mirror of
https://gitlab.com/cryptsetup/cryptsetup.git
synced 2025-12-06 00:10:04 +01:00
Compare commits
1 Commits
tcrypt-arg
...
v1_3_0
| Author | SHA1 | Date | |
|---|---|---|---|
|
e4410550dc |
@@ -1,31 +0,0 @@
|
||||
name: "Cryptsetup CodeQL config"
|
||||
|
||||
query-filters:
|
||||
- exclude:
|
||||
id: cpp/fixme-comment
|
||||
- exclude:
|
||||
id: cpp/empty-block
|
||||
- exclude:
|
||||
id: cpp/poorly-documented-function
|
||||
- exclude:
|
||||
id: cpp/loop-variable-changed
|
||||
- exclude:
|
||||
id: cpp/empty-if
|
||||
- exclude:
|
||||
id: cpp/long-switch
|
||||
- exclude:
|
||||
id: cpp/complex-condition
|
||||
- exclude:
|
||||
id: cpp/commented-out-code
|
||||
|
||||
# These produce many false positives
|
||||
- exclude:
|
||||
id: cpp/uninitialized-local
|
||||
- exclude:
|
||||
id: cpp/path-injection
|
||||
- exclude:
|
||||
id: cpp/missing-check-scanf
|
||||
|
||||
# CodeQL should understand coverity [toctou] comments
|
||||
- exclude:
|
||||
id: cpp/toctou-race-condition
|
||||
29
.github/workflows/cibuild-setup-ubuntu.sh
vendored
29
.github/workflows/cibuild-setup-ubuntu.sh
vendored
@@ -1,29 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -ex
|
||||
|
||||
PACKAGES=(
|
||||
git make autoconf automake autopoint pkg-config libtool libtool-bin
|
||||
gettext libssl-dev libdevmapper-dev libpopt-dev uuid-dev libsepol-dev
|
||||
libjson-c-dev libssh-dev libblkid-dev tar libargon2-dev libpwquality-dev
|
||||
sharutils dmsetup jq xxd expect keyutils netcat-openbsd passwd openssh-client
|
||||
sshpass asciidoctor meson ninja-build
|
||||
)
|
||||
|
||||
COMPILER="${COMPILER:?}"
|
||||
COMPILER_VERSION="${COMPILER_VERSION:?}"
|
||||
RELEASE="$(lsb_release -cs)"
|
||||
|
||||
bash -c "echo 'deb-src http://archive.ubuntu.com/ubuntu/ $RELEASE main restricted universe multiverse' >>/etc/apt/sources.list"
|
||||
|
||||
# Latest gcc stack deb packages provided by
|
||||
# https://launchpad.net/~ubuntu-toolchain-r/+archive/ubuntu/test
|
||||
add-apt-repository -y ppa:ubuntu-toolchain-r/test
|
||||
PACKAGES+=(gcc-$COMPILER_VERSION)
|
||||
|
||||
# scsi_debug, gost crypto
|
||||
PACKAGES+=(dkms linux-headers-$(uname -r) linux-modules-extra-$(uname -r) gost-crypto-dkms)
|
||||
|
||||
apt-get -y update --fix-missing
|
||||
apt-get -y install "${PACKAGES[@]}"
|
||||
apt-get -y build-dep cryptsetup
|
||||
38
.github/workflows/cibuild.sh
vendored
38
.github/workflows/cibuild.sh
vendored
@@ -1,38 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
PHASES=(${@:-CONFIGURE MAKE CHECK})
|
||||
COMPILER="${COMPILER:?}"
|
||||
COMPILER_VERSION="${COMPILER_VERSION}"
|
||||
CFLAGS=(-O1 -g)
|
||||
CXXFLAGS=(-O1 -g)
|
||||
|
||||
CC="gcc${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
CXX="g++${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
|
||||
set -ex
|
||||
|
||||
for phase in "${PHASES[@]}"; do
|
||||
case $phase in
|
||||
CONFIGURE)
|
||||
opts=(
|
||||
--enable-libargon2
|
||||
)
|
||||
|
||||
sudo -E git clean -xdf
|
||||
|
||||
./autogen.sh
|
||||
CC="$CC" CXX="$CXX" CFLAGS="${CFLAGS[@]}" CXXFLAGS="${CXXFLAGS[@]}" ./configure "${opts[@]}"
|
||||
;;
|
||||
MAKE)
|
||||
make -j
|
||||
make -j -C tests check-programs
|
||||
;;
|
||||
CHECK)
|
||||
make check
|
||||
;;
|
||||
|
||||
*)
|
||||
echo >&2 "Unknown phase '$phase'"
|
||||
exit 1
|
||||
esac
|
||||
done
|
||||
29
.github/workflows/cibuild.yml
vendored
29
.github/workflows/cibuild.yml
vendored
@@ -1,29 +0,0 @@
|
||||
name: Build test
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- 'main'
|
||||
- 'wip-luks2'
|
||||
- 'v2.*.x'
|
||||
paths-ignore:
|
||||
- 'docs/**'
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
if: github.repository == 'mbroz/cryptsetup'
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
env:
|
||||
- { COMPILER: "gcc", COMPILER_VERSION: "14", RUN_SSH_PLUGIN_TEST: "1" }
|
||||
env: ${{ matrix.env }}
|
||||
steps:
|
||||
- name: Repository checkout
|
||||
uses: actions/checkout@v4
|
||||
- name: Ubuntu setup
|
||||
run: sudo -E .github/workflows/cibuild-setup-ubuntu.sh
|
||||
- name: Configure & Make
|
||||
run: .github/workflows/cibuild.sh CONFIGURE MAKE
|
||||
- name: Check
|
||||
run: sudo -E .github/workflows/cibuild.sh CHECK
|
||||
53
.github/workflows/codeql.yml
vendored
53
.github/workflows/codeql.yml
vendored
@@ -1,53 +0,0 @@
|
||||
name: "CodeQL"
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- 'main'
|
||||
- 'wip-luks2'
|
||||
- 'v2.*.x'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
analyze:
|
||||
name: Analyze
|
||||
runs-on: ubuntu-latest
|
||||
if: github.repository == 'mbroz/cryptsetup'
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ matrix.language }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
permissions:
|
||||
actions: read
|
||||
security-events: write
|
||||
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
language: [ 'cpp' ]
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@v3
|
||||
with:
|
||||
languages: ${{ matrix.language }}
|
||||
queries: +security-extended,security-and-quality
|
||||
config-file: .codeql-config.yml
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
sudo -E .github/workflows/cibuild-setup-ubuntu.sh
|
||||
# Force autoconf for now, meson is broken in analysis step
|
||||
rm meson.build
|
||||
|
||||
env: { COMPILER: "gcc", COMPILER_VERSION: "14", RUN_SSH_PLUGIN_TEST: "1" }
|
||||
|
||||
- name: Autobuild
|
||||
uses: github/codeql-action/autobuild@v3
|
||||
|
||||
- name: Perform CodeQL Analysis
|
||||
uses: github/codeql-action/analyze@v3
|
||||
48
.github/workflows/coverity.yml
vendored
48
.github/workflows/coverity.yml
vendored
@@ -1,48 +0,0 @@
|
||||
name: Coverity test
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- 'coverity_scan'
|
||||
paths-ignore:
|
||||
- 'docs/**'
|
||||
|
||||
jobs:
|
||||
latest:
|
||||
runs-on: ubuntu-latest
|
||||
if: github.repository == 'mbroz/cryptsetup'
|
||||
steps:
|
||||
- name: Repository checkout
|
||||
uses: actions/checkout@v4
|
||||
- name: Ubuntu setup
|
||||
run: sudo -E .github/workflows/cibuild-setup-ubuntu.sh
|
||||
env:
|
||||
COMPILER: "gcc"
|
||||
COMPILER_VERSION: "14"
|
||||
- name: Install Coverity
|
||||
run: |
|
||||
wget -q https://scan.coverity.com/download/cxx/linux64 --post-data "token=$TOKEN&project=mbroz/cryptsetup" -O cov-analysis-linux64.tar.gz
|
||||
mkdir cov-analysis-linux64
|
||||
tar xzf cov-analysis-linux64.tar.gz --strip 1 -C cov-analysis-linux64
|
||||
env:
|
||||
TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
|
||||
- name: Run autoconf & configure
|
||||
run: |
|
||||
./autogen.sh
|
||||
./configure
|
||||
- name: Run cov-build
|
||||
run: |
|
||||
export PATH=`pwd`/cov-analysis-linux64/bin:$PATH
|
||||
cov-build --dir cov-int make
|
||||
- name: Submit to Coverity Scan
|
||||
run: |
|
||||
tar czvf cryptsetup.tgz cov-int
|
||||
curl \
|
||||
--form project=mbroz/cryptsetup \
|
||||
--form token=$TOKEN \
|
||||
--form email=gmazyland@gmail.com \
|
||||
--form file=@cryptsetup.tgz \
|
||||
--form version=trunk \
|
||||
--form description="`./cryptsetup --version`" \
|
||||
https://scan.coverity.com/builds?project=mbroz/cryptsetup
|
||||
env:
|
||||
TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
|
||||
62
.gitignore
vendored
62
.gitignore
vendored
@@ -1,62 +0,0 @@
|
||||
po/*gmo
|
||||
*~
|
||||
Makefile
|
||||
Makefile.in
|
||||
Makefile.in.in
|
||||
*.lo
|
||||
*.la
|
||||
*.o
|
||||
*.so
|
||||
*.8
|
||||
**/*.dirstamp
|
||||
.deps/
|
||||
.libs/
|
||||
src/cryptsetup
|
||||
src/veritysetup
|
||||
ABOUT-NLS
|
||||
aclocal.m4
|
||||
autom4te.cache/
|
||||
compile
|
||||
compile_commands.json
|
||||
config.guess
|
||||
config.h
|
||||
config.h.in
|
||||
config.log
|
||||
config.rpath
|
||||
config.status
|
||||
config.sub
|
||||
configure
|
||||
cryptsetup
|
||||
cryptsetup-reencrypt
|
||||
cryptsetup-ssh
|
||||
depcomp
|
||||
install-sh
|
||||
integritysetup
|
||||
lib/libcryptsetup.pc
|
||||
libtool
|
||||
ltmain.sh
|
||||
m4/
|
||||
missing
|
||||
po/Makevars.template
|
||||
po/POTFILES
|
||||
po/Rules-quot
|
||||
po/*.header
|
||||
po/*.sed
|
||||
po/*.sin
|
||||
po/stamp-po
|
||||
scripts/cryptsetup.conf
|
||||
stamp-h1
|
||||
veritysetup
|
||||
tests/valglog.*
|
||||
*/*.dirstamp
|
||||
*-debug-luks2-backup*
|
||||
tests/api-test
|
||||
tests/api-test-2
|
||||
tests/differ
|
||||
tests/luks1-images
|
||||
tests/tcrypt-images
|
||||
tests/unit-utils-io
|
||||
tests/vectors-test
|
||||
tests/test-symbols-list.h
|
||||
tests/all-symbols-test
|
||||
tests/fuzz/LUKS2.pb*
|
||||
@@ -1,23 +0,0 @@
|
||||
stages:
|
||||
- test
|
||||
- test-opal
|
||||
|
||||
.fail_if_coredump_generated:
|
||||
after_script:
|
||||
- '[ "$(ls -A /var/coredumps)" ] && exit 1 || true'
|
||||
|
||||
include:
|
||||
- local: .gitlab/ci/debian.yml
|
||||
- local: .gitlab/ci/fedora.yml
|
||||
- local: .gitlab/ci/fedora-opal.yml
|
||||
- local: .gitlab/ci/centos.yml
|
||||
# - local: .gitlab/ci/annocheck.yml
|
||||
- local: .gitlab/ci/csmock.yml
|
||||
- local: .gitlab/ci/gitlab-shared-docker.yml
|
||||
- local: .gitlab/ci/compilation-various-disables.yml
|
||||
- local: .gitlab/ci/compilation-gcc.gitlab-ci.yml
|
||||
- local: .gitlab/ci/compilation-clang.gitlab-ci.yml
|
||||
- local: .gitlab/ci/compilation-spellcheck.yml
|
||||
- local: .gitlab/ci/alpinelinux.yml
|
||||
- local: .gitlab/ci/debian-i686.yml
|
||||
- local: .gitlab/ci/cifuzz.yml
|
||||
@@ -1,57 +0,0 @@
|
||||
.alpinelinux-dependencies:
|
||||
variables:
|
||||
DISTRO: cryptsetup-alpine-edge
|
||||
extends:
|
||||
- .fail_if_coredump_generated
|
||||
before_script:
|
||||
- >
|
||||
sudo apk add
|
||||
lvm2-dev openssl-dev popt-dev util-linux-dev json-c-dev
|
||||
argon2-dev device-mapper which sharutils gettext-dev argp-standalone automake
|
||||
autoconf libtool build-base keyutils tar jq expect git asciidoctor
|
||||
# Be sure we have updated basic tools and system
|
||||
- sudo apk upgrade gcc binutils build-base musl
|
||||
- ./autogen.sh
|
||||
- ./configure --prefix=/usr --libdir=/lib --sbindir=/sbin --disable-static --enable-libargon2 --with-crypto_backend=openssl --disable-external-tokens --disable-ssh-token --enable-asciidoc
|
||||
|
||||
test-main-commit-job-alpinelinux:
|
||||
extends:
|
||||
- .alpinelinux-dependencies
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-alpine-edge
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
RUN_SSH_PLUGIN_TEST: "0"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-mergerq-job-alpinelinux:
|
||||
extends:
|
||||
- .alpinelinux-dependencies
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-alpine-edge
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
RUN_SSH_PLUGIN_TEST: "0"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
@@ -1,18 +0,0 @@
|
||||
test-main-commit-job-annocheck:
|
||||
extends:
|
||||
- .fail_if_coredump_generated
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-rhel-9
|
||||
stage: test
|
||||
interruptible: true
|
||||
allow_failure: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-rhel-9
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- sudo /opt/run-annocheck.sh
|
||||
@@ -1,32 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
SAVED_PWD=$(pwd)
|
||||
GIT_DIR="$SAVED_PWD/upstream_git"
|
||||
SPEC="$GIT_DIR/misc/fedora/cryptsetup.spec"
|
||||
|
||||
rm -fr $GIT_DIR
|
||||
|
||||
git clone -q --depth 1 https://gitlab.com/cryptsetup/cryptsetup.git $GIT_DIR
|
||||
cd $GIT_DIR
|
||||
|
||||
GIT_COMMIT=$(git rev-parse --short=8 HEAD)
|
||||
[ -z "$GIT_COMMIT" ] && exit 1
|
||||
|
||||
sed -i "s/^AC_INIT.*/AC_INIT([cryptsetup],[$GIT_COMMIT])/" $GIT_DIR/configure.ac
|
||||
sed -i "s/^Version:.*/Version: $GIT_COMMIT/" $SPEC
|
||||
sed -i "s/%{version_no_tilde}/$GIT_COMMIT/" $SPEC
|
||||
sed -i "2i %global source_date_epoch_from_changelog 0" $SPEC
|
||||
sed -i "3i %define _unpackaged_files_terminate_build 0" $SPEC
|
||||
|
||||
./autogen.sh
|
||||
./configure
|
||||
make -j dist
|
||||
|
||||
rpmbuild --define "_sourcedir $GIT_DIR" --define "_srcrpmdir $SAVED_PWD" -bs $SPEC
|
||||
|
||||
cd $SAVED_PWD
|
||||
rm -fr $GIT_DIR
|
||||
|
||||
exit 0
|
||||
@@ -1,111 +0,0 @@
|
||||
.centos-openssl-backend:
|
||||
extends:
|
||||
- .fail_if_coredump_generated
|
||||
before_script:
|
||||
- sudo dnf clean all
|
||||
- >
|
||||
sudo dnf -y -q install
|
||||
autoconf automake device-mapper-devel gcc gettext-devel json-c-devel
|
||||
libblkid-devel libpwquality-devel libselinux-devel libssh-devel libtool
|
||||
libuuid-devel make popt-devel libsepol-devel nc openssh-clients passwd
|
||||
pkgconfig sharutils sshpass tar uuid-devel vim-common device-mapper
|
||||
expect gettext git jq keyutils openssl-devel openssl gem swtpm swtpm-tools
|
||||
tpm2-tools
|
||||
- sudo gem install asciidoctor
|
||||
- sudo -E git clean -xdf
|
||||
- ./autogen.sh
|
||||
- ./configure --enable-fips --enable-pwquality --with-crypto_backend=openssl --enable-asciidoc
|
||||
|
||||
# non-FIPS jobs
|
||||
|
||||
test-main-commit-centos-stream9:
|
||||
extends:
|
||||
- .centos-openssl-backend
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-centos-stream-9
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-centos-stream-9
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-mergerq-centos-stream9:
|
||||
extends:
|
||||
- .centos-openssl-backend
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-centos-stream-9
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-centos-stream-9
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-main-commit-centos-stream10:
|
||||
extends:
|
||||
- .centos-openssl-backend
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-centos-stream-10
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-centos-stream-10
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-mergerq-centos-stream10:
|
||||
extends:
|
||||
- .centos-openssl-backend
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-centos-stream-10
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-centos-stream-10
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
@@ -1,47 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -ex
|
||||
|
||||
PACKAGES=(
|
||||
git make autoconf automake autopoint pkg-config libtool libtool-bin
|
||||
gettext libssl-dev libdevmapper-dev libpopt-dev uuid-dev libsepol-dev
|
||||
libjson-c-dev libssh-dev libblkid-dev tar libargon2-dev libpwquality-dev
|
||||
sharutils dmsetup jq xxd expect keyutils netcat-openbsd passwd openssh-client
|
||||
sshpass asciidoctor
|
||||
)
|
||||
|
||||
COMPILER="${COMPILER:?}"
|
||||
COMPILER_VERSION="${COMPILER_VERSION:?}"
|
||||
|
||||
sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/ubuntu.sources
|
||||
|
||||
# use this on older Ubuntu
|
||||
# grep -E '^deb' /etc/apt/sources.list > /etc/apt/sources.list~
|
||||
# sed -Ei 's/^deb /deb-src /' /etc/apt/sources.list~
|
||||
# cat /etc/apt/sources.list~ >> /etc/apt/sources.list
|
||||
|
||||
apt-get -y update --fix-missing
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -yq install software-properties-common wget lsb-release
|
||||
RELEASE="$(lsb_release -cs)"
|
||||
|
||||
if [[ $COMPILER == "gcc" ]]; then
|
||||
# Latest gcc stack deb packages provided by
|
||||
# https://launchpad.net/~ubuntu-toolchain-r/+archive/ubuntu/test
|
||||
add-apt-repository -y ppa:ubuntu-toolchain-r/test
|
||||
PACKAGES+=(gcc-$COMPILER_VERSION)
|
||||
elif [[ $COMPILER == "clang" ]]; then
|
||||
wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | apt-key add -
|
||||
add-apt-repository -n "deb http://apt.llvm.org/${RELEASE}/ llvm-toolchain-${RELEASE}-${COMPILER_VERSION} main"
|
||||
|
||||
# scan-build
|
||||
PACKAGES+=(clang-tools-$COMPILER_VERSION clang-$COMPILER_VERSION lldb-$COMPILER_VERSION lld-$COMPILER_VERSION clangd-$COMPILER_VERSION)
|
||||
PACKAGES+=(perl)
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
|
||||
#apt-get -y update --fix-missing
|
||||
(r=3;while ! apt-get -y update --fix-missing ; do ((--r))||exit;sleep 5;echo "Retrying";done)
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -yq install "${PACKAGES[@]}"
|
||||
apt-get -y build-dep cryptsetup
|
||||
@@ -1,46 +0,0 @@
|
||||
cifuzz:
|
||||
variables:
|
||||
OSS_FUZZ_PROJECT_NAME: cryptsetup
|
||||
CFL_PLATFORM: gitlab
|
||||
CIFUZZ_DEBUG: "True"
|
||||
FUZZ_SECONDS: 300 # 5 minutes per fuzzer
|
||||
ARCHITECTURE: "x86_64"
|
||||
DRY_RUN: "False"
|
||||
LOW_DISK_SPACE: "True"
|
||||
BAD_BUILD_CHECK: "True"
|
||||
LANGUAGE: "c"
|
||||
DOCKER_HOST: "tcp://docker:2375"
|
||||
DOCKER_IN_DOCKER: "true"
|
||||
DOCKER_DRIVER: overlay2
|
||||
DOCKER_TLS_CERTDIR: ""
|
||||
image:
|
||||
name: gcr.io/oss-fuzz-base/cifuzz-base
|
||||
entrypoint: [""]
|
||||
services:
|
||||
- docker:dind
|
||||
|
||||
stage: test
|
||||
parallel:
|
||||
matrix:
|
||||
- SANITIZER: [address, undefined, memory]
|
||||
rules:
|
||||
# Default code change.
|
||||
# - if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
# variables:
|
||||
# MODE: "code-change"
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $BUILD_AND_RUN_FUZZERS != null
|
||||
before_script:
|
||||
# Get gitlab's container id.
|
||||
- export CFL_CONTAINER_ID=`cut -c9- < /proc/1/cpuset`
|
||||
script:
|
||||
# Will build and run the fuzzers.
|
||||
# We use a hack to override CI_JOB_ID, because otherwise a bad path is used
|
||||
# in GitLab CI environment
|
||||
- CI_JOB_ID="$CI_PROJECT_NAMESPACE/$CI_PROJECT_TITLE" python3 "/opt/oss-fuzz/infra/cifuzz/cifuzz_combined_entrypoint.py"
|
||||
artifacts:
|
||||
# Upload artifacts when a crash makes the job fail.
|
||||
when: always
|
||||
paths:
|
||||
- artifacts/
|
||||
@@ -1,48 +0,0 @@
|
||||
#!/bin/bash
|
||||
# clang -Wall plus other important warnings not included in -Wall
|
||||
|
||||
for arg in "$@"
|
||||
do
|
||||
case $arg in
|
||||
-O*) Wuninitialized=-Wuninitialized;; # only makes sense with `-O'
|
||||
esac
|
||||
done
|
||||
|
||||
CLANG="clang${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
|
||||
#PEDANTIC="-std=gnu99"
|
||||
#PEDANTIC="-pedantic -std=gnu99"
|
||||
#PEDANTIC="-pedantic -std=gnu99 -Wno-variadic-macros"
|
||||
#CONVERSION="-Wconversion"
|
||||
|
||||
EXTRA="\
|
||||
-Wextra \
|
||||
-Wsign-compare \
|
||||
-Wcast-align
|
||||
-Werror-implicit-function-declaration \
|
||||
-Wpointer-arith \
|
||||
-Wwrite-strings \
|
||||
-Wswitch \
|
||||
-Wmissing-format-attribute \
|
||||
-Winit-self \
|
||||
-Wold-style-definition \
|
||||
-Wno-missing-field-initializers \
|
||||
-Wunused-parameter \
|
||||
-Wno-long-long"
|
||||
|
||||
exec $CLANG $PEDANTIC $CONVERSION \
|
||||
-Wall $Wuninitialized \
|
||||
-Wno-switch \
|
||||
-Wdisabled-optimization \
|
||||
-Wwrite-strings \
|
||||
-Wpointer-arith \
|
||||
-Wbad-function-cast \
|
||||
-Wmissing-prototypes \
|
||||
-Wmissing-declarations \
|
||||
-Wstrict-prototypes \
|
||||
-Wnested-externs \
|
||||
-Wcomment \
|
||||
-Winline \
|
||||
-Wcast-qual \
|
||||
-Wredundant-decls $EXTRA \
|
||||
"$@"
|
||||
@@ -1,88 +0,0 @@
|
||||
test-clang-compilation:
|
||||
extends:
|
||||
- .gitlab-shared-clang
|
||||
script:
|
||||
- export CFLAGS="-Wall -Werror"
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure
|
||||
- make -j
|
||||
- make -j check-programs
|
||||
|
||||
test-clang-Wall-script-ubuntu:
|
||||
extends:
|
||||
- .gitlab-shared-clang
|
||||
script:
|
||||
- export CFLAGS="-g -O0"
|
||||
- export CC="$CI_PROJECT_DIR/.gitlab/ci/clang-Wall"
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure
|
||||
- make -j CFLAGS="-g -O0 -Werror"
|
||||
- make -j CFLAGS="-g -O0 -Werror" check-programs
|
||||
|
||||
test-clang-Wall-script-alpine:
|
||||
extends:
|
||||
- .gitlab-shared-clang-alpine
|
||||
allow_failure: true
|
||||
script:
|
||||
- export CFLAGS="-g -O0"
|
||||
- export CC="$CI_PROJECT_DIR/.gitlab/ci/clang-Wall"
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure
|
||||
- make -j CFLAGS="-g -O0 -Werror"
|
||||
- make -j CFLAGS="-g -O0 -Werror" check-programs
|
||||
|
||||
test-scan-build-ubuntu:
|
||||
extends:
|
||||
- .gitlab-shared-clang
|
||||
script:
|
||||
- ./autogen.sh
|
||||
- echo "scan-build${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} -V ./configure CFLAGS="-g -O0"
|
||||
- make clean
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j check-programs
|
||||
|
||||
test-scan-build-alpine:
|
||||
extends:
|
||||
- .gitlab-shared-clang-alpine
|
||||
allow_failure: true
|
||||
script:
|
||||
- ./autogen.sh
|
||||
- echo "scan-build${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} -V ./configure CFLAGS="-g -O0"
|
||||
- make clean
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j check-programs
|
||||
|
||||
test-scan-build-backends:
|
||||
extends:
|
||||
- .gitlab-shared-clang
|
||||
parallel:
|
||||
matrix:
|
||||
- BACKENDS: [
|
||||
"openssl",
|
||||
"gcrypt",
|
||||
"nss",
|
||||
"kernel",
|
||||
"nettle",
|
||||
"mbedtls"
|
||||
]
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
changes:
|
||||
- lib/crypto_backend/*
|
||||
script:
|
||||
- DEBIAN_FRONTEND=noninteractive apt-get -yq install libgcrypt20-dev libnss3-dev nettle-dev libmbedtls-dev
|
||||
- ./autogen.sh
|
||||
- echo "Configuring with crypto backend $BACKENDS"
|
||||
- echo "scan-build${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} -V ./configure CFLAGS="-g -O0" --with-crypto_backend=$BACKENDS
|
||||
- make clean
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j
|
||||
- scan-build${COMPILER_VERSION:+-$COMPILER_VERSION} --status-bugs -maxloop 10 make -j check-programs
|
||||
- ./tests/vectors-test
|
||||
@@ -1,85 +0,0 @@
|
||||
test-gcc-compilation:
|
||||
extends:
|
||||
- .gitlab-shared-gcc
|
||||
script:
|
||||
- export CFLAGS="-Wall -Werror"
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure
|
||||
- make -j
|
||||
- make -j check-programs
|
||||
|
||||
test-gcc-Wall-script-ubuntu:
|
||||
extends:
|
||||
- .gitlab-shared-gcc
|
||||
script:
|
||||
- export CFLAGS="-g -O0"
|
||||
- export CC="$CI_PROJECT_DIR/.gitlab/ci/gcc-Wall"
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure
|
||||
- make -j CFLAGS="-g -O0 -Werror"
|
||||
- make -j CFLAGS="-g -O0 -Werror" check-programs
|
||||
|
||||
test-gcc-Wall-script-alpine:
|
||||
extends:
|
||||
- .gitlab-shared-gcc-alpine
|
||||
allow_failure: true
|
||||
script:
|
||||
- export CFLAGS="-g -O0"
|
||||
- export CC="$CI_PROJECT_DIR/.gitlab/ci/gcc-Wall"
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure
|
||||
- make -j CFLAGS="-g -O0 -Werror"
|
||||
- make -j CFLAGS="-g -O0 -Werror" check-programs
|
||||
|
||||
test-gcc-fanalyzer-ubuntu:
|
||||
extends:
|
||||
- .gitlab-shared-gcc
|
||||
script:
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure CFLAGS="-Wall -Werror -g -O0 -fanalyzer -fdiagnostics-path-format=separate-events" --host=x86_64
|
||||
- make -j
|
||||
- make -j check-programs
|
||||
|
||||
test-gcc-fanalyzer-alpine:
|
||||
extends:
|
||||
- .gitlab-shared-gcc-alpine
|
||||
allow_failure: true
|
||||
script:
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- ./configure CFLAGS="-Wall -Werror -g -O0 -fanalyzer -fdiagnostics-path-format=separate-events -Wno-analyzer-fd-leak" --host=x86_64
|
||||
- make -j
|
||||
- make -j check-programs
|
||||
|
||||
test-gcc-fanalyzer-backends:
|
||||
extends:
|
||||
- .gitlab-shared-gcc
|
||||
parallel:
|
||||
matrix:
|
||||
- BACKENDS: [
|
||||
"openssl",
|
||||
"gcrypt",
|
||||
"nss",
|
||||
"kernel",
|
||||
"nettle",
|
||||
"mbedtls"
|
||||
]
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
changes:
|
||||
- lib/crypto_backend/*
|
||||
script:
|
||||
- DEBIAN_FRONTEND=noninteractive apt-get -yq install libgcrypt20-dev libnss3-dev nettle-dev libmbedtls-dev
|
||||
- ./autogen.sh
|
||||
- $CC --version
|
||||
- echo "Configuring with crypto backend $BACKENDS"
|
||||
- ./configure CFLAGS="-Wall -Werror -g -O0 -fanalyzer -fdiagnostics-path-format=separate-events" --host=x86_64 --with-crypto_backend=$BACKENDS
|
||||
- make -j
|
||||
- make -j check-programs
|
||||
- ./tests/vectors-test
|
||||
@@ -1,20 +0,0 @@
|
||||
test-run-spellcheck:
|
||||
image: ubuntu:noble
|
||||
tags:
|
||||
- gitlab-org-docker
|
||||
stage: test
|
||||
interruptible: true
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
artifacts:
|
||||
name: "spellcheck-$CI_COMMIT_REF_NAME"
|
||||
paths:
|
||||
- _spellcheck
|
||||
before_script:
|
||||
- apt-get -y update --fix-missing
|
||||
- apt-get -y install git lintian codespell
|
||||
script:
|
||||
- echo "Running spellcheck"
|
||||
- .gitlab/ci/spellcheck
|
||||
@@ -1,33 +0,0 @@
|
||||
test-gcc-disable-compiles:
|
||||
extends:
|
||||
- .gitlab-shared-gcc
|
||||
parallel:
|
||||
matrix:
|
||||
- DISABLE_FLAGS: [
|
||||
"keyring",
|
||||
"external-tokens ssh-token",
|
||||
"luks2-reencryption",
|
||||
"cryptsetup veritysetup integritysetup",
|
||||
"kernel_crypto",
|
||||
"udev",
|
||||
"internal-argon2",
|
||||
"blkid",
|
||||
"hw-opal"
|
||||
]
|
||||
artifacts:
|
||||
name: "meson-build-logs-$CI_COMMIT_REF_NAME"
|
||||
paths:
|
||||
- meson_builddir/meson-logs
|
||||
script:
|
||||
- DEBIAN_FRONTEND=noninteractive apt-get -yq install meson ninja-build
|
||||
- export CFLAGS="-Wall -Werror"
|
||||
- ./autogen.sh
|
||||
- echo "Configuring with --disable-$DISABLE_FLAGS"
|
||||
- ./configure $(for i in $DISABLE_FLAGS; do echo "--disable-$i"; done)
|
||||
- make -j
|
||||
- make -j check-programs
|
||||
- git checkout -f && git clean -xdf
|
||||
- meson -v
|
||||
- echo "Configuring with -D$DISABLE_FLAGS=false"
|
||||
- meson setup meson_builddir $(for i in $DISABLE_FLAGS; do [ "$i" == "internal-argon2" ] && echo "-Dargon-implementation=internal" || echo "-D$i=false"; done)
|
||||
- ninja -C meson_builddir
|
||||
@@ -1,36 +0,0 @@
|
||||
.dnf-csmock:
|
||||
variables:
|
||||
DISTRO: cryptsetup-fedora-rawhide
|
||||
DISK_SIZE: 20
|
||||
extends:
|
||||
- .fail_if_coredump_generated
|
||||
before_script:
|
||||
- >
|
||||
sudo dnf -y -q install
|
||||
autoconf automake device-mapper-devel gcc gettext-devel json-c-devel
|
||||
libblkid-devel libpwquality-devel libselinux-devel
|
||||
libssh-devel libtool libuuid-devel make popt-devel
|
||||
libsepol-devel.x86_64 pkgconfig tar uuid-devel git
|
||||
openssl-devel asciidoctor meson ninja-build
|
||||
rpm-build csmock
|
||||
|
||||
test-commit-job-csmock:
|
||||
extends:
|
||||
- .dnf-csmock
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-fedora-rawhide
|
||||
stage: test
|
||||
interruptible: true
|
||||
allow_failure: true
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/ || $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- .gitlab/ci/build_srpm
|
||||
- .gitlab/ci/run_csmock
|
||||
artifacts:
|
||||
when: always
|
||||
paths:
|
||||
- cryptsetup-csmock-results.tar.xz
|
||||
@@ -1,43 +0,0 @@
|
||||
test-mergerq-job-debian-i686:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-12i686
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-12i686
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-main-commit-job-debian-i686:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-12i686
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-12i686
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
rules:
|
||||
- if: $RUN_SYSTEMD_PLUGIN_TEST != null
|
||||
when: never
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
@@ -1,104 +0,0 @@
|
||||
.debian-prep:
|
||||
extends:
|
||||
- .fail_if_coredump_generated
|
||||
before_script:
|
||||
- sudo apt-get -y update
|
||||
- >
|
||||
sudo apt-get -y install -y -qq git gcc make autoconf automake autopoint
|
||||
pkgconf libtool libtool-bin gettext libssl-dev libdevmapper-dev
|
||||
libpopt-dev uuid-dev libsepol-dev libjson-c-dev libssh-dev libblkid-dev
|
||||
tar libargon2-dev libpwquality-dev sharutils dmsetup jq xxd expect
|
||||
keyutils netcat-openbsd passwd openssh-client sshpass asciidoctor
|
||||
swtpm meson ninja-build python3-jinja2 gperf libcap-dev libtss2-dev
|
||||
libmount-dev swtpm-tools tpm2-tools
|
||||
- sudo apt-get -y build-dep cryptsetup
|
||||
- sudo -E git clean -xdf
|
||||
- ./autogen.sh
|
||||
- ./configure --enable-libargon2 --enable-asciidoc
|
||||
|
||||
test-mergerq-job-debian:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-12
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-12
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-main-commit-job-debian:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-12
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-12
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
# meson tests
|
||||
test-mergerq-job-debian-meson:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-12
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-12
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- sudo apt-get -y install -y -qq meson ninja-build
|
||||
- meson setup build
|
||||
- ninja -C build
|
||||
- cd build && sudo -E meson test --verbose --print-errorlogs
|
||||
|
||||
test-main-commit-job-debian-meson:
|
||||
extends:
|
||||
- .debian-prep
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-debian-12
|
||||
stage: test
|
||||
interruptible: true
|
||||
variables:
|
||||
DISTRO: cryptsetup-debian-12
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- sudo apt-get -y install -y -qq meson ninja-build
|
||||
- meson setup build
|
||||
- ninja -C build
|
||||
- cd build && sudo -E meson test --verbose --print-errorlogs
|
||||
@@ -1,145 +0,0 @@
|
||||
.opal-template-fedora:
|
||||
extends:
|
||||
- .dnf-openssl-backend
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-fedora-rawhide
|
||||
stage: test-opal
|
||||
interruptible: false
|
||||
variables:
|
||||
OPAL2_DEV: "/dev/nvme0n1"
|
||||
OPAL2_PSID_FILE: "/home/gitlab-runner/psid.txt"
|
||||
VOLATILE: 1
|
||||
script:
|
||||
- sudo dnf install -y -q nvme-cli
|
||||
- sudo nvme list
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check TESTS="00modules-test compat-test-opal"
|
||||
|
||||
# Samsung SSD 980 500GB (on tiber machine)
|
||||
test-commit-rawhide-samsung980:
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
extends:
|
||||
- .opal-template-fedora
|
||||
tags:
|
||||
- tiber
|
||||
resource_group: samsung980-on-tiber
|
||||
interruptible: false
|
||||
variables:
|
||||
PCI_PASSTHROUGH_VENDOR_ID: "144d"
|
||||
PCI_PASSTHROUGH_DEVICE_ID: "a809"
|
||||
|
||||
test-mergerq-rawhide-samsung980:
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
extends:
|
||||
- .opal-template-fedora
|
||||
tags:
|
||||
- tiber
|
||||
resource_group: samsung980-on-tiber
|
||||
interruptible: false
|
||||
variables:
|
||||
PCI_PASSTHROUGH_VENDOR_ID: "144d"
|
||||
PCI_PASSTHROUGH_DEVICE_ID: "a809"
|
||||
|
||||
# WD PC SN740 SDDQNQD-512G-1014 (on tiber machine)
|
||||
# Disabled on 2025-03-20, seems broken
|
||||
#test-commit-rawhide-sn740:
|
||||
# rules:
|
||||
# - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
# when: never
|
||||
# - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
# extends:
|
||||
# - .opal-template-fedora
|
||||
# tags:
|
||||
# - tiber
|
||||
# resource_group: sn740-on-tiber
|
||||
# interruptible: false
|
||||
# variables:
|
||||
# PCI_PASSTHROUGH_VENDOR_ID: "15b7"
|
||||
# PCI_PASSTHROUGH_DEVICE_ID: "5017"
|
||||
#
|
||||
#test-mergerq-rawhide-sn740:
|
||||
# rules:
|
||||
# - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
# when: never
|
||||
# - if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
# extends:
|
||||
# - .opal-template-fedora
|
||||
# tags:
|
||||
# - tiber
|
||||
# resource_group: sn740-on-tiber
|
||||
# interruptible: false
|
||||
# variables:
|
||||
# PCI_PASSTHROUGH_VENDOR_ID: "15b7"
|
||||
# PCI_PASSTHROUGH_DEVICE_ID: "5017"
|
||||
|
||||
# Samsung SSD 980 PRO 1TB (on trantor machine)
|
||||
test-commit-rawhide-samsung980pro:
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
extends:
|
||||
- .opal-template-fedora
|
||||
tags:
|
||||
- trantor
|
||||
resource_group: samsung980pro-on-trantor
|
||||
interruptible: false
|
||||
variables:
|
||||
PCI_PASSTHROUGH_VENDOR_ID: "144d"
|
||||
PCI_PASSTHROUGH_DEVICE_ID: "a80a"
|
||||
|
||||
test-mergerq-rawhide-samsung980pro:
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
extends:
|
||||
- .opal-template-fedora
|
||||
tags:
|
||||
- trantor
|
||||
resource_group: samsung980pro-on-trantor
|
||||
interruptible: false
|
||||
variables:
|
||||
PCI_PASSTHROUGH_VENDOR_ID: "144d"
|
||||
PCI_PASSTHROUGH_DEVICE_ID: "a80a"
|
||||
|
||||
# # UMIS RPETJ256MGE2MDQ (on tiber machine)
|
||||
# test-commit-rawhide-umis:
|
||||
# rules:
|
||||
# - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
# when: never
|
||||
# - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
# extends:
|
||||
# - .opal-template-fedora
|
||||
# tags:
|
||||
# - tiber
|
||||
# resource_group: umis-on-tiber
|
||||
# stage: test
|
||||
# interruptible: false
|
||||
# variables:
|
||||
# PCI_PASSTHROUGH_VENDOR_ID: "1cc4"
|
||||
# PCI_PASSTHROUGH_DEVICE_ID: "6302"
|
||||
#
|
||||
# test-mergerq-rawhide-umis:
|
||||
# rules:
|
||||
# - if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
# when: never
|
||||
# - if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
# extends:
|
||||
# - .opal-template-fedora
|
||||
# tags:
|
||||
# - tiber
|
||||
# resource_group: umis-on-tiber
|
||||
# stage: test
|
||||
# interruptible: false
|
||||
# variables:
|
||||
# PCI_PASSTHROUGH_VENDOR_ID: "1cc4"
|
||||
# PCI_PASSTHROUGH_DEVICE_ID: "6302"
|
||||
@@ -1,63 +0,0 @@
|
||||
.dnf-openssl-backend:
|
||||
variables:
|
||||
DISTRO: cryptsetup-fedora-rawhide
|
||||
PKGS: >-
|
||||
autoconf automake device-mapper-devel gcc gettext-devel json-c-devel
|
||||
libargon2-devel libblkid-devel libpwquality-devel libselinux-devel
|
||||
libssh-devel libtool libuuid-devel make popt-devel
|
||||
libsepol-devel.x86_64 netcat openssh-clients passwd pkgconfig sharutils
|
||||
sshpass tar uuid-devel vim-common device-mapper expect gettext git jq
|
||||
keyutils openssl-devel openssl asciidoctor swtpm meson ninja-build
|
||||
python3-jinja2 gperf libcap-devel tpm2-tss-devel libmount-devel swtpm-tools
|
||||
extends:
|
||||
- .fail_if_coredump_generated
|
||||
before_script:
|
||||
- sudo dnf clean all
|
||||
- (r=3;while ! sudo dnf -y -q install $PKGS ; do ((--r))||exit;sleep 5;echo "Retrying";done)
|
||||
- sudo -E git clean -xdf
|
||||
- ./autogen.sh
|
||||
- ./configure --enable-fips --enable-pwquality --enable-libargon2 --with-crypto_backend=openssl --enable-asciidoc
|
||||
|
||||
test-main-commit-job-rawhide:
|
||||
extends:
|
||||
- .dnf-openssl-backend
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-fedora-rawhide
|
||||
stage: test
|
||||
interruptible: true
|
||||
allow_failure: true
|
||||
variables:
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
RUN_SYSTEMD_PLUGIN_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
|
||||
test-mergerq-job-rawhide:
|
||||
extends:
|
||||
- .dnf-openssl-backend
|
||||
tags:
|
||||
- libvirt
|
||||
- cryptsetup-fedora-rawhide
|
||||
stage: test
|
||||
interruptible: true
|
||||
allow_failure: true
|
||||
variables:
|
||||
RUN_SSH_PLUGIN_TEST: "1"
|
||||
RUN_KEYRING_TRUSTED_TEST: "1"
|
||||
RUN_SYSTEMD_PLUGIN_TEST: "1"
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
script:
|
||||
- make -j
|
||||
- make -j -C tests check-programs
|
||||
- sudo -E make check
|
||||
@@ -1,58 +0,0 @@
|
||||
#!/bin/bash
|
||||
# gcc -Wall plus other important warnings not included in -Wall
|
||||
|
||||
for arg in "$@"
|
||||
do
|
||||
case $arg in
|
||||
-O*) Wuninitialized=-Wuninitialized;; # only makes sense with `-O'
|
||||
esac
|
||||
done
|
||||
|
||||
GCC="gcc${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
|
||||
#PEDANTIC="-std=gnu99"
|
||||
#PEDANTIC="-pedantic -std=gnu99"
|
||||
#PEDANTIC="-pedantic -std=gnu99 -Wno-variadic-macros"
|
||||
#CONVERSION="-Wconversion"
|
||||
# -Wpacked \
|
||||
|
||||
# This does more than expected for gcc (mixed code with declarations)
|
||||
# -Wdeclaration-after-statement \
|
||||
|
||||
EXTRA="-Wextra \
|
||||
-Wsign-compare \
|
||||
-Werror-implicit-function-declaration \
|
||||
-Wpointer-arith \
|
||||
-Wwrite-strings \
|
||||
-Wswitch \
|
||||
-Wmissing-format-attribute \
|
||||
-Wstrict-aliasing=3 \
|
||||
-Winit-self \
|
||||
-Wunsafe-loop-optimizations \
|
||||
-Wold-style-definition \
|
||||
-Wno-missing-field-initializers \
|
||||
-Wunused-parameter \
|
||||
-Wno-long-long \
|
||||
-Wmaybe-uninitialized \
|
||||
-Wvla \
|
||||
-Wformat-overflow \
|
||||
-Wformat-truncation \
|
||||
-Wstringop-overread"
|
||||
|
||||
exec $GCC $PEDANTIC $CONVERSION \
|
||||
-Wall $Wuninitialized \
|
||||
-Wno-switch \
|
||||
-Wdisabled-optimization \
|
||||
-Wwrite-strings \
|
||||
-Wpointer-arith \
|
||||
-Wbad-function-cast \
|
||||
-Wmissing-prototypes \
|
||||
-Wmissing-declarations \
|
||||
-Wstrict-prototypes \
|
||||
-Wnested-externs \
|
||||
-Wcomment \
|
||||
-Winline \
|
||||
-Wcast-align=strict \
|
||||
-Wcast-qual \
|
||||
-Wredundant-decls $EXTRA \
|
||||
"$@"
|
||||
@@ -1,61 +0,0 @@
|
||||
# Ubuntu
|
||||
.gitlab-shared-docker-ubuntu:
|
||||
image: ubuntu:noble
|
||||
tags:
|
||||
- gitlab-org-docker
|
||||
stage: test
|
||||
interruptible: true
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
before_script:
|
||||
- .gitlab/ci/cibuild-setup-ubuntu.sh
|
||||
- export CC="${COMPILER}${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
- export CXX="${COMPILER}++${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
|
||||
# Alpine
|
||||
.gitlab-shared-docker-alpine:
|
||||
image: alpine:latest
|
||||
tags:
|
||||
- gitlab-org-docker
|
||||
stage: test
|
||||
interruptible: true
|
||||
rules:
|
||||
- if: $CI_PROJECT_PATH != "cryptsetup/cryptsetup"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /v2\..\.x$/
|
||||
before_script:
|
||||
- apk add bash build-base clang clang-analyzer argp-standalone lvm2-dev openssl-dev popt-dev util-linux-dev json-c-dev device-mapper gettext-dev libssh-dev automake autoconf libtool tar asciidoctor
|
||||
- export CC="${COMPILER}${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
- export CXX="${COMPILER}++${COMPILER_VERSION:+-$COMPILER_VERSION}"
|
||||
|
||||
.gitlab-shared-gcc:
|
||||
extends:
|
||||
- .gitlab-shared-docker-ubuntu
|
||||
variables:
|
||||
COMPILER: "gcc"
|
||||
COMPILER_VERSION: "14"
|
||||
CC: "gcc-14"
|
||||
|
||||
.gitlab-shared-clang:
|
||||
extends:
|
||||
- .gitlab-shared-docker-ubuntu
|
||||
variables:
|
||||
COMPILER: "clang"
|
||||
COMPILER_VERSION: "20"
|
||||
CC: "clang-20"
|
||||
|
||||
.gitlab-shared-gcc-alpine:
|
||||
extends:
|
||||
- .gitlab-shared-docker-alpine
|
||||
variables:
|
||||
COMPILER: "gcc"
|
||||
CC: "gcc"
|
||||
|
||||
.gitlab-shared-clang-alpine:
|
||||
extends:
|
||||
- .gitlab-shared-docker-alpine
|
||||
variables:
|
||||
COMPILER: "clang"
|
||||
CC: "clang"
|
||||
@@ -1,22 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
CSMOCK="sudo /usr/bin/csmock"
|
||||
CSMOCK_TOOLS="gcc,clang,cppcheck,shellcheck"
|
||||
CSMOCK_TXZ="cryptsetup-csmock-results.tar.xz"
|
||||
CSMOCK_ERR="cryptsetup-csmock-results/scan-results.err"
|
||||
|
||||
$CSMOCK cryptsetup-*.src.rpm \
|
||||
--keep-going --force \
|
||||
--cswrap-timeout 300 \
|
||||
--skip-patches \
|
||||
--tools $CSMOCK_TOOLS \
|
||||
--output $CSMOCK_TXZ \
|
||||
--gcc-analyze \
|
||||
--cppcheck-add-flag=--check-level=exhaustive \
|
||||
|| { echo "csmock command failed"; exit 2; }
|
||||
|
||||
tar xJf $CSMOCK_TXZ $CSMOCK_ERR --strip-components 1 \
|
||||
&& test -s $CSMOCK_ERR \
|
||||
&& { echo "csmock discovered important errors"; echo 3; }
|
||||
|
||||
exit 0
|
||||
@@ -1,31 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
DIR="_spellcheck"
|
||||
|
||||
[ ! -d $DIR ] && mkdir $DIR
|
||||
|
||||
echo "[SPELLINTIAN]"
|
||||
git ls-tree -rz --name-only HEAD | grep -Evz -e '\.(pdf|xz)$' -e ^po/ | \
|
||||
xargs -r0 spellintian | \
|
||||
grep -v "(duplicate word)" | \
|
||||
grep -v "docs/" | tee $DIR/spell1.txt
|
||||
|
||||
echo "[CODESPELL]"
|
||||
git ls-tree -rz --name-only HEAD | grep -Evz -e '\.(pdf|xz)$' -e ^po/ | \
|
||||
xargs -r0 codespell | \
|
||||
grep -v "EXPCT" | \
|
||||
grep -v "params, prams" | \
|
||||
grep -v "pad, padded" | \
|
||||
grep -v "CIPHER, CHIP" | \
|
||||
grep -v "gost" | \
|
||||
grep -v "userA" | \
|
||||
grep -v "re-use" | \
|
||||
grep -v "fo ==" | \
|
||||
grep -v "docs/" | tee $DIR/spell2.txt
|
||||
|
||||
|
||||
[ -s $DIR/spell1.txt ] && exit 1
|
||||
[ -s $DIR/spell2.txt ] && exit 2
|
||||
|
||||
exit 0
|
||||
@@ -1,18 +0,0 @@
|
||||
### Issue description
|
||||
<!-- Please, shortly describe the issue here. -->
|
||||
|
||||
### Steps for reproducing the issue
|
||||
<!-- How it can be reproduced? Include all important steps. -->
|
||||
|
||||
### Additional info
|
||||
<!-- Please mention what distribution you are using. -->
|
||||
|
||||
### Debug log
|
||||
<!-- Paste a debug log of the failing command (add --debug option) between the markers below (to keep raw debug format).-->
|
||||
<!-- We need a lot of information from the debug log; without it, we cannot process your report. -->
|
||||
<!-- Debug log does not contain any private information. Do not paste private data; we'll ask you for more information if needed. -->
|
||||
```
|
||||
Output with --debug option:
|
||||
|
||||
```
|
||||
<!-- NOTE: WITHOUT DEBUG LOG, THE BUG REPORT WILL BE CLOSED. ALSO, PLEASE DO NOT TRY TO REMOVE PARTS OF THE DEBUG LOG! -->
|
||||
@@ -1,5 +0,0 @@
|
||||
### Documentation issue
|
||||
<!-- Please, shortly describe the issue in documentation here. -->
|
||||
|
||||
### Additional info
|
||||
<!-- Please mention what cryptsetup version you are using. -->
|
||||
@@ -1,5 +0,0 @@
|
||||
### New feature description
|
||||
<!-- Please, shortly describe the requested feature here. -->
|
||||
|
||||
### Additional info
|
||||
<!-- Please mention what distribution and cryptsetup version you are using. -->
|
||||
5
AUTHORS
5
AUTHORS
@@ -1,4 +1,3 @@
|
||||
Jana Saout <jana@saout.de>
|
||||
Christophe Saout <christophe@saout.de>
|
||||
Clemens Fruhwirth <clemens@endorphin.org>
|
||||
Milan Broz <gmazyland@gmail.com>
|
||||
Ondrej Kozina <okozina@redhat.com>
|
||||
Milan Broz <asi@ucw.cz>
|
||||
|
||||
158
CONTRIBUTING.md
158
CONTRIBUTING.md
@@ -1,158 +0,0 @@
|
||||
Contributing to cryptsetup
|
||||
==========================
|
||||
For basic information about the cryptsetup project, please read [README](README.md).
