||||
FILTER_SOURCE_FILES = NO
|
||||
FILTER_SOURCE_PATTERNS =
|
||||
USE_MDFILE_AS_MAINPAGE =
|
||||
FORTRAN_COMMENT_AFTER = 72
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to source browsing
|
||||
#---------------------------------------------------------------------------
|
||||
SOURCE_BROWSER = NO
|
||||
INLINE_SOURCES = NO
|
||||
STRIP_CODE_COMMENTS = YES
|
||||
REFERENCED_BY_RELATION = NO
|
||||
REFERENCES_RELATION = NO
|
||||
REFERENCES_LINK_SOURCE = YES
|
||||
SOURCE_TOOLTIPS = YES
|
||||
USE_HTAGS = NO
|
||||
VERBATIM_HEADERS = YES
|
||||
CLANG_ASSISTED_PARSING = NO
|
||||
CLANG_ADD_INC_PATHS = YES
|
||||
CLANG_OPTIONS =
|
||||
CLANG_DATABASE_PATH =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the alphabetical class index
|
||||
#---------------------------------------------------------------------------
|
||||
ALPHABETICAL_INDEX = YES
|
||||
IGNORE_PREFIX =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the HTML output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_HTML = YES
|
||||
HTML_OUTPUT = html
|
||||
HTML_FILE_EXTENSION = .html
|
||||
HTML_HEADER =
|
||||
HTML_FOOTER =
|
||||
HTML_STYLESHEET =
|
||||
HTML_EXTRA_STYLESHEET =
|
||||
HTML_EXTRA_FILES =
|
||||
HTML_COLORSTYLE = AUTO_LIGHT
|
||||
HTML_COLORSTYLE_HUE = 220
|
||||
HTML_COLORSTYLE_SAT = 100
|
||||
HTML_COLORSTYLE_GAMMA = 80
|
||||
HTML_DYNAMIC_MENUS = YES
|
||||
HTML_DYNAMIC_SECTIONS = NO
|
||||
HTML_CODE_FOLDING = YES
|
||||
HTML_INDEX_NUM_ENTRIES = 100
|
||||
GENERATE_DOCSET = NO
|
||||
DOCSET_FEEDNAME = "Doxygen generated docs"
|
||||
DOCSET_FEEDURL =
|
||||
DOCSET_BUNDLE_ID = org.doxygen.Project
|
||||
DOCSET_PUBLISHER_ID = org.doxygen.Publisher
|
||||
DOCSET_PUBLISHER_NAME = Publisher
|
||||
GENERATE_HTMLHELP = NO
|
||||
CHM_FILE =
|
||||
HHC_LOCATION =
|
||||
GENERATE_CHI = NO
|
||||
CHM_INDEX_ENCODING =
|
||||
BINARY_TOC = NO
|
||||
TOC_EXPAND = NO
|
||||
SITEMAP_URL =
|
||||
GENERATE_QHP = NO
|
||||
QCH_FILE =
|
||||
QHP_NAMESPACE = org.doxygen.Project
|
||||
QHP_VIRTUAL_FOLDER = doc
|
||||
QHP_CUST_FILTER_NAME =
|
||||
QHP_CUST_FILTER_ATTRS =
|
||||
QHP_SECT_FILTER_ATTRS =
|
||||
QHG_LOCATION =
|
||||
GENERATE_ECLIPSEHELP = NO
|
||||
ECLIPSE_DOC_ID = org.doxygen.Project
|
||||
DISABLE_INDEX = NO
|
||||
GENERATE_TREEVIEW = NO
|
||||
FULL_SIDEBAR = NO
|
||||
ENUM_VALUES_PER_LINE = 4
|
||||
TREEVIEW_WIDTH = 250
|
||||
EXT_LINKS_IN_WINDOW = NO
|
||||
OBFUSCATE_EMAILS = YES
|
||||
HTML_FORMULA_FORMAT = png
|
||||
FORMULA_FONTSIZE = 10
|
||||
FORMULA_MACROFILE =
|
||||
USE_MATHJAX = NO
|
||||
MATHJAX_VERSION = MathJax_2
|
||||
MATHJAX_FORMAT = HTML-CSS
|
||||
MATHJAX_RELPATH = http://www.mathjax.org/mathjax
|
||||
MATHJAX_EXTENSIONS =
|
||||
MATHJAX_CODEFILE =
|
||||
SEARCHENGINE = YES
|
||||
SERVER_BASED_SEARCH = NO
|
||||
EXTERNAL_SEARCH = NO
|
||||
SEARCHENGINE_URL =
|
||||
SEARCHDATA_FILE = searchdata.xml
|
||||
EXTERNAL_SEARCH_ID =
|
||||
EXTRA_SEARCH_MAPPINGS =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the LaTeX output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_LATEX = YES
|
||||
LATEX_OUTPUT = latex
|
||||
LATEX_CMD_NAME = latex
|
||||
MAKEINDEX_CMD_NAME = makeindex
|
||||
LATEX_MAKEINDEX_CMD = makeindex
|
||||
COMPACT_LATEX = NO
|
||||
PAPER_TYPE = a4
|
||||
EXTRA_PACKAGES =
|
||||
LATEX_HEADER =
|
||||
LATEX_FOOTER =
|
||||
LATEX_EXTRA_STYLESHEET =
|
||||
LATEX_EXTRA_FILES =
|
||||
PDF_HYPERLINKS = YES
|
||||
USE_PDFLATEX = YES
|
||||
LATEX_BATCHMODE = NO
|
||||
LATEX_HIDE_INDICES = NO
|
||||
LATEX_BIB_STYLE = plain
|
||||
LATEX_EMOJI_DIRECTORY =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the RTF output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_RTF = NO
|
||||
RTF_OUTPUT = rtf
|
||||
COMPACT_RTF = NO
|
||||
RTF_HYPERLINKS = NO
|
||||
RTF_STYLESHEET_FILE =
|
||||
RTF_EXTENSIONS_FILE =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the man page output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_MAN = NO
|
||||
MAN_OUTPUT = man
|
||||
MAN_EXTENSION = .3
|
||||
MAN_SUBDIR =
|
||||
MAN_LINKS = NO
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the XML output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_XML = NO
|
||||
XML_OUTPUT = xml
|
||||
XML_PROGRAMLISTING = YES
|
||||
XML_NS_MEMB_FILE_SCOPE = NO
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the DOCBOOK output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_DOCBOOK = NO
|
||||
DOCBOOK_OUTPUT = docbook
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options for the AutoGen Definitions output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_AUTOGEN_DEF = NO
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to Sqlite3 output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_SQLITE3 = NO
|
||||
SQLITE3_OUTPUT = sqlite3
|
||||
SQLITE3_RECREATE_DB = YES
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the Perl module output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_PERLMOD = NO
|
||||
PERLMOD_LATEX = NO
|
||||
PERLMOD_PRETTY = YES
|
||||
PERLMOD_MAKEVAR_PREFIX =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the preprocessor
|
||||
#---------------------------------------------------------------------------
|
||||
ENABLE_PREPROCESSING = YES
|
||||
MACRO_EXPANSION = NO
|
||||
EXPAND_ONLY_PREDEF = NO
|
||||
SEARCH_INCLUDES = YES
|
||||
INCLUDE_PATH =
|
||||
INCLUDE_FILE_PATTERNS =
|
||||
PREDEFINED =
|
||||
EXPAND_AS_DEFINED =
|
||||
SKIP_FUNCTION_MACROS = YES
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to external references
|
||||
#---------------------------------------------------------------------------
|
||||
TAGFILES =
|
||||
GENERATE_TAGFILE =
|
||||
ALLEXTERNALS = NO
|
||||
EXTERNAL_GROUPS = YES
|
||||
EXTERNAL_PAGES = YES
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to diagram generator tools
|
||||
#---------------------------------------------------------------------------
|
||||
HIDE_UNDOC_RELATIONS = YES
|
||||
HAVE_DOT = NO
|
||||
DOT_NUM_THREADS = 0
|
||||
DOT_COMMON_ATTR = "fontname=Helvetica,fontsize=10"
|
||||
DOT_EDGE_ATTR = "labelfontname=Helvetica,labelfontsize=10"
|
||||
DOT_NODE_ATTR = "shape=box,height=0.2,width=0.4"
|
||||
DOT_FONTPATH =
|
||||
CLASS_GRAPH = YES
|
||||
COLLABORATION_GRAPH = YES
|
||||
GROUP_GRAPHS = YES
|
||||
UML_LOOK = NO
|
||||
UML_LIMIT_NUM_FIELDS = 10
|
||||
DOT_UML_DETAILS = NO
|
||||
DOT_WRAP_THRESHOLD = 17
|
||||
TEMPLATE_RELATIONS = NO
|
||||
INCLUDE_GRAPH = YES
|
||||
INCLUDED_BY_GRAPH = YES
|
||||
CALL_GRAPH = NO
|
||||
CALLER_GRAPH = NO
|
||||
GRAPHICAL_HIERARCHY = YES
|
||||
DIRECTORY_GRAPH = YES
|
||||
DIR_GRAPH_MAX_DEPTH = 1
|
||||
DOT_IMAGE_FORMAT = png
|
||||
INTERACTIVE_SVG = NO
|
||||
DOT_PATH =
|
||||
DOTFILE_DIRS =
|
||||
DIA_PATH =
|
||||
DIAFILE_DIRS =
|
||||
PLANTUML_JAR_PATH =
|
||||
PLANTUML_CFG_FILE =
|
||||
PLANTUML_INCLUDE_PATH =
|
||||
DOT_GRAPH_MAX_NODES = 50
|
||||
MAX_DOT_GRAPH_DEPTH = 0
|
||||
DOT_MULTI_TARGETS = NO
|
||||
GENERATE_LEGEND = YES
|
||||
DOT_CLEANUP = YES
|
||||
MSCGEN_TOOL =
|
||||
MSCFILE_DIRS =
|
||||
@@ -1,110 +0,0 @@
|
||||
/*! \mainpage Cryptsetup API
|
||||
*
|
||||
* <b>The</b> documentation covers public parts of cryptsetup API. In the following sections you'll find
|
||||
* the examples that describe some features of cryptsetup API.
|
||||
* For more info about libcryptsetup API versions see
|
||||
* <a href="https://gitlab.com/cryptsetup/cryptsetup/wikis/ABI-tracker/timeline/libcryptsetup/index.html">API Tracker</a>.
|
||||
*
|
||||
* <OL type="A">
|
||||
* <LI>@ref cexamples "Cryptsetup API examples"</LI>
|
||||
* <OL type="1">
|
||||
* <LI>@ref cluks "crypt_luks_usage" - cryptsetup LUKS device type usage examples</LI>
|
||||
* <UL>
|
||||
* <LI>@ref cinit "crypt_init()"</LI>
|
||||
* <LI>@ref cformat "crypt_format()" - header and payload on mutual device</LI>
|
||||
* <LI>@ref ckeys "Keyslot operations" </LI>
|
||||
* <UL>
|
||||
* <LI>@ref ckeyslot_vol "crypt_keyslot_add_by_volume_key()"</LI>
|
||||
* <LI>@ref ckeyslot_pass "crypt_keyslot_add_by_passphrase()"</LI>
|
||||
* </UL>
|
||||
* <LI>@ref cload "crypt_load()"
|
||||
* <LI>@ref cactivate "crypt_activate_by_passphrase()"</LI>
|
||||
* <LI>@ref cactive_pars "crypt_get_active_device()"</LI>
|
||||
* <LI>@ref cinit_by_name "crypt_init_by_name()"</LI>
|
||||
* <LI>@ref cdeactivate "crypt_deactivate()"</LI>
|
||||
* <LI>@ref cluks_ex "crypt_luks_usage.c"</LI>
|
||||
* </UL>
|
||||
* <LI>@ref clog "crypt_log_usage" - cryptsetup logging API examples</LI>
|
||||
* </OL>
|
||||
* </OL>
|
||||
*
|
||||
* @section cexamples Cryptsetup API examples
|
||||
* @section cluks crypt_luks_usage - cryptsetup LUKS device type usage
|
||||
* @subsection cinit crypt_init()
|
||||
* Every time you need to do something with cryptsetup or dmcrypt device
|
||||
* you need a valid context. The first step to start your work is
|
||||
* @ref crypt_init call. You can call it either with path
|
||||
* to the block device or path to the regular file. If you don't supply the path,
|
||||
* empty context is initialized.
|
||||
*
|
||||
* @subsection cformat crypt_format() - header and payload on mutual device
|
||||
* This section covers basic use cases for formatting LUKS devices. Format operation
|
||||
* sets device type in context and in case of LUKS header is written at the beginning
|
||||
* of block device. In the example below we use the scenario where LUKS header and data
|
||||
* are both stored on the same device. There's also a possibility to store header and
|
||||
* data separately.
|
||||
*
|
||||
* <B>Bear in mind</B> that @ref crypt_format() is destructive operation and it
|
||||
* overwrites part of the backing block device.
|
||||
*
|
||||
* @subsection ckeys Keyslot operations examples
|
||||
* After successful @ref crypt_format of LUKS device, volume key is not stored
|
||||
* in a persistent way on the device. Keyslot area is an array beyond LUKS header, where
|
||||
* volume key is stored in the encrypted form using user input passphrase. For more info about
|
||||
* LUKS keyslots and how it's actually protected, please look at
|
||||
* <A HREF="https://gitlab.com/cryptsetup/cryptsetup/wikis/Specification">LUKS specification</A>.
|
||||
* There are two basic methods to create a new keyslot:
|
||||
*
|
||||
* @subsection ckeyslot_vol crypt_keyslot_add_by_volume_key()
|
||||
* Creates a new keyslot directly by encrypting volume_key stored in the device
|
||||
* context. Passphrase should be supplied or user is prompted if passphrase param is
|
||||
* NULL.
|
||||
*
|
||||
* @subsection ckeyslot_pass crypt_keyslot_add_by_passphrase()
|
||||
* Creates a new keyslot for the volume key by opening existing active keyslot,
|
||||
* extracting volume key from it and storing it into a new keyslot
|
||||
* protected by a new passphrase
|
||||
*
|
||||
* @subsection cload crypt_load()
|
||||
* Function loads header from backing block device into device context.
|
||||
*
|
||||
* @subsection cactivate crypt_activate_by_passphrase()
|
||||
* Activates crypt device by user supplied password for keyslot containing the volume_key.
|
||||
* If <I>keyslot</I> parameter is set to <I>CRYPT_ANY_SLOT</I> then all active keyslots
|
||||
* are tried one by one until the volume key is found.
|
||||
*
|
||||
* @subsection cactive_pars crypt_get_active_device()
|
||||
* This call returns structure containing runtime attributes of active device.
|
||||
*
|
||||
* @subsection cinit_by_name crypt_init_by_name()
|
||||
* In case you need to do operations with active device (device which already
|
||||
* has its corresponding mapping) and you miss valid device context stored in
|
||||
* *crypt_device reference, you should use this call. Function tries to
|
||||
* get path to backing device from DM, initializes context for it and loads LUKS
|
||||
* header.
|
||||
*
|
||||
* @subsection cdeactivate crypt_deactivate()
|
||||
* Deactivates crypt device (removes DM mapping and safely erases volume key from kernel).
|
||||
*
|
||||
* @subsection cluks_ex crypt_luks_usage.c - Complex example
|
||||
* To compile and run use following commands in examples directory:
|
||||
*
|
||||
* @code
|
||||
* make
|
||||
* ./crypt_luks_usage _path_to_[block_device]_file
|
||||
* @endcode
|
||||
* Note that you need to have the cryptsetup library compiled. @include crypt_luks_usage.c
|
||||
*
|
||||
* @section clog crypt_log_usage - cryptsetup logging API example
|
||||
* Example describes basic use case for cryptsetup logging. To compile and run
|
||||
* use following commands in examples directory:
|
||||
*
|
||||
* @code
|
||||
* make
|
||||
* ./crypt_log_usage
|
||||
* @endcode
|
||||
* Note that you need to have the cryptsetup library compiled. @include crypt_log_usage.c
|
||||
*
|
||||
* @example crypt_luks_usage.c
|
||||
* @example crypt_log_usage.c
|
||||
*/
|
||||
@@ -1,17 +0,0 @@
|
||||
TARGETS=crypt_log_usage crypt_luks_usage
|
||||
CFLAGS=-O0 -g -Wall -D_GNU_SOURCE
|
||||
LDLIBS=-lcryptsetup
|
||||
CC=gcc
|
||||
|
||||
all: $(TARGETS)
|
||||
|
||||
crypt_log_usage: crypt_log_usage.o
|
||||
$(CC) -o $@ $^ $(LDLIBS)
|
||||
|
||||
crypt_luks_usage: crypt_luks_usage.o
|
||||
$(CC) -o $@ $^ $(LDLIBS)
|
||||
|
||||
clean:
|
||||
rm -f *.o *~ core $(TARGETS)
|
||||
|
||||
.PHONY: clean
|
||||
@@ -1,81 +0,0 @@
|
||||
// SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
/*
|
||||
* libcryptsetup API log example
|
||||
*
|
||||
* Copyright (C) 2011-2025 Red Hat, Inc. All rights reserved.
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <sys/types.h>
|
||||
#include <syslog.h>
|
||||
#include <unistd.h>
|
||||
#include <libcryptsetup.h>
|
||||
|
||||
/*
|
||||
* This is an example of crypt_set_log_callback API callback.
|
||||
*
|
||||
*/
|
||||
static void simple_syslog_wrapper(int level, const char *msg, void *usrptr)
|
||||
{
|
||||
const char *prefix = (const char *)usrptr;
|
||||
int priority;
|
||||
|
||||
switch(level) {
|
||||
case CRYPT_LOG_NORMAL: priority = LOG_NOTICE; break;
|
||||
case CRYPT_LOG_ERROR: priority = LOG_ERR; break;
|
||||
case CRYPT_LOG_VERBOSE: priority = LOG_INFO; break;
|
||||
case CRYPT_LOG_DEBUG: priority = LOG_DEBUG; break;
|
||||
default:
|
||||
fprintf(stderr, "Unsupported log level requested!\n");
|
||||
return;
|
||||
}
|
||||
|
||||
if (prefix)
|
||||
syslog(priority, "%s:%s", prefix, msg);
|
||||
else
|
||||
syslog(priority, "%s", msg);
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
struct crypt_device *cd;
|
||||
char usrprefix[] = "cslog_example";
|
||||
int r;
|
||||
|
||||
if (geteuid()) {
|
||||
printf("Using of libcryptsetup requires super user privileges.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
openlog("cryptsetup", LOG_CONS | LOG_PID, LOG_USER);
|
||||
|
||||
/* Initialize empty crypt device context */
|
||||
r = crypt_init(&cd, NULL);
|
||||
if (r < 0) {
|
||||
printf("crypt_init() failed.\n");
|
||||
return 2;
|
||||
}
|
||||
|
||||
/* crypt_set_log_callback() - register a log callback for crypt context */
|
||||
crypt_set_log_callback(cd, &simple_syslog_wrapper, (void *)usrprefix);
|
||||
|
||||
/* send messages ithrough the crypt_log() interface */
|
||||
crypt_log(cd, CRYPT_LOG_NORMAL, "This is normal log message");
|
||||
crypt_log(cd, CRYPT_LOG_ERROR, "This is error log message");
|
||||
crypt_log(cd, CRYPT_LOG_VERBOSE, "This is verbose log message");
|
||||
crypt_log(cd, CRYPT_LOG_DEBUG, "This is debug message");
|
||||
|
||||
/* release crypt context */
|
||||
crypt_free(cd);
|
||||
|
||||
/* Initialize default (global) log callback */
|
||||
crypt_set_log_callback(NULL, &simple_syslog_wrapper, NULL);
|
||||
|
||||
crypt_log(NULL, CRYPT_LOG_NORMAL, "This is normal log message");
|
||||
crypt_log(NULL, CRYPT_LOG_ERROR, "This is error log message");
|
||||
crypt_log(NULL, CRYPT_LOG_VERBOSE, "This is verbose log message");
|
||||
crypt_log(NULL, CRYPT_LOG_DEBUG, "This is debug message");
|
||||
|
||||
closelog();
|
||||
return 0;
|
||||
}
|
||||
@@ -1,237 +0,0 @@
|
||||
// SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
/*
|
||||
* libcryptsetup API - using LUKS device example
|
||||
*
|
||||
* Copyright (C) 2011-2025 Red Hat, Inc. All rights reserved.
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <inttypes.h>
|
||||
#include <sys/types.h>
|
||||
#include <libcryptsetup.h>
|
||||
|
||||
static int format_and_add_keyslots(const char *path)
|
||||
{
|
||||
struct crypt_device *cd;
|
||||
int r;
|
||||
|
||||
/*
|
||||
* The crypt_init() call is used to initialize crypt_device context,
|
||||
* The path parameter specifies a device path.
|
||||
*
|
||||
* For path, you can use either link to a file or block device.
|
||||
* The loopback device will be detached automatically.
|
||||
*/
|
||||
|
||||
r = crypt_init(&cd, path);
|
||||
if (r < 0) {
|
||||
printf("crypt_init() failed for %s.\n", path);
|
||||
return r;
|
||||
}
|
||||
|
||||
printf("Context is attached to block device %s.\n", crypt_get_device_name(cd));
|
||||
|
||||
/*
|
||||
* So far, no data were written to the device.
|
||||
*/
|
||||
printf("Device %s will be formatted as a LUKS device after 5 seconds.\n"
|
||||
"Press CTRL+C now if you want to cancel this operation.\n", path);
|
||||
sleep(5);
|
||||
|
||||
/*
|
||||
* NULLs for uuid and volume_key means that these attributes will be
|
||||
* generated during crypt_format().
|
||||
*/
|
||||
r = crypt_format(cd, /* crypt context */
|
||||
CRYPT_LUKS2, /* LUKS2 is a new LUKS format; use CRYPT_LUKS1 for LUKS1 */
|
||||
"aes", /* used cipher */
|
||||
"xts-plain64", /* used block mode and IV */
|
||||
NULL, /* generate UUID */
|
||||
NULL, /* generate volume key from RNG */
|
||||
512 / 8, /* 512bit key - here AES-256 in XTS mode, size is in bytes */
|
||||
NULL); /* default parameters */
|
||||
|
||||
if (r < 0) {
|
||||
printf("crypt_format() failed on device %s\n", crypt_get_device_name(cd));
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
/*
|
||||
* The device now contains a LUKS header, but there is no active keyslot.
|
||||
*
|
||||
* crypt_keyslot_add_* call stores the volume_key in the encrypted form into the keyslot.
|
||||
*
|
||||
* After format, the volume key is stored internally.
|
||||
*/
|
||||
r = crypt_keyslot_add_by_volume_key(cd, /* crypt context */
|
||||
CRYPT_ANY_SLOT, /* just use first free slot */
|
||||
NULL, /* use internal volume key */
|
||||
0, /* unused (size of volume key) */
|
||||
"foo", /* passphrase - NULL means query*/
|
||||
3); /* size of passphrase */
|
||||
|
||||
if (r < 0) {
|
||||
printf("Adding keyslot failed.\n");
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
printf("The first keyslot is initialized.\n");
|
||||
|
||||
/*
|
||||
* Add another keyslot, now authenticating with the first keyslot.
|
||||
* It decrypts the volume key from the first keyslot and creates a new one with the specified passphrase.
|
||||
*/
|
||||
r = crypt_keyslot_add_by_passphrase(cd, /* crypt context */
|
||||
CRYPT_ANY_SLOT, /* just use first free slot */
|
||||
"foo", 3, /* passphrase for the old keyslot */
|
||||
"bar", 3); /* passphrase for the new kesylot */
|
||||
if (r < 0) {
|
||||
printf("Adding keyslot failed.\n");
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
printf("The second keyslot is initialized.\n");
|
||||
|
||||
crypt_free(cd);
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int activate_and_check_status(const char *path, const char *device_name)
|
||||
{
|
||||
struct crypt_device *cd;
|
||||
struct crypt_active_device cad;
|
||||
int r;
|
||||
|
||||
/*
|
||||
* LUKS device activation example.
|
||||
*/
|
||||
r = crypt_init(&cd, path);
|
||||
if (r < 0) {
|
||||
printf("crypt_init() failed for %s.\n", path);
|
||||
return r;
|
||||
}
|
||||
|
||||
/*
|
||||
* crypt_load() is used to load existing LUKS header from a block device
|
||||
*/
|
||||
r = crypt_load(cd, /* crypt context */
|
||||
CRYPT_LUKS, /* requested type - here LUKS of any type */
|
||||
NULL); /* additional parameters (not used) */
|
||||
|
||||
if (r < 0) {
|
||||
printf("crypt_load() failed on device %s.\n", crypt_get_device_name(cd));
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
/*
|
||||
* Device activation creates a device-mapper device with the specified name.
|
||||
*/
|
||||
r = crypt_activate_by_passphrase(cd, /* crypt context */
|
||||
device_name, /* device name to activate */
|
||||
CRYPT_ANY_SLOT,/* the keyslot use (try all here) */
|
||||
"foo", 3, /* passphrase */
|
||||
CRYPT_ACTIVATE_READONLY); /* flags */
|
||||
if (r < 0) {
|
||||
printf("Device %s activation failed.\n", device_name);
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
printf("%s device %s/%s is active.\n", crypt_get_type(cd), crypt_get_dir(), device_name);
|
||||
printf("\tcipher used: %s\n", crypt_get_cipher(cd));
|
||||
printf("\tcipher mode: %s\n", crypt_get_cipher_mode(cd));
|
||||
printf("\tdevice UUID: %s\n", crypt_get_uuid(cd));
|
||||
|
||||
/*
|
||||
* Get info about the active device.
|
||||
*/
|
||||
r = crypt_get_active_device(cd, device_name, &cad);
|
||||
if (r < 0) {
|
||||
printf("Get info about active device %s failed.\n", device_name);
|
||||
crypt_deactivate(cd, device_name);
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
printf("Active device parameters for %s:\n"
|
||||
"\tDevice offset (in sectors): %" PRIu64 "\n"
|
||||
"\tIV offset (in sectors) : %" PRIu64 "\n"
|
||||
"\tdevice size (in sectors) : %" PRIu64 "\n"
|
||||
"\tread-only flag : %s\n",
|
||||
device_name, cad.offset, cad.iv_offset, cad.size,
|
||||
cad.flags & CRYPT_ACTIVATE_READONLY ? "1" : "0");
|
||||
|
||||
crypt_free(cd);
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int handle_active_device(const char *device_name)
|
||||
{
|
||||
struct crypt_device *cd;
|
||||
int r;
|
||||
|
||||
/*
|
||||
* crypt_init_by_name() initializes context by an active device-mapper name
|
||||
*/
|
||||
r = crypt_init_by_name(&cd, device_name);
|
||||
if (r < 0) {
|
||||
printf("crypt_init_by_name() failed for %s.\n", device_name);
|
||||
return r;
|
||||
}
|
||||
|
||||
if (crypt_status(cd, device_name) == CRYPT_ACTIVE)
|
||||
printf("Device %s is still active.\n", device_name);
|
||||
else {
|
||||
printf("Something failed perhaps, device %s is not active.\n", device_name);
|
||||
crypt_free(cd);
|
||||
return -1;
|
||||
}
|
||||
|
||||
/*
|
||||
* crypt_deactivate() is used to deactivate a device
|
||||
*/
|
||||
r = crypt_deactivate(cd, device_name);
|
||||
if (r < 0) {
|
||||
printf("crypt_deactivate() failed.\n");
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
printf("Device %s is now deactivated.\n", device_name);
|
||||
|
||||
crypt_free(cd);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int main(int argc, char **argv)
|
||||
{
|
||||
if (geteuid()) {
|
||||
printf("Using of libcryptsetup requires super user privileges.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (argc != 2) {
|
||||
printf("usage: ./crypt_luks_usage <path>\n"
|
||||
"<path> refers to either a regular file or a block device.\n"
|
||||
" WARNING: the file or device will be wiped.\n");
|
||||
return 2;
|
||||
}
|
||||
|
||||
if (format_and_add_keyslots(argv[1]))
|
||||
return 3;
|
||||
|
||||
if (activate_and_check_status(argv[1], "example_device"))
|
||||
return 4;
|
||||
|
||||
if (handle_active_device("example_device"))
|
||||
return 5;
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -1,202 +0,0 @@
|
||||
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright [yyyy] [name of copyright owner]
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
@@ -1,428 +0,0 @@
|
||||
Attribution-ShareAlike 4.0 International
|
||||
|
||||
=======================================================================
|
||||
|
||||
Creative Commons Corporation ("Creative Commons") is not a law firm and
|
||||
does not provide legal services or legal advice. Distribution of
|
||||
Creative Commons public licenses does not create a lawyer-client or
|
||||
other relationship. Creative Commons makes its licenses and related
|
||||
information available on an "as-is" basis. Creative Commons gives no
|
||||
warranties regarding its licenses, any material licensed under their
|
||||
terms and conditions, or any related information. Creative Commons
|
||||
disclaims all liability for damages resulting from their use to the
|
||||
fullest extent possible.