|
||||
|
||||
The Cryptsetup project uses free, open-source licenses; details are described in [licensing](README.licensing).
|
||||
|
||||
For contribution code or documentation to the cryptsetup project, you must have the necessary rights to the content, and your contribution must be provided under the required license.
|
||||
|
||||
We welcome contributions from everyone.
|
||||
|
||||
Cryptsetup is an independent project with much volunteer effort, and our resources are limited.
|
||||
Following the guidelines specified in this file makes it easier for us to process your issue.
|
||||
|
||||
Project maintainers can remove or reject abusive or otherwise unacceptable comments or code.
|
||||
|
||||
Git repository
|
||||
--------------
|
||||
The primary repository is located at [gitlab.com/cryptsetup/cryptsetup](https://gitlab.com/cryptsetup/cryptsetup).
|
||||
The development branch is ``main``; minor stable releases can use their branches with cherry-picked or backported patches.
|
||||
|
||||
There are backup mirrors located at [github.com/mbroz/cryptsetup](https://github.com/mbroz/cryptsetup) and [git.kernel.org/pub/scm/utils/cryptsetup/cryptsetup.git](https://git.kernel.org/pub/scm/utils/cryptsetup/cryptsetup.git).
|
||||
|
||||
How to make a bug report
|
||||
------------------------
|
||||
To report an issue or feature request, please use GitLab [cryptsetup issue tracker](https://gitlab.com/cryptsetup/cryptsetup/-/issues).
|
||||
|
||||
Before reporting an issue, please try to search documentation and existing issues. Always try to reproduce the problem on the latest supported release.
|
||||
Please *always* collect and attach ``--debug`` log and other information as instructed in the issue template.
|
||||
Even if you think the problem is obvious, we need logged information about the environment (like versions of kernel modules, etc.).
|
||||
|
||||
Please do not report distribution-specific issues if they are not present in the latest upstream release.
|
||||
For such reports, please use downstream distribution-specific trackers.
|
||||
If the issue is related to upstream, downstream maintainers will redirect you here, or upstream maintainers will join the discussion.
|
||||
|
||||
If you think that you found some security bug, please follow the instructions in the [SECURITY](SECURITY.md) file.
|
||||
|
||||
How to contribute changes to cryptsetup
|
||||
---------------------------------------
|
||||
The following notes are a very short introduction to cryptsetup internal processes and an overview of generic rules that should be followed for all changes.
|
||||
|
||||
Changes from developers and external contributors should go through the GitLab repository [merge reguests](https://gitlab.com/cryptsetup/cryptsetup/-/merge_requests).
|
||||
Alternatively (for trivial changes), you can send a patch to [cryptsetup mailing list](mailto:cryptsetup@lists.linux.dev).
|
||||
|
||||
Please do not write personal emails with questions or patches to maintainers and developers.
|
||||
|
||||
### Project structure
|
||||
Cryptsetup projects include a libcryptsetup library, tools, token plugins, documentation, and a test suite.
|
||||
|
||||
Cryptsetup library (libcryptsetup) exports [versioned symbols](lib/libcryptsetup.sym).
|
||||
Tools (cryptsetup, veritysetup, integritysetup) use libcryptsetup shared library.
|
||||
Some isolated parts in the lib directory can be reused for tools (the source is recompiled).
|
||||
|
||||
The basic directory structure in the repository is
|
||||
```
|
||||
├── docs - Documentation and release notes.
|
||||
├── lib - libcryptsetup implementation
|
||||
│ ├── bitlk - Bitlocker format
|
||||
│ ├── crypto_backend - Cryptography backend
|
||||
│ ├── fvault2 - FileVault2 format
|
||||
│ ├── integrity - Linux dm-integrity interface
|
||||
│ ├── loopaes - Linux LoopAES format
|
||||
│ ├── luks1 - LUKS1 format
|
||||
│ ├── luks2 - LUKS2 format including OPAL2 SED
|
||||
│ ├── tcrypt - TrueCrypt / VeraCrypt format
|
||||
│ └── verity - Linux dm-verity interface
|
||||
├── man - Manual pages (in AsciiDoc format)
|
||||
├── misc - Miscellaneous additions
|
||||
├── po - Translation files
|
||||
├── scripts - Scripts for system configuration
|
||||
├── src - Tools implementation
|
||||
├── tests - Testsuite (test units, regression tests, fuzzing)
|
||||
└── tokens - Token plugins
|
||||
```
|
||||
### Coordination with other projects
|
||||
The cryptsetup tools and library use low-level functions that depend on many other subsystems.
|
||||
Currently, the project is supported only for Linux (it will not work on Android or other systems).
|
||||
|
||||
Cryptsetup project requires some parts of the Linux kernel, notably the *Device Mapper* (dm-crypt, dm-integrity, dm-verity, dm-zero modules) and kernel *userspace cryptographic interface*.
|
||||
Missing kernel interface can significantly limit (or even disallow) cryptsetup functionality.
|
||||
|
||||
Integration in operating systems also depends on several other projects, most notably *systemd* (that implements its own tooling using libcryptsetup) and *util-Linux* (*blkid* parsing of supported format metadata). Some changes must be synchronized in all needed places (kernel, blkid, libcryptsetup).
|
||||
|
||||
Several other projects implement their own token metadata (either through binary token plugins or through generic libcryptsetup JSON token access functions).
|
||||
|
||||
### Used cryptography algorithms
|
||||
Cryptsetup avoids implementing cryptographic primitives but uses cryptographic libraries.
|
||||
Exceptions were PBKDF internal implementations - PBKDF2 and Argon2 until these were integrated into major cryptographic libraries.
|
||||
|
||||
Cryptsetup can be compiled with several cryptographic libraries backend (OpenSSL, libgcrypt, Nettle, NSS, and Linux kernel userspace API).
|
||||
OpenSSL is the default and strongly recommended configuration.
|
||||
|
||||
If the cryptographic library does not implement some cryptographic primitive (for example, if running in a FIPS-140 environment or just
|
||||
because it does not include it at all), functionality could be limited.
|
||||
|
||||
### Configuration and versioning
|
||||
Cryptsetup can be configured using *Autoconf* or *Meson*. Autoconf support is being deprecated in the long term.
|
||||
Currently, all new configuration options must be implemented in both systems.
|
||||
|
||||
Cryptsetup intentionally does not use a system configuration file (located in /etc).
|
||||
All functionality must be determined dynamically.
|
||||
|
||||
All related /etc configuration files (crypttab, fstab and others) are maintained by systemd (in some legacy distributions by cryptsetup downstream).
|
||||
|
||||
Cryptsetup uses [semantic versioning](https://semver.org/).
|
||||
Major and minor releases are always based on the main git branch; the minor stable (patch) versions can have some specific branch with backported or cherry-picked patches (from the main branch).
|
||||
Usually, minor releases happen twice per year and stable patch updates according to reported bugs (in 1-3 month intervals).
|
||||
|
||||
### Compilation and debugging
|
||||
The library and tools are written in C language; we require C99 and support gcc and Clang compilers.
|
||||
Manual pages are generated from AsciiDoc sources and libcryptsetup API documentation by Doxygen (from libcryptsetup.h comments).
|
||||
Testsuite is a combination of local C utilities, fuzzing implementation in C++, bash scripts, and uses many other system utilities.
|
||||
|
||||
All tools contain compiled-in debug messages that are available through --debug options.
|
||||
|
||||
With Autoconf and libtool, you can run the cryptsetup tool in the debugger without installation using this one-line script:
|
||||
```
|
||||
libtool --mode=execute gdb --args ./cryptsetup --debug $@
|
||||
```
|
||||
This will ensure that a properly compiled libcryptsetup file is used.
|
||||
|
||||
### Coding style
|
||||
Cryptsetup uses [Linux kernel coding style](https://cdn.kernel.org/doc/html/latest/process/coding-style.html) for libcryptsetup and tools (where applicable) with some additional notes:
|
||||
- Use tabulators for indentation; the line should not exceed 100 characters with an 8-character tabulator. Otherwise, use a tab of any length. :-).
|
||||
- The minimal C standard required is C99.
|
||||
- The ``goto`` use is allowed only for error path (``goto out`` for common code path, ``goto err`` for specific error code path).
|
||||
- Split patches per change; do not submit huge patches combining several changes.
|
||||
- Use an elaborative description in the patch header.
|
||||
- No need to use sign-off-by lines.
|
||||
- Use name prefixes (``crypt_``, ``LUKS2_`` and similar).
|
||||
- Avoid extensive preprocessor use (specifically conditional ``#if`` or ``#ifdef`` sections).
|
||||
- To check detected configuration options stored in config.h, always use ``#if SOMETHING`` (do NOT use ``#ifdef``).
|
||||
- Use output only through ``log_err, log_std, log_verbose, log_dbg`` macros.
|
||||
The ``log_dbg`` is always in English; the others should be wrapped in the ``_()`` macro for translation.
|
||||
- Use ``assert()`` but only for simple invariants and variables (avoid calling functions).
|
||||
Do not use assert for user-defined input (this should be a normal error path).
|
||||
- The code style is quite relaxed in testing scripts (code there is not intended for production use).
|
||||
|
||||
### General rules and testing
|
||||
- Cryptsetup should work on all architectures supported by the Linux kernel.
|
||||
Only very few functionalities require specific hardware (notably Opal SED support).
|
||||
If you want to introduce some specific hardware support, please discuss it with the maintainers first.
|
||||
|
||||
- All code changes should go through merge requests and reviews.
|
||||
Code can be merged after review approval (done by someone with the commit right to the development repository), but reviews from external people are very welcome, too.
|
||||
|
||||
- All new functionality must come with at least rudimentary coverage in the test suite.
|
||||
Always run the test suite before opening the merge request (``make check`` with root privilege).
|
||||
|
||||
- We have continuous integration (CI) that runs many tests automatically, but the output is not directly visible for external merge request authors (for security reasons).
|
||||
All CI scripts are available in .gitlab and .github folders in the project repository.
|
||||
|
||||
Maintainers will provide you log files if anything fails. Your code must produce no warnings before it is merged.
|
||||
|
||||
- We run compilation with many extended [gcc](.gitlab/ci/gcc-Wall) and [Clang](.gitlab/ci/clang-Wall) warnings and include some analyzers, notably
|
||||
- [Coverity](https://scan.coverity.com), GitHub CodeQL, Clang scan-build, and gcc static analyzer, and
|
||||
- fuzzing integrated in [OSS-fuzz project](https://github.com/google/oss-fuzz/tree/master/projects/cryptsetup).
|
||||
|
||||
- Testsuite can also partially run under Valgrind dynamic analyzer with ``make valgrind-check``.
|
||||
41
COPYING
41
COPYING
@@ -1,12 +1,12 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
|
||||
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
@@ -15,7 +15,7 @@ software--to make sure the software is free for all its users. This
|
||||
General Public License applies to most of the Free Software
|
||||
Foundation's software and to any other program whose authors commit to
|
||||
using it. (Some other Free Software Foundation software is covered by
|
||||
the GNU Lesser General Public License instead.) You can apply it to
|
||||
the GNU Library General Public License instead.) You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
@@ -55,8 +55,8 @@ patent must be licensed for everyone's free use or not licensed at all.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License applies to any program or other work which contains
|
||||
@@ -110,7 +110,7 @@ above, provided that you also meet all of these conditions:
|
||||
License. (Exception: if the Program itself is interactive but
|
||||
does not normally print such an announcement, your work based on
|
||||
the Program is not required to print an announcement.)
|
||||
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Program,
|
||||
and can be reasonably considered independent and separate works in
|
||||
@@ -168,7 +168,7 @@ access to copy from a designated place, then offering equivalent
|
||||
access to copy the source code from the same place counts as
|
||||
distribution of the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
|
||||
4. You may not copy, modify, sublicense, or distribute the Program
|
||||
except as expressly provided under this License. Any attempt
|
||||
otherwise to copy, modify, sublicense or distribute the Program is
|
||||
@@ -225,7 +225,7 @@ impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
|
||||
8. If the distribution and/or use of the Program is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Program under this License
|
||||
@@ -255,7 +255,7 @@ make exceptions for this. Our decision will be guided by the two goals
|
||||
of preserving the free status of all derivatives of our free software and
|
||||
of promoting the sharing and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
NO WARRANTY
|
||||
|
||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
@@ -277,9 +277,9 @@ YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
@@ -303,16 +303,17 @@ the "copyright" line and a pointer to where the full notice is found.
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License along
|
||||
with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program; if not, write to the Free Software
|
||||
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program is interactive, make it output a short notice like this
|
||||
when it starts in an interactive mode:
|
||||
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
@@ -335,7 +336,7 @@ necessary. Here is a sample; alter the names:
|
||||
This General Public License does not permit incorporating your program into
|
||||
proprietary programs. If your program is a subroutine library, you may
|
||||
consider it more useful to permit linking proprietary applications with the
|
||||
library. If this is what you want to do, use the GNU Lesser General
|
||||
library. If this is what you want to do, use the GNU Library General
|
||||
Public License instead of this License.
|
||||
|
||||
-----
|
||||
|
||||
@@ -1,174 +1,3 @@
|
||||
2012-12-21 Milan Broz <gmazyland@gmail.com>
|
||||
* Since version 1.6 This file is no longer maintained.
|
||||
* See version control log http://code.google.com/p/cryptsetup/source/list
|
||||
|
||||
2012-10-11 Milan Broz <gmazyland@gmail.com>
|
||||
* Added keyslot checker (by Arno Wagner).
|
||||
* Version 1.5.1.
|
||||
|
||||
2012-09-11 Milan Broz <gmazyland@gmail.com>
|
||||
* Add crypt_keyslot_area() API call.
|
||||
|
||||
2012-08-27 Milan Broz <gmazyland@gmail.com>
|
||||
* Optimize seek to keyfile-offset (Issue #135, thx to dreisner).
|
||||
* Fix luksHeaderBackup for very old v1.0 unaligned LUKS headers.
|
||||
|
||||
2012-08-12 Milan Broz <gmazyland@gmail.com>
|
||||
* Allocate loop device late (only when real block device needed).
|
||||
* Rework underlying device/file access functions.
|
||||
* Create hash image if doesn't exist in veritysetup format.
|
||||
* Provide better error message if running as non-root user (device-mapper, loop).
|
||||
|
||||
2012-07-10 Milan Broz <gmazyland@gmail.com>
|
||||
* Version 1.5.0.
|
||||
|
||||
2012-06-25 Milan Broz <gmazyland@gmail.com>
|
||||
* Add --device-size option for reencryption tool.
|
||||
* Switch to use unit suffix for --reduce-device-size option.
|
||||
* Remove open device debugging feature (no longer needed).
|
||||
* Fix library name for FIPS check.
|
||||
|
||||
2012-06-20 Milan Broz <gmazyland@gmail.com>
|
||||
* Version 1.5.0-rc2.
|
||||
|
||||
2012-06-18 Milan Broz <gmazyland@gmail.com>
|
||||
* Introduce cryptsetup-reencrypt - experimental offline LUKS reencryption tool.
|
||||
* Fix luks-header-from-active script (do not use LUKS header on-disk, add UUID).
|
||||
* Add --test-passphrase option for luksOpen (check passphrase only).
|
||||
|
||||
2012-06-11 Milan Broz <gmazyland@gmail.com>
|
||||
* Introduce veritysetup for dm-verity target management.
|
||||
* Version 1.5.0-rc1.
|
||||
|
||||
2012-06-10 Milan Broz <gmazyland@gmail.com>
|
||||
* Both data and header device can now be a file.
|
||||
* Loop is automatically allocated in crypt_set_data_device().
|
||||
* Require only up to last keyslot area for header device (ignore data offset).
|
||||
* Fix header backup and restore to work on files with large data offset.
|
||||
|
||||
2012-05-27 Milan Broz <gmazyland@gmail.com>
|
||||
* Fix readonly activation if underlying device is readonly (1.4.0).
|
||||
* Include stddef.h in libdevmapper.h (size_t definition).
|
||||
* Version 1.4.3.
|
||||
|
||||
2012-05-21 Milan Broz <gmazyland@gmail.com>
|
||||
* Add --enable-fips for linking with fipscheck library.
|
||||
* Initialize binary and library selfcheck if running in FIPS mode.
|
||||
* Use FIPS RNG in FIPS mode for KEY and SALT (only gcrypt backend supported).
|
||||
|
||||
2012-05-09 Milan Broz <gmazyland@gmail.com>
|
||||
* Fix keyslot removal (wipe keyslot) for device with 4k hw block (1.4.0).
|
||||
* Allow empty cipher (cipher_null) for testing.
|
||||
|
||||
2012-05-02 Milan Broz <gmazyland@gmail.com>
|
||||
* Fix loop mapping on readonly file.
|
||||
* Relax --shared test, allow mapping even for overlapping segments.
|
||||
* Support shared flag for LUKS devices (dangerous).
|
||||
* Switch on retry on device remove for libdevmapper.
|
||||
* Allow "private" activation (skip some udev global rules) flag.
|
||||
|
||||
2012-04-09 Milan Broz <gmazyland@gmail.com>
|
||||
* Fix header check to support old (cryptsetup 1.0.0) header alignment. (1.4.0)
|
||||
* Version 1.4.2.
|
||||
|
||||
2012-03-16 Milan Broz <gmazyland@gmail.com>
|
||||
* Add --keyfile-offset and --new-keyfile-offset parameters to API and CLI.
|
||||
* Add repair command and crypt_repair() for known LUKS metadata problems repair.
|
||||
* Allow one to specify --align-payload only for luksFormat.
|
||||
|
||||
2012-03-16 Milan Broz <mbroz@redhat.com>
|
||||
* Unify password verification option.
|
||||
* Support password verification with quiet flag if possible. (1.2.0)
|
||||
* Fix retry if entered passphrases (with verify option) do not match.
|
||||
* Support UUID=<LUKS_UUID> format for device specification.
|
||||
|
||||
2012-02-11 Milan Broz <mbroz@redhat.com>
|
||||
* Add --master-key-file option to luksOpen (open using volume key).
|
||||
|
||||
2012-01-12 Milan Broz <mbroz@redhat.com>
|
||||
* Fix use of empty keyfile.
|
||||
|
||||
2011-11-13 Milan Broz <mbroz@redhat.com>
|
||||
* Fix error message for luksClose and detached LUKS header.
|
||||
* Allow --header for status command to get full info with detached header.
|
||||
|
||||
2011-11-09 Milan Broz <mbroz@redhat.com>
|
||||
* Version 1.4.1.
|
||||
|
||||
2011-11-05 Milan Broz <mbroz@redhat.com>
|
||||
* Merge pycryptsetup (Python libcryptsetup bindings).
|
||||
* Fix stupid typo in set_iteration_time API call.
|
||||
* Fix cryptsetup status output if parameter is device path.
|
||||
|
||||
2011-10-27 Milan Broz <mbroz@redhat.com>
|
||||
* Fix crypt_get_volume_key_size() for plain device.
|
||||
* Fix FSF address in license text.
|
||||
|
||||
2011-10-25 Milan Broz <mbroz@redhat.com>
|
||||
* Print informative message in isLuks only in verbose mode.
|
||||
* Version 1.4.0.
|
||||
|
||||
2011-10-10 Milan Broz <mbroz@redhat.com>
|
||||
* Version 1.4.0-rc1.
|
||||
|
||||
2011-10-05 Milan Broz <mbroz@redhat.com>
|
||||
* Support Nettle 2.4 crypto backend (for ripemd160).
|
||||
* If device is not rotational, do not use Gutmann wipe method.
|
||||
* Add crypt_last_error() API call.
|
||||
* Fix luksKillSLot exit code if slot is inactive or invalid.
|
||||
* Fix exit code if passphrases do not match in luksAddKey.
|
||||
* Add LUKS on-disk format description into package.
|
||||
|
||||
2011-09-22 Milan Broz <mbroz@redhat.com>
|
||||
* Support key-slot option for luksOpen (use only explicit keyslot).
|
||||
|
||||
2011-08-22 Milan Broz <mbroz@redhat.com>
|
||||
* Add more paranoid checks for LUKS header and keyslot attributes.
|
||||
* Fix crypt_load to properly check device size.
|
||||
* Use new /dev/loop-control (kernel 3.1) if possible.
|
||||
* Enhance check of device size before writing LUKS header.
|
||||
* Do not allow context format of already formatted device.
|
||||
|
||||
2011-07-25 Milan Broz <mbroz@redhat.com>
|
||||
* Remove hash/hmac restart from crypto backend and make it part of hash/hmac final.
|
||||
* Improve check for invalid offset and size values.
|
||||
|
||||
2011-07-19 Milan Broz <mbroz@redhat.com>
|
||||
* Revert default initialisation of volume key in crypt_init_by_name().
|
||||
* Do not allow key retrieval while suspended (key could be wiped).
|
||||
* Do not allow suspend for non-LUKS devices.
|
||||
* Support retries and timeout parameters for luksSuspend.
|
||||
* Add --header option for detached metadata (on-disk LUKS header) device.
|
||||
* Add crypt_init_by_name_and_header() and crypt_set_data_device() to API.
|
||||
* Allow different data offset setting for detached header.
|
||||
|
||||
2011-07-07 Milan Broz <mbroz@redhat.com>
|
||||
* Remove old API functions (all functions using crypt_options).
|
||||
* Add --enable-discards option to allow discards/TRIM requests.
|
||||
* Add crypt_get_iv_offset() function to API.
|
||||
|
||||
2011-07-01 Milan Broz <mbroz@redhat.com>
|
||||
* Add --shared option for creating non-overlapping crypt segments.
|
||||
* Add shared flag to libcryptsetup api.
|
||||
* Fix plain crypt format parameters to include size option (API change).
|
||||
|
||||
2011-06-08 Milan Broz <mbroz@redhat.com>
|
||||
* Fix return code for status command when device doesn't exists.
|
||||
|
||||
2011-05-24 Milan Broz <mbroz@redhat.com>
|
||||
* Version 1.3.1.
|
||||
|
||||
2011-05-17 Milan Broz <mbroz@redhat.com>
|
||||
* Fix keyfile=- processing in create command (1.3.0).
|
||||
* Simplify device path status check.
|
||||
|
||||
2011-05-03 Milan Broz <mbroz@redhat.com>
|
||||
* Do not ignore size argument for create command (1.2.0).
|
||||
|
||||
2011-04-18 Milan Broz <mbroz@redhat.com>
|
||||
* Fix error paths in blockwise code and lseek_write call.
|
||||
* Add Nettle crypto backend support.
|
||||
|
||||
2011-04-05 Milan Broz <mbroz@redhat.com>
|
||||
* Version 1.3.0.
|
||||
|
||||
@@ -178,7 +7,7 @@
|
||||
* Document cryptsetup exit codes.
|
||||
|
||||
2011-03-18 Milan Broz <mbroz@redhat.com>
|
||||
* Respect maximum keyfile size parameter.
|
||||
* Respect maximum keyfile size paramater.
|
||||
* Introduce maximum default keyfile size, add configure option.
|
||||
* Require the whole key read from keyfile in create command (broken in 1.2.0).
|
||||
* Fix offset option for loopaesOpen.
|
||||
@@ -195,7 +24,7 @@
|
||||
|
||||
2011-03-05 Milan Broz <mbroz@redhat.com>
|
||||
* Add exception to COPYING for binary distribution linked with OpenSSL library.
|
||||
* Set secure data flag (wipe all ioctl buffers) if devmapper library supports it.
|
||||
* Set secure data flag (wipe all ioclt buffers) if devmapper library supports it.
|
||||
|
||||
2011-01-29 Milan Broz <mbroz@redhat.com>
|
||||
* Fix mapping removal if device disappeared but node still exists.
|
||||
@@ -228,7 +57,7 @@
|
||||
* Fix password callback call.
|
||||
* Fix default plain password entry from terminal in activate_by_passphrase.
|
||||
* Add --dump-master-key option for luksDump to allow volume key dump.
|
||||
* Allow one to activate by internally cached volume key
|
||||
* Allow to activate by internally cached volume key
|
||||
(format/activate without keyslots active - used for temporary devices).
|
||||
* Initialize volume key from active device in crypt_init_by_name()
|
||||
* Fix cryptsetup binary exitcodes.
|
||||
@@ -334,13 +163,13 @@
|
||||
* Version 1.1.0.
|
||||
|
||||
2010-01-10 Milan Broz <mbroz@redhat.com>
|
||||
* Fix initialisation of gcrypt during luksFormat.
|
||||
* Convert hash name to lower case in header (fix sha1 backward compatible header)
|
||||
* Fix initialisation of gcrypt duting luksFormat.
|
||||
* Convert hash name to lower case in header (fix sha1 backward comatible header)
|
||||
* Check for minimum required gcrypt version.
|
||||
|
||||
2009-12-30 Milan Broz <mbroz@redhat.com>
|
||||
* Fix key slot iteration count calculation (small -i value was the same as default).
|
||||
* The slot and key digest iteration minimum is now 1000.
|
||||
* The slot and key digest iteration minimun is now 1000.
|
||||
* The key digest iteration # is calculated from iteration time (approx 1/8 of that).
|
||||
* Version 1.1.0-rc4.
|
||||
|
||||
@@ -395,16 +224,16 @@
|
||||
* Require device device-mapper to build and do not use backend wrapper for dm calls.
|
||||
* Move memory locking and dm initialization to command layer.
|
||||
* Increase priority of process if memory is locked.
|
||||
* Add log macros and make logging more consistent.
|
||||
* Add log macros and make logging modre consitent.
|
||||
* Move command successful messages to verbose level.
|
||||
* Introduce --debug parameter.
|
||||
* Move device utils code and provide context parameter (for log).
|
||||
* Keyfile now must be provided by path, only stdin file descriptor is used (api only).
|
||||
* Do not call isatty() on closed keyfile descriptor.
|
||||
* Run performance check for PBKDF2 from LUKS code, do not mix hash algorithms results.
|
||||
* Run performance check for PBKDF2 from LUKS code, do not mix hash algoritms results.
|
||||
* Add ability to provide pre-generated master key and UUID in LUKS header format.
|
||||
* Add LUKS function to verify master key digest.
|
||||
* Move key slot manipulation function into LUKS specific code.
|
||||
* Move key slot manuipulation function into LUKS specific code.
|
||||
* Replace global options struct with separate parameters in helper functions.
|
||||
* Add new libcryptsetup API (documented in libcryptsetup.h).
|
||||
* Implement old API calls using new functions.
|
||||
@@ -412,7 +241,7 @@
|
||||
* Add --master-key-file option for luksFormat and luksAddKey.
|
||||
|
||||
2009-08-17 Milan Broz <mbroz@redhat.com>
|
||||
* Fix PBKDF2 speed calculation for large passphrases.
|
||||
* Fix PBKDF2 speed calculation for large passhrases.
|
||||
* Allow using passphrase provided in options struct for LuksOpen.
|
||||
* Allow restrict keys size in LuksOpen.
|
||||
|
||||
@@ -424,7 +253,7 @@
|
||||
* Switch PBKDF2 from internal SHA1 to libgcrypt, make hash algorithm not hardcoded to SHA1 here.
|
||||
* Add required parameters for changing hash used in LUKS key setup scheme.
|
||||
* Do not export simple XOR helper now used only inside AF functions.
|
||||
* Completely remove internal SHA1 implementation code, not needed anymore.
|
||||
* Completely remove internal SHA1 implementanion code, not needed anymore.
|
||||
* Enable hash algorithm selection for LUKS through -h luksFormat option.
|
||||
|
||||
2009-07-28 Milan Broz <mbroz@redhat.com>
|
||||
@@ -520,7 +349,7 @@
|
||||
* configure.in (AC_OUTPUT): Add m4/Makefile.
|
||||
(AM_GNU_GETTEXT_VERSION): Bump to 0.15.
|
||||
|
||||
2006-10-22 David Härdeman <david@hardeman.nu>
|
||||
2006-10-22 David Härdeman <david@hardeman.nu>
|
||||
|
||||
* Allow hashing of keys passed through stdin.
|
||||
|
||||
@@ -587,7 +416,7 @@
|
||||
|
||||
2006-08-04 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
|
||||
* lib/setup.c (get_key): Applied patch from David Härdeman
|
||||
* lib/setup.c (get_key): Applied patch from David Härdeman
|
||||
<david@2gen.com> for reading binary keys from stdin using
|
||||
the "-" as key file.
|
||||
|
||||
@@ -604,7 +433,7 @@
|
||||
|
||||
2006-07-23 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
|
||||
* Applied patches from David Härdeman <david@2gen.com> to fix 64
|
||||
* Applied patches from David Härdeman <david@2gen.com> to fix 64
|
||||
bit compiler warning issues.
|
||||
|
||||
2006-05-19 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
@@ -623,7 +452,7 @@
|
||||
|
||||
* configure.in: Release 1.0.3.
|
||||
|
||||
* Applied patch by Johannes Weißl for more meaningful exit codes
|
||||
* Applied patch by Johannes Weißl for more meaningful exit codes
|
||||
and password retries
|
||||
|
||||
2006-03-30 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
@@ -636,7 +465,7 @@
|
||||
|
||||
2006-03-15 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
|
||||
* configure.in: 1.0.3-rc3. Most displease release ever.
|
||||
* configure.in: 1.0.3-rc3. Most unplease release ever.
|
||||
* lib/setup.c (__crypt_create_device): More verbose error message.
|
||||
|
||||
2006-02-26 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
@@ -705,7 +534,7 @@
|
||||
|
||||
2005-12-06 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
|
||||
* man/cryptsetup.8: Correct "seconds" to "microseconds" in the explanation for -i.
|
||||
* man/cryptsetup.8: Correct "seconds" to "microseconds" in the explaination for -i.
|
||||
|
||||
2005-11-09 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
|
||||
@@ -726,7 +555,7 @@
|
||||
|
||||
2005-09-08 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
|
||||
* lib/setup.c (get_key): Fixed another incompatibility with
|
||||
* lib/setup.c (get_key): Fixed another incompatiblity with
|
||||
original cryptsetup.
|
||||
|
||||
2005-08-20 Clemens Fruhwirth <clemens@endorphin.org>
|
||||
@@ -816,7 +645,7 @@
|
||||
|
||||
* man/cryptsetup.1: Add man page.
|
||||
|
||||
* lib/setup.c: Remove unnecessary LUKS_write_phdr call, so the
|
||||
* lib/setup.c: Remove unneccessary LUKS_write_phdr call, so the
|
||||
phdr is written after passphrase reading, so the user can change
|
||||
his mind, and not have a partial written LUKS header on it's disk.
|
||||
|
||||
@@ -834,16 +663,16 @@
|
||||
* lib/utils.c: Add read|write_blockwise functions, to use in
|
||||
O_DIRECT file accesses.
|
||||
|
||||
2004-03-11 Thursday 15:52 Jana Saout <jana@saout.de>
|
||||
2004-03-11 Thursday 15:52 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* lib/blockdev.h: BLKGETSIZE64 really uses size_t as third
|
||||
argument, the rest is wrong.
|
||||
|
||||
2004-03-10 Wednesday 17:50 Jana Saout <jana@saout.de>
|
||||
2004-03-10 Wednesday 17:50 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* lib/: libcryptsetup.h, libdevmapper.c: Small fixes.
|
||||
|
||||
2004-03-09 Tuesday 21:41 Jana Saout <jana@saout.de>
|
||||
2004-03-09 Tuesday 21:41 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* lib/internal.h, lib/libcryptsetup.h, lib/libdevmapper.c,
|
||||
lib/setup.c, po/de.po, src/cryptsetup.c: Added internal flags to
|
||||
@@ -851,7 +680,7 @@
|
||||
add a function to free the memory. Also add a readonly flag to
|
||||
libcryptsetup.
|
||||
|
||||
2004-03-09 Tuesday 16:03 Jana Saout <jana@saout.de>
|
||||
2004-03-09 Tuesday 16:03 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* ChangeLog, configure.in, setup-gettext, lib/Makefile.am,
|
||||
lib/backends.c, lib/blockdev.h, lib/gcrypt.c, lib/internal.h,
|
||||
@@ -859,7 +688,7 @@
|
||||
lib/utils.c, po/de.po, src/Makefile.am, src/cryptsetup.c: More
|
||||
reorganization work.
|
||||
|
||||
2004-03-08 Monday 01:38 Jana Saout <jana@saout.de>
|
||||
2004-03-08 Monday 01:38 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* ChangeLog, Makefile.am, acinclude.m4, configure.in,
|
||||
lib/Makefile.am, lib/backends.c, lib/blockdev.h, lib/gcrypt.c,
|
||||
@@ -867,19 +696,19 @@
|
||||
src/Makefile.am: BLKGETSIZE64 fixes and started modularity
|
||||
enhancements
|
||||
|
||||
2004-03-04 Thursday 21:06 Jana Saout <jana@saout.de>
|
||||
2004-03-04 Thursday 21:06 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* Makefile.am, po/de.po, src/cryptsetup.c, src/cryptsetup.h: First
|
||||
backward compatible working version.
|
||||
|
||||
2004-03-04 Thursday 00:42 Jana Saout <jana@saout.de>
|
||||
2004-03-04 Thursday 00:42 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* NEWS, AUTHORS, ChangeLog, Makefile.am, README, autogen.sh,
|
||||
configure.in, setup-gettext, po/ChangeLog, po/LINGUAS,
|
||||
po/POTFILES.in, po/de.po, src/cryptsetup.c, src/cryptsetup.h,
|
||||
src/Makefile.am (utags: initial): Initial checkin.
|
||||
|
||||
2004-03-04 Thursday 00:42 Jana Saout <jana@saout.de>
|
||||
2004-03-04 Thursday 00:42 Christophe Saout <christophe@saout.de>
|
||||
|
||||
* NEWS, AUTHORS, ChangeLog, Makefile.am, README, autogen.sh,
|
||||
configure.in, setup-gettext, po/ChangeLog, po/LINGUAS,
|
||||
229
INSTALL
Normal file
229
INSTALL
Normal file
@@ -0,0 +1,229 @@
|
||||
Copyright 1994, 1995, 1996, 1999, 2000, 2001, 2002 Free Software
|
||||
Foundation, Inc.
|
||||
|
||||
This file is free documentation; the Free Software Foundation gives
|
||||
unlimited permission to copy, distribute and modify it.
|
||||
|
||||
Basic Installation
|
||||
==================
|
||||
|
||||
These are generic installation instructions.
|
||||
|
||||
The `configure' shell script attempts to guess correct values for
|
||||
various system-dependent variables used during compilation. It uses
|
||||
those values to create a `Makefile' in each directory of the package.
|
||||
It may also create one or more `.h' files containing system-dependent
|
||||
definitions. Finally, it creates a shell script `config.status' that
|
||||
you can run in the future to recreate the current configuration, and a
|
||||
file `config.log' containing compiler output (useful mainly for
|
||||
debugging `configure').
|
||||
|
||||
It can also use an optional file (typically called `config.cache'
|
||||
and enabled with `--cache-file=config.cache' or simply `-C') that saves
|
||||
the results of its tests to speed up reconfiguring. (Caching is
|
||||
disabled by default to prevent problems with accidental use of stale
|
||||
cache files.)
|
||||
|
||||
If you need to do unusual things to compile the package, please try
|
||||
to figure out how `configure' could check whether to do them, and mail
|
||||
diffs or instructions to the address given in the `README' so they can
|
||||
be considered for the next release. If you are using the cache, and at
|
||||
some point `config.cache' contains results you don't want to keep, you
|
||||
may remove or edit it.
|
||||
|
||||
The file `configure.ac' (or `configure.in') is used to create
|
||||
`configure' by a program called `autoconf'. You only need
|
||||
`configure.ac' if you want to change it or regenerate `configure' using
|
||||
a newer version of `autoconf'.
|
||||
|
||||
The simplest way to compile this package is:
|
||||
|
||||
1. `cd' to the directory containing the package's source code and type
|
||||
`./configure' to configure the package for your system. If you're
|
||||
using `csh' on an old version of System V, you might need to type
|
||||
`sh ./configure' instead to prevent `csh' from trying to execute
|
||||
`configure' itself.
|
||||
|
||||
Running `configure' takes awhile. While running, it prints some
|
||||
messages telling which features it is checking for.
|
||||
|
||||
2. Type `make' to compile the package.
|
||||
|
||||
3. Optionally, type `make check' to run any self-tests that come with
|
||||
the package.
|
||||
|
||||
4. Type `make install' to install the programs and any data files and
|
||||
documentation.
|
||||
|
||||
5. You can remove the program binaries and object files from the
|
||||
source code directory by typing `make clean'. To also remove the
|
||||
files that `configure' created (so you can compile the package for
|
||||
a different kind of computer), type `make distclean'. There is
|
||||
also a `make maintainer-clean' target, but that is intended mainly
|
||||
for the package's developers. If you use it, you may have to get
|
||||
all sorts of other programs in order to regenerate files that came
|
||||
with the distribution.
|
||||
|
||||
Compilers and Options
|
||||
=====================
|
||||
|
||||
Some systems require unusual options for compilation or linking that
|
||||
the `configure' script does not know about. Run `./configure --help'
|
||||
for details on some of the pertinent environment variables.
|
||||
|
||||
You can give `configure' initial values for configuration parameters
|
||||
by setting variables in the command line or in the environment. Here
|
||||
is an example:
|
||||
|
||||
./configure CC=c89 CFLAGS=-O2 LIBS=-lposix
|
||||
|
||||
*Note Defining Variables::, for more details.
|
||||
|
||||
Compiling For Multiple Architectures
|
||||
====================================
|
||||
|
||||
You can compile the package for more than one kind of computer at the
|
||||
same time, by placing the object files for each architecture in their
|
||||
own directory. To do this, you must use a version of `make' that
|
||||
supports the `VPATH' variable, such as GNU `make'. `cd' to the
|
||||
directory where you want the object files and executables to go and run
|
||||
the `configure' script. `configure' automatically checks for the
|
||||
source code in the directory that `configure' is in and in `..'.
|
||||
|
||||
If you have to use a `make' that does not support the `VPATH'
|
||||
variable, you have to compile the package for one architecture at a
|
||||
time in the source code directory. After you have installed the
|
||||
package for one architecture, use `make distclean' before reconfiguring
|
||||
for another architecture.
|
||||
|
||||
Installation Names
|
||||
==================
|
||||
|
||||
By default, `make install' will install the package's files in
|
||||
`/usr/local/bin', `/usr/local/man', etc. You can specify an
|
||||
installation prefix other than `/usr/local' by giving `configure' the
|
||||
option `--prefix=PATH'.
|
||||
|
||||
You can specify separate installation prefixes for
|
||||
architecture-specific files and architecture-independent files. If you
|
||||
give `configure' the option `--exec-prefix=PATH', the package will use
|
||||
PATH as the prefix for installing programs and libraries.
|
||||
Documentation and other data files will still use the regular prefix.
|
||||
|
||||
In addition, if you use an unusual directory layout you can give
|
||||
options like `--bindir=PATH' to specify different values for particular
|
||||
kinds of files. Run `configure --help' for a list of the directories
|
||||
you can set and what kinds of files go in them.
|
||||
|
||||
If the package supports it, you can cause programs to be installed
|
||||
with an extra prefix or suffix on their names by giving `configure' the
|
||||
option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'.
|
||||
|
||||
Optional Features
|
||||
=================
|
||||
|
||||
Some packages pay attention to `--enable-FEATURE' options to
|
||||
`configure', where FEATURE indicates an optional part of the package.
|
||||
They may also pay attention to `--with-PACKAGE' options, where PACKAGE
|
||||
is something like `gnu-as' or `x' (for the X Window System). The
|
||||
`README' should mention any `--enable-' and `--with-' options that the
|
||||
package recognizes.
|
||||
|
||||
For packages that use the X Window System, `configure' can usually
|
||||
find the X include and library files automatically, but if it doesn't,
|
||||
you can use the `configure' options `--x-includes=DIR' and
|
||||
`--x-libraries=DIR' to specify their locations.
|
||||
|
||||
Specifying the System Type
|
||||
==========================
|
||||
|
||||
There may be some features `configure' cannot figure out
|
||||
automatically, but needs to determine by the type of machine the package
|
||||
will run on. Usually, assuming the package is built to be run on the
|
||||
_same_ architectures, `configure' can figure that out, but if it prints
|
||||
a message saying it cannot guess the machine type, give it the
|
||||
`--build=TYPE' option. TYPE can either be a short name for the system
|
||||
type, such as `sun4', or a canonical name which has the form:
|
||||
|
||||
CPU-COMPANY-SYSTEM
|
||||
|
||||
where SYSTEM can have one of these forms:
|
||||
|
||||
OS KERNEL-OS
|
||||
|
||||
See the file `config.sub' for the possible values of each field. If
|
||||
`config.sub' isn't included in this package, then this package doesn't
|
||||
need to know the machine type.
|
||||
|
||||
If you are _building_ compiler tools for cross-compiling, you should
|
||||
use the `--target=TYPE' option to select the type of system they will
|
||||
produce code for.
|
||||
|
||||
If you want to _use_ a cross compiler, that generates code for a
|
||||
platform different from the build platform, you should specify the
|
||||
"host" platform (i.e., that on which the generated programs will
|
||||
eventually be run) with `--host=TYPE'.
|
||||
|
||||
Sharing Defaults
|
||||
================
|
||||
|
||||
If you want to set default values for `configure' scripts to share,
|
||||
you can create a site shell script called `config.site' that gives
|
||||
default values for variables like `CC', `cache_file', and `prefix'.
|
||||
`configure' looks for `PREFIX/share/config.site' if it exists, then
|
||||
`PREFIX/etc/config.site' if it exists. Or, you can set the
|
||||
`CONFIG_SITE' environment variable to the location of the site script.
|
||||
A warning: not all `configure' scripts look for a site script.
|
||||
|
||||
Defining Variables
|
||||
==================
|
||||
|
||||
Variables not defined in a site shell script can be set in the
|
||||
environment passed to `configure'. However, some packages may run
|
||||
configure again during the build, and the customized values of these
|
||||
variables may be lost. In order to avoid this problem, you should set
|
||||
them in the `configure' command line, using `VAR=value'. For example:
|
||||
|
||||
./configure CC=/usr/local2/bin/gcc
|
||||
|
||||
will cause the specified gcc to be used as the C compiler (unless it is
|
||||
overridden in the site shell script).
|
||||
|
||||
`configure' Invocation
|
||||
======================
|
||||
|
||||
`configure' recognizes the following options to control how it
|
||||
operates.
|
||||
|
||||
`--help'
|
||||
`-h'
|
||||
Print a summary of the options to `configure', and exit.
|
||||
|
||||
`--version'
|
||||
`-V'
|
||||
Print the version of Autoconf used to generate the `configure'
|
||||
script, and exit.
|
||||
|
||||
`--cache-file=FILE'
|
||||
Enable the cache: use and save the results of the tests in FILE,
|
||||
traditionally `config.cache'. FILE defaults to `/dev/null' to
|
||||
disable caching.
|
||||
|
||||
`--config-cache'
|
||||
`-C'
|
||||
Alias for `--cache-file=config.cache'.
|
||||
|
||||
`--quiet'
|
||||
`--silent'
|
||||
`-q'
|
||||
Do not print messages saying which checks are being made. To
|
||||
suppress all normal output, redirect it to `/dev/null' (any error
|
||||
messages will still be shown).
|
||||
|
||||
`--srcdir=DIR'
|
||||
Look for the package's source code in directory DIR. Usually
|
||||
`configure' can determine that directory automatically.
|
||||
|
||||
`configure' also accepts some other, not widely useful, options. Run
|
||||
`configure --help' for more details.
|
||||
|
||||
95
Makefile.am
95
Makefile.am
@@ -1,90 +1,9 @@
|
||||
EXTRA_DIST = README.md SECURITY.md README.licensing CONTRIBUTING.md FAQ.md docs misc autogen.sh
|
||||
EXTRA_DIST += meson_options.txt \
|
||||
meson.build \
|
||||
lib/crypto_backend/argon2/meson.build \
|
||||
lib/crypto_backend/meson.build \
|
||||
lib/meson.build \
|
||||
man/meson.build \
|
||||
po/meson.build \
|
||||
scripts/meson.build \
|
||||
src/meson.build \
|
||||
tests/meson.build \
|
||||
tests/fuzz/meson.build \
|
||||
tokens/meson.build \
|
||||
tokens/ssh/meson.build
|
||||
|
||||
SUBDIRS = po tests tests/fuzz
|
||||
CLEANFILES =
|
||||
DISTCLEAN_TARGETS =
|
||||
|
||||
AM_CPPFLAGS = \
|
||||
-include config.h \
|
||||
-I$(top_srcdir)/lib \
|
||||
-DDATADIR=\""$(datadir)"\" \
|
||||
-DLOCALEDIR=\""$(datadir)/locale"\" \
|
||||
-DLIBDIR=\""$(libdir)"\" \
|
||||
-DPREFIX=\""$(prefix)"\" \
|
||||
-DSYSCONFDIR=\""$(sysconfdir)"\" \
|
||||
-DVERSION=\""$(VERSION)"\"
|
||||
AM_CFLAGS = -Wall
|
||||
AM_CXXFLAGS = -Wall
|
||||
AM_LDFLAGS =
|
||||
|
||||
if ENABLE_FUZZ_TARGETS
|
||||
AM_CFLAGS += -fsanitize=fuzzer-no-link
|
||||
AM_CXXFLAGS += -fsanitize=fuzzer-no-link
|
||||
endif
|
||||
|
||||
LDADD = $(LTLIBINTL)
|
||||
|
||||
tmpfilesddir = @DEFAULT_TMPFILESDIR@
|
||||
|
||||
include_HEADERS =
|
||||
lib_LTLIBRARIES =
|
||||
noinst_LTLIBRARIES =
|
||||
sbin_PROGRAMS =
|
||||
man8_MANS =
|
||||
tmpfilesd_DATA =
|
||||
pkgconfig_DATA =
|
||||
dist_noinst_DATA =
|
||||
|
||||
include man/Makemodule.am
|
||||
|
||||
include scripts/Makemodule.am
|
||||
|
||||
if CRYPTO_INTERNAL_ARGON2
|
||||
include lib/crypto_backend/argon2/Makemodule.am
|
||||
endif
|
||||
include lib/crypto_backend/Makemodule.am
|
||||
include lib/Makemodule.am
|
||||
|
||||
include src/Makemodule.am
|
||||
include tokens/Makemodule.am
|
||||
EXTRA_DIST = FAQ docs
|
||||
SUBDIRS = \
|
||||
lib \
|
||||
src \
|
||||
man \
|
||||
tests \
|
||||
po
|
||||
|
||||
ACLOCAL_AMFLAGS = -I m4
|
||||
|
||||
DISTCHECK_CONFIGURE_FLAGS = \
|
||||
--with-tmpfilesdir=$$dc_install_base/usr/lib/tmpfiles.d \
|
||||
--enable-internal-argon2 --enable-internal-sse-argon2 \
|
||||
--enable-external-tokens --enable-ssh-token --enable-asciidoc
|
||||
|
||||
distclean-local:
|
||||
-find . -name \*~ -o -name \*.orig -o -name \*.rej | xargs rm -f
|
||||
rm -rf autom4te.cache
|
||||
|
||||
clean-local:
|
||||
-rm -rf docs/doxygen_api_docs libargon2.la
|
||||
|
||||
install-data-local:
|
||||
$(MKDIR_P) -m 0755 $(DESTDIR)/${EXTERNAL_LUKS2_TOKENS_PATH}
|
||||
|
||||
uninstall-local:
|
||||
rmdir $(DESTDIR)/${EXTERNAL_LUKS2_TOKENS_PATH} 2>/dev/null || :
|
||||
|
||||
check-programs: libcryptsetup.la
|
||||
$(MAKE) -C tests $@
|
||||
|
||||
if ENABLE_FUZZ_TARGETS
|
||||
fuzz-targets: libcryptsetup.la libcrypto_backend.la
|
||||
$(MAKE) -C tests/fuzz $@
|
||||
endif
|
||||
|
||||
31
README
Normal file
31
README
Normal file
@@ -0,0 +1,31 @@
|
||||
|
||||
cryptsetup
|
||||
|
||||
setup cryptographic volumes for dm-crypt (including LUKS extension)
|
||||
|
||||
WEB PAGE:
|
||||
|
||||
http://code.google.com/p/cryptsetup/
|
||||
|
||||
FAQ:
|
||||
|
||||
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
|
||||
|
||||
MAILING LIST:
|
||||
|
||||
E-MAIL: dm-crypt@saout.de
|
||||
URL: http://www.saout.de/mailman/listinfo/dm-crypt
|
||||
|
||||
DOWNLOAD:
|
||||
|
||||
http://code.google.com/p/cryptsetup/downloads/
|
||||
|
||||
SOURCE CODE:
|
||||
|
||||
URL: http://code.google.com/p/cryptsetup/source/browse/
|
||||
Checkout: svn checkout http://cryptsetup.googlecode.com/svn/trunk/ cryptsetup
|
||||
|
||||
NLS (PO TRANSLATIONS):
|
||||
|
||||
PO files are maintained by:
|
||||
http://translationproject.org/domain/cryptsetup.html
|
||||
@@ -1,20 +0,0 @@
|
||||
The cryptsetup project does not use the same license for all of the code and documentation.
|
||||
|
||||
There is code and documentation under:
|
||||
|
||||
* GPL-2.0-or-later - GNU General Public License version 2, or any later version
|
||||
|
||||
* LGPL-2.1-or-later WITH cryptsetup-OpenSSL-exception
|
||||
* LGPL-2.1-or-later - GNU Lesser General Public License 2.1 or any later version,
|
||||
(with cryptsetup-OpenSSL-exception where applicable)
|
||||
|
||||
* Apache-2.0 - Apache License 2.0
|
||||
|
||||
* CC-BY-SA-4.0 - Creative Commons Attribution Share Alike 4.0 International
|
||||
|
||||
* Public Domain
|
||||
|
||||
Please, check the source code for more details.