|
||||
|
||||
Using Creative Commons Public Licenses
|
||||
|
||||
Creative Commons public licenses provide a standard set of terms and
|
||||
conditions that creators and other rights holders may use to share
|
||||
original works of authorship and other material subject to copyright
|
||||
and certain other rights specified in the public license below. The
|
||||
following considerations are for informational purposes only, are not
|
||||
exhaustive, and do not form part of our licenses.
|
||||
|
||||
Considerations for licensors: Our public licenses are
|
||||
intended for use by those authorized to give the public
|
||||
permission to use material in ways otherwise restricted by
|
||||
copyright and certain other rights. Our licenses are
|
||||
irrevocable. Licensors should read and understand the terms
|
||||
and conditions of the license they choose before applying it.
|
||||
Licensors should also secure all rights necessary before
|
||||
applying our licenses so that the public can reuse the
|
||||
material as expected. Licensors should clearly mark any
|
||||
material not subject to the license. This includes other CC-
|
||||
licensed material, or material used under an exception or
|
||||
limitation to copyright. More considerations for licensors:
|
||||
wiki.creativecommons.org/Considerations_for_licensors
|
||||
|
||||
Considerations for the public: By using one of our public
|
||||
licenses, a licensor grants the public permission to use the
|
||||
licensed material under specified terms and conditions. If
|
||||
the licensor's permission is not necessary for any reason--for
|
||||
example, because of any applicable exception or limitation to
|
||||
copyright--then that use is not regulated by the license. Our
|
||||
licenses grant only permissions under copyright and certain
|
||||
other rights that a licensor has authority to grant. Use of
|
||||
the licensed material may still be restricted for other
|
||||
reasons, including because others have copyright or other
|
||||
rights in the material. A licensor may make special requests,
|
||||
such as asking that all changes be marked or described.
|
||||
Although not required by our licenses, you are encouraged to
|
||||
respect those requests where reasonable. More considerations
|
||||
for the public:
|
||||
wiki.creativecommons.org/Considerations_for_licensees
|
||||
|
||||
=======================================================================
|
||||
|
||||
Creative Commons Attribution-ShareAlike 4.0 International Public
|
||||
License
|
||||
|
||||
By exercising the Licensed Rights (defined below), You accept and agree
|
||||
to be bound by the terms and conditions of this Creative Commons
|
||||
Attribution-ShareAlike 4.0 International Public License ("Public
|
||||
License"). To the extent this Public License may be interpreted as a
|
||||
contract, You are granted the Licensed Rights in consideration of Your
|
||||
acceptance of these terms and conditions, and the Licensor grants You
|
||||
such rights in consideration of benefits the Licensor receives from
|
||||
making the Licensed Material available under these terms and
|
||||
conditions.
|
||||
|
||||
|
||||
Section 1 -- Definitions.
|
||||
|
||||
a. Adapted Material means material subject to Copyright and Similar
|
||||
Rights that is derived from or based upon the Licensed Material
|
||||
and in which the Licensed Material is translated, altered,
|
||||
arranged, transformed, or otherwise modified in a manner requiring
|
||||
permission under the Copyright and Similar Rights held by the
|
||||
Licensor. For purposes of this Public License, where the Licensed
|
||||
Material is a musical work, performance, or sound recording,
|
||||
Adapted Material is always produced where the Licensed Material is
|
||||
synched in timed relation with a moving image.
|
||||
|
||||
b. Adapter's License means the license You apply to Your Copyright
|
||||
and Similar Rights in Your contributions to Adapted Material in
|
||||
accordance with the terms and conditions of this Public License.
|
||||
|
||||
c. BY-SA Compatible License means a license listed at
|
||||
creativecommons.org/compatiblelicenses, approved by Creative
|
||||
Commons as essentially the equivalent of this Public License.
|
||||
|
||||
d. Copyright and Similar Rights means copyright and/or similar rights
|
||||
closely related to copyright including, without limitation,
|
||||
performance, broadcast, sound recording, and Sui Generis Database
|
||||
Rights, without regard to how the rights are labeled or
|
||||
categorized. For purposes of this Public License, the rights
|
||||
specified in Section 2(b)(1)-(2) are not Copyright and Similar
|
||||
Rights.
|
||||
|
||||
e. Effective Technological Measures means those measures that, in the
|
||||
absence of proper authority, may not be circumvented under laws
|
||||
fulfilling obligations under Article 11 of the WIPO Copyright
|
||||
Treaty adopted on December 20, 1996, and/or similar international
|
||||
agreements.
|
||||
|
||||
f. Exceptions and Limitations means fair use, fair dealing, and/or
|
||||
any other exception or limitation to Copyright and Similar Rights
|
||||
that applies to Your use of the Licensed Material.
|
||||
|
||||
g. License Elements means the license attributes listed in the name
|
||||
of a Creative Commons Public License. The License Elements of this
|
||||
Public License are Attribution and ShareAlike.
|
||||
|
||||
h. Licensed Material means the artistic or literary work, database,
|
||||
or other material to which the Licensor applied this Public
|
||||
License.
|
||||
|
||||
i. Licensed Rights means the rights granted to You subject to the
|
||||
terms and conditions of this Public License, which are limited to
|
||||
all Copyright and Similar Rights that apply to Your use of the
|
||||
Licensed Material and that the Licensor has authority to license.
|
||||
|
||||
j. Licensor means the individual(s) or entity(ies) granting rights
|
||||
under this Public License.
|
||||
|
||||
k. Share means to provide material to the public by any means or
|
||||
process that requires permission under the Licensed Rights, such
|
||||
as reproduction, public display, public performance, distribution,
|
||||
dissemination, communication, or importation, and to make material
|
||||
available to the public including in ways that members of the
|
||||
public may access the material from a place and at a time
|
||||
individually chosen by them.
|
||||
|
||||
l. Sui Generis Database Rights means rights other than copyright
|
||||
resulting from Directive 96/9/EC of the European Parliament and of
|
||||
the Council of 11 March 1996 on the legal protection of databases,
|
||||
as amended and/or succeeded, as well as other essentially
|
||||
equivalent rights anywhere in the world.
|
||||
|
||||
m. You means the individual or entity exercising the Licensed Rights
|
||||
under this Public License. Your has a corresponding meaning.
|
||||
|
||||
|
||||
Section 2 -- Scope.
|
||||
|
||||
a. License grant.
|
||||
|
||||
1. Subject to the terms and conditions of this Public License,
|
||||
the Licensor hereby grants You a worldwide, royalty-free,
|
||||
non-sublicensable, non-exclusive, irrevocable license to
|
||||
exercise the Licensed Rights in the Licensed Material to:
|
||||
|
||||
a. reproduce and Share the Licensed Material, in whole or
|
||||
in part; and
|
||||
|
||||
b. produce, reproduce, and Share Adapted Material.
|
||||
|
||||
2. Exceptions and Limitations. For the avoidance of doubt, where
|
||||
Exceptions and Limitations apply to Your use, this Public
|
||||
License does not apply, and You do not need to comply with
|
||||
its terms and conditions.
|
||||
|
||||
3. Term. The term of this Public License is specified in Section
|
||||
6(a).
|
||||
|
||||
4. Media and formats; technical modifications allowed. The
|
||||
Licensor authorizes You to exercise the Licensed Rights in
|
||||
all media and formats whether now known or hereafter created,
|
||||
and to make technical modifications necessary to do so. The
|
||||
Licensor waives and/or agrees not to assert any right or
|
||||
authority to forbid You from making technical modifications
|
||||
necessary to exercise the Licensed Rights, including
|
||||
technical modifications necessary to circumvent Effective
|
||||
Technological Measures. For purposes of this Public License,
|
||||
simply making modifications authorized by this Section 2(a)
|
||||
(4) never produces Adapted Material.
|
||||
|
||||
5. Downstream recipients.
|
||||
|
||||
a. Offer from the Licensor -- Licensed Material. Every
|
||||
recipient of the Licensed Material automatically
|
||||
receives an offer from the Licensor to exercise the
|
||||
Licensed Rights under the terms and conditions of this
|
||||
Public License.
|
||||
|
||||
b. Additional offer from the Licensor -- Adapted Material.
|
||||
Every recipient of Adapted Material from You
|
||||
automatically receives an offer from the Licensor to
|
||||
exercise the Licensed Rights in the Adapted Material
|
||||
under the conditions of the Adapter's License You apply.
|
||||
|
||||
c. No downstream restrictions. You may not offer or impose
|
||||
any additional or different terms or conditions on, or
|
||||
apply any Effective Technological Measures to, the
|
||||
Licensed Material if doing so restricts exercise of the
|
||||
Licensed Rights by any recipient of the Licensed
|
||||
Material.
|
||||
|
||||
6. No endorsement. Nothing in this Public License constitutes or
|
||||
may be construed as permission to assert or imply that You
|
||||
are, or that Your use of the Licensed Material is, connected
|
||||
with, or sponsored, endorsed, or granted official status by,
|
||||
the Licensor or others designated to receive attribution as
|
||||
provided in Section 3(a)(1)(A)(i).
|
||||
|
||||
b. Other rights.
|
||||
|
||||
1. Moral rights, such as the right of integrity, are not
|
||||
licensed under this Public License, nor are publicity,
|
||||
privacy, and/or other similar personality rights; however, to
|
||||
the extent possible, the Licensor waives and/or agrees not to
|
||||
assert any such rights held by the Licensor to the limited
|
||||
extent necessary to allow You to exercise the Licensed
|
||||
Rights, but not otherwise.
|
||||
|
||||
2. Patent and trademark rights are not licensed under this
|
||||
Public License.
|
||||
|
||||
3. To the extent possible, the Licensor waives any right to
|
||||
collect royalties from You for the exercise of the Licensed
|
||||
Rights, whether directly or through a collecting society
|
||||
under any voluntary or waivable statutory or compulsory
|
||||
licensing scheme. In all other cases the Licensor expressly
|
||||
reserves any right to collect such royalties.
|
||||
|
||||
|
||||
Section 3 -- License Conditions.
|
||||
|
||||
Your exercise of the Licensed Rights is expressly made subject to the
|
||||
following conditions.
|
||||
|
||||
a. Attribution.
|
||||
|
||||
1. If You Share the Licensed Material (including in modified
|
||||
form), You must:
|
||||
|
||||
a. retain the following if it is supplied by the Licensor
|
||||
with the Licensed Material:
|
||||
|
||||
i. identification of the creator(s) of the Licensed
|
||||
Material and any others designated to receive
|
||||
attribution, in any reasonable manner requested by
|
||||
the Licensor (including by pseudonym if
|
||||
designated);
|
||||
|
||||
ii. a copyright notice;
|
||||
|
||||
iii. a notice that refers to this Public License;
|
||||
|
||||
iv. a notice that refers to the disclaimer of
|
||||
warranties;
|
||||
|
||||
v. a URI or hyperlink to the Licensed Material to the
|
||||
extent reasonably practicable;
|
||||
|
||||
b. indicate if You modified the Licensed Material and
|
||||
retain an indication of any previous modifications; and
|
||||
|
||||
c. indicate the Licensed Material is licensed under this
|
||||
Public License, and include the text of, or the URI or
|
||||
hyperlink to, this Public License.
|
||||
|
||||
2. You may satisfy the conditions in Section 3(a)(1) in any
|
||||
reasonable manner based on the medium, means, and context in
|
||||
which You Share the Licensed Material. For example, it may be
|
||||
reasonable to satisfy the conditions by providing a URI or
|
||||
hyperlink to a resource that includes the required
|
||||
information.
|
||||
|
||||
3. If requested by the Licensor, You must remove any of the
|
||||
information required by Section 3(a)(1)(A) to the extent
|
||||
reasonably practicable.
|
||||
|
||||
b. ShareAlike.
|
||||
|
||||
In addition to the conditions in Section 3(a), if You Share
|
||||
Adapted Material You produce, the following conditions also apply.
|
||||
|
||||
1. The Adapter's License You apply must be a Creative Commons
|
||||
license with the same License Elements, this version or
|
||||
later, or a BY-SA Compatible License.
|
||||
|
||||
2. You must include the text of, or the URI or hyperlink to, the
|
||||
Adapter's License You apply. You may satisfy this condition
|
||||
in any reasonable manner based on the medium, means, and
|
||||
context in which You Share Adapted Material.
|
||||
|
||||
3. You may not offer or impose any additional or different terms
|
||||
or conditions on, or apply any Effective Technological
|
||||
Measures to, Adapted Material that restrict exercise of the
|
||||
rights granted under the Adapter's License You apply.
|
||||
|
||||
|
||||
Section 4 -- Sui Generis Database Rights.
|
||||
|
||||
Where the Licensed Rights include Sui Generis Database Rights that
|
||||
apply to Your use of the Licensed Material:
|
||||
|
||||
a. for the avoidance of doubt, Section 2(a)(1) grants You the right
|
||||
to extract, reuse, reproduce, and Share all or a substantial
|
||||
portion of the contents of the database;
|
||||
|
||||
b. if You include all or a substantial portion of the database
|
||||
contents in a database in which You have Sui Generis Database
|
||||
Rights, then the database in which You have Sui Generis Database
|
||||
Rights (but not its individual contents) is Adapted Material,
|
||||
including for purposes of Section 3(b); and
|
||||
|
||||
c. You must comply with the conditions in Section 3(a) if You Share
|
||||
all or a substantial portion of the contents of the database.
|
||||
|
||||
For the avoidance of doubt, this Section 4 supplements and does not
|
||||
replace Your obligations under this Public License where the Licensed
|
||||
Rights include other Copyright and Similar Rights.
|
||||
|
||||
|
||||
Section 5 -- Disclaimer of Warranties and Limitation of Liability.
|
||||
|
||||
a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
|
||||
EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
|
||||
AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
|
||||
ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
|
||||
IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
|
||||
WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
|
||||
PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
|
||||
ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
|
||||
KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
|
||||
ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.
|
||||
|
||||
b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
|
||||
TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
|
||||
NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
|
||||
INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
|
||||
COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
|
||||
USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
|
||||
ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
|
||||
DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
|
||||
IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.
|
||||
|
||||
c. The disclaimer of warranties and limitation of liability provided
|
||||
above shall be interpreted in a manner that, to the extent
|
||||
possible, most closely approximates an absolute disclaimer and
|
||||
waiver of all liability.
|
||||
|
||||
|
||||
Section 6 -- Term and Termination.
|
||||
|
||||
a. This Public License applies for the term of the Copyright and
|
||||
Similar Rights licensed here. However, if You fail to comply with
|
||||
this Public License, then Your rights under this Public License
|
||||
terminate automatically.
|
||||
|
||||
b. Where Your right to use the Licensed Material has terminated under
|
||||
Section 6(a), it reinstates:
|
||||
|
||||
1. automatically as of the date the violation is cured, provided
|
||||
it is cured within 30 days of Your discovery of the
|
||||
violation; or
|
||||
|
||||
2. upon express reinstatement by the Licensor.
|
||||
|
||||
For the avoidance of doubt, this Section 6(b) does not affect any
|
||||
right the Licensor may have to seek remedies for Your violations
|
||||
of this Public License.
|
||||
|
||||
c. For the avoidance of doubt, the Licensor may also offer the
|
||||
Licensed Material under separate terms or conditions or stop
|
||||
distributing the Licensed Material at any time; however, doing so
|
||||
will not terminate this Public License.
|
||||
|
||||
d. Sections 1, 5, 6, 7, and 8 survive termination of this Public
|
||||
License.
|
||||
|
||||
|
||||
Section 7 -- Other Terms and Conditions.
|
||||
|
||||
a. The Licensor shall not be bound by any additional or different
|
||||
terms or conditions communicated by You unless expressly agreed.
|
||||
|
||||
b. Any arrangements, understandings, or agreements regarding the
|
||||
Licensed Material not stated herein are separate from and
|
||||
independent of the terms and conditions of this Public License.
|
||||
|
||||
|
||||
Section 8 -- Interpretation.
|
||||
|
||||
a. For the avoidance of doubt, this Public License does not, and
|
||||
shall not be interpreted to, reduce, limit, restrict, or impose
|
||||
conditions on any use of the Licensed Material that could lawfully
|
||||
be made without permission under this Public License.
|
||||
|
||||
b. To the extent possible, if any provision of this Public License is
|
||||
deemed unenforceable, it shall be automatically reformed to the
|
||||
minimum extent necessary to make it enforceable. If the provision
|
||||
cannot be reformed, it shall be severed from this Public License
|
||||
without affecting the enforceability of the remaining terms and
|
||||
conditions.
|
||||
|
||||
c. No term or condition of this Public License will be waived and no
|
||||
failure to comply consented to unless expressly agreed to by the
|
||||
Licensor.
|
||||
|
||||
d. Nothing in this Public License constitutes or may be interpreted
|
||||
as a limitation upon, or waiver of, any privileges and immunities
|
||||
that apply to the Licensor or You, including from the legal
|
||||
processes of any jurisdiction or authority.
|
||||
|
||||
|
||||
=======================================================================
|
||||
|
||||
Creative Commons is not a party to its public
|
||||
licenses. Notwithstanding, Creative Commons may elect to apply one of
|
||||
its public licenses to material it publishes and in those instances
|
||||
will be considered the “Licensor.” The text of the Creative Commons
|
||||
public licenses is dedicated to the public domain under the CC0 Public
|
||||
Domain Dedication. Except for the limited purpose of indicating that
|
||||
material is shared under a Creative Commons public license or as
|
||||
otherwise permitted by the Creative Commons policies published at
|
||||
creativecommons.org/policies, Creative Commons does not authorize the
|
||||
use of the trademark "Creative Commons" or any other trademark or logo
|
||||
of Creative Commons without its prior written consent including,
|
||||
without limitation, in connection with any unauthorized modifications
|
||||
to any of its public licenses or any other arrangements,
|
||||
understandings, or agreements concerning use of licensed material. For
|
||||
the avoidance of doubt, this paragraph does not form part of the
|
||||
public licenses.
|
||||
|
||||
Creative Commons may be contacted at creativecommons.org.
|
||||
|
||||
@@ -1,354 +0,0 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
License is intended to guarantee your freedom to share and change free
|
||||
software--to make sure the software is free for all its users. This
|
||||
General Public License applies to most of the Free Software
|
||||
Foundation's software and to any other program whose authors commit to
|
||||
using it. (Some other Free Software Foundation software is covered by
|
||||
the GNU Lesser General Public License instead.) You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
this service if you wish), that you receive source code or can get it
|
||||
if you want it, that you can change the software or use pieces of it
|
||||
in new free programs; and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
anyone to deny you these rights or to ask you to surrender the rights.
|
||||
These restrictions translate to certain responsibilities for you if you
|
||||
distribute copies of the software, or if you modify it.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must give the recipients all the rights that
|
||||
you have. You must make sure that they, too, receive or can get the
|
||||
source code. And you must show them these terms so they know their
|
||||
rights.
|
||||
|
||||
We protect your rights with two steps: (1) copyright the software, and
|
||||
(2) offer you this license which gives you legal permission to copy,
|
||||
distribute and/or modify the software.
|
||||
|
||||
Also, for each author's protection and ours, we want to make certain
|
||||
that everyone understands that there is no warranty for this free
|
||||
software. If the software is modified by someone else and passed on, we
|
||||
want its recipients to know that what they have is not the original, so
|
||||
that any problems introduced by others will not reflect on the original
|
||||
authors' reputations.
|
||||
|
||||
Finally, any free program is threatened constantly by software
|
||||
patents. We wish to avoid the danger that redistributors of a free
|
||||
program will individually obtain patent licenses, in effect making the
|
||||
program proprietary. To prevent this, we have made it clear that any
|
||||
patent must be licensed for everyone's free use or not licensed at all.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License applies to any program or other work which contains
|
||||
a notice placed by the copyright holder saying it may be distributed
|
||||
under the terms of this General Public License. The "Program", below,
|
||||
refers to any such program or work, and a "work based on the Program"
|
||||
means either the Program or any derivative work under copyright law:
|
||||
that is to say, a work containing the Program or a portion of it,
|
||||
either verbatim or with modifications and/or translated into another
|
||||
language. (Hereinafter, translation is included without limitation in
|
||||
the term "modification".) Each licensee is addressed as "you".
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running the Program is not restricted, and the output from the Program
|
||||
is covered only if its contents constitute a work based on the
|
||||
Program (independent of having been made by running the Program).
|
||||
Whether that is true depends on what the Program does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Program's
|
||||
source code as you receive it, in any medium, provided that you
|
||||
conspicuously and appropriately publish on each copy an appropriate
|
||||
copyright notice and disclaimer of warranty; keep intact all the
|
||||
notices that refer to this License and to the absence of any warranty;
|
||||
and give any other recipients of the Program a copy of this License
|
||||
along with the Program.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy, and
|
||||
you may at your option offer warranty protection in exchange for a fee.
|
||||
|
||||
2. You may modify your copy or copies of the Program or any portion
|
||||
of it, thus forming a work based on the Program, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) You must cause the modified files to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
b) You must cause any work that you distribute or publish, that in
|
||||
whole or in part contains or is derived from the Program or any
|
||||
part thereof, to be licensed as a whole at no charge to all third
|
||||
parties under the terms of this License.
|
||||
|
||||
c) If the modified program normally reads commands interactively
|
||||
when run, you must cause it, when started running for such
|
||||
interactive use in the most ordinary way, to print or display an
|
||||
announcement including an appropriate copyright notice and a
|
||||
notice that there is no warranty (or else, saying that you provide
|
||||
a warranty) and that users may redistribute the program under
|
||||
these conditions, and telling the user how to view a copy of this
|
||||
License. (Exception: if the Program itself is interactive but
|
||||
does not normally print such an announcement, your work based on
|
||||
the Program is not required to print an announcement.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Program,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Program, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Program.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Program
|
||||
with the Program (or with a work based on the Program) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may copy and distribute the Program (or a work based on it,
|
||||
under Section 2) in object code or executable form under the terms of
|
||||
Sections 1 and 2 above provided that you also do one of the following:
|
||||
|
||||
a) Accompany it with the complete corresponding machine-readable
|
||||
source code, which must be distributed under the terms of Sections
|
||||
1 and 2 above on a medium customarily used for software interchange; or,
|
||||
|
||||
b) Accompany it with a written offer, valid for at least three
|
||||
years, to give any third party, for a charge no more than your
|
||||
cost of physically performing source distribution, a complete
|
||||
machine-readable copy of the corresponding source code, to be
|
||||
distributed under the terms of Sections 1 and 2 above on a medium
|
||||
customarily used for software interchange; or,
|
||||
|
||||
c) Accompany it with the information you received as to the offer
|
||||
to distribute corresponding source code. (This alternative is
|
||||
allowed only for noncommercial distribution and only if you
|
||||
received the program in object code or executable form with such
|
||||
an offer, in accord with Subsection b above.)
|
||||
|
||||
The source code for a work means the preferred form of the work for
|
||||
making modifications to it. For an executable work, complete source
|
||||
code means all the source code for all modules it contains, plus any
|
||||
associated interface definition files, plus the scripts used to
|
||||
control compilation and installation of the executable. However, as a
|
||||
special exception, the source code distributed need not include
|
||||
anything that is normally distributed (in either source or binary
|
||||
form) with the major components (compiler, kernel, and so on) of the
|
||||
operating system on which the executable runs, unless that component
|
||||
itself accompanies the executable.
|
||||
|
||||
If distribution of executable or object code is made by offering
|
||||
access to copy from a designated place, then offering equivalent
|
||||
access to copy the source code from the same place counts as
|
||||
distribution of the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
4. You may not copy, modify, sublicense, or distribute the Program
|
||||
except as expressly provided under this License. Any attempt
|
||||
otherwise to copy, modify, sublicense or distribute the Program is
|
||||
void, and will automatically terminate your rights under this License.
|
||||
However, parties who have received copies, or rights, from you under
|
||||
this License will not have their licenses terminated so long as such
|
||||
parties remain in full compliance.
|
||||
|
||||
5. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Program or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Program (or any work based on the
|
||||
Program), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Program or works based on it.
|
||||
|
||||
6. Each time you redistribute the Program (or any work based on the
|
||||
Program), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute or modify the Program subject to
|
||||
these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties to
|
||||
this License.
|
||||
|
||||
7. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Program at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Program by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Program.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under
|
||||
any particular circumstance, the balance of the section is intended to
|
||||
apply and the section as a whole is intended to apply in other
|
||||
circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system, which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
8. If the distribution and/or use of the Program is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Program under this License
|
||||
may add an explicit geographical distribution limitation excluding
|
||||
those countries, so that distribution is permitted only in or among
|
||||
countries not thus excluded. In such case, this License incorporates
|
||||
the limitation as if written in the body of this License.
|
||||
|
||||
9. The Free Software Foundation may publish revised and/or new versions
|
||||
of the General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Program
|
||||
specifies a version number of this License which applies to it and "any
|
||||
later version", you have the option of following the terms and conditions
|
||||
either of that version or of any later version published by the Free
|
||||
Software Foundation. If the Program does not specify a version number of
|
||||
this License, you may choose any version ever published by the Free Software
|
||||
Foundation.
|
||||
|
||||
10. If you wish to incorporate parts of the Program into other free
|
||||
programs whose distribution conditions are different, write to the author
|
||||
to ask for permission. For software which is copyrighted by the Free
|
||||
Software Foundation, write to the Free Software Foundation; we sometimes
|
||||
make exceptions for this. Our decision will be guided by the two goals
|
||||
of preserving the free status of all derivatives of our free software and
|
||||
of promoting the sharing and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||
REPAIR OR CORRECTION.
|
||||
|
||||
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
convey the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 2 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License along
|
||||
with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program is interactive, make it output a short notice like this
|
||||
when it starts in an interactive mode:
|
||||
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, the commands you use may
|
||||
be called something other than `show w' and `show c'; they could even be
|
||||
mouse-clicks or menu items--whatever suits your program.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or your
|
||||
school, if any, to sign a "copyright disclaimer" for the program, if
|
||||
necessary. Here is a sample; alter the names:
|
||||
|
||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
||||
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
||||
|
||||
<signature of Ty Coon>, 1 April 1989
|
||||
Ty Coon, President of Vice
|
||||
|
||||
This General Public License does not permit incorporating your program into
|
||||
proprietary programs. If your program is a subroutine library, you may
|
||||
consider it more useful to permit linking proprietary applications with the
|
||||
library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License.
|
||||
|
||||
-----
|
||||
In addition, as a special exception, the copyright holders give
|
||||
permission to link the code of portions of this program with the
|
||||
OpenSSL library under certain conditions as described in each
|
||||
individual source file, and distribute linked combinations
|
||||
including the two.
|
||||
|
||||
You must obey the GNU General Public License in all respects
|
||||
for all of the code used other than OpenSSL. If you modify
|
||||
file(s) with this exception, you may extend this exception to your
|
||||
version of the file(s), but you are not obligated to do so. If you
|
||||
do not wish to do so, delete this exception statement from your
|
||||
version. If you delete this exception statement from all source
|
||||
files in the program, then also delete it here.
|
||||
@@ -1,517 +0,0 @@
|
||||
GNU LESSER GENERAL PUBLIC LICENSE
|
||||
Version 2.1, February 1999
|
||||
|
||||
Copyright (C) 1991, 1999 Free Software Foundation, Inc.
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
[This is the first released version of the Lesser GPL. It also counts
|
||||
as the successor of the GNU Library Public License, version 2, hence
|
||||
the version number 2.1.]
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
Licenses are intended to guarantee your freedom to share and change
|
||||
free software--to make sure the software is free for all its users.
|
||||
|
||||
This license, the Lesser General Public License, applies to some
|
||||
specially designated software packages--typically libraries--of the
|
||||
Free Software Foundation and other authors who decide to use it. You
|
||||
can use it too, but we suggest you first think carefully about whether
|
||||
this license or the ordinary General Public License is the better
|
||||
strategy to use in any particular case, based on the explanations below.
|
||||
|
||||
When we speak of free software, we are referring to freedom of use,
|
||||
not price. Our General Public Licenses are designed to make sure that
|
||||
you have the freedom to distribute copies of free software (and charge
|
||||
for this service if you wish); that you receive source code or can get
|
||||
it if you want it; that you can change the software and use pieces of
|
||||
it in new free programs; and that you are informed that you can do
|
||||
these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
distributors to deny you these rights or to ask you to surrender these
|
||||
rights. These restrictions translate to certain responsibilities for
|
||||
you if you distribute copies of the library or if you modify it.
|
||||
|
||||
For example, if you distribute copies of the library, whether gratis
|
||||
or for a fee, you must give the recipients all the rights that we gave
|
||||
you. You must make sure that they, too, receive or can get the source
|
||||
code. If you link other code with the library, you must provide
|
||||
complete object files to the recipients, so that they can relink them
|
||||
with the library after making changes to the library and recompiling
|
||||
it. And you must show them these terms so they know their rights.
|
||||
|
||||
We protect your rights with a two-step method: (1) we copyright the
|
||||
library, and (2) we offer you this license, which gives you legal
|
||||
permission to copy, distribute and/or modify the library.
|
||||
|
||||
To protect each distributor, we want to make it very clear that
|
||||
there is no warranty for the free library. Also, if the library is
|
||||
modified by someone else and passed on, the recipients should know
|
||||
that what they have is not the original version, so that the original
|
||||
author's reputation will not be affected by problems that might be
|
||||
introduced by others.
|
||||
|
||||
Finally, software patents pose a constant threat to the existence of
|
||||
any free program. We wish to make sure that a company cannot
|
||||
effectively restrict the users of a free program by obtaining a
|
||||
restrictive license from a patent holder. Therefore, we insist that
|
||||
any patent license obtained for a version of the library must be
|
||||
consistent with the full freedom of use specified in this license.
|
||||
|
||||
Most GNU software, including some libraries, is covered by the
|
||||
ordinary GNU General Public License. This license, the GNU Lesser
|
||||
General Public License, applies to certain designated libraries, and
|
||||
is quite different from the ordinary General Public License. We use
|
||||
this license for certain libraries in order to permit linking those
|
||||
libraries into non-free programs.
|
||||
|
||||
When a program is linked with a library, whether statically or using
|
||||
a shared library, the combination of the two is legally speaking a
|
||||
combined work, a derivative of the original library. The ordinary
|
||||
General Public License therefore permits such linking only if the
|
||||
entire combination fits its criteria of freedom. The Lesser General
|
||||
Public License permits more lax criteria for linking other code with
|
||||
the library.
|
||||
|
||||
We call this license the "Lesser" General Public License because it
|
||||
does Less to protect the user's freedom than the ordinary General
|
||||
Public License. It also provides other free software developers Less
|
||||
of an advantage over competing non-free programs. These disadvantages
|
||||
are the reason we use the ordinary General Public License for many
|
||||
libraries. However, the Lesser license provides advantages in certain
|
||||
special circumstances.
|
||||
|
||||
For example, on rare occasions, there may be a special need to
|
||||
encourage the widest possible use of a certain library, so that it becomes
|
||||
a de-facto standard. To achieve this, non-free programs must be
|
||||
allowed to use the library. A more frequent case is that a free
|
||||
library does the same job as widely used non-free libraries. In this
|
||||
case, there is little to gain by limiting the free library to free
|
||||
software only, so we use the Lesser General Public License.
|
||||
|
||||
In other cases, permission to use a particular library in non-free
|
||||
programs enables a greater number of people to use a large body of
|
||||
free software. For example, permission to use the GNU C Library in
|
||||
non-free programs enables many more people to use the whole GNU
|
||||
operating system, as well as its variant, the GNU/Linux operating
|
||||
system.
|
||||
|
||||
Although the Lesser General Public License is Less protective of the
|
||||
users' freedom, it does ensure that the user of a program that is
|
||||
linked with the Library has the freedom and the wherewithal to run
|
||||
that program using a modified version of the Library.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow. Pay close attention to the difference between a
|
||||
"work based on the library" and a "work that uses the library". The
|
||||
former contains code derived from the library, whereas the latter must
|
||||
be combined with the library in order to run.
|
||||
|
||||
GNU LESSER GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License Agreement applies to any software library or other
|
||||
program which contains a notice placed by the copyright holder or
|
||||
other authorized party saying it may be distributed under the terms of
|
||||
this Lesser General Public License (also called "this License").
|
||||
Each licensee is addressed as "you".
|
||||
|
||||
A "library" means a collection of software functions and/or data
|
||||
prepared so as to be conveniently linked with application programs
|
||||
(which use some of those functions and data) to form executables.
|
||||
|
||||
The "Library", below, refers to any such software library or work
|
||||
which has been distributed under these terms. A "work based on the
|
||||
Library" means either the Library or any derivative work under
|
||||
copyright law: that is to say, a work containing the Library or a
|
||||
portion of it, either verbatim or with modifications and/or translated
|
||||
straightforwardly into another language. (Hereinafter, translation is
|
||||
included without limitation in the term "modification".)
|
||||
|
||||
"Source code" for a work means the preferred form of the work for
|
||||
making modifications to it. For a library, complete source code means
|
||||
all the source code for all modules it contains, plus any associated
|
||||
interface definition files, plus the scripts used to control compilation
|
||||
and installation of the library.
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running a program using the Library is not restricted, and output from
|
||||
such a program is covered only if its contents constitute a work based
|
||||
on the Library (independent of the use of the Library in a tool for
|
||||
writing it). Whether that is true depends on what the Library does
|
||||
and what the program that uses the Library does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Library's
|
||||
complete source code as you receive it, in any medium, provided that
|
||||
you conspicuously and appropriately publish on each copy an
|
||||
appropriate copyright notice and disclaimer of warranty; keep intact
|
||||
all the notices that refer to this License and to the absence of any
|
||||
warranty; and distribute a copy of this License along with the
|
||||
Library.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy,
|
||||
and you may at your option offer warranty protection in exchange for a
|
||||
fee.
|
||||
|
||||
2. You may modify your copy or copies of the Library or any portion
|
||||
of it, thus forming a work based on the Library, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) The modified work must itself be a software library.
|
||||
|
||||
b) You must cause the files modified to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
c) You must cause the whole of the work to be licensed at no
|
||||
charge to all third parties under the terms of this License.
|
||||
|
||||
d) If a facility in the modified Library refers to a function or a
|
||||
table of data to be supplied by an application program that uses
|
||||
the facility, other than as an argument passed when the facility
|
||||
is invoked, then you must make a good faith effort to ensure that,
|
||||
in the event an application does not supply such function or
|
||||
table, the facility still operates, and performs whatever part of
|
||||
its purpose remains meaningful.
|
||||
|
||||
(For example, a function in a library to compute square roots has
|
||||
a purpose that is entirely well-defined independent of the
|
||||
application. Therefore, Subsection 2d requires that any
|
||||
application-supplied function or table used by this function must
|
||||
be optional: if the application does not supply it, the square
|
||||
root function must still compute square roots.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Library,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Library, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote
|
||||
it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Library.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Library
|
||||
with the Library (or with a work based on the Library) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may opt to apply the terms of the ordinary GNU General Public
|
||||
License instead of this License to a given copy of the Library. To do
|
||||
this, you must alter all the notices that refer to this License, so
|
||||
that they refer to the ordinary GNU General Public License, version 2,
|
||||
instead of to this License. (If a newer version than version 2 of the
|
||||
ordinary GNU General Public License has appeared, then you can specify
|
||||
that version instead if you wish.) Do not make any other change in
|
||||
these notices.
|
||||
|
||||
Once this change is made in a given copy, it is irreversible for
|
||||
that copy, so the ordinary GNU General Public License applies to all
|
||||
subsequent copies and derivative works made from that copy.
|
||||
|
||||
This option is useful when you wish to copy part of the code of
|
||||
the Library into a program that is not a library.
|
||||
|
||||
4. You may copy and distribute the Library (or a portion or
|
||||
derivative of it, under Section 2) in object code or executable form
|
||||
under the terms of Sections 1 and 2 above provided that you accompany
|
||||
it with the complete corresponding machine-readable source code, which
|
||||
must be distributed under the terms of Sections 1 and 2 above on a
|
||||
medium customarily used for software interchange.
|
||||
|
||||
If distribution of object code is made by offering access to copy
|
||||
from a designated place, then offering equivalent access to copy the
|
||||
source code from the same place satisfies the requirement to
|
||||
distribute the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
5. A program that contains no derivative of any portion of the
|
||||
Library, but is designed to work with the Library by being compiled or
|
||||
linked with it, is called a "work that uses the Library". Such a
|
||||
work, in isolation, is not a derivative work of the Library, and
|
||||
therefore falls outside the scope of this License.
|
||||
|
||||
However, linking a "work that uses the Library" with the Library
|
||||
creates an executable that is a derivative of the Library (because it
|
||||
contains portions of the Library), rather than a "work that uses the
|
||||
library". The executable is therefore covered by this License.
|
||||
Section 6 states terms for distribution of such executables.
|
||||
|
||||
When a "work that uses the Library" uses material from a header file
|
||||
that is part of the Library, the object code for the work may be a
|
||||
derivative work of the Library even though the source code is not.
|
||||
Whether this is true is especially significant if the work can be
|
||||
linked without the Library, or if the work is itself a library. The
|
||||
threshold for this to be true is not precisely defined by law.
|
||||
|
||||
If such an object file uses only numerical parameters, data
|
||||
structure layouts and accessors, and small macros and small inline
|
||||
functions (ten lines or less in length), then the use of the object
|
||||
file is unrestricted, regardless of whether it is legally a derivative
|
||||
work. (Executables containing this object code plus portions of the
|
||||
Library will still fall under Section 6.)
|
||||
|
||||
Otherwise, if the work is a derivative of the Library, you may
|
||||
distribute the object code for the work under the terms of Section 6.
|
||||
Any executables containing that work also fall under Section 6,
|
||||
whether or not they are linked directly with the Library itself.
|
||||
|
||||
6. As an exception to the Sections above, you may also combine or
|
||||
link a "work that uses the Library" with the Library to produce a
|
||||
work containing portions of the Library, and distribute that work
|
||||
under terms of your choice, provided that the terms permit
|
||||
modification of the work for the customer's own use and reverse
|
||||
engineering for debugging such modifications.
|
||||
|
||||
You must give prominent notice with each copy of the work that the
|
||||
Library is used in it and that the Library and its use are covered by
|
||||
this License. You must supply a copy of this License. If the work
|
||||
during execution displays copyright notices, you must include the
|
||||
copyright notice for the Library among them, as well as a reference
|
||||
directing the user to the copy of this License. Also, you must do one
|
||||
of these things:
|
||||
|
||||
a) Accompany the work with the complete corresponding
|
||||
machine-readable source code for the Library including whatever
|
||||
changes were used in the work (which must be distributed under
|
||||
Sections 1 and 2 above); and, if the work is an executable linked
|
||||
with the Library, with the complete machine-readable "work that
|
||||
uses the Library", as object code and/or source code, so that the
|
||||
user can modify the Library and then relink to produce a modified
|
||||
executable containing the modified Library. (It is understood
|
||||
that the user who changes the contents of definitions files in the
|
||||
Library will not necessarily be able to recompile the application
|
||||
to use the modified definitions.)
|
||||
|
||||
b) Use a suitable shared library mechanism for linking with the
|
||||
Library. A suitable mechanism is one that (1) uses at run time a
|
||||
copy of the library already present on the user's computer system,
|
||||
rather than copying library functions into the executable, and (2)
|
||||
will operate properly with a modified version of the library, if
|
||||
the user installs one, as long as the modified version is
|
||||
interface-compatible with the version that the work was made with.
|
||||
|
||||
c) Accompany the work with a written offer, valid for at
|
||||
least three years, to give the same user the materials
|
||||
specified in Subsection 6a, above, for a charge no more
|
||||
than the cost of performing this distribution.
|
||||
|
||||
d) If distribution of the work is made by offering access to copy
|
||||
from a designated place, offer equivalent access to copy the above
|
||||
specified materials from the same place.
|
||||
|
||||
e) Verify that the user has already received a copy of these
|
||||
materials or that you have already sent this user a copy.
|
||||
|
||||
For an executable, the required form of the "work that uses the
|
||||
Library" must include any data and utility programs needed for
|
||||
reproducing the executable from it. However, as a special exception,
|
||||
the materials to be distributed need not include anything that is
|
||||
normally distributed (in either source or binary form) with the major
|
||||
components (compiler, kernel, and so on) of the operating system on
|
||||
which the executable runs, unless that component itself accompanies
|
||||
the executable.
|
||||
|
||||
It may happen that this requirement contradicts the license
|
||||
restrictions of other proprietary libraries that do not normally
|
||||
accompany the operating system. Such a contradiction means you cannot
|
||||
use both them and the Library together in an executable that you
|
||||
distribute.
|
||||
|
||||
7. You may place library facilities that are a work based on the
|
||||
Library side-by-side in a single library together with other library
|
||||
facilities not covered by this License, and distribute such a combined
|
||||
library, provided that the separate distribution of the work based on
|
||||
the Library and of the other library facilities is otherwise
|
||||
permitted, and provided that you do these two things:
|
||||
|
||||
a) Accompany the combined library with a copy of the same work
|
||||
based on the Library, uncombined with any other library
|
||||
facilities. This must be distributed under the terms of the
|
||||
Sections above.
|
||||
|
||||
b) Give prominent notice with the combined library of the fact
|
||||
that part of it is a work based on the Library, and explaining
|
||||
where to find the accompanying uncombined form of the same work.
|
||||
|
||||
8. You may not copy, modify, sublicense, link with, or distribute
|
||||
the Library except as expressly provided under this License. Any
|
||||
attempt otherwise to copy, modify, sublicense, link with, or
|
||||
distribute the Library is void, and will automatically terminate your
|
||||
rights under this License. However, parties who have received copies,
|
||||
or rights, from you under this License will not have their licenses
|
||||
terminated so long as such parties remain in full compliance.
|
||||
|
||||
9. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Library or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Library (or any work based on the
|
||||
Library), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Library or works based on it.
|
||||
|
||||
10. Each time you redistribute the Library (or any work based on the
|
||||
Library), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute, link with or modify the Library
|
||||
subject to these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties with
|
||||
this License.
|
||||
|
||||
11. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Library at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Library by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Library.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under any
|
||||
particular circumstance, the balance of the section is intended to apply,
|
||||
and the section as a whole is intended to apply in other circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
12. If the distribution and/or use of the Library is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Library under this License may add
|
||||
an explicit geographical distribution limitation excluding those countries,
|
||||
so that distribution is permitted only in or among countries not thus
|
||||
excluded. In such case, this License incorporates the limitation as if
|
||||
written in the body of this License.
|
||||
|
||||
13. The Free Software Foundation may publish revised and/or new
|
||||
versions of the Lesser General Public License from time to time.
|
||||
Such new versions will be similar in spirit to the present version,
|
||||
but may differ in detail to address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Library
|
||||
specifies a version number of this License which applies to it and
|
||||
"any later version", you have the option of following the terms and
|
||||
conditions either of that version or of any later version published by
|
||||
the Free Software Foundation. If the Library does not specify a
|
||||
license version number, you may choose any version ever published by
|
||||
the Free Software Foundation.
|
||||
|
||||
14. If you wish to incorporate parts of the Library into other free
|
||||
programs whose distribution conditions are incompatible with these,
|
||||
write to the author to ask for permission. For software which is
|
||||
copyrighted by the Free Software Foundation, write to the Free
|
||||
Software Foundation; we sometimes make exceptions for this. Our
|
||||
decision will be guided by the two goals of preserving the free status
|
||||
of all derivatives of our free software and of promoting the sharing
|
||||
and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
|
||||
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
|
||||
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
|
||||
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
|
||||
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
|
||||
LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
|
||||
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
|
||||
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
|
||||
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
|
||||
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
|
||||
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
|
||||
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
|
||||
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
|
||||
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
|
||||
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
|
||||
DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Libraries
|
||||
|
||||
If you develop a new library, and you want it to be of the greatest
|
||||
possible use to the public, we recommend making it free software that
|
||||
everyone can redistribute and change. You can do so by permitting
|
||||
redistribution under these terms (or, alternatively, under the terms of the
|
||||
ordinary General Public License).
|
||||
|
||||
To apply these terms, attach the following notices to the library. It is
|
||||
safest to attach them to the start of each source file to most effectively
|
||||
convey the exclusion of warranty; and each file should have at least the
|
||||
"copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the library's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This library is free software; you can redistribute it and/or
|
||||
modify it under the terms of the GNU Lesser General Public
|
||||
License as published by the Free Software Foundation; either
|
||||
version 2.1 of the License, or (at your option) any later version.
|
||||
|
||||
This library is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
Lesser General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Lesser General Public
|
||||
License along with this library; if not, write to the Free Software
|
||||
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or your
|
||||
school, if any, to sign a "copyright disclaimer" for the library, if
|
||||
necessary. Here is a sample; alter the names:
|
||||
|
||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the
|
||||
library `Frob' (a library for tweaking knobs) written by James Random Hacker.
|
||||
|
||||
<signature of Ty Coon>, 1 April 1990
|
||||
Ty Coon, President of Vice
|
||||
|
||||
That's all there is to it!
|
||||
|
||||
-----
|
||||
In addition, as a special exception, the copyright holders give
|
||||
permission to link the code of portions of this program with the
|
||||
OpenSSL library under certain conditions as described in each
|
||||
individual source file, and distribute linked combinations
|
||||
including the two.
|
||||
|
||||
You must obey the GNU Lesser General Public License in all respects
|
||||
for all of the code used other than OpenSSL. If you modify
|
||||
file(s) with this exception, you may extend this exception to your
|
||||
version of the file(s), but you are not obligated to do so. If you
|
||||
do not wish to do so, delete this exception statement from your
|
||||
version. If you delete this exception statement from all source
|
||||
files in the program, then also delete it here.
|
||||
Binary file not shown.
Binary file not shown.
@@ -1,92 +0,0 @@
|
||||
cryptsetup 1.0.7 Release Notes (2009-07-22)
|
||||
===========================================
|
||||
|
||||
Changes since 1.0.7-rc1
|
||||
------------------------
|
||||
[committer name]
|
||||
|
||||
* Allow removal of last slot in luksRemoveKey
|
||||
and luksKillSlot. [Milan Broz]
|
||||
|
||||
* Add --disable-selinux option and fix static build if selinux
|
||||
is required. [Milan Broz]
|
||||
|
||||
* Reject unsupported --offset and --skip options for luksFormat
|
||||
and update man page. [Milan Broz]
|
||||
|
||||
|
||||
Changes since 1.0.6
|
||||
--------------------
|
||||
[committer name]
|
||||
|
||||
* Various man page fixes. Also merged some Debian/Ubuntu man page
|
||||
fixes. (thanks to Martin Pitt) [Milan Broz]
|
||||
|
||||
* Set UUID in device-mapper for LUKS devices. [Milan Broz]
|
||||
|
||||
* Retain readahead of underlying device. [Milan Broz]
|
||||
|
||||
* Display device name when asking for password. (thanks to Till
|
||||
Maas) [Milan Broz]
|
||||
|
||||
* Check device size when loading LUKS header. Remove misleading
|
||||
error message later. [Milan Broz]
|
||||
|
||||
* Add error hint if dm-crypt mapping failed. (Key size and kernel
|
||||
version check for XTS and LRW mode for now.) [Milan Broz]
|
||||
|
||||
* Use better error messages if device doesn't exist or is already
|
||||
used by other mapping. [Milan Broz]
|
||||
|
||||
* Fix make distcheck. (thanks to Mike Kelly) [Milan Broz]
|
||||
|
||||
* Check if all slots are full during luksAddKey. [Clemens Fruhwirth]
|
||||
|
||||
* Fix segfault in set_error (thanks to Oliver Metz). [Clemens Fruhwirth]
|
||||
|
||||
* Remove precompiled pot files. Fix uninitialized return value
|
||||
variable in setup.c. [Clemens Fruhwirth]
|
||||
|
||||
* Code cleanups. (thanks to Ivan Stankovic) [Clemens Fruhwirth]
|
||||
|
||||
* Remove unnecessary files from po directory. They will be
|
||||
regenerated by autogen.sh. [Clemens Fruhwirth]
|
||||
|
||||
* Fix wrong output for remaining key at key deletion. Allow deletion
|
||||
of key slot while other keys have the same key information. [Clemens
|
||||
Fruhwirth]
|
||||
|
||||
* Add missing AM_PROG_CC_C_O to configure.in [Milan Broz]
|
||||
|
||||
* Remove duplicate sentence in man page (thanks to Till Maas).
|
||||
[Milan Broz]
|
||||
|
||||
* Wipe start of device (possible fs signature) before
|
||||
LUKS-formatting. [Milan Broz]
|
||||
|
||||
* Do not process configure.in in hidden directories. [Milan Broz]
|
||||
|
||||
* Return more descriptive error in case of IO or header format
|
||||
error. [Milan Broz]
|
||||
|
||||
* Use remapping to error target instead of calling udevsettle
|
||||
for temporary crypt device. [Milan Broz]
|
||||
|
||||
* Check device mapper communication and warn user in case the
|
||||
communication fails. (thanks to Milan Broz) [Clemens Fruhwirth]
|
||||
|
||||
* Fix signal handler to proper close device. (thanks to Milan Broz)
|
||||
[Clemens Fruhwirth]
|
||||
|
||||
* write_lseek_blockwise: declare innerCount outside the if block,
|
||||
add -Wall to the default CFLAGS, * fix some signedness issues
|
||||
(thanks to Ivan Stankovic) [Clemens Fruhwirth]
|
||||
|
||||
* Error handling improvement. (thanks to Erik Edin) [Clemens Fruhwirth]
|
||||
|
||||
* Add non-exclusive override to interface definition. [Clemens
|
||||
Fruhwirth]
|
||||
|
||||
* Refactor key slot selection into keyslot_from_option. Either
|
||||
autoselect next free keyslot or honor user choice (after checking).
|
||||
[Clemens Fruhwirth]
|
||||
@@ -1,110 +0,0 @@
|
||||
Cryptsetup 1.1.0 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.0.7
|
||||
----------------------------
|
||||
|
||||
Important changes:
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* IMPORTANT: the default compiled-in cipher parameters changed
|
||||
plain mode: aes-cbc-essiv:sha256 (default is backward incompatible!).
|
||||
LUKS mode: aes-cbc-essiv:sha256 (only key size increased)
|
||||
In both modes is now default key size 256bits.
|
||||
|
||||
* Default compiled-in parameters are now configurable through configure options:
|
||||
--with-plain-* / --with-luks1-* (see configure --help)
|
||||
|
||||
* If you need backward compatible defaults for distribution use
|
||||
configure --with-plain-mode=cbc-plain --with-luks1-keybits=128
|
||||
|
||||
Default compiled-in modes are printed in "cryptsetup --help" output.
|
||||
|
||||
* Change in iterations count (LUKS):
|
||||
The slot and key digest iteration minimum count is now 1000.
|
||||
The key digest iteration count is calculated from iteration time (approx 1/8 of req. time).
|
||||
For more info about above items see discussion here: http://tinyurl.com/yaug97y
|
||||
|
||||
* New libcryptsetup API (documented in libcryptsetup.h).
|
||||
|
||||
The old API (using crypt_options struct) is still available but will remain
|
||||
frozen and not used for new functions.
|
||||
Soname of library changed to libcryptsetup.so.1.0.0.
|
||||
(But only recompilation should be needed for old programs.)
|
||||
|
||||
The new API provides much more flexible operation over LUKS device for
|
||||
applications, it is preferred that new applications will use libcryptsetup
|
||||
and not wrapper around cryptsetup binary.
|
||||
|
||||
* New luksHeaderBackup and luksHeaderRestore commands.
|
||||
|
||||
These commands allows binary backup of LUKS header.
|
||||
Please read man page about possible security issues with backup files.
|
||||
|
||||
* New luksSuspend (freeze device and wipe key) and luksResume (with provided passphrase).
|
||||
|
||||
luksSuspend wipe encryption key in kernel memory and set device to suspend
|
||||
(blocking all IO) state. This option can be used for situations when you need
|
||||
temporary wipe encryption key (like suspend to RAM etc.)
|
||||
Please read man page for more information.
|
||||
|
||||
* New --master-key-file option for luksFormat and luksAddKey.
|
||||
|
||||
User can now specify pre-generated master key in file, which allows regenerating
|
||||
LUKS header or add key with only master key knowledge.
|
||||
|
||||
* Uses libgcrypt and enables all gcrypt hash algorithms for LUKS through -h luksFormat option.
|
||||
|
||||
Please note that using different hash for LUKS header make device incompatible with
|
||||
old cryptsetup releases.
|
||||
|
||||
* Introduces --debug parameter.
|
||||
|
||||
Use when reporting bugs (just run cryptsetup with --debug and attach output
|
||||
to issue report.) Sensitive data are never printed to this log.
|
||||
|
||||
* Moves command successful messages to verbose level.
|
||||
|
||||
* Requires device-mapper library and libgcrypt to build.
|
||||
|
||||
* Uses dm-uuid for all crypt devices, contains device type and name now.
|
||||
|
||||
* Removes support for dangerous non-exclusive option
|
||||
(it is ignored now, LUKS device must be always opened exclusive)
|
||||
|
||||
Other changes:
|
||||
~~~~~~~~~~~~~~
|
||||
* Fixed localization to work again. Also cryptsetup is now translated by translationproject.org.
|
||||
* Fix some libcryptsetup problems, including
|
||||
* exported symbols and versions in libcryptsetup (properly use versioned symbols)
|
||||
* Add crypt_log library function.
|
||||
* Add CRYPT_ prefix to enum defined in libcryptsetup.h.
|
||||
* Move duplicate Command failed message to verbose level (error is printed always).
|
||||
* Fix several problems in build system
|
||||
* use autopoint and clean gettext processing.
|
||||
* Check in configure if selinux libraries are required in static version.
|
||||
* Fix build for non-standard location of gcrypt library.
|
||||
* Add temporary debug code to find processes locking internal device.
|
||||
* Fix error handling during reading passphrase.
|
||||
* Fail passphrase read if piped input no longer exists.
|
||||
* Fix man page to not require --size which expands to device size by default.
|
||||
* Clean up Makefiles and configure script.
|
||||
* Try to read first sector from device to properly check that device is ready.
|
||||
* Move memory locking and dm initialization to command layer.
|
||||
* Increase priority of process if memory is locked.
|
||||
* Add log macros and make logging more consistent.
|
||||
* Keyfile now must be provided by path, only stdin file descriptor is used (api only).
|
||||
* Do not call isatty() on closed keyfile descriptor.
|
||||
* Move key slot manipulation function into LUKS specific code.
|
||||
* Replace global options struct with separate parameters in helper functions.
|
||||
* Implement old API calls using new functions.
|
||||
* Allow using passphrase provided in options struct for LuksOpen.
|
||||
* Allow restrict keys size in LuksOpen.
|
||||
* Fix errors when compiled with LUKS_DEBUG.
|
||||
* Print error when getline fails.
|
||||
* Completely remove internal SHA1 implementation code, not needed anymore.
|
||||
* Pad luks header to 512 sector size.
|
||||
* Rework read/write blockwise to not split operation to many pieces.
|
||||
* Use posix_memalign if available.
|
||||
* Fix segfault if provided slot in luksKillslot is invalid.
|
||||
* Remove unneeded timeout when remove of temporary device succeeded.
|
||||
@@ -1,47 +0,0 @@
|
||||
Cryptsetup 1.1.1 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.1.1-rc2
|
||||
* Fix luksClose error if underlying device is LVM logical volume.
|
||||
|
||||
Changes since version 1.1.1-rc1
|
||||
* Fix automatic dm-crypt module loading.
|
||||
|
||||
Changes since version 1.1.0
|
||||
|
||||
Important changes:
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Detects and use device-mapper udev support if available.
|
||||
|
||||
This should allow synchronisation with udev rules and avoid races with udev.
|
||||
|
||||
If package maintainer want to use old, direct libdevmapper device node creation,
|
||||
use configure option --disable-udev.
|
||||
|
||||
* Supports device topology detection for data alignment.
|
||||
|
||||
If kernel provides device topology ioctl calls, the LUKS data area
|
||||
alignment is automatically set to optimal value.
|
||||
|
||||
This means that stacked devices (like LUKS over MD/LVM)
|
||||
should use the most optimal data alignment.
|
||||
|
||||
(You can still overwrite this calculation using --align-payload option.)
|
||||
|
||||
* Prefers some device paths in status display.
|
||||
(So status command will try to find top level device name, like /dev/sdb.)
|
||||
|
||||
* Fix package config file to use proper package version.
|
||||
|
||||
Other changes:
|
||||
~~~~~~~~~~~~~~
|
||||
* Fix luksOpen reading of passphrase on stdin (if "-" keyfile specified).
|
||||
* Fix isLuks to initialise crypto backend (blkid instead is suggested anyway).