|
||||
|
||||
The ./COPYING file (GPL-2.0-or-later) is the default license for code without
|
||||
an explicitly defined license.
|
||||
137
README.md
137
README.md
@@ -1,137 +0,0 @@
|
||||
|
||||
|
||||
What the ...?
|
||||
=============
|
||||
**Cryptsetup** is an open-source utility used to conveniently set up disk encryption based
|
||||
on the [dm-crypt](https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt) kernel module.
|
||||
|
||||
These formats are supported:
|
||||
* **plain** volumes,
|
||||
* **LUKS** volumes,
|
||||
* **loop-AES**,
|
||||
* **TrueCrypt** (including **VeraCrypt** extension),
|
||||
* **BitLocker**, and
|
||||
* **FileVault2**.
|
||||
|
||||
The project also includes a **veritysetup** utility used to conveniently setup
|
||||
[dm-verity](https://gitlab.com/cryptsetup/cryptsetup/wikis/DMVerity)
|
||||
block integrity checking kernel module and **integritysetup** to setup
|
||||
[dm-integrity](https://gitlab.com/cryptsetup/cryptsetup/wikis/DMIntegrity)
|
||||
block integrity kernel module.
|
||||
|
||||
LUKS Design
|
||||
-----------
|
||||
**LUKS** is the standard for Linux disk encryption. By providing a standardized on-disk format,
|
||||
it not only facilitate compatibility among distributions, but also enables secure management
|
||||
of multiple user passwords. LUKS stores all necessary setup information in the partition header,
|
||||
which enables users to transport or migrate data seamlessly.
|
||||
|
||||
### Specification and documentation
|
||||
* The latest version of the
|
||||
[LUKS2 format specification](https://gitlab.com/cryptsetup/LUKS2-docs).
|
||||
* The latest version of the
|
||||
[LUKS1 format specification](https://cdn.kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/on-disk-format.pdf).
|
||||
* [Project home page](https://gitlab.com/cryptsetup/cryptsetup/).
|
||||
* [Frequently asked questions (FAQ)](https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions)
|
||||
|
||||
Download
|
||||
--------
|
||||
Release notes and tarballs are available at
|
||||
[kernel.org](https://cdn.kernel.org/pub/linux/utils/cryptsetup/).
|
||||
|
||||
**The latest stable cryptsetup release version is 2.8.1**
|
||||
* [cryptsetup-2.8.1.tar.xz](https://cdn.kernel.org/pub/linux/utils/cryptsetup/v2.8/cryptsetup-2.8.1.tar.xz)
|
||||
* Signature [cryptsetup-2.8.1.tar.sign](https://cdn.kernel.org/pub/linux/utils/cryptsetup/v2.8/cryptsetup-2.8.1.tar.sign)
|
||||
_(You need to decompress file first to check signature.)_
|
||||
* [Cryptsetup 2.8.1 Release Notes](https://cdn.kernel.org/pub/linux/utils/cryptsetup/v2.8/v2.8.1-ReleaseNotes).
|
||||
|
||||
[Previous versions](https://cdn.kernel.org/pub/linux/utils/cryptsetup)
|
||||
|
||||
Source and API documentation
|
||||
----------------------------
|
||||
For development version code, please refer to the
|
||||
[source](https://gitlab.com/cryptsetup/cryptsetup/tree/master) page, with mirrors
|
||||
at [kernel.org](https://git.kernel.org/cgit/utils/cryptsetup/cryptsetup.git/) and
|
||||
[GitHub](https://github.com/mbroz/cryptsetup).
|
||||
|
||||
For libcryptsetup documentation see
|
||||
[libcryptsetup API](https://mbroz.fedorapeople.org/libcryptsetup_API/) page.
|
||||
|
||||
NLS PO files are maintained by
|
||||
[TranslationProject](https://translationproject.org/domain/cryptsetup.html).
|
||||
|
||||
Required packages
|
||||
-----------------
|
||||
All major Linux distributions provide cryptsetup as a bundled package. If you need
|
||||
to compile cryptsetup yourself, various additional packages are required.
|
||||
Any distribution-specific build tools are preferred when manually configuring cryptsetup.
|
||||
|
||||
Below are the packages needed to build for certain Linux distributions:
|
||||
|
||||
**For Fedora**:
|
||||
```
|
||||
git gcc make autoconf automake gettext-devel pkgconfig openssl-devel popt-devel device-mapper-devel libuuid-devel json-c-devel libblkid-devel findutils libtool libssh-devel tar rubygem-asciidoctor
|
||||
|
||||
Optionally: libargon2-devel libpwquality-devel
|
||||
```
|
||||
To run the internal testsuite (make check) you also need to install
|
||||
```
|
||||
sharutils device-mapper jq vim-common expect keyutils netcat shadow-utils openssh-clients openssh sshpass
|
||||
```
|
||||
|
||||
**For Debian and Ubuntu**:
|
||||
```
|
||||
git gcc make autoconf automake autopoint pkg-config libtool gettext libssl-dev libdevmapper-dev libpopt-dev uuid-dev libsepol-dev libjson-c-dev libssh-dev libblkid-dev tar asciidoctor
|
||||
|
||||
Optionally: libargon2-0-dev libpwquality-dev
|
||||
```
|
||||
To run the internal testsuite (make check) you also need to install
|
||||
```
|
||||
sharutils dmsetup jq xxd expect keyutils netcat-openbsd passwd openssh-client sshpass
|
||||
```
|
||||
|
||||
Note that the list may change as Linux distributions evolve.
|
||||
|
||||
Compilation
|
||||
-----------
|
||||
The cryptsetup project uses **automake** and **autoconf** system to generate all files needed to build.
|
||||
When building from a git snapshot,, use **./autogen.sh && ./configure && make**
|
||||
to compile the project. When building from a release **tar.xz** tarball, the configure script
|
||||
is pre-generated (no need to run **autoconf.sh**).
|
||||
See **./configure --help** and use the **--disable-[feature]** and **--enable-[feature]** options.
|
||||
|
||||
To run the test suite that come with the project, type **make check**.
|
||||
Note that most tests will need root user privileges and will run dangerous storage failure simulations.
|
||||
Do **not** run tests with root privilege on production systems! Some tests will need the **scsi_debug**
|
||||
kernel module to be installed.
|
||||
|
||||
For more details, please refer to the
|
||||
[automake](https://www.gnu.org/software/automake/manual/automake.html) and
|
||||
[autoconf](https://www.gnu.org/savannah-checkouts/gnu/autoconf/manual/autoconf.html) documentation.
|
||||
|
||||
Help!
|
||||
-----
|
||||
### Documentation
|
||||
Please read the following before posting questions to the mailing list so that
|
||||
you can ask better questions and better understand answers.
|
||||
|
||||
* [Frequently asked questions (FAQ)](https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions),
|
||||
* [LUKS Specifications](#specification-and-documentation), and
|
||||
* manuals (aka man page, man pages, man-page)
|
||||
|
||||
The FAQ is available online and in the source code for the project. The specifications are
|
||||
referenced above in this document. The man pages live within the source tree and should be
|
||||
available after installation using standard man commands, e.g. **man cryptsetup**.
|
||||
|
||||
### Mailing List
|
||||
For cryptsetup and LUKS related questions, please use the cryptsetup mailing list
|
||||
[cryptsetup@lists.linux.dev](mailto:cryptsetup@lists.linux.dev),
|
||||
hosted at [kernel.org subspace](https://subspace.kernel.org/lists.linux.dev.html).
|
||||
To subscribe send an empty email message to
|
||||
[cryptsetup+subscribe@lists.linux.dev](mailto:cryptsetup+subscribe@lists.linux.dev).
|
||||
|
||||
You can also browse and/or search the mailing [list archive](https://lore.kernel.org/cryptsetup/).
|
||||
USEnet News (NNTP), Atom feed and git access to the public inbox is available through
|
||||
[lore.kernel.org](https://lore.kernel.org) service.
|
||||
|
||||
The former **dm-crypt** [list archive](https://lore.kernel.org/dm-crypt/) is also available.
|
||||
10
SECURITY.md
10
SECURITY.md
@@ -1,10 +0,0 @@
|
||||
# Reporting a Security Bug in cryptsetup project
|
||||
|
||||
If you think you have discovered a security issue, please report it through
|
||||
the project issue tracker [New issue](https://gitlab.com/cryptsetup/cryptsetup/issues)
|
||||
as a confidential issue (select confidential checkbox).
|
||||
|
||||
An alternative is to send PGP encrypted mail to the cryptsetup maintainer.
|
||||
Current maintainer is [Milan Broz](mailto:gmazyland@gmail.com), use PGP key
|
||||
with fingerprint 2A29 1824 3FDE 4664 8D06 86F9 D9B0 577B D93E 98FC.
|
||||
|
||||
5
TODO
Normal file
5
TODO
Normal file
@@ -0,0 +1,5 @@
|
||||
Version 1.4.0:
|
||||
- Remove old API (all calls using crypt_options)
|
||||
- Support separation of metadata device
|
||||
- Wipe device flag
|
||||
- Add Natty crypto backend
|
||||
53
acinclude.m4
Normal file
53
acinclude.m4
Normal file
@@ -0,0 +1,53 @@
|
||||
dnl MODULE_HELPER(NAME, HELP, DEFAULT, COMMANDS)
|
||||
AC_DEFUN([MODULE_HELPER],[
|
||||
unset have_module
|
||||
AC_ARG_ENABLE([$1], [$2],,[
|
||||
if test "x${enable_all}" = "xdefault"; then
|
||||
enable_[$1]=[$3]
|
||||
else
|
||||
enable_[$1]="${enable_all}"
|
||||
fi
|
||||
])
|
||||
if test "x${enable_[$1]}" != "xno"; then
|
||||
$4
|
||||
AC_MSG_CHECKING([whether to build $1 module])
|
||||
if test -n "${have_module+set}"; then
|
||||
if test "x${enable_[$1]}" = "xauto"; then
|
||||
if test "x${enable_plugins}" != "xno"; then
|
||||
AC_MSG_RESULT([yes, as plugin])
|
||||
build_static=no
|
||||
build_shared=yes
|
||||
else
|
||||
AC_MSG_RESULT([yes])
|
||||
build_static=yes
|
||||
build_shared=no
|
||||
fi
|
||||
elif test "x${enable_[$1]}" = "xshared"; then
|
||||
if test "x${enable_plugins}" != "xno"; then
|
||||
AC_MSG_RESULT([yes, as plugin])
|
||||
build_static=no
|
||||
build_shared=yes
|
||||
else
|
||||
AC_MSG_RESULT([no])
|
||||
AC_MSG_ERROR([Can't build [$1] module, plugins are disabled])
|
||||
fi
|
||||
else
|
||||
AC_MSG_RESULT([yes])
|
||||
build_static=yes
|
||||
build_shared=no
|
||||
fi
|
||||
elif test "x${enable_[$1]}" != "xauto"; then
|
||||
AC_MSG_RESULT([no])
|
||||
AC_MSG_ERROR([Unable to build $1 plugin, see messages above])
|
||||
else
|
||||
AC_MSG_RESULT([no])
|
||||
build_static=no
|
||||
build_shared=no
|
||||
fi
|
||||
else
|
||||
AC_MSG_CHECKING([whether to build $1 module])
|
||||
AC_MSG_RESULT([no])
|
||||
build_static=no
|
||||
build_shared=no
|
||||
fi
|
||||
])
|
||||
50
autogen.sh
50
autogen.sh
@@ -9,31 +9,25 @@ DIE=0
|
||||
(autopoint --version) < /dev/null > /dev/null 2>&1 || {
|
||||
echo
|
||||
echo "**Error**: You must have autopoint installed."
|
||||
echo "Download the appropriate package for your distribution."
|
||||
echo "Download the appropriate package for your distribution,"
|
||||
echo "or see http://www.gnu.org/software/gettext"
|
||||
DIE=1
|
||||
}
|
||||
|
||||
|
||||
(msgfmt --version) < /dev/null > /dev/null 2>&1 || {
|
||||
echo
|
||||
echo "**Warning**: You should have gettext installed."
|
||||
echo "Download the appropriate package for your distribution."
|
||||
echo "To disable translation, you can also use --disable-nls"
|
||||
echo "configure option."
|
||||
}
|
||||
|
||||
(autoconf --version) < /dev/null > /dev/null 2>&1 || {
|
||||
echo
|
||||
echo "**Error**: You must have autoconf installed."
|
||||
echo "Download the appropriate package for your distribution."
|
||||
echo "**Error**: You must have autoconf installed to."
|
||||
echo "Download the appropriate package for your distribution,"
|
||||
echo "or get the source tarball at ftp://ftp.gnu.org/pub/gnu/"
|
||||
DIE=1
|
||||
}
|
||||
|
||||
(grep "^LT_INIT" $srcdir/configure.ac >/dev/null) && {
|
||||
(libtoolize --version) < /dev/null > /dev/null 2>&1 || {
|
||||
(grep "^AM_PROG_LIBTOOL" $srcdir/configure.in >/dev/null) && {
|
||||
(libtool --version) < /dev/null > /dev/null 2>&1 || {
|
||||
echo
|
||||
echo "**Error**: You must have libtoolize installed."
|
||||
echo "Download the appropriate package for your distribution."
|
||||
echo "**Error**: You must have libtool installed."
|
||||
echo "Get ftp://ftp.gnu.org/pub/gnu/"
|
||||
echo "(or a newer version if it is available)"
|
||||
DIE=1
|
||||
}
|
||||
}
|
||||
@@ -41,7 +35,8 @@ DIE=0
|
||||
(automake --version) < /dev/null > /dev/null 2>&1 || {
|
||||
echo
|
||||
echo "**Error**: You must have automake installed."
|
||||
echo "Download the appropriate package for your distribution."
|
||||
echo "Get ftp://ftp.gnu.org/pub/gnu/"
|
||||
echo "(or a newer version if it is available)"
|
||||
DIE=1
|
||||
NO_AUTOMAKE=yes
|
||||
}
|
||||
@@ -52,6 +47,8 @@ test -n "$NO_AUTOMAKE" || (aclocal --version) < /dev/null > /dev/null 2>&1 || {
|
||||
echo
|
||||
echo "**Error**: Missing aclocal. The version of automake"
|
||||
echo "installed doesn't appear recent enough."
|
||||
echo "Get ftp://ftp.gnu.org/pub/gnu/"
|
||||
echo "(or a newer version if it is available)"
|
||||
DIE=1
|
||||
}
|
||||
|
||||
@@ -59,6 +56,13 @@ if test "$DIE" -eq 1; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if test -z "$*"; then
|
||||
echo
|
||||
echo "**Warning**: I am going to run 'configure' with no arguments."
|
||||
echo "If you wish to pass any to it, please specify them on the"
|
||||
echo \'$0\'" command line."
|
||||
fi
|
||||
|
||||
echo
|
||||
echo "Generate build-system by:"
|
||||
echo " autopoint: $(autopoint --version | head -1)"
|
||||
@@ -74,9 +78,13 @@ autopoint --force $AP_OPTS
|
||||
libtoolize --force --copy
|
||||
aclocal -I m4 $AL_OPTS
|
||||
autoheader $AH_OPTS
|
||||
automake --force-missing --add-missing --copy --gnu $AM_OPTS
|
||||
automake --add-missing --gnu $AM_OPTS
|
||||
autoconf $AC_OPTS
|
||||
|
||||
echo
|
||||
echo "Now type '$srcdir/configure' and 'make' to compile."
|
||||
echo
|
||||
if test x$NOCONFIGURE = x; then
|
||||
echo Running $srcdir/configure $conf_flags "$@" ...
|
||||
$srcdir/configure $conf_flags "$@" \
|
||||
&& echo Now type \`make\' to compile $PKG_NAME
|
||||
else
|
||||
echo Skipping configure process.
|
||||
fi
|
||||
|
||||
890
configure.ac
890
configure.ac
@@ -1,890 +0,0 @@
|
||||
AC_PREREQ([2.67])
|
||||
AC_INIT([cryptsetup],[2.9.0-git])
|
||||
|
||||
dnl library version from <major>.<minor>.<release>[-<suffix>]
|
||||
LIBCRYPTSETUP_VERSION=$(echo $PACKAGE_VERSION | cut -f1 -d-)
|
||||
LIBCRYPTSETUP_VERSION_INFO=23:0:11
|
||||
|
||||
AM_SILENT_RULES([yes])
|
||||
AC_CONFIG_SRCDIR(src/cryptsetup.c)
|
||||
AC_CONFIG_MACRO_DIR([m4])
|
||||
|
||||
AC_CONFIG_HEADERS([config.h:config.h.in])
|
||||
|
||||
# We do not want to run test in parallel. Really.
|
||||
# http://lists.gnu.org/archive/html/automake/2013-01/msg00060.html
|
||||
|
||||
# For old automake use this
|
||||
#AM_INIT_AUTOMAKE(dist-xz subdir-objects)
|
||||
AM_INIT_AUTOMAKE([dist-xz 1.12 serial-tests subdir-objects foreign])
|
||||
|
||||
if test "x$prefix" = "xNONE"; then
|
||||
sysconfdir=/etc
|
||||
fi
|
||||
AC_PREFIX_DEFAULT(/usr)
|
||||
|
||||
AC_CANONICAL_HOST
|
||||
AC_USE_SYSTEM_EXTENSIONS
|
||||
AC_PROG_CC
|
||||
AM_PROG_CC_C_O
|
||||
AC_PROG_CPP
|
||||
AC_PROG_CXX
|
||||
AC_PROG_INSTALL
|
||||
AC_PROG_MAKE_SET
|
||||
AC_PROG_MKDIR_P
|
||||
AC_ENABLE_STATIC(no)
|
||||
LT_INIT
|
||||
PKG_PROG_PKG_CONFIG
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl define PKG_CHECK_VAR for old pkg-config <= 0.28
|
||||
m4_ifndef([AS_VAR_COPY],
|
||||
[m4_define([AS_VAR_COPY],
|
||||
[AS_LITERAL_IF([$1[]$2], [$1=$$2], [eval $1=\$$2])])
|
||||
])
|
||||
m4_ifndef([PKG_CHECK_VAR], [
|
||||
AC_DEFUN([PKG_CHECK_VAR],
|
||||
[AC_REQUIRE([PKG_PROG_PKG_CONFIG])
|
||||
AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])
|
||||
|
||||
_PKG_CONFIG([$1], [variable="][$3]["], [$2])
|
||||
AS_VAR_COPY([$1], [pkg_cv_][$1])
|
||||
|
||||
AS_VAR_IF([$1], [""], [$5], [$4])
|
||||
])
|
||||
])
|
||||
dnl ==========================================================================
|
||||
dnl AsciiDoc manual pages
|
||||
|
||||
AC_ARG_ENABLE([asciidoc],
|
||||
AS_HELP_STRING([--disable-asciidoc], [do not generate man pages from asciidoc]),
|
||||
[], [enable_asciidoc=yes]
|
||||
)
|
||||
|
||||
AC_PATH_PROG([ASCIIDOCTOR], [asciidoctor])
|
||||
if test "x$enable_asciidoc" = xyes -a "x$ASCIIDOCTOR" = x; then
|
||||
AC_MSG_ERROR([Building man pages requires asciidoctor installed.])
|
||||
fi
|
||||
AM_CONDITIONAL([ENABLE_ASCIIDOC], [test "x$enable_asciidoc" = xyes])
|
||||
|
||||
have_manpages=no
|
||||
AS_IF([test -f "$srcdir/man/cryptsetup-open.8"], [
|
||||
AC_MSG_NOTICE([re-use already generated man-pages.])
|
||||
have_manpages=yes]
|
||||
)
|
||||
AM_CONDITIONAL([HAVE_MANPAGES], [test "x$have_manpages" = xyes])
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
AC_C_RESTRICT
|
||||
|
||||
AC_HEADER_DIRENT
|
||||
AC_CHECK_HEADERS(fcntl.h malloc.h inttypes.h uchar.h sys/ioctl.h sys/mman.h \
|
||||
sys/sysmacros.h sys/statvfs.h ctype.h unistd.h locale.h byteswap.h endian.h stdint.h)
|
||||
AC_CHECK_DECLS([O_CLOEXEC],,[AC_DEFINE([O_CLOEXEC],[0], [Defined to 0 if not provided])],
|
||||
[[
|
||||
#ifdef HAVE_FCNTL_H
|
||||
# include <fcntl.h>
|
||||
#endif
|
||||
]])
|
||||
|
||||
AC_CHECK_HEADERS(uuid/uuid.h,,[AC_MSG_ERROR([You need the uuid library.])])
|
||||
AC_CHECK_HEADER(libdevmapper.h,,[AC_MSG_ERROR([You need the device-mapper library.])])
|
||||
|
||||
AC_ARG_ENABLE([keyring],
|
||||
AS_HELP_STRING([--disable-keyring], [disable kernel keyring support and builtin kernel keyring token]),
|
||||
[], [enable_keyring=yes])
|
||||
if test "x$enable_keyring" = "xyes"; then
|
||||
AC_CHECK_HEADERS(linux/keyctl.h,,[AC_MSG_ERROR([You need Linux kernel headers with kernel keyring service compiled.])])
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl check whether kernel is compiled with kernel keyring service syscalls
|
||||
AC_CHECK_DECL(__NR_add_key,,[AC_MSG_ERROR([The kernel is missing add_key syscall.])], [#include <syscall.h>])
|
||||
AC_CHECK_DECL(__NR_keyctl,,[AC_MSG_ERROR([The kernel is missing keyctl syscall.])], [#include <syscall.h>])
|
||||
AC_CHECK_DECL(__NR_request_key,,[AC_MSG_ERROR([The kernel is missing request_key syscall.])], [#include <syscall.h>])
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl check that key_serial_t hasn't been adopted yet in stdlib
|
||||
AC_CHECK_TYPES([key_serial_t], [], [], [
|
||||
AC_INCLUDES_DEFAULT
|
||||
#ifdef HAVE_LINUX_KEYCTL_H
|
||||
# include <linux/keyctl.h>
|
||||
#endif
|
||||
])
|
||||
|
||||
AC_DEFINE(KERNEL_KEYRING, 1, [Enable kernel keyring service support])
|
||||
fi
|
||||
AM_CONDITIONAL(KERNEL_KEYRING, test "x$enable_keyring" = "xyes")
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(uuid, uuid_clear, ,[AC_MSG_ERROR([You need the uuid library.])])
|
||||
AC_SUBST(UUID_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
AC_SEARCH_LIBS([clock_gettime],[rt posix4])
|
||||
AC_CHECK_FUNCS([posix_memalign clock_gettime posix_fallocate explicit_bzero])
|
||||
|
||||
if test "x$enable_largefile" = "xno"; then
|
||||
AC_MSG_ERROR([Building with --disable-largefile is not supported, it can cause data corruption.])
|
||||
fi
|
||||
|
||||
AC_C_BIGENDIAN
|
||||
AC_TYPE_OFF_T
|
||||
AC_SYS_LARGEFILE
|
||||
AC_FUNC_FSEEKO
|
||||
AC_FUNC_STRERROR_R
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl LUKS2 external tokens
|
||||
|
||||
AC_ARG_ENABLE([external-tokens],
|
||||
AS_HELP_STRING([--disable-external-tokens], [disable external LUKS2 tokens]),
|
||||
[], [enable_external_tokens=yes])
|
||||
if test "x$enable_external_tokens" = "xyes"; then
|
||||
AC_DEFINE(USE_EXTERNAL_TOKENS, 1, [Use external tokens])
|
||||
dnl we need dynamic library loading here
|
||||
saved_LIBS=$LIBS
|
||||
AC_SEARCH_LIBS([dlsym],[dl])
|
||||
AC_CHECK_FUNCS([dlvsym])
|
||||
AC_SUBST(DL_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
fi
|
||||
AM_CONDITIONAL(EXTERNAL_TOKENS, test "x$enable_external_tokens" = "xyes")
|
||||
|
||||
AC_ARG_ENABLE([ssh-token],
|
||||
AS_HELP_STRING([--disable-ssh-token], [disable LUKS2 ssh-token]),
|
||||
[], [enable_ssh_token=yes])
|
||||
AM_CONDITIONAL(SSHPLUGIN_TOKEN, test "x$enable_ssh_token" = "xyes")
|
||||
|
||||
if test "x$enable_ssh_token" = "xyes" -a "x$enable_external_tokens" = "xno"; then
|
||||
AC_MSG_ERROR([Requested LUKS2 ssh-token build, but external tokens are disabled.])
|
||||
fi
|
||||
|
||||
dnl LUKS2 online reencryption
|
||||
AC_ARG_ENABLE([luks2-reencryption],
|
||||
AS_HELP_STRING([--disable-luks2-reencryption], [disable LUKS2 online reencryption extension]),
|
||||
[], [enable_luks2_reencryption=yes])
|
||||
if test "x$enable_luks2_reencryption" = "xyes"; then
|
||||
AC_DEFINE(USE_LUKS2_REENCRYPTION, 1, [Use LUKS2 online reencryption extension])
|
||||
fi
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
AM_GNU_GETTEXT([external],[need-ngettext])
|
||||
AM_GNU_GETTEXT_VERSION([0.18.3])
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(popt, poptConfigFileToString,,
|
||||
[AC_MSG_ERROR([You need popt 1.7 or newer to compile.])])
|
||||
AC_SUBST(POPT_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl FIPS extensions
|
||||
AC_ARG_ENABLE([fips],
|
||||
AS_HELP_STRING([--enable-fips], [enable FIPS mode restrictions]))
|
||||
if test "x$enable_fips" = "xyes"; then
|
||||
AC_DEFINE(ENABLE_FIPS, 1, [Enable FIPS mode restrictions])
|
||||
|
||||
if test "x$enable_static" = "xyes" -o "x$enable_static_cryptsetup" = "xyes" ; then
|
||||
AC_MSG_ERROR([Static build is not compatible with FIPS.])
|
||||
fi
|
||||
fi
|
||||
|
||||
AC_DEFUN([NO_FIPS], [
|
||||
if test "x$enable_fips" = "xyes"; then
|
||||
AC_MSG_ERROR([This option is not compatible with FIPS.])
|
||||
fi
|
||||
])
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl pwquality library (cryptsetup CLI only)
|
||||
AC_ARG_ENABLE([pwquality],
|
||||
AS_HELP_STRING([--enable-pwquality], [enable password quality checking using pwquality library]))
|
||||
|
||||
if test "x$enable_pwquality" = "xyes"; then
|
||||
AC_DEFINE(ENABLE_PWQUALITY, 1, [Enable password quality checking using pwquality library])
|
||||
PKG_CHECK_MODULES([PWQUALITY], [pwquality >= 1.0.0],,
|
||||
AC_MSG_ERROR([You need pwquality library.]))
|
||||
|
||||
dnl FIXME: this is really hack for now
|
||||
PWQUALITY_STATIC_LIBS="$PWQUALITY_LIBS -lcrack -lz"
|
||||
fi
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl fuzzers, it requires own static library compilation later
|
||||
AC_ARG_ENABLE([fuzz-targets],
|
||||
AS_HELP_STRING([--enable-fuzz-targets], [enable building fuzz targets]))
|
||||
AM_CONDITIONAL(ENABLE_FUZZ_TARGETS, test "x$enable_fuzz_targets" = "xyes")
|
||||
|
||||
if test "x$enable_fuzz_targets" = "xyes"; then
|
||||
AX_CHECK_COMPILE_FLAG([-fsanitize=fuzzer-no-link],,
|
||||
AC_MSG_ERROR([Required compiler options not supported; use clang.]), [-Werror])
|
||||
fi
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl passwdqc library (cryptsetup CLI only)
|
||||
AC_ARG_ENABLE([passwdqc],
|
||||
AS_HELP_STRING([--enable-passwdqc@<:@=CONFIG_PATH@:>@],
|
||||
[enable password quality checking using passwdqc library (optionally with CONFIG_PATH)]))
|
||||
|
||||
case "$enable_passwdqc" in
|
||||
""|yes|no) use_passwdqc_config="" ;;
|
||||
/*) use_passwdqc_config="$enable_passwdqc"; enable_passwdqc=yes ;;
|
||||
*) AC_MSG_ERROR([Unrecognized --enable-passwdqc parameter.]) ;;
|
||||
esac
|
||||
AC_DEFINE_UNQUOTED([PASSWDQC_CONFIG_FILE], ["$use_passwdqc_config"], [passwdqc library config file])
|
||||
|
||||
if test "x$enable_passwdqc" = "xyes"; then
|
||||
AC_DEFINE(ENABLE_PASSWDQC, 1, [Enable password quality checking using passwdqc library])
|
||||
|
||||
saved_LIBS="$LIBS"
|
||||
AC_SEARCH_LIBS([passwdqc_check], [passwdqc])
|
||||
case "$ac_cv_search_passwdqc_check" in
|
||||
no) AC_MSG_ERROR([failed to find passwdqc_check]) ;;
|
||||
-l*) PASSWDQC_LIBS="$ac_cv_search_passwdqc_check" ;;
|
||||
*) PASSWDQC_LIBS= ;;
|
||||
esac
|
||||
AC_CHECK_FUNCS([passwdqc_params_free])
|
||||
LIBS="$saved_LIBS"
|
||||
fi
|
||||
|
||||
if test "x$enable_pwquality$enable_passwdqc" = "xyesyes"; then
|
||||
AC_MSG_ERROR([--enable-pwquality and --enable-passwdqc are mutually incompatible.])
|
||||
fi
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl Crypto backend functions
|
||||
|
||||
AC_DEFUN([CONFIGURE_GCRYPT], [
|
||||
if test "x$enable_fips" = "xyes"; then
|
||||
GCRYPT_REQ_VERSION=1.4.5
|
||||
else
|
||||
GCRYPT_REQ_VERSION=1.1.42
|
||||
fi
|
||||
|
||||
use_internal_pbkdf2=0
|
||||
use_internal_argon2=1
|
||||
|
||||
dnl libgcrypt rejects to use pkgconfig, use AM_PATH_LIBGCRYPT from gcrypt-devel here.
|
||||
dnl Do not require gcrypt-devel if other crypto backend is used.
|
||||
m4_ifdef([AM_PATH_LIBGCRYPT],[
|
||||
AC_ARG_ENABLE([gcrypt-pbkdf2],
|
||||
dnl Check if we can use gcrypt PBKDF2 (1.6.0 supports empty password)
|
||||
AS_HELP_STRING([--enable-gcrypt-pbkdf2], [force enable internal gcrypt PBKDF2]),
|
||||
if test "x$enableval" = "xyes"; then
|
||||
[use_internal_pbkdf2=0]
|
||||
else
|
||||
[use_internal_pbkdf2=1]
|
||||
fi,
|
||||
[AM_PATH_LIBGCRYPT([1.6.1], [use_internal_pbkdf2=0], [use_internal_pbkdf2=1])])
|
||||
AM_PATH_LIBGCRYPT($GCRYPT_REQ_VERSION,,[AC_MSG_ERROR([You need the gcrypt library.])])],
|
||||
AC_MSG_ERROR([Missing support for gcrypt: install gcrypt and regenerate configure.]))
|
||||
|
||||
AC_MSG_CHECKING([if internal cryptsetup PBKDF2 is compiled-in])
|
||||
if test $use_internal_pbkdf2 = 0; then
|
||||
AC_MSG_RESULT([no])
|
||||
else
|
||||
AC_MSG_RESULT([yes])
|
||||
NO_FIPS([])
|
||||
fi
|
||||
|
||||
m4_ifdef([AM_PATH_LIBGCRYPT],[
|
||||
AC_ARG_ENABLE([gcrypt-argon2],
|
||||
dnl Check if we can use gcrypt Argon2 (1.11.0 supports empty password)
|
||||
AS_HELP_STRING([--disable-gcrypt-argon2], [force disable internal gcrypt Argon2]),
|
||||
[],
|
||||
[AM_PATH_LIBGCRYPT([1.11.0], [use_internal_argon2=0], [use_internal_argon2=1])])
|
||||
AM_PATH_LIBGCRYPT($GCRYPT_REQ_VERSION,,[AC_MSG_ERROR([You need the gcrypt library.])])],
|
||||
AC_MSG_ERROR([Missing support for gcrypt: install gcrypt and regenerate configure.]))
|
||||
|
||||
AC_MSG_CHECKING([if internal cryptsetup Argon2 is compiled-in])
|
||||
if test $use_internal_argon2 = 0; then
|
||||
AC_MSG_RESULT([no])
|
||||
else
|
||||
AC_MSG_RESULT([yes])
|
||||
fi
|
||||
|
||||
AC_CHECK_DECLS([GCRY_CIPHER_MODE_XTS], [], [], [#include <gcrypt.h>])
|
||||
AC_CHECK_DECLS([GCRY_KDF_ARGON2], [], [], [#include <gcrypt.h>])
|
||||
|
||||
if test "x$enable_static_cryptsetup" = "xyes"; then
|
||||
saved_LIBS=$LIBS
|
||||
LIBS="$saved_LIBS $LIBGCRYPT_LIBS -static"
|
||||
AC_CHECK_LIB(gcrypt, gcry_check_version,,
|
||||
AC_MSG_ERROR([Cannot find static gcrypt library.]),
|
||||
[-lgpg-error])
|
||||
LIBGCRYPT_STATIC_LIBS="$LIBGCRYPT_LIBS -lgpg-error"
|
||||
LIBS=$saved_LIBS
|
||||
fi
|
||||
|
||||
CRYPTO_CFLAGS=$LIBGCRYPT_CFLAGS
|
||||
CRYPTO_LIBS=$LIBGCRYPT_LIBS
|
||||
CRYPTO_STATIC_LIBS=$LIBGCRYPT_STATIC_LIBS
|
||||
|
||||
AC_DEFINE_UNQUOTED(GCRYPT_REQ_VERSION, ["$GCRYPT_REQ_VERSION"], [Requested gcrypt version])
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_OPENSSL], [
|
||||
PKG_CHECK_MODULES([LIBCRYPTO], [libcrypto >= 0.9.8],,
|
||||
AC_MSG_ERROR([You need openssl library.]))
|
||||
CRYPTO_CFLAGS=$LIBCRYPTO_CFLAGS
|
||||
CRYPTO_LIBS=$LIBCRYPTO_LIBS
|
||||
use_internal_pbkdf2=0
|
||||
use_internal_argon2=1
|
||||
|
||||
if test "x$enable_static_cryptsetup" = "xyes"; then
|
||||
saved_PKG_CONFIG=$PKG_CONFIG
|
||||
PKG_CONFIG="$PKG_CONFIG --static"
|
||||
PKG_CHECK_MODULES([LIBCRYPTO_STATIC], [libcrypto])
|
||||
CRYPTO_STATIC_LIBS=$LIBCRYPTO_STATIC_LIBS
|
||||
PKG_CONFIG=$saved_PKG_CONFIG
|
||||
fi
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_DECLS([OSSL_get_max_threads], [], [], [#include <openssl/thread.h>])
|
||||
AC_CHECK_DECLS([OSSL_KDF_PARAM_ARGON2_VERSION], [use_internal_argon2=0], [], [#include <openssl/core_names.h>])
|
||||
LIBS=$saved_LIBS
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_NSS], [
|
||||
if test "x$enable_static_cryptsetup" = "xyes"; then
|
||||
AC_MSG_ERROR([Static build of cryptsetup is not supported with NSS.])
|
||||
fi
|
||||
|
||||
AC_MSG_WARN([NSS backend does NOT provide backward compatibility (missing ripemd160 hash).])
|
||||
|
||||
PKG_CHECK_MODULES([NSS], [nss],,
|
||||
AC_MSG_ERROR([You need nss library.]))
|
||||
|
||||
saved_CFLAGS=$CFLAGS
|
||||
CFLAGS="$CFLAGS $NSS_CFLAGS"
|
||||
AC_CHECK_DECLS([NSS_GetVersion], [], [], [#include <nss.h>])
|
||||
CFLAGS=$saved_CFLAGS
|
||||
|
||||
CRYPTO_CFLAGS=$NSS_CFLAGS
|
||||
CRYPTO_LIBS=$NSS_LIBS
|
||||
use_internal_pbkdf2=1
|
||||
use_internal_argon2=1
|
||||
NO_FIPS([])
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_KERNEL], [
|
||||
AC_CHECK_HEADERS(linux/if_alg.h,,
|
||||
[AC_MSG_ERROR([You need Linux kernel headers with userspace crypto interface.])])
|
||||
# AC_CHECK_DECLS([AF_ALG],,
|
||||
# [AC_MSG_ERROR([You need Linux kernel with userspace crypto interface.])],
|
||||
# [#include <sys/socket.h>])
|
||||
use_internal_pbkdf2=1
|
||||
use_internal_argon2=1
|
||||
NO_FIPS([])
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_NETTLE], [
|
||||
AC_CHECK_HEADERS(nettle/sha.h,,
|
||||
[AC_MSG_ERROR([You need Nettle cryptographic library.])])
|
||||
AC_CHECK_HEADERS(nettle/version.h)
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(nettle, nettle_pbkdf2_hmac_sha256,,
|
||||
[AC_MSG_ERROR([You need Nettle library version 2.6 or more recent.])])
|
||||
CRYPTO_LIBS=$LIBS
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
CRYPTO_STATIC_LIBS=$CRYPTO_LIBS
|
||||
use_internal_pbkdf2=0
|
||||
use_internal_argon2=1
|
||||
NO_FIPS([])
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_MBEDTLS], [
|
||||
AC_CHECK_HEADERS(mbedtls/version.h,,
|
||||
[AC_MSG_ERROR([You need mbedTLS cryptographic library.])])
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(mbedcrypto, mbedtls_md_init,,
|
||||
[AC_MSG_ERROR([You need mbedTLS cryptographic library.])])
|
||||
AC_CHECK_FUNCS(mbedtls_pkcs5_pbkdf2_hmac_ext)
|
||||
CRYPTO_LIBS=$LIBS
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
CRYPTO_STATIC_LIBS=$CRYPTO_LIBS
|
||||
use_internal_pbkdf2=0
|
||||
use_internal_argon2=1
|
||||
NO_FIPS([])
|
||||
])
|
||||
|
||||
dnl ==========================================================================
|
||||
saved_LIBS=$LIBS
|
||||
|
||||
AC_ARG_ENABLE([static-cryptsetup],
|
||||
AS_HELP_STRING([--enable-static-cryptsetup], [enable build of static version of tools]))
|
||||
if test "x$enable_static_cryptsetup" = "xyes"; then
|
||||
if test "x$enable_static" = "xno"; then
|
||||
AC_MSG_WARN([Requested static cryptsetup build, enabling static library.])
|
||||
enable_static=yes
|
||||
fi
|
||||
fi
|
||||
AM_CONDITIONAL(STATIC_TOOLS, test "x$enable_static_cryptsetup" = "xyes")
|
||||
|
||||
AC_ARG_ENABLE([cryptsetup],
|
||||
AS_HELP_STRING([--disable-cryptsetup], [disable cryptsetup support]),
|
||||
[], [enable_cryptsetup=yes])
|
||||
AM_CONDITIONAL(CRYPTSETUP, test "x$enable_cryptsetup" = "xyes")
|
||||
|
||||
AC_ARG_ENABLE([veritysetup],
|
||||
AS_HELP_STRING([--disable-veritysetup], [disable veritysetup support]),
|
||||
[], [enable_veritysetup=yes])
|
||||
AM_CONDITIONAL(VERITYSETUP, test "x$enable_veritysetup" = "xyes")
|
||||
|
||||
AC_ARG_ENABLE([integritysetup],
|
||||
AS_HELP_STRING([--disable-integritysetup], [disable integritysetup support]),
|
||||
[], [enable_integritysetup=yes])
|
||||
AM_CONDITIONAL(INTEGRITYSETUP, test "x$enable_integritysetup" = "xyes")
|
||||
|
||||
AC_ARG_ENABLE([selinux],
|
||||
AS_HELP_STRING([--disable-selinux], [disable selinux support [default=auto]]),
|
||||
[], [enable_selinux=yes])
|
||||
|
||||
AC_ARG_ENABLE([udev],
|
||||
AS_HELP_STRING([--disable-udev], [disable udev support]),
|
||||
[], [enable_udev=yes])
|
||||
|
||||
dnl Try to use pkg-config for devmapper, but fallback to old detection
|
||||
PKG_CHECK_MODULES([DEVMAPPER], [devmapper >= 1.02.03],, [
|
||||
AC_CHECK_LIB(devmapper, dm_task_set_name,,
|
||||
[AC_MSG_ERROR([You need the device-mapper library.])])
|
||||
AC_CHECK_LIB(devmapper, dm_task_set_message,,
|
||||
[AC_MSG_ERROR([The device-mapper library on your system is too old.])])
|
||||
DEVMAPPER_LIBS=$LIBS
|
||||
])
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
LIBS="$LIBS $DEVMAPPER_LIBS"
|
||||
AC_CHECK_DECLS([dm_task_secure_data], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([dm_task_retry_remove], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([dm_task_deferred_remove], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([dm_device_has_mounted_fs], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([dm_device_has_holders], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([dm_device_get_name], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([DM_DEVICE_GET_TARGET_VERSION], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([DM_UDEV_DISABLE_DISK_RULES_FLAG], [have_cookie=yes], [have_cookie=no], [#include <libdevmapper.h>])
|
||||
if test "x$enable_udev" = xyes; then
|
||||
if test "x$have_cookie" = xno; then
|
||||
AC_MSG_WARN([The device-mapper library on your system has no udev support, udev support disabled.])
|
||||
else
|
||||
AC_DEFINE(USE_UDEV, 1, [Try to use udev synchronisation?])
|
||||
fi
|
||||
fi
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
dnl Check for JSON-C used in LUKS2
|
||||
PKG_CHECK_MODULES([JSON_C], [json-c])
|
||||
AC_CHECK_DECLS([json_object_object_add_ex], [], [], [#include <json-c/json.h>])
|
||||
AC_CHECK_DECLS([json_object_deep_copy], [], [], [#include <json-c/json.h>])
|
||||
|
||||
dnl Check for libssh and argp for SSH plugin
|
||||
if test "x$enable_ssh_token" = "xyes"; then
|
||||
PKG_CHECK_MODULES([LIBSSH], [libssh])
|
||||
AC_CHECK_DECLS([ssh_session_is_known_server], [], [], [#include <libssh/libssh.h>])
|
||||
AC_CHECK_HEADER([argp.h], [], AC_MSG_ERROR([You need argp library.]))
|
||||
saved_LIBS=$LIBS
|
||||
AC_SEARCH_LIBS([argp_parse],[argp])
|
||||
AC_SUBST(ARGP_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
fi
|
||||
|
||||
dnl Crypto backend configuration.
|
||||
AC_ARG_WITH([crypto_backend],
|
||||
AS_HELP_STRING([--with-crypto_backend=BACKEND], [crypto backend (gcrypt/openssl/nss/kernel/nettle/mbedtls) [openssl]]),
|
||||
[], [with_crypto_backend=openssl])
|
||||
|
||||
dnl Kernel crypto API backend needed for benchmark and tcrypt
|
||||
AC_ARG_ENABLE([kernel_crypto],
|
||||
AS_HELP_STRING([--disable-kernel_crypto], [disable kernel userspace crypto (no benchmark and tcrypt)]),
|
||||
[], [enable_kernel_crypto=yes])
|
||||
|
||||
if test "x$enable_kernel_crypto" = "xyes"; then
|
||||
AC_CHECK_HEADERS(linux/if_alg.h,,
|
||||
[AC_MSG_ERROR([You need Linux kernel headers with userspace crypto interface. (Or use --disable-kernel_crypto.)])])
|
||||
AC_DEFINE(ENABLE_AF_ALG, 1, [Enable using of kernel userspace crypto])
|
||||
fi
|
||||
|
||||
case $with_crypto_backend in
|
||||
gcrypt) CONFIGURE_GCRYPT([]) ;;
|
||||
openssl) CONFIGURE_OPENSSL([]) ;;
|
||||
nss) CONFIGURE_NSS([]) ;;
|
||||
kernel) CONFIGURE_KERNEL([]) ;;
|
||||
nettle) CONFIGURE_NETTLE([]) ;;
|
||||
mbedtls) CONFIGURE_MBEDTLS([]) ;;
|
||||
*) AC_MSG_ERROR([Unknown crypto backend.]) ;;
|
||||
esac
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_GCRYPT, test "$with_crypto_backend" = "gcrypt")
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_OPENSSL, test "$with_crypto_backend" = "openssl")
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_NSS, test "$with_crypto_backend" = "nss")
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_KERNEL, test "$with_crypto_backend" = "kernel")
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_NETTLE, test "$with_crypto_backend" = "nettle")
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_MBEDTLS, test "$with_crypto_backend" = "mbedtls")
|
||||
|
||||
AM_CONDITIONAL(CRYPTO_INTERNAL_PBKDF2, test $use_internal_pbkdf2 = 1)
|
||||
AC_DEFINE_UNQUOTED(USE_INTERNAL_PBKDF2, [$use_internal_pbkdf2], [Use internal PBKDF2])
|
||||
|
||||
dnl Argon2 implementation
|
||||
AC_ARG_ENABLE([internal-argon2],
|
||||
AS_HELP_STRING([--disable-internal-argon2], [disable internal implementation of Argon2 PBKDF]),
|
||||
[], [enable_internal_argon2=yes])
|
||||
|
||||
AC_ARG_ENABLE([libargon2],
|
||||
AS_HELP_STRING([--enable-libargon2], [enable external libargon2 (PHC) library (disables internal bundled version)]))
|
||||
|
||||
if test $use_internal_argon2 = 0 || ( test "x$enable_internal_argon2" = "xno" && test "x$enable_libargon2" != "xyes" ); then
|
||||
if test "x$enable_internal_argon2" = "xyes" || test "x$enable_libargon2" = "xyes"; then
|
||||
AC_MSG_NOTICE([Argon2 in $with_crypto_backend lib is used; internal Argon2 options are ignored.])
|
||||
fi
|
||||
enable_internal_argon2=no
|
||||
enable_internal_sse_argon2=no
|
||||
enable_libargon2=no
|
||||
use_internal_argon2=0
|
||||
elif test "x$enable_libargon2" = "xyes" ; then
|
||||
AC_CHECK_HEADERS(argon2.h,,
|
||||
[AC_MSG_ERROR([You need libargon2 development library installed.])])
|
||||
AC_CHECK_DECL(Argon2_id,,[AC_MSG_ERROR([You need more recent Argon2 library with support for Argon2id.])], [#include <argon2.h>])
|
||||
PKG_CHECK_MODULES([LIBARGON2], [libargon2],,[LIBARGON2_LIBS="-largon2"])
|
||||
enable_internal_argon2=no
|
||||
use_internal_argon2=0
|
||||
else
|
||||
AC_MSG_WARN([Argon2 bundled (slow) reference implementation will be used, please consider to use system library with --enable-libargon2.])
|
||||
|
||||
AC_ARG_ENABLE([internal-sse-argon2],
|
||||
AS_HELP_STRING([--enable-internal-sse-argon2], [enable internal SSE implementation of Argon2 PBKDF]))
|
||||
|
||||
if test "x$enable_internal_sse_argon2" = "xyes"; then
|
||||
AC_MSG_CHECKING(if Argon2 SSE optimization can be used)
|
||||
AC_LINK_IFELSE([AC_LANG_PROGRAM([[
|
||||
#include <emmintrin.h>
|
||||
__m128i testfunc(__m128i *a, __m128i *b) {
|
||||
return _mm_xor_si128(_mm_loadu_si128(a), _mm_loadu_si128(b));
|
||||
}
|
||||
]])],,[enable_internal_sse_argon2=no])
|
||||
AC_MSG_RESULT($enable_internal_sse_argon2)
|
||||
fi
|
||||
fi
|
||||
|
||||
AM_CONDITIONAL(CRYPTO_INTERNAL_ARGON2, test "x$enable_internal_argon2" = "xyes")
|
||||
AM_CONDITIONAL(CRYPTO_INTERNAL_SSE_ARGON2, test "x$enable_internal_sse_argon2" = "xyes")
|
||||
dnl If libargon is in use, we have defined HAVE_ARGON2_H
|
||||
AC_DEFINE_UNQUOTED(USE_INTERNAL_ARGON2, [$use_internal_argon2], [Use internal Argon2])
|
||||
|
||||
dnl Link with blkid to check for other device types
|
||||
AC_ARG_ENABLE([blkid],
|
||||
AS_HELP_STRING([--disable-blkid], [disable use of blkid for device signature detection and wiping]),
|
||||
[], [enable_blkid=yes])
|
||||
|
||||
if test "x$enable_blkid" = "xyes"; then
|
||||
PKG_CHECK_MODULES([BLKID], [blkid],[AC_DEFINE([HAVE_BLKID], 1, [Define to 1 to use blkid for detection of disk signatures.])],[LIBBLKID_LIBS="-lblkid"])
|
||||
|
||||
AC_CHECK_HEADERS(blkid/blkid.h,,[AC_MSG_ERROR([You need blkid development library installed.])])
|
||||
AC_CHECK_DECL([blkid_do_wipe],
|
||||
[ AC_DEFINE([HAVE_BLKID_WIPE], 1, [Define to 1 to use blkid_do_wipe.])
|
||||
enable_blkid_wipe=yes
|
||||
],,
|
||||
[#include <blkid/blkid.h>])
|
||||
AC_CHECK_DECL([blkid_probe_step_back],
|
||||
[ AC_DEFINE([HAVE_BLKID_STEP_BACK], 1, [Define to 1 to use blkid_probe_step_back.])
|
||||
enable_blkid_step_back=yes
|
||||
],,
|
||||
[#include <blkid/blkid.h>])
|
||||
AC_CHECK_DECLS([ blkid_reset_probe,
|
||||
blkid_probe_set_device,
|
||||
blkid_probe_filter_superblocks_type,
|
||||
blkid_do_safeprobe,
|
||||
blkid_do_probe,
|
||||
blkid_probe_lookup_value
|
||||
],,
|
||||
[AC_MSG_ERROR([Can not compile with blkid support, disable it by --disable-blkid.])],
|
||||
[#include <blkid/blkid.h>])
|
||||
fi
|
||||
AM_CONDITIONAL(HAVE_BLKID, test "x$enable_blkid" = "xyes")
|
||||
AM_CONDITIONAL(HAVE_BLKID_WIPE, test "x$enable_blkid_wipe" = "xyes")
|
||||
AM_CONDITIONAL(HAVE_BLKID_STEP_BACK, test "x$enable_blkid_step_back" = "xyes")
|
||||
|
||||
AC_ARG_ENABLE([hw-opal],
|
||||
AS_HELP_STRING([--disable-hw-opal], [disable use of hardware-backed OPAL for device encryption]),
|
||||
[],
|
||||
[enable_hw_opal=yes])
|
||||
|
||||
if test "x$enable_hw_opal" = "xyes"; then
|
||||
have_opal=yes
|
||||
AC_CHECK_DECLS([ OPAL_FL_SUM_SUPPORTED,
|
||||
IOC_OPAL_GET_LR_STATUS,
|
||||
IOC_OPAL_GET_GEOMETRY
|
||||
],
|
||||
[],
|
||||
[have_opal=no],
|
||||
[#include <linux/sed-opal.h>])
|
||||
if test "x$have_opal" = "xyes"; then
|
||||
AC_DEFINE([HAVE_HW_OPAL], 1, [Define to 1 to enable OPAL support.])