|
||||
* Properly initialise crypto backend in header backup/restore commands.
|
||||
* Do not verify unlocking passphrase in luksAddKey command.
|
||||
* Allow no hash specification in plain device constructor - user can provide volume key directly.
|
||||
* Try to use pkgconfig for device mapper library in configuration script.
|
||||
* Add some compatibility checks and disable LUKS suspend/resume if not supported.
|
||||
* Rearrange tests, "make check" now run all available test for package.
|
||||
* Avoid class C++ keyword in library header.
|
||||
@@ -1,33 +0,0 @@
|
||||
== Cryptsetup 1.1.2 Release Notes ==
|
||||
|
||||
This release fixes a regression (introduced in 1.1.1 version) in handling
|
||||
key files containing new line characters (affects only files read from
|
||||
standard input).
|
||||
|
||||
Cryptsetup can accept passphrase on stdin (standard input).
|
||||
|
||||
Handling of new line (\n) character is defined by input specification:
|
||||
|
||||
* if keyfile is specified as "-" (using --key-file=- of by "-" positional argument
|
||||
in luksFormat and luksAddKey, like cat file | cryptsetup --key-file=- <action>),
|
||||
input is processed as normal binary file and no new line is interpreted.
|
||||
|
||||
* if there is no key file specification (with default input from stdin pipe
|
||||
like echo passphrase | cryptsetup <action>) input is processed as input from terminal,
|
||||
reading will stop after new line is detected.
|
||||
|
||||
Moreover, luksFormat now understands --key-file (in addition to positional key
|
||||
file argument).
|
||||
|
||||
N.B. Using of standard input and pipes for passphrases should be avoided if possible,
|
||||
cryptsetup have no control of used pipe buffers between commands in scripts and cannot
|
||||
guarantee that all passphrase/key-file buffers are properly wiped after use.
|
||||
|
||||
=== changes since version 1.1.1 ===
|
||||
|
||||
* Fix luksFormat/luksOpen reading passphrase from stdin and "-" keyfile.
|
||||
* Support --key-file/-d option for luksFormat.
|
||||
* Fix description of --key-file and add --verbose and --debug options to man page.
|
||||
* Add verbose log level and move unlocking message there.
|
||||
* Remove device even if underlying device disappeared (remove, luksClose).
|
||||
* Fix (deprecated) reload device command to accept new device argument.
|
||||
@@ -1,13 +0,0 @@
|
||||
== Cryptsetup 1.1.3 Release Notes ==
|
||||
|
||||
=== changes since version 1.1.2 ===
|
||||
|
||||
* Fix device alignment ioctl calls parameters.
|
||||
(Device alignment code was not working properly on some architectures like ppc64.)
|
||||
|
||||
* Fix activate_by_* API calls to handle NULL device name as documented.
|
||||
(To enable check of passphrase/keyfile using libcryptsetup without activating the device.)
|
||||
|
||||
* Fix udev support for old libdevmapper with not compatible definition.
|
||||
|
||||
* Added Polish translation file.
|
||||
@@ -1,126 +0,0 @@
|
||||
Cryptsetup 1.2.0 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.2.0-rc1
|
||||
|
||||
* Fix crypt_activate_by_keyfile() to work with PLAIN devices.
|
||||
* Fix plain create command to properly handle keyfile size.
|
||||
* Update translations.
|
||||
|
||||
Changes since version 1.1.3
|
||||
|
||||
Important changes
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Add text version of *FAQ* (Frequently Asked Questions) to distribution.
|
||||
|
||||
* Add selection of random/urandom number generator for luksFormat
|
||||
(option --use-random and --use-urandom).
|
||||
|
||||
(This affects only long term volume key in *luksFormat*,
|
||||
not RNG used for salt and AF splitter).
|
||||
|
||||
You can also set the default to /dev/random during compilation with
|
||||
--enable-dev-random. Compiled-in default is printed in --help output.
|
||||
|
||||
Be very careful before changing default to blocking /dev/random use here.
|
||||
|
||||
* Fix *luksRemoveKey* to not ask for remaining keyslot passphrase,
|
||||
only for removed one.
|
||||
|
||||
* No longer support *luksDelKey* (replaced with luksKillSlot).
|
||||
* if you want to remove particular passphrase, use *luksKeyRemove*
|
||||
* if you want to remove particular keyslot, use *luksKillSlot*
|
||||
|
||||
Note that in batch mode *luksKillSlot* allows removing of any keyslot
|
||||
without question, in normal mode requires passphrase or keyfile from
|
||||
other keyslot.
|
||||
|
||||
* *Default alignment* for device (if not overridden by topology info)
|
||||
is now (multiple of) *1MiB*.
|
||||
This reflects trends in storage technologies and aligns to the same
|
||||
defaults for partitions and volume management.
|
||||
|
||||
* Allow explicit UUID setting in *luksFormat* and allow change it later
|
||||
in *luksUUID* (--uuid parameter).
|
||||
|
||||
* All commands using key file now allows limited read from keyfile using
|
||||
--keyfile-size and --new-keyfile-size parameters (in bytes).
|
||||
|
||||
This change also disallows overloading of --key-size parameter which
|
||||
is now exclusively used for key size specification (in bits.)
|
||||
|
||||
* *luksFormat* using pre-generated master key now properly allows
|
||||
using key file (only passphrase was allowed prior to this update).
|
||||
|
||||
* Add --dump-master-key option for *luksDump* to perform volume (master)
|
||||
key dump. Note that printed information allows accessing device without
|
||||
passphrase so it must be stored encrypted.
|
||||
|
||||
This operation is useful for simple Key Escrow function (volume key and
|
||||
encryption parameters printed on paper on safe place).
|
||||
|
||||
This operation requires passphrase or key file.
|
||||
|
||||
* The reload command is no longer supported.
|
||||
(Use dmsetup reload instead if needed. There is no real use for this
|
||||
function except explicit data corruption:-)
|
||||
|
||||
* Cryptsetup now properly checks if underlying device is in use and
|
||||
disallows *luksFormat*, *luksOpen* and *create* commands on open
|
||||
(e.g. already mapped or mounted) device.
|
||||
|
||||
* Option --non-exclusive (already deprecated) is removed.
|
||||
|
||||
Libcryptsetup API additions:
|
||||
|
||||
* new functions
|
||||
* crypt_get_type() - explicit query to crypt device context type
|
||||
* crypt_resize() - new resize command using context
|
||||
* crypt_keyslot_max() - helper to get number of supported keyslots
|
||||
* crypt_get_active_device() - get active device info
|
||||
* crypt_set/get_rng_type() - random/urandom RNG setting
|
||||
* crypt_set_uuid() - explicit UUID change of existing device
|
||||
* crypt_get_device_name() - get underlying device name
|
||||
|
||||
* Fix optional password callback handling.
|
||||
|
||||
* Allow one to activate by internally cached volume key immediately after
|
||||
crypt_format() without active slot (for temporary devices with
|
||||
on-disk metadata)
|
||||
|
||||
* libcryptsetup is binary compatible with 1.1.x release and still
|
||||
supports legacy API calls
|
||||
|
||||
* cryptsetup binary now uses only new API calls.
|
||||
|
||||
* Static compilation of both library (--enable-static) and cryptsetup
|
||||
binary (--enable-static-cryptsetup) is now properly implemented by common
|
||||
libtool logic.
|
||||
|
||||
Prior to this it produced miscompiled dynamic cryptsetup binary with
|
||||
statically linked libcryptsetup.
|
||||
|
||||
The static binary is compiled as src/cryptsetup.static in parallel
|
||||
with dynamic build if requested.
|
||||
|
||||
Other changes
|
||||
~~~~~~~~~~~~~
|
||||
* Fix default plain password entry from terminal in activate_by_passphrase.
|
||||
* Initialize volume key from active device in crypt_init_by_name()
|
||||
* Fix cryptsetup binary exit codes.
|
||||
0 - success, otherwise fail
|
||||
1 - wrong parameters
|
||||
2 - no permission
|
||||
3 - out of memory
|
||||
4 - wrong device specified
|
||||
5 - device already exists or device is busy
|
||||
* Remove some obsolete info from man page.
|
||||
* Add more regression tests for commands.
|
||||
* Fix possible double free when handling master key file.
|
||||
* Fix pkg-config use in automake scripts.
|
||||
* Wipe iteration and salt after luksKillSlot in LUKS header.
|
||||
* Rewrite file differ test to C (and fix it to really work).
|
||||
* Do not query non-existent device twice (cryptsetup status /dev/nonexistent).
|
||||
* Check if requested hash is supported before writing LUKS header.
|
||||
* Fix problems reported by clang scan-build.
|
||||
@@ -1,101 +0,0 @@
|
||||
Cryptsetup 1.3.0 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.2.0
|
||||
|
||||
Important changes
|
||||
~~~~~~~~~~~~~~~~~
|
||||
* Several userspace crypto backends support
|
||||
|
||||
cryptsetup now supports generic crypto backend interface which allows
|
||||
compile package with various crypto libraries, these are already implemented:
|
||||
|
||||
* gcrypt (default, used in previous versions)
|
||||
* OpenSSL
|
||||
* NSS (because of missing ripemd160 it cannot provide full backward compatibility)
|
||||
* kernel userspace API (provided by kernel 2.6.38 and above)
|
||||
(Note that kernel userspace backend is very slow for this type of operation.
|
||||
But it can be useful for embedded systems, because you can avoid userspace
|
||||
crypto library completely.)
|
||||
|
||||
Backend is selected during configure time, using --with-crypto_backend option.
|
||||
|
||||
configure --with-crypto_backend=BACKEND (gcrypt/openssl/nss/kernel) [gcrypt]
|
||||
|
||||
Note that performance checked (iterations) in LUKS header will cause that
|
||||
real iteration time will differ with different backends.
|
||||
(There are huge differences in speed between libraries.)
|
||||
|
||||
* Cryptsetup now automatically allocates loopback device (/dev/loop) if device
|
||||
argument is file and not plain device.
|
||||
|
||||
This require Linux kernel 2.6.25 and above (which implements loop autoclear flag).
|
||||
|
||||
You can see backing file in cryptsetup status output if underlying device is loopback.
|
||||
|
||||
* Introduce maximum default keyfile size, add configure option, visible in --help.
|
||||
|
||||
Cryptsetup now fails if read from keyfile exceeds internal limit.
|
||||
You can always specify keyfile size (overrides limit) by using --keyfile-size option.
|
||||
|
||||
* Adds luksChangeKey command
|
||||
|
||||
cryptestup luksChangeKey --key-file <old keyfile> <new keyfile> [--key-slot X]
|
||||
cryptestup luksChangeKey [--key-slot X] (for passphrase change)
|
||||
|
||||
This command allows passphrase/keyfile change in one step. If no key slot is
|
||||
specified (and there is still free key slot on device) new slot is allocated before
|
||||
the old is purged.
|
||||
|
||||
If --key-slot option is specified (or there is no free slot) command will overwrite
|
||||
existing slot.
|
||||
WARNING: Be sure you have another slot active or header backup when using explicit
|
||||
key slot (so you can unlock the device even after possible media failure).
|
||||
|
||||
* Adds compatible support for loop-AES encryption type in loopaesOpen command.
|
||||
|
||||
Linux dm-crypt in 2.6.38 and above supports loop-AES compatible mapping
|
||||
(including multi-key and special CBC mode, all three modes are supported).
|
||||
|
||||
If you have raw loop-AES keyfile (text file with uuencoded per-line keys), you can
|
||||
access loop-AES volume using
|
||||
cryptsetup loopaesOpen <device> <name> [--key-size 128] --key-file <key-file>
|
||||
|
||||
If you are using GPG encrypted keyfile
|
||||
gpg --decrypt <key-file> | cryptsetup loopaesOpen --key-file=- <device> <name>
|
||||
|
||||
Do not forget to specify key size. Version and hash is automatically detected
|
||||
according to number of lines in key file. For special configuration you can
|
||||
override IV sector offset using --skip option, device offset with --offset
|
||||
and hash algorithm using --hash, see man page for details.
|
||||
|
||||
Please note that loopAES dm-crypt mode is provided for compatibility reasons
|
||||
(so you do not need to patch kernel and util-linux to map existing volumes)
|
||||
but it is not, and never will be, optimized for speed.
|
||||
It is experimental feature for now.
|
||||
|
||||
* Require the whole key read from keyfile in create command (regression in 1.2.0).
|
||||
|
||||
* WARNING: This is the last cryptsetup release which supports library with
|
||||
old API (using struct crypt_options).
|
||||
These calls are deprecated since 1.1.0 and AFAIK no application
|
||||
is using it in recent distros. Removing compatible code will allow
|
||||
new features to be implemented easily.
|
||||
|
||||
Other changes
|
||||
~~~~~~~~~~~~~
|
||||
* Lock memory also in luksDump command.
|
||||
* Fix return code when passphrase is read from pipe.
|
||||
* Increase libcryptsetup version (loopAES change), still fully backward compatible.
|
||||
* Fixes static build (--disable-static-cryptsetup now works properly).
|
||||
* Supports secure data flag for device-mapper ioctl (will be in 2.6.39,
|
||||
forcing kernel to wipe all ioctl buffers with possible key data).
|
||||
To enable this flag you need new device-mapper library, in LVM2 2.02.84.
|
||||
* Add copyright texts into some files and adds GPL exception allowing
|
||||
to distribute resulting binaries linked with OpenSSL.
|
||||
* Update FAQ.
|
||||
* Fix message when locking memory fails.
|
||||
* Fix luksAddKey return code if master key is used.
|
||||
* Update some text files in distributions.
|
||||
* Add docs directory with Release Notes archive.
|
||||
* Do not hardcode loopback device name in tests, use internal loopback library.
|
||||
@@ -1,14 +0,0 @@
|
||||
Cryptsetup 1.3.1 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.3.0
|
||||
|
||||
* Fix keyfile=- processing in create command (regression in 1.3.0).
|
||||
|
||||
* Simplify device path status check (use /sys and do not scan /dev).
|
||||
|
||||
* Do not ignore device size argument for create command (regression in 1.2.0).
|
||||
|
||||
* Fix error paths in blockwise code and lseek_write call.
|
||||
|
||||
* Add optional Nettle crypto backend support.
|
||||
@@ -1,131 +0,0 @@
|
||||
Cryptsetup 1.4.0 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.3.1
|
||||
|
||||
Important changes
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
WARNING: This release removes old deprecated API from libcryptsetup
|
||||
(all functions using struct crypt_options).
|
||||
|
||||
This require libcrypsetup version change and
|
||||
rebuild of applications using cryptsetup library.
|
||||
All new API symbols are backward compatible.
|
||||
|
||||
* If device is not rotational disk, cryptsetup no longer tries
|
||||
to wipe keyslot with Gutmann algorithm for magnetic media erase
|
||||
but simply rewrites area once by random data.
|
||||
|
||||
* The on-disk LUKS header can now be detached (e.g. placed on separate
|
||||
device or in file) using new --header option.
|
||||
|
||||
This option is only relevant for LUKS devices and can be used in
|
||||
luksFormat, luksOpen, luksSuspend, luksResume and resize commands.
|
||||
|
||||
If used with luksFormat the --align-payload option is taken
|
||||
as absolute sector alignment on ciphertext device and can be zero.
|
||||
|
||||
Example:
|
||||
Create LUKS device with ciphertext device on /dev/sdb and header
|
||||
on device /dev/sdc. Use all space on /dev/sdb (no reserved area for header).
|
||||
|
||||
cryptsetup luksFormat /dev/sdb --header /dev/sdc --align-payload 0
|
||||
|
||||
Activate such device:
|
||||
cryptsetup luksOpen /dev/sdb --header /dev/sdc test_disk
|
||||
|
||||
You can use file for LUKS header (loop device will be used while
|
||||
manipulating with such detached header), just you have to create
|
||||
large enough file in advance.
|
||||
|
||||
dd if=/dev/zero of=/mnt/luks_header bs=1M count=4
|
||||
cryptsetup luksFormat /dev/sdb --header /mnt/luks_header --align-payload 0
|
||||
|
||||
Activation is the same as above.
|
||||
|
||||
cryptsetup luksOpen /dev/sdb --header /mnt/luks_header test_disk
|
||||
|
||||
All keyslot operations need to be run on _header_ not on ciphertext device,
|
||||
an example:
|
||||
|
||||
cryptsetup luksAddKey /mnt/luks_header
|
||||
|
||||
If you do not use --align-payload 0, you can later restore LUKS header
|
||||
on device itself (and use it as normal LUKS device without detached header).
|
||||
|
||||
WARNING: There is no possible check that specified ciphertext device
|
||||
matches detached on-disk header. Use with care, it can destroy
|
||||
your data in case of a mistake.
|
||||
|
||||
WARNING: Storing LUKS header in a file means that anti-forensic splitter
|
||||
cannot properly work (there is filesystem allocation layer between
|
||||
header and disk).
|
||||
|
||||
* Support --allow-discards option to allow discards/TRIM requests.
|
||||
|
||||
Since kernel 3.1, dm-crypt devices optionally (not by default) support
|
||||
block discards (TRIM) commands.
|
||||
If you want to enable this operation, you have to enable it manually
|
||||
on every activation using --allow-discards
|
||||
|
||||
cryptsetup luksOpen --allow-discards /dev/sdb test_disk
|
||||
|
||||
WARNING: There are several security consequences, please read at least
|
||||
http://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html
|
||||
before you enable it.
|
||||
|
||||
* Add --shared option for creating non-overlapping crypt segments.
|
||||
|
||||
The --shared options checks that mapped segments are not overlapping
|
||||
and allows non-exclusive access to underlying device.
|
||||
Only plain crypt devices can be used in this mode.
|
||||
|
||||
Example - map 64M of device disk and following 32 M area as another disk.
|
||||
|
||||
cryptsetup create outer_disk /dev/sdb --offset 0 --size 65536
|
||||
cryptsetup create inner_disk /dev/sdb --offset 65536 --size 32768 --shared
|
||||
|
||||
(It can be used to simulate trivial hidden disk concepts.)
|
||||
|
||||
libcryptsetup API changes:
|
||||
* Added options to support detached metadata device
|
||||
crypt_init_by_name_and_header()
|
||||
crypt_set_data_device()
|
||||
* Add crypt_last_error() API call.
|
||||
* Fix plain crypt format parameters to include size option.
|
||||
* Add crypt_get_iv_offset() function.
|
||||
|
||||
* Remove old API functions (all functions using crypt_options).
|
||||
|
||||
* Support key-slot option for luksOpen (use only explicit keyslot).
|
||||
|
||||
You can now specify key slot in luksOpen and limit checking
|
||||
only to specified slot.
|
||||
|
||||
* Support retries and timeout parameters for luksSuspend.
|
||||
(The same way as in luksOpen.)
|
||||
|
||||
* Add doxygen-like documentation (it will be available on project page later).
|
||||
(To generate it manually run doxygen in docs directory.)
|
||||
|
||||
Other changes
|
||||
~~~~~~~~~~~~~
|
||||
* Fix crypt_load to properly check device size.
|
||||
* Do not allow context format of already formatted device.
|
||||
* Do not allow key retrieval while suspended (key could be wiped).
|
||||
* Do not allow suspend for non-LUKS devices.
|
||||
* Fix luksKillSLot exit code if slot is inactive or invalid.
|
||||
* Fix exit code if passphrases do not match in luksAddKey.
|
||||
* Fix return code for status command when device doesn't exists.
|
||||
* Fix verbose messages in isLuks command.
|
||||
* Support Nettle 2.4 crypto backend (supports ripemd160).
|
||||
* Add LUKS on-disk format description into package.
|
||||
* Enhance check of device size before writing LUKS header.
|
||||
* Add more paranoid checks for LUKS header and keyslot attributes.
|
||||
* Use new /dev/loop-control (kernel 3.1) if possible.
|
||||
* Remove hash/hmac restart from crypto backend and make it part of hash/hmac final.
|
||||
* Improve check for invalid offset and size values.
|
||||
* Revert default initialisation of volume key in crypt_init_by_name().
|
||||
* Add more regression tests.
|
||||
* Add some libcryptsetup example files (see docs/examples).
|
||||
@@ -1,25 +0,0 @@
|
||||
Cryptsetup 1.4.1 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.4.0
|
||||
|
||||
* Merge experimental Python cryptsetup (pycryptsetup) binding.
|
||||
|
||||
This option is disabled by default, you can enable build of Python binding
|
||||
with --enable--python configure switch.
|
||||
|
||||
Note that binding currently covers only partial libcryptsetup functions,
|
||||
mainly LUKS device handling needed for Anaconda installer.
|
||||
Until now provided separately as python-cryptsetup.
|
||||
Thanks to Martin Sivak for the code.
|
||||
|
||||
See python subdirectory for more info.
|
||||
|
||||
Python binding code is experimental for now, no stable API guarantee.
|
||||
|
||||
* Fix crypt_get_volume_key_size() for plain device.
|
||||
(cryptsetup status reported zero key size for plain crypt devices).
|
||||
|
||||
* Fix typo in set_iteration_time API call (old name remains for compatibility reasons).
|
||||
|
||||
* Fix FSF address in license and add LGPL license text.
|
||||
@@ -1,44 +0,0 @@
|
||||
Cryptsetup 1.4.2 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.4.1
|
||||
|
||||
* Add --keyfile-offset and --new-keyfile-offset parameters to API and CLI.
|
||||
These options can be used to skip start of keyfile or device used as keyfile.
|
||||
|
||||
* Add repair command and crypt_repair() for known LUKS metadata problems repair.
|
||||
|
||||
Some well-known LUKS metadata corruptions are easy to repair, this
|
||||
command should provide a way to fix these problems.
|
||||
|
||||
Always create binary backup of header device before running repair,
|
||||
(only 4kB - visible header) for example by using dd:
|
||||
dd if=/dev/<LUKS header device> of=repair_bck.img bs=1k count=4
|
||||
|
||||
Then you can try to run repair:
|
||||
cryptsetup repair <device>
|
||||
|
||||
Note, not all problems are possible to repair and if keyslot or some header
|
||||
parameters are overwritten, device is lost permanently.
|
||||
|
||||
* Fix header check to support old (cryptsetup 1.0.0) header alignment.
|
||||
(Regression in 1.4.0)
|
||||
|
||||
* Allow one to specify --align-payload only for luksFormat.
|
||||
|
||||
* Add --master-key-file option to luksOpen (open using volume key).
|
||||
|
||||
* Support UUID=<LUKS_UUID> format for device specification.
|
||||
You can open device by UUID (only shortcut to /dev/disk/by-uuid/ symlinks).
|
||||
|
||||
* Support password verification with quiet flag if possible. (1.2.0)
|
||||
Password verification can be still possible if input is terminal.
|
||||
|
||||
* Fix retry if entered passphrases (with verify option) do not match.
|
||||
(It should retry if requested, not fail.)
|
||||
|
||||
* Fix use of empty keyfile.
|
||||
|
||||
* Fix error message for luksClose and detached LUKS header.
|
||||
|
||||
* Allow --header for status command to get full info with detached header.
|
||||
@@ -1,62 +0,0 @@
|
||||
Cryptsetup 1.4.3 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.4.2
|
||||
|
||||
* Fix readonly activation if underlying device is readonly (1.4.0).
|
||||
|
||||
* Fix loop mapping on readonly file.
|
||||
|
||||
* Include stddef.h in libdevmapper.h (size_t definition).
|
||||
|
||||
* Fix keyslot removal for device with 4k hw block (1.4.0).
|
||||
(Wipe keyslot failed in this case.)
|
||||
|
||||
* Relax --shared flag to allow mapping even for overlapping segments.
|
||||
|
||||
The --shared flag (and API CRYPT_ACTIVATE_SHARED flag) is now able
|
||||
to map arbitrary overlapping area. From API it is even usable
|
||||
for LUKS devices.
|
||||
It is user responsibility to not cause data corruption though.
|
||||
|
||||
This allows e.g. scubed to work again and also allows some
|
||||
tricky extensions later.
|
||||
|
||||
* Allow empty cipher (cipher_null) for testing.
|
||||
|
||||
You can now use "null" (or directly cipher_null-ecb) in cryptsetup.
|
||||
This means no encryption, useful for performance tests
|
||||
(measure dm-crypt layer overhead).
|
||||
|
||||
* Switch on retry on device remove for libdevmapper.
|
||||
Device-mapper now retry removal if device is busy.
|
||||
|
||||
* Allow "private" activation (skip some udev global rules) flag.
|
||||
Cryptsetup library API now allows one to specify CRYPT_ACTIVATE_PRIVATE,
|
||||
which means that some udev rules are not processed.
|
||||
(Used for temporary devices, like internal keyslot mappings where
|
||||
it is not desirable to run any device scans.)
|
||||
|
||||
* This release also includes some Red Hat/Fedora specific extensions
|
||||
related to FIPS140-2 compliance.
|
||||
|
||||
In fact, all these patches are more formal changes and are just subset
|
||||
of building blocks for FIPS certification. See FAQ for more details
|
||||
about FIPS.
|
||||
|
||||
FIPS extensions are enabled by using --enable-fips configure switch.
|
||||
|
||||
In FIPS mode (kernel booted with fips=1 and gcrypt in FIPS mode)
|
||||
|
||||
- it provides library and binary integrity verification using
|
||||
libfipscheck (requires pre-generated checksums)
|
||||
|
||||
- it uses FIPS approved RNG for encryption key and salt generation
|
||||
(note that using /dev/random is not formally FIPS compliant RNG).
|
||||
|
||||
- only gcrypt crypto backend is currently supported in FIPS mode.
|
||||
|
||||
The FIPS RNG requirement for salt comes from NIST SP 800-132 recommendation.
|
||||
(Recommendation for Password-Based Key Derivation. Part 1: Storage Applications.
|
||||
http://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf)
|
||||
LUKS should be aligned to this recommendation otherwise.
|
||||
@@ -1,241 +0,0 @@
|
||||
Cryptsetup 1.5.0 Release Notes
|
||||
==============================
|
||||
|
||||
This release covers mainly inclusion of:
|
||||
|
||||
* Veritysetup tool (and related libcryptsetup extensions for dm-verity).
|
||||
|
||||
* Experimental cryptsetup-reencrypt tool (LUKS offline reencryption).
|
||||
|
||||
Changes since version 1.5.0-rc2
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Add --device-size option for reencryption tool.
|
||||
|
||||
* Switch to use unit suffix for --reduce-device-size option.
|
||||
|
||||
* Remove open device debugging feature (no longer needed).
|
||||
|
||||
* Fix library name for FIPS check.
|
||||
|
||||
* Add example of using reencryption inside dracut (see misc/dracut).
|
||||
|
||||
Changes since version 1.5.0-rc1
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
Introduce cryptsetup-reencrypt - experimental offline LUKS reencryption tool.
|
||||
|
||||
! cryptsetup-reencrypt tool is EXPERIMENTAL
|
||||
! ALWAYS BE SURE YOU HAVE RELIABLE BACKUP BEFORE USING THIS TOOL
|
||||
|
||||
This tool tries to simplify situation when you need to re-encrypt the whole
|
||||
LUKS device in situ (without need to move data elsewhere).
|
||||
|
||||
This can happen for example when you want to change volume (master) key,
|
||||
encryption algorithm, or other encryption parameter.
|
||||
|
||||
Cryptsetup-reencrypt can even optionally shift data on device
|
||||
(reducing data device size - you need some free space at the end of device).
|
||||
|
||||
In general, cryptsetup-reencrypt can be used to
|
||||
|
||||
- re-generate volume key
|
||||
- change arbitrary encryption parameters
|
||||
- add encryption to not yet encrypted drive
|
||||
|
||||
Side effect of reencryption is that final device will contain
|
||||
only ciphertext (for all sectors) so even if device was not properly
|
||||
wiped by random data, after reencryption you cannot distinguish
|
||||
which sectors are used.
|
||||
(Reencryption is done always for the whole device.)
|
||||
|
||||
There are for sure bugs, please TEST IT IN TEST ENVIRONMENT before
|
||||
use for your data.
|
||||
|
||||
This tool is not resistant to HW and kernel failures - hw crash
|
||||
will cause serious data corruption.
|
||||
|
||||
You can enable compilation of this tool with --enable-cryptsetup-reencrypt
|
||||
configure option (it is switched off by default).
|
||||
(Tool requires libcryptsetup 1.4.3 and later.)
|
||||
|
||||
You have to provide all keyslot passphrases or use --keyslot-option
|
||||
(then all other keyslots will be disabled).