|
||||
else
|
||||
AC_MSG_WARN([Can not compile with OPAL support, kernel headers are too old, requires v6.4.])
|
||||
fi
|
||||
fi
|
||||
|
||||
dnl Magic for cryptsetup.static build.
|
||||
if test "x$enable_static_cryptsetup" = "xyes"; then
|
||||
saved_PKG_CONFIG=$PKG_CONFIG
|
||||
PKG_CONFIG="$PKG_CONFIG --static"
|
||||
|
||||
LIBS="$saved_LIBS -static"
|
||||
AC_CHECK_LIB(popt, poptGetContext,,
|
||||
AC_MSG_ERROR([Cannot find static popt library.]))
|
||||
|
||||
dnl Try to detect needed device-mapper static libraries, try pkg-config first.
|
||||
LIBS="$saved_LIBS -static"
|
||||
PKG_CHECK_MODULES([DEVMAPPER_STATIC], [devmapper >= 1.02.27],,[
|
||||
DEVMAPPER_STATIC_LIBS=$DEVMAPPER_LIBS
|
||||
if test "x$enable_selinux" = "xyes"; then
|
||||
AC_CHECK_LIB(sepol, sepol_bool_set)
|
||||
AC_CHECK_LIB(selinux, is_selinux_enabled)
|
||||
DEVMAPPER_STATIC_LIBS="$DEVMAPPER_STATIC_LIBS $LIBS"
|
||||
fi
|
||||
])
|
||||
LIBS="$saved_LIBS $DEVMAPPER_STATIC_LIBS"
|
||||
AC_CHECK_LIB(devmapper, dm_task_set_uuid,,
|
||||
AC_MSG_ERROR([Cannot link with static device-mapper library.]))
|
||||
|
||||
dnl Try to detect uuid static library.
|
||||
LIBS="$saved_LIBS -static"
|
||||
AC_CHECK_LIB(uuid, uuid_generate,,
|
||||
AC_MSG_ERROR([Cannot find static uuid library.]))
|
||||
|
||||
LIBS=$saved_LIBS
|
||||
PKG_CONFIG=$saved_PKG_CONFIG
|
||||
fi
|
||||
|
||||
dnl Check compiler support for symver function attribute
|
||||
AC_MSG_CHECKING([for symver attribute support])
|
||||
saved_CFLAGS=$CFLAGS
|
||||
CFLAGS="-O0 -Werror"
|
||||
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
|
||||
void _test_sym(void);
|
||||
__attribute__((__symver__("sym@VERSION_4.2"))) void _test_sym(void) {}
|
||||
]],
|
||||
[[ _test_sym() ]]
|
||||
)],[
|
||||
AC_DEFINE([HAVE_ATTRIBUTE_SYMVER], 1, [Define to 1 to use __attribute__((symver))])
|
||||
AC_MSG_RESULT([yes])
|
||||
], [
|
||||
AC_MSG_RESULT([no])
|
||||
])
|
||||
CFLAGS=$saved_CFLAGS
|
||||
|
||||
dnl Force compiler to use zero_call_used_regs("used") to check for the function attribute support.
|
||||
dnl Otherwise the compiler may falsely advertise it with __has_attribute operator, even though
|
||||
dnl it does not implement it on some archs.
|
||||
AC_MSG_CHECKING([for zero_call_used_regs(user)])
|
||||
saved_CFLAGS=$CFLAGS
|
||||
CFLAGS="-O0 -Werror"
|
||||
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
|
||||
void _test_function(void);
|
||||
__attribute__((zero_call_used_regs("used"))) void _test_function(void) {
|
||||
volatile int *i; volatile int j = 0; if (j) *i = 0;
|
||||
}
|
||||
]],
|
||||
[[ _test_function() ]]
|
||||
)],[
|
||||
AC_DEFINE([HAVE_ATTRIBUTE_ZEROCALLUSEDREGS], 1, [Define to 1 to use __attribute__((zero_call_used_regs("used")))])
|
||||
AC_MSG_RESULT([yes])
|
||||
], [
|
||||
AC_MSG_RESULT([no])
|
||||
])
|
||||
CFLAGS=$saved_CFLAGS
|
||||
|
||||
AC_MSG_CHECKING([for systemd tmpfiles config directory])
|
||||
if test "x$prefix" != "xNONE"; then
|
||||
saved_PKG_CONFIG=$PKG_CONFIG
|
||||
PKG_CONFIG="$PKG_CONFIG --define-variable=prefix='${prefix}'"
|
||||
PKG_CHECK_VAR([systemd_tmpfilesdir], [systemd], [tmpfilesdir], [], [systemd_tmpfilesdir=no])
|
||||
PKG_CONFIG=$saved_PKG_CONFIG
|
||||
else
|
||||
PKG_CHECK_VAR([systemd_tmpfilesdir], [systemd], [tmpfilesdir], [], [systemd_tmpfilesdir=no])
|
||||
fi
|
||||
AC_MSG_RESULT([$systemd_tmpfilesdir])
|
||||
|
||||
AC_SUBST([DEVMAPPER_LIBS])
|
||||
AC_SUBST([DEVMAPPER_STATIC_LIBS])
|
||||
|
||||
AC_SUBST([PWQUALITY_LIBS])
|
||||
AC_SUBST([PWQUALITY_STATIC_LIBS])
|
||||
|
||||
AC_SUBST([PASSWDQC_LIBS])
|
||||
|
||||
AC_SUBST([CRYPTO_CFLAGS])
|
||||
AC_SUBST([CRYPTO_LIBS])
|
||||
AC_SUBST([CRYPTO_STATIC_LIBS])
|
||||
|
||||
AC_SUBST([JSON_C_LIBS])
|
||||
AC_SUBST([LIBARGON2_LIBS])
|
||||
AC_SUBST([BLKID_LIBS])
|
||||
|
||||
AC_SUBST([LIBSSH_LIBS])
|
||||
|
||||
AC_SUBST([LIBCRYPTSETUP_VERSION])
|
||||
AC_SUBST([LIBCRYPTSETUP_VERSION_INFO])
|
||||
|
||||
dnl Set Requires.private for libcryptsetup.pc
|
||||
dnl pwquality is used only by tools
|
||||
PKGMODULES="uuid devmapper json-c"
|
||||
case $with_crypto_backend in
|
||||
gcrypt) PKGMODULES="$PKGMODULES libgcrypt" ;;
|
||||
openssl) PKGMODULES="$PKGMODULES openssl" ;;
|
||||
nss) PKGMODULES="$PKGMODULES nss" ;;
|
||||
nettle) PKGMODULES="$PKGMODULES nettle" ;;
|
||||
esac
|
||||
if test "x$enable_libargon2" = "xyes"; then
|
||||
PKGMODULES="$PKGMODULES libargon2"
|
||||
fi
|
||||
if test "x$enable_blkid" = "xyes"; then
|
||||
PKGMODULES="$PKGMODULES blkid"
|
||||
fi
|
||||
AC_SUBST([PKGMODULES])
|
||||
dnl ==========================================================================
|
||||
AC_ARG_ENABLE([dev-random],
|
||||
AS_HELP_STRING([--enable-dev-random], [use /dev/random by default for key generation (otherwise use /dev/urandom)]))
|
||||
if test "x$enable_dev_random" = "xyes"; then
|
||||
default_rng=/dev/random
|
||||
else
|
||||
default_rng=/dev/urandom
|
||||
fi
|
||||
AC_DEFINE_UNQUOTED(DEFAULT_RNG, ["$default_rng"], [default RNG type for key generator])
|
||||
|
||||
dnl ==========================================================================
|
||||
AC_DEFUN([CS_DEFINE],
|
||||
[AC_DEFINE_UNQUOTED(DEFAULT_[]m4_translit([$1], [-a-z], [_A-Z]), [$2], [$3])
|
||||
])
|
||||
|
||||
AC_DEFUN([CS_STR_WITH], [AC_ARG_WITH([$1],
|
||||
[AS_HELP_STRING(--with-[$1], [default $2 [$3]])],
|
||||
[CS_DEFINE([$1], ["$withval"], [$2])],
|
||||
[CS_DEFINE([$1], ["$3"], [$2])]
|
||||
)])
|
||||
|
||||
AC_DEFUN([CS_NUM_WITH], [AC_ARG_WITH([$1],
|
||||
[AS_HELP_STRING(--with-[$1], [default $2 [$3]])],
|
||||
[CS_DEFINE([$1], [$withval], [$2])],
|
||||
[CS_DEFINE([$1], [$3], [$2])]
|
||||
)])
|
||||
|
||||
AC_DEFUN([CS_ABSPATH], [
|
||||
case "$1" in
|
||||
/*) ;;
|
||||
*) AC_MSG_ERROR([$2 argument must be an absolute path.]);;
|
||||
esac
|
||||
])
|
||||
|
||||
dnl ==========================================================================
|
||||
CS_STR_WITH([plain-hash], [password hashing function for plain mode], [sha256])
|
||||
CS_STR_WITH([plain-cipher], [cipher for plain mode], [aes])
|
||||
CS_STR_WITH([plain-mode], [cipher mode for plain mode], [xts-plain64])
|
||||
CS_NUM_WITH([plain-keybits],[key length in bits for plain mode], [256])
|
||||
|
||||
CS_STR_WITH([luks1-hash], [hash function for LUKS1 header], [sha256])
|
||||
CS_STR_WITH([luks1-cipher], [cipher for LUKS1], [aes])
|
||||
CS_STR_WITH([luks1-mode], [cipher mode for LUKS1], [xts-plain64])
|
||||
CS_NUM_WITH([luks1-keybits],[key length in bits for LUKS1], [256])
|
||||
|
||||
AC_ARG_ENABLE([luks_adjust_xts_keysize], AS_HELP_STRING([--disable-luks-adjust-xts-keysize],
|
||||
[XTS mode requires two keys, double default LUKS keysize if needed]),
|
||||
[], [enable_luks_adjust_xts_keysize=yes])
|
||||
if test "x$enable_luks_adjust_xts_keysize" = "xyes"; then
|
||||
AC_DEFINE(ENABLE_LUKS_ADJUST_XTS_KEYSIZE, 1, [XTS mode - double default LUKS keysize if needed])
|
||||
fi
|
||||
|
||||
CS_STR_WITH([luks2-pbkdf], [Default PBKDF algorithm (pbkdf2 or argon2i/argon2id) for LUKS2], [argon2id])
|
||||
CS_NUM_WITH([luks1-iter-time], [PBKDF2 iteration time for LUKS1 (in ms)], [2000])
|
||||
CS_NUM_WITH([luks2-iter-time], [Argon2 PBKDF iteration time for LUKS2 (in ms)], [2000])
|
||||
CS_NUM_WITH([luks2-memory-kb], [Argon2 PBKDF memory cost for LUKS2 (in kB)], [1048576])
|
||||
CS_NUM_WITH([luks2-parallel-threads],[Argon2 PBKDF max parallel cost for LUKS2 (if CPUs available)], [4])
|
||||
|
||||
CS_STR_WITH([luks2-keyslot-cipher], [fallback cipher for LUKS2 keyslot (if data encryption is incompatible)], [aes-xts-plain64])
|
||||
CS_NUM_WITH([luks2-keyslot-keybits],[fallback key size for LUKS2 keyslot (if data encryption is incompatible)], [512])
|
||||
|
||||
CS_STR_WITH([loopaes-cipher], [cipher for loop-AES mode], [aes])
|
||||
CS_NUM_WITH([loopaes-keybits],[key length in bits for loop-AES mode], [256])
|
||||
|
||||
CS_NUM_WITH([keyfile-size-maxkb],[maximum keyfile size (in KiB)], [8192])
|
||||
CS_NUM_WITH([integrity-keyfile-size-maxkb],[maximum integritysetup keyfile size (in KiB)], [4])
|
||||
CS_NUM_WITH([passphrase-size-max],[maximum passphrase size (in characters)], [512])
|
||||
|
||||
CS_STR_WITH([verity-hash], [hash function for verity mode], [sha256])
|
||||
CS_NUM_WITH([verity-data-block], [data block size for verity mode], [4096])
|
||||
CS_NUM_WITH([verity-hash-block], [hash block size for verity mode], [4096])
|
||||
CS_NUM_WITH([verity-salt-size], [salt size for verity mode], [32])
|
||||
CS_NUM_WITH([verity-fec-roots], [parity bytes for verity FEC], [2])
|
||||
|
||||
AC_ARG_WITH([tmpfilesdir],
|
||||
AS_HELP_STRING([--with-tmpfilesdir=DIR], [override default path to directory with systemd temporary files]),
|
||||
[], [with_tmpfilesdir=$systemd_tmpfilesdir])
|
||||
test "x$with_tmpfilesdir" = "xno" || {
|
||||
CS_ABSPATH([${with_tmpfilesdir}],[with-tmpfilesdir])
|
||||
DEFAULT_TMPFILESDIR=$with_tmpfilesdir
|
||||
AC_SUBST(DEFAULT_TMPFILESDIR)
|
||||
}
|
||||
AM_CONDITIONAL(CRYPTSETUP_TMPFILE, test -n "$DEFAULT_TMPFILESDIR")
|
||||
|
||||
CS_STR_WITH([luks2-lock-path], [path to directory for LUKSv2 locks], [/run/cryptsetup])
|
||||
test -z "$with_luks2_lock_path" && with_luks2_lock_path=/run/cryptsetup
|
||||
CS_ABSPATH([${with_luks2_lock_path}],[with-luks2-lock-path])
|
||||
DEFAULT_LUKS2_LOCK_PATH=$with_luks2_lock_path
|
||||
AC_SUBST(DEFAULT_LUKS2_LOCK_PATH)
|
||||
|
||||
CS_NUM_WITH([luks2-lock-dir-perms], [default luks2 locking directory permissions], [0700])
|
||||
test -z "$with_luks2_lock_dir_perms" && with_luks2_lock_dir_perms=0700
|
||||
DEFAULT_LUKS2_LOCK_DIR_PERMS=$with_luks2_lock_dir_perms
|
||||
AC_SUBST(DEFAULT_LUKS2_LOCK_DIR_PERMS)
|
||||
|
||||
AC_ARG_WITH([luks2-external-tokens-path],
|
||||
AS_HELP_STRING([--with-luks2-external-tokens-path=DIR], [path to directory with LUKSv2 external token handlers (plugins)]),
|
||||
[], [with_luks2_external_tokens_path=""])
|
||||
if test -n "$with_luks2_external_tokens_path"; then
|
||||
CS_ABSPATH([${with_luks2_external_tokens_path}],[with-luks2-external-tokens-path])
|
||||
EXTERNAL_LUKS2_TOKENS_PATH=$with_luks2_external_tokens_path
|
||||
else
|
||||
EXTERNAL_LUKS2_TOKENS_PATH="\${libdir}/cryptsetup"
|
||||
fi
|
||||
AC_SUBST(EXTERNAL_LUKS2_TOKENS_PATH)
|
||||
dnl We need to define expanded EXTERNAL_LUKS2_TOKENS_PATH, but some other code can depend on prefix=NONE.
|
||||
dnl Pretend you do not see this hack :-)
|
||||
saved_prefix=$prefix
|
||||
saved_exec_prefix=$exec_prefix
|
||||
test "x$prefix" = "xNONE" && prefix="$ac_default_prefix"
|
||||
test "x$exec_prefix" = "xNONE" && exec_prefix="$prefix"
|
||||
expanded_EXTERNAL_LUKS2_TOKENS_PATH=$(eval echo "$EXTERNAL_LUKS2_TOKENS_PATH")
|
||||
expanded_EXTERNAL_LUKS2_TOKENS_PATH=$(eval echo "$expanded_EXTERNAL_LUKS2_TOKENS_PATH")
|
||||
AC_DEFINE_UNQUOTED([EXTERNAL_LUKS2_TOKENS_PATH], ["$expanded_EXTERNAL_LUKS2_TOKENS_PATH"], [path to directory with LUKSv2 external token handlers (plugins)])
|
||||
prefix=$saved_prefix
|
||||
exec_prefix=$saved_exec_prefix
|
||||
|
||||
dnl Override default LUKS format version (for cryptsetup or cryptsetup-reencrypt format actions only).
|
||||
AC_ARG_WITH([default_luks_format],
|
||||
AS_HELP_STRING([--with-default-luks-format=FORMAT], [default LUKS format version (LUKS1/LUKS2) [LUKS2]]),
|
||||
[], [with_default_luks_format=LUKS2])
|
||||
|
||||
case $with_default_luks_format in
|
||||
LUKS1) default_luks=CRYPT_LUKS1 ;;
|
||||
LUKS2) default_luks=CRYPT_LUKS2 ;;
|
||||
*) AC_MSG_ERROR([Unknown default LUKS format. Use LUKS1 or LUKS2 only.]) ;;
|
||||
esac
|
||||
AC_DEFINE_UNQUOTED([DEFAULT_LUKS_FORMAT], [$default_luks], [default LUKS format version])
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
AC_CONFIG_FILES([ Makefile
|
||||
lib/libcryptsetup.pc
|
||||
po/Makefile.in
|
||||
scripts/cryptsetup.conf
|
||||
tests/Makefile
|
||||
tests/fuzz/Makefile
|
||||
])
|
||||
AC_OUTPUT
|
||||
272
configure.in
Normal file
272
configure.in
Normal file
@@ -0,0 +1,272 @@
|
||||
AC_PREREQ([2.67])
|
||||
AC_INIT([cryptsetup],[1.3.0])
|
||||
|
||||
dnl library version from <major>.<minor>.<release>[-<suffix>]
|
||||
LIBCRYPTSETUP_VERSION=$(echo $PACKAGE_VERSION | cut -f1 -d-)
|
||||
LIBCRYPTSETUP_VERSION_INFO=3:0:2
|
||||
|
||||
AC_CONFIG_SRCDIR(src/cryptsetup.c)
|
||||
AC_CONFIG_MACRO_DIR([m4])
|
||||
|
||||
AC_CONFIG_HEADERS([config.h:config.h.in])
|
||||
AM_INIT_AUTOMAKE(dist-bzip2)
|
||||
|
||||
if test "x$prefix" = "xNONE"; then
|
||||
sysconfdir=/etc
|
||||
fi
|
||||
AC_PREFIX_DEFAULT(/usr)
|
||||
|
||||
AC_CANONICAL_HOST
|
||||
AC_USE_SYSTEM_EXTENSIONS
|
||||
AC_PROG_CC
|
||||
AM_PROG_CC_C_O
|
||||
AC_PROG_CPP
|
||||
AC_PROG_INSTALL
|
||||
AC_PROG_MAKE_SET
|
||||
AC_ENABLE_STATIC(no)
|
||||
LT_INIT
|
||||
|
||||
AC_HEADER_DIRENT
|
||||
AC_HEADER_STDC
|
||||
AC_CHECK_HEADERS(fcntl.h malloc.h inttypes.h sys/ioctl.h sys/mman.h \
|
||||
ctype.h unistd.h locale.h)
|
||||
|
||||
AC_CHECK_HEADERS(uuid/uuid.h,,[AC_MSG_ERROR('You need the uuid library')])
|
||||
AC_CHECK_HEADER(libdevmapper.h,,[AC_MSG_ERROR('You need the device-mapper library')])
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(uuid, uuid_clear, ,[AC_MSG_ERROR('You need the uuid library')])
|
||||
AC_SUBST(UUID_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
AC_CHECK_FUNCS([posix_memalign])
|
||||
|
||||
AC_C_CONST
|
||||
AC_C_BIGENDIAN
|
||||
AC_TYPE_OFF_T
|
||||
AC_SYS_LARGEFILE
|
||||
|
||||
AC_PROG_GCC_TRADITIONAL
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
AM_GNU_GETTEXT([external],[need-ngettext])
|
||||
AM_GNU_GETTEXT_VERSION([0.15])
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(popt, poptConfigFileToString,,
|
||||
[AC_MSG_ERROR([You need popt 1.7 or newer to compile.])])
|
||||
AC_SUBST(POPT_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl Crypto backend functions
|
||||
|
||||
AC_DEFUN([CONFIGURE_GCRYPT], [
|
||||
AM_PATH_LIBGCRYPT(1.1.42,,[AC_MSG_ERROR('You need the gcrypt library')])
|
||||
|
||||
if test x$enable_static_cryptsetup = xyes; then
|
||||
saved_LIBS=$LIBS
|
||||
LIBS="$saved_LIBS $LIBGCRYPT_LIBS -static"
|
||||
AC_CHECK_LIB(gcrypt, gcry_check_version,,
|
||||
AC_MSG_ERROR([Cannot find static gcrypt library.]),
|
||||
[-lgpg-error])
|
||||
LIBGCRYPT_STATIC_LIBS="$LIBGCRYPT_LIBS -lgpg-error"
|
||||
LIBS=$saved_LIBS
|
||||
fi
|
||||
|
||||
CRYPTO_CFLAGS=$LIBGCRYPT_CFLAGS
|
||||
CRYPTO_LIBS=$LIBGCRYPT_LIBS
|
||||
CRYPTO_STATIC_LIBS=$LIBGCRYPT_STATIC_LIBS
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_OPENSSL], [
|
||||
PKG_CHECK_MODULES([OPENSSL], [openssl >= 0.9.8],,
|
||||
AC_MSG_ERROR('You need openssl library'))
|
||||
CRYPTO_CFLAGS=$OPENSSL_CFLAGS
|
||||
CRYPTO_LIBS=$OPENSSL_LIBS
|
||||
|
||||
if test x$enable_static_cryptsetup = xyes; then
|
||||
saved_PKG_CONFIG=$PKG_CONFIG
|
||||
PKG_CONFIG="$PKG_CONFIG --static"
|
||||
PKG_CHECK_MODULES([OPENSSL], [openssl])
|
||||
CRYPTO_STATIC_LIBS=$OPENSSL_LIBS
|
||||
PKG_CONFIG=$saved_PKG_CONFIG
|
||||
fi
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_NSS], [
|
||||
if test x$enable_static_cryptsetup = xyes; then
|
||||
AC_MSG_ERROR([Static build of cryptsetup is not supported with NSS.]),
|
||||
fi
|
||||
|
||||
AC_MSG_WARN([NSS backend does NOT provide backward compatibility (missing ripemd160 hash).])
|
||||
|
||||
PKG_CHECK_MODULES([NSS], [nss],,
|
||||
AC_MSG_ERROR('You need nss library'))
|
||||
CRYPTO_CFLAGS=$NSS_CFLAGS
|
||||
CRYPTO_LIBS=$NSS_LIBS
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_KERNEL], [
|
||||
AC_CHECK_HEADERS(linux/if_alg.h,,
|
||||
[AC_MSG_ERROR('You need Linux kernel with userspace crypto interface.')])
|
||||
# AC_CHECK_DECLS([AF_ALG],,
|
||||
# [AC_MSG_ERROR('You need Linux kernel with userspace crypto interface.')],
|
||||
# [#include <sys/socket.h>])
|
||||
|
||||
])
|
||||
|
||||
dnl ==========================================================================
|
||||
saved_LIBS=$LIBS
|
||||
|
||||
AC_ARG_ENABLE([static-cryptsetup],
|
||||
AS_HELP_STRING([--enable-static-cryptsetup],
|
||||
[enable build of static cryptsetup binary]))
|
||||
if test x$enable_static_cryptsetup = xyes; then
|
||||
if test x$enable_static = xno; then
|
||||
AC_MSG_WARN([Requested static cryptsetup build, enabling static library.])
|
||||
enable_static=yes
|
||||
fi
|
||||
fi
|
||||
AM_CONDITIONAL(STATIC_CRYPTSETUP, test x$enable_static_cryptsetup = xyes)
|
||||
|
||||
AC_ARG_ENABLE(selinux,
|
||||
AS_HELP_STRING([--disable-selinux],
|
||||
[disable selinux support [default=auto]]),[], [])
|
||||
|
||||
AC_ARG_ENABLE([udev],
|
||||
AS_HELP_STRING([--disable-udev],
|
||||
[disable udev support]),[], enable_udev=yes)
|
||||
|
||||
dnl Try to use pkg-config for devmapper, but fallback to old detection
|
||||
PKG_CHECK_MODULES([DEVMAPPER], [devmapper >= 1.02.03],, [
|
||||
AC_CHECK_LIB(devmapper, dm_task_set_name,,
|
||||
[AC_MSG_ERROR([You need the device-mapper library.])])
|
||||
AC_CHECK_LIB(devmapper, dm_task_set_message,,
|
||||
[AC_MSG_ERROR([The device-mapper library on your system is too old.])])
|
||||
DEVMAPPER_LIBS=$LIBS
|
||||
])
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
LIBS="$LIBS $DEVMAPPER_LIBS"
|
||||
AC_CHECK_DECLS([dm_task_secure_data], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([DM_UDEV_DISABLE_DISK_RULES_FLAG], [have_cookie=yes], [have_cookie=no], [#include <libdevmapper.h>])
|
||||
if test "x$enable_udev" = xyes; then
|
||||
if test "x$have_cookie" = xno; then
|
||||
AC_MSG_WARN([The device-mapper library on your system has no udev support, udev support disabled.])
|
||||
else
|
||||
AC_DEFINE(USE_UDEV, 1, [Try to use udev synchronisation?])
|
||||
fi
|
||||
fi
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
dnl Crypto backend configuration.
|
||||
AC_ARG_WITH([crypto_backend],
|
||||
AS_HELP_STRING([--with-crypto_backend=BACKEND], [crypto backend (gcrypt/openssl/nss/kernel) [gcrypt]]),
|
||||
[], with_crypto_backend=gcrypt
|
||||
)
|
||||
case $with_crypto_backend in
|
||||
gcrypt) CONFIGURE_GCRYPT([]) ;;
|
||||
openssl) CONFIGURE_OPENSSL([]) ;;
|
||||
nss) CONFIGURE_NSS([]) ;;
|
||||
kernel) CONFIGURE_KERNEL([]) ;;
|
||||
*) AC_MSG_ERROR([Unknown crypto backend.]) ;;
|
||||
esac
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_GCRYPT, test $with_crypto_backend = gcrypt)
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_OPENSSL, test $with_crypto_backend = openssl)
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_NSS, test $with_crypto_backend = nss)
|
||||
AM_CONDITIONAL(CRYPTO_BACKEND_KERNEL, test $with_crypto_backend = kernel)
|
||||
|
||||
dnl Magic for cryptsetup.static build.
|
||||
if test x$enable_static_cryptsetup = xyes; then
|
||||
saved_PKG_CONFIG=$PKG_CONFIG
|
||||
PKG_CONFIG="$PKG_CONFIG --static"
|
||||
|
||||
LIBS="$saved_LIBS -static"
|
||||
AC_CHECK_LIB(popt, poptGetContext,,
|
||||
AC_MSG_ERROR([Cannot find static popt library.]))
|
||||
|
||||
dnl Try to detect needed device-mapper static libraries, try pkg-config first.
|
||||
LIBS="$saved_LIBS -static"
|
||||
PKG_CHECK_MODULES([DEVMAPPER_STATIC], [devmapper >= 1.02.27],,[
|
||||
DEVMAPPER_STATIC_LIBS=$DEVMAPPER_LIBS
|
||||
if test "x$enable_selinux" != xno; then
|
||||
AC_CHECK_LIB(sepol, sepol_bool_set)
|
||||
AC_CHECK_LIB(selinux, is_selinux_enabled)
|
||||
DEVMAPPER_STATIC_LIBS="$DEVMAPPER_STATIC_LIBS $LIBS"
|
||||
fi
|
||||
])
|
||||
LIBS="$saved_LIBS $DEVMAPPER_STATIC_LIBS"
|
||||
AC_CHECK_LIB(devmapper, dm_task_set_uuid,,
|
||||
AC_MSG_ERROR([Cannot link with static device-mapper library.]))
|
||||
|
||||
LIBS=$saved_LIBS
|
||||
PKG_CONFIG=$saved_PKG_CONFIG
|
||||
fi
|
||||
|
||||
AC_SUBST([DEVMAPPER_LIBS])
|
||||
AC_SUBST([DEVMAPPER_STATIC_LIBS])
|
||||
|
||||
AC_SUBST([CRYPTO_CFLAGS])
|
||||
AC_SUBST([CRYPTO_LIBS])
|
||||
AC_SUBST([CRYPTO_STATIC_LIBS])
|
||||
|
||||
AC_SUBST([LIBCRYPTSETUP_VERSION])
|
||||
AC_SUBST([LIBCRYPTSETUP_VERSION_INFO])
|
||||
|
||||
dnl ==========================================================================
|
||||
AC_ARG_ENABLE([dev-random], AS_HELP_STRING([--enable-dev-random],
|
||||
[use blocking /dev/random by default for key generator (otherwise use /dev/urandom)]),
|
||||
[default_rng=/dev/random], [default_rng=/dev/urandom])
|
||||
AC_DEFINE_UNQUOTED(DEFAULT_RNG, ["$default_rng"], [default RNG type for key generator])
|
||||
|
||||
dnl ==========================================================================
|
||||
AC_DEFUN([CS_DEFINE],
|
||||
[AC_DEFINE_UNQUOTED(DEFAULT_[]m4_translit([$1], [-a-z], [_A-Z]), [$2], [$3])
|
||||
])
|
||||
|
||||
AC_DEFUN([CS_STR_WITH], [AC_ARG_WITH([$1],
|
||||
[AS_HELP_STRING(--with-[$1], [default $2 [$3]])],
|
||||
[CS_DEFINE([$1], ["$withval"], [$2])],
|
||||
[CS_DEFINE([$1], ["$3"], [$2])]
|
||||
)])
|
||||
|
||||
AC_DEFUN([CS_NUM_WITH], [AC_ARG_WITH([$1],
|
||||
[AS_HELP_STRING(--with-[$1], [default $2 [$3]])],
|
||||
[CS_DEFINE([$1], [$withval], [$2])],
|
||||
[CS_DEFINE([$1], [$3], [$2])]
|
||||
)])
|
||||
|
||||
CS_STR_WITH([plain-hash], [password hashing function for plain mode], [ripemd160])
|
||||
CS_STR_WITH([plain-cipher], [cipher for plain mode], [aes])
|
||||
CS_STR_WITH([plain-mode], [cipher mode for plain mode], [cbc-essiv:sha256])
|
||||
CS_NUM_WITH([plain-keybits],[key length in bits for plain mode], [256])
|
||||
|
||||
CS_STR_WITH([luks1-hash], [hash function for LUKS1 header], [sha1])
|
||||
CS_STR_WITH([luks1-cipher], [cipher for LUKS1], [aes])
|
||||
CS_STR_WITH([luks1-mode], [cipher mode for LUKS1], [cbc-essiv:sha256])
|
||||
CS_NUM_WITH([luks1-keybits],[key length in bits for LUKS1], [256])
|
||||
|
||||
CS_STR_WITH([loopaes-cipher], [cipher for loop-AES mode], [aes])
|
||||
CS_NUM_WITH([loopaes-keybits],[key length in bits for loop-AES mode], [256])
|
||||
|
||||
CS_NUM_WITH([keyfile-size-maxkb],[maximum keyfile size (in kilobytes)], [8192])
|
||||
CS_NUM_WITH([passphrase-size-max],[maximum keyfile size (in kilobytes)], [512])
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
AC_CONFIG_FILES([ Makefile
|
||||
lib/Makefile
|
||||
lib/libcryptsetup.pc
|
||||
lib/crypto_backend/Makefile
|
||||
lib/luks1/Makefile
|
||||
lib/loopaes/Makefile
|
||||
src/Makefile
|
||||
po/Makefile.in
|
||||
man/Makefile
|
||||
tests/Makefile
|
||||
])
|
||||
AC_OUTPUT
|
||||
@@ -1,79 +0,0 @@
|
||||
Integration with kernel keyring service
|
||||
---------------------------------------
|
||||
|
||||
We have two different use cases for kernel keyring service:
|
||||
|
||||
I) Volume keys
|
||||
|
||||
Since upstream kernel 4.10 dm-crypt device mapper target allows loading volume
|
||||
key (VK) in kernel keyring service. The key offloaded in kernel keyring service
|
||||
is only referenced (by key description) in dm-crypt target and the VK is therefore
|
||||
no longer stored directly in dm-crypt target. Starting with cryptsetup 2.0 we
|
||||
load VK in kernel keyring by default for LUKSv2 devices (when dm-crypt with the
|
||||
feature is available).
|
||||
|
||||
Currently, cryptsetup loads VK in 'logon' type kernel key so that VK is passed in
|
||||
the kernel and can't be read from userspace afterwards. Also, cryptsetup loads VK in
|
||||
the thread keyring (before passing the reference to dm-crypt target) so that the key
|
||||
lifetime is directly bound to the process that performs the dm-crypt setup. When
|
||||
cryptsetup process exits (for whatever reason) the key gets unlinked in the kernel
|
||||
automatically. In summary, the key description visible in dm-crypt table line is
|
||||
a reference to VK that usually no longer exists in kernel keyring service if you
|
||||
used cryptsetup for device activation.
|
||||
|
||||
Using this feature dm-crypt no longer maintains a direct key copy (but there's
|
||||
always at least one copy in the kernel crypto layer).
|
||||
|
||||
Additionally, libcryptsetup supports the linking of volume keys to
|
||||
user-specified kernel keyring with crypt_set_keyring_to_link(). The user may
|
||||
specify keyring name, key type ('user' or 'logon') and key description where
|
||||
libcryptsetup should link the verified volume key upon subsequent device
|
||||
activation (or key verification alone).
|
||||
|
||||
The volume key(s) (provided the key type is 'user') linked in the user keyring
|
||||
can be later used to activate the device via crypt_activate_by_keyslot_context()
|
||||
with CRYPT_KC_TYPE_VK_KEYRING type keyslot context
|
||||
(acquired by crypt_keyslot_context_init_by_vk_in_keyring()).
|
||||
|
||||
Example of how to use volume key linked in custom user keyring from cryptsetup
|
||||
utility:
|
||||
|
||||
1) Open the device and store the volume key to the session keyring:
|
||||
# cryptsetup open <device> --link-vk-to-keyring "@s::%user:testkey" tst
|
||||
|
||||
2) Add a keyslot using the stored volume key in a keyring:
|
||||
# cryptsetup luksAddKey <device> --volume-key-keyring "%user:testkey"
|
||||
|
||||
3) Activate the device using the volume key cached in a keyring ('user' type key)
|
||||
# cryptsetup open <device> <active_name> --volume-key-keyring "testkey"
|
||||
|
||||
II) Keyslot passphrase
|
||||
The second use case for kernel keyring is to allow cryptsetup reading the keyslot
|
||||
passphrase stored in kernel keyring instead. The user may load the passphrase in the kernel
|
||||
keyring and notify cryptsetup to read it from there later. Currently, cryptsetup
|
||||
cli supports kernel keyring for passphrase only via LUKS2 internal token
|
||||
(luks2-keyring). The library also provides a general method for device activation by
|
||||
reading the passphrase from the keyring: crypt_activate_by_keyring(). The key type
|
||||
for use case II) must always be 'user' since we need to read the actual key
|
||||
data from userspace unlike with VK in I). The ability to read keyslot passphrases
|
||||
from kernel keyring also allows easy auto-activate LUKS2 devices.
|
||||
|
||||
Simple example of how to use kernel keyring for keyslot passphrase:
|
||||
|
||||
1) create LUKS2 keyring token for keyslot 0 (in LUKS2 device/image)
|
||||
cryptsetup token add --key-description my:key -S 0 /dev/device
|
||||
|
||||
2) Load keyslot passphrase in user keyring
|
||||
read -s -p "Keyslot passphrase: "; echo -n $REPLY | keyctl padd user my:key @u
|
||||
|
||||
3) Activate the device using the passphrase stored in the kernel keyring
|
||||
cryptsetup open /dev/device my_unlocked_device
|
||||
|
||||
4a) unlink the key when no longer needed by
|
||||
keyctl unlink %user:my:key @u
|
||||
|
||||
4b) or revoke it immediately by
|
||||
keyctl revoke %user:my:key
|
||||
|
||||
If cryptsetup asks for a passphrase in step 3) something went wrong with keyring
|
||||
activation. See --debug output then.
|
||||
@@ -1,97 +0,0 @@
|
||||
LUKS2 device locking overview
|
||||
=============================
|
||||
|
||||
Why
|
||||
~~~
|
||||
|
||||
LUKS2 format keeps two identical copies of metadata stored consecutively
|
||||
at the head of the metadata device (file or bdev). The metadata
|
||||
area (both copies) must be updated in a single atomic operation to avoid
|
||||
header corruption during concurrent write.
|
||||
|
||||
While with LUKS1 users may have clear knowledge of when a LUKS header is
|
||||
being updated (written to) or when it's being read solely the need for
|
||||
locking with legacy format was not so obvious as it is with the LUKSv2 format.
|
||||
|
||||
With LUKS2 the boundary between read-only and read-write is blurry and what
|
||||
used to be the exclusively read-only operation (i.e., cryptsetup open command) may
|
||||
easily become read-update operation silently without the user's knowledge.
|
||||
A major feature of the LUKS2 format is resilience against accidental
|
||||
corruption of metadata (i.e., partial header overwrite by parted or cfdisk
|
||||
while creating a partition on a mistaken block device).
|
||||
Such header corruption is detected early on the header read and the auto-recovery
|
||||
procedure takes place (the corrupted header with checksum mismatch is being
|
||||
replaced by the secondary one if that one is intact).
|
||||
On current Linux systems header load operation may be triggered without the user
|
||||
direct intervention for example by an udev rule or from a systemd service.
|
||||
Such a clash of header read and auto-recovery procedure could have severe
|
||||
consequences with the worst case of having a LUKS2 device inaccessible or being
|
||||
broken beyond repair.
|
||||
|
||||
The whole locking of LUKSv2 device headers split into two categories depending
|
||||
what backend the header is stored on:
|
||||
|
||||
I) block device
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
We perform flock() on file descriptors of files stored in a private
|
||||
directory (by default /run/lock/cryptsetup). The file name is derived
|
||||
from major:minor couple of the affected block device. Note we recommend
|
||||
that access to the private locking directory is supposed to be limited
|
||||
to the superuser only. For this method to work the distribution needs
|
||||
to install the locking directory with appropriate access rights.
|
||||
|
||||
II) regular files
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
A first notable difference between headers stored in a file
|
||||
vs. headers stored in a block device is that headers in a file may be
|
||||
manipulated by the regular user, unlike headers on block devices. Therefore
|
||||
we perform flock() protection on file with the luks2 header directly.
|
||||
|
||||
Limitations
|
||||
~~~~~~~~~~~
|
||||
|
||||
a) In general, the locking model provides serialization of I/Os targeting
|
||||
the header only. It means the header is always written or read at once
|
||||
while locking is enabled.
|
||||
We do not suppress any other negative effect that two or more concurrent
|
||||
writers of the same header may cause.
|
||||
|
||||
b) The locking is not cluster-aware in any way.
|
||||
|
||||
Additional LUKS2 locks
|
||||
======================
|
||||
|
||||
LUKS2 reencryption device lock
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Device in LUKS2 reencryption is protected by an exclusive lock placed in the default
|
||||
locking directory. The lock's purpose is to exclude multiple processes from
|
||||
performing reencryption on the same device (identified by LUKS uuid). The lock
|
||||
is taken no matter the LUKS2 reencryption mode (online or offline).
|
||||
|
||||
LUKS2 memory hard global lock
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
An optional global lock that makes libcryptsetup serialize memory hard
|
||||
pbkdf function when deriving a key encryption key from passphrase on unlocking
|
||||
LUKS2 keyslot. The lock has to be enabled via the CRYPT_ACTIVATE_SERIALIZE_MEMORY_HARD_PBKDF
|
||||
flag. The lock is placed in the default locking directory.
|
||||
|
||||
LUKS2 OPAL lock
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
Exclusive per device lock taken when manipulating LUKS2 device configured for use with
|
||||
SED OPAL2 locking range.
|
||||
|
||||
Lock ordering
|
||||
=============
|
||||
|
||||
To avoid a deadlock following rules must apply:
|
||||
|
||||
- LUKS2 reencrytpion lock must be taken before LUKS2 OPAL lock.
|
||||
|
||||
- LUKS2 OPAL lock must be taken before LUKS2 metadata lock.
|
||||
|
||||
- LUKS2 memory hard global lock can not be used with other locks.
|
||||
351
docs/doxyfile
351
docs/doxyfile
@@ -1,351 +0,0 @@
|
||||
# Doxyfile 1.9.8
|
||||
|
||||
#---------------------------------------------------------------------------
|
||||
# Project related configuration options
|
||||
#---------------------------------------------------------------------------
|
||||
DOXYFILE_ENCODING = UTF-8
|
||||
PROJECT_NAME = "cryptsetup API"
|
||||
PROJECT_NUMBER =
|
||||
PROJECT_BRIEF = "Public cryptsetup API"
|
||||
PROJECT_LOGO =
|
||||
OUTPUT_DIRECTORY = doxygen_api_docs
|
||||
CREATE_SUBDIRS = NO
|
||||
CREATE_SUBDIRS_LEVEL = 8
|
||||
ALLOW_UNICODE_NAMES = NO
|
||||
OUTPUT_LANGUAGE = English
|
||||
BRIEF_MEMBER_DESC = YES
|
||||
REPEAT_BRIEF = YES
|
||||
ABBREVIATE_BRIEF =
|
||||
ALWAYS_DETAILED_SEC = NO
|
||||
INLINE_INHERITED_MEMB = NO
|
||||
FULL_PATH_NAMES = YES
|
||||
STRIP_FROM_PATH =
|
||||
STRIP_FROM_INC_PATH =
|
||||
SHORT_NAMES = NO
|
||||
JAVADOC_AUTOBRIEF = NO
|
||||
JAVADOC_BANNER = NO
|
||||
QT_AUTOBRIEF = NO
|
||||
MULTILINE_CPP_IS_BRIEF = NO
|
||||
PYTHON_DOCSTRING = YES
|
||||
INHERIT_DOCS = YES
|
||||
SEPARATE_MEMBER_PAGES = NO
|
||||
TAB_SIZE = 8
|
||||
ALIASES =
|
||||
OPTIMIZE_OUTPUT_FOR_C = YES
|
||||
OPTIMIZE_OUTPUT_JAVA = NO
|
||||
OPTIMIZE_FOR_FORTRAN = NO
|
||||
OPTIMIZE_OUTPUT_VHDL = NO
|
||||
OPTIMIZE_OUTPUT_SLICE = NO
|
||||
EXTENSION_MAPPING =
|
||||
MARKDOWN_SUPPORT = YES
|
||||
TOC_INCLUDE_HEADINGS = 5
|
||||
MARKDOWN_ID_STYLE = DOXYGEN
|
||||
AUTOLINK_SUPPORT = YES
|
||||
BUILTIN_STL_SUPPORT = NO
|
||||
CPP_CLI_SUPPORT = NO
|
||||
SIP_SUPPORT = NO
|
||||
IDL_PROPERTY_SUPPORT = YES
|
||||
DISTRIBUTE_GROUP_DOC = NO
|
||||
GROUP_NESTED_COMPOUNDS = NO
|
||||
SUBGROUPING = YES
|
||||
INLINE_GROUPED_CLASSES = NO
|
||||
INLINE_SIMPLE_STRUCTS = NO
|
||||
TYPEDEF_HIDES_STRUCT = YES
|
||||
LOOKUP_CACHE_SIZE = 0
|
||||
NUM_PROC_THREADS = 1
|
||||
TIMESTAMP = NO
|
||||
#---------------------------------------------------------------------------
|
||||
# Build related configuration options
|
||||
#---------------------------------------------------------------------------
|
||||
EXTRACT_ALL = NO
|
||||
EXTRACT_PRIVATE = NO
|
||||
EXTRACT_PRIV_VIRTUAL = NO
|
||||
EXTRACT_PACKAGE = NO
|
||||
EXTRACT_STATIC = NO
|
||||
EXTRACT_LOCAL_CLASSES = YES
|
||||
EXTRACT_LOCAL_METHODS = NO
|
||||
EXTRACT_ANON_NSPACES = NO
|
||||
RESOLVE_UNNAMED_PARAMS = YES
|
||||
HIDE_UNDOC_MEMBERS = NO
|
||||
HIDE_UNDOC_CLASSES = NO
|
||||
HIDE_FRIEND_COMPOUNDS = NO
|
||||
HIDE_IN_BODY_DOCS = NO
|
||||
INTERNAL_DOCS = NO
|
||||
CASE_SENSE_NAMES = YES
|
||||
HIDE_SCOPE_NAMES = NO
|
||||
HIDE_COMPOUND_REFERENCE= NO
|
||||
SHOW_HEADERFILE = YES
|
||||
SHOW_INCLUDE_FILES = YES
|
||||
SHOW_GROUPED_MEMB_INC = NO
|
||||
FORCE_LOCAL_INCLUDES = NO
|
||||
INLINE_INFO = YES
|
||||
SORT_MEMBER_DOCS = YES
|
||||
SORT_BRIEF_DOCS = NO
|
||||
SORT_MEMBERS_CTORS_1ST = NO
|
||||
SORT_GROUP_NAMES = NO
|
||||
SORT_BY_SCOPE_NAME = NO
|
||||
STRICT_PROTO_MATCHING = NO
|
||||
GENERATE_TODOLIST = YES
|
||||
GENERATE_TESTLIST = YES
|
||||
GENERATE_BUGLIST = YES
|
||||
GENERATE_DEPRECATEDLIST= YES
|
||||
ENABLED_SECTIONS =
|
||||
MAX_INITIALIZER_LINES = 30
|
||||
SHOW_USED_FILES = YES
|
||||
SHOW_FILES = YES
|
||||
SHOW_NAMESPACES = YES
|
||||
FILE_VERSION_FILTER =
|
||||
LAYOUT_FILE =
|
||||
CITE_BIB_FILES =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to warning and progress messages
|
||||
#---------------------------------------------------------------------------
|
||||
QUIET = NO
|
||||
WARNINGS = YES
|
||||
WARN_IF_UNDOCUMENTED = YES
|
||||
WARN_IF_DOC_ERROR = YES
|
||||
WARN_IF_INCOMPLETE_DOC = YES
|
||||
WARN_NO_PARAMDOC = NO
|
||||
WARN_IF_UNDOC_ENUM_VAL = NO
|
||||
WARN_AS_ERROR = NO
|
||||
WARN_FORMAT = "$file:$line: $text"
|
||||
WARN_LINE_FORMAT = "at line $line of file $file"
|
||||
WARN_LOGFILE =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the input files
|
||||
#---------------------------------------------------------------------------
|
||||
INPUT = doxygen_index.h \
|
||||
../lib/libcryptsetup.h
|
||||
INPUT_ENCODING = UTF-8
|
||||
INPUT_FILE_ENCODING =
|
||||
FILE_PATTERNS =
|
||||
RECURSIVE = NO
|
||||
EXCLUDE =
|
||||
EXCLUDE_SYMLINKS = NO
|
||||
EXCLUDE_PATTERNS =
|
||||
EXCLUDE_SYMBOLS =
|
||||
EXAMPLE_PATH = examples
|
||||
EXAMPLE_PATTERNS =
|
||||
EXAMPLE_RECURSIVE = NO
|
||||
IMAGE_PATH =
|
||||
INPUT_FILTER =
|
||||
FILTER_PATTERNS =
|
||||
FILTER_SOURCE_FILES = NO
|
||||
FILTER_SOURCE_PATTERNS =
|
||||
USE_MDFILE_AS_MAINPAGE =
|
||||
FORTRAN_COMMENT_AFTER = 72
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to source browsing
|
||||
#---------------------------------------------------------------------------
|
||||
SOURCE_BROWSER = NO
|
||||
INLINE_SOURCES = NO
|
||||
STRIP_CODE_COMMENTS = YES
|
||||
REFERENCED_BY_RELATION = NO
|
||||
REFERENCES_RELATION = NO
|
||||
REFERENCES_LINK_SOURCE = YES
|
||||
SOURCE_TOOLTIPS = YES
|
||||
USE_HTAGS = NO
|
||||
VERBATIM_HEADERS = YES
|
||||
CLANG_ASSISTED_PARSING = NO
|
||||
CLANG_ADD_INC_PATHS = YES
|
||||
CLANG_OPTIONS =
|
||||
CLANG_DATABASE_PATH =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the alphabetical class index
|
||||
#---------------------------------------------------------------------------
|
||||
ALPHABETICAL_INDEX = YES
|
||||
IGNORE_PREFIX =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the HTML output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_HTML = YES
|
||||
HTML_OUTPUT = html
|
||||
HTML_FILE_EXTENSION = .html
|
||||
HTML_HEADER =
|
||||
HTML_FOOTER =
|
||||
HTML_STYLESHEET =
|
||||
HTML_EXTRA_STYLESHEET =
|
||||
HTML_EXTRA_FILES =
|
||||
HTML_COLORSTYLE = AUTO_LIGHT
|
||||
HTML_COLORSTYLE_HUE = 220
|
||||
HTML_COLORSTYLE_SAT = 100
|
||||
HTML_COLORSTYLE_GAMMA = 80
|
||||
HTML_DYNAMIC_MENUS = YES
|
||||
HTML_DYNAMIC_SECTIONS = NO
|
||||
HTML_CODE_FOLDING = YES
|
||||
HTML_INDEX_NUM_ENTRIES = 100
|
||||
GENERATE_DOCSET = NO
|
||||
DOCSET_FEEDNAME = "Doxygen generated docs"
|
||||
DOCSET_FEEDURL =
|
||||
DOCSET_BUNDLE_ID = org.doxygen.Project
|
||||
DOCSET_PUBLISHER_ID = org.doxygen.Publisher
|
||||
DOCSET_PUBLISHER_NAME = Publisher
|
||||
GENERATE_HTMLHELP = NO
|
||||
CHM_FILE =
|
||||
HHC_LOCATION =
|
||||
GENERATE_CHI = NO
|
||||
CHM_INDEX_ENCODING =
|
||||
BINARY_TOC = NO
|
||||
TOC_EXPAND = NO
|
||||
SITEMAP_URL =
|
||||
GENERATE_QHP = NO
|
||||
QCH_FILE =
|
||||
QHP_NAMESPACE = org.doxygen.Project
|
||||
QHP_VIRTUAL_FOLDER = doc
|
||||
QHP_CUST_FILTER_NAME =
|
||||
QHP_CUST_FILTER_ATTRS =
|
||||
QHP_SECT_FILTER_ATTRS =
|
||||
QHG_LOCATION =
|
||||
GENERATE_ECLIPSEHELP = NO
|
||||
ECLIPSE_DOC_ID = org.doxygen.Project
|
||||
DISABLE_INDEX = NO
|
||||
GENERATE_TREEVIEW = NO
|
||||
FULL_SIDEBAR = NO
|
||||
ENUM_VALUES_PER_LINE = 4
|
||||
TREEVIEW_WIDTH = 250
|
||||
EXT_LINKS_IN_WINDOW = NO
|
||||
OBFUSCATE_EMAILS = YES
|
||||
HTML_FORMULA_FORMAT = png
|
||||
FORMULA_FONTSIZE = 10
|
||||
FORMULA_MACROFILE =
|
||||
USE_MATHJAX = NO
|
||||
MATHJAX_VERSION = MathJax_2
|
||||
MATHJAX_FORMAT = HTML-CSS
|
||||
MATHJAX_RELPATH = http://www.mathjax.org/mathjax
|
||||
MATHJAX_EXTENSIONS =
|
||||
MATHJAX_CODEFILE =
|
||||
SEARCHENGINE = YES
|
||||
SERVER_BASED_SEARCH = NO
|
||||
EXTERNAL_SEARCH = NO
|
||||
SEARCHENGINE_URL =
|
||||
SEARCHDATA_FILE = searchdata.xml
|
||||
EXTERNAL_SEARCH_ID =
|
||||
EXTRA_SEARCH_MAPPINGS =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the LaTeX output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_LATEX = YES
|
||||
LATEX_OUTPUT = latex
|
||||
LATEX_CMD_NAME = latex
|
||||
MAKEINDEX_CMD_NAME = makeindex
|
||||
LATEX_MAKEINDEX_CMD = makeindex
|
||||
COMPACT_LATEX = NO
|
||||
PAPER_TYPE = a4
|
||||
EXTRA_PACKAGES =
|
||||
LATEX_HEADER =
|
||||
LATEX_FOOTER =
|
||||
LATEX_EXTRA_STYLESHEET =
|
||||
LATEX_EXTRA_FILES =
|
||||
PDF_HYPERLINKS = YES
|
||||
USE_PDFLATEX = YES
|
||||
LATEX_BATCHMODE = NO
|
||||
LATEX_HIDE_INDICES = NO
|
||||
LATEX_BIB_STYLE = plain
|
||||
LATEX_EMOJI_DIRECTORY =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the RTF output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_RTF = NO
|
||||
RTF_OUTPUT = rtf
|
||||
COMPACT_RTF = NO
|
||||
RTF_HYPERLINKS = NO
|
||||
RTF_STYLESHEET_FILE =
|
||||
RTF_EXTENSIONS_FILE =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the man page output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_MAN = NO
|
||||
MAN_OUTPUT = man
|
||||
MAN_EXTENSION = .3
|
||||
MAN_SUBDIR =
|
||||
MAN_LINKS = NO
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the XML output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_XML = NO
|
||||
XML_OUTPUT = xml
|
||||
XML_PROGRAMLISTING = YES
|
||||
XML_NS_MEMB_FILE_SCOPE = NO
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the DOCBOOK output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_DOCBOOK = NO
|
||||
DOCBOOK_OUTPUT = docbook
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options for the AutoGen Definitions output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_AUTOGEN_DEF = NO
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to Sqlite3 output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_SQLITE3 = NO
|
||||
SQLITE3_OUTPUT = sqlite3
|
||||
SQLITE3_RECREATE_DB = YES
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the Perl module output
|
||||
#---------------------------------------------------------------------------
|
||||
GENERATE_PERLMOD = NO
|
||||
PERLMOD_LATEX = NO
|
||||
PERLMOD_PRETTY = YES
|
||||
PERLMOD_MAKEVAR_PREFIX =
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to the preprocessor
|
||||
#---------------------------------------------------------------------------
|
||||
ENABLE_PREPROCESSING = YES
|
||||
MACRO_EXPANSION = NO
|
||||
EXPAND_ONLY_PREDEF = NO
|
||||
SEARCH_INCLUDES = YES
|
||||
INCLUDE_PATH =
|
||||
INCLUDE_FILE_PATTERNS =
|
||||
PREDEFINED =
|
||||
EXPAND_AS_DEFINED =
|
||||
SKIP_FUNCTION_MACROS = YES
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to external references
|
||||
#---------------------------------------------------------------------------
|
||||
TAGFILES =
|
||||
GENERATE_TAGFILE =
|
||||
ALLEXTERNALS = NO
|
||||
EXTERNAL_GROUPS = YES
|
||||
EXTERNAL_PAGES = YES
|
||||
#---------------------------------------------------------------------------
|
||||
# Configuration options related to diagram generator tools
|
||||
#---------------------------------------------------------------------------
|
||||
HIDE_UNDOC_RELATIONS = YES
|
||||
HAVE_DOT = NO
|
||||
DOT_NUM_THREADS = 0
|
||||
DOT_COMMON_ATTR = "fontname=Helvetica,fontsize=10"
|
||||
DOT_EDGE_ATTR = "labelfontname=Helvetica,labelfontsize=10"
|
||||
DOT_NODE_ATTR = "shape=box,height=0.2,width=0.4"
|
||||
DOT_FONTPATH =
|
||||
CLASS_GRAPH = YES
|
||||
COLLABORATION_GRAPH = YES
|
||||
GROUP_GRAPHS = YES
|
||||
UML_LOOK = NO
|
||||
UML_LIMIT_NUM_FIELDS = 10
|
||||
DOT_UML_DETAILS = NO
|
||||
DOT_WRAP_THRESHOLD = 17
|
||||
TEMPLATE_RELATIONS = NO
|
||||
INCLUDE_GRAPH = YES
|
||||
INCLUDED_BY_GRAPH = YES
|
||||
CALL_GRAPH = NO
|
||||
CALLER_GRAPH = NO
|
||||
GRAPHICAL_HIERARCHY = YES
|
||||
DIRECTORY_GRAPH = YES
|
||||
DIR_GRAPH_MAX_DEPTH = 1
|
||||
DOT_IMAGE_FORMAT = png
|
||||
INTERACTIVE_SVG = NO
|
||||
DOT_PATH =
|
||||
DOTFILE_DIRS =
|
||||
DIA_PATH =
|
||||
DIAFILE_DIRS =
|
||||
PLANTUML_JAR_PATH =
|
||||
PLANTUML_CFG_FILE =
|
||||
PLANTUML_INCLUDE_PATH =
|
||||
DOT_GRAPH_MAX_NODES = 50
|
||||
MAX_DOT_GRAPH_DEPTH = 0
|
||||
DOT_MULTI_TARGETS = NO
|
||||
GENERATE_LEGEND = YES
|
||||
DOT_CLEANUP = YES
|
||||
MSCGEN_TOOL =
|
||||
MSCFILE_DIRS =
|
||||
@@ -1,110 +0,0 @@
|
||||
/*! \mainpage Cryptsetup API
|
||||
*
|
||||
* <b>The</b> documentation covers public parts of cryptsetup API. In the following sections you'll find
|
||||
* the examples that describe some features of cryptsetup API.
|
||||
* For more info about libcryptsetup API versions see
|
||||
* <a href="https://gitlab.com/cryptsetup/cryptsetup/wikis/ABI-tracker/timeline/libcryptsetup/index.html">API Tracker</a>.
|
||||
*
|
||||
* <OL type="A">
|
||||
* <LI>@ref cexamples "Cryptsetup API examples"</LI>
|
||||
* <OL type="1">
|
||||
* <LI>@ref cluks "crypt_luks_usage" - cryptsetup LUKS device type usage examples</LI>
|
||||
* <UL>
|
||||
* <LI>@ref cinit "crypt_init()"</LI>
|
||||
* <LI>@ref cformat "crypt_format()" - header and payload on mutual device</LI>
|
||||
* <LI>@ref ckeys "Keyslot operations" </LI>
|
||||
* <UL>
|
||||
* <LI>@ref ckeyslot_vol "crypt_keyslot_add_by_volume_key()"</LI>
|
||||
* <LI>@ref ckeyslot_pass "crypt_keyslot_add_by_passphrase()"</LI>
|
||||
* </UL>
|
||||
* <LI>@ref cload "crypt_load()"
|
||||
* <LI>@ref cactivate "crypt_activate_by_passphrase()"</LI>
|
||||
* <LI>@ref cactive_pars "crypt_get_active_device()"</LI>
|
||||
* <LI>@ref cinit_by_name "crypt_init_by_name()"</LI>
|
||||
* <LI>@ref cdeactivate "crypt_deactivate()"</LI>
|
||||
* <LI>@ref cluks_ex "crypt_luks_usage.c"</LI>
|
||||
* </UL>
|
||||
* <LI>@ref clog "crypt_log_usage" - cryptsetup logging API examples</LI>
|
||||
* </OL>
|
||||
* </OL>
|
||||
*
|
||||
* @section cexamples Cryptsetup API examples
|
||||
* @section cluks crypt_luks_usage - cryptsetup LUKS device type usage
|
||||
* @subsection cinit crypt_init()
|
||||
* Every time you need to do something with cryptsetup or dmcrypt device
|
||||
* you need a valid context. The first step to start your work is
|
||||
* @ref crypt_init call. You can call it either with path
|
||||
* to the block device or path to the regular file. If you don't supply the path,
|
||||
* empty context is initialized.
|
||||
*
|
||||
* @subsection cformat crypt_format() - header and payload on mutual device
|
||||
* This section covers basic use cases for formatting LUKS devices. Format operation
|
||||
* sets device type in context and in case of LUKS header is written at the beginning
|
||||
* of block device. In the example below we use the scenario where LUKS header and data
|
||||
* are both stored on the same device. There's also a possibility to store header and
|
||||
* data separately.
|
||||
*
|
||||
* <B>Bear in mind</B> that @ref crypt_format() is destructive operation and it
|
||||
* overwrites part of the backing block device.
|
||||
*
|
||||
* @subsection ckeys Keyslot operations examples
|
||||
* After successful @ref crypt_format of LUKS device, volume key is not stored
|
||||
* in a persistent way on the device. Keyslot area is an array beyond LUKS header, where
|
||||
* volume key is stored in the encrypted form using user input passphrase. For more info about
|
||||
* LUKS keyslots and how it's actually protected, please look at
|
||||
* <A HREF="https://gitlab.com/cryptsetup/cryptsetup/wikis/Specification">LUKS specification</A>.
|
||||
* There are two basic methods to create a new keyslot:
|
||||
*
|
||||
* @subsection ckeyslot_vol crypt_keyslot_add_by_volume_key()
|
||||
* Creates a new keyslot directly by encrypting volume_key stored in the device
|
||||
* context. Passphrase should be supplied or user is prompted if passphrase param is
|
||||
* NULL.
|
||||
*
|
||||
* @subsection ckeyslot_pass crypt_keyslot_add_by_passphrase()
|
||||
* Creates a new keyslot for the volume key by opening existing active keyslot,
|
||||
* extracting volume key from it and storing it into a new keyslot
|
||||
* protected by a new passphrase
|
||||
*
|
||||
* @subsection cload crypt_load()
|
||||
* Function loads header from backing block device into device context.
|
||||
*
|
||||
* @subsection cactivate crypt_activate_by_passphrase()
|
||||
* Activates crypt device by user supplied password for keyslot containing the volume_key.
|
||||
* If <I>keyslot</I> parameter is set to <I>CRYPT_ANY_SLOT</I> then all active keyslots
|
||||
* are tried one by one until the volume key is found.
|
||||
*
|
||||
* @subsection cactive_pars crypt_get_active_device()
|
||||
* This call returns structure containing runtime attributes of active device.
|
||||
*
|
||||
* @subsection cinit_by_name crypt_init_by_name()
|
||||
* In case you need to do operations with active device (device which already
|
||||
* has its corresponding mapping) and you miss valid device context stored in
|
||||
* *crypt_device reference, you should use this call. Function tries to
|
||||
* get path to backing device from DM, initializes context for it and loads LUKS
|
||||
* header.
|
||||
*
|
||||
* @subsection cdeactivate crypt_deactivate()
|
||||
* Deactivates crypt device (removes DM mapping and safely erases volume key from kernel).
|
||||
*
|
||||
* @subsection cluks_ex crypt_luks_usage.c - Complex example
|
||||
* To compile and run use following commands in examples directory:
|
||||
*
|
||||
* @code
|
||||
* make
|
||||
* ./crypt_luks_usage _path_to_[block_device]_file
|
||||
* @endcode
|
||||
* Note that you need to have the cryptsetup library compiled. @include crypt_luks_usage.c
|
||||
*
|
||||
* @section clog crypt_log_usage - cryptsetup logging API example
|
||||
* Example describes basic use case for cryptsetup logging. To compile and run
|
||||
* use following commands in examples directory:
|
||||
*
|
||||
* @code
|
||||
* make
|
||||
* ./crypt_log_usage
|
||||
* @endcode
|
||||
* Note that you need to have the cryptsetup library compiled. @include crypt_log_usage.c
|
||||
*
|
||||
* @example crypt_luks_usage.c
|
||||
* @example crypt_log_usage.c
|
||||
*/
|
||||
@@ -1,17 +0,0 @@
|
||||
TARGETS=crypt_log_usage crypt_luks_usage
|
||||
CFLAGS=-O0 -g -Wall -D_GNU_SOURCE
|
||||
LDLIBS=-lcryptsetup
|
||||
CC=gcc
|
||||
|
||||
all: $(TARGETS)
|
||||
|
||||
crypt_log_usage: crypt_log_usage.o
|
||||
$(CC) -o $@ $^ $(LDLIBS)
|
||||
|
||||
crypt_luks_usage: crypt_luks_usage.o
|
||||
$(CC) -o $@ $^ $(LDLIBS)
|
||||
|
||||
clean:
|
||||
rm -f *.o *~ core $(TARGETS)
|
||||
|
||||
.PHONY: clean
|
||||
@@ -1,81 +0,0 @@
|
||||
// SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
/*
|
||||
* libcryptsetup API log example
|
||||
*
|
||||
* Copyright (C) 2011-2025 Red Hat, Inc. All rights reserved.
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <sys/types.h>
|
||||
#include <syslog.h>
|
||||
#include <unistd.h>
|
||||
#include <libcryptsetup.h>
|
||||
|
||||
/*
|
||||
* This is an example of crypt_set_log_callback API callback.
|
||||
*
|
||||
*/
|
||||
static void simple_syslog_wrapper(int level, const char *msg, void *usrptr)
|
||||
{
|
||||
const char *prefix = (const char *)usrptr;
|
||||
int priority;
|
||||
|
||||
switch(level) {
|
||||
case CRYPT_LOG_NORMAL: priority = LOG_NOTICE; break;
|
||||
case CRYPT_LOG_ERROR: priority = LOG_ERR; break;
|
||||
case CRYPT_LOG_VERBOSE: priority = LOG_INFO; break;
|
||||
case CRYPT_LOG_DEBUG: priority = LOG_DEBUG; break;
|
||||
default:
|
||||
fprintf(stderr, "Unsupported log level requested!\n");
|
||||
return;
|
||||
}
|
||||
|
||||
if (prefix)
|
||||
syslog(priority, "%s:%s", prefix, msg);
|
||||
else
|
||||
syslog(priority, "%s", msg);
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
struct crypt_device *cd;
|
||||
char usrprefix[] = "cslog_example";
|
||||
int r;
|
||||
|
||||
if (geteuid()) {
|
||||
printf("Using of libcryptsetup requires super user privileges.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
openlog("cryptsetup", LOG_CONS | LOG_PID, LOG_USER);
|
||||
|
||||
/* Initialize empty crypt device context */
|
||||
r = crypt_init(&cd, NULL);
|
||||
if (r < 0) {
|
||||
printf("crypt_init() failed.\n");
|
||||
return 2;
|
||||
}
|
||||
|
||||
/* crypt_set_log_callback() - register a log callback for crypt context */
|
||||
crypt_set_log_callback(cd, &simple_syslog_wrapper, (void *)usrprefix);
|
||||
|
||||
/* send messages ithrough the crypt_log() interface */
|
||||
crypt_log(cd, CRYPT_LOG_NORMAL, "This is normal log message");
|
||||
crypt_log(cd, CRYPT_LOG_ERROR, "This is error log message");
|
||||
crypt_log(cd, CRYPT_LOG_VERBOSE, "This is verbose log message");
|
||||
crypt_log(cd, CRYPT_LOG_DEBUG, "This is debug message");
|
||||
|
||||
/* release crypt context */
|
||||
crypt_free(cd);
|
||||
|
||||
/* Initialize default (global) log callback */
|
||||
crypt_set_log_callback(NULL, &simple_syslog_wrapper, NULL);
|
||||
|
||||
crypt_log(NULL, CRYPT_LOG_NORMAL, "This is normal log message");
|
||||
crypt_log(NULL, CRYPT_LOG_ERROR, "This is error log message");
|
||||
crypt_log(NULL, CRYPT_LOG_VERBOSE, "This is verbose log message");
|
||||
crypt_log(NULL, CRYPT_LOG_DEBUG, "This is debug message");
|
||||
|
||||
closelog();
|
||||
return 0;
|
||||
}
|
||||
@@ -1,237 +0,0 @@
|
||||
// SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
/*
|
||||
* libcryptsetup API - using LUKS device example
|
||||
*
|
||||
* Copyright (C) 2011-2025 Red Hat, Inc. All rights reserved.
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <inttypes.h>
|
||||
#include <sys/types.h>
|
||||
#include <libcryptsetup.h>
|
||||
|
||||
static int format_and_add_keyslots(const char *path)
|
||||
{
|
||||
struct crypt_device *cd;
|
||||
int r;
|
||||
|
||||
/*
|
||||
* The crypt_init() call is used to initialize crypt_device context,
|
||||
* The path parameter specifies a device path.
|
||||
*
|
||||
* For path, you can use either link to a file or block device.
|
||||
* The loopback device will be detached automatically.
|
||||
*/
|
||||
|
||||
r = crypt_init(&cd, path);
|
||||
if (r < 0) {
|
||||
printf("crypt_init() failed for %s.\n", path);
|
||||
return r;
|
||||
}
|
||||
|
||||
printf("Context is attached to block device %s.\n", crypt_get_device_name(cd));
|
||||
|
||||
/*
|
||||
* So far, no data were written to the device.
|
||||
*/
|
||||
printf("Device %s will be formatted as a LUKS device after 5 seconds.\n"
|
||||
"Press CTRL+C now if you want to cancel this operation.\n", path);
|
||||
sleep(5);
|
||||
|
||||
/*
|
||||
* NULLs for uuid and volume_key means that these attributes will be
|
||||
* generated during crypt_format().
|
||||
*/
|
||||
r = crypt_format(cd, /* crypt context */
|
||||
CRYPT_LUKS2, /* LUKS2 is a new LUKS format; use CRYPT_LUKS1 for LUKS1 */
|
||||
"aes", /* used cipher */
|
||||
"xts-plain64", /* used block mode and IV */
|
||||
NULL, /* generate UUID */
|
||||
NULL, /* generate volume key from RNG */
|
||||
512 / 8, /* 512bit key - here AES-256 in XTS mode, size is in bytes */
|
||||
NULL); /* default parameters */
|
||||
|
||||
if (r < 0) {
|
||||
printf("crypt_format() failed on device %s\n", crypt_get_device_name(cd));
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
/*
|
||||
* The device now contains a LUKS header, but there is no active keyslot.
|
||||
*
|
||||
* crypt_keyslot_add_* call stores the volume_key in the encrypted form into the keyslot.
|
||||
*
|
||||
* After format, the volume key is stored internally.
|
||||
*/
|
||||
r = crypt_keyslot_add_by_volume_key(cd, /* crypt context */
|
||||
CRYPT_ANY_SLOT, /* just use first free slot */
|
||||
NULL, /* use internal volume key */
|
||||
0, /* unused (size of volume key) */
|
||||
"foo", /* passphrase - NULL means query*/
|
||||
3); /* size of passphrase */
|
||||
|
||||
if (r < 0) {
|
||||
printf("Adding keyslot failed.\n");
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
printf("The first keyslot is initialized.\n");
|
||||
|
||||
/*
|
||||
* Add another keyslot, now authenticating with the first keyslot.
|
||||
* It decrypts the volume key from the first keyslot and creates a new one with the specified passphrase.
|
||||
*/
|
||||
r = crypt_keyslot_add_by_passphrase(cd, /* crypt context */
|
||||
CRYPT_ANY_SLOT, /* just use first free slot */
|
||||
"foo", 3, /* passphrase for the old keyslot */
|
||||
"bar", 3); /* passphrase for the new kesylot */
|
||||
if (r < 0) {
|
||||
printf("Adding keyslot failed.\n");
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
printf("The second keyslot is initialized.\n");
|
||||
|
||||
crypt_free(cd);
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int activate_and_check_status(const char *path, const char *device_name)
|
||||
{
|
||||
struct crypt_device *cd;
|
||||
struct crypt_active_device cad;
|
||||
int r;
|
||||
|
||||
/*
|
||||
* LUKS device activation example.
|
||||
*/
|
||||
r = crypt_init(&cd, path);
|
||||
if (r < 0) {
|
||||
printf("crypt_init() failed for %s.\n", path);
|
||||
return r;
|
||||
}
|
||||
|
||||
/*
|
||||
* crypt_load() is used to load existing LUKS header from a block device
|
||||
*/
|
||||
r = crypt_load(cd, /* crypt context */
|
||||
CRYPT_LUKS, /* requested type - here LUKS of any type */
|
||||
NULL); /* additional parameters (not used) */
|
||||
|
||||
if (r < 0) {
|
||||
printf("crypt_load() failed on device %s.\n", crypt_get_device_name(cd));
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
/*
|
||||
* Device activation creates a device-mapper device with the specified name.
|
||||
*/
|
||||
r = crypt_activate_by_passphrase(cd, /* crypt context */
|
||||
device_name, /* device name to activate */
|
||||
CRYPT_ANY_SLOT,/* the keyslot use (try all here) */
|
||||
"foo", 3, /* passphrase */
|
||||
CRYPT_ACTIVATE_READONLY); /* flags */
|
||||
if (r < 0) {
|
||||
printf("Device %s activation failed.\n", device_name);
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
printf("%s device %s/%s is active.\n", crypt_get_type(cd), crypt_get_dir(), device_name);
|
||||
printf("\tcipher used: %s\n", crypt_get_cipher(cd));
|
||||
printf("\tcipher mode: %s\n", crypt_get_cipher_mode(cd));
|
||||
printf("\tdevice UUID: %s\n", crypt_get_uuid(cd));
|
||||
|
||||
/*
|
||||
* Get info about the active device.
|
||||
*/
|
||||
r = crypt_get_active_device(cd, device_name, &cad);
|
||||
if (r < 0) {
|
||||
printf("Get info about active device %s failed.\n", device_name);
|
||||
crypt_deactivate(cd, device_name);
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
printf("Active device parameters for %s:\n"
|
||||
"\tDevice offset (in sectors): %" PRIu64 "\n"
|
||||
"\tIV offset (in sectors) : %" PRIu64 "\n"
|
||||
"\tdevice size (in sectors) : %" PRIu64 "\n"
|
||||
"\tread-only flag : %s\n",
|
||||
device_name, cad.offset, cad.iv_offset, cad.size,
|
||||
cad.flags & CRYPT_ACTIVATE_READONLY ? "1" : "0");
|
||||
|
||||
crypt_free(cd);
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int handle_active_device(const char *device_name)
|
||||
{
|
||||
struct crypt_device *cd;
|
||||
int r;
|
||||
|
||||
/*
|
||||
* crypt_init_by_name() initializes context by an active device-mapper name
|
||||
*/
|
||||
r = crypt_init_by_name(&cd, device_name);
|
||||
if (r < 0) {
|
||||
printf("crypt_init_by_name() failed for %s.\n", device_name);
|
||||
return r;
|
||||
}
|
||||
|
||||
if (crypt_status(cd, device_name) == CRYPT_ACTIVE)
|
||||
printf("Device %s is still active.\n", device_name);
|
||||
else {
|
||||
printf("Something failed perhaps, device %s is not active.\n", device_name);
|
||||
crypt_free(cd);
|
||||
return -1;
|
||||
}
|
||||
|
||||
/*
|
||||
* crypt_deactivate() is used to deactivate a device
|
||||
*/
|
||||
r = crypt_deactivate(cd, device_name);
|
||||
if (r < 0) {
|
||||
printf("crypt_deactivate() failed.\n");
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
printf("Device %s is now deactivated.\n", device_name);
|
||||
|
||||
crypt_free(cd);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int main(int argc, char **argv)
|
||||
{
|
||||
if (geteuid()) {
|
||||
printf("Using of libcryptsetup requires super user privileges.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (argc != 2) {
|
||||
printf("usage: ./crypt_luks_usage <path>\n"
|
||||
"<path> refers to either a regular file or a block device.\n"
|
||||
" WARNING: the file or device will be wiped.\n");
|
||||
return 2;
|
||||
}
|
||||
|
||||
if (format_and_add_keyslots(argv[1]))
|
||||
return 3;
|
||||
|
||||
if (activate_and_check_status(argv[1], "example_device"))
|
||||
return 4;
|
||||
|
||||
if (handle_active_device("example_device"))
|
||||
return 5;
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -1,202 +0,0 @@
|
||||
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright [yyyy] [name of copyright owner]
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
@@ -1,428 +0,0 @@
|
||||
Attribution-ShareAlike 4.0 International
|
||||
|
||||
=======================================================================
|
||||
|
||||
Creative Commons Corporation ("Creative Commons") is not a law firm and
|
||||
does not provide legal services or legal advice. Distribution of
|
||||
Creative Commons public licenses does not create a lawyer-client or
|
||||
other relationship. Creative Commons makes its licenses and related
|
||||
information available on an "as-is" basis. Creative Commons gives no
|
||||
warranties regarding its licenses, any material licensed under their
|
||||
terms and conditions, or any related information. Creative Commons
|
||||
disclaims all liability for damages resulting from their use to the
|
||||
fullest extent possible.
|
||||
|
||||
Using Creative Commons Public Licenses
|
||||
|
||||
Creative Commons public licenses provide a standard set of terms and
|
||||
conditions that creators and other rights holders may use to share
|
||||
original works of authorship and other material subject to copyright
|
||||
and certain other rights specified in the public license below. The
|
||||
following considerations are for informational purposes only, are not
|
||||
exhaustive, and do not form part of our licenses.
|
||||
|
||||
Considerations for licensors: Our public licenses are
|
||||
intended for use by those authorized to give the public
|
||||
permission to use material in ways otherwise restricted by
|
||||
copyright and certain other rights. Our licenses are
|
||||
irrevocable. Licensors should read and understand the terms
|
||||
and conditions of the license they choose before applying it.
|
||||
Licensors should also secure all rights necessary before
|
||||
applying our licenses so that the public can reuse the
|
||||
material as expected. Licensors should clearly mark any
|
||||
material not subject to the license. This includes other CC-
|
||||
licensed material, or material used under an exception or
|
||||
limitation to copyright. More considerations for licensors:
|
||||
wiki.creativecommons.org/Considerations_for_licensors
|
||||
|
||||
Considerations for the public: By using one of our public
|
||||
licenses, a licensor grants the public permission to use the
|
||||
licensed material under specified terms and conditions. If
|
||||
the licensor's permission is not necessary for any reason--for
|
||||
example, because of any applicable exception or limitation to
|
||||
copyright--then that use is not regulated by the license. Our
|
||||
licenses grant only permissions under copyright and certain
|
||||
other rights that a licensor has authority to grant. Use of
|
||||
the licensed material may still be restricted for other
|
||||
reasons, including because others have copyright or other
|
||||
rights in the material. A licensor may make special requests,
|
||||
such as asking that all changes be marked or described.
|
||||
Although not required by our licenses, you are encouraged to
|
||||
respect those requests where reasonable. More considerations
|
||||
for the public:
|
||||
wiki.creativecommons.org/Considerations_for_licensees
|
||||
|
||||
=======================================================================
|
||||
|
||||
Creative Commons Attribution-ShareAlike 4.0 International Public
|
||||
License
|
||||
|
||||
By exercising the Licensed Rights (defined below), You accept and agree
|
||||
to be bound by the terms and conditions of this Creative Commons
|
||||
Attribution-ShareAlike 4.0 International Public License ("Public
|
||||
License"). To the extent this Public License may be interpreted as a
|
||||
contract, You are granted the Licensed Rights in consideration of Your
|
||||
acceptance of these terms and conditions, and the Licensor grants You
|
||||
such rights in consideration of benefits the Licensor receives from
|
||||
making the Licensed Material available under these terms and
|
||||
conditions.
|
||||
|
||||
|
||||
Section 1 -- Definitions.
|
||||
|
||||
a. Adapted Material means material subject to Copyright and Similar
|
||||
Rights that is derived from or based upon the Licensed Material
|
||||
and in which the Licensed Material is translated, altered,
|
||||
arranged, transformed, or otherwise modified in a manner requiring
|
||||
permission under the Copyright and Similar Rights held by the
|
||||
Licensor. For purposes of this Public License, where the Licensed
|
||||
Material is a musical work, performance, or sound recording,
|
||||
Adapted Material is always produced where the Licensed Material is
|
||||
synched in timed relation with a moving image.
|
||||
|
||||
b. Adapter's License means the license You apply to Your Copyright
|
||||
and Similar Rights in Your contributions to Adapted Material in
|
||||
accordance with the terms and conditions of this Public License.
|
||||
|
||||
c. BY-SA Compatible License means a license listed at
|
||||
creativecommons.org/compatiblelicenses, approved by Creative
|
||||
Commons as essentially the equivalent of this Public License.
|
||||
|
||||
d. Copyright and Similar Rights means copyright and/or similar rights
|
||||
closely related to copyright including, without limitation,
|
||||
performance, broadcast, sound recording, and Sui Generis Database
|
||||
Rights, without regard to how the rights are labeled or
|
||||
categorized. For purposes of this Public License, the rights
|
||||
specified in Section 2(b)(1)-(2) are not Copyright and Similar
|
||||
Rights.
|
||||
|
||||
e. Effective Technological Measures means those measures that, in the
|
||||
absence of proper authority, may not be circumvented under laws
|
||||
fulfilling obligations under Article 11 of the WIPO Copyright
|
||||
Treaty adopted on December 20, 1996, and/or similar international
|
||||
agreements.
|
||||
|
||||
f. Exceptions and Limitations means fair use, fair dealing, and/or
|
||||
any other exception or limitation to Copyright and Similar Rights
|
||||
that applies to Your use of the Licensed Material.
|
||||
|
||||
g. License Elements means the license attributes listed in the name
|
||||
of a Creative Commons Public License. The License Elements of this
|
||||
Public License are Attribution and ShareAlike.
|
||||
|
||||
h. Licensed Material means the artistic or literary work, database,
|
||||
or other material to which the Licensor applied this Public
|
||||
License.
|
||||
|
||||
i. Licensed Rights means the rights granted to You subject to the
|
||||
terms and conditions of this Public License, which are limited to
|
||||
all Copyright and Similar Rights that apply to Your use of the
|
||||
Licensed Material and that the Licensor has authority to license.
|
||||
|
||||
j. Licensor means the individual(s) or entity(ies) granting rights
|
||||
under this Public License.
|
||||
|
||||
k. Share means to provide material to the public by any means or
|
||||
process that requires permission under the Licensed Rights, such
|
||||
as reproduction, public display, public performance, distribution,
|
||||
dissemination, communication, or importation, and to make material
|
||||
available to the public including in ways that members of the
|
||||
public may access the material from a place and at a time
|
||||
individually chosen by them.
|
||||
|
||||
l. Sui Generis Database Rights means rights other than copyright
|
||||
resulting from Directive 96/9/EC of the European Parliament and of
|
||||
the Council of 11 March 1996 on the legal protection of databases,
|
||||
as amended and/or succeeded, as well as other essentially
|
||||
equivalent rights anywhere in the world.
|
||||
|
||||
m. You means the individual or entity exercising the Licensed Rights
|
||||
under this Public License. Your has a corresponding meaning.
|
||||
|
||||
|
||||
Section 2 -- Scope.
|
||||
|
||||
a. License grant.
|
||||
|
||||
1. Subject to the terms and conditions of this Public License,
|
||||
the Licensor hereby grants You a worldwide, royalty-free,
|
||||
non-sublicensable, non-exclusive, irrevocable license to
|
||||
exercise the Licensed Rights in the Licensed Material to:
|
||||
|
||||
a. reproduce and Share the Licensed Material, in whole or
|
||||
in part; and
|
||||
|
||||
b. produce, reproduce, and Share Adapted Material.
|
||||
|
||||
2. Exceptions and Limitations. For the avoidance of doubt, where
|
||||
Exceptions and Limitations apply to Your use, this Public
|
||||
License does not apply, and You do not need to comply with
|
||||
its terms and conditions.
|
||||
|
||||
3. Term. The term of this Public License is specified in Section
|
||||
6(a).
|
||||
|
||||
4. Media and formats; technical modifications allowed. The
|
||||
Licensor authorizes You to exercise the Licensed Rights in
|
||||
all media and formats whether now known or hereafter created,
|
||||
and to make technical modifications necessary to do so. The
|
||||
Licensor waives and/or agrees not to assert any right or
|
||||
authority to forbid You from making technical modifications
|
||||
necessary to exercise the Licensed Rights, including
|
||||
technical modifications necessary to circumvent Effective
|
||||
Technological Measures. For purposes of this Public License,
|
||||
simply making modifications authorized by this Section 2(a)
|
||||
(4) never produces Adapted Material.
|
||||
|
||||
5. Downstream recipients.
|
||||
|
||||
a. Offer from the Licensor -- Licensed Material. Every
|
||||
recipient of the Licensed Material automatically
|
||||
receives an offer from the Licensor to exercise the
|
||||
Licensed Rights under the terms and conditions of this
|
||||
Public License.
|
||||
|
||||
b. Additional offer from the Licensor -- Adapted Material.
|
||||
Every recipient of Adapted Material from You
|
||||
automatically receives an offer from the Licensor to
|
||||
exercise the Licensed Rights in the Adapted Material
|
||||
under the conditions of the Adapter's License You apply.
|
||||
|
||||
c. No downstream restrictions. You may not offer or impose
|
||||
any additional or different terms or conditions on, or
|
||||
apply any Effective Technological Measures to, the
|
||||
Licensed Material if doing so restricts exercise of the
|
||||
Licensed Rights by any recipient of the Licensed
|
||||
Material.
|
||||
|
||||
6. No endorsement. Nothing in this Public License constitutes or
|
||||
may be construed as permission to assert or imply that You
|
||||
are, or that Your use of the Licensed Material is, connected
|
||||
with, or sponsored, endorsed, or granted official status by,
|
||||
the Licensor or others designated to receive attribution as
|
||||
provided in Section 3(a)(1)(A)(i).
|
||||
|
||||
b. Other rights.
|
||||
|
||||
1. Moral rights, such as the right of integrity, are not
|
||||
licensed under this Public License, nor are publicity,
|
||||
privacy, and/or other similar personality rights; however, to
|
||||
the extent possible, the Licensor waives and/or agrees not to
|
||||
assert any such rights held by the Licensor to the limited
|
||||
extent necessary to allow You to exercise the Licensed
|
||||
Rights, but not otherwise.
|
||||
|
||||
2. Patent and trademark rights are not licensed under this
|
||||
Public License.
|
||||
|
||||
3. To the extent possible, the Licensor waives any right to
|
||||
collect royalties from You for the exercise of the Licensed
|
||||
Rights, whether directly or through a collecting society
|
||||
under any voluntary or waivable statutory or compulsory
|
||||
licensing scheme. In all other cases the Licensor expressly
|
||||
reserves any right to collect such royalties.
|
||||
|
||||
|
||||
Section 3 -- License Conditions.
|
||||
|
||||
Your exercise of the Licensed Rights is expressly made subject to the
|
||||
following conditions.
|
||||
|
||||
a. Attribution.
|
||||
|
||||
1. If You Share the Licensed Material (including in modified
|
||||
form), You must:
|
||||
|
||||
a. retain the following if it is supplied by the Licensor
|
||||
with the Licensed Material:
|
||||
|
||||
i. identification of the creator(s) of the Licensed
|
||||
Material and any others designated to receive
|
||||
attribution, in any reasonable manner requested by
|
||||
the Licensor (including by pseudonym if
|
||||
designated);
|
||||
|
||||
ii. a copyright notice;
|
||||
|
||||
iii. a notice that refers to this Public License;
|
||||
|
||||
iv. a notice that refers to the disclaimer of
|
||||
warranties;
|
||||
|
||||
v. a URI or hyperlink to the Licensed Material to the
|
||||
extent reasonably practicable;
|
||||
|
||||
b. indicate if You modified the Licensed Material and
|
||||
retain an indication of any previous modifications; and
|
||||
|
||||
c. indicate the Licensed Material is licensed under this
|
||||
Public License, and include the text of, or the URI or
|
||||
hyperlink to, this Public License.
|
||||
|
||||
2. You may satisfy the conditions in Section 3(a)(1) in any
|
||||
reasonable manner based on the medium, means, and context in
|
||||
which You Share the Licensed Material. For example, it may be
|
||||
reasonable to satisfy the conditions by providing a URI or
|
||||
hyperlink to a resource that includes the required
|
||||
information.
|
||||
|
||||
3. If requested by the Licensor, You must remove any of the
|
||||
information required by Section 3(a)(1)(A) to the extent
|
||||
reasonably practicable.
|
||||
|
||||
b. ShareAlike.
|
||||
|
||||
In addition to the conditions in Section 3(a), if You Share
|
||||
Adapted Material You produce, the following conditions also apply.
|
||||
|
||||
1. The Adapter's License You apply must be a Creative Commons
|
||||
license with the same License Elements, this version or
|
||||
later, or a BY-SA Compatible License.
|
||||
|
||||
2. You must include the text of, or the URI or hyperlink to, the
|
||||
Adapter's License You apply. You may satisfy this condition
|
||||
in any reasonable manner based on the medium, means, and
|
||||
context in which You Share Adapted Material.
|
||||
|
||||
3. You may not offer or impose any additional or different terms
|
||||
or conditions on, or apply any Effective Technological
|
||||
Measures to, Adapted Material that restrict exercise of the
|
||||
rights granted under the Adapter's License You apply.
|
||||
|
||||
|
||||
Section 4 -- Sui Generis Database Rights.
|
||||
|
||||
Where the Licensed Rights include Sui Generis Database Rights that
|
||||
apply to Your use of the Licensed Material:
|
||||
|
||||
a. for the avoidance of doubt, Section 2(a)(1) grants You the right
|
||||
to extract, reuse, reproduce, and Share all or a substantial
|
||||
portion of the contents of the database;
|
||||
|
||||
b. if You include all or a substantial portion of the database
|
||||
contents in a database in which You have Sui Generis Database
|
||||
Rights, then the database in which You have Sui Generis Database
|
||||
Rights (but not its individual contents) is Adapted Material,
|
||||
including for purposes of Section 3(b); and
|
||||
|
||||
c. You must comply with the conditions in Section 3(a) if You Share
|
||||
all or a substantial portion of the contents of the database.
|
||||
|
||||
For the avoidance of doubt, this Section 4 supplements and does not
|
||||
replace Your obligations under this Public License where the Licensed
|
||||
Rights include other Copyright and Similar Rights.
|
||||
|
||||
|
||||
Section 5 -- Disclaimer of Warranties and Limitation of Liability.
|
||||
|
||||
a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
|
||||
EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
|
||||
AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
|
||||
ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
|
||||
IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
|
||||
WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
|
||||
PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
|
||||
ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
|
||||
KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
|
||||
ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.
|
||||
|
||||
b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
|
||||
TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
|
||||
NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
|
||||
INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
|
||||
COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
|
||||
USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
|
||||
ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
|
||||
DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
|
||||
IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.
|
||||
|
||||
c. The disclaimer of warranties and limitation of liability provided
|
||||
above shall be interpreted in a manner that, to the extent
|
||||
possible, most closely approximates an absolute disclaimer and
|
||||
waiver of all liability.
|
||||
|
||||
|
||||
Section 6 -- Term and Termination.
|
||||
|
||||
a. This Public License applies for the term of the Copyright and
|
||||
Similar Rights licensed here. However, if You fail to comply with
|
||||
this Public License, then Your rights under this Public License
|
||||
terminate automatically.
|
||||
|
||||
b. Where Your right to use the Licensed Material has terminated under
|
||||
Section 6(a), it reinstates:
|
||||
|
||||
1. automatically as of the date the violation is cured, provided
|
||||
it is cured within 30 days of Your discovery of the
|
||||
violation; or
|
||||
|
||||
2. upon express reinstatement by the Licensor.
|
||||
|
||||
For the avoidance of doubt, this Section 6(b) does not affect any
|
||||
right the Licensor may have to seek remedies for Your violations
|
||||
of this Public License.
|
||||
|
||||
c. For the avoidance of doubt, the Licensor may also offer the
|
||||
Licensed Material under separate terms or conditions or stop
|
||||
distributing the Licensed Material at any time; however, doing so
|
||||
will not terminate this Public License.
|
||||
|
||||
d. Sections 1, 5, 6, 7, and 8 survive termination of this Public
|
||||
License.
|
||||
|
||||
|
||||
Section 7 -- Other Terms and Conditions.
|
||||
|
||||
a. The Licensor shall not be bound by any additional or different
|
||||
terms or conditions communicated by You unless expressly agreed.
|
||||
|
||||
b. Any arrangements, understandings, or agreements regarding the
|
||||
Licensed Material not stated herein are separate from and
|
||||
independent of the terms and conditions of this Public License.
|
||||
|
||||
|
||||
Section 8 -- Interpretation.
|
||||
|
||||
a. For the avoidance of doubt, this Public License does not, and
|
||||
shall not be interpreted to, reduce, limit, restrict, or impose
|
||||
conditions on any use of the Licensed Material that could lawfully
|
||||
be made without permission under this Public License.
|
||||
|
||||
b. To the extent possible, if any provision of this Public License is
|
||||
deemed unenforceable, it shall be automatically reformed to the
|
||||
minimum extent necessary to make it enforceable. If the provision
|
||||
cannot be reformed, it shall be severed from this Public License
|
||||
without affecting the enforceability of the remaining terms and
|
||||
conditions.
|
||||
|
||||
c. No term or condition of this Public License will be waived and no
|
||||
failure to comply consented to unless expressly agreed to by the
|
||||
Licensor.
|
||||
|
||||
d. Nothing in this Public License constitutes or may be interpreted
|
||||
as a limitation upon, or waiver of, any privileges and immunities
|
||||
that apply to the Licensor or You, including from the legal
|
||||
processes of any jurisdiction or authority.
|
||||
|
||||
|
||||
=======================================================================
|
||||
|
||||
Creative Commons is not a party to its public
|
||||
licenses. Notwithstanding, Creative Commons may elect to apply one of
|
||||
its public licenses to material it publishes and in those instances
|
||||
will be considered the “Licensor.” The text of the Creative Commons
|
||||
public licenses is dedicated to the public domain under the CC0 Public
|
||||
Domain Dedication. Except for the limited purpose of indicating that
|
||||
material is shared under a Creative Commons public license or as
|
||||
otherwise permitted by the Creative Commons policies published at
|
||||
creativecommons.org/policies, Creative Commons does not authorize the
|
||||
use of the trademark "Creative Commons" or any other trademark or logo
|
||||
of Creative Commons without its prior written consent including,
|
||||
without limitation, in connection with any unauthorized modifications
|
||||
to any of its public licenses or any other arrangements,
|
||||
understandings, or agreements concerning use of licensed material. For
|
||||
the avoidance of doubt, this paragraph does not form part of the
|
||||
public licenses.
|
||||
|
||||
Creative Commons may be contacted at creativecommons.org.
|
||||
|
||||
@@ -1,354 +0,0 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
License is intended to guarantee your freedom to share and change free
|
||||
software--to make sure the software is free for all its users. This
|
||||
General Public License applies to most of the Free Software
|
||||
Foundation's software and to any other program whose authors commit to
|
||||
using it. (Some other Free Software Foundation software is covered by
|
||||
the GNU Lesser General Public License instead.) You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
this service if you wish), that you receive source code or can get it
|
||||
if you want it, that you can change the software or use pieces of it
|
||||
in new free programs; and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
anyone to deny you these rights or to ask you to surrender the rights.
|
||||
These restrictions translate to certain responsibilities for you if you
|
||||
distribute copies of the software, or if you modify it.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must give the recipients all the rights that
|
||||
you have. You must make sure that they, too, receive or can get the
|
||||
source code. And you must show them these terms so they know their
|
||||
rights.
|
||||
|
||||
We protect your rights with two steps: (1) copyright the software, and
|
||||
(2) offer you this license which gives you legal permission to copy,
|
||||
distribute and/or modify the software.
|
||||
|
||||
Also, for each author's protection and ours, we want to make certain
|
||||
that everyone understands that there is no warranty for this free
|
||||
software. If the software is modified by someone else and passed on, we
|
||||
want its recipients to know that what they have is not the original, so
|
||||
that any problems introduced by others will not reflect on the original
|
||||
authors' reputations.
|
||||
|
||||
Finally, any free program is threatened constantly by software
|
||||
patents. We wish to avoid the danger that redistributors of a free
|
||||
program will individually obtain patent licenses, in effect making the
|
||||
program proprietary. To prevent this, we have made it clear that any
|
||||
patent must be licensed for everyone's free use or not licensed at all.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License applies to any program or other work which contains
|
||||
a notice placed by the copyright holder saying it may be distributed
|
||||
under the terms of this General Public License. The "Program", below,
|
||||
refers to any such program or work, and a "work based on the Program"
|
||||
means either the Program or any derivative work under copyright law:
|
||||
that is to say, a work containing the Program or a portion of it,
|
||||
either verbatim or with modifications and/or translated into another
|
||||
language. (Hereinafter, translation is included without limitation in
|
||||
the term "modification".) Each licensee is addressed as "you".
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running the Program is not restricted, and the output from the Program
|
||||
is covered only if its contents constitute a work based on the
|
||||
Program (independent of having been made by running the Program).
|
||||
Whether that is true depends on what the Program does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Program's
|
||||
source code as you receive it, in any medium, provided that you
|
||||
conspicuously and appropriately publish on each copy an appropriate
|
||||
copyright notice and disclaimer of warranty; keep intact all the
|
||||
notices that refer to this License and to the absence of any warranty;
|
||||
and give any other recipients of the Program a copy of this License
|
||||
along with the Program.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy, and
|
||||
you may at your option offer warranty protection in exchange for a fee.
|
||||
|
||||
2. You may modify your copy or copies of the Program or any portion
|
||||
of it, thus forming a work based on the Program, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) You must cause the modified files to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
b) You must cause any work that you distribute or publish, that in
|
||||
whole or in part contains or is derived from the Program or any
|
||||
part thereof, to be licensed as a whole at no charge to all third
|
||||
parties under the terms of this License.
|
||||
|
||||
c) If the modified program normally reads commands interactively
|
||||
when run, you must cause it, when started running for such
|
||||
interactive use in the most ordinary way, to print or display an
|
||||
announcement including an appropriate copyright notice and a
|
||||
notice that there is no warranty (or else, saying that you provide
|
||||
a warranty) and that users may redistribute the program under
|
||||
these conditions, and telling the user how to view a copy of this
|
||||
License. (Exception: if the Program itself is interactive but
|
||||
does not normally print such an announcement, your work based on
|
||||
the Program is not required to print an announcement.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Program,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Program, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Program.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Program
|
||||
with the Program (or with a work based on the Program) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may copy and distribute the Program (or a work based on it,
|
||||
under Section 2) in object code or executable form under the terms of
|
||||
Sections 1 and 2 above provided that you also do one of the following:
|
||||
|
||||
a) Accompany it with the complete corresponding machine-readable
|
||||
source code, which must be distributed under the terms of Sections
|
||||
1 and 2 above on a medium customarily used for software interchange; or,
|
||||
|
||||
b) Accompany it with a written offer, valid for at least three
|
||||
years, to give any third party, for a charge no more than your
|
||||
cost of physically performing source distribution, a complete
|
||||
machine-readable copy of the corresponding source code, to be
|
||||
distributed under the terms of Sections 1 and 2 above on a medium
|
||||
customarily used for software interchange; or,
|
||||
|
||||
c) Accompany it with the information you received as to the offer
|
||||
to distribute corresponding source code. (This alternative is
|
||||
allowed only for noncommercial distribution and only if you
|
||||
received the program in object code or executable form with such
|
||||
an offer, in accord with Subsection b above.)
|
||||
|
||||
The source code for a work means the preferred form of the work for
|
||||
making modifications to it. For an executable work, complete source
|
||||
code means all the source code for all modules it contains, plus any
|
||||
associated interface definition files, plus the scripts used to
|
||||
control compilation and installation of the executable. However, as a
|
||||
special exception, the source code distributed need not include
|
||||
anything that is normally distributed (in either source or binary
|
||||
form) with the major components (compiler, kernel, and so on) of the
|
||||
operating system on which the executable runs, unless that component
|
||||
itself accompanies the executable.
|
||||
|
||||
If distribution of executable or object code is made by offering
|
||||
access to copy from a designated place, then offering equivalent
|
||||
access to copy the source code from the same place counts as
|
||||
distribution of the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
4. You may not copy, modify, sublicense, or distribute the Program
|
||||
except as expressly provided under this License. Any attempt
|
||||
otherwise to copy, modify, sublicense or distribute the Program is
|
||||
void, and will automatically terminate your rights under this License.
|
||||
However, parties who have received copies, or rights, from you under
|
||||
this License will not have their licenses terminated so long as such
|
||||
parties remain in full compliance.
|
||||
|
||||
5. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Program or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Program (or any work based on the
|
||||
Program), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Program or works based on it.
|
||||
|
||||
6. Each time you redistribute the Program (or any work based on the
|
||||
Program), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute or modify the Program subject to
|
||||
these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties to
|
||||
this License.
|
||||
|
||||
7. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Program at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Program by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Program.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under
|
||||
any particular circumstance, the balance of the section is intended to
|
||||
apply and the section as a whole is intended to apply in other
|
||||
circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system, which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
8. If the distribution and/or use of the Program is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Program under this License
|
||||
may add an explicit geographical distribution limitation excluding
|
||||
those countries, so that distribution is permitted only in or among
|
||||
countries not thus excluded. In such case, this License incorporates
|
||||
the limitation as if written in the body of this License.
|
||||
|
||||
9. The Free Software Foundation may publish revised and/or new versions
|
||||
of the General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Program
|
||||
specifies a version number of this License which applies to it and "any
|
||||
later version", you have the option of following the terms and conditions
|
||||
either of that version or of any later version published by the Free
|
||||
Software Foundation. If the Program does not specify a version number of
|
||||
this License, you may choose any version ever published by the Free Software
|
||||
Foundation.
|
||||
|
||||
10. If you wish to incorporate parts of the Program into other free
|
||||
programs whose distribution conditions are different, write to the author
|
||||
to ask for permission. For software which is copyrighted by the Free
|
||||
Software Foundation, write to the Free Software Foundation; we sometimes
|
||||
make exceptions for this. Our decision will be guided by the two goals
|
||||
of preserving the free status of all derivatives of our free software and
|
||||
of promoting the sharing and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||
REPAIR OR CORRECTION.
|
||||
|
||||
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
convey the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 2 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License along
|
||||
with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program is interactive, make it output a short notice like this
|
||||
when it starts in an interactive mode:
|
||||
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, the commands you use may
|
||||
be called something other than `show w' and `show c'; they could even be
|
||||
mouse-clicks or menu items--whatever suits your program.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or your
|
||||
school, if any, to sign a "copyright disclaimer" for the program, if
|
||||
necessary. Here is a sample; alter the names:
|
||||
|
||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
||||
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
||||
|
||||
<signature of Ty Coon>, 1 April 1989
|
||||
Ty Coon, President of Vice
|
||||
|
||||
This General Public License does not permit incorporating your program into
|
||||
proprietary programs. If your program is a subroutine library, you may
|
||||
consider it more useful to permit linking proprietary applications with the
|
||||
library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License.
|
||||
|
||||
-----
|
||||
In addition, as a special exception, the copyright holders give
|
||||
permission to link the code of portions of this program with the
|
||||
OpenSSL library under certain conditions as described in each
|
||||
individual source file, and distribute linked combinations
|
||||
including the two.
|
||||
|
||||
You must obey the GNU General Public License in all respects
|
||||
for all of the code used other than OpenSSL. If you modify
|
||||
file(s) with this exception, you may extend this exception to your
|
||||
version of the file(s), but you are not obligated to do so. If you
|
||||
do not wish to do so, delete this exception statement from your
|
||||
version. If you delete this exception statement from all source
|
||||
files in the program, then also delete it here.
|
||||
@@ -1,517 +0,0 @@
|
||||
GNU LESSER GENERAL PUBLIC LICENSE
|
||||
Version 2.1, February 1999
|
||||
|
||||
Copyright (C) 1991, 1999 Free Software Foundation, Inc.