|
||||
|
||||
EXAMPLES (from man page)
|
||||
|
||||
Reencrypt /dev/sdb1 (change volume key)
|
||||
# cryptsetup-reencrypt /dev/sdb1
|
||||
|
||||
Reencrypt and also change cipher and cipher mode
|
||||
# cryptsetup-reencrypt /dev/sdb1 -c aes-xts-plain64
|
||||
|
||||
Note: if you are changing key size, there must be enough space
|
||||
for keyslots in header or you have to use --reduce-device size and
|
||||
reduce fs in advance.
|
||||
|
||||
Add LUKS encryption to not yet encrypted device
|
||||
First, be sure you have space added to disk.
|
||||
Or, alternatively, shrink filesystem in advance.
|
||||
|
||||
Here we need 4096 512-bytes sectors (enough for 2x128 bit key).
|
||||
|
||||
# fdisk -u /dev/sdb # move sdb1 partition end + 4096 sectors
|
||||
|
||||
# cryptsetup-reencrypt /dev/sdb1 --new --reduce-device-size 4096
|
||||
|
||||
There are some options which can improve performance (depends on system),
|
||||
namely --use-directio (use direct IO for all operations) can be faster
|
||||
on some systems. See man page.
|
||||
|
||||
Progress and estimated time is printed during reencryption.
|
||||
|
||||
You can suspend reencryption (using ctrl+c or term signal).
|
||||
To continue reencryption you have to provide only
|
||||
the device parameter (offset is stored in temporary log file).
|
||||
|
||||
Please note LUKS device is marked invalid during reencryption and
|
||||
you have to retain tool temporary files until reencryption finishes.
|
||||
|
||||
Temporary files are LUKS-<uuid>.[log|org|new]
|
||||
|
||||
Other changes
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
* Fix luks-header-from-active script (do not use LUKS header on-disk, add UUID).
|
||||
|
||||
* Add --test-passphrase option for luksOpen (check passphrase only).
|
||||
|
||||
* Fix parsing of hexadecimal string (salt or root hash) in veritysetup.
|
||||
|
||||
Changes since version 1.4.3
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
Introduce veritysetup tool for dm-verity target management.
|
||||
|
||||
The dm-verity device-mapper target was added to Linux kernel 3.4 and
|
||||
provides transparent integrity checking of block devices using a cryptographic
|
||||
digest provided by the kernel crypto API. This target is read-only.
|
||||
|
||||
It is meant to be setup as part of a verified boot path (it was originally
|
||||
developed by Chrome OS authors as part of verified boot infrastructure).
|
||||
|
||||
For deeper description please see http://code.google.com/p/cryptsetup/wiki/DMVerity
|
||||
and kernel dm-verity documentation.
|
||||
|
||||
The libcryptsetup library was extended to support manipulation
|
||||
with dm-verity kernel module and new veritysetup CLI tool is added.
|
||||
|
||||
There are no additional library requirements (it uses the same crypto
|
||||
backend as cryptsetup).
|
||||
|
||||
If you want compile cryptsetup without veritysetup tool,
|
||||
use --disable-veritysetup configure option.
|
||||
For other configuration option see configure --help and veritysetup --help
|
||||
(e.g. default parameters).
|
||||
|
||||
Supported libcryptsetup functions new CRYPT_VERITY type:
|
||||
crypt_init
|
||||
crypt_init_by_name
|
||||
crypt_set_data device
|
||||
crypt_get_type
|
||||
crypt_format
|
||||
crypt_load
|
||||
crypt_get_active_device
|
||||
crypt_activate_by_volume_key (volume key == root hash here)
|
||||
crypt_dump
|
||||
and new introduced function
|
||||
crypt_get_verity_info
|
||||
|
||||
Please see comments in libcryptsetup.h and veritysetup.c as an code example
|
||||
how to use CRYPT_VERITY API.
|
||||
|
||||
The veritysetup tool supports these operations:
|
||||
|
||||
veritysetup format <data_device> <hash_device>
|
||||
Formats <hash_device> (calculates all hash areas according to <data_device>).
|
||||
This is initial command to prepare device <hash_device> for later verification.
|
||||
|
||||
veritysetup create <name> <data_device> <hash_device> <root_hash>
|
||||
Creates (activates) a dm-verity mapping with <name> backed by device <data_device>
|
||||
and using <hash_device> for in-kernel verification.
|
||||
|
||||
veritysetup verify <data_device> <hash_device> <root_hash>
|
||||
Verifies data in userspace (no kernel device is activated).
|
||||
|
||||
veritysetup remove <name>
|
||||
Removes activated device from kernel (similar to dmsetup remove).
|
||||
|
||||
veritysetup status <name>
|
||||
Reports status for the active kernel dm-verity device.
|
||||
|
||||
veritysetup dump <hash_device>
|
||||
Reports parameters of verity device from on-disk stored superblock.
|
||||
|
||||
For more info see veritysetup --help and veritysetup man page.
|
||||
|
||||
Other changes
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
* Both data and header device can now be a file and
|
||||
loop device is automatically allocated.
|
||||
|
||||
* Require only up to last keyslot area for header device, previously
|
||||
backup (and activation) required device/file of size up to data start
|
||||
offset (data payload).
|
||||
|
||||
* Fix header backup and restore to work on files with large data offset.
|
||||
Backup and restore now works even if backup file is smaller than data offset.
|
||||
|
||||
Appendix: Examples of veritysetup use
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Format device using default parameters, info and final root hash is printed:
|
||||
# veritysetup format /dev/sdb /dev/sdc
|
||||
VERITY header information for /dev/sdc
|
||||
UUID: fad30431-0c59-4fa6-9b57-732a90501f75
|
||||
Hash type: 1
|
||||
Data blocks: 52224
|
||||
Data block size: 4096
|
||||
Hash block size: 4096
|
||||
Hash algorithm: sha256
|
||||
Salt: 5cc52759af76a092e0c21829cd0ef6938f69831bf86926525106f92a7e9e3aa9
|
||||
Root hash: 7aefa4506f7af497ac491a27f862cf8005ea782a5d97f6426945a6896ab557a1
|
||||
|
||||
Activation of device in-kernel:
|
||||
# veritysetup create vr /dev/sdb /dev/sdc 7aefa4506f7af497ac491a27f862cf8005ea782a5d97f6426945a6896ab557a1
|
||||
Note - if device is corrupted, kernel mapping is created but will report failure:
|
||||
Verity device detected corruption after activation.
|
||||
|
||||
Userspace verification:
|
||||
# veritysetup verify /dev/sdb /dev/sdc 7aefa4506f7af497ac491a27f862cf8005ea782a5d97f6426945a6896ab557a1
|
||||
Verification failed at position 8192.
|
||||
Verification of data area failed.
|
||||
|
||||
Active device status report:
|
||||
# veritysetup status vr
|
||||
/dev/mapper/vr is active.
|
||||
type: VERITY
|
||||
status: verified
|
||||
hash type: 1
|
||||
data block: 4096
|
||||
hash block: 4096
|
||||
hash name: sha256
|
||||
salt: 5cc52759af76a092e0c21829cd0ef6938f69831bf86926525106f92a7e9e3aa9
|
||||
data device: /dev/sdb
|
||||
size: 417792 sectors
|
||||
mode: readonly
|
||||
hash device: /dev/sdc
|
||||
hash offset: 8 sectors
|
||||
|
||||
Dump of on-disk superblock information:
|
||||
# veritysetup dump /dev/sdc
|
||||
VERITY header information for /dev/sdc
|
||||
UUID: fad30431-0c59-4fa6-9b57-732a90501f75
|
||||
Hash type: 1
|
||||
Data blocks: 52224
|
||||
Data block size: 4096
|
||||
Hash block size: 4096
|
||||
Hash algorithm: sha256
|
||||
Salt: 5cc52759af76a092e0c21829cd0ef6938f69831bf86926525106f92a7e9e3aa9
|
||||
|
||||
Remove mapping:
|
||||
# veritysetup remove vr
|
||||
@@ -1,32 +0,0 @@
|
||||
Cryptsetup 1.5.1 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.5.0
|
||||
|
||||
* The libcryptsetup library now tries to initialize device-mapper backend and
|
||||
loop devices only if they are really needed (lazy initializations).
|
||||
This allows some operations to be run by a non-root user.
|
||||
|
||||
(Unfortunately LUKS header keyslot operations still require temporary dm-crypt
|
||||
device and device-mapper subsystem is available only to superuser.)
|
||||
|
||||
Also clear error messages are provided if running as non-root user and
|
||||
operation requires privileged user.
|
||||
|
||||
* Veritysetup can be now used by a normal user for creating hash image to file
|
||||
and also it can create hash image if doesn't exist.
|
||||
(Previously it required pre-allocated space.)
|
||||
|
||||
* Added crypt_keyslot_area() API call which allows external tools
|
||||
to get exact keyslot offsets and analyse content.
|
||||
|
||||
An example of a tool that searches the keyslot area of a LUKS container
|
||||
for positions where entropy is low and hence there is a high probability
|
||||
of damage is in misc/kesylot_checker.
|
||||
(Thanks to Arno Wagner for the code.)
|
||||
|
||||
* Optimized seek to keyfile-offset if key offset is large.
|
||||
|
||||
* Fixed luksHeaderBackup for very old v1.0 unaligned LUKS headers.
|
||||
|
||||
* Various fixes for problems found by a several static analysis tools.
|
||||
@@ -1,261 +0,0 @@
|
||||
Cryptsetup 1.6.0 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.0-rc1
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Change LUKS default cipher to use XTS encryption mode,
|
||||
aes-xts-plain64 (i.e. using AES128-XTS).
|
||||
|
||||
XTS mode becomes standard in hard disk encryption.
|
||||
|
||||
You can still use any old mode:
|
||||
- compile cryptsetup with old default:
|
||||
configure --with-luks1-cipher=aes --with-luks1-mode=cbc-essiv:sha256 --with-luks1-keybits=256
|
||||
- format LUKS device with old default:
|
||||
cryptsetup luksFormat -c aes-cbc-essiv:sha256 -s 256 <device>
|
||||
|
||||
|
||||
* Skip tests and fix error messages if running on old systems (or with old kernel).
|
||||
|
||||
* Rename configure.in to configure.ac and fix issues with new automake and pkgconfig
|
||||
and --disable-kernel_crypto option to allow compilation with old kernel headers.
|
||||
|
||||
* Allow repair of 512 bits key header.
|
||||
|
||||
* Fix status of device if path argument is used and fix double path prefix
|
||||
for non-existent device path.
|
||||
|
||||
|
||||
Changes since version 1.5.1
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Important changes
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Cryptsetup and libcryptsetup is now released under GPLv2+
|
||||
(GPL version 2 or any later).
|
||||
Some internal code handling files (loopaes, verity, tcrypt
|
||||
and crypto backend wrapper) are LGPLv2+.
|
||||
|
||||
Previously code was GPL version 2 only.
|
||||
|
||||
|
||||
* Introducing new unified command open and close.
|
||||
|
||||
Example:
|
||||
cryptsetup open --type plain|luks|loopaes|tcrypt <device> <name>
|
||||
(type defaults to luks)
|
||||
|
||||
with backward-compatible aliases plainOpen, luksOpen, loopaesOpen,
|
||||
tcryptOpen. Basically "open --type xyz" has alias "xyzOpen".
|
||||
|
||||
The "create" command (plain device create) is DEPRECATED but will
|
||||
be still supported.
|
||||
(This command is confusing because of switched arguments order.)
|
||||
|
||||
The close command is generic command to remove mapping and have
|
||||
backward compatible aliases (remove, luksClose, ...) which behaves
|
||||
exactly the same.
|
||||
|
||||
While all old syntax is still supported, I strongly suggest to use
|
||||
new command syntax which is common for all device types (and possible
|
||||
new formats added in future).
|
||||
|
||||
|
||||
* cryptsetup now support directly TCRYPT (TrueCrypt and compatible tc-play)
|
||||
on-disk format
|
||||
(Code is independent implementation not related to original project).
|
||||
|
||||
Only dump (tcryptDump command) and activation (open --type tcrypt or tcryptOpen)
|
||||
of TCRYPT device are supported. No header changes are supported.
|
||||
|
||||
It is intended to easily access containers shared with other operating systems
|
||||
without need to install 3rd party software. For native Linux installations LUKS
|
||||
is the preferred format.
|
||||
|
||||
WARNING: TCRYPT extension requires kernel userspace crypto API to be
|
||||
available (introduced in Linux kernel 2.6.38).
|
||||
If you are configuring kernel yourself, enable "User-space interface
|
||||
for symmetric key cipher algorithms" in "Cryptographic API" section
|
||||
(CRYPTO_USER_API_SKCIPHER .config option).
|
||||
|
||||
Because TCRYPT header is encrypted, you have to always provide valid
|
||||
passphrase and keyfiles. Keyfiles are handled exactly the same as in original
|
||||
format (basically, first 1MB of every keyfile is mixed using CRC32 into pool).
|
||||
|
||||
Cryptsetup should recognize all TCRYPT header variants ever released, except
|
||||
legacy cipher chains using LRW encryption mode with 64 bits encryption block
|
||||
(namely Blowfish in LRW mode is not recognized, this is limitation of kernel
|
||||
crypto API).
|
||||
|
||||
Device activation is supported only for LRW/XTS modes (again, limitation
|
||||
of kernel dmcrypt which do not implements TCRYPT extensions to CBC mode).
|
||||
(So old containers cannot be activated, but you can use libcryptsetup
|
||||
for lost password search, example of such code is included in misc directory.)
|
||||
|
||||
Hidden header are supported using --tcrypt-hidden option, system encryption
|
||||
using --tcrypt-system option.
|
||||
|
||||
For detailed description see man page.
|
||||
|
||||
EXAMPLE:
|
||||
* Dump device parameters of container in file:
|
||||
|
||||
# cryptsetup tcryptDump tst
|
||||
Enter passphrase:
|
||||
|
||||
TCRYPT header information for tst
|
||||
Version: 5
|
||||
Driver req.: 7
|
||||
Sector size: 512
|
||||
MK offset: 131072
|
||||
PBKDF2 hash: sha512
|
||||
Cipher chain: serpent-twofish-aes
|
||||
Cipher mode: xts-plain64
|
||||
MK bits: 1536
|
||||
|
||||
You can also dump master key using --dump-master-key.
|
||||
Dump does not require superuser privilege.
|
||||
|
||||
* Activation of this container
|
||||
|
||||
# cryptsetup tcryptOpen tst tcrypt_dev
|
||||
Enter passphrase:
|
||||
(Chain of dmcrypt devices is activated as /dev/mapper/tcrypt_dev.)
|
||||
|
||||
* See status of active TCRYPT device
|
||||
|
||||
# cryptsetup status tcrypt_dev
|
||||
|
||||
/dev/mapper/tcrypt_dev is active.
|
||||
type: TCRYPT
|
||||
cipher: serpent-twofish-aes-xts-plain64
|
||||
keysize: 1536 bits
|
||||
device: /dev/loop0
|
||||
loop: /tmp/tst
|
||||
offset: 256 sectors
|
||||
size: 65024 sectors
|
||||
skipped: 256 sectors
|
||||
mode: read/write
|
||||
|
||||
* And plaintext filesystem now ready to mount
|
||||
|
||||
# blkid /dev/mapper/tcrypt_dev
|
||||
/dev/mapper/tcrypt_dev: SEC_TYPE="msdos" UUID="9F33-2954" TYPE="vfat"
|
||||
|
||||
|
||||
* Add (optional) support for lipwquality for new LUKS passwords.
|
||||
|
||||
If password is entered through terminal (no keyfile specified)
|
||||
and cryptsetup is compiled with --enable-pwquality, default
|
||||
system pwquality settings are used to check password quality.
|
||||
|
||||
You can always override this check by using new --force-password option.
|
||||
|
||||
For more info about pwquality project see http://libpwquality.fedorahosted.org/
|
||||
|
||||
|
||||
* Proper handle interrupt signals (ctrl+c and TERM signal) in tools
|
||||
|
||||
Code should now handle interrupt properly, release and explicitly wipe
|
||||
in-memory key materials on interrupt.
|
||||
(Direct users of libcryptsetup should always call crypt_free() when
|
||||
code is interrupted to wipe all resources. There is no signal handling
|
||||
in library, it is up to the tool using it.)
|
||||
|
||||
|
||||
* Add new benchmark command
|
||||
|
||||
The "benchmark" command now tries to benchmark PBKDF2 and some block
|
||||
cipher variants. You can specify you own parameters (--cipher/--key-size
|
||||
for block ciphers, --hash for PBKDF2).
|
||||
|
||||
See man page for detailed description.
|
||||
|
||||
WARNING: benchmark command requires kernel userspace crypto API to be
|
||||
available (introduced in Linux kernel 2.6.38).
|
||||
If you are configuring kernel yourself, enable "User-space interface
|
||||
for symmetric key cipher algorithms" in "Cryptographic API" section
|
||||
(CRYPTO_USER_API_SKCIPHER .config option).
|
||||
|
||||
EXAMPLE:
|
||||
# cryptsetup benchmark
|
||||
# Tests are approximate using memory only (no storage IO).
|
||||
PBKDF2-sha1 111077 iterations per second
|
||||
PBKDF2-sha256 53718 iterations per second
|
||||
PBKDF2-sha512 18832 iterations per second
|
||||
PBKDF2-ripemd160 89775 iterations per second
|
||||
PBKDF2-whirlpool 23918 iterations per second
|
||||
# Algorithm | Key | Encryption | Decryption
|
||||
aes-cbc 128b 212.0 MiB/s 428.0 MiB/s
|
||||
serpent-cbc 128b 23.1 MiB/s 66.0 MiB/s
|
||||
twofish-cbc 128b 46.1 MiB/s 50.5 MiB/s
|
||||
aes-cbc 256b 163.0 MiB/s 350.0 MiB/s
|
||||
serpent-cbc 256b 23.1 MiB/s 66.0 MiB/s
|
||||
twofish-cbc 256b 47.0 MiB/s 50.0 MiB/s
|
||||
aes-xts 256b 190.0 MiB/s 190.0 MiB/s
|
||||
serpent-xts 256b 58.4 MiB/s 58.0 MiB/s
|
||||
twofish-xts 256b 49.0 MiB/s 49.5 MiB/s
|
||||
aes-xts 512b 175.0 MiB/s 175.0 MiB/s
|
||||
serpent-xts 512b 59.0 MiB/s 58.0 MiB/s
|
||||
twofish-xts 512b 48.5 MiB/s 49.5 MiB/s
|
||||
|
||||
Or you can specify cipher yourself:
|
||||
# cryptsetup benchmark --cipher cast5-cbc-essiv:sha256 -s 128
|
||||
# Tests are approximate using memory only (no storage IO).
|
||||
# Algorithm | Key | Encryption | Decryption
|
||||
cast5-cbc 128b 32.4 MiB/s 35.0 MiB/s
|
||||
|
||||
WARNING: these tests do not use dmcrypt, only crypto API.
|
||||
You have to benchmark the whole device stack and you can get completely
|
||||
different results. But it is usable for basic comparison.
|
||||
(Note for example AES-NI decryption optimization effect in example above.)
|
||||
|
||||
Features
|
||||
~~~~~~~~
|
||||
|
||||
* Do not maintain ChangeLog file anymore, see git log for detailed changes,
|
||||
e.g. here http://code.google.com/p/cryptsetup/source/list
|
||||
|
||||
* Move change key into library, add crypt_keyslot_change_by_passphrase().
|
||||
This change is useful mainly in FIPS mode, where we cannot
|
||||
extract volume key directly from libcryptsetup.
|
||||
|
||||
* Add verbose messages during reencryption.
|
||||
|
||||
* Default LUKS PBKDF2 iteration time is now configurable.
|
||||
|
||||
* Add simple cipher benchmarking API.
|
||||
|
||||
* Add kernel skcipher backend.
|
||||
|
||||
* Add CRC32 implementation (for TCRYPT).
|
||||
|
||||
* Move PBKDF2 into crypto backend wrapper.
|
||||
This allows use it in other formats, use library implementations and
|
||||
also possible use of different KDF function in future.
|
||||
|
||||
* New PBKDF2 benchmark using getrusage().
|
||||
|
||||
Fixes
|
||||
~~~~~
|
||||
|
||||
* Avoid O_DIRECT open if underlying storage doesn't support it.
|
||||
|
||||
* Fix some non-translated messages.
|
||||
|
||||
* Fix regression in header backup (1.5.1) with container in file.
|
||||
|
||||
* Fix blockwise read/write for end writes near end of device.
|
||||
(was not used in previous versions)
|
||||
|
||||
* Ignore setpriority failure.
|
||||
|
||||
* Code changes to fix/ignore problems found by Coverity static analysis, including
|
||||
- Get page size should never fail.
|
||||
- Fix time of check/use (TOCTOU test) in tools
|
||||
- Fix time of check/use in loop/wipe utils.
|
||||
- Fix time of check/use in device utils.
|
||||
|
||||
* Disallow header restore if context is non-LUKS device.
|
||||
@@ -1,32 +0,0 @@
|
||||
Cryptsetup 1.6.1 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.0
|
||||
|
||||
* Fix loop-AES keyfile parsing.
|
||||
Loop-AES keyfile should be text keyfile, reject keyfiles which
|
||||
are not properly terminated.
|
||||
|
||||
* Fix passphrase pool overflow for too long TCRYPT passphrase.
|
||||
(Maximal TCRYPT passphrase length is 64 characters.)
|
||||
|
||||
* Return EPERM (translated to exit code 2) for too long TCRYPT passphrase.
|
||||
|
||||
* Fix deactivation of device when failed underlying node disappeared.
|
||||
|
||||
* Fix API deactivate call for TCRYPT format and NULL context parameter.
|
||||
|
||||
* Improve keyslot checker example documentation.
|
||||
|
||||
* Report error message if deactivation fails and device is still busy.
|
||||
|
||||
* Make passphrase prompts more consistent (and remove "LUKS" form prompt).
|
||||
|
||||
* Fix some missing headers (compilation failed with alternative libc).
|
||||
|
||||
* Remove not functional API UUID support for plain & loopaes devices.
|
||||
(not persistent activation UUID).
|
||||
|
||||
* Properly cleanup devices on interrupt in api-test.
|
||||
|
||||
* Support all tests run if kernel is in FIPS mode.
|
||||
@@ -1,25 +0,0 @@
|
||||
Cryptsetup 1.6.2 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.1
|
||||
|
||||
* Print error and fail if more device arguments are present for isLuks command.
|
||||
|
||||
* Fix cipher specification string parsing (found by gcc -fsanitize=address option).
|
||||
|
||||
* Try to map TCRYPT system encryption through partition
|
||||
(allows one to activate mapping when other partition on the same device is mounted).
|
||||
|
||||
* Print a warning if system encryption is used and device is a partition.
|
||||
(TCRYPT system encryption uses whole device argument.)
|
||||
|
||||
* Disallow explicit small payload offset for LUKS detached header.
|
||||
LUKS detached header only allows data payload 0 (whole data device is used)
|
||||
or explicit offset larger than header + keyslots size.
|
||||
|
||||
* Fix boundary condition for verity device that caused failure for certain device sizes.
|
||||
|
||||
* Various fixes to documentation, including update FAQ, default modes
|
||||
and TCRYPT description.
|
||||
|
||||
* Workaround for some recent changes in automake (serial-tests).
|
||||
@@ -1,50 +0,0 @@
|
||||
Cryptsetup 1.6.3 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.2
|
||||
|
||||
* Fix cryptsetup reencryption tool to work properly
|
||||
with devices using 4kB sectors.
|
||||
|
||||
* Always use page size if running through loop device,
|
||||
this fixes failures for external LUKS header and
|
||||
filesystem requiring 4kB block size.
|
||||
|
||||
* Fix TCRYPT system encryption mapping for multiple partitions.
|
||||
Since this commit, one can use partition directly as device parameter.
|
||||
If you need to activate such partition from image in file,
|
||||
please first use map partitioned loop device (losetup -P)
|
||||
on image.
|
||||
(Cryptsetup require partition offsets visible in kernel sysfs
|
||||
in this mode.)
|
||||
|
||||
* Support activation of old TrueCrypt containers using CBC mode
|
||||
and whitening (created in TrueCrypt version < 4.1).
|
||||
This requires Linux kernel 3.13 or later.
|
||||
(Containers with cascade CBC ciphers are not supported.)
|
||||
|
||||
* Properly display keys in dump --dump-master-key command
|
||||
for TrueCrypt CBC containers.
|
||||
|
||||
* Rewrite cipher benchmark loop which was unreliable
|
||||
on very fast machines.
|
||||
|
||||
* Add warning if LUKS device was activated using non-cryptsetup
|
||||
library which did not set UUID properly (e.g. cryptmount).
|
||||
(Some commands, like luksSuspend, are not available then.)
|
||||
|
||||
* Support length limitation also for plain (no hash) length.
|
||||
This can be used for mapping problematic cryptosystems which
|
||||
wipes some key (losetup sometimes set last 32 byte to zero,
|
||||
which can be now configured as --hash plain:31 parameter).
|
||||
|
||||
* Fix hash limit if parameter is not a number.
|
||||
(The whole key was set to zero instead of command failure.)
|
||||
|
||||
* Unify --key-slot behavior in cryptsetup_reencrypt tool.
|
||||
|
||||
* Update dracut example scripts for system reencryption on first boot.
|
||||
|
||||
* Add command line option --tcrypt-backup to access TCRYPT backup header.
|
||||
|
||||
* Fix static compilation with OpenSSL.
|
||||
@@ -1,57 +0,0 @@
|
||||
Cryptsetup 1.6.4 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.3
|
||||
|
||||
* Implement new erase (with alias luksErase) command.
|
||||
|
||||
The erase cryptsetup command can be used to permanently erase
|
||||
all keyslots and make the LUKS container inaccessible.
|
||||
(The only way to unlock such device is to use LUKS header backup
|
||||
created before erase command was used.)
|
||||
|
||||
You do not need to provide any password for this operation.
|
||||
|
||||
This operation is irreversible.
|
||||
|
||||
* Add internal "whirlpool_gcryptbug hash" for accessing flawed
|
||||
Whirlpool hash in gcrypt (requires gcrypt 1.6.1 or above).
|
||||
|
||||
The gcrypt version of Whirlpool hash algorithm was flawed in some
|
||||
situations.
|
||||
|
||||
This means that if you used Whirlpool in LUKS header and upgraded
|
||||
to new gcrypt library your LUKS container become inaccessible.
|
||||
|
||||
Please refer to cryptsetup FAQ for detail how to fix this situation.
|
||||
|
||||
* Allow one to use --disable-gcrypt-pbkdf2 during configuration
|
||||
to force use internal PBKDF2 code.
|
||||
|
||||
* Require gcrypt 1.6.1 for imported implementation of PBKDF2
|
||||
(PBKDF2 in gcrypt 1.6.0 is too slow).
|
||||
|
||||
* Add --keep-key to cryptsetup-reencrypt.
|
||||
|
||||
This allows change of LUKS header hash (and iteration count) without
|
||||
the need to reencrypt the whole data area.
|
||||
(Reencryption of LUKS header only without master key change.)
|
||||
|
||||
* By default verify new passphrase in luksChangeKey and luksAddKey
|
||||
commands (if input is from terminal).
|
||||
|
||||
* Fix memory leak in Nettle crypto backend.
|
||||
|
||||
* Support --tries option even for TCRYPT devices in cryptsetup.
|
||||
|
||||
* Support --allow-discards option even for TCRYPT devices.
|
||||
(Note that this could destroy hidden volume and it is not suggested
|
||||
by original TrueCrypt security model.)
|
||||
|
||||
* Link against -lrt for clock_gettime to fix undefined reference
|
||||
to clock_gettime error (introduced in 1.6.2).
|
||||
|
||||
* Fix misleading error message when some algorithms are not available.
|
||||
|
||||
* Count system time in PBKDF2 benchmark if kernel returns no self usage info.
|
||||
(Workaround to broken getrusage() syscall with some hypervisors.)
|
||||
@@ -1,54 +0,0 @@
|
||||
Cryptsetup 1.6.5 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.4
|
||||
|
||||
* Allow LUKS header operation handling without requiring root privilege.
|
||||
It means that you can manipulate with keyslots as a regular user, only
|
||||
write access to device (or image) is required.
|
||||
|
||||
This requires kernel crypto wrapper (similar to TrueCrypt device handling)
|
||||
to be available (CRYPTO_USER_API_SKCIPHER kernel option).
|
||||
If this kernel interface is not available, code fallbacks to old temporary
|
||||
keyslot device creation (where root privilege is required).
|
||||
|
||||
Note that activation, deactivation, resize and suspend operations still
|
||||
need root privilege (limitation of kernel device-mapper backend).
|
||||
|
||||
* Fix internal PBKDF2 key derivation function implementation for alternative
|
||||
crypto backends (kernel, NSS) which do not support PBKDF2 directly and have
|
||||
issues with longer HMAC keys.
|
||||
|
||||
This fixes the problem for long keyfiles where either calculation is too slow
|
||||
(because of internal rehashing in every iteration) or there is a limit
|
||||
(kernel backend seems to not support HMAC key longer than 20480 bytes).
|
||||
|
||||
(Note that for recent version of gcrypt, nettle or openssl the internal
|
||||
PBKDF2 code is not compiled in and crypto library internal functions are
|
||||
used instead.)
|
||||
|
||||
* Support for Python3 for simple Python binding.
|
||||
Python >= 2.6 is now required. You can set Python compiled version by setting
|
||||
--with-python_version configure option (together with --enable-python).
|
||||
|
||||
* Use internal PBKDF2 in Nettle library for Nettle crypto backend.
|
||||
Cryptsetup compilation requires Nettle >= 2.6 (if using Nettle crypto backend).
|
||||
|
||||
* Allow simple status of crypt device without providing metadata header.
|
||||
The command "cryptsetup status" will print basic info, even if you
|
||||
do not provide detached header argument.
|
||||
|
||||
* Allow one to specify ECB mode in cryptsetup benchmark.
|
||||
|
||||
* Add some LUKS images for regression testing.
|
||||
Note that if image with Whirlpool fails, the most probable cause is that
|
||||
you have old gcrypt library with flawed whirlpool hash.
|
||||
Read FAQ section 8.3 for more info.
|
||||
|
||||
Cryptsetup API NOTE:
|
||||
The direct terminal handling for passphrase entry will be removed from
|
||||
libcryptsetup in next major version (application should handle it itself).
|
||||
|
||||
It means that you have to always either provide password in buffer or set
|
||||
your own password callback function trhough crypt_set_password_callback().
|
||||
See API documentation (or libcryptsetup.h) for more info.
|
||||
@@ -1,29 +0,0 @@
|
||||
Cryptsetup 1.6.6 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.5
|
||||
|
||||
* LUKS: Fix keyslot device access for devices which
|
||||
do not support direct IO operations. (Regression in 1.6.5.)
|
||||
|
||||
* LUKS: Fallback to old temporary keyslot device mapping method
|
||||
if hash (for ESSIV) is not supported by userspace crypto
|
||||
library. (Regression in 1.6.5.)
|
||||
|
||||
* Properly activate device with discard (TRIM for SSDs)
|
||||
if requested even if dm_crypt module is not yet loaded.
|
||||
Only if discard is not supported by the old kernel then
|
||||
the discard option is ignored.
|
||||
|
||||
* Fix some static analysis build warnings (scan-build).
|
||||
|
||||
* Report crypto lib version only once (and always add kernel
|
||||
version) in debug output.
|
||||
|
||||
Cryptsetup API NOTE:
|
||||
The direct terminal handling for passphrase entry will be removed from
|
||||
libcryptsetup in next major version (application should handle it itself).
|
||||
|
||||
It means that you have to always either provide password in buffer or set
|
||||
your own password callback function through crypt_set_password_callback().
|
||||
See API documentation (or libcryptsetup.h) for more info.
|
||||
@@ -1,84 +0,0 @@
|
||||
Cryptsetup 1.6.7 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.6
|
||||
|
||||
* Cryptsetup git and wiki are now hosted on GitLab.
|
||||
https://gitlab.com/cryptsetup/cryptsetup
|
||||
|
||||
Repository of stable releases remains on kernel.org site
|
||||
https://www.kernel.org/pub/linux/utils/cryptsetup/
|
||||
|
||||
For more info please see README file.
|
||||
|
||||
* Cryptsetup TCRYPT mode now supports VeraCrypt devices (TrueCrypt extension).
|
||||
|
||||
The VeraCrypt extension only increases iteration count for the key
|
||||
derivation function (on-disk format is the same as TrueCrypt format).
|
||||
|
||||
Note that unlocking of a VeraCrypt device can take very long time if used
|
||||
on slow machines.
|
||||
|
||||
To use this extension, add --veracrypt option, for example
|
||||
cryptsetup open --type tcrypt --veracrypt <container> <name>
|
||||
|
||||
For use through libcryptsetup, just add CRYPT_TCRYPT_VERA_MODES flag.
|
||||
|
||||
* Support keyfile-offset and keyfile-size options even for plain volumes.
|
||||
|
||||
* Support keyfile option for luksAddKey if the master key is specified.
|
||||
|
||||
* For historic reasons, hashing in the plain mode is not used
|
||||
if keyfile is specified (with exception of --key-file=-).
|
||||
Print a warning if these parameters are ignored.
|
||||
|
||||
* Support permanent device decryption for cryptsetup-reencrypt.
|
||||
To remove LUKS encryption from a device, you can now use --decrypt option.
|
||||
|
||||
* Allow one to use --header option in all LUKS commands.
|
||||
The --header always takes precedence over positional device argument.
|
||||
|
||||
* Allow luksSuspend without need to specify a detached header.
|
||||
|
||||
* Detect if O_DIRECT is usable on a device allocation.
|
||||
There are some strange storage stack configurations which wrongly allows
|
||||
one to open devices with direct-io but fails on all IO operations later.
|
||||
|
||||
Cryptsetup now tries to read the device first sector to ensure it can use
|
||||
direct-io.
|
||||
|
||||
* Add low-level performance options tuning for dmcrypt (for Linux 4.0 and later).
|
||||
|
||||
Linux kernel 4.0 contains rewritten dmcrypt code which tries to better utilize
|
||||
encryption on parallel CPU cores.
|
||||
|
||||
While tests show that this change increases performance on most configurations,
|
||||
dmcrypt now provides some switches to change its new behavior.
|
||||
|
||||
You can use them (per-device) with these cryptsetup switches:
|
||||
--perf-same_cpu_crypt
|
||||
--perf-submit_from_crypt_cpus
|
||||
|
||||
Please use these only in the case of serious performance problems.
|
||||
Refer to the cryptsetup man page and dm-crypt documentation
|
||||
(for same_cpu_crypt and submit_from_crypt_cpus options).
|
||||
https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt
|
||||
|
||||
* Get rid of libfipscheck library.
|
||||
(Note that this option was used only for Red Hat and derived distributions.)
|
||||
With recent FIPS changes we do not need to link to this FIPS monster anymore.
|
||||
Also drop some no longer needed FIPS mode checks.
|
||||
|
||||
* Many fixes and clarifications to man pages.
|
||||
|
||||
* Prevent compiler to optimize-out zeroing of buffers for on-stack variables.
|
||||
|
||||
* Fix a crash if non-GNU strerror_r is used.
|
||||
|
||||
Cryptsetup API NOTE:
|
||||
The direct terminal handling for passphrase entry will be removed from
|
||||
libcryptsetup in next major version (application should handle it itself).
|
||||
|
||||
It means that you have to always either provide password in buffer or set
|
||||
your own password callback function through crypt_set_password_callback().
|
||||
See API documentation (or libcryptsetup.h) for more info.
|
||||
@@ -1,47 +0,0 @@
|
||||
Cryptsetup 1.6.8 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.7
|
||||
|
||||
* If the null cipher (no encryption) is used, allow only empty password for LUKS.
|
||||
(Previously cryptsetup accepted any password in this case.)
|
||||
|
||||
The null cipher can be used only for testing and it is used temporarily during
|
||||
offline encrypting not yet encrypted device (cryptsetup-reencrypt tool).
|
||||
|
||||
Accepting only empty password prevents situation when someone adds another
|
||||
LUKS device using the same UUID (UUID of existing LUKS device) with faked
|
||||
header containing null cipher.
|
||||
This could force user to use different LUKS device (with no encryption)
|
||||
without noticing.
|
||||
(IOW it prevents situation when attacker intentionally forces
|
||||
user to boot into different system just by LUKS header manipulation.)
|
||||
|
||||
Properly configured systems should have an additional integrity protection
|
||||
in place here (LUKS here provides only confidentiality) but it is better
|
||||
to not allow this situation in the first place.
|
||||
|
||||
(For more info see QubesOS Security Bulletin QSB-019-2015.)
|
||||
|
||||
* Properly support stdin "-" handling for luksAddKey for both new and old
|
||||
keyfile parameters.
|
||||
|
||||
* If encrypted device is file-backed (it uses underlying loop device),
|
||||
cryptsetup resize will try to resize underlying loop device as well.
|
||||
(It can be used to grow up file-backed device in one step.)
|
||||
|
||||
* Cryptsetup now allows one to use empty password through stdin pipe.
|
||||
(Intended only for testing in scripts.)
|
||||
|
||||
Cryptsetup API NOTE:
|
||||
|
||||
Direct terminal handling and password calling callback for passphrase
|
||||
entry will be removed from libcryptsetup in next major (2.x) version
|
||||
(application should handle it itself).
|
||||
It means that application have to always provide password in API calls.
|
||||
|
||||
Functions returning last error will be removed in next major version (2.x).
|
||||
These functions did not work properly for early initialization errors
|
||||
and application can implement better function easily using own error callback.
|
||||
|
||||
See comments in libcryptsetup.h for more info about deprecated functions.
|
||||
@@ -1,81 +0,0 @@
|
||||
Cryptsetup 1.7.0 Release Notes
|
||||
==============================
|
||||
|
||||
The cryptsetup 1.7 release changes defaults for LUKS,
|
||||
there are no API changes.
|
||||
|
||||
Changes since version 1.6.8
|
||||
|
||||
* Default hash function is now SHA256 (used in key derivation function
|
||||
and anti-forensic splitter).
|
||||
|
||||
Note that replacing SHA1 with SHA256 is not for security reasons.
|
||||
(LUKS does not have problems even if collisions are found for SHA1,
|
||||
for details see FAQ item 5.20).
|
||||
|
||||
Using SHA256 as default is mainly to prevent compatibility problems
|
||||
on hardened systems where SHA1 is already be phased out.
|
||||
|
||||
Note that all checks (kernel crypto API availability check) now uses
|
||||
SHA256 as well.
|
||||
|
||||
* Default iteration time for PBKDF2 is now 2 seconds.
|
||||
|
||||
Increasing iteration time is in combination with PBKDF2 benchmark
|
||||
fixes a try to keep PBKDF2 iteration count still high enough and
|
||||
also still acceptable for users.
|
||||
|
||||
N.B. Long term is to replace PBKDF2 algorithm with Password Hashing
|
||||
Competition winner - Argon2.
|
||||
|
||||
Distributions can still change these defaults in compilation time.
|
||||
|
||||
You can change iteration time and used hash function in existing LUKS
|
||||
header with cryptsetup-reencrypt utility even without full reencryption
|
||||
of device (see --keep-key option).
|
||||
|
||||
* Fix PBKDF2 iteration benchmark for longer key sizes.
|
||||
|
||||
The previous PBKDF2 benchmark code did not take into account
|
||||
output key length properly.
|
||||
|
||||
For SHA1 (with 160-bits output) and 256-bit keys (and longer)
|
||||
it means that the final iteration value was higher than it should be.
|
||||
|
||||
For other hash algorithms (like SHA256 or SHA512) it caused
|
||||
that iteration count was lower (in comparison to SHA1) than
|
||||
expected for the requested time period.
|
||||
|
||||
The PBKDF2 benchmark code is now fixed to use the key size for
|
||||
the formatted device (or default LUKS key size if running in informational
|
||||
benchmark mode).
|
||||
|
||||
Thanks to A.Visconti, S.Bossi, A.Calo and H.Ragab
|
||||
(http://www.club.di.unimi.it/) for point this out.
|
||||
(Based on "What users should know about Full Disk Encryption
|
||||
based on LUKS" paper to be presented on CANS2015).
|
||||
|
||||
* Remove experimental warning for reencrypt tool.
|
||||
The strong request for full backup before using reencryption utility
|
||||
still applies :)
|
||||
|
||||
* Add optional libpasswdqc support for new LUKS passwords.
|
||||
|
||||
If password is entered through terminal (no keyfile specified) and
|
||||
cryptsetup is compiled with --enable-passwdqc[=/etc/passwdqc.conf],
|
||||
configured system passwdqc settings are used to check password quality.
|
||||
|
||||
* Update FAQ document.
|
||||
|
||||
Cryptsetup API NOTE:
|
||||
|
||||
Direct terminal handling and password calling callback for passphrase
|
||||
entry will be removed from libcryptsetup in next major (2.x) version
|
||||
(application should handle it itself).
|
||||
It means that application have to always provide password in API calls.
|
||||
|
||||
Functions returning last error will be removed in next major version (2.x).
|
||||
These functions did not work properly for early initialization errors
|
||||
and application can implement better function easily using own error callback.
|
||||
|
||||
See comments in libcryptsetup.h for more info about deprecated functions.
|
||||
@@ -1,36 +0,0 @@
|
||||
Cryptsetup 1.7.1 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.7.0
|
||||
|
||||
* Code now uses kernel crypto API backend according to new
|
||||
changes introduced in mainline kernel
|
||||
|
||||
While mainline kernel should contain backward compatible
|
||||
changes, some stable series kernels do not contain fully
|
||||
backported compatibility patches.
|
||||
Without these patches most of cryptsetup operations
|
||||
(like unlocking device) fail.
|
||||
|
||||
This change in cryptsetup ensures that all operations using
|
||||
kernel crypto API works even on these kernels.
|
||||
|
||||
* The cryptsetup-reencrypt utility now properly detects removal
|
||||
of underlying link to block device and does not remove
|
||||
ongoing re-encryption log.
|
||||
This allows proper recovery (resume) of reencrypt operation later.
|
||||
|
||||
NOTE: Never use /dev/disk/by-uuid/ path for reencryption utility,
|
||||
this link disappears once the device metadata is temporarily
|
||||
removed from device.
|
||||
|
||||
* Cryptsetup now allows special "-" (standard input) keyfile handling
|
||||
even for TCRYPT (TrueCrypt and VeraCrypt compatible) devices.
|
||||
|
||||
* Cryptsetup now fails if there are more keyfiles specified
|
||||
for non-TCRYPT device.
|
||||
|
||||
* The luksKillSlot command now does not suppress provided password
|
||||
in batch mode (if password is wrong slot is not destroyed).
|
||||
Note that not providing password in batch mode means that keyslot
|
||||
is destroyed unconditionally.
|
||||
@@ -1,37 +0,0 @@
|
||||
Cryptsetup 1.7.2 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.7.1
|
||||
|
||||
* Update LUKS documentation format.
|
||||
Clarify fixed sector size and keyslots alignment.
|
||||
|
||||
* Support activation options for error handling modes in Linux kernel
|
||||
dm-verity module:
|
||||
|
||||
--ignore-corruption - dm-verity just logs detected corruption
|
||||
|
||||
--restart-on-corruption - dm-verity restarts the kernel if corruption is detected
|
||||
|
||||
If the options above are not specified, default behavior for dm-verity remains.
|
||||
Default is that I/O operation fails with I/O error if corrupted block is detected.
|
||||
|
||||
--ignore-zero-blocks - Instructs dm-verity to not verify blocks that are expected
|
||||
to contain zeroes and always return zeroes directly instead.
|
||||
|
||||
NOTE that these options could have security or functional impacts,
|
||||
do not use them without assessing the risks!
|
||||
|
||||
* Fix help text for cipher benchmark specification (mention --cipher option).
|
||||
|
||||
* Fix off-by-one error in maximum keyfile size.
|
||||
Allow keyfiles up to compiled-in default and not that value minus one.
|
||||
|
||||
* Support resume of interrupted decryption in cryptsetup-reencrypt utility.
|
||||
To resume decryption, LUKS device UUID (--uuid option) option must be used.
|
||||
|
||||
* Do not use direct-io for LUKS header with unaligned keyslots.
|
||||
Such headers were used only by the first cryptsetup-luks-1.0.0 release (2005).
|
||||
|
||||
* Fix device block size detection to properly work on particular file-based
|
||||
containers over underlying devices with 4k sectors.
|
||||
@@ -1,20 +0,0 @@
|
||||
Cryptsetup 1.7.3 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.7.2
|
||||
|
||||
* Fix device access to hash offsets located beyond the 2GB device boundary in veritysetup.
|
||||
|
||||
* Set configured (compile-time) default iteration time for devices created directly through
|
||||
libcryptsetup (default was hardcoded 1 second, the configured value applied only
|
||||
for cryptsetup application).
|
||||
|
||||
* Fix PBKDF2 benchmark to not double iteration count for specific corner case.
|
||||
If the measurement function returns exactly 500 ms, the iteration calculation loop
|
||||
doubled iteration count but instead of repeating measurement it used this value directly.
|
||||
|
||||
* OpenSSL backend: fix memory leak if hash context was repeatedly reused.
|
||||
|
||||
* OpenSSL backend: add support for OpenSSL 1.1.0.
|
||||
|
||||
* Fix several minor spelling errors.
|
||||
@@ -1,22 +0,0 @@
|
||||
Cryptsetup 1.7.4 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.7.3
|
||||
|
||||
* Allow one to specify LUKS1 hash algorithm in Python luksFormat wrapper.
|
||||
|
||||
* Use LUKS1 compiled-in defaults also in Python wrapper.
|
||||
|
||||
* OpenSSL backend: Fix OpenSSL 1.1.0 support without backward compatible API.
|
||||
|
||||
* OpenSSL backend: Fix LibreSSL compatibility.
|
||||
|
||||
* Check for data device and hash device area overlap in veritysetup.
|
||||
|
||||
* Fix a possible race while allocating a free loop device.
|
||||
|
||||
* Fix possible file descriptor leaks if libcryptsetup is run from a forked process.
|
||||
|
||||
* Fix missing same_cpu_crypt flag in status command.
|
||||
|
||||
* Various updates to FAQ and man pages.
|
||||
@@ -1,22 +0,0 @@
|
||||
Cryptsetup 1.7.5 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.7.4
|
||||
|
||||
* Fixes to luksFormat to properly support recent kernel running in FIPS mode.
|
||||
|
||||
Cryptsetup must never use a weak key even if it is just used for testing
|
||||
of algorithm availability. In FIPS mode, weak keys are always rejected.
|
||||
|
||||
A weak key is for example detected if the XTS encryption mode use
|
||||
the same key for the tweak and the encryption part.
|
||||
|
||||
* Fixes accesses to unaligned hidden legacy TrueCrypt header.
|
||||
|
||||
On a native 4k-sector device the old hidden TrueCrypt header is not
|
||||
aligned with the hw sector size (this problem was fixed in later TrueCrypt
|
||||
on-disk format versions).
|
||||
|
||||
Cryptsetup now properly aligns the read so it does not fail.
|
||||
|
||||
* Fixes to optional dracut ramdisk scripts for offline re-encryption on initial boot.
|
||||
@@ -1,605 +0,0 @@
|
||||
Cryptsetup 2.0.0 Release Notes
|
||||
==============================
|
||||
Stable release with experimental features.
|
||||
|
||||
This version introduces a new on-disk LUKS2 format.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported
|
||||
forever as well as a traditional and fully backward compatible format.
|
||||
|
||||
NOTE: This version changes soname of libcryptsetup library and increases
|
||||
major version for all public symbols.
|
||||
Most of the old functions are fully backward compatible, so only
|
||||
recompilation of programs should be needed.
|
||||
|
||||
Please note that authenticated disk encryption, non-cryptographic
|
||||
data integrity protection (dm-integrity), use of Argon2 Password-Based
|
||||
Key Derivation Function and the LUKS2 on-disk format itself are new
|
||||
features and can contain some bugs.
|
||||
|
||||
To provide all security features of authenticated encryption we need
|
||||
better nonce-reuse resistant algorithm in kernel (see note below).
|
||||
For now, please use authenticated encryption as experimental feature.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or in
|
||||
production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.0-RC1
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* Limit KDF requested (for format) memory by available physical memory.
|
||||
On some systems too high requested amount of memory causes OOM killer
|
||||
to kill the process (instead of returning ENOMEM).
|
||||
We never try to use more than half of available physical memory.
|
||||
|
||||
* Ignore device alignment if it is not multiple of minimal-io.
|
||||
Some USB enclosures seems to report bogus topology info that
|
||||
prevents to use LUKS detached header.
|
||||
|
||||
Changes since version 2.0.0-RC0
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Enable to use system libargon2 instead of bundled version.
|
||||
Renames --disable-argon2 to --disable-internal-argon2 option
|
||||
and adds --enable-libargon2 flag to allow system libargon2.
|
||||
|
||||
* Changes in build system (Automake)
|
||||
- The build system now uses non-recursive automake (except for tests).
|
||||
(Tools binaries are now located in buildroot directory.)
|
||||
- New --disable-cryptsetup option to disable build of cryptsetup tool.
|
||||
- Enable build of cryptsetup-reencrypt by default.
|
||||
|
||||
* Install tmpfiles.d configuration for LUKS2 locking directory.
|
||||
You can overwrite this using --with-tmpfilesdir configure option.
|
||||
If your distro does not support tmpfiles.d directory, you have
|
||||
to create locking directory (/run/lock/cryptsetup) in cryptsetup
|
||||
package (or init scripts).
|
||||
|
||||
* Adds limited support for offline reencryption of LUKS2 format.
|
||||
|
||||
* Decrease size of testing images (and the whole release archive).
|
||||
|
||||
* Fixes for several memory leaks found by Valgrind and Coverity tools.
|
||||
|
||||
* Fixes for several typos in man pages and error messages.
|
||||
|
||||
* LUKS header file in luksFormat is now automatically created
|
||||
if it does not exist.
|
||||
|
||||
* Do not allow resize if device size is not aligned to sector size.
|
||||
|
||||
Cryptsetup 2.0.0 RC0 Release Notes
|
||||
==================================
|
||||
|
||||
Important features
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* New command integritysetup: support for the new dm-integrity kernel target.
|
||||
|
||||
The dm-integrity is a new kernel device-mapper target that introduces
|
||||
software emulation of per-sector integrity fields on the disk sector level.
|
||||
It is available since Linux kernel version 4.12.
|
||||
|
||||
The provided per-sector metadata fields can be used for storing a data
|
||||
integrity checksum (for example CRC32).
|
||||
The dm-integrity implements data journal that enforces atomic update
|
||||
of a sector and its integrity metadata.
|
||||
|
||||
Integritysetup is a CLI utility that can setup standalone dm-integrity
|
||||
devices (that internally check integrity of data).
|
||||
|
||||
Integritysetup is intended to be used for settings that require
|
||||
non-cryptographic data integrity protection with no data encryption.
|
||||
For setting integrity protected encrypted devices, see disk authenticated
|
||||
encryption below.
|
||||
|
||||
Note that after formatting the checksums need to be initialized;
|
||||
otherwise device reads will fail because of integrity errors.
|
||||
Integritysetup by default tries to wipe the device with zero blocks
|
||||
to avoid this problem. Device wipe can be time-consuming, you can skip
|
||||
this step by specifying --no-wipe option.
|
||||
(But note that not wiping device can cause some operations to fail
|
||||
if a write is not multiple of page size and kernel page cache tries
|
||||
to read sectors with not yet initialized checksums.)
|
||||
|
||||
The default setting is tag size 4 bytes per-sector and CRC32C protection.
|
||||
To format device with these defaults:
|
||||
$ integritysetup format <device>
|
||||
$ integritysetup open <device> <name>
|
||||
|
||||
Note that used algorithm (unlike tag size) is NOT stored in device
|
||||
kernel superblock and if you use different algorithm, you MUST specify
|
||||
it in every open command, for example:
|
||||
$ integritysetup format <device> --tag-size 32 --integrity sha256
|
||||
$ integritysetup open <device> <name> --integrity sha256
|
||||
|
||||
For more info, see integrity man page.
|
||||
|
||||
* Veritysetup command can now format and activate dm-verity devices
|
||||
that contain Forward Error Correction (FEC) (Reed-Solomon code is used).
|
||||
This feature is used on most of Android devices already (available since
|
||||
Linux kernel 4.5).
|
||||
|
||||
There are new options --fec-device, --fec-offset to specify data area
|
||||
with correction code and --fec-roots that set Redd-Solomon generator roots.
|
||||
This setting can be used for format command (veritysetup will calculate
|
||||
and store RS codes) or open command (veritysetup configures kernel
|
||||
dm-verity to use RS codes).
|
||||
|
||||
For more info see veritysetup man page.
|
||||
|
||||
* Support for larger sector sizes for crypt devices.
|
||||
|
||||
LUKS2 and plain crypt devices can be now configured with larger encryption
|
||||
sector (typically 4096 bytes, sector size must be the power of two,
|
||||
maximal sector size is 4096 bytes for portability).
|
||||
Large sector size can decrease encryption overhead and can also help
|
||||
with some specific crypto hardware accelerators that perform very
|
||||
badly with 512 bytes sectors.
|
||||
|
||||
Note that if you configure such a larger sector of the device that does use
|
||||
smaller physical sector, there is a possibility of a data corruption during
|
||||
power fail (partial sector writes).
|
||||
|
||||
WARNING: If you use different sector size for a plain device after data were
|
||||
stored, the decryption will produce garbage.
|
||||
|
||||
For LUKS2, the sector size is stored in metadata and cannot be changed later.
|
||||
|
||||
LUKS2 format and features
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
The LUKS2 is an on-disk storage format designed to provide simple key
|
||||
management, primarily intended for Full Disk Encryption based on dm-crypt.
|
||||
|
||||
The LUKS2 is inspired by LUKS1 format and in some specific situations (most
|
||||
of the default configurations) can be converted in-place from LUKS1.
|
||||
|
||||
The LUKS2 format is designed to allow future updates of various
|
||||
parts without the need to modify binary structures and internally
|
||||
uses JSON text format for metadata. Compilation now requires the json-c library
|
||||
that is used for JSON data processing.
|
||||
|
||||
On-disk format provides redundancy of metadata, detection
|
||||
of metadata corruption and automatic repair from metadata copy.
|
||||
|
||||
NOTE: For security reasons, there is no redundancy in keyslots binary data
|
||||
(encrypted keys) but the format allows adding such a feature in future.
|
||||
|
||||
NOTE: to operate correctly, LUKS2 requires locking of metadata.
|
||||
Locking is performed by using flock() system call for images in file
|
||||
and for block device by using a specific lock file in /run/lock/cryptsetup.
|
||||
|
||||
This directory must be created by distribution (do not rely on internal
|
||||
fallback). For systemd-based distribution, you can simply install
|
||||
scripts/cryptsetup.conf into tmpfiles.d directory.
|
||||
|
||||
For more details see LUKS2-format.txt and LUKS2-locking.txt in the docs
|
||||
directory. (Please note this is just overview, there will be more formal
|
||||
documentation later.)
|
||||
|
||||
LUKS2 use
|
||||
~~~~~~~~~
|
||||
|
||||
LUKS2 allows using all possible configurations as LUKS1.
|
||||
|
||||
To format device as LUKS2, you have to add "--type luks2" during format:
|
||||
|
||||
$ cryptsetup luksFormat --type luks2 <device>
|
||||
|
||||
All commands issued later will recognize the new format automatically.
|
||||
|
||||
The newly added features in LUKS2 include:
|
||||
|
||||
* Authenticated disk (sector) encryption (EXPERIMENTAL)
|
||||
|
||||
Legacy Full disk encryption (FDE), for example, LUKS1, is a length-preserving
|
||||
encryption (plaintext is the same size as a ciphertext).
|
||||
Such FDE can provide data confidentiality, but cannot provide sound data
|
||||
integrity protection.
|
||||
|
||||
Full disk authenticated encryption is a way how to provide both
|
||||
confidentiality and data integrity protection. Integrity protection here means
|
||||
not only detection of random data corruption (silent data corruption) but also
|
||||
prevention of an unauthorized intentional change of disk sector content.
|
||||
|
||||
NOTE: Integrity protection of this type cannot prevent a replay attack.
|
||||
An attacker can replace the device or its part of the old content, and it
|
||||
cannot be detected.
|
||||
If you need such protection, better use integrity protection on a higher layer.
|
||||
|
||||
For data integrity protection on the sector level, we need additional
|
||||
per-sector metadata space. In LUKS2 this space is provided by a new
|
||||
device-mapper dm-integrity target (available since kernel 4.12).
|
||||
Here the integrity target provides only reliable per-sector metadata store,
|
||||
and the whole authenticated encryption is performed inside dm-crypt stacked
|
||||
over the dm-integrity device.
|
||||
|
||||
For encryption, Authenticated Encryption with Additional Data (AEAD) is used.
|
||||
Every sector is processed as a encryption request of this format:
|
||||
|
||||
|----- AAD -------|------ DATA -------|-- AUTH TAG --|
|
||||
| (authenticated) | (auth+encryption) | |
|
||||
| sector_LE | IV | sector in/out | tag in/out |
|
||||
|
||||
AEAD encrypts the whole sector and also authenticates sector number
|
||||
(to detect sector relocation) and also authenticates Initialization Vector.