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
[This is the first released version of the Lesser GPL. It also counts
|
||||
as the successor of the GNU Library Public License, version 2, hence
|
||||
the version number 2.1.]
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
Licenses are intended to guarantee your freedom to share and change
|
||||
free software--to make sure the software is free for all its users.
|
||||
|
||||
This license, the Lesser General Public License, applies to some
|
||||
specially designated software packages--typically libraries--of the
|
||||
Free Software Foundation and other authors who decide to use it. You
|
||||
can use it too, but we suggest you first think carefully about whether
|
||||
this license or the ordinary General Public License is the better
|
||||
strategy to use in any particular case, based on the explanations below.
|
||||
|
||||
When we speak of free software, we are referring to freedom of use,
|
||||
not price. Our General Public Licenses are designed to make sure that
|
||||
you have the freedom to distribute copies of free software (and charge
|
||||
for this service if you wish); that you receive source code or can get
|
||||
it if you want it; that you can change the software and use pieces of
|
||||
it in new free programs; and that you are informed that you can do
|
||||
these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
distributors to deny you these rights or to ask you to surrender these
|
||||
rights. These restrictions translate to certain responsibilities for
|
||||
you if you distribute copies of the library or if you modify it.
|
||||
|
||||
For example, if you distribute copies of the library, whether gratis
|
||||
or for a fee, you must give the recipients all the rights that we gave
|
||||
you. You must make sure that they, too, receive or can get the source
|
||||
code. If you link other code with the library, you must provide
|
||||
complete object files to the recipients, so that they can relink them
|
||||
with the library after making changes to the library and recompiling
|
||||
it. And you must show them these terms so they know their rights.
|
||||
|
||||
We protect your rights with a two-step method: (1) we copyright the
|
||||
library, and (2) we offer you this license, which gives you legal
|
||||
permission to copy, distribute and/or modify the library.
|
||||
|
||||
To protect each distributor, we want to make it very clear that
|
||||
there is no warranty for the free library. Also, if the library is
|
||||
modified by someone else and passed on, the recipients should know
|
||||
that what they have is not the original version, so that the original
|
||||
author's reputation will not be affected by problems that might be
|
||||
introduced by others.
|
||||
|
||||
Finally, software patents pose a constant threat to the existence of
|
||||
any free program. We wish to make sure that a company cannot
|
||||
effectively restrict the users of a free program by obtaining a
|
||||
restrictive license from a patent holder. Therefore, we insist that
|
||||
any patent license obtained for a version of the library must be
|
||||
consistent with the full freedom of use specified in this license.
|
||||
|
||||
Most GNU software, including some libraries, is covered by the
|
||||
ordinary GNU General Public License. This license, the GNU Lesser
|
||||
General Public License, applies to certain designated libraries, and
|
||||
is quite different from the ordinary General Public License. We use
|
||||
this license for certain libraries in order to permit linking those
|
||||
libraries into non-free programs.
|
||||
|
||||
When a program is linked with a library, whether statically or using
|
||||
a shared library, the combination of the two is legally speaking a
|
||||
combined work, a derivative of the original library. The ordinary
|
||||
General Public License therefore permits such linking only if the
|
||||
entire combination fits its criteria of freedom. The Lesser General
|
||||
Public License permits more lax criteria for linking other code with
|
||||
the library.
|
||||
|
||||
We call this license the "Lesser" General Public License because it
|
||||
does Less to protect the user's freedom than the ordinary General
|
||||
Public License. It also provides other free software developers Less
|
||||
of an advantage over competing non-free programs. These disadvantages
|
||||
are the reason we use the ordinary General Public License for many
|
||||
libraries. However, the Lesser license provides advantages in certain
|
||||
special circumstances.
|
||||
|
||||
For example, on rare occasions, there may be a special need to
|
||||
encourage the widest possible use of a certain library, so that it becomes
|
||||
a de-facto standard. To achieve this, non-free programs must be
|
||||
allowed to use the library. A more frequent case is that a free
|
||||
library does the same job as widely used non-free libraries. In this
|
||||
case, there is little to gain by limiting the free library to free
|
||||
software only, so we use the Lesser General Public License.
|
||||
|
||||
In other cases, permission to use a particular library in non-free
|
||||
programs enables a greater number of people to use a large body of
|
||||
free software. For example, permission to use the GNU C Library in
|
||||
non-free programs enables many more people to use the whole GNU
|
||||
operating system, as well as its variant, the GNU/Linux operating
|
||||
system.
|
||||
|
||||
Although the Lesser General Public License is Less protective of the
|
||||
users' freedom, it does ensure that the user of a program that is
|
||||
linked with the Library has the freedom and the wherewithal to run
|
||||
that program using a modified version of the Library.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow. Pay close attention to the difference between a
|
||||
"work based on the library" and a "work that uses the library". The
|
||||
former contains code derived from the library, whereas the latter must
|
||||
be combined with the library in order to run.
|
||||
|
||||
GNU LESSER GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License Agreement applies to any software library or other
|
||||
program which contains a notice placed by the copyright holder or
|
||||
other authorized party saying it may be distributed under the terms of
|
||||
this Lesser General Public License (also called "this License").
|
||||
Each licensee is addressed as "you".
|
||||
|
||||
A "library" means a collection of software functions and/or data
|
||||
prepared so as to be conveniently linked with application programs
|
||||
(which use some of those functions and data) to form executables.
|
||||
|
||||
The "Library", below, refers to any such software library or work
|
||||
which has been distributed under these terms. A "work based on the
|
||||
Library" means either the Library or any derivative work under
|
||||
copyright law: that is to say, a work containing the Library or a
|
||||
portion of it, either verbatim or with modifications and/or translated
|
||||
straightforwardly into another language. (Hereinafter, translation is
|
||||
included without limitation in the term "modification".)
|
||||
|
||||
"Source code" for a work means the preferred form of the work for
|
||||
making modifications to it. For a library, complete source code means
|
||||
all the source code for all modules it contains, plus any associated
|
||||
interface definition files, plus the scripts used to control compilation
|
||||
and installation of the library.
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running a program using the Library is not restricted, and output from
|
||||
such a program is covered only if its contents constitute a work based
|
||||
on the Library (independent of the use of the Library in a tool for
|
||||
writing it). Whether that is true depends on what the Library does
|
||||
and what the program that uses the Library does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Library's
|
||||
complete source code as you receive it, in any medium, provided that
|
||||
you conspicuously and appropriately publish on each copy an
|
||||
appropriate copyright notice and disclaimer of warranty; keep intact
|
||||
all the notices that refer to this License and to the absence of any
|
||||
warranty; and distribute a copy of this License along with the
|
||||
Library.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy,
|
||||
and you may at your option offer warranty protection in exchange for a
|
||||
fee.
|
||||
|
||||
2. You may modify your copy or copies of the Library or any portion
|
||||
of it, thus forming a work based on the Library, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) The modified work must itself be a software library.
|
||||
|
||||
b) You must cause the files modified to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
c) You must cause the whole of the work to be licensed at no
|
||||
charge to all third parties under the terms of this License.
|
||||
|
||||
d) If a facility in the modified Library refers to a function or a
|
||||
table of data to be supplied by an application program that uses
|
||||
the facility, other than as an argument passed when the facility
|
||||
is invoked, then you must make a good faith effort to ensure that,
|
||||
in the event an application does not supply such function or
|
||||
table, the facility still operates, and performs whatever part of
|
||||
its purpose remains meaningful.
|
||||
|
||||
(For example, a function in a library to compute square roots has
|
||||
a purpose that is entirely well-defined independent of the
|
||||
application. Therefore, Subsection 2d requires that any
|
||||
application-supplied function or table used by this function must
|
||||
be optional: if the application does not supply it, the square
|
||||
root function must still compute square roots.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Library,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Library, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote
|
||||
it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Library.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Library
|
||||
with the Library (or with a work based on the Library) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may opt to apply the terms of the ordinary GNU General Public
|
||||
License instead of this License to a given copy of the Library. To do
|
||||
this, you must alter all the notices that refer to this License, so
|
||||
that they refer to the ordinary GNU General Public License, version 2,
|
||||
instead of to this License. (If a newer version than version 2 of the
|
||||
ordinary GNU General Public License has appeared, then you can specify
|
||||
that version instead if you wish.) Do not make any other change in
|
||||
these notices.
|
||||
|
||||
Once this change is made in a given copy, it is irreversible for
|
||||
that copy, so the ordinary GNU General Public License applies to all
|
||||
subsequent copies and derivative works made from that copy.
|
||||
|
||||
This option is useful when you wish to copy part of the code of
|
||||
the Library into a program that is not a library.
|
||||
|
||||
4. You may copy and distribute the Library (or a portion or
|
||||
derivative of it, under Section 2) in object code or executable form
|
||||
under the terms of Sections 1 and 2 above provided that you accompany
|
||||
it with the complete corresponding machine-readable source code, which
|
||||
must be distributed under the terms of Sections 1 and 2 above on a
|
||||
medium customarily used for software interchange.
|
||||
|
||||
If distribution of object code is made by offering access to copy
|
||||
from a designated place, then offering equivalent access to copy the
|
||||
source code from the same place satisfies the requirement to
|
||||
distribute the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
5. A program that contains no derivative of any portion of the
|
||||
Library, but is designed to work with the Library by being compiled or
|
||||
linked with it, is called a "work that uses the Library". Such a
|
||||
work, in isolation, is not a derivative work of the Library, and
|
||||
therefore falls outside the scope of this License.
|
||||
|
||||
However, linking a "work that uses the Library" with the Library
|
||||
creates an executable that is a derivative of the Library (because it
|
||||
contains portions of the Library), rather than a "work that uses the
|
||||
library". The executable is therefore covered by this License.
|
||||
Section 6 states terms for distribution of such executables.
|
||||
|
||||
When a "work that uses the Library" uses material from a header file
|
||||
that is part of the Library, the object code for the work may be a
|
||||
derivative work of the Library even though the source code is not.
|
||||
Whether this is true is especially significant if the work can be
|
||||
linked without the Library, or if the work is itself a library. The
|
||||
threshold for this to be true is not precisely defined by law.
|
||||
|
||||
If such an object file uses only numerical parameters, data
|
||||
structure layouts and accessors, and small macros and small inline
|
||||
functions (ten lines or less in length), then the use of the object
|
||||
file is unrestricted, regardless of whether it is legally a derivative
|
||||
work. (Executables containing this object code plus portions of the
|
||||
Library will still fall under Section 6.)
|
||||
|
||||
Otherwise, if the work is a derivative of the Library, you may
|
||||
distribute the object code for the work under the terms of Section 6.
|
||||
Any executables containing that work also fall under Section 6,
|
||||
whether or not they are linked directly with the Library itself.
|
||||
|
||||
6. As an exception to the Sections above, you may also combine or
|
||||
link a "work that uses the Library" with the Library to produce a
|
||||
work containing portions of the Library, and distribute that work
|
||||
under terms of your choice, provided that the terms permit
|
||||
modification of the work for the customer's own use and reverse
|
||||
engineering for debugging such modifications.
|
||||
|
||||
You must give prominent notice with each copy of the work that the
|
||||
Library is used in it and that the Library and its use are covered by
|
||||
this License. You must supply a copy of this License. If the work
|
||||
during execution displays copyright notices, you must include the
|
||||
copyright notice for the Library among them, as well as a reference
|
||||
directing the user to the copy of this License. Also, you must do one
|
||||
of these things:
|
||||
|
||||
a) Accompany the work with the complete corresponding
|
||||
machine-readable source code for the Library including whatever
|
||||
changes were used in the work (which must be distributed under
|
||||
Sections 1 and 2 above); and, if the work is an executable linked
|
||||
with the Library, with the complete machine-readable "work that
|
||||
uses the Library", as object code and/or source code, so that the
|
||||
user can modify the Library and then relink to produce a modified
|
||||
executable containing the modified Library. (It is understood
|
||||
that the user who changes the contents of definitions files in the
|
||||
Library will not necessarily be able to recompile the application
|
||||
to use the modified definitions.)
|
||||
|
||||
b) Use a suitable shared library mechanism for linking with the
|
||||
Library. A suitable mechanism is one that (1) uses at run time a
|
||||
copy of the library already present on the user's computer system,
|
||||
rather than copying library functions into the executable, and (2)
|
||||
will operate properly with a modified version of the library, if
|
||||
the user installs one, as long as the modified version is
|
||||
interface-compatible with the version that the work was made with.
|
||||
|
||||
c) Accompany the work with a written offer, valid for at
|
||||
least three years, to give the same user the materials
|
||||
specified in Subsection 6a, above, for a charge no more
|
||||
than the cost of performing this distribution.
|
||||
|
||||
d) If distribution of the work is made by offering access to copy
|
||||
from a designated place, offer equivalent access to copy the above
|
||||
specified materials from the same place.
|
||||
|
||||
e) Verify that the user has already received a copy of these
|
||||
materials or that you have already sent this user a copy.
|
||||
|
||||
For an executable, the required form of the "work that uses the
|
||||
Library" must include any data and utility programs needed for
|
||||
reproducing the executable from it. However, as a special exception,
|
||||
the materials to be distributed need not include anything that is
|
||||
normally distributed (in either source or binary form) with the major
|
||||
components (compiler, kernel, and so on) of the operating system on
|
||||
which the executable runs, unless that component itself accompanies
|
||||
the executable.
|
||||
|
||||
It may happen that this requirement contradicts the license
|
||||
restrictions of other proprietary libraries that do not normally
|
||||
accompany the operating system. Such a contradiction means you cannot
|
||||
use both them and the Library together in an executable that you
|
||||
distribute.
|
||||
|
||||
7. You may place library facilities that are a work based on the
|
||||
Library side-by-side in a single library together with other library
|
||||
facilities not covered by this License, and distribute such a combined
|
||||
library, provided that the separate distribution of the work based on
|
||||
the Library and of the other library facilities is otherwise
|
||||
permitted, and provided that you do these two things:
|
||||
|
||||
a) Accompany the combined library with a copy of the same work
|
||||
based on the Library, uncombined with any other library
|
||||
facilities. This must be distributed under the terms of the
|
||||
Sections above.
|
||||
|
||||
b) Give prominent notice with the combined library of the fact
|
||||
that part of it is a work based on the Library, and explaining
|
||||
where to find the accompanying uncombined form of the same work.
|
||||
|
||||
8. You may not copy, modify, sublicense, link with, or distribute
|
||||
the Library except as expressly provided under this License. Any
|
||||
attempt otherwise to copy, modify, sublicense, link with, or
|
||||
distribute the Library is void, and will automatically terminate your
|
||||
rights under this License. However, parties who have received copies,
|
||||
or rights, from you under this License will not have their licenses
|
||||
terminated so long as such parties remain in full compliance.
|
||||
|
||||
9. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Library or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Library (or any work based on the
|
||||
Library), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Library or works based on it.
|
||||
|
||||
10. Each time you redistribute the Library (or any work based on the
|
||||
Library), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute, link with or modify the Library
|
||||
subject to these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties with
|
||||
this License.
|
||||
|
||||
11. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Library at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Library by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Library.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under any
|
||||
particular circumstance, the balance of the section is intended to apply,
|
||||
and the section as a whole is intended to apply in other circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
12. If the distribution and/or use of the Library is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Library under this License may add
|
||||
an explicit geographical distribution limitation excluding those countries,
|
||||
so that distribution is permitted only in or among countries not thus
|
||||
excluded. In such case, this License incorporates the limitation as if
|
||||
written in the body of this License.
|
||||
|
||||
13. The Free Software Foundation may publish revised and/or new
|
||||
versions of the Lesser General Public License from time to time.
|
||||
Such new versions will be similar in spirit to the present version,
|
||||
but may differ in detail to address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Library
|
||||
specifies a version number of this License which applies to it and
|
||||
"any later version", you have the option of following the terms and
|
||||
conditions either of that version or of any later version published by
|
||||
the Free Software Foundation. If the Library does not specify a
|
||||
license version number, you may choose any version ever published by
|
||||
the Free Software Foundation.
|
||||
|
||||
14. If you wish to incorporate parts of the Library into other free
|
||||
programs whose distribution conditions are incompatible with these,
|
||||
write to the author to ask for permission. For software which is
|
||||
copyrighted by the Free Software Foundation, write to the Free
|
||||
Software Foundation; we sometimes make exceptions for this. Our
|
||||
decision will be guided by the two goals of preserving the free status
|
||||
of all derivatives of our free software and of promoting the sharing
|
||||
and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
|
||||
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
|
||||
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
|
||||
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
|
||||
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
|
||||
LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
|
||||
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
|
||||
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
|
||||
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
|
||||
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
|
||||
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
|
||||
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
|
||||
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
|
||||
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
|
||||
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
|
||||
DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Libraries
|
||||
|
||||
If you develop a new library, and you want it to be of the greatest
|
||||
possible use to the public, we recommend making it free software that
|
||||
everyone can redistribute and change. You can do so by permitting
|
||||
redistribution under these terms (or, alternatively, under the terms of the
|
||||
ordinary General Public License).
|
||||
|
||||
To apply these terms, attach the following notices to the library. It is
|
||||
safest to attach them to the start of each source file to most effectively
|
||||
convey the exclusion of warranty; and each file should have at least the
|
||||
"copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the library's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This library is free software; you can redistribute it and/or
|
||||
modify it under the terms of the GNU Lesser General Public
|
||||
License as published by the Free Software Foundation; either
|
||||
version 2.1 of the License, or (at your option) any later version.
|
||||
|
||||
This library is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
Lesser General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Lesser General Public
|
||||
License along with this library; if not, write to the Free Software
|
||||
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or your
|
||||
school, if any, to sign a "copyright disclaimer" for the library, if
|
||||
necessary. Here is a sample; alter the names:
|
||||
|
||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the
|
||||
library `Frob' (a library for tweaking knobs) written by James Random Hacker.
|
||||
|
||||
<signature of Ty Coon>, 1 April 1990
|
||||
Ty Coon, President of Vice
|
||||
|
||||
That's all there is to it!
|
||||
|
||||
-----
|
||||
In addition, as a special exception, the copyright holders give
|
||||
permission to link the code of portions of this program with the
|
||||
OpenSSL library under certain conditions as described in each
|
||||
individual source file, and distribute linked combinations
|
||||
including the two.
|
||||
|
||||
You must obey the GNU Lesser General Public License in all respects
|
||||
for all of the code used other than OpenSSL. If you modify
|
||||
file(s) with this exception, you may extend this exception to your
|
||||
version of the file(s), but you are not obligated to do so. If you
|
||||
do not wish to do so, delete this exception statement from your
|
||||
version. If you delete this exception statement from all source
|
||||
files in the program, then also delete it here.
|
||||
Binary file not shown.
Binary file not shown.
@@ -85,7 +85,7 @@ Libcryptsetup API additions:
|
||||
|
||||
* Fix optional password callback handling.
|
||||
|
||||
* Allow one to activate by internally cached volume key immediately after
|
||||
* Allow to activate by internally cached volume key immediately after
|
||||
crypt_format() without active slot (for temporary devices with
|
||||
on-disk metadata)
|
||||
|
||||
|
||||
@@ -15,7 +15,7 @@ Important changes
|
||||
* NSS (because of missing ripemd160 it cannot provide full backward compatibility)
|
||||
* kernel userspace API (provided by kernel 2.6.38 and above)
|
||||
(Note that kernel userspace backend is very slow for this type of operation.
|
||||
But it can be useful for embedded systems, because you can avoid userspace
|
||||
But it can be usefull for embedded systems, because you can avoid userspace
|
||||
crypto library completely.)
|
||||
|
||||
Backend is selected during configure time, using --with-crypto_backend option.
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
Cryptsetup 1.3.1 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.3.0
|
||||
|
||||
* Fix keyfile=- processing in create command (regression in 1.3.0).
|
||||
|
||||
* Simplify device path status check (use /sys and do not scan /dev).
|
||||
|
||||
* Do not ignore device size argument for create command (regression in 1.2.0).
|
||||
|
||||
* Fix error paths in blockwise code and lseek_write call.
|
||||
|
||||
* Add optional Nettle crypto backend support.
|
||||
@@ -1,131 +0,0 @@
|
||||
Cryptsetup 1.4.0 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.3.1
|
||||
|
||||
Important changes
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
WARNING: This release removes old deprecated API from libcryptsetup
|
||||
(all functions using struct crypt_options).
|
||||
|
||||
This require libcrypsetup version change and
|
||||
rebuild of applications using cryptsetup library.
|
||||
All new API symbols are backward compatible.
|
||||
|
||||
* If device is not rotational disk, cryptsetup no longer tries
|
||||
to wipe keyslot with Gutmann algorithm for magnetic media erase
|
||||
but simply rewrites area once by random data.
|
||||
|
||||
* The on-disk LUKS header can now be detached (e.g. placed on separate
|
||||
device or in file) using new --header option.
|
||||
|
||||
This option is only relevant for LUKS devices and can be used in
|
||||
luksFormat, luksOpen, luksSuspend, luksResume and resize commands.
|
||||
|
||||
If used with luksFormat the --align-payload option is taken
|
||||
as absolute sector alignment on ciphertext device and can be zero.
|
||||
|
||||
Example:
|
||||
Create LUKS device with ciphertext device on /dev/sdb and header
|
||||
on device /dev/sdc. Use all space on /dev/sdb (no reserved area for header).
|
||||
|
||||
cryptsetup luksFormat /dev/sdb --header /dev/sdc --align-payload 0
|
||||
|
||||
Activate such device:
|
||||
cryptsetup luksOpen /dev/sdb --header /dev/sdc test_disk
|
||||
|
||||
You can use file for LUKS header (loop device will be used while
|
||||
manipulating with such detached header), just you have to create
|
||||
large enough file in advance.
|
||||
|
||||
dd if=/dev/zero of=/mnt/luks_header bs=1M count=4
|
||||
cryptsetup luksFormat /dev/sdb --header /mnt/luks_header --align-payload 0
|
||||
|
||||
Activation is the same as above.
|
||||
|
||||
cryptsetup luksOpen /dev/sdb --header /mnt/luks_header test_disk
|
||||
|
||||
All keyslot operations need to be run on _header_ not on ciphertext device,
|
||||
an example:
|
||||
|
||||
cryptsetup luksAddKey /mnt/luks_header
|
||||
|
||||
If you do not use --align-payload 0, you can later restore LUKS header
|
||||
on device itself (and use it as normal LUKS device without detached header).
|
||||
|
||||
WARNING: There is no possible check that specified ciphertext device
|
||||
matches detached on-disk header. Use with care, it can destroy
|
||||
your data in case of a mistake.
|
||||
|
||||
WARNING: Storing LUKS header in a file means that anti-forensic splitter
|
||||
cannot properly work (there is filesystem allocation layer between
|
||||
header and disk).
|
||||
|
||||
* Support --allow-discards option to allow discards/TRIM requests.
|
||||
|
||||
Since kernel 3.1, dm-crypt devices optionally (not by default) support
|
||||
block discards (TRIM) commands.
|
||||
If you want to enable this operation, you have to enable it manually
|
||||
on every activation using --allow-discards
|
||||
|
||||
cryptsetup luksOpen --allow-discards /dev/sdb test_disk
|
||||
|
||||
WARNING: There are several security consequences, please read at least
|
||||
http://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html
|
||||
before you enable it.
|
||||
|
||||
* Add --shared option for creating non-overlapping crypt segments.
|
||||
|
||||
The --shared options checks that mapped segments are not overlapping
|
||||
and allows non-exclusive access to underlying device.
|
||||
Only plain crypt devices can be used in this mode.
|
||||
|
||||
Example - map 64M of device disk and following 32 M area as another disk.
|
||||
|
||||
cryptsetup create outer_disk /dev/sdb --offset 0 --size 65536
|
||||
cryptsetup create inner_disk /dev/sdb --offset 65536 --size 32768 --shared
|
||||
|
||||
(It can be used to simulate trivial hidden disk concepts.)
|
||||
|
||||
libcryptsetup API changes:
|
||||
* Added options to support detached metadata device
|
||||
crypt_init_by_name_and_header()
|
||||
crypt_set_data_device()
|
||||
* Add crypt_last_error() API call.
|
||||
* Fix plain crypt format parameters to include size option.
|
||||
* Add crypt_get_iv_offset() function.
|
||||
|
||||
* Remove old API functions (all functions using crypt_options).
|
||||
|
||||
* Support key-slot option for luksOpen (use only explicit keyslot).
|
||||
|
||||
You can now specify key slot in luksOpen and limit checking
|
||||
only to specified slot.
|
||||
|
||||
* Support retries and timeout parameters for luksSuspend.
|
||||
(The same way as in luksOpen.)
|
||||
|
||||
* Add doxygen-like documentation (it will be available on project page later).
|
||||
(To generate it manually run doxygen in docs directory.)
|
||||
|
||||
Other changes
|
||||
~~~~~~~~~~~~~
|
||||
* Fix crypt_load to properly check device size.
|
||||
* Do not allow context format of already formatted device.
|
||||
* Do not allow key retrieval while suspended (key could be wiped).
|
||||
* Do not allow suspend for non-LUKS devices.
|
||||
* Fix luksKillSLot exit code if slot is inactive or invalid.
|
||||
* Fix exit code if passphrases do not match in luksAddKey.
|
||||
* Fix return code for status command when device doesn't exists.
|
||||
* Fix verbose messages in isLuks command.
|
||||
* Support Nettle 2.4 crypto backend (supports ripemd160).
|
||||
* Add LUKS on-disk format description into package.
|
||||
* Enhance check of device size before writing LUKS header.
|
||||
* Add more paranoid checks for LUKS header and keyslot attributes.
|
||||
* Use new /dev/loop-control (kernel 3.1) if possible.
|
||||
* Remove hash/hmac restart from crypto backend and make it part of hash/hmac final.
|
||||
* Improve check for invalid offset and size values.
|
||||
* Revert default initialisation of volume key in crypt_init_by_name().
|
||||
* Add more regression tests.
|
||||
* Add some libcryptsetup example files (see docs/examples).
|
||||
@@ -1,25 +0,0 @@
|
||||
Cryptsetup 1.4.1 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.4.0
|
||||
|
||||
* Merge experimental Python cryptsetup (pycryptsetup) binding.
|
||||
|
||||
This option is disabled by default, you can enable build of Python binding
|
||||
with --enable--python configure switch.
|
||||
|
||||
Note that binding currently covers only partial libcryptsetup functions,
|
||||
mainly LUKS device handling needed for Anaconda installer.
|
||||
Until now provided separately as python-cryptsetup.
|
||||
Thanks to Martin Sivak for the code.
|
||||
|
||||
See python subdirectory for more info.
|
||||
|
||||
Python binding code is experimental for now, no stable API guarantee.
|
||||
|
||||
* Fix crypt_get_volume_key_size() for plain device.
|
||||
(cryptsetup status reported zero key size for plain crypt devices).
|
||||
|
||||
* Fix typo in set_iteration_time API call (old name remains for compatibility reasons).
|
||||
|
||||
* Fix FSF address in license and add LGPL license text.
|
||||
@@ -1,44 +0,0 @@
|
||||
Cryptsetup 1.4.2 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.4.1
|
||||
|
||||
* Add --keyfile-offset and --new-keyfile-offset parameters to API and CLI.
|
||||
These options can be used to skip start of keyfile or device used as keyfile.
|
||||
|
||||
* Add repair command and crypt_repair() for known LUKS metadata problems repair.
|
||||
|
||||
Some well-known LUKS metadata corruptions are easy to repair, this
|
||||
command should provide a way to fix these problems.
|
||||
|
||||
Always create binary backup of header device before running repair,
|
||||
(only 4kB - visible header) for example by using dd:
|
||||
dd if=/dev/<LUKS header device> of=repair_bck.img bs=1k count=4
|
||||
|
||||
Then you can try to run repair:
|
||||
cryptsetup repair <device>
|
||||
|
||||
Note, not all problems are possible to repair and if keyslot or some header
|
||||
parameters are overwritten, device is lost permanently.
|
||||
|
||||
* Fix header check to support old (cryptsetup 1.0.0) header alignment.
|
||||
(Regression in 1.4.0)
|
||||
|
||||
* Allow one to specify --align-payload only for luksFormat.
|
||||
|
||||
* Add --master-key-file option to luksOpen (open using volume key).
|
||||
|
||||
* Support UUID=<LUKS_UUID> format for device specification.
|
||||
You can open device by UUID (only shortcut to /dev/disk/by-uuid/ symlinks).
|
||||
|
||||
* Support password verification with quiet flag if possible. (1.2.0)
|
||||
Password verification can be still possible if input is terminal.
|
||||
|
||||
* Fix retry if entered passphrases (with verify option) do not match.
|
||||
(It should retry if requested, not fail.)
|
||||
|
||||
* Fix use of empty keyfile.
|
||||
|
||||
* Fix error message for luksClose and detached LUKS header.
|
||||
|
||||
* Allow --header for status command to get full info with detached header.
|
||||
@@ -1,62 +0,0 @@
|
||||
Cryptsetup 1.4.3 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.4.2
|
||||
|
||||
* Fix readonly activation if underlying device is readonly (1.4.0).
|
||||
|
||||
* Fix loop mapping on readonly file.
|
||||
|
||||
* Include stddef.h in libdevmapper.h (size_t definition).
|
||||
|
||||
* Fix keyslot removal for device with 4k hw block (1.4.0).
|
||||
(Wipe keyslot failed in this case.)
|
||||
|
||||
* Relax --shared flag to allow mapping even for overlapping segments.
|
||||
|
||||
The --shared flag (and API CRYPT_ACTIVATE_SHARED flag) is now able
|
||||
to map arbitrary overlapping area. From API it is even usable
|
||||
for LUKS devices.
|
||||
It is user responsibility to not cause data corruption though.
|
||||
|
||||
This allows e.g. scubed to work again and also allows some
|
||||
tricky extensions later.
|
||||
|
||||
* Allow empty cipher (cipher_null) for testing.
|
||||
|
||||
You can now use "null" (or directly cipher_null-ecb) in cryptsetup.
|
||||
This means no encryption, useful for performance tests
|
||||
(measure dm-crypt layer overhead).
|
||||
|
||||
* Switch on retry on device remove for libdevmapper.
|
||||
Device-mapper now retry removal if device is busy.
|
||||
|
||||
* Allow "private" activation (skip some udev global rules) flag.
|
||||
Cryptsetup library API now allows one to specify CRYPT_ACTIVATE_PRIVATE,
|
||||
which means that some udev rules are not processed.
|
||||
(Used for temporary devices, like internal keyslot mappings where
|
||||
it is not desirable to run any device scans.)
|
||||
|
||||
* This release also includes some Red Hat/Fedora specific extensions
|
||||
related to FIPS140-2 compliance.
|
||||
|
||||
In fact, all these patches are more formal changes and are just subset
|
||||
of building blocks for FIPS certification. See FAQ for more details
|
||||
about FIPS.
|
||||
|
||||
FIPS extensions are enabled by using --enable-fips configure switch.
|
||||
|
||||
In FIPS mode (kernel booted with fips=1 and gcrypt in FIPS mode)
|
||||
|
||||
- it provides library and binary integrity verification using
|
||||
libfipscheck (requires pre-generated checksums)
|
||||
|
||||
- it uses FIPS approved RNG for encryption key and salt generation
|
||||
(note that using /dev/random is not formally FIPS compliant RNG).
|
||||
|
||||
- only gcrypt crypto backend is currently supported in FIPS mode.
|
||||
|
||||
The FIPS RNG requirement for salt comes from NIST SP 800-132 recommendation.
|
||||
(Recommendation for Password-Based Key Derivation. Part 1: Storage Applications.
|
||||
http://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf)
|
||||
LUKS should be aligned to this recommendation otherwise.
|
||||
@@ -1,241 +0,0 @@
|
||||
Cryptsetup 1.5.0 Release Notes
|
||||
==============================
|
||||
|
||||
This release covers mainly inclusion of:
|
||||
|
||||
* Veritysetup tool (and related libcryptsetup extensions for dm-verity).
|
||||
|
||||
* Experimental cryptsetup-reencrypt tool (LUKS offline reencryption).
|
||||
|
||||
Changes since version 1.5.0-rc2
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Add --device-size option for reencryption tool.
|
||||
|
||||
* Switch to use unit suffix for --reduce-device-size option.
|
||||
|
||||
* Remove open device debugging feature (no longer needed).
|
||||
|
||||
* Fix library name for FIPS check.
|
||||
|
||||
* Add example of using reencryption inside dracut (see misc/dracut).
|
||||
|
||||
Changes since version 1.5.0-rc1
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
Introduce cryptsetup-reencrypt - experimental offline LUKS reencryption tool.
|
||||
|
||||
! cryptsetup-reencrypt tool is EXPERIMENTAL
|
||||
! ALWAYS BE SURE YOU HAVE RELIABLE BACKUP BEFORE USING THIS TOOL
|
||||
|
||||
This tool tries to simplify situation when you need to re-encrypt the whole
|
||||
LUKS device in situ (without need to move data elsewhere).
|
||||
|
||||
This can happen for example when you want to change volume (master) key,
|
||||
encryption algorithm, or other encryption parameter.
|
||||
|
||||
Cryptsetup-reencrypt can even optionally shift data on device
|
||||
(reducing data device size - you need some free space at the end of device).
|
||||
|
||||
In general, cryptsetup-reencrypt can be used to
|
||||
|
||||
- re-generate volume key
|
||||
- change arbitrary encryption parameters
|
||||
- add encryption to not yet encrypted drive
|
||||
|
||||
Side effect of reencryption is that final device will contain
|
||||
only ciphertext (for all sectors) so even if device was not properly
|
||||
wiped by random data, after reencryption you cannot distinguish
|
||||
which sectors are used.
|
||||
(Reencryption is done always for the whole device.)
|
||||
|
||||
There are for sure bugs, please TEST IT IN TEST ENVIRONMENT before
|
||||
use for your data.
|
||||
|
||||
This tool is not resistant to HW and kernel failures - hw crash
|
||||
will cause serious data corruption.
|
||||
|
||||
You can enable compilation of this tool with --enable-cryptsetup-reencrypt
|
||||
configure option (it is switched off by default).
|
||||
(Tool requires libcryptsetup 1.4.3 and later.)
|
||||
|
||||
You have to provide all keyslot passphrases or use --keyslot-option
|
||||
(then all other keyslots will be disabled).
|
||||
|
||||
EXAMPLES (from man page)
|
||||
|
||||
Reencrypt /dev/sdb1 (change volume key)
|
||||
# cryptsetup-reencrypt /dev/sdb1
|
||||
|
||||
Reencrypt and also change cipher and cipher mode
|
||||
# cryptsetup-reencrypt /dev/sdb1 -c aes-xts-plain64
|
||||
|
||||
Note: if you are changing key size, there must be enough space
|
||||
for keyslots in header or you have to use --reduce-device size and
|
||||
reduce fs in advance.
|
||||
|
||||
Add LUKS encryption to not yet encrypted device
|
||||
First, be sure you have space added to disk.
|
||||
Or, alternatively, shrink filesystem in advance.
|
||||
|
||||
Here we need 4096 512-bytes sectors (enough for 2x128 bit key).
|
||||
|
||||
# fdisk -u /dev/sdb # move sdb1 partition end + 4096 sectors
|
||||
|
||||
# cryptsetup-reencrypt /dev/sdb1 --new --reduce-device-size 4096
|
||||
|
||||
There are some options which can improve performance (depends on system),
|
||||
namely --use-directio (use direct IO for all operations) can be faster
|
||||
on some systems. See man page.
|
||||
|
||||
Progress and estimated time is printed during reencryption.
|
||||
|
||||
You can suspend reencryption (using ctrl+c or term signal).
|
||||
To continue reencryption you have to provide only
|
||||
the device parameter (offset is stored in temporary log file).
|
||||
|
||||
Please note LUKS device is marked invalid during reencryption and
|
||||
you have to retain tool temporary files until reencryption finishes.
|
||||
|
||||
Temporary files are LUKS-<uuid>.[log|org|new]
|
||||
|
||||
Other changes
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
* Fix luks-header-from-active script (do not use LUKS header on-disk, add UUID).
|
||||
|
||||
* Add --test-passphrase option for luksOpen (check passphrase only).
|
||||
|
||||
* Fix parsing of hexadecimal string (salt or root hash) in veritysetup.
|
||||
|
||||
Changes since version 1.4.3
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
Introduce veritysetup tool for dm-verity target management.
|
||||
|
||||
The dm-verity device-mapper target was added to Linux kernel 3.4 and
|
||||
provides transparent integrity checking of block devices using a cryptographic
|
||||
digest provided by the kernel crypto API. This target is read-only.
|
||||
|
||||
It is meant to be setup as part of a verified boot path (it was originally
|
||||
developed by Chrome OS authors as part of verified boot infrastructure).
|
||||
|
||||
For deeper description please see http://code.google.com/p/cryptsetup/wiki/DMVerity
|
||||
and kernel dm-verity documentation.
|
||||
|
||||
The libcryptsetup library was extended to support manipulation
|
||||
with dm-verity kernel module and new veritysetup CLI tool is added.
|
||||
|
||||
There are no additional library requirements (it uses the same crypto
|
||||
backend as cryptsetup).
|
||||
|
||||
If you want compile cryptsetup without veritysetup tool,
|
||||
use --disable-veritysetup configure option.
|
||||
For other configuration option see configure --help and veritysetup --help
|
||||
(e.g. default parameters).
|
||||
|
||||
Supported libcryptsetup functions new CRYPT_VERITY type:
|
||||
crypt_init
|
||||
crypt_init_by_name
|
||||
crypt_set_data device
|
||||
crypt_get_type
|
||||
crypt_format
|
||||
crypt_load
|
||||
crypt_get_active_device
|
||||
crypt_activate_by_volume_key (volume key == root hash here)
|
||||
crypt_dump
|
||||
and new introduced function
|
||||
crypt_get_verity_info
|
||||
|
||||
Please see comments in libcryptsetup.h and veritysetup.c as an code example
|
||||
how to use CRYPT_VERITY API.
|
||||
|
||||
The veritysetup tool supports these operations:
|
||||
|
||||
veritysetup format <data_device> <hash_device>
|
||||
Formats <hash_device> (calculates all hash areas according to <data_device>).
|
||||
This is initial command to prepare device <hash_device> for later verification.
|
||||
|
||||
veritysetup create <name> <data_device> <hash_device> <root_hash>
|
||||
Creates (activates) a dm-verity mapping with <name> backed by device <data_device>
|
||||
and using <hash_device> for in-kernel verification.
|
||||
|
||||
veritysetup verify <data_device> <hash_device> <root_hash>
|
||||
Verifies data in userspace (no kernel device is activated).
|
||||
|
||||
veritysetup remove <name>
|
||||
Removes activated device from kernel (similar to dmsetup remove).
|
||||
|
||||
veritysetup status <name>
|
||||
Reports status for the active kernel dm-verity device.
|
||||
|
||||
veritysetup dump <hash_device>
|
||||
Reports parameters of verity device from on-disk stored superblock.
|
||||
|
||||
For more info see veritysetup --help and veritysetup man page.
|
||||
|
||||
Other changes
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
* Both data and header device can now be a file and
|
||||
loop device is automatically allocated.
|
||||
|
||||
* Require only up to last keyslot area for header device, previously
|
||||
backup (and activation) required device/file of size up to data start
|
||||
offset (data payload).
|
||||
|
||||
* Fix header backup and restore to work on files with large data offset.
|
||||
Backup and restore now works even if backup file is smaller than data offset.
|
||||
|
||||
Appendix: Examples of veritysetup use
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Format device using default parameters, info and final root hash is printed:
|
||||
# veritysetup format /dev/sdb /dev/sdc
|
||||
VERITY header information for /dev/sdc
|
||||
UUID: fad30431-0c59-4fa6-9b57-732a90501f75
|
||||
Hash type: 1
|
||||
Data blocks: 52224
|
||||
Data block size: 4096
|
||||
Hash block size: 4096
|
||||
Hash algorithm: sha256
|
||||
Salt: 5cc52759af76a092e0c21829cd0ef6938f69831bf86926525106f92a7e9e3aa9
|
||||
Root hash: 7aefa4506f7af497ac491a27f862cf8005ea782a5d97f6426945a6896ab557a1
|
||||
|
||||
Activation of device in-kernel:
|
||||
# veritysetup create vr /dev/sdb /dev/sdc 7aefa4506f7af497ac491a27f862cf8005ea782a5d97f6426945a6896ab557a1
|
||||
Note - if device is corrupted, kernel mapping is created but will report failure:
|
||||
Verity device detected corruption after activation.
|
||||
|
||||
Userspace verification:
|
||||
# veritysetup verify /dev/sdb /dev/sdc 7aefa4506f7af497ac491a27f862cf8005ea782a5d97f6426945a6896ab557a1
|
||||
Verification failed at position 8192.
|
||||
Verification of data area failed.
|
||||
|
||||
Active device status report:
|
||||
# veritysetup status vr
|
||||
/dev/mapper/vr is active.
|
||||
type: VERITY
|
||||
status: verified
|
||||
hash type: 1
|
||||
data block: 4096
|
||||
hash block: 4096
|
||||
hash name: sha256
|
||||
salt: 5cc52759af76a092e0c21829cd0ef6938f69831bf86926525106f92a7e9e3aa9
|
||||
data device: /dev/sdb
|
||||
size: 417792 sectors
|
||||
mode: readonly
|
||||
hash device: /dev/sdc
|
||||
hash offset: 8 sectors
|
||||
|
||||
Dump of on-disk superblock information:
|
||||
# veritysetup dump /dev/sdc
|
||||
VERITY header information for /dev/sdc
|
||||
UUID: fad30431-0c59-4fa6-9b57-732a90501f75
|
||||
Hash type: 1
|
||||
Data blocks: 52224
|
||||
Data block size: 4096
|
||||
Hash block size: 4096
|
||||
Hash algorithm: sha256
|
||||
Salt: 5cc52759af76a092e0c21829cd0ef6938f69831bf86926525106f92a7e9e3aa9
|
||||
|
||||
Remove mapping:
|
||||
# veritysetup remove vr
|
||||
@@ -1,32 +0,0 @@
|
||||
Cryptsetup 1.5.1 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.5.0
|
||||
|
||||
* The libcryptsetup library now tries to initialize device-mapper backend and
|
||||
loop devices only if they are really needed (lazy initializations).
|
||||
This allows some operations to be run by a non-root user.
|
||||
|
||||
(Unfortunately LUKS header keyslot operations still require temporary dm-crypt
|
||||
device and device-mapper subsystem is available only to superuser.)
|
||||
|
||||
Also clear error messages are provided if running as non-root user and
|
||||
operation requires privileged user.
|
||||
|
||||
* Veritysetup can be now used by a normal user for creating hash image to file
|
||||
and also it can create hash image if doesn't exist.
|
||||
(Previously it required pre-allocated space.)
|
||||
|
||||
* Added crypt_keyslot_area() API call which allows external tools
|
||||
to get exact keyslot offsets and analyse content.
|
||||
|
||||
An example of a tool that searches the keyslot area of a LUKS container
|
||||
for positions where entropy is low and hence there is a high probability
|
||||
of damage is in misc/kesylot_checker.
|
||||
(Thanks to Arno Wagner for the code.)
|
||||
|
||||
* Optimized seek to keyfile-offset if key offset is large.
|
||||
|
||||
* Fixed luksHeaderBackup for very old v1.0 unaligned LUKS headers.
|
||||
|
||||
* Various fixes for problems found by a several static analysis tools.
|
||||
@@ -1,261 +0,0 @@
|
||||
Cryptsetup 1.6.0 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.0-rc1
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Change LUKS default cipher to use XTS encryption mode,
|
||||
aes-xts-plain64 (i.e. using AES128-XTS).
|
||||
|
||||
XTS mode becomes standard in hard disk encryption.
|
||||
|
||||
You can still use any old mode:
|
||||
- compile cryptsetup with old default:
|
||||
configure --with-luks1-cipher=aes --with-luks1-mode=cbc-essiv:sha256 --with-luks1-keybits=256
|
||||
- format LUKS device with old default:
|
||||
cryptsetup luksFormat -c aes-cbc-essiv:sha256 -s 256 <device>
|
||||
|
||||
|
||||
* Skip tests and fix error messages if running on old systems (or with old kernel).
|
||||
|
||||
* Rename configure.in to configure.ac and fix issues with new automake and pkgconfig
|
||||
and --disable-kernel_crypto option to allow compilation with old kernel headers.
|
||||
|
||||
* Allow repair of 512 bits key header.
|
||||
|
||||
* Fix status of device if path argument is used and fix double path prefix
|
||||
for non-existent device path.
|
||||
|
||||
|
||||
Changes since version 1.5.1
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Important changes
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Cryptsetup and libcryptsetup is now released under GPLv2+
|
||||
(GPL version 2 or any later).
|
||||
Some internal code handling files (loopaes, verity, tcrypt
|
||||
and crypto backend wrapper) are LGPLv2+.
|
||||
|
||||
Previously code was GPL version 2 only.
|
||||
|
||||
|
||||
* Introducing new unified command open and close.
|
||||
|
||||
Example:
|
||||
cryptsetup open --type plain|luks|loopaes|tcrypt <device> <name>
|
||||
(type defaults to luks)
|
||||
|
||||
with backward-compatible aliases plainOpen, luksOpen, loopaesOpen,
|
||||
tcryptOpen. Basically "open --type xyz" has alias "xyzOpen".
|
||||
|
||||
The "create" command (plain device create) is DEPRECATED but will
|
||||
be still supported.
|
||||
(This command is confusing because of switched arguments order.)
|
||||
|
||||
The close command is generic command to remove mapping and have
|
||||
backward compatible aliases (remove, luksClose, ...) which behaves
|
||||
exactly the same.
|
||||
|
||||
While all old syntax is still supported, I strongly suggest to use
|
||||
new command syntax which is common for all device types (and possible
|
||||
new formats added in future).
|
||||
|
||||
|
||||
* cryptsetup now support directly TCRYPT (TrueCrypt and compatible tc-play)
|
||||
on-disk format
|
||||
(Code is independent implementation not related to original project).
|
||||
|
||||
Only dump (tcryptDump command) and activation (open --type tcrypt or tcryptOpen)
|
||||
of TCRYPT device are supported. No header changes are supported.
|
||||
|
||||
It is intended to easily access containers shared with other operating systems
|
||||
without need to install 3rd party software. For native Linux installations LUKS
|
||||
is the preferred format.
|
||||
|
||||
WARNING: TCRYPT extension requires kernel userspace crypto API to be
|
||||
available (introduced in Linux kernel 2.6.38).
|
||||
If you are configuring kernel yourself, enable "User-space interface
|
||||
for symmetric key cipher algorithms" in "Cryptographic API" section
|
||||
(CRYPTO_USER_API_SKCIPHER .config option).
|
||||
|
||||
Because TCRYPT header is encrypted, you have to always provide valid
|
||||
passphrase and keyfiles. Keyfiles are handled exactly the same as in original
|
||||
format (basically, first 1MB of every keyfile is mixed using CRC32 into pool).
|
||||
|
||||
Cryptsetup should recognize all TCRYPT header variants ever released, except
|
||||
legacy cipher chains using LRW encryption mode with 64 bits encryption block
|
||||
(namely Blowfish in LRW mode is not recognized, this is limitation of kernel
|
||||
crypto API).
|
||||
|
||||
Device activation is supported only for LRW/XTS modes (again, limitation
|
||||
of kernel dmcrypt which do not implements TCRYPT extensions to CBC mode).
|
||||
(So old containers cannot be activated, but you can use libcryptsetup
|
||||
for lost password search, example of such code is included in misc directory.)
|
||||
|
||||
Hidden header are supported using --tcrypt-hidden option, system encryption
|
||||
using --tcrypt-system option.
|
||||
|
||||
For detailed description see man page.