|
||||
|
||||
AEAD encryption produces encrypted data and authentication tag.
|
||||
The authenticated tag is then stored in per-sector metadata space provided
|
||||
by dm-integrity.
|
||||
|
||||
Most of the current AEAD algorithms requires IV as a nonce, value that is
|
||||
never reused. Because sector number, as an IV, cannot be used in this
|
||||
environment, we use a new random IV (IV is a random value generated by system
|
||||
RNG on every write). This random IV is then stored in the per-sector metadata
|
||||
as well.
|
||||
|
||||
Because the authentication tag (and IV) requires additional space, the device
|
||||
provided for a user has less capacity. Also, the data journalling means that
|
||||
writes are performed twice, decreasing throughput.
|
||||
|
||||
This integrity protection works better with SSDs. If you want to ignore
|
||||
dm-integrity data journal (because journalling is performed on some higher
|
||||
layer or you just want to trade-off performance to safe recovery), you can
|
||||
switch journal off with --integrity-no-journal option.
|
||||
(This flag can be stored persistently as well.)
|
||||
|
||||
Note that (similar to integritysetup) the device read will fail if
|
||||
authentication tag is not initialized (no previous write).
|
||||
By default cryptsetup run wipe of a device (writing zeroes) to initialize
|
||||
authentication tags. This operation can be very time-consuming.
|
||||
You can skip device wipe using --integrity-no-wipe option.
|
||||
|
||||
To format LUKS2 device with integrity protection, use new --integrity option.
|
||||
|
||||
For now, there are very few AEAD algorithms that can be used, and some
|
||||
of them are known to be problematic. In this release we support only
|
||||
a few of AEAD algorithms (options are for now hard coded), later this
|
||||
extension will be completely algorithm-agnostic.
|
||||
|
||||
For testing of authenticated encryption, these algorithms work for now:
|
||||
|
||||
1) aes-xts-plain64 with hmac-sha256 or hmac-sha512 as the authentication tag.
|
||||
(Common FDE mode + independent authentication tag. Authentication key
|
||||
for HMAC is independently generated. This mode is very slow.)
|
||||
$ cryptsetup luksFormat --type luks2 <device> --cipher aes-xts-plain64 --integrity hmac-sha256
|
||||
|
||||
2) aes-gcm-random (native AEAD mode)
|
||||
DO NOT USE in production! The GCM mode uses only 96-bit nonce,
|
||||
and possible collision means fatal security problem.
|
||||
GCM mode has very good hardware support through AES-NI, so it is useful
|
||||
for performance testing.
|
||||
$ cryptsetup luksFormat --type luks2 <device> --cipher aes-gcm-random --integrity aead
|
||||
|
||||
3) ChaCha20 with Poly1305 authenticator (according to RFC7539)
|
||||
$ cryptsetup luksFormat --type luks2 <device> --cipher chacha20-random --integrity poly1305
|
||||
|
||||
To specify AES128/AES256 just specify proper key size (without possible
|
||||
authentication key). Other symmetric ciphers, like Serpent or Twofish,
|
||||
should work as well. The mode 1) and 2) should be compatible with IEEE 1619.1
|
||||
standard recommendation.
|
||||
|
||||
There will be better suitable authenticated modes available soon
|
||||
For now we are just preparing framework to enable it (and hopefully improve security of FDE).
|
||||
|
||||
FDE authenticated encryption is not a replacement for filesystem layer
|
||||
authenticated encryption. The goal is to provide at least something because
|
||||
data integrity protection is often completely ignored in today systems.
|
||||
|
||||
* New memory-hard PBKDF
|
||||
|
||||
LUKS1 introduced Password-Based Key Derivation Function v2 as a tool to
|
||||
increase attacker cost for a dictionary and brute force attacks.
|
||||
The PBKDF2 uses iteration count to increase time of key derivation.
|
||||
Unfortunately, with modern GPUs, the PBKDF2 calculations can be run
|
||||
in parallel and PBKDF2 can no longer provide the best available protection.
|
||||
Increasing iteration count just cannot prevent massive parallel dictionary
|
||||
password attacks in long-term.
|
||||
|
||||
To solve this problem, a new PBKDF, based on so-called memory-hard functions
|
||||
can be used. Key derivation with memory-hard function requires a certain
|
||||
amount of memory to compute its output. The memory requirement is very
|
||||
costly for GPUs and prevents these systems to operate effectively,
|
||||
increasing cost for attackers.
|
||||
|
||||
LUKS2 introduces support for Argon2i and Argon2id as a PBKDF.
|
||||
Argon2 is the winner of Password Hashing Competition and is currently
|
||||
in final RFC draft specification.
|
||||
|
||||
For now, libcryptsetup contains the embedded copy of reference implementation
|
||||
of Argon2 (that is easily portable to all architectures).
|
||||
Later, once this function is available in common crypto libraries, it will
|
||||
switch to external implementation. (This happened for LUKS1 and PBKDF2
|
||||
as well years ago.)
|
||||
With using reference implementation (that is not optimized for speed), there
|
||||
is some performance penalty. However, using memory-hard PBKDF should still
|
||||
significantly complicate GPU-optimized dictionary and brute force attacks.
|
||||
|
||||
The Argon2 uses three costs: memory, time (number of iterations) and parallel
|
||||
(number of threads).
|
||||
Note that time and memory cost highly influences each other (accessing a lot
|
||||
of memory takes more time).
|
||||
|
||||
There is a new benchmark that tries to calculate costs to take similar way as
|
||||
in LUKS1 (where iteration is measured to take 1-2 seconds on user system).
|
||||
Because now there are more cost variables, it prefers time cost (iterations)
|
||||
and tries to find required memory that fits. (IOW required memory cost can be
|
||||
lower if the benchmarks are not able to find required parameters.)
|
||||
The benchmark cannot run too long, so it tries to approximate next step
|
||||
for benchmarking.
|
||||
|
||||
For now, default LUKS2 PBKDF algorithm is Argon2i (data independent variant)
|
||||
with memory cost set to 128MB, time to 800ms and parallel thread according
|
||||
to available CPU cores but no more than 4.
|
||||
|
||||
All default parameters can be set during compile time and also set on
|
||||
the command line by using --pbkdf, --pbkdf-memory, --pbkdf-parallel and
|
||||
--iter-time options.
|
||||
(Or without benchmark directly by using --pbkdf-force-iterations, see below.)
|
||||
|
||||
You can still use PBKDF2 even for LUKS2 by specifying --pbkdf pbkdf2 option.
|
||||
(Then only iteration count is applied.)
|
||||
|
||||
* Use of kernel keyring
|
||||
|
||||
Kernel keyring is a storage for sensitive material (like cryptographic keys)
|
||||
inside Linux kernel.
|
||||
|
||||
LUKS2 uses keyring for two major functions:
|
||||
|
||||
- To store volume key for dm-crypt where it avoids sending volume key in
|
||||
every device-mapper ioctl structure. Volume key is also no longer directly
|
||||
visible in a dm-crypt mapping table. The key is not available for the user
|
||||
after dm-crypt configuration (obviously except direct memory scan).
|
||||
Use of kernel keyring can be disabled in runtime by --disable-keyring option.
|
||||
|
||||
- As a tool to automatically unlock LUKS device if a passphrase is put into
|
||||
kernel keyring and proper keyring token is configured.
|
||||
|
||||
This allows storing a secret (passphrase) to kernel per-user keyring by
|
||||
some external tool (for example some TPM handler) and LUKS2, if configured,
|
||||
will automatically search in the keyring and unlock the system.
|
||||
For more info see Tokens section below.
|
||||
|
||||
* Persistent flags
|
||||
The activation flags (like allow-discards) can be stored in metadata and used
|
||||
automatically by all later activations (even without using crypttab).
|
||||
|
||||
To store activation flags permanently, use activation command with required
|
||||
flags and add --persistent option.
|
||||
|
||||
For example, to mark device to always activate with TRIM enabled,
|
||||
use (for LUKS2 type):
|
||||
|
||||
$ cryptsetup open <device> <name> --allow-discards --persistent
|
||||
|
||||
You can check persistent flags in dump command output:
|
||||
|
||||
$ cryptsetup luksDump <device>
|
||||
|
||||
* Tokens and auto-activation
|
||||
|
||||
A LUKS2 token is an object that can be described "how to get passphrase or key"
|
||||
to unlock particular keyslot.
|
||||
(Also it can be used to store any additional metadata, and with
|
||||
the libcryptsetup interface it can be used to define user token types.)
|
||||
|
||||
Cryptsetup internally implements keyring token. Cryptsetup tries to use
|
||||
available tokens before asking for the passphrase. For keyring token,
|
||||
it means that if the passphrase is available under specified identifier
|
||||
inside kernel keyring, the device is automatically activated using this
|
||||
stored passphrase.
|
||||
|
||||
Example of using LUKS2 keyring token:
|
||||
|
||||
# Adding token to metadata with "my_token" identifier (by default it applies to all keyslots).
|
||||
$ cryptsetup token add --key-description "my_token" <device>
|
||||
|
||||
# Storing passphrase to user keyring (this can be done by an external application)
|
||||
$ echo -n <passphrase> | keyctl padd user my_token @u
|
||||
|
||||
# Now cryptsetup activates automatically if it finds correct passphrase
|
||||
$ cryptsetup open <device> <name>
|
||||
|
||||
The main reason to use tokens this way is to separate possible hardware
|
||||
handlers from cryptsetup code.
|
||||
|
||||
* Keyslot priorities
|
||||
|
||||
LUKS2 keyslot can have a new priority attribute.
|
||||
The default is "normal". The "prefer" priority tell the keyslot to be tried
|
||||
before other keyslots. Priority "ignore" means that keyslot will never be
|
||||
used if not specified explicitly (it can be used for backup administrator
|
||||
passwords that are used only situations when a user forgets own passphrase).
|
||||
|
||||
The priority of keyslot can be set with new config command, for example
|
||||
$ cryptsetup config <device> --key-slot 1 --priority prefer
|
||||
|
||||
Setting priority to normal will reset slot to normal state.
|
||||
|
||||
* LUKS2 label and subsystem
|
||||
|
||||
The header now contains additional fields for label and subsystem (additional
|
||||
label). These fields can be used similar to filesystem label and will be
|
||||
visible in udev rules to possible filtering. (Note that blkid do not yet
|
||||
contain the LUKS scanning code).
|
||||
|
||||
By default both labels are empty. Label and subsystem are always set together
|
||||
(no option means clear the label) with the config command:
|
||||
|
||||
$ cryptsetup config <device> --label my_device --subsystem ""
|
||||
|
||||
* In-place conversion form LUKS1
|
||||
|
||||
To allow easy testing and transition to the new LUKS2 format, there is a new
|
||||
convert command that allows in-place conversion from the LUKS1 format and,
|
||||
if there are no incompatible options, also conversion back from LUKS2
|
||||
to LUKS1 format.
|
||||
|
||||
Note this command can be used only on some LUKS1 devices (some device header
|
||||
sizes are not supported).
|
||||
This command is dangerous, never run it without header backup!
|
||||
If something fails in the middle of conversion (IO error), the header
|
||||
is destroyed. (Note that conversion requires move of keyslot data area to
|
||||
a different offset.)
|
||||
|
||||
To convert header in-place to LUKS2 format, use
|
||||
$ cryptsetup convert <device> --type luks2
|
||||
|
||||
To convert it back to LUKS1 format, use
|
||||
$ cryptsetup convert <device> --type luks1
|
||||
|
||||
You can verify LUKS version with luksDump command.
|
||||
$ cryptsetup luksDump <device>
|
||||
|
||||
Note that some LUKS2 features will make header incompatible with LUKS1 and
|
||||
conversion will be rejected (for example using new Argon2 PBKDF or integrity
|
||||
extensions). Some minor attributes can be lost in conversion.
|
||||
|
||||
Other changes
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
* Explicit KDF iterations count setting
|
||||
|
||||
With new PBKDF interface, there is also the possibility to setup PBKDF costs
|
||||
directly, avoiding benchmarks. This can be useful if device is formatted to be
|
||||
primarily used on a different system.
|
||||
|
||||
The option --pbkdf-force-iterations is available for both LUKS1 and LUKS2
|
||||
format. Using this option can cause device to have either very low or very
|
||||
high PBKDF costs.
|
||||
In the first case it means bad protection to dictionary attacks, in the second
|
||||
case, it can mean extremely high unlocking time or memory requirements.
|
||||
Use only if you are sure what you are doing!
|
||||
|
||||
Not that this setting also affects iteration count for the key digest.
|
||||
For LUKS1 iteration count for digest will be approximately 1/8 of requested
|
||||
value, for LUKS2 and "pbkdf2" digest minimal PBKDF2 iteration count (1000)
|
||||
will be used. You cannot set lower iteration count than the internal minimum
|
||||
(1000 for PBKDF2).
|
||||
|
||||
To format LUKS1 device with forced iteration count (and no benchmarking), use
|
||||
$ cryptsetup luksFormat <device> --pbkdf-force-iterations 22222
|
||||
|
||||
For LUKS2 it is always better to specify full settings (do not rely on default
|
||||
cost values).
|
||||
For example, we can set to use Argon2id with iteration cost 5, memory 128000
|
||||
and parallel set 1:
|
||||
$ cryptsetup luksFormat --type luks2 <device> \
|
||||
--pbkdf argon2id --pbkdf-force-iterations 5 --pbkdf-memory 128000 --pbkdf-parallel 1
|
||||
|
||||
* VeraCrypt PIM
|
||||
|
||||
Cryptsetup can now also open VeraCrypt device that uses Personal Iteration
|
||||
Multiplier (PIM). PIM is an integer value that user must remember additionally
|
||||
to passphrase and influences PBKDF2 iteration count (without it VeraCrypt uses
|
||||
a fixed number of iterations).
|
||||
|
||||
To open VeraCrypt device with PIM settings, use --veracrypt-pim (to specify
|
||||
PIM on the command line) or --veracrypt-query-pim to query PIM interactively.
|
||||
|
||||
* Support for plain64be IV
|
||||
|
||||
The plain64be is big-endian variant of plain64 Initialization Vector. It is
|
||||
used in some images of hardware-based disk encryption systems. Supporting this
|
||||
variant allows using dm-crypt to map such images through cryptsetup.
|
||||
|
||||
* Deferral removal
|
||||
|
||||
Cryptsetup now can mark device for deferred removal by using a new option
|
||||
--deferred. This means that close command will not fail if the device is still
|
||||
in use, but will instruct the kernel to remove the device automatically after
|
||||
use count drops to zero (for example, once the filesystem is unmounted).
|
||||
|
||||
* A lot of updates to man pages and many minor changes that would make this
|
||||
release notes too long ;-)
|
||||
|
||||
Libcryptsetup API changes
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
These API functions were removed, libcryptsetup no longer handles password
|
||||
retries from terminal (application should handle terminal operations itself):
|
||||
crypt_set_password_callback;
|
||||
crypt_set_timeout;
|
||||
crypt_set_password_retry;
|
||||
crypt_set_password_verify;
|
||||
|
||||
This call is removed (no need to keep typo backward compatibility,
|
||||
the proper function is crypt_set_iteration_time :-)
|
||||
crypt_set_iterarion_time;
|
||||
|
||||
These calls were removed because are not safe, use per-context
|
||||
error callbacks instead:
|
||||
crypt_last_error;
|
||||
crypt_get_error;
|
||||
|
||||
The PBKDF benchmark was replaced by a new function that uses new KDF structure
|
||||
crypt_benchmark_kdf; (removed)
|
||||
crypt_benchmark_pbkdf; (new API call)
|
||||
|
||||
These new calls are now exported, for details see libcryptsetup.h:
|
||||
crypt_keyslot_add_by_key;
|
||||
crypt_keyslot_set_priority;
|
||||
crypt_keyslot_get_priority;
|
||||
|
||||
crypt_token_json_get;
|
||||
crypt_token_json_set;
|
||||
crypt_token_status;
|
||||
crypt_token_luks2_keyring_get;
|
||||
crypt_token_luks2_keyring_set;
|
||||
crypt_token_assign_keyslot;
|
||||
crypt_token_unassign_keyslot;
|
||||
crypt_token_register;
|
||||
|
||||
crypt_activate_by_token;
|
||||
crypt_activate_by_keyring;
|
||||
crypt_deactivate_by_name;
|
||||
|
||||
crypt_metadata_locking;
|
||||
crypt_volume_key_keyring;
|
||||
crypt_get_integrity_info;
|
||||
crypt_get_sector_size;
|
||||
crypt_persistent_flags_set;
|
||||
crypt_persistent_flags_get;
|
||||
crypt_set_pbkdf_type;
|
||||
crypt_get_pbkdf_type;
|
||||
|
||||
crypt_convert;
|
||||
crypt_keyfile_read;
|
||||
crypt_wipe;
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* There will be better documentation and examples.
|
||||
|
||||
* There will be some more formal definition of the threat model for integrity
|
||||
protection. (And a link to some papers discussing integrity protection,
|
||||
once it is, hopefully, accepted and published.)
|
||||
|
||||
* Offline re-encrypt tool LUKS2 support is currently limited.
|
||||
There will be online LUKS2 re-encryption tool in future.
|
||||
|
||||
* Authenticated encryption will use new algorithms from CAESAR competition
|
||||
(https://competitions.cr.yp.to/caesar.html) once these algorithms are available
|
||||
in kernel (more on this later).
|
||||
NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305)
|
||||
in kernel have too small 96-bit nonces that are problematic with
|
||||
randomly generated IVs (the collision probability is not negligible).
|
||||
For the GCM, nonce collision is a fatal problem.
|
||||
|
||||
* Authenticated encryption do not set encryption for dm-integrity journal.
|
||||
|
||||
While it does not influence data confidentiality or integrity protection,
|
||||
an attacker can get some more information from data journal or cause that
|
||||
system will corrupt sectors after journal replay. (That corruption will be
|
||||
detected though.)
|
||||
|
||||
* Some utilities (blkid, systemd-cryptsetup) have already support for LUKS
|
||||
but not yet in released version (support in crypttab etc).
|
||||
|
||||
* There are some examples of user-defined tokens inside misc/luks2_keyslot_example
|
||||
directory (like a simple external program that uses libssh to unlock LUKS2
|
||||
using remote keyfile).
|
||||
|
||||
* The python binding (pycryptsetup) contains only basic functionality for LUKS1
|
||||
(it is not updated for new features) and will be deprecated soon in favor
|
||||
of python bindings to libblockdev library (that can already handle LUKS1 devices).
|
||||
@@ -1,109 +0,0 @@
|
||||
Cryptsetup 2.0.1 Release Notes
|
||||
==============================
|
||||
Stable and bug-fix release with experimental features.
|
||||
|
||||
This version introduces a new on-disk LUKS2 format.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported
|
||||
forever as well as a traditional and fully backward compatible format.
|
||||
|
||||
Please note that authenticated disk encryption, non-cryptographic
|
||||
data integrity protection (dm-integrity), use of Argon2 Password-Based
|
||||
Key Derivation Function and the LUKS2 on-disk format itself are new
|
||||
features and can contain some bugs.
|
||||
|
||||
To provide all security features of authenticated encryption we need
|
||||
a better nonce-reuse resistant algorithm in the kernel (see note below).
|
||||
For now, please use authenticated encryption as an experimental feature.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or in
|
||||
production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.0
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* To store volume key into kernel keyring, kernel 4.15 with dm-crypt 1.18.1
|
||||
is required. If a volume key is stored in keyring (LUKS2 only),
|
||||
the dm-crypt v1.15.0 through v1.18.0 contains a serious bug that may cause
|
||||
data corruption for ciphers with ESSIV.
|
||||
(The key for ESSIV is zeroed because of code misplacement.)
|
||||
This bug is not present for LUKS1 or any other IVs used in LUKS modes.
|
||||
This change is not visible to the user (except dmsetup output).
|
||||
|
||||
* Increase maximum allowed PBKDF memory-cost limit to 4 GiB.
|
||||
The Argon2 PBKDF uses 1GiB by default; this is also limited by the amount
|
||||
of physical memory available (maximum is half of the physical memory).
|
||||
|
||||
* Use /run/cryptsetup as default for cryptsetup locking dir.
|
||||
There were problems with sharing /run/lock with lockdev, and in the early
|
||||
boot, the directory was missing.
|
||||
The directory can be changed with --with-luks2-lock-path and
|
||||
--with-luks2-lock-dir-perms configure switches.
|
||||
|
||||
* Introduce new 64-bit byte-offset *keyfile_device_offset functions.
|
||||
|
||||
The keyfile interface was designed, well, for keyfiles. Unfortunately,
|
||||
there are user cases where a keyfile can be placed on a device, and
|
||||
size_t offset can overflow on 32-bit systems.
|
||||
|
||||
New set of functions that allow 64-bit offsets even on 32bit systems
|
||||
are now available:
|
||||
|
||||
- crypt_resume_by_keyfile_device_offset
|
||||
- crypt_keyslot_add_by_keyfile_device_offset
|
||||
- crypt_activate_by_keyfile_device_offset
|
||||
- crypt_keyfile_device_read
|
||||
|
||||
The new functions have added the _device_ in name.
|
||||
Old functions are just internal wrappers around these.
|
||||
|
||||
Also cryptsetup --keyfile-offset and --new-keyfile-offset now allows
|
||||
64-bit offsets as parameters.
|
||||
|
||||
* Add error hint for wrongly formatted cipher strings in LUKS1 and
|
||||
properly fail in luksFormat if cipher format is missing required IV.
|
||||
For now, crypto API quietly used cipher without IV if a cipher
|
||||
algorithm without IV specification was used (e.g., aes-xts).
|
||||
This caused fail later during activation.
|
||||
|
||||
* Configure check for a recent Argon2 lib to support mandatory Argon2id.
|
||||
|
||||
* Fix for the cryptsetup-reencrypt static build if pwquality is enabled.
|
||||
|
||||
* Update LUKS1 standard doc (https links in the bibliography).
|
||||
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* There will be better documentation and examples.
|
||||
|
||||
* There will be some more formal definition of the threat model for integrity
|
||||
protection. (And a link to some papers discussing integrity protection,
|
||||
once it is, hopefully, accepted and published.)
|
||||
|
||||
* Offline re-encrypt tool LUKS2 support is currently limited.
|
||||
There will be online LUKS2 re-encryption tool in future.
|
||||
|
||||
* Authenticated encryption will use new algorithms from CAESAR competition
|
||||
(https://competitions.cr.yp.to/caesar.html) once these algorithms are
|
||||
available in the kernel (more on this later).
|
||||
NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305)
|
||||
in the kernel have too small 96-bit nonces that are problematic with
|
||||
randomly generated IVs (the collision probability is not negligible).
|
||||
For the GCM, nonce collision is a fatal problem.
|
||||
|
||||
* Authenticated encryption do not set encryption for a dm-integrity journal.
|
||||
|
||||
While it does not influence data confidentiality or integrity protection,
|
||||
an attacker can get some more information from data journal or cause that
|
||||
system will corrupt sectors after journal replay. (That corruption will be
|
||||
detected though.)
|
||||
|
||||
* There are examples of user-defined tokens inside misc/luks2_keyslot_example
|
||||
directory (like a simple external program that uses libssh to unlock LUKS2
|
||||
using remote keyfile).
|
||||
|
||||
* The python binding (pycryptsetup) contains only basic functionality for LUKS1
|
||||
(it is not updated for new features) and will be deprecated soon in favor
|
||||
of python bindings to the libblockdev library (that can already handle LUKS1
|
||||
devices).
|
||||
@@ -1,93 +0,0 @@
|
||||
Cryptsetup 2.0.2 Release Notes
|
||||
==============================
|
||||
Stable and bug-fix release with experimental features.
|
||||
|
||||
Cryptsetup 2.x version introduces a new on-disk LUKS2 format.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported
|
||||
forever as well as a traditional and fully backward compatible format.
|
||||
|
||||
Please note that authenticated disk encryption, non-cryptographic
|
||||
data integrity protection (dm-integrity), use of Argon2 Password-Based
|
||||
Key Derivation Function and the LUKS2 on-disk format itself are new
|
||||
features and can contain some bugs.
|
||||
|
||||
To provide all security features of authenticated encryption, we need
|
||||
a better nonce-reuse resistant algorithm in the kernel (see note below).
|
||||
For now, please use authenticated encryption as an experimental feature.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or in
|
||||
production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.1
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Fix a regression in early detection of inactive keyslot for luksKillSlot.
|
||||
It tried to ask for passphrase even for already erased keyslot.
|
||||
|
||||
* Fix a regression in loopaesOpen processing for keyfile on standard input.
|
||||
Use of "-" argument was not working properly.
|
||||
|
||||
* Add LUKS2 specific options for cryptsetup-reencrypt.
|
||||
Tokens and persistent flags are now transferred during reencryption;
|
||||
change of PBKDF keyslot parameters is now supported and allows one
|
||||
to set precalculated values (no benchmarks).
|
||||
|
||||
* Do not allow LUKS2 --persistent and --test-passphrase cryptsetup flags
|
||||
combination. Persistent flags are now stored only if the device was
|
||||
successfully activated with the specified flags.
|
||||
|
||||
* Fix integritysetup format after recent Linux kernel changes that
|
||||
requires to setup key for HMAC in all cases.
|
||||
Previously integritysetup allowed HMAC with zero key that behaves
|
||||
like a plain hash.
|
||||
|
||||
* Fix VeraCrypt PIM handling that modified internal iteration counts
|
||||
even for subsequent activations. The PIM count is no longer printed
|
||||
in debug log as it is sensitive information.
|
||||
Also, the code now skips legacy TrueCrypt algorithms if a PIM
|
||||
is specified (they cannot be used with PIM anyway).
|
||||
|
||||
* PBKDF values cannot be set (even with force parameters) below
|
||||
hardcoded minimums. For PBKDF2 is it 1000 iterations, for Argon2
|
||||
it is 4 iterations and 32 KiB of memory cost.
|
||||
|
||||
* Introduce new crypt_token_is_assigned() API function for reporting
|
||||
the binding between token and keyslots.
|
||||
|
||||
* Allow crypt_token_json_set() API function to create internal token types.
|
||||
Do not allow unknown fields in internal token objects.
|
||||
|
||||
* Print message in cryptsetup that about was aborted if a user did not
|
||||
answer YES in a query.
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* There will be better documentation and examples.
|
||||
|
||||
* There will be some more formal definition of the threat model for integrity
|
||||
protection. (And a link to some papers discussing integrity protection,
|
||||
once it is, hopefully, accepted and published.)
|
||||
|
||||
* Authenticated encryption will use new algorithms from CAESAR competition
|
||||
https://competitions.cr.yp.to/caesar-submissions.html.
|
||||
We plan to use AEGIS and MORUS, as CAESAR finalists.
|
||||
|
||||
NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305)
|
||||
in the kernel have too small 96-bit nonces that are problematic with
|
||||
randomly generated IVs (the collision probability is not negligible).
|
||||
|
||||
* Authenticated encryption do not set encryption for a dm-integrity journal.
|
||||
|
||||
While it does not influence data confidentiality or integrity protection,
|
||||
an attacker can get some more information from data journal or cause that
|
||||
system will corrupt sectors after journal replay. (That corruption will be
|
||||
detected though.)
|
||||
|
||||
* There are examples of user-defined tokens inside misc/luks2_keyslot_example
|
||||
directory (like a simple external program that uses libssh to unlock LUKS2
|
||||
using remote keyfile).
|
||||
|
||||
* The python binding (pycryptsetup) contains only basic functionality for LUKS1
|
||||
(it is not updated for new features) and will be deprecated in version 2.1
|
||||
in favor of python bindings to the libblockdev library.
|
||||
@@ -1,121 +0,0 @@
|
||||
Cryptsetup 2.0.3 Release Notes
|
||||
==============================
|
||||
Stable bug-fix release with new features.
|
||||
|
||||
Cryptsetup 2.x version introduces a new on-disk LUKS2 format.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported
|
||||
forever as well as a traditional and fully backward compatible format.
|
||||
|
||||
Please note that authenticated disk encryption, non-cryptographic
|
||||
data integrity protection (dm-integrity), use of Argon2 Password-Based
|
||||
Key Derivation Function and the LUKS2 on-disk format itself are new
|
||||
features and can contain some bugs.
|
||||
|
||||
To provide all security features of authenticated encryption, we need
|
||||
a better nonce-reuse resistant algorithm in the kernel (see note below).
|
||||
For now, please use authenticated encryption as an experimental feature.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or in
|
||||
production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.2
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Expose interface to unbound LUKS2 keyslots.
|
||||
Unbound LUKS2 keyslot allows storing a key material that is independent
|
||||
of master volume key (it is not bound to encrypted data segment).
|
||||
|
||||
* New API extensions for unbound keyslots (LUKS2 only)
|
||||
crypt_keyslot_get_key_size() and crypt_volume_key_get()
|
||||
These functions allow one to get key and key size for unbound keyslots.
|
||||
|
||||
* New enum value CRYPT_SLOT_UNBOUND for keyslot status (LUKS2 only).
|
||||
|
||||
* Add --unbound keyslot option to the cryptsetup luksAddKey command.
|
||||
|
||||
* Add crypt_get_active_integrity_failures() call to get integrity
|
||||
failure count for dm-integrity devices.
|
||||
|
||||
* Add crypt_get_pbkdf_default() function to get per-type PBKDF default
|
||||
setting.
|
||||
|
||||
* Add new flag to crypt_keyslot_add_by_key() to force update device
|
||||
volume key. This call is mainly intended for a wrapped key change.
|
||||
|
||||
* Allow volume key store in a file with cryptsetup.
|
||||
The --dump-master-key together with --master-key-file allows cryptsetup
|
||||
to store the binary volume key to a file instead of standard output.
|
||||
|
||||
* Add support detached header for cryptsetup-reencrypt command.
|
||||
|
||||
* Fix VeraCrypt PIM handling - use proper iterations count formula
|
||||
for PBKDF2-SHA512 and PBKDF2-Whirlpool used in system volumes.
|
||||
|
||||
* Fix cryptsetup tcryptDump for VeraCrypt PIM (support --veracrypt-pim).
|
||||
|
||||
* Add --with-default-luks-format configure time option.
|
||||
(Option to override default LUKS format version.)
|
||||
|
||||
* Fix LUKS version conversion for detached (and trimmed) LUKS headers.
|
||||
|
||||
* Add luksConvertKey cryptsetup command that converts specific keyslot
|
||||
from one PBKDF to another.
|
||||
|
||||
* Do not allow conversion to LUKS2 if LUKSMETA (external tool metadata)
|
||||
header is detected.
|
||||
|
||||
* More cleanup and hardening of LUKS2 keyslot specific validation options.
|
||||
Add more checks for cipher validity before writing metadata on-disk.
|
||||
|
||||
* Do not allow LUKS1 version downconversion if the header contains tokens.
|
||||
|
||||
* Add "paes" family ciphers (AES wrapped key scheme for mainframes)
|
||||
to allowed ciphers.
|
||||
Specific wrapped ley configuration logic must be done by 3rd party tool,
|
||||
LUKS2 stores only keyslot material and allow activation of the device.
|
||||
|
||||
* Add support for --check-at-most-once option (kernel 4.17) to veritysetup.
|
||||
This flag can be dangerous; if you can control underlying device
|
||||
(you can change its content after it was verified) it will no longer
|
||||
prevent reading tampered data and also it does not prevent silent
|
||||
data corruptions that appear after the block was once read.
|
||||
|
||||
* Fix return code (EPERM instead of EINVAL) and retry count for bad
|
||||
passphrase on non-tty input.
|
||||
|
||||
* Enable support for FEC decoding in veritysetup to check dm-verity devices
|
||||
with additional Reed-Solomon code in userspace (verify command).
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* There will be better documentation and examples (planned for 2.0.4).
|
||||
|
||||
* There will be some more formal definition of the threat model for integrity
|
||||
protection. (And a link to some papers discussing integrity protection,
|
||||
once it is, hopefully, accepted and published.)
|
||||
|
||||
* Authenticated encryption will use new algorithms from CAESAR competition
|
||||
https://competitions.cr.yp.to/caesar-submissions.html.
|
||||
We plan to use AEGIS and MORUS, as CAESAR finalists.
|
||||
|
||||
NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305)
|
||||
in the kernel have too small 96-bit nonces that are problematic with
|
||||
randomly generated IVs (the collision probability is not negligible).
|
||||
|
||||
* Authenticated encryption do not set encryption for a dm-integrity journal.
|
||||
|
||||
While it does not influence data confidentiality or integrity protection,
|
||||
an attacker can get some more information from data journal or cause that
|
||||
system will corrupt sectors after journal replay. (That corruption will be
|
||||
detected though.)
|
||||
|
||||
* There are examples of user-defined tokens inside misc/luks2_keyslot_example
|
||||
directory (like a simple external program that uses libssh to unlock LUKS2
|
||||
using remote keyfile).
|
||||
|
||||
* The python binding (pycryptsetup) contains only basic functionality for LUKS1
|
||||
(it is not updated for new features) and will be REMOVED in version 2.1
|
||||
in favor of python bindings to the libblockdev library.
|
||||
See https://github.com/storaged-project/libblockdev/releases/tag/2.17-1 that
|
||||
already supports LUKS2 and VeraCrypt devices handling through libcryptsetup.
|
||||
@@ -1,119 +0,0 @@
|
||||
Cryptsetup 2.0.4 Release Notes
|
||||
==============================
|
||||
Stable bug-fix release with new features.
|
||||
|
||||
Cryptsetup 2.x version introduces a new on-disk LUKS2 format.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported
|
||||
forever as well as a traditional and fully backward compatible format.
|
||||
|
||||
Please note that authenticated disk encryption, non-cryptographic
|
||||
data integrity protection (dm-integrity), use of Argon2 Password-Based
|
||||
Key Derivation Function and the LUKS2 on-disk format itself are new
|
||||
features and can contain some bugs.
|
||||
|
||||
To provide all security features of authenticated encryption, we need
|
||||
a better nonce-reuse resistant algorithm in the kernel (see note below).
|
||||
For now, please use authenticated encryption as an experimental feature.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or in
|
||||
production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.3
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Use the libblkid (blockid) library to detect foreign signatures
|
||||
on a device before LUKS format and LUKS2 auto-recovery.
|
||||
|
||||
This change fixes an unexpected recovery using the secondary
|
||||
LUKS2 header after a device was already overwritten with
|
||||
another format (filesystem or LVM physical volume).
|
||||
|
||||
LUKS2 will not recreate a primary header if it detects a valid
|
||||
foreign signature. In this situation, a user must always
|
||||
use cryptsetup repair command for the recovery.
|
||||
|
||||
Note that libcryptsetup and utilities are now linked to libblkid
|
||||
as a new dependence.
|
||||
|
||||
To compile code without blockid support (strongly discouraged),
|
||||
use --disable-blkid configure switch.
|
||||
|
||||
* Add prompt for format and repair actions in cryptsetup and
|
||||
integritysetup if foreign signatures are detected on the device
|
||||
through the blockid library.
|
||||
|
||||
After the confirmation, all known signatures are then wiped as
|
||||
part of the format or repair procedure.
|
||||
|
||||
* Print consistent verbose message about keyslot and token numbers.
|
||||
For keyslot actions: Key slot <number> unlocked/created/removed.
|
||||
For token actions: Token <number> created/removed.
|
||||
|
||||
* Print error, if a non-existent token is tried to be removed.
|
||||
|
||||
* Add support for LUKS2 token definition export and import.
|
||||
|
||||
The token command now can export/import customized token JSON file
|
||||
directly from command line. See the man page for more details.
|
||||
|
||||
* Add support for new dm-integrity superblock version 2.
|
||||
|
||||
* Add an error message when nothing was read from a key file.
|
||||
|
||||
* Update cryptsetup man pages, including --type option usage.
|
||||
|
||||
* Add a snapshot of LUKS2 format specification to documentation
|
||||
and accordingly fix supported secondary header offsets.
|
||||
|
||||
* Add bundled optimized Argon2 SSE (X86_64 platform) code.
|
||||
|
||||
If the bundled Argon2 code is used and the new configure switch
|
||||
--enable-internal-sse-argon2 option is present, and compiler flags
|
||||
support required optimization, the code will try to use optimized
|
||||
and faster variant.
|
||||
|
||||
Always use the shared library (--enable-libargon2) if possible.
|
||||
|
||||
This option was added because an enterprise distribution
|
||||
rejected to support the shared Argon2 library and native support
|
||||
in generic cryptographic libraries is not ready yet.
|
||||
|
||||
* Fix compilation with crypto backend for LibreSSL >= 2.7.0.
|
||||
LibreSSL introduced OpenSSL 1.1.x API functions, so compatibility
|
||||
wrapper must be commented out.
|
||||
|
||||
* Fix on-disk header size calculation for LUKS2 format if a specific
|
||||
data alignment is requested. Until now, the code used default size
|
||||
that could be wrong for converted devices.
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* Authenticated encryption will use new algorithms from CAESAR competition
|
||||
https://competitions.cr.yp.to/caesar-submissions.html.
|
||||
We plan to use AEGIS and MORUS (in kernel 4.18), as CAESAR finalists.
|
||||
|
||||
NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305)
|
||||
in the kernel have too small 96-bit nonces that are problematic with
|
||||
randomly generated IVs (the collision probability is not negligible).
|
||||
|
||||
For more info about LUKS2 authenticated encryption, please see our paper
|
||||
https://arxiv.org/abs/1807.00309
|
||||
|
||||
* Authenticated encryption do not set encryption for a dm-integrity journal.
|
||||
|
||||
While it does not influence data confidentiality or integrity protection,
|
||||
an attacker can get some more information from data journal or cause that
|
||||
system will corrupt sectors after journal replay. (That corruption will be
|
||||
detected though.)
|
||||
|
||||
* There are examples of user-defined tokens inside misc/luks2_keyslot_example
|
||||
directory (like a simple external program that uses libssh to unlock LUKS2
|
||||
using remote keyfile).
|
||||
|
||||
* The python binding (pycryptsetup) contains only basic functionality for LUKS1
|
||||
(it is not updated for new features) and will be REMOVED in version 2.1
|
||||
in favor of python bindings to the libblockdev library.
|
||||
See https://github.com/storaged-project/libblockdev/releases that
|
||||
already supports LUKS2 and VeraCrypt devices handling through libcryptsetup.
|
||||
|
||||
@@ -1,102 +0,0 @@
|
||||
Cryptsetup 2.0.5 Release Notes
|
||||
==============================
|
||||
Stable bug-fix release with new features.
|
||||
|
||||
Cryptsetup 2.x version introduces a new on-disk LUKS2 format.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported
|
||||
forever as well as a traditional and fully backward compatible format.
|
||||
|
||||
Please note that authenticated disk encryption, non-cryptographic
|
||||
data integrity protection (dm-integrity), use of Argon2 Password-Based
|
||||
Key Derivation Function and the LUKS2 on-disk format itself are new
|
||||
features and can contain some bugs.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or in
|
||||
production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.4
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Wipe full header areas (including unused) during LUKS format.
|
||||
|
||||
Since this version, the whole area up to the data offset is zeroed,
|
||||
and subsequently, all keyslots areas are wiped with random data.
|
||||
This ensures that no remaining old data remains in the LUKS header
|
||||
areas, but it could slow down format operation on some devices.
|
||||
Previously only first 4k (or 32k for LUKS2) and the used keyslot
|
||||
was overwritten in the format operation.
|
||||
|
||||
* Several fixes to error messages that were unintentionally replaced
|
||||
in previous versions with a silent exit code.
|
||||
More descriptive error messages were added, including error
|
||||
messages if
|
||||
- a device is unusable (not a block device, no access, etc.),
|
||||
- a LUKS device is not detected,
|
||||
- LUKS header load code detects unsupported version,
|
||||
- a keyslot decryption fails (also happens in the cipher check),
|
||||
- converting an inactive keyslot.
|
||||
|
||||
* Device activation fails if data area overlaps with LUKS header.
|
||||
|
||||
* Code now uses explicit_bzero to wipe memory if available
|
||||
(instead of own implementation).
|
||||
|
||||
* Additional VeraCrypt modes are now supported, including Camellia
|
||||
and Kuznyechik symmetric ciphers (and cipher chains) and Streebog
|
||||
hash function. These were introduced in a recent VeraCrypt upstream.
|
||||
|
||||
Note that Kuznyechik requires out-of-tree kernel module and
|
||||
Streebog hash function is available only with the gcrypt cryptographic
|
||||
backend for now.
|
||||
|
||||
* Fixes static build for integritysetup if the pwquality library is used.
|
||||
|
||||
* Allows passphrase change for unbound keyslots.
|
||||
|
||||
* Fixes removed keyslot number in verbose message for luksKillSlot,
|
||||
luksRemoveKey and erase command.
|
||||
|
||||
* Adds blkid scan when attempting to open a plain device and warn the user
|
||||
about existing device signatures in a ciphertext device.
|
||||
|
||||
* Remove LUKS header signature if luksFormat fails to add the first keyslot.
|
||||
|
||||
* Remove O_SYNC from device open and use fsync() to speed up
|
||||
wipe operation considerably.
|
||||
|
||||
* Create --master-key-file in luksDump and fail if the file already exists.
|
||||
|
||||
* Fixes a bug when LUKS2 authenticated encryption with a detached header
|
||||
wiped the header device instead of dm-integrity data device area (causing
|
||||
unnecessary LUKS2 header auto recovery).
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* Authenticated encryption should use new algorithms from CAESAR competition
|
||||
https://competitions.cr.yp.to/caesar-submissions.html.
|
||||
AEGIS and MORUS are already available in kernel 4.18.
|
||||
|
||||
For more info about LUKS2 authenticated encryption, please see our paper
|
||||
https://arxiv.org/abs/1807.00309
|
||||
|
||||
Please note that authenticated encryption is still an experimental feature
|
||||
and can have performance problems for hish-speed devices and device
|
||||
with larger IO blocks (like RAID).
|
||||
|
||||
* Authenticated encryption do not set encryption for a dm-integrity journal.
|
||||
|
||||
While it does not influence data confidentiality or integrity protection,
|
||||
an attacker can get some more information from data journal or cause that
|
||||
system will corrupt sectors after journal replay. (That corruption will be
|
||||
detected though.)
|
||||
|
||||
* There are examples of user-defined tokens inside misc/luks2_keyslot_example
|
||||
directory (like a simple external program that uses libssh to unlock LUKS2
|
||||
using remote keyfile).
|
||||
|
||||
* The python binding (pycryptsetup) contains only basic functionality for LUKS1
|
||||
(it is not updated for new features) and will be REMOVED in version 2.1
|
||||
in favor of python bindings to the libblockdev library.
|
||||
See https://github.com/storaged-project/libblockdev/releases that
|
||||
already supports LUKS2 and VeraCrypt devices handling through libcryptsetup.
|
||||
@@ -1,97 +0,0 @@
|
||||
Cryptsetup 2.0.6 Release Notes
|
||||
==============================
|
||||
Stable bug-fix release.
|
||||
All users of cryptsetup 2.0.x should upgrade to this version.
|
||||
|
||||
Cryptsetup 2.x version introduces a new on-disk LUKS2 format.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported
|
||||
forever as well as a traditional and fully backward compatible format.
|
||||
|
||||
Please note that authenticated disk encryption, non-cryptographic
|
||||
data integrity protection (dm-integrity), use of Argon2 Password-Based
|
||||
Key Derivation Function and the LUKS2 on-disk format itself are new
|
||||
features and can contain some bugs.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or in
|
||||
production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.5
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Fix support of larger metadata areas in LUKS2 header.
|
||||
|
||||
This release properly supports all specified metadata areas, as documented
|
||||
in LUKS2 format description (see docs/on-disk-format-luks2.pdf in archive).
|
||||
|
||||
Currently, only default metadata area size is used (in format or convert).
|
||||
Later cryptsetup versions will allow increasing this metadata area size.
|
||||
|
||||
* If AEAD (authenticated encryption) is used, cryptsetup now tries to check
|
||||
if the requested AEAD algorithm with specified key size is available
|
||||
in kernel crypto API.
|
||||
This change avoids formatting a device that cannot be later activated.
|
||||
|
||||
For this function, the kernel must be compiled with the
|
||||
CONFIG_CRYPTO_USER_API_AEAD option enabled.
|
||||
Note that kernel user crypto API options (CONFIG_CRYPTO_USER_API and
|
||||
CONFIG_CRYPTO_USER_API_SKCIPHER) are already mandatory for LUKS2.
|
||||
|
||||
* Fix setting of integrity no-journal flag.
|
||||
Now you can store this flag to metadata using --persistent option.
|
||||
|
||||
* Fix cryptsetup-reencrypt to not keep temporary reencryption headers
|
||||
if interrupted during initial password prompt.
|
||||
|
||||
* Adds early check to plain and LUKS2 formats to disallow device format
|
||||
if device size is not aligned to requested sector size.
|
||||
Previously it was possible, and the device was rejected to activate by
|
||||
kernel later.
|
||||
|
||||
* Fix checking of hash algorithms availability for PBKDF early.
|
||||
Previously LUKS2 format allowed non-existent hash algorithm with
|
||||
invalid keyslot preventing the device from activation.
|
||||
|
||||
* Allow Adiantum cipher construction (a non-authenticated length-preserving
|
||||
fast encryption scheme), so it can be used both for data encryption and
|
||||
keyslot encryption in LUKS1/2 devices.
|
||||
|
||||
For benchmark, use:
|
||||
# cryptsetup benchmark -c xchacha12,aes-adiantum
|
||||
# cryptsetup benchmark -c xchacha20,aes-adiantum
|
||||
|
||||
For LUKS format:
|
||||
# cryptsetup luksFormat -c xchacha20,aes-adiantum-plain64 -s 256 <device>
|
||||
|
||||
The support for Adiantum will be merged in Linux kernel 4.21.
|
||||
For more info see the paper https://eprint.iacr.org/2018/720.
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* Authenticated encryption should use new algorithms from CAESAR competition
|
||||
https://competitions.cr.yp.to/caesar-submissions.html.
|
||||
AEGIS and MORUS are already available in kernel 4.18.
|
||||
|
||||
For more info about LUKS2 authenticated encryption, please see our paper
|
||||
https://arxiv.org/abs/1807.00309
|
||||
|
||||
Please note that authenticated encryption is still an experimental feature
|
||||
and can have performance problems for high-speed devices and device
|
||||
with larger IO blocks (like RAID).
|
||||
|
||||
* Authenticated encryption do not set encryption for a dm-integrity journal.
|
||||
|
||||
While it does not influence data confidentiality or integrity protection,
|
||||
an attacker can get some more information from data journal or cause that
|
||||
system will corrupt sectors after journal replay. (That corruption will be
|
||||
detected though.)
|
||||
|
||||
* There are examples of user-defined tokens inside misc/luks2_keyslot_example
|
||||
directory (like a simple external program that uses libssh to unlock LUKS2
|
||||
using remote keyfile).
|
||||
|
||||
* The python binding (pycryptsetup) contains only basic functionality for LUKS1
|
||||
(it is not updated for new features) and will be REMOVED in version 2.1
|
||||
in favor of python bindings to the libblockdev library.
|
||||
See https://github.com/storaged-project/libblockdev/releases that
|
||||
already supports LUKS2 and VeraCrypt devices handling through libcryptsetup.
|
||||
@@ -1,210 +0,0 @@
|
||||
Cryptsetup 2.1.0 Release Notes
|
||||
==============================
|
||||
Stable release with new features and bug fixes.
|
||||
|
||||
Cryptsetup 2.1 version uses a new on-disk LUKS2 format as the default
|
||||
LUKS format and increases default LUKS2 header size.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported forever
|
||||
as well as a traditional and fully backward compatible format.
|
||||
|
||||
When upgrading a stable distribution, please use configure option
|
||||
--with-default-luks-format=LUKS1 to maintain backward compatibility.
|
||||
|
||||
This release also switches to OpenSSL as a default cryptographic
|
||||
backend for LUKS header processing. Use --with-crypto_backend=gcrypt
|
||||
configure option if you need to preserve legacy libgcrypt backend.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or
|
||||
in production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.6
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* The default for cryptsetup LUKS format action is now LUKS2.
|
||||
You can use LUKS1 with cryptsetup option --type luks1.
|
||||
|
||||
* The default size of the LUKS2 header is increased to 16 MB.
|
||||
It includes metadata and the area used for binary keyslots;
|
||||
it means that LUKS header backup is now 16MB in size.
|
||||
|
||||
Note, that used keyslot area is much smaller, but this increase
|
||||
of reserved space allows implementation of later extensions
|
||||
(like online reencryption).
|
||||
It is fully compatible with older cryptsetup 2.0.x versions.
|
||||
If you require to create LUKS2 header with the same size as
|
||||
in the 2.0.x version, use --offset 8192 option for luksFormat
|
||||
(units are in 512-bytes sectors; see notes below).
|
||||
|
||||
* Cryptsetup now doubles LUKS default key size if XTS mode is used
|
||||
(XTS mode uses two internal keys). This does not apply if key size
|
||||
is explicitly specified on the command line and it does not apply
|
||||
for the plain mode.
|
||||
This fixes a confusion with AES and 256bit key in XTS mode where
|
||||
code used AES128 and not AES256 as often expected.
|
||||
|
||||
Also, the default keyslot encryption algorithm (if cannot be derived
|
||||
from data encryption algorithm) is now available as configure
|
||||
options --with-luks2-keyslot-cipher and --with-luks2-keyslot-keybits.
|
||||
The default is aes-xts-plain64 with 2 * 256-bits key.
|
||||
|
||||
* Default cryptographic backend used for LUKS header processing is now
|
||||
OpenSSL. For years, OpenSSL provided better performance for PBKDF.
|
||||
|
||||
NOTE: Cryptsetup/libcryptsetup supports several cryptographic
|
||||
library backends. The fully supported are libgcrypt, OpenSSL and
|
||||
kernel crypto API. FIPS mode extensions are maintained only for
|
||||
libgcrypt and OpenSSL. Nettle and NSS are usable only for some
|
||||
subset of algorithms and cannot provide full backward compatibility.
|
||||
You can always switch to other backends by using a configure switch,
|
||||
for libgcrypt (compatibility for older distributions) use:
|
||||
--with-crypto_backend=gcrypt
|
||||
|
||||
* The Python bindings are no longer supported and the code was removed
|
||||
from cryptsetup distribution. Please use the libblockdev project
|
||||
that already covers most of the libcryptsetup functionality
|
||||
including LUKS2.
|
||||
|
||||
* Cryptsetup now allows using --offset option also for luksFormat.
|
||||
It means that the specified offset value is used for data offset.
|
||||
LUKS2 header areas are automatically adjusted according to this value.
|
||||
(Note units are in 512-byte sectors due to the previous definition
|
||||
of this option in plain mode.)
|
||||
This option can replace --align-payload with absolute alignment value.
|
||||
|
||||
* Cryptsetup now supports new refresh action (that is the alias for
|
||||
"open --refresh").
|
||||
It allows changes of parameters for an active device (like root
|
||||
device mapping), for example, it can enable or disable TRIM support
|
||||
on-the-fly.
|
||||
It is supported for LUKS1, LUKS2, plain and loop-AES devices.
|
||||
|
||||
* Integritysetup now supports mode with detached data device through
|
||||
new --data-device option.
|
||||
Since kernel 4.18 there is a possibility to specify external data
|
||||
device for dm-integrity that stores all integrity tags.
|
||||
|
||||
* Integritysetup now supports automatic integrity recalculation
|
||||
through new --integrity-recalculate option.
|
||||
Linux kernel since version 4.18 supports automatic background
|
||||
recalculation of integrity tags for dm-integrity.
|
||||
|
||||
Other changes and fixes
|
||||
~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Fix for crypt_wipe call to allocate space if the header is backed
|
||||
by a file. This means that if you use detached header file, it will
|
||||
now have always the full size after luksFormat, even if only
|
||||
a few keyslots are used.
|
||||
|
||||
* Fixes to offline cryptsetup-reencrypt to preserve LUKS2 keyslots
|
||||
area sizes after reencryption and fixes for some other issues when
|
||||
creating temporary reencryption headers.
|
||||
|
||||
* Added some FIPS mode workarounds. We cannot (yet) use Argon2 in
|
||||
FIPS mode, libcryptsetup now fallbacks to use PBKDF2 in FIPS mode.
|
||||
|
||||
* Rejects conversion to LUKS1 if PBKDF2 hash algorithms
|
||||
in keyslots differ.
|
||||
|
||||
* The hash setting on command line now applies also to LUKS2 PBKDF2
|
||||
digest. In previous versions, the LUKS2 key digest used PBKDF2-SHA256
|
||||
(except for converted headers).
|
||||
|
||||
* Allow LUKS2 keyslots area to increase if data offset allows it.
|
||||
Cryptsetup can fine-tune LUKS2 metadata area sizes through
|
||||
--luks2-metadata-size=BYTES and --luks2-keyslots-size=BYTES.
|
||||
Please DO NOT use these low-level options until you need it for
|
||||
some very specific additional feature.
|
||||
Also, the code now prints these LUKS2 header area sizes in dump
|
||||
command.
|
||||
|
||||
* For LUKS2, keyslot can use different encryption that data with
|
||||
new options --keyslot-key-size=BITS and --keyslot-cipher=STRING
|
||||
in all commands that create new LUKS keyslot.
|
||||
Please DO NOT use these low-level options until you need it for
|
||||
some very specific additional feature.
|
||||
|
||||
* Code now avoids data flush when reading device status through
|
||||
device-mapper.
|
||||
|
||||
* The Nettle crypto backend and the userspace kernel crypto API
|
||||
backend were enhanced to allow more available hash functions
|
||||
(like SHA3 variants).
|
||||
|
||||
* Upstream code now does not require libgcrypt-devel
|
||||
for autoconfigure, because OpenSSL is the default.
|
||||
The libgcrypt does not use standard pkgconfig detection and
|
||||
requires specific macro (part of libgcrypt development files)
|
||||
to be always present during autoconfigure.
|
||||
With other crypto backends, like OpenSSL, this makes no sense,
|
||||
so this part of autoconfigure is now optional.
|
||||
|
||||
* Cryptsetup now understands new --debug-json option that allows
|
||||
an additional dump of some JSON information. These are no longer
|
||||
present in standard debug output because it could contain some
|
||||
specific LUKS header parameters.
|
||||
|
||||
* The luksDump contains the hash algorithm used in Anti-Forensic
|
||||
function.
|
||||
|
||||
* All debug messages are now sent through configured log callback
|
||||
functions, so an application can easily use own debug messages
|
||||
handling. In previous versions debug messages were printed directly
|
||||
to standard output.)
|
||||
|
||||
Libcryptsetup API additions
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
These new calls are now exported, for details see libcryptsetup.h:
|
||||
|
||||
* crypt_init_data_device
|
||||
* crypt_get_metadata_device_name
|
||||
functions to init devices with separate metadata and data device
|
||||
before a format function is called.
|
||||
|
||||
* crypt_set_data_offset
|
||||
sets the data offset for LUKS to the specified value
|
||||
in 512-byte sectors.
|
||||
It should replace alignment calculation in LUKS param structures.
|
||||
|
||||
* crypt_get_metadata_size
|
||||
* crypt_set_metadata_size
|
||||
allows one to set/get area sizes in LUKS header
|
||||
(according to specification).
|
||||
|
||||
* crypt_get_default_type
|
||||
get default compiled-in LUKS type (version).
|
||||
|
||||
* crypt_get_pbkdf_type_params
|
||||
allows one to get compiled-in PBKDF parameters.
|
||||
|
||||
* crypt_keyslot_set_encryption
|
||||
* crypt_keyslot_get_encryption
|
||||
allows one to set/get per-keyslot encryption algorithm for LUKS2.
|
||||
|
||||
* crypt_keyslot_get_pbkdf
|
||||
allows one to get PBKDF parameters per-keyslot.
|
||||
|
||||
and these new defines:
|
||||
* CRYPT_LOG_DEBUG_JSON (message type for JSON debug)
|
||||
* CRYPT_DEBUG_JSON (log level for JSON debug)
|
||||
* CRYPT_ACTIVATE_RECALCULATE (dm-integrity recalculate flag)
|
||||
* CRYPT_ACTIVATE_REFRESH (new open with refresh flag)
|
||||
|
||||
All existing API calls should remain backward compatible.
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* Optional authenticated encryption is still an experimental feature
|
||||
and can have performance problems for high-speed devices and device
|
||||
with larger IO blocks (like RAID).
|
||||
|
||||
* Authenticated encryption does not use encryption for a dm-integrity
|
||||
journal. While it does not influence data confidentiality or
|
||||
integrity protection, an attacker can get some more information
|
||||
from data journal or cause that system will corrupt sectors after
|
||||
journal replay. (That corruption will be detected though.)
|
||||
|
||||
* The LUKS2 metadata area increase is mainly needed for the new online
|
||||
reencryption as the major feature for the next release.
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user