|
||||
|
||||
EXAMPLE:
|
||||
* Dump device parameters of container in file:
|
||||
|
||||
# cryptsetup tcryptDump tst
|
||||
Enter passphrase:
|
||||
|
||||
TCRYPT header information for tst
|
||||
Version: 5
|
||||
Driver req.: 7
|
||||
Sector size: 512
|
||||
MK offset: 131072
|
||||
PBKDF2 hash: sha512
|
||||
Cipher chain: serpent-twofish-aes
|
||||
Cipher mode: xts-plain64
|
||||
MK bits: 1536
|
||||
|
||||
You can also dump master key using --dump-master-key.
|
||||
Dump does not require superuser privilege.
|
||||
|
||||
* Activation of this container
|
||||
|
||||
# cryptsetup tcryptOpen tst tcrypt_dev
|
||||
Enter passphrase:
|
||||
(Chain of dmcrypt devices is activated as /dev/mapper/tcrypt_dev.)
|
||||
|
||||
* See status of active TCRYPT device
|
||||
|
||||
# cryptsetup status tcrypt_dev
|
||||
|
||||
/dev/mapper/tcrypt_dev is active.
|
||||
type: TCRYPT
|
||||
cipher: serpent-twofish-aes-xts-plain64
|
||||
keysize: 1536 bits
|
||||
device: /dev/loop0
|
||||
loop: /tmp/tst
|
||||
offset: 256 sectors
|
||||
size: 65024 sectors
|
||||
skipped: 256 sectors
|
||||
mode: read/write
|
||||
|
||||
* And plaintext filesystem now ready to mount
|
||||
|
||||
# blkid /dev/mapper/tcrypt_dev
|
||||
/dev/mapper/tcrypt_dev: SEC_TYPE="msdos" UUID="9F33-2954" TYPE="vfat"
|
||||
|
||||
|
||||
* Add (optional) support for lipwquality for new LUKS passwords.
|
||||
|
||||
If password is entered through terminal (no keyfile specified)
|
||||
and cryptsetup is compiled with --enable-pwquality, default
|
||||
system pwquality settings are used to check password quality.
|
||||
|
||||
You can always override this check by using new --force-password option.
|
||||
|
||||
For more info about pwquality project see http://libpwquality.fedorahosted.org/
|
||||
|
||||
|
||||
* Proper handle interrupt signals (ctrl+c and TERM signal) in tools
|
||||
|
||||
Code should now handle interrupt properly, release and explicitly wipe
|
||||
in-memory key materials on interrupt.
|
||||
(Direct users of libcryptsetup should always call crypt_free() when
|
||||
code is interrupted to wipe all resources. There is no signal handling
|
||||
in library, it is up to the tool using it.)
|
||||
|
||||
|
||||
* Add new benchmark command
|
||||
|
||||
The "benchmark" command now tries to benchmark PBKDF2 and some block
|
||||
cipher variants. You can specify you own parameters (--cipher/--key-size
|
||||
for block ciphers, --hash for PBKDF2).
|
||||
|
||||
See man page for detailed description.
|
||||
|
||||
WARNING: benchmark command requires kernel userspace crypto API to be
|
||||
available (introduced in Linux kernel 2.6.38).
|
||||
If you are configuring kernel yourself, enable "User-space interface
|
||||
for symmetric key cipher algorithms" in "Cryptographic API" section
|
||||
(CRYPTO_USER_API_SKCIPHER .config option).
|
||||
|
||||
EXAMPLE:
|
||||
# cryptsetup benchmark
|
||||
# Tests are approximate using memory only (no storage IO).
|
||||
PBKDF2-sha1 111077 iterations per second
|
||||
PBKDF2-sha256 53718 iterations per second
|
||||
PBKDF2-sha512 18832 iterations per second
|
||||
PBKDF2-ripemd160 89775 iterations per second
|
||||
PBKDF2-whirlpool 23918 iterations per second
|
||||
# Algorithm | Key | Encryption | Decryption
|
||||
aes-cbc 128b 212.0 MiB/s 428.0 MiB/s
|
||||
serpent-cbc 128b 23.1 MiB/s 66.0 MiB/s
|
||||
twofish-cbc 128b 46.1 MiB/s 50.5 MiB/s
|
||||
aes-cbc 256b 163.0 MiB/s 350.0 MiB/s
|
||||
serpent-cbc 256b 23.1 MiB/s 66.0 MiB/s
|
||||
twofish-cbc 256b 47.0 MiB/s 50.0 MiB/s
|
||||
aes-xts 256b 190.0 MiB/s 190.0 MiB/s
|
||||
serpent-xts 256b 58.4 MiB/s 58.0 MiB/s
|
||||
twofish-xts 256b 49.0 MiB/s 49.5 MiB/s
|
||||
aes-xts 512b 175.0 MiB/s 175.0 MiB/s
|
||||
serpent-xts 512b 59.0 MiB/s 58.0 MiB/s
|
||||
twofish-xts 512b 48.5 MiB/s 49.5 MiB/s
|
||||
|
||||
Or you can specify cipher yourself:
|
||||
# cryptsetup benchmark --cipher cast5-cbc-essiv:sha256 -s 128
|
||||
# Tests are approximate using memory only (no storage IO).
|
||||
# Algorithm | Key | Encryption | Decryption
|
||||
cast5-cbc 128b 32.4 MiB/s 35.0 MiB/s
|
||||
|
||||
WARNING: these tests do not use dmcrypt, only crypto API.
|
||||
You have to benchmark the whole device stack and you can get completely
|
||||
different results. But it is usable for basic comparison.
|
||||
(Note for example AES-NI decryption optimization effect in example above.)
|
||||
|
||||
Features
|
||||
~~~~~~~~
|
||||
|
||||
* Do not maintain ChangeLog file anymore, see git log for detailed changes,
|
||||
e.g. here http://code.google.com/p/cryptsetup/source/list
|
||||
|
||||
* Move change key into library, add crypt_keyslot_change_by_passphrase().
|
||||
This change is useful mainly in FIPS mode, where we cannot
|
||||
extract volume key directly from libcryptsetup.
|
||||
|
||||
* Add verbose messages during reencryption.
|
||||
|
||||
* Default LUKS PBKDF2 iteration time is now configurable.
|
||||
|
||||
* Add simple cipher benchmarking API.
|
||||
|
||||
* Add kernel skcipher backend.
|
||||
|
||||
* Add CRC32 implementation (for TCRYPT).
|
||||
|
||||
* Move PBKDF2 into crypto backend wrapper.
|
||||
This allows use it in other formats, use library implementations and
|
||||
also possible use of different KDF function in future.
|
||||
|
||||
* New PBKDF2 benchmark using getrusage().
|
||||
|
||||
Fixes
|
||||
~~~~~
|
||||
|
||||
* Avoid O_DIRECT open if underlying storage doesn't support it.
|
||||
|
||||
* Fix some non-translated messages.
|
||||
|
||||
* Fix regression in header backup (1.5.1) with container in file.
|
||||
|
||||
* Fix blockwise read/write for end writes near end of device.
|
||||
(was not used in previous versions)
|
||||
|
||||
* Ignore setpriority failure.
|
||||
|
||||
* Code changes to fix/ignore problems found by Coverity static analysis, including
|
||||
- Get page size should never fail.
|
||||
- Fix time of check/use (TOCTOU test) in tools
|
||||
- Fix time of check/use in loop/wipe utils.
|
||||
- Fix time of check/use in device utils.
|
||||
|
||||
* Disallow header restore if context is non-LUKS device.
|
||||
@@ -1,32 +0,0 @@
|
||||
Cryptsetup 1.6.1 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.0
|
||||
|
||||
* Fix loop-AES keyfile parsing.
|
||||
Loop-AES keyfile should be text keyfile, reject keyfiles which
|
||||
are not properly terminated.
|
||||
|
||||
* Fix passphrase pool overflow for too long TCRYPT passphrase.
|
||||
(Maximal TCRYPT passphrase length is 64 characters.)
|
||||
|
||||
* Return EPERM (translated to exit code 2) for too long TCRYPT passphrase.
|
||||
|
||||
* Fix deactivation of device when failed underlying node disappeared.
|
||||
|
||||
* Fix API deactivate call for TCRYPT format and NULL context parameter.
|
||||
|
||||
* Improve keyslot checker example documentation.
|
||||
|
||||
* Report error message if deactivation fails and device is still busy.
|
||||
|
||||
* Make passphrase prompts more consistent (and remove "LUKS" form prompt).
|
||||
|
||||
* Fix some missing headers (compilation failed with alternative libc).
|
||||
|
||||
* Remove not functional API UUID support for plain & loopaes devices.
|
||||
(not persistent activation UUID).
|
||||
|
||||
* Properly cleanup devices on interrupt in api-test.
|
||||
|
||||
* Support all tests run if kernel is in FIPS mode.
|
||||
@@ -1,25 +0,0 @@
|
||||
Cryptsetup 1.6.2 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.1
|
||||
|
||||
* Print error and fail if more device arguments are present for isLuks command.
|
||||
|
||||
* Fix cipher specification string parsing (found by gcc -fsanitize=address option).
|
||||
|
||||
* Try to map TCRYPT system encryption through partition
|
||||
(allows one to activate mapping when other partition on the same device is mounted).
|
||||
|
||||
* Print a warning if system encryption is used and device is a partition.
|
||||
(TCRYPT system encryption uses whole device argument.)
|
||||
|
||||
* Disallow explicit small payload offset for LUKS detached header.
|
||||
LUKS detached header only allows data payload 0 (whole data device is used)
|
||||
or explicit offset larger than header + keyslots size.
|
||||
|
||||
* Fix boundary condition for verity device that caused failure for certain device sizes.
|
||||
|
||||
* Various fixes to documentation, including update FAQ, default modes
|
||||
and TCRYPT description.
|
||||
|
||||
* Workaround for some recent changes in automake (serial-tests).
|
||||
@@ -1,50 +0,0 @@
|
||||
Cryptsetup 1.6.3 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.2
|
||||
|
||||
* Fix cryptsetup reencryption tool to work properly
|
||||
with devices using 4kB sectors.
|
||||
|
||||
* Always use page size if running through loop device,
|
||||
this fixes failures for external LUKS header and
|
||||
filesystem requiring 4kB block size.
|
||||
|
||||
* Fix TCRYPT system encryption mapping for multiple partitions.
|
||||
Since this commit, one can use partition directly as device parameter.
|
||||
If you need to activate such partition from image in file,
|
||||
please first use map partitioned loop device (losetup -P)
|
||||
on image.
|
||||
(Cryptsetup require partition offsets visible in kernel sysfs
|
||||
in this mode.)
|
||||
|
||||
* Support activation of old TrueCrypt containers using CBC mode
|
||||
and whitening (created in TrueCrypt version < 4.1).
|
||||
This requires Linux kernel 3.13 or later.
|
||||
(Containers with cascade CBC ciphers are not supported.)
|
||||
|
||||
* Properly display keys in dump --dump-master-key command
|
||||
for TrueCrypt CBC containers.
|
||||
|
||||
* Rewrite cipher benchmark loop which was unreliable
|
||||
on very fast machines.
|
||||
|
||||
* Add warning if LUKS device was activated using non-cryptsetup
|
||||
library which did not set UUID properly (e.g. cryptmount).
|
||||
(Some commands, like luksSuspend, are not available then.)
|
||||
|
||||
* Support length limitation also for plain (no hash) length.
|
||||
This can be used for mapping problematic cryptosystems which
|
||||
wipes some key (losetup sometimes set last 32 byte to zero,
|
||||
which can be now configured as --hash plain:31 parameter).
|
||||
|
||||
* Fix hash limit if parameter is not a number.
|
||||
(The whole key was set to zero instead of command failure.)
|
||||
|
||||
* Unify --key-slot behavior in cryptsetup_reencrypt tool.
|
||||
|
||||
* Update dracut example scripts for system reencryption on first boot.
|
||||
|
||||
* Add command line option --tcrypt-backup to access TCRYPT backup header.
|
||||
|
||||
* Fix static compilation with OpenSSL.
|
||||
@@ -1,57 +0,0 @@
|
||||
Cryptsetup 1.6.4 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.3
|
||||
|
||||
* Implement new erase (with alias luksErase) command.
|
||||
|
||||
The erase cryptsetup command can be used to permanently erase
|
||||
all keyslots and make the LUKS container inaccessible.
|
||||
(The only way to unlock such device is to use LUKS header backup
|
||||
created before erase command was used.)
|
||||
|
||||
You do not need to provide any password for this operation.
|
||||
|
||||
This operation is irreversible.
|
||||
|
||||
* Add internal "whirlpool_gcryptbug hash" for accessing flawed
|
||||
Whirlpool hash in gcrypt (requires gcrypt 1.6.1 or above).
|
||||
|
||||
The gcrypt version of Whirlpool hash algorithm was flawed in some
|
||||
situations.
|
||||
|
||||
This means that if you used Whirlpool in LUKS header and upgraded
|
||||
to new gcrypt library your LUKS container become inaccessible.
|
||||
|
||||
Please refer to cryptsetup FAQ for detail how to fix this situation.
|
||||
|
||||
* Allow one to use --disable-gcrypt-pbkdf2 during configuration
|
||||
to force use internal PBKDF2 code.
|
||||
|
||||
* Require gcrypt 1.6.1 for imported implementation of PBKDF2
|
||||
(PBKDF2 in gcrypt 1.6.0 is too slow).
|
||||
|
||||
* Add --keep-key to cryptsetup-reencrypt.
|
||||
|
||||
This allows change of LUKS header hash (and iteration count) without
|
||||
the need to reencrypt the whole data area.
|
||||
(Reencryption of LUKS header only without master key change.)
|
||||
|
||||
* By default verify new passphrase in luksChangeKey and luksAddKey
|
||||
commands (if input is from terminal).
|
||||
|
||||
* Fix memory leak in Nettle crypto backend.
|
||||
|
||||
* Support --tries option even for TCRYPT devices in cryptsetup.
|
||||
|
||||
* Support --allow-discards option even for TCRYPT devices.
|
||||
(Note that this could destroy hidden volume and it is not suggested
|
||||
by original TrueCrypt security model.)
|
||||
|
||||
* Link against -lrt for clock_gettime to fix undefined reference
|
||||
to clock_gettime error (introduced in 1.6.2).
|
||||
|
||||
* Fix misleading error message when some algorithms are not available.
|
||||
|
||||
* Count system time in PBKDF2 benchmark if kernel returns no self usage info.
|
||||
(Workaround to broken getrusage() syscall with some hypervisors.)
|
||||
@@ -1,54 +0,0 @@
|
||||
Cryptsetup 1.6.5 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.4
|
||||
|
||||
* Allow LUKS header operation handling without requiring root privilege.
|
||||
It means that you can manipulate with keyslots as a regular user, only
|
||||
write access to device (or image) is required.
|
||||
|
||||
This requires kernel crypto wrapper (similar to TrueCrypt device handling)
|
||||
to be available (CRYPTO_USER_API_SKCIPHER kernel option).
|
||||
If this kernel interface is not available, code fallbacks to old temporary
|
||||
keyslot device creation (where root privilege is required).
|
||||
|
||||
Note that activation, deactivation, resize and suspend operations still
|
||||
need root privilege (limitation of kernel device-mapper backend).
|
||||
|
||||
* Fix internal PBKDF2 key derivation function implementation for alternative
|
||||
crypto backends (kernel, NSS) which do not support PBKDF2 directly and have
|
||||
issues with longer HMAC keys.
|
||||
|
||||
This fixes the problem for long keyfiles where either calculation is too slow
|
||||
(because of internal rehashing in every iteration) or there is a limit
|
||||
(kernel backend seems to not support HMAC key longer than 20480 bytes).
|
||||
|
||||
(Note that for recent version of gcrypt, nettle or openssl the internal
|
||||
PBKDF2 code is not compiled in and crypto library internal functions are
|
||||
used instead.)
|
||||
|
||||
* Support for Python3 for simple Python binding.
|
||||
Python >= 2.6 is now required. You can set Python compiled version by setting
|
||||
--with-python_version configure option (together with --enable-python).
|
||||
|
||||
* Use internal PBKDF2 in Nettle library for Nettle crypto backend.
|
||||
Cryptsetup compilation requires Nettle >= 2.6 (if using Nettle crypto backend).
|
||||
|
||||
* Allow simple status of crypt device without providing metadata header.
|
||||
The command "cryptsetup status" will print basic info, even if you
|
||||
do not provide detached header argument.
|
||||
|
||||
* Allow one to specify ECB mode in cryptsetup benchmark.
|
||||
|
||||
* Add some LUKS images for regression testing.
|
||||
Note that if image with Whirlpool fails, the most probable cause is that
|
||||
you have old gcrypt library with flawed whirlpool hash.
|
||||
Read FAQ section 8.3 for more info.
|
||||
|
||||
Cryptsetup API NOTE:
|
||||
The direct terminal handling for passphrase entry will be removed from
|
||||
libcryptsetup in next major version (application should handle it itself).
|
||||
|
||||
It means that you have to always either provide password in buffer or set
|
||||
your own password callback function trhough crypt_set_password_callback().
|
||||
See API documentation (or libcryptsetup.h) for more info.
|
||||
@@ -1,29 +0,0 @@
|
||||
Cryptsetup 1.6.6 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.5
|
||||
|
||||
* LUKS: Fix keyslot device access for devices which
|
||||
do not support direct IO operations. (Regression in 1.6.5.)
|
||||
|
||||
* LUKS: Fallback to old temporary keyslot device mapping method
|
||||
if hash (for ESSIV) is not supported by userspace crypto
|
||||
library. (Regression in 1.6.5.)
|
||||
|
||||
* Properly activate device with discard (TRIM for SSDs)
|
||||
if requested even if dm_crypt module is not yet loaded.
|
||||
Only if discard is not supported by the old kernel then
|
||||
the discard option is ignored.
|
||||
|
||||
* Fix some static analysis build warnings (scan-build).
|
||||
|
||||
* Report crypto lib version only once (and always add kernel
|
||||
version) in debug output.
|
||||
|
||||
Cryptsetup API NOTE:
|
||||
The direct terminal handling for passphrase entry will be removed from
|
||||
libcryptsetup in next major version (application should handle it itself).
|
||||
|
||||
It means that you have to always either provide password in buffer or set
|
||||
your own password callback function through crypt_set_password_callback().
|
||||
See API documentation (or libcryptsetup.h) for more info.
|
||||
@@ -1,84 +0,0 @@
|
||||
Cryptsetup 1.6.7 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.6
|
||||
|
||||
* Cryptsetup git and wiki are now hosted on GitLab.
|
||||
https://gitlab.com/cryptsetup/cryptsetup
|
||||
|
||||
Repository of stable releases remains on kernel.org site
|
||||
https://www.kernel.org/pub/linux/utils/cryptsetup/
|
||||
|
||||
For more info please see README file.
|
||||
|
||||
* Cryptsetup TCRYPT mode now supports VeraCrypt devices (TrueCrypt extension).
|
||||
|
||||
The VeraCrypt extension only increases iteration count for the key
|
||||
derivation function (on-disk format is the same as TrueCrypt format).
|
||||
|
||||
Note that unlocking of a VeraCrypt device can take very long time if used
|
||||
on slow machines.
|
||||
|
||||
To use this extension, add --veracrypt option, for example
|
||||
cryptsetup open --type tcrypt --veracrypt <container> <name>
|
||||
|
||||
For use through libcryptsetup, just add CRYPT_TCRYPT_VERA_MODES flag.
|
||||
|
||||
* Support keyfile-offset and keyfile-size options even for plain volumes.
|
||||
|
||||
* Support keyfile option for luksAddKey if the master key is specified.
|
||||
|
||||
* For historic reasons, hashing in the plain mode is not used
|
||||
if keyfile is specified (with exception of --key-file=-).
|
||||
Print a warning if these parameters are ignored.
|
||||
|
||||
* Support permanent device decryption for cryptsetup-reencrypt.
|
||||
To remove LUKS encryption from a device, you can now use --decrypt option.
|
||||
|
||||
* Allow one to use --header option in all LUKS commands.
|
||||
The --header always takes precedence over positional device argument.
|
||||
|
||||
* Allow luksSuspend without need to specify a detached header.
|
||||
|
||||
* Detect if O_DIRECT is usable on a device allocation.
|
||||
There are some strange storage stack configurations which wrongly allows
|
||||
one to open devices with direct-io but fails on all IO operations later.
|
||||
|
||||
Cryptsetup now tries to read the device first sector to ensure it can use
|
||||
direct-io.
|
||||
|
||||
* Add low-level performance options tuning for dmcrypt (for Linux 4.0 and later).
|
||||
|
||||
Linux kernel 4.0 contains rewritten dmcrypt code which tries to better utilize
|
||||
encryption on parallel CPU cores.
|
||||
|
||||
While tests show that this change increases performance on most configurations,
|
||||
dmcrypt now provides some switches to change its new behavior.
|
||||
|
||||
You can use them (per-device) with these cryptsetup switches:
|
||||
--perf-same_cpu_crypt
|
||||
--perf-submit_from_crypt_cpus
|
||||
|
||||
Please use these only in the case of serious performance problems.
|
||||
Refer to the cryptsetup man page and dm-crypt documentation
|
||||
(for same_cpu_crypt and submit_from_crypt_cpus options).
|
||||
https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt
|
||||
|
||||
* Get rid of libfipscheck library.
|
||||
(Note that this option was used only for Red Hat and derived distributions.)
|
||||
With recent FIPS changes we do not need to link to this FIPS monster anymore.
|
||||
Also drop some no longer needed FIPS mode checks.
|
||||
|
||||
* Many fixes and clarifications to man pages.
|
||||
|
||||
* Prevent compiler to optimize-out zeroing of buffers for on-stack variables.
|
||||
|
||||
* Fix a crash if non-GNU strerror_r is used.
|
||||
|
||||
Cryptsetup API NOTE:
|
||||
The direct terminal handling for passphrase entry will be removed from
|
||||
libcryptsetup in next major version (application should handle it itself).
|
||||
|
||||
It means that you have to always either provide password in buffer or set
|
||||
your own password callback function through crypt_set_password_callback().
|
||||
See API documentation (or libcryptsetup.h) for more info.
|
||||
@@ -1,47 +0,0 @@
|
||||
Cryptsetup 1.6.8 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.6.7
|
||||
|
||||
* If the null cipher (no encryption) is used, allow only empty password for LUKS.
|
||||
(Previously cryptsetup accepted any password in this case.)
|
||||
|
||||
The null cipher can be used only for testing and it is used temporarily during
|
||||
offline encrypting not yet encrypted device (cryptsetup-reencrypt tool).
|
||||
|
||||
Accepting only empty password prevents situation when someone adds another
|
||||
LUKS device using the same UUID (UUID of existing LUKS device) with faked
|
||||
header containing null cipher.
|
||||
This could force user to use different LUKS device (with no encryption)
|
||||
without noticing.
|
||||
(IOW it prevents situation when attacker intentionally forces
|
||||
user to boot into different system just by LUKS header manipulation.)
|
||||
|
||||
Properly configured systems should have an additional integrity protection
|
||||
in place here (LUKS here provides only confidentiality) but it is better
|
||||
to not allow this situation in the first place.
|
||||
|
||||
(For more info see QubesOS Security Bulletin QSB-019-2015.)
|
||||
|
||||
* Properly support stdin "-" handling for luksAddKey for both new and old
|
||||
keyfile parameters.
|
||||
|
||||
* If encrypted device is file-backed (it uses underlying loop device),
|
||||
cryptsetup resize will try to resize underlying loop device as well.
|
||||
(It can be used to grow up file-backed device in one step.)
|
||||
|
||||
* Cryptsetup now allows one to use empty password through stdin pipe.
|
||||
(Intended only for testing in scripts.)
|
||||
|
||||
Cryptsetup API NOTE:
|
||||
|
||||
Direct terminal handling and password calling callback for passphrase
|
||||
entry will be removed from libcryptsetup in next major (2.x) version
|
||||
(application should handle it itself).
|
||||
It means that application have to always provide password in API calls.
|
||||
|
||||
Functions returning last error will be removed in next major version (2.x).
|
||||
These functions did not work properly for early initialization errors
|
||||
and application can implement better function easily using own error callback.
|
||||
|
||||
See comments in libcryptsetup.h for more info about deprecated functions.
|
||||
@@ -1,81 +0,0 @@
|
||||
Cryptsetup 1.7.0 Release Notes
|
||||
==============================
|
||||
|
||||
The cryptsetup 1.7 release changes defaults for LUKS,
|
||||
there are no API changes.
|
||||
|
||||
Changes since version 1.6.8
|
||||
|
||||
* Default hash function is now SHA256 (used in key derivation function
|
||||
and anti-forensic splitter).
|
||||
|
||||
Note that replacing SHA1 with SHA256 is not for security reasons.
|
||||
(LUKS does not have problems even if collisions are found for SHA1,
|
||||
for details see FAQ item 5.20).
|
||||
|
||||
Using SHA256 as default is mainly to prevent compatibility problems
|
||||
on hardened systems where SHA1 is already be phased out.
|
||||
|
||||
Note that all checks (kernel crypto API availability check) now uses
|
||||
SHA256 as well.
|
||||
|
||||
* Default iteration time for PBKDF2 is now 2 seconds.
|
||||
|
||||
Increasing iteration time is in combination with PBKDF2 benchmark
|
||||
fixes a try to keep PBKDF2 iteration count still high enough and
|
||||
also still acceptable for users.
|
||||
|
||||
N.B. Long term is to replace PBKDF2 algorithm with Password Hashing
|
||||
Competition winner - Argon2.
|
||||
|
||||
Distributions can still change these defaults in compilation time.
|
||||
|
||||
You can change iteration time and used hash function in existing LUKS
|
||||
header with cryptsetup-reencrypt utility even without full reencryption
|
||||
of device (see --keep-key option).
|
||||
|
||||
* Fix PBKDF2 iteration benchmark for longer key sizes.
|
||||
|
||||
The previous PBKDF2 benchmark code did not take into account
|
||||
output key length properly.
|
||||
|
||||
For SHA1 (with 160-bits output) and 256-bit keys (and longer)
|
||||
it means that the final iteration value was higher than it should be.
|
||||
|
||||
For other hash algorithms (like SHA256 or SHA512) it caused
|
||||
that iteration count was lower (in comparison to SHA1) than
|
||||
expected for the requested time period.
|
||||
|
||||
The PBKDF2 benchmark code is now fixed to use the key size for
|
||||
the formatted device (or default LUKS key size if running in informational
|
||||
benchmark mode).
|
||||
|
||||
Thanks to A.Visconti, S.Bossi, A.Calo and H.Ragab
|
||||
(http://www.club.di.unimi.it/) for point this out.
|
||||
(Based on "What users should know about Full Disk Encryption
|
||||
based on LUKS" paper to be presented on CANS2015).
|
||||
|
||||
* Remove experimental warning for reencrypt tool.
|
||||
The strong request for full backup before using reencryption utility
|
||||
still applies :)
|
||||
|
||||
* Add optional libpasswdqc support for new LUKS passwords.
|
||||
|
||||
If password is entered through terminal (no keyfile specified) and
|
||||
cryptsetup is compiled with --enable-passwdqc[=/etc/passwdqc.conf],
|
||||
configured system passwdqc settings are used to check password quality.
|
||||
|
||||
* Update FAQ document.
|
||||
|
||||
Cryptsetup API NOTE:
|
||||
|
||||
Direct terminal handling and password calling callback for passphrase
|
||||
entry will be removed from libcryptsetup in next major (2.x) version
|
||||
(application should handle it itself).
|
||||
It means that application have to always provide password in API calls.
|
||||
|
||||
Functions returning last error will be removed in next major version (2.x).
|
||||
These functions did not work properly for early initialization errors
|
||||
and application can implement better function easily using own error callback.
|
||||
|
||||
See comments in libcryptsetup.h for more info about deprecated functions.
|
||||
@@ -1,36 +0,0 @@
|
||||
Cryptsetup 1.7.1 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.7.0
|
||||
|
||||
* Code now uses kernel crypto API backend according to new
|
||||
changes introduced in mainline kernel
|
||||
|
||||
While mainline kernel should contain backward compatible
|
||||
changes, some stable series kernels do not contain fully
|
||||
backported compatibility patches.
|
||||
Without these patches most of cryptsetup operations
|
||||
(like unlocking device) fail.
|
||||
|
||||
This change in cryptsetup ensures that all operations using
|
||||
kernel crypto API works even on these kernels.
|
||||
|
||||
* The cryptsetup-reencrypt utility now properly detects removal
|
||||
of underlying link to block device and does not remove
|
||||
ongoing re-encryption log.
|
||||
This allows proper recovery (resume) of reencrypt operation later.
|
||||
|
||||
NOTE: Never use /dev/disk/by-uuid/ path for reencryption utility,
|
||||
this link disappears once the device metadata is temporarily
|
||||
removed from device.
|
||||
|
||||
* Cryptsetup now allows special "-" (standard input) keyfile handling
|
||||
even for TCRYPT (TrueCrypt and VeraCrypt compatible) devices.
|
||||
|
||||
* Cryptsetup now fails if there are more keyfiles specified
|
||||
for non-TCRYPT device.
|
||||
|
||||
* The luksKillSlot command now does not suppress provided password
|
||||
in batch mode (if password is wrong slot is not destroyed).
|
||||
Note that not providing password in batch mode means that keyslot
|
||||
is destroyed unconditionally.
|
||||
@@ -1,37 +0,0 @@
|
||||
Cryptsetup 1.7.2 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.7.1
|
||||
|
||||
* Update LUKS documentation format.
|
||||
Clarify fixed sector size and keyslots alignment.
|
||||
|
||||
* Support activation options for error handling modes in Linux kernel
|
||||
dm-verity module:
|
||||
|
||||
--ignore-corruption - dm-verity just logs detected corruption
|
||||
|
||||
--restart-on-corruption - dm-verity restarts the kernel if corruption is detected
|
||||
|
||||
If the options above are not specified, default behavior for dm-verity remains.
|
||||
Default is that I/O operation fails with I/O error if corrupted block is detected.
|
||||
|
||||
--ignore-zero-blocks - Instructs dm-verity to not verify blocks that are expected
|
||||
to contain zeroes and always return zeroes directly instead.
|
||||
|
||||
NOTE that these options could have security or functional impacts,
|
||||
do not use them without assessing the risks!
|
||||
|
||||
* Fix help text for cipher benchmark specification (mention --cipher option).
|
||||
|
||||
* Fix off-by-one error in maximum keyfile size.
|
||||
Allow keyfiles up to compiled-in default and not that value minus one.
|
||||
|
||||
* Support resume of interrupted decryption in cryptsetup-reencrypt utility.
|
||||
To resume decryption, LUKS device UUID (--uuid option) option must be used.
|
||||
|
||||
* Do not use direct-io for LUKS header with unaligned keyslots.
|
||||
Such headers were used only by the first cryptsetup-luks-1.0.0 release (2005).
|
||||
|
||||
* Fix device block size detection to properly work on particular file-based
|
||||
containers over underlying devices with 4k sectors.
|
||||
@@ -1,20 +0,0 @@
|
||||
Cryptsetup 1.7.3 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.7.2
|
||||
|
||||
* Fix device access to hash offsets located beyond the 2GB device boundary in veritysetup.
|
||||
|
||||
* Set configured (compile-time) default iteration time for devices created directly through
|
||||
libcryptsetup (default was hardcoded 1 second, the configured value applied only
|
||||
for cryptsetup application).
|
||||
|
||||
* Fix PBKDF2 benchmark to not double iteration count for specific corner case.
|
||||
If the measurement function returns exactly 500 ms, the iteration calculation loop
|
||||
doubled iteration count but instead of repeating measurement it used this value directly.
|
||||
|
||||
* OpenSSL backend: fix memory leak if hash context was repeatedly reused.
|
||||
|
||||
* OpenSSL backend: add support for OpenSSL 1.1.0.
|
||||
|
||||
* Fix several minor spelling errors.
|
||||
@@ -1,22 +0,0 @@
|
||||
Cryptsetup 1.7.4 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.7.3
|
||||
|
||||
* Allow one to specify LUKS1 hash algorithm in Python luksFormat wrapper.
|
||||
|
||||
* Use LUKS1 compiled-in defaults also in Python wrapper.
|
||||
|
||||
* OpenSSL backend: Fix OpenSSL 1.1.0 support without backward compatible API.
|
||||
|
||||
* OpenSSL backend: Fix LibreSSL compatibility.
|
||||
|
||||
* Check for data device and hash device area overlap in veritysetup.
|
||||
|
||||
* Fix a possible race while allocating a free loop device.
|
||||
|
||||
* Fix possible file descriptor leaks if libcryptsetup is run from a forked process.
|
||||
|
||||
* Fix missing same_cpu_crypt flag in status command.
|
||||
|
||||
* Various updates to FAQ and man pages.
|
||||
@@ -1,22 +0,0 @@
|
||||
Cryptsetup 1.7.5 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.7.4
|
||||
|
||||
* Fixes to luksFormat to properly support recent kernel running in FIPS mode.
|
||||
|
||||
Cryptsetup must never use a weak key even if it is just used for testing
|
||||
of algorithm availability. In FIPS mode, weak keys are always rejected.
|
||||
|
||||
A weak key is for example detected if the XTS encryption mode use
|
||||
the same key for the tweak and the encryption part.
|
||||
|
||||
* Fixes accesses to unaligned hidden legacy TrueCrypt header.
|
||||
|
||||
On a native 4k-sector device the old hidden TrueCrypt header is not
|
||||
aligned with the hw sector size (this problem was fixed in later TrueCrypt
|
||||
on-disk format versions).
|
||||
|
||||
Cryptsetup now properly aligns the read so it does not fail.
|
||||
|
||||
* Fixes to optional dracut ramdisk scripts for offline re-encryption on initial boot.
|
||||
@@ -1,605 +0,0 @@
|
||||
Cryptsetup 2.0.0 Release Notes
|
||||
==============================
|
||||
Stable release with experimental features.
|
||||
|
||||
This version introduces a new on-disk LUKS2 format.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported
|
||||
forever as well as a traditional and fully backward compatible format.
|
||||
|
||||
NOTE: This version changes soname of libcryptsetup library and increases
|
||||
major version for all public symbols.
|
||||
Most of the old functions are fully backward compatible, so only
|
||||
recompilation of programs should be needed.
|
||||
|
||||
Please note that authenticated disk encryption, non-cryptographic
|
||||
data integrity protection (dm-integrity), use of Argon2 Password-Based
|
||||
Key Derivation Function and the LUKS2 on-disk format itself are new
|
||||
features and can contain some bugs.
|
||||
|
||||
To provide all security features of authenticated encryption we need
|
||||
better nonce-reuse resistant algorithm in kernel (see note below).
|
||||
For now, please use authenticated encryption as experimental feature.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or in
|
||||
production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.0-RC1
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* Limit KDF requested (for format) memory by available physical memory.
|
||||
On some systems too high requested amount of memory causes OOM killer
|
||||
to kill the process (instead of returning ENOMEM).
|
||||
We never try to use more than half of available physical memory.
|
||||
|
||||
* Ignore device alignment if it is not multiple of minimal-io.
|
||||
Some USB enclosures seems to report bogus topology info that
|
||||
prevents to use LUKS detached header.
|
||||
|
||||
Changes since version 2.0.0-RC0
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Enable to use system libargon2 instead of bundled version.
|
||||
Renames --disable-argon2 to --disable-internal-argon2 option
|
||||
and adds --enable-libargon2 flag to allow system libargon2.
|
||||
|
||||
* Changes in build system (Automake)
|
||||
- The build system now uses non-recursive automake (except for tests).
|
||||
(Tools binaries are now located in buildroot directory.)
|
||||
- New --disable-cryptsetup option to disable build of cryptsetup tool.
|
||||
- Enable build of cryptsetup-reencrypt by default.
|
||||
|
||||
* Install tmpfiles.d configuration for LUKS2 locking directory.
|
||||
You can overwrite this using --with-tmpfilesdir configure option.
|
||||
If your distro does not support tmpfiles.d directory, you have
|
||||
to create locking directory (/run/lock/cryptsetup) in cryptsetup
|
||||
package (or init scripts).
|
||||
|
||||
* Adds limited support for offline reencryption of LUKS2 format.
|
||||
|
||||
* Decrease size of testing images (and the whole release archive).
|
||||
|
||||
* Fixes for several memory leaks found by Valgrind and Coverity tools.
|
||||
|
||||
* Fixes for several typos in man pages and error messages.
|
||||
|
||||
* LUKS header file in luksFormat is now automatically created
|
||||
if it does not exist.
|
||||
|
||||
* Do not allow resize if device size is not aligned to sector size.
|
||||
|
||||
Cryptsetup 2.0.0 RC0 Release Notes
|
||||
==================================
|
||||
|
||||
Important features
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* New command integritysetup: support for the new dm-integrity kernel target.
|
||||
|
||||
The dm-integrity is a new kernel device-mapper target that introduces
|
||||
software emulation of per-sector integrity fields on the disk sector level.
|
||||
It is available since Linux kernel version 4.12.
|
||||
|
||||
The provided per-sector metadata fields can be used for storing a data
|
||||
integrity checksum (for example CRC32).
|
||||
The dm-integrity implements data journal that enforces atomic update
|
||||
of a sector and its integrity metadata.
|
||||
|
||||
Integritysetup is a CLI utility that can setup standalone dm-integrity
|
||||
devices (that internally check integrity of data).
|
||||
|
||||
Integritysetup is intended to be used for settings that require
|
||||
non-cryptographic data integrity protection with no data encryption.
|
||||
For setting integrity protected encrypted devices, see disk authenticated
|
||||
encryption below.
|
||||
|
||||
Note that after formatting the checksums need to be initialized;
|
||||
otherwise device reads will fail because of integrity errors.
|
||||
Integritysetup by default tries to wipe the device with zero blocks
|
||||
to avoid this problem. Device wipe can be time-consuming, you can skip
|
||||
this step by specifying --no-wipe option.
|
||||
(But note that not wiping device can cause some operations to fail
|
||||
if a write is not multiple of page size and kernel page cache tries
|
||||
to read sectors with not yet initialized checksums.)
|
||||
|
||||
The default setting is tag size 4 bytes per-sector and CRC32C protection.
|
||||
To format device with these defaults:
|
||||
$ integritysetup format <device>
|
||||
$ integritysetup open <device> <name>
|
||||
|
||||
Note that used algorithm (unlike tag size) is NOT stored in device
|
||||
kernel superblock and if you use different algorithm, you MUST specify
|
||||
it in every open command, for example:
|
||||
$ integritysetup format <device> --tag-size 32 --integrity sha256
|
||||
$ integritysetup open <device> <name> --integrity sha256
|
||||
|
||||
For more info, see integrity man page.
|
||||
|
||||
* Veritysetup command can now format and activate dm-verity devices
|
||||
that contain Forward Error Correction (FEC) (Reed-Solomon code is used).
|
||||
This feature is used on most of Android devices already (available since
|
||||
Linux kernel 4.5).
|
||||
|
||||
There are new options --fec-device, --fec-offset to specify data area
|
||||
with correction code and --fec-roots that set Redd-Solomon generator roots.
|
||||
This setting can be used for format command (veritysetup will calculate
|
||||
and store RS codes) or open command (veritysetup configures kernel
|
||||
dm-verity to use RS codes).
|
||||
|
||||
For more info see veritysetup man page.
|
||||
|
||||
* Support for larger sector sizes for crypt devices.
|
||||
|
||||
LUKS2 and plain crypt devices can be now configured with larger encryption
|
||||
sector (typically 4096 bytes, sector size must be the power of two,
|
||||
maximal sector size is 4096 bytes for portability).
|
||||
Large sector size can decrease encryption overhead and can also help
|
||||
with some specific crypto hardware accelerators that perform very
|
||||
badly with 512 bytes sectors.
|
||||
|
||||
Note that if you configure such a larger sector of the device that does use
|
||||
smaller physical sector, there is a possibility of a data corruption during
|
||||
power fail (partial sector writes).
|
||||
|
||||
WARNING: If you use different sector size for a plain device after data were
|
||||
stored, the decryption will produce garbage.
|
||||
|
||||
For LUKS2, the sector size is stored in metadata and cannot be changed later.
|
||||
|
||||
LUKS2 format and features
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
The LUKS2 is an on-disk storage format designed to provide simple key
|
||||
management, primarily intended for Full Disk Encryption based on dm-crypt.
|
||||
|
||||
The LUKS2 is inspired by LUKS1 format and in some specific situations (most
|
||||
of the default configurations) can be converted in-place from LUKS1.
|
||||
|
||||
The LUKS2 format is designed to allow future updates of various
|
||||
parts without the need to modify binary structures and internally
|
||||
uses JSON text format for metadata. Compilation now requires the json-c library
|
||||
that is used for JSON data processing.
|
||||
|
||||
On-disk format provides redundancy of metadata, detection
|
||||
of metadata corruption and automatic repair from metadata copy.
|
||||
|
||||
NOTE: For security reasons, there is no redundancy in keyslots binary data
|
||||
(encrypted keys) but the format allows adding such a feature in future.
|
||||
|
||||
NOTE: to operate correctly, LUKS2 requires locking of metadata.
|
||||
Locking is performed by using flock() system call for images in file
|
||||
and for block device by using a specific lock file in /run/lock/cryptsetup.
|
||||
|
||||
This directory must be created by distribution (do not rely on internal
|
||||
fallback). For systemd-based distribution, you can simply install
|
||||
scripts/cryptsetup.conf into tmpfiles.d directory.
|
||||
|
||||
For more details see LUKS2-format.txt and LUKS2-locking.txt in the docs
|
||||
directory. (Please note this is just overview, there will be more formal
|
||||
documentation later.)
|
||||
|
||||
LUKS2 use
|
||||
~~~~~~~~~
|
||||
|
||||
LUKS2 allows using all possible configurations as LUKS1.
|
||||
|
||||
To format device as LUKS2, you have to add "--type luks2" during format:
|
||||
|
||||
$ cryptsetup luksFormat --type luks2 <device>
|
||||
|
||||
All commands issued later will recognize the new format automatically.
|
||||
|
||||
The newly added features in LUKS2 include:
|
||||
|
||||
* Authenticated disk (sector) encryption (EXPERIMENTAL)
|
||||
|
||||
Legacy Full disk encryption (FDE), for example, LUKS1, is a length-preserving
|
||||
encryption (plaintext is the same size as a ciphertext).
|
||||
Such FDE can provide data confidentiality, but cannot provide sound data
|
||||
integrity protection.
|
||||
|
||||
Full disk authenticated encryption is a way how to provide both
|
||||
confidentiality and data integrity protection. Integrity protection here means
|
||||
not only detection of random data corruption (silent data corruption) but also
|
||||
prevention of an unauthorized intentional change of disk sector content.
|
||||
|
||||
NOTE: Integrity protection of this type cannot prevent a replay attack.
|
||||
An attacker can replace the device or its part of the old content, and it
|
||||
cannot be detected.
|
||||
If you need such protection, better use integrity protection on a higher layer.
|
||||
|
||||
For data integrity protection on the sector level, we need additional
|
||||
per-sector metadata space. In LUKS2 this space is provided by a new
|
||||
device-mapper dm-integrity target (available since kernel 4.12).
|
||||
Here the integrity target provides only reliable per-sector metadata store,
|
||||
and the whole authenticated encryption is performed inside dm-crypt stacked
|
||||
over the dm-integrity device.
|
||||
|
||||
For encryption, Authenticated Encryption with Additional Data (AEAD) is used.
|
||||
Every sector is processed as a encryption request of this format:
|
||||
|
||||
|----- AAD -------|------ DATA -------|-- AUTH TAG --|
|
||||
| (authenticated) | (auth+encryption) | |
|
||||
| sector_LE | IV | sector in/out | tag in/out |
|
||||
|
||||
AEAD encrypts the whole sector and also authenticates sector number
|
||||
(to detect sector relocation) and also authenticates Initialization Vector.
|
||||
|
||||
AEAD encryption produces encrypted data and authentication tag.
|
||||
The authenticated tag is then stored in per-sector metadata space provided
|
||||
by dm-integrity.
|
||||
|
||||
Most of the current AEAD algorithms requires IV as a nonce, value that is
|
||||
never reused. Because sector number, as an IV, cannot be used in this
|
||||
environment, we use a new random IV (IV is a random value generated by system
|
||||
RNG on every write). This random IV is then stored in the per-sector metadata
|
||||
as well.
|
||||
|
||||
Because the authentication tag (and IV) requires additional space, the device
|
||||
provided for a user has less capacity. Also, the data journalling means that
|
||||
writes are performed twice, decreasing throughput.
|
||||
|
||||
This integrity protection works better with SSDs. If you want to ignore
|
||||
dm-integrity data journal (because journalling is performed on some higher
|
||||
layer or you just want to trade-off performance to safe recovery), you can
|
||||
switch journal off with --integrity-no-journal option.
|
||||
(This flag can be stored persistently as well.)
|
||||
|
||||
Note that (similar to integritysetup) the device read will fail if
|
||||
authentication tag is not initialized (no previous write).
|
||||
By default cryptsetup run wipe of a device (writing zeroes) to initialize
|
||||
authentication tags. This operation can be very time-consuming.
|
||||
You can skip device wipe using --integrity-no-wipe option.
|
||||
|
||||
To format LUKS2 device with integrity protection, use new --integrity option.
|
||||
|
||||
For now, there are very few AEAD algorithms that can be used, and some
|
||||
of them are known to be problematic. In this release we support only
|
||||
a few of AEAD algorithms (options are for now hard coded), later this
|
||||
extension will be completely algorithm-agnostic.
|
||||
|
||||
For testing of authenticated encryption, these algorithms work for now:
|
||||
|
||||
1) aes-xts-plain64 with hmac-sha256 or hmac-sha512 as the authentication tag.
|
||||
(Common FDE mode + independent authentication tag. Authentication key
|
||||
for HMAC is independently generated. This mode is very slow.)
|
||||
$ cryptsetup luksFormat --type luks2 <device> --cipher aes-xts-plain64 --integrity hmac-sha256
|
||||
|
||||
2) aes-gcm-random (native AEAD mode)
|
||||
DO NOT USE in production! The GCM mode uses only 96-bit nonce,
|
||||
and possible collision means fatal security problem.
|
||||
GCM mode has very good hardware support through AES-NI, so it is useful
|
||||
for performance testing.
|
||||
$ cryptsetup luksFormat --type luks2 <device> --cipher aes-gcm-random --integrity aead
|
||||
|
||||
3) ChaCha20 with Poly1305 authenticator (according to RFC7539)
|
||||
$ cryptsetup luksFormat --type luks2 <device> --cipher chacha20-random --integrity poly1305
|
||||
|
||||
To specify AES128/AES256 just specify proper key size (without possible
|
||||
authentication key). Other symmetric ciphers, like Serpent or Twofish,
|
||||
should work as well. The mode 1) and 2) should be compatible with IEEE 1619.1
|
||||
standard recommendation.
|
||||
|
||||
There will be better suitable authenticated modes available soon
|
||||
For now we are just preparing framework to enable it (and hopefully improve security of FDE).
|
||||
|
||||
FDE authenticated encryption is not a replacement for filesystem layer
|
||||
authenticated encryption. The goal is to provide at least something because
|
||||
data integrity protection is often completely ignored in today systems.
|
||||
|
||||
* New memory-hard PBKDF
|
||||
|
||||
LUKS1 introduced Password-Based Key Derivation Function v2 as a tool to
|
||||
increase attacker cost for a dictionary and brute force attacks.
|
||||
The PBKDF2 uses iteration count to increase time of key derivation.
|
||||
Unfortunately, with modern GPUs, the PBKDF2 calculations can be run
|
||||
in parallel and PBKDF2 can no longer provide the best available protection.
|
||||
Increasing iteration count just cannot prevent massive parallel dictionary
|
||||
password attacks in long-term.
|
||||
|
||||
To solve this problem, a new PBKDF, based on so-called memory-hard functions
|
||||
can be used. Key derivation with memory-hard function requires a certain
|
||||
amount of memory to compute its output. The memory requirement is very
|
||||
costly for GPUs and prevents these systems to operate effectively,
|
||||
increasing cost for attackers.
|
||||
|
||||
LUKS2 introduces support for Argon2i and Argon2id as a PBKDF.
|
||||
Argon2 is the winner of Password Hashing Competition and is currently
|
||||
in final RFC draft specification.
|
||||
|
||||
For now, libcryptsetup contains the embedded copy of reference implementation
|
||||
of Argon2 (that is easily portable to all architectures).
|
||||
Later, once this function is available in common crypto libraries, it will
|
||||
switch to external implementation. (This happened for LUKS1 and PBKDF2
|
||||
as well years ago.)
|
||||
With using reference implementation (that is not optimized for speed), there
|
||||
is some performance penalty. However, using memory-hard PBKDF should still
|
||||
significantly complicate GPU-optimized dictionary and brute force attacks.
|
||||
|
||||
The Argon2 uses three costs: memory, time (number of iterations) and parallel
|
||||
(number of threads).
|
||||
Note that time and memory cost highly influences each other (accessing a lot
|
||||
of memory takes more time).
|
||||
|
||||
There is a new benchmark that tries to calculate costs to take similar way as
|
||||
in LUKS1 (where iteration is measured to take 1-2 seconds on user system).
|
||||
Because now there are more cost variables, it prefers time cost (iterations)
|
||||
and tries to find required memory that fits. (IOW required memory cost can be
|
||||
lower if the benchmarks are not able to find required parameters.)
|
||||
The benchmark cannot run too long, so it tries to approximate next step
|
||||
for benchmarking.
|
||||
|
||||
For now, default LUKS2 PBKDF algorithm is Argon2i (data independent variant)
|
||||
with memory cost set to 128MB, time to 800ms and parallel thread according
|
||||
to available CPU cores but no more than 4.
|
||||
|
||||
All default parameters can be set during compile time and also set on
|
||||
the command line by using --pbkdf, --pbkdf-memory, --pbkdf-parallel and
|
||||
--iter-time options.
|
||||
(Or without benchmark directly by using --pbkdf-force-iterations, see below.)
|
||||
|
||||
You can still use PBKDF2 even for LUKS2 by specifying --pbkdf pbkdf2 option.
|
||||
(Then only iteration count is applied.)
|
||||
|
||||
* Use of kernel keyring
|
||||
|
||||
Kernel keyring is a storage for sensitive material (like cryptographic keys)
|
||||
inside Linux kernel.
|
||||
|
||||
LUKS2 uses keyring for two major functions:
|
||||
|
||||
- To store volume key for dm-crypt where it avoids sending volume key in
|
||||
every device-mapper ioctl structure. Volume key is also no longer directly
|
||||
visible in a dm-crypt mapping table. The key is not available for the user
|
||||
after dm-crypt configuration (obviously except direct memory scan).
|
||||
Use of kernel keyring can be disabled in runtime by --disable-keyring option.
|
||||
|
||||
- As a tool to automatically unlock LUKS device if a passphrase is put into
|
||||
kernel keyring and proper keyring token is configured.
|
||||
|
||||
This allows storing a secret (passphrase) to kernel per-user keyring by
|
||||
some external tool (for example some TPM handler) and LUKS2, if configured,
|
||||
will automatically search in the keyring and unlock the system.
|
||||
For more info see Tokens section below.
|
||||
|
||||
* Persistent flags
|
||||
The activation flags (like allow-discards) can be stored in metadata and used
|
||||
automatically by all later activations (even without using crypttab).
|
||||
|
||||
To store activation flags permanently, use activation command with required
|
||||
flags and add --persistent option.
|
||||
|
||||
For example, to mark device to always activate with TRIM enabled,
|
||||
use (for LUKS2 type):
|
||||
|
||||
$ cryptsetup open <device> <name> --allow-discards --persistent
|
||||
|
||||
You can check persistent flags in dump command output:
|
||||
|
||||
$ cryptsetup luksDump <device>
|
||||
|
||||
* Tokens and auto-activation
|
||||
|
||||
A LUKS2 token is an object that can be described "how to get passphrase or key"
|
||||
to unlock particular keyslot.
|
||||
(Also it can be used to store any additional metadata, and with
|
||||
the libcryptsetup interface it can be used to define user token types.)
|
||||
|
||||
Cryptsetup internally implements keyring token. Cryptsetup tries to use
|
||||
available tokens before asking for the passphrase. For keyring token,
|
||||
it means that if the passphrase is available under specified identifier
|
||||
inside kernel keyring, the device is automatically activated using this
|
||||
stored passphrase.
|
||||
|
||||
Example of using LUKS2 keyring token:
|
||||
|
||||
# Adding token to metadata with "my_token" identifier (by default it applies to all keyslots).
|
||||
$ cryptsetup token add --key-description "my_token" <device>
|
||||
|
||||
# Storing passphrase to user keyring (this can be done by an external application)
|
||||
$ echo -n <passphrase> | keyctl padd user my_token @u
|
||||
|
||||
# Now cryptsetup activates automatically if it finds correct passphrase
|
||||
$ cryptsetup open <device> <name>
|
||||
|
||||
The main reason to use tokens this way is to separate possible hardware
|
||||
handlers from cryptsetup code.
|
||||
|
||||
* Keyslot priorities
|
||||
|
||||
LUKS2 keyslot can have a new priority attribute.
|
||||
The default is "normal". The "prefer" priority tell the keyslot to be tried
|
||||
before other keyslots. Priority "ignore" means that keyslot will never be
|
||||
used if not specified explicitly (it can be used for backup administrator
|
||||
passwords that are used only situations when a user forgets own passphrase).
|
||||
|
||||
The priority of keyslot can be set with new config command, for example
|
||||
$ cryptsetup config <device> --key-slot 1 --priority prefer
|
||||
|
||||
Setting priority to normal will reset slot to normal state.
|
||||
|
||||
* LUKS2 label and subsystem
|
||||
|
||||
The header now contains additional fields for label and subsystem (additional
|
||||
label). These fields can be used similar to filesystem label and will be
|
||||
visible in udev rules to possible filtering. (Note that blkid do not yet
|
||||
contain the LUKS scanning code).
|
||||
|
||||
By default both labels are empty. Label and subsystem are always set together
|
||||
(no option means clear the label) with the config command:
|
||||
|
||||
$ cryptsetup config <device> --label my_device --subsystem ""
|
||||
|
||||
* In-place conversion form LUKS1
|
||||
|
||||
To allow easy testing and transition to the new LUKS2 format, there is a new
|
||||
convert command that allows in-place conversion from the LUKS1 format and,
|
||||
if there are no incompatible options, also conversion back from LUKS2
|
||||
to LUKS1 format.
|
||||
|
||||
Note this command can be used only on some LUKS1 devices (some device header
|
||||
sizes are not supported).
|
||||
This command is dangerous, never run it without header backup!
|
||||
If something fails in the middle of conversion (IO error), the header
|
||||
is destroyed. (Note that conversion requires move of keyslot data area to
|
||||
a different offset.)
|
||||
|
||||
To convert header in-place to LUKS2 format, use
|
||||
$ cryptsetup convert <device> --type luks2
|
||||
|
||||
To convert it back to LUKS1 format, use
|
||||
$ cryptsetup convert <device> --type luks1
|
||||
|
||||
You can verify LUKS version with luksDump command.
|
||||
$ cryptsetup luksDump <device>
|
||||
|
||||
Note that some LUKS2 features will make header incompatible with LUKS1 and
|
||||
conversion will be rejected (for example using new Argon2 PBKDF or integrity
|
||||
extensions). Some minor attributes can be lost in conversion.
|
||||
|
||||
Other changes
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
* Explicit KDF iterations count setting
|
||||
|
||||
With new PBKDF interface, there is also the possibility to setup PBKDF costs
|
||||
directly, avoiding benchmarks. This can be useful if device is formatted to be
|
||||
primarily used on a different system.
|
||||
|
||||
The option --pbkdf-force-iterations is available for both LUKS1 and LUKS2
|
||||
format. Using this option can cause device to have either very low or very
|
||||
high PBKDF costs.
|
||||
In the first case it means bad protection to dictionary attacks, in the second
|
||||
case, it can mean extremely high unlocking time or memory requirements.
|
||||
Use only if you are sure what you are doing!
|
||||
|
||||
Not that this setting also affects iteration count for the key digest.
|
||||
For LUKS1 iteration count for digest will be approximately 1/8 of requested
|
||||
value, for LUKS2 and "pbkdf2" digest minimal PBKDF2 iteration count (1000)
|
||||
will be used. You cannot set lower iteration count than the internal minimum
|
||||
(1000 for PBKDF2).
|
||||
|
||||
To format LUKS1 device with forced iteration count (and no benchmarking), use
|
||||
$ cryptsetup luksFormat <device> --pbkdf-force-iterations 22222
|
||||
|
||||
For LUKS2 it is always better to specify full settings (do not rely on default
|
||||
cost values).
|
||||
For example, we can set to use Argon2id with iteration cost 5, memory 128000
|
||||
and parallel set 1:
|
||||
$ cryptsetup luksFormat --type luks2 <device> \
|
||||
--pbkdf argon2id --pbkdf-force-iterations 5 --pbkdf-memory 128000 --pbkdf-parallel 1
|
||||
|
||||
* VeraCrypt PIM
|
||||
|
||||
Cryptsetup can now also open VeraCrypt device that uses Personal Iteration
|
||||
Multiplier (PIM). PIM is an integer value that user must remember additionally
|
||||
to passphrase and influences PBKDF2 iteration count (without it VeraCrypt uses
|
||||
a fixed number of iterations).
|
||||
|
||||
To open VeraCrypt device with PIM settings, use --veracrypt-pim (to specify
|
||||
PIM on the command line) or --veracrypt-query-pim to query PIM interactively.
|
||||
|
||||
* Support for plain64be IV
|
||||
|
||||
The plain64be is big-endian variant of plain64 Initialization Vector. It is
|
||||
used in some images of hardware-based disk encryption systems. Supporting this
|
||||
variant allows using dm-crypt to map such images through cryptsetup.
|
||||
|
||||
* Deferral removal
|
||||
|
||||
Cryptsetup now can mark device for deferred removal by using a new option
|
||||
--deferred. This means that close command will not fail if the device is still
|
||||
in use, but will instruct the kernel to remove the device automatically after
|
||||
use count drops to zero (for example, once the filesystem is unmounted).
|
||||
|
||||
* A lot of updates to man pages and many minor changes that would make this
|
||||
release notes too long ;-)
|
||||
|
||||
Libcryptsetup API changes
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
These API functions were removed, libcryptsetup no longer handles password
|
||||
retries from terminal (application should handle terminal operations itself):
|
||||
crypt_set_password_callback;
|
||||
crypt_set_timeout;
|
||||
crypt_set_password_retry;
|
||||
crypt_set_password_verify;
|
||||
|
||||
This call is removed (no need to keep typo backward compatibility,
|
||||
the proper function is crypt_set_iteration_time :-)
|
||||
crypt_set_iterarion_time;
|
||||
|
||||
These calls were removed because are not safe, use per-context
|
||||
error callbacks instead:
|
||||
crypt_last_error;
|
||||
crypt_get_error;
|
||||
|
||||
The PBKDF benchmark was replaced by a new function that uses new KDF structure
|
||||
crypt_benchmark_kdf; (removed)
|
||||
crypt_benchmark_pbkdf; (new API call)
|
||||
|
||||
These new calls are now exported, for details see libcryptsetup.h:
|
||||
crypt_keyslot_add_by_key;
|
||||
crypt_keyslot_set_priority;
|
||||
crypt_keyslot_get_priority;
|
||||
|
||||
crypt_token_json_get;
|
||||
crypt_token_json_set;
|
||||
crypt_token_status;
|
||||
crypt_token_luks2_keyring_get;
|
||||
crypt_token_luks2_keyring_set;
|
||||
crypt_token_assign_keyslot;
|
||||
crypt_token_unassign_keyslot;
|
||||
crypt_token_register;
|
||||
|
||||
crypt_activate_by_token;
|
||||
crypt_activate_by_keyring;
|
||||
crypt_deactivate_by_name;
|
||||
|
||||
crypt_metadata_locking;
|
||||
crypt_volume_key_keyring;
|
||||
crypt_get_integrity_info;
|
||||
crypt_get_sector_size;
|
||||
crypt_persistent_flags_set;
|
||||
crypt_persistent_flags_get;
|
||||
crypt_set_pbkdf_type;
|
||||
crypt_get_pbkdf_type;
|
||||
|
||||
crypt_convert;
|
||||
crypt_keyfile_read;
|
||||
crypt_wipe;
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* There will be better documentation and examples.
|
||||
|
||||
* There will be some more formal definition of the threat model for integrity
|
||||
protection. (And a link to some papers discussing integrity protection,
|
||||
once it is, hopefully, accepted and published.)
|
||||
|
||||
* Offline re-encrypt tool LUKS2 support is currently limited.
|
||||
There will be online LUKS2 re-encryption tool in future.
|
||||
|
||||
* Authenticated encryption will use new algorithms from CAESAR competition
|
||||
(https://competitions.cr.yp.to/caesar.html) once these algorithms are available
|
||||
in kernel (more on this later).
|
||||
NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305)
|
||||
in kernel have too small 96-bit nonces that are problematic with
|
||||
randomly generated IVs (the collision probability is not negligible).
|
||||
For the GCM, nonce collision is a fatal problem.
|
||||
|
||||
* Authenticated encryption do not set encryption for dm-integrity journal.
|
||||
|
||||
While it does not influence data confidentiality or integrity protection,
|
||||
an attacker can get some more information from data journal or cause that
|
||||
system will corrupt sectors after journal replay. (That corruption will be
|
||||
detected though.)
|
||||
|
||||
* Some utilities (blkid, systemd-cryptsetup) have already support for LUKS
|
||||
but not yet in released version (support in crypttab etc).
|
||||
|
||||
* There are some examples of user-defined tokens inside misc/luks2_keyslot_example
|
||||
directory (like a simple external program that uses libssh to unlock LUKS2
|
||||
using remote keyfile).
|
||||
|
||||
* The python binding (pycryptsetup) contains only basic functionality for LUKS1
|
||||
(it is not updated for new features) and will be deprecated soon in favor
|
||||
of python bindings to libblockdev library (that can already handle LUKS1 devices).
|
||||
@@ -1,109 +0,0 @@
|
||||
Cryptsetup 2.0.1 Release Notes
|
||||
==============================
|
||||
Stable and bug-fix release with experimental features.
|
||||
|
||||
This version introduces a new on-disk LUKS2 format.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported
|
||||
forever as well as a traditional and fully backward compatible format.
|
||||
|
||||
Please note that authenticated disk encryption, non-cryptographic
|
||||
data integrity protection (dm-integrity), use of Argon2 Password-Based
|
||||
Key Derivation Function and the LUKS2 on-disk format itself are new
|
||||
features and can contain some bugs.
|
||||
|
||||
To provide all security features of authenticated encryption we need
|
||||
a better nonce-reuse resistant algorithm in the kernel (see note below).
|
||||
For now, please use authenticated encryption as an experimental feature.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or in
|
||||
production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.0
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* To store volume key into kernel keyring, kernel 4.15 with dm-crypt 1.18.1
|
||||
is required. If a volume key is stored in keyring (LUKS2 only),
|
||||
the dm-crypt v1.15.0 through v1.18.0 contains a serious bug that may cause
|
||||
data corruption for ciphers with ESSIV.
|
||||
(The key for ESSIV is zeroed because of code misplacement.)
|
||||
This bug is not present for LUKS1 or any other IVs used in LUKS modes.
|
||||
This change is not visible to the user (except dmsetup output).
|
||||
|
||||
* Increase maximum allowed PBKDF memory-cost limit to 4 GiB.
|
||||
The Argon2 PBKDF uses 1GiB by default; this is also limited by the amount
|
||||
of physical memory available (maximum is half of the physical memory).
|
||||
|
||||
* Use /run/cryptsetup as default for cryptsetup locking dir.
|
||||
There were problems with sharing /run/lock with lockdev, and in the early
|
||||
boot, the directory was missing.
|
||||
The directory can be changed with --with-luks2-lock-path and
|
||||
--with-luks2-lock-dir-perms configure switches.
|
||||
|
||||
* Introduce new 64-bit byte-offset *keyfile_device_offset functions.
|
||||
|
||||
The keyfile interface was designed, well, for keyfiles. Unfortunately,
|
||||
there are user cases where a keyfile can be placed on a device, and
|
||||
size_t offset can overflow on 32-bit systems.
|
||||
|
||||
New set of functions that allow 64-bit offsets even on 32bit systems
|
||||
are now available:
|
||||
|
||||
- crypt_resume_by_keyfile_device_offset
|
||||
- crypt_keyslot_add_by_keyfile_device_offset
|
||||
- crypt_activate_by_keyfile_device_offset
|
||||
- crypt_keyfile_device_read
|
||||
|
||||
The new functions have added the _device_ in name.
|
||||
Old functions are just internal wrappers around these.
|
||||
|
||||
Also cryptsetup --keyfile-offset and --new-keyfile-offset now allows
|
||||
64-bit offsets as parameters.
|
||||
|
||||
* Add error hint for wrongly formatted cipher strings in LUKS1 and
|
||||
properly fail in luksFormat if cipher format is missing required IV.
|
||||
For now, crypto API quietly used cipher without IV if a cipher
|
||||
algorithm without IV specification was used (e.g., aes-xts).
|
||||
This caused fail later during activation.
|
||||
|
||||
* Configure check for a recent Argon2 lib to support mandatory Argon2id.
|
||||
|
||||
* Fix for the cryptsetup-reencrypt static build if pwquality is enabled.
|
||||
|
||||
* Update LUKS1 standard doc (https links in the bibliography).
|
||||
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* There will be better documentation and examples.
|
||||
|
||||
* There will be some more formal definition of the threat model for integrity
|
||||
protection. (And a link to some papers discussing integrity protection,
|
||||
once it is, hopefully, accepted and published.)
|
||||
|
||||
* Offline re-encrypt tool LUKS2 support is currently limited.
|
||||
There will be online LUKS2 re-encryption tool in future.
|
||||
|
||||
* Authenticated encryption will use new algorithms from CAESAR competition
|
||||
(https://competitions.cr.yp.to/caesar.html) once these algorithms are
|
||||
available in the kernel (more on this later).
|
||||
NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305)
|
||||
in the kernel have too small 96-bit nonces that are problematic with
|
||||
randomly generated IVs (the collision probability is not negligible).
|
||||
For the GCM, nonce collision is a fatal problem.
|
||||
|
||||
* Authenticated encryption do not set encryption for a dm-integrity journal.
|
||||
|
||||
While it does not influence data confidentiality or integrity protection,
|
||||
an attacker can get some more information from data journal or cause that
|
||||
system will corrupt sectors after journal replay. (That corruption will be
|
||||
detected though.)
|
||||
|
||||
* There are examples of user-defined tokens inside misc/luks2_keyslot_example
|
||||
directory (like a simple external program that uses libssh to unlock LUKS2
|
||||
using remote keyfile).
|
||||
|
||||
* The python binding (pycryptsetup) contains only basic functionality for LUKS1
|
||||
(it is not updated for new features) and will be deprecated soon in favor
|
||||
of python bindings to the libblockdev library (that can already handle LUKS1
|
||||
devices).
|
||||
@@ -1,93 +0,0 @@
|
||||
Cryptsetup 2.0.2 Release Notes
|
||||
==============================
|
||||
Stable and bug-fix release with experimental features.
|
||||
|
||||
Cryptsetup 2.x version introduces a new on-disk LUKS2 format.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported
|
||||
forever as well as a traditional and fully backward compatible format.
|
||||
|
||||
Please note that authenticated disk encryption, non-cryptographic
|
||||
data integrity protection (dm-integrity), use of Argon2 Password-Based
|
||||
Key Derivation Function and the LUKS2 on-disk format itself are new
|
||||
features and can contain some bugs.
|
||||
|
||||
To provide all security features of authenticated encryption, we need
|
||||
a better nonce-reuse resistant algorithm in the kernel (see note below).
|
||||
For now, please use authenticated encryption as an experimental feature.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or in
|
||||
production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.1
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Fix a regression in early detection of inactive keyslot for luksKillSlot.
|
||||
It tried to ask for passphrase even for already erased keyslot.
|
||||
|
||||
* Fix a regression in loopaesOpen processing for keyfile on standard input.
|
||||
Use of "-" argument was not working properly.
|
||||
|
||||
* Add LUKS2 specific options for cryptsetup-reencrypt.
|
||||
Tokens and persistent flags are now transferred during reencryption;
|
||||
change of PBKDF keyslot parameters is now supported and allows one
|
||||
to set precalculated values (no benchmarks).
|
||||
|
||||
* Do not allow LUKS2 --persistent and --test-passphrase cryptsetup flags
|
||||
combination. Persistent flags are now stored only if the device was
|
||||
successfully activated with the specified flags.
|
||||
|
||||
* Fix integritysetup format after recent Linux kernel changes that
|
||||
requires to setup key for HMAC in all cases.
|
||||
Previously integritysetup allowed HMAC with zero key that behaves
|
||||
like a plain hash.
|
||||
|
||||
* Fix VeraCrypt PIM handling that modified internal iteration counts
|
||||
even for subsequent activations. The PIM count is no longer printed
|
||||
in debug log as it is sensitive information.
|
||||
Also, the code now skips legacy TrueCrypt algorithms if a PIM
|
||||
is specified (they cannot be used with PIM anyway).
|
||||
|
||||
* PBKDF values cannot be set (even with force parameters) below
|
||||
hardcoded minimums. For PBKDF2 is it 1000 iterations, for Argon2
|
||||
it is 4 iterations and 32 KiB of memory cost.
|
||||
|
||||
* Introduce new crypt_token_is_assigned() API function for reporting
|
||||
the binding between token and keyslots.
|
||||
|
||||
* Allow crypt_token_json_set() API function to create internal token types.
|
||||
Do not allow unknown fields in internal token objects.
|
||||
|
||||
* Print message in cryptsetup that about was aborted if a user did not
|
||||
answer YES in a query.
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* There will be better documentation and examples.
|
||||
|
||||
* There will be some more formal definition of the threat model for integrity
|
||||
protection. (And a link to some papers discussing integrity protection,
|
||||
once it is, hopefully, accepted and published.)
|
||||
|
||||
* Authenticated encryption will use new algorithms from CAESAR competition
|
||||
https://competitions.cr.yp.to/caesar-submissions.html.
|
||||
We plan to use AEGIS and MORUS, as CAESAR finalists.
|
||||
|
||||
NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305)
|
||||
in the kernel have too small 96-bit nonces that are problematic with
|
||||
randomly generated IVs (the collision probability is not negligible).
|
||||
|
||||
* Authenticated encryption do not set encryption for a dm-integrity journal.
|
||||
|
||||
While it does not influence data confidentiality or integrity protection,
|
||||
an attacker can get some more information from data journal or cause that
|
||||
system will corrupt sectors after journal replay. (That corruption will be
|
||||
detected though.)
|
||||
|
||||
* There are examples of user-defined tokens inside misc/luks2_keyslot_example
|
||||
directory (like a simple external program that uses libssh to unlock LUKS2
|
||||
using remote keyfile).
|
||||
|
||||
* The python binding (pycryptsetup) contains only basic functionality for LUKS1
|
||||
(it is not updated for new features) and will be deprecated in version 2.1
|
||||
in favor of python bindings to the libblockdev library.
|
||||
@@ -1,121 +0,0 @@
|
||||
Cryptsetup 2.0.3 Release Notes
|
||||
==============================
|
||||
Stable bug-fix release with new features.
|
||||
|
||||
Cryptsetup 2.x version introduces a new on-disk LUKS2 format.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported
|
||||
forever as well as a traditional and fully backward compatible format.
|
||||
|
||||
Please note that authenticated disk encryption, non-cryptographic
|
||||
data integrity protection (dm-integrity), use of Argon2 Password-Based
|
||||
Key Derivation Function and the LUKS2 on-disk format itself are new
|
||||
features and can contain some bugs.
|
||||
|
||||
To provide all security features of authenticated encryption, we need
|
||||
a better nonce-reuse resistant algorithm in the kernel (see note below).
|
||||
For now, please use authenticated encryption as an experimental feature.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or in
|
||||
production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.2
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Expose interface to unbound LUKS2 keyslots.
|
||||
Unbound LUKS2 keyslot allows storing a key material that is independent
|
||||
of master volume key (it is not bound to encrypted data segment).
|
||||
|
||||
* New API extensions for unbound keyslots (LUKS2 only)
|
||||
crypt_keyslot_get_key_size() and crypt_volume_key_get()
|
||||
These functions allow one to get key and key size for unbound keyslots.
|
||||
|
||||
* New enum value CRYPT_SLOT_UNBOUND for keyslot status (LUKS2 only).
|
||||
|
||||
* Add --unbound keyslot option to the cryptsetup luksAddKey command.
|
||||
|
||||
* Add crypt_get_active_integrity_failures() call to get integrity
|
||||
failure count for dm-integrity devices.
|
||||
|
||||
* Add crypt_get_pbkdf_default() function to get per-type PBKDF default
|
||||
setting.
|
||||
|
||||
* Add new flag to crypt_keyslot_add_by_key() to force update device
|
||||
volume key. This call is mainly intended for a wrapped key change.
|
||||
|
||||
* Allow volume key store in a file with cryptsetup.
|
||||
The --dump-master-key together with --master-key-file allows cryptsetup
|
||||
to store the binary volume key to a file instead of standard output.
|
||||
|
||||
* Add support detached header for cryptsetup-reencrypt command.
|
||||
|
||||
* Fix VeraCrypt PIM handling - use proper iterations count formula
|
||||
for PBKDF2-SHA512 and PBKDF2-Whirlpool used in system volumes.
|
||||
|
||||
* Fix cryptsetup tcryptDump for VeraCrypt PIM (support --veracrypt-pim).
|
||||
|
||||
* Add --with-default-luks-format configure time option.
|
||||
(Option to override default LUKS format version.)
|
||||
|
||||
* Fix LUKS version conversion for detached (and trimmed) LUKS headers.
|
||||
|
||||
* Add luksConvertKey cryptsetup command that converts specific keyslot
|
||||
from one PBKDF to another.
|
||||
|
||||
* Do not allow conversion to LUKS2 if LUKSMETA (external tool metadata)
|
||||
header is detected.
|
||||
|
||||
* More cleanup and hardening of LUKS2 keyslot specific validation options.
|
||||
Add more checks for cipher validity before writing metadata on-disk.
|
||||
|
||||
* Do not allow LUKS1 version downconversion if the header contains tokens.
|
||||
|
||||
* Add "paes" family ciphers (AES wrapped key scheme for mainframes)
|
||||
to allowed ciphers.
|
||||
Specific wrapped ley configuration logic must be done by 3rd party tool,
|
||||
LUKS2 stores only keyslot material and allow activation of the device.
|
||||
|
||||
* Add support for --check-at-most-once option (kernel 4.17) to veritysetup.
|
||||
This flag can be dangerous; if you can control underlying device
|
||||
(you can change its content after it was verified) it will no longer
|
||||
prevent reading tampered data and also it does not prevent silent
|
||||
data corruptions that appear after the block was once read.
|
||||
|
||||
* Fix return code (EPERM instead of EINVAL) and retry count for bad
|
||||
passphrase on non-tty input.
|
||||
|
||||
* Enable support for FEC decoding in veritysetup to check dm-verity devices
|
||||
with additional Reed-Solomon code in userspace (verify command).
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* There will be better documentation and examples (planned for 2.0.4).
|
||||
|
||||
* There will be some more formal definition of the threat model for integrity
|
||||
protection. (And a link to some papers discussing integrity protection,
|
||||
once it is, hopefully, accepted and published.)
|
||||
|
||||
* Authenticated encryption will use new algorithms from CAESAR competition
|
||||
https://competitions.cr.yp.to/caesar-submissions.html.
|
||||
We plan to use AEGIS and MORUS, as CAESAR finalists.
|
||||
|
||||
NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305)
|
||||
in the kernel have too small 96-bit nonces that are problematic with
|
||||
randomly generated IVs (the collision probability is not negligible).
|
||||
|
||||
* Authenticated encryption do not set encryption for a dm-integrity journal.
|
||||
|
||||
While it does not influence data confidentiality or integrity protection,
|
||||
an attacker can get some more information from data journal or cause that
|
||||
system will corrupt sectors after journal replay. (That corruption will be
|
||||
detected though.)
|
||||
|
||||
* There are examples of user-defined tokens inside misc/luks2_keyslot_example
|
||||
directory (like a simple external program that uses libssh to unlock LUKS2
|
||||
using remote keyfile).
|
||||
|
||||
* The python binding (pycryptsetup) contains only basic functionality for LUKS1
|
||||
(it is not updated for new features) and will be REMOVED in version 2.1
|
||||
in favor of python bindings to the libblockdev library.
|
||||
See https://github.com/storaged-project/libblockdev/releases/tag/2.17-1 that
|
||||
already supports LUKS2 and VeraCrypt devices handling through libcryptsetup.
|
||||
@@ -1,119 +0,0 @@
|
||||
Cryptsetup 2.0.4 Release Notes
|
||||
==============================
|
||||
Stable bug-fix release with new features.
|
||||
|
||||
Cryptsetup 2.x version introduces a new on-disk LUKS2 format.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported
|
||||
forever as well as a traditional and fully backward compatible format.
|
||||
|
||||
Please note that authenticated disk encryption, non-cryptographic
|
||||
data integrity protection (dm-integrity), use of Argon2 Password-Based
|
||||
Key Derivation Function and the LUKS2 on-disk format itself are new
|
||||
features and can contain some bugs.
|
||||
|
||||
To provide all security features of authenticated encryption, we need
|
||||
a better nonce-reuse resistant algorithm in the kernel (see note below).
|
||||
For now, please use authenticated encryption as an experimental feature.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or in
|
||||
production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.3
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Use the libblkid (blockid) library to detect foreign signatures
|
||||
on a device before LUKS format and LUKS2 auto-recovery.
|
||||
|
||||
This change fixes an unexpected recovery using the secondary
|
||||
LUKS2 header after a device was already overwritten with
|
||||
another format (filesystem or LVM physical volume).
|
||||
|
||||
LUKS2 will not recreate a primary header if it detects a valid
|
||||
foreign signature. In this situation, a user must always
|
||||
use cryptsetup repair command for the recovery.
|
||||
|
||||
Note that libcryptsetup and utilities are now linked to libblkid
|
||||
as a new dependence.
|
||||
|
||||
To compile code without blockid support (strongly discouraged),
|
||||
use --disable-blkid configure switch.
|
||||
|
||||
* Add prompt for format and repair actions in cryptsetup and
|
||||
integritysetup if foreign signatures are detected on the device
|
||||
through the blockid library.
|
||||
|
||||
After the confirmation, all known signatures are then wiped as
|
||||
part of the format or repair procedure.
|
||||
|
||||
* Print consistent verbose message about keyslot and token numbers.
|
||||
For keyslot actions: Key slot <number> unlocked/created/removed.
|
||||
For token actions: Token <number> created/removed.
|
||||
|
||||
* Print error, if a non-existent token is tried to be removed.
|
||||
|
||||
* Add support for LUKS2 token definition export and import.
|
||||
|
||||
The token command now can export/import customized token JSON file
|
||||
directly from command line. See the man page for more details.
|
||||
|
||||
* Add support for new dm-integrity superblock version 2.
|
||||
|
||||
* Add an error message when nothing was read from a key file.
|
||||
|
||||
* Update cryptsetup man pages, including --type option usage.
|
||||
|
||||
* Add a snapshot of LUKS2 format specification to documentation
|
||||
and accordingly fix supported secondary header offsets.
|
||||
|
||||
* Add bundled optimized Argon2 SSE (X86_64 platform) code.
|
||||
|
||||
If the bundled Argon2 code is used and the new configure switch
|
||||
--enable-internal-sse-argon2 option is present, and compiler flags
|
||||
support required optimization, the code will try to use optimized
|
||||
and faster variant.
|
||||
|
||||
Always use the shared library (--enable-libargon2) if possible.
|
||||
|
||||
This option was added because an enterprise distribution
|
||||
rejected to support the shared Argon2 library and native support
|
||||
in generic cryptographic libraries is not ready yet.
|
||||
|
||||
* Fix compilation with crypto backend for LibreSSL >= 2.7.0.
|
||||
LibreSSL introduced OpenSSL 1.1.x API functions, so compatibility
|
||||
wrapper must be commented out.
|
||||
|
||||
* Fix on-disk header size calculation for LUKS2 format if a specific
|
||||
data alignment is requested. Until now, the code used default size
|
||||
that could be wrong for converted devices.
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* Authenticated encryption will use new algorithms from CAESAR competition
|
||||
https://competitions.cr.yp.to/caesar-submissions.html.
|
||||
We plan to use AEGIS and MORUS (in kernel 4.18), as CAESAR finalists.
|
||||
|
||||
NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305)
|
||||
in the kernel have too small 96-bit nonces that are problematic with
|
||||
randomly generated IVs (the collision probability is not negligible).
|
||||
|
||||
For more info about LUKS2 authenticated encryption, please see our paper
|
||||
https://arxiv.org/abs/1807.00309
|
||||
|
||||
* Authenticated encryption do not set encryption for a dm-integrity journal.
|
||||
|
||||
While it does not influence data confidentiality or integrity protection,
|
||||
an attacker can get some more information from data journal or cause that
|
||||
system will corrupt sectors after journal replay. (That corruption will be
|
||||
detected though.)
|
||||
|
||||
* There are examples of user-defined tokens inside misc/luks2_keyslot_example
|
||||
directory (like a simple external program that uses libssh to unlock LUKS2
|
||||
using remote keyfile).
|
||||
|
||||
* The python binding (pycryptsetup) contains only basic functionality for LUKS1
|
||||
(it is not updated for new features) and will be REMOVED in version 2.1
|
||||
in favor of python bindings to the libblockdev library.
|
||||
See https://github.com/storaged-project/libblockdev/releases that
|
||||
already supports LUKS2 and VeraCrypt devices handling through libcryptsetup.
|
||||
|
||||
@@ -1,102 +0,0 @@
|
||||
Cryptsetup 2.0.5 Release Notes
|
||||
==============================
|
||||
Stable bug-fix release with new features.
|
||||
|
||||
Cryptsetup 2.x version introduces a new on-disk LUKS2 format.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported
|
||||
forever as well as a traditional and fully backward compatible format.
|
||||
|
||||
Please note that authenticated disk encryption, non-cryptographic
|
||||
data integrity protection (dm-integrity), use of Argon2 Password-Based
|
||||
Key Derivation Function and the LUKS2 on-disk format itself are new
|
||||
features and can contain some bugs.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or in
|
||||
production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.4
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Wipe full header areas (including unused) during LUKS format.
|
||||
|
||||
Since this version, the whole area up to the data offset is zeroed,
|
||||
and subsequently, all keyslots areas are wiped with random data.
|
||||
This ensures that no remaining old data remains in the LUKS header
|
||||
areas, but it could slow down format operation on some devices.
|
||||
Previously only first 4k (or 32k for LUKS2) and the used keyslot
|
||||
was overwritten in the format operation.
|
||||
|
||||
* Several fixes to error messages that were unintentionally replaced
|
||||
in previous versions with a silent exit code.
|
||||
More descriptive error messages were added, including error
|
||||
messages if
|
||||
- a device is unusable (not a block device, no access, etc.),
|
||||
- a LUKS device is not detected,
|
||||
- LUKS header load code detects unsupported version,
|
||||
- a keyslot decryption fails (also happens in the cipher check),
|
||||
- converting an inactive keyslot.
|
||||
|
||||
* Device activation fails if data area overlaps with LUKS header.
|
||||
|
||||
* Code now uses explicit_bzero to wipe memory if available
|
||||
(instead of own implementation).
|
||||
|
||||
* Additional VeraCrypt modes are now supported, including Camellia
|
||||
and Kuznyechik symmetric ciphers (and cipher chains) and Streebog
|
||||
hash function. These were introduced in a recent VeraCrypt upstream.
|
||||
|
||||
Note that Kuznyechik requires out-of-tree kernel module and
|
||||
Streebog hash function is available only with the gcrypt cryptographic
|
||||
backend for now.
|
||||
|
||||
* Fixes static build for integritysetup if the pwquality library is used.
|
||||
|
||||
* Allows passphrase change for unbound keyslots.
|
||||
|
||||
* Fixes removed keyslot number in verbose message for luksKillSlot,
|
||||
luksRemoveKey and erase command.
|
||||
|
||||
* Adds blkid scan when attempting to open a plain device and warn the user
|
||||
about existing device signatures in a ciphertext device.
|
||||
|
||||
* Remove LUKS header signature if luksFormat fails to add the first keyslot.
|
||||
|
||||
* Remove O_SYNC from device open and use fsync() to speed up
|
||||
wipe operation considerably.
|
||||
|
||||
* Create --master-key-file in luksDump and fail if the file already exists.
|
||||
|
||||
* Fixes a bug when LUKS2 authenticated encryption with a detached header
|
||||
wiped the header device instead of dm-integrity data device area (causing
|
||||
unnecessary LUKS2 header auto recovery).
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* Authenticated encryption should use new algorithms from CAESAR competition
|
||||
https://competitions.cr.yp.to/caesar-submissions.html.
|
||||
AEGIS and MORUS are already available in kernel 4.18.
|
||||
|
||||
For more info about LUKS2 authenticated encryption, please see our paper
|
||||
https://arxiv.org/abs/1807.00309
|
||||
|
||||
Please note that authenticated encryption is still an experimental feature
|
||||
and can have performance problems for hish-speed devices and device
|
||||
with larger IO blocks (like RAID).
|
||||
|
||||
* Authenticated encryption do not set encryption for a dm-integrity journal.
|
||||
|
||||
While it does not influence data confidentiality or integrity protection,
|
||||
an attacker can get some more information from data journal or cause that
|
||||
system will corrupt sectors after journal replay. (That corruption will be
|
||||
detected though.)
|
||||
|
||||
* There are examples of user-defined tokens inside misc/luks2_keyslot_example
|
||||
directory (like a simple external program that uses libssh to unlock LUKS2
|
||||
using remote keyfile).
|
||||
|
||||
* The python binding (pycryptsetup) contains only basic functionality for LUKS1
|
||||
(it is not updated for new features) and will be REMOVED in version 2.1
|
||||
in favor of python bindings to the libblockdev library.
|
||||
See https://github.com/storaged-project/libblockdev/releases that
|
||||
already supports LUKS2 and VeraCrypt devices handling through libcryptsetup.
|
||||
@@ -1,97 +0,0 @@
|
||||
Cryptsetup 2.0.6 Release Notes
|
||||
==============================
|
||||
Stable bug-fix release.
|
||||
All users of cryptsetup 2.0.x should upgrade to this version.
|
||||
|
||||
Cryptsetup 2.x version introduces a new on-disk LUKS2 format.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported
|
||||
forever as well as a traditional and fully backward compatible format.
|
||||
|
||||
Please note that authenticated disk encryption, non-cryptographic
|
||||
data integrity protection (dm-integrity), use of Argon2 Password-Based
|
||||
Key Derivation Function and the LUKS2 on-disk format itself are new
|
||||
features and can contain some bugs.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or in
|
||||
production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.5
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Fix support of larger metadata areas in LUKS2 header.
|
||||
|
||||
This release properly supports all specified metadata areas, as documented
|
||||
in LUKS2 format description (see docs/on-disk-format-luks2.pdf in archive).
|
||||
|
||||
Currently, only default metadata area size is used (in format or convert).
|
||||
Later cryptsetup versions will allow increasing this metadata area size.
|
||||
|
||||
* If AEAD (authenticated encryption) is used, cryptsetup now tries to check
|
||||
if the requested AEAD algorithm with specified key size is available
|
||||
in kernel crypto API.
|
||||
This change avoids formatting a device that cannot be later activated.
|
||||
|
||||
For this function, the kernel must be compiled with the
|
||||
CONFIG_CRYPTO_USER_API_AEAD option enabled.
|
||||
Note that kernel user crypto API options (CONFIG_CRYPTO_USER_API and
|
||||
CONFIG_CRYPTO_USER_API_SKCIPHER) are already mandatory for LUKS2.
|
||||
|
||||
* Fix setting of integrity no-journal flag.
|
||||
Now you can store this flag to metadata using --persistent option.
|
||||
|
||||
* Fix cryptsetup-reencrypt to not keep temporary reencryption headers
|
||||
if interrupted during initial password prompt.
|
||||
|
||||
* Adds early check to plain and LUKS2 formats to disallow device format
|
||||
if device size is not aligned to requested sector size.
|
||||
Previously it was possible, and the device was rejected to activate by
|
||||
kernel later.
|
||||
|
||||
* Fix checking of hash algorithms availability for PBKDF early.
|
||||
Previously LUKS2 format allowed non-existent hash algorithm with
|
||||
invalid keyslot preventing the device from activation.
|
||||
|
||||
* Allow Adiantum cipher construction (a non-authenticated length-preserving
|
||||
fast encryption scheme), so it can be used both for data encryption and
|
||||
keyslot encryption in LUKS1/2 devices.
|
||||
|
||||
For benchmark, use:
|
||||
# cryptsetup benchmark -c xchacha12,aes-adiantum
|
||||
# cryptsetup benchmark -c xchacha20,aes-adiantum
|
||||
|
||||
For LUKS format:
|
||||
# cryptsetup luksFormat -c xchacha20,aes-adiantum-plain64 -s 256 <device>
|
||||
|
||||
The support for Adiantum will be merged in Linux kernel 4.21.
|
||||
For more info see the paper https://eprint.iacr.org/2018/720.
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* Authenticated encryption should use new algorithms from CAESAR competition
|
||||
https://competitions.cr.yp.to/caesar-submissions.html.
|
||||
AEGIS and MORUS are already available in kernel 4.18.
|
||||
|
||||
For more info about LUKS2 authenticated encryption, please see our paper
|
||||
https://arxiv.org/abs/1807.00309
|
||||
|
||||
Please note that authenticated encryption is still an experimental feature
|
||||
and can have performance problems for high-speed devices and device
|
||||
with larger IO blocks (like RAID).
|
||||
|
||||
* Authenticated encryption do not set encryption for a dm-integrity journal.
|
||||
|
||||
While it does not influence data confidentiality or integrity protection,
|
||||
an attacker can get some more information from data journal or cause that
|
||||
system will corrupt sectors after journal replay. (That corruption will be
|
||||
detected though.)
|
||||
|
||||
* There are examples of user-defined tokens inside misc/luks2_keyslot_example
|
||||
directory (like a simple external program that uses libssh to unlock LUKS2
|
||||
using remote keyfile).
|
||||
|
||||
* The python binding (pycryptsetup) contains only basic functionality for LUKS1
|
||||
(it is not updated for new features) and will be REMOVED in version 2.1
|
||||
in favor of python bindings to the libblockdev library.
|
||||
See https://github.com/storaged-project/libblockdev/releases that
|
||||
already supports LUKS2 and VeraCrypt devices handling through libcryptsetup.
|
||||
@@ -1,210 +0,0 @@
|
||||
Cryptsetup 2.1.0 Release Notes
|
||||
==============================
|
||||
Stable release with new features and bug fixes.
|
||||
|
||||
Cryptsetup 2.1 version uses a new on-disk LUKS2 format as the default
|
||||
LUKS format and increases default LUKS2 header size.
|
||||
|
||||
The legacy LUKS (referenced as LUKS1) will be fully supported forever
|
||||
as well as a traditional and fully backward compatible format.
|
||||
|
||||
When upgrading a stable distribution, please use configure option
|
||||
--with-default-luks-format=LUKS1 to maintain backward compatibility.
|
||||
|
||||
This release also switches to OpenSSL as a default cryptographic
|
||||
backend for LUKS header processing. Use --with-crypto_backend=gcrypt
|
||||
configure option if you need to preserve legacy libgcrypt backend.
|
||||
|
||||
Please do not use LUKS2 without properly configured backup or
|
||||
in production systems that need to be compatible with older systems.
|
||||
|
||||
Changes since version 2.0.6
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* The default for cryptsetup LUKS format action is now LUKS2.
|
||||
You can use LUKS1 with cryptsetup option --type luks1.
|
||||
|
||||
* The default size of the LUKS2 header is increased to 16 MB.
|
||||
It includes metadata and the area used for binary keyslots;
|
||||
it means that LUKS header backup is now 16MB in size.
|
||||
|
||||
Note, that used keyslot area is much smaller, but this increase
|
||||
of reserved space allows implementation of later extensions
|
||||
(like online reencryption).
|
||||
It is fully compatible with older cryptsetup 2.0.x versions.
|
||||
If you require to create LUKS2 header with the same size as
|
||||
in the 2.0.x version, use --offset 8192 option for luksFormat
|
||||
(units are in 512-bytes sectors; see notes below).
|
||||
|
||||
* Cryptsetup now doubles LUKS default key size if XTS mode is used
|
||||
(XTS mode uses two internal keys). This does not apply if key size
|
||||
is explicitly specified on the command line and it does not apply
|
||||
for the plain mode.
|
||||
This fixes a confusion with AES and 256bit key in XTS mode where
|
||||
code used AES128 and not AES256 as often expected.
|
||||
|
||||
Also, the default keyslot encryption algorithm (if cannot be derived
|
||||
from data encryption algorithm) is now available as configure
|
||||
options --with-luks2-keyslot-cipher and --with-luks2-keyslot-keybits.
|
||||
The default is aes-xts-plain64 with 2 * 256-bits key.
|
||||
|
||||
* Default cryptographic backend used for LUKS header processing is now
|
||||
OpenSSL. For years, OpenSSL provided better performance for PBKDF.
|
||||
|
||||
NOTE: Cryptsetup/libcryptsetup supports several cryptographic
|
||||
library backends. The fully supported are libgcrypt, OpenSSL and
|
||||
kernel crypto API. FIPS mode extensions are maintained only for
|
||||
libgcrypt and OpenSSL. Nettle and NSS are usable only for some
|
||||
subset of algorithms and cannot provide full backward compatibility.
|
||||
You can always switch to other backends by using a configure switch,
|
||||
for libgcrypt (compatibility for older distributions) use:
|
||||
--with-crypto_backend=gcrypt
|
||||
|
||||
* The Python bindings are no longer supported and the code was removed
|
||||
from cryptsetup distribution. Please use the libblockdev project
|
||||
that already covers most of the libcryptsetup functionality
|
||||
including LUKS2.
|
||||
|
||||
* Cryptsetup now allows using --offset option also for luksFormat.
|
||||
It means that the specified offset value is used for data offset.
|
||||
LUKS2 header areas are automatically adjusted according to this value.
|
||||
(Note units are in 512-byte sectors due to the previous definition
|
||||
of this option in plain mode.)
|
||||
This option can replace --align-payload with absolute alignment value.
|
||||
|
||||
* Cryptsetup now supports new refresh action (that is the alias for
|
||||
"open --refresh").
|
||||
It allows changes of parameters for an active device (like root
|
||||
device mapping), for example, it can enable or disable TRIM support
|
||||
on-the-fly.
|
||||
It is supported for LUKS1, LUKS2, plain and loop-AES devices.
|
||||
|
||||
* Integritysetup now supports mode with detached data device through
|
||||
new --data-device option.
|
||||
Since kernel 4.18 there is a possibility to specify external data
|
||||
device for dm-integrity that stores all integrity tags.
|
||||
|
||||
* Integritysetup now supports automatic integrity recalculation
|
||||
through new --integrity-recalculate option.
|
||||
Linux kernel since version 4.18 supports automatic background
|
||||
recalculation of integrity tags for dm-integrity.
|
||||
|
||||
Other changes and fixes
|
||||
~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Fix for crypt_wipe call to allocate space if the header is backed
|
||||
by a file. This means that if you use detached header file, it will
|
||||
now have always the full size after luksFormat, even if only
|
||||
a few keyslots are used.
|
||||
|
||||
* Fixes to offline cryptsetup-reencrypt to preserve LUKS2 keyslots
|
||||
area sizes after reencryption and fixes for some other issues when
|
||||
creating temporary reencryption headers.
|
||||
|
||||
* Added some FIPS mode workarounds. We cannot (yet) use Argon2 in
|
||||
FIPS mode, libcryptsetup now fallbacks to use PBKDF2 in FIPS mode.
|
||||
|
||||
* Rejects conversion to LUKS1 if PBKDF2 hash algorithms
|
||||
in keyslots differ.
|
||||
|
||||
* The hash setting on command line now applies also to LUKS2 PBKDF2
|
||||
digest. In previous versions, the LUKS2 key digest used PBKDF2-SHA256
|
||||
(except for converted headers).
|
||||
|
||||
* Allow LUKS2 keyslots area to increase if data offset allows it.
|
||||
Cryptsetup can fine-tune LUKS2 metadata area sizes through
|
||||
--luks2-metadata-size=BYTES and --luks2-keyslots-size=BYTES.
|
||||
Please DO NOT use these low-level options until you need it for
|
||||
some very specific additional feature.
|
||||
Also, the code now prints these LUKS2 header area sizes in dump
|
||||
command.
|
||||
|
||||
* For LUKS2, keyslot can use different encryption that data with
|
||||
new options --keyslot-key-size=BITS and --keyslot-cipher=STRING
|
||||
in all commands that create new LUKS keyslot.
|
||||
Please DO NOT use these low-level options until you need it for
|
||||
some very specific additional feature.
|
||||
|
||||
* Code now avoids data flush when reading device status through
|
||||
device-mapper.
|
||||
|
||||
* The Nettle crypto backend and the userspace kernel crypto API
|
||||
backend were enhanced to allow more available hash functions
|
||||
(like SHA3 variants).
|
||||
|
||||
* Upstream code now does not require libgcrypt-devel
|
||||
for autoconfigure, because OpenSSL is the default.
|
||||
The libgcrypt does not use standard pkgconfig detection and
|
||||
requires specific macro (part of libgcrypt development files)
|
||||
to be always present during autoconfigure.
|
||||
With other crypto backends, like OpenSSL, this makes no sense,
|
||||
so this part of autoconfigure is now optional.
|
||||
|
||||
* Cryptsetup now understands new --debug-json option that allows
|
||||
an additional dump of some JSON information. These are no longer
|
||||
present in standard debug output because it could contain some
|
||||
specific LUKS header parameters.
|
||||
|
||||
* The luksDump contains the hash algorithm used in Anti-Forensic
|
||||
function.
|
||||
|
||||
* All debug messages are now sent through configured log callback
|
||||
functions, so an application can easily use own debug messages
|
||||
handling. In previous versions debug messages were printed directly
|
||||
to standard output.)
|
||||
|
||||
Libcryptsetup API additions
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
These new calls are now exported, for details see libcryptsetup.h:
|
||||
|
||||
* crypt_init_data_device
|
||||
* crypt_get_metadata_device_name
|
||||
functions to init devices with separate metadata and data device
|
||||
before a format function is called.
|
||||
|
||||
* crypt_set_data_offset
|
||||
sets the data offset for LUKS to the specified value
|
||||
in 512-byte sectors.
|
||||
It should replace alignment calculation in LUKS param structures.
|
||||
|
||||
* crypt_get_metadata_size
|
||||
* crypt_set_metadata_size
|
||||
allows one to set/get area sizes in LUKS header
|
||||
(according to specification).
|
||||
|
||||
* crypt_get_default_type
|
||||
get default compiled-in LUKS type (version).
|
||||
|
||||
* crypt_get_pbkdf_type_params
|
||||
allows one to get compiled-in PBKDF parameters.
|
||||
|
||||
* crypt_keyslot_set_encryption
|
||||
* crypt_keyslot_get_encryption
|
||||
allows one to set/get per-keyslot encryption algorithm for LUKS2.
|
||||
|
||||
* crypt_keyslot_get_pbkdf
|
||||
allows one to get PBKDF parameters per-keyslot.
|
||||
|
||||
and these new defines:
|
||||
* CRYPT_LOG_DEBUG_JSON (message type for JSON debug)
|
||||
* CRYPT_DEBUG_JSON (log level for JSON debug)
|
||||
* CRYPT_ACTIVATE_RECALCULATE (dm-integrity recalculate flag)
|
||||
* CRYPT_ACTIVATE_REFRESH (new open with refresh flag)
|
||||
|
||||
All existing API calls should remain backward compatible.
|
||||
|
||||
Unfinished things & TODO for next releases
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* Optional authenticated encryption is still an experimental feature
|
||||
and can have performance problems for high-speed devices and device
|
||||
with larger IO blocks (like RAID).
|
||||
|
||||
* Authenticated encryption does not use encryption for a dm-integrity
|
||||
journal. While it does not influence data confidentiality or
|
||||
integrity protection, an attacker can get some more information
|
||||
from data journal or cause that system will corrupt sectors after
|
||||
journal replay. (That corruption will be detected though.)
|
||||
|
||||
* The LUKS2 metadata area increase is mainly needed for the new online
|
||||
reencryption as the major feature for the next release.
|
||||
@@ -1,279 +0,0 @@
|
||||
Cryptsetup 2.2.0 Release Notes
|
||||
==============================
|
||||
Stable release with new experimental features and bug fixes.
|
||||
|
||||
Cryptsetup 2.2 version introduces a new LUKS2 online reencryption
|
||||
extension that allows reencryption of mounted LUKS2 devices
|
||||
(device in use) in the background.
|
||||
|
||||
Online reencryption is a complex feature. Please be sure you
|
||||
have a full data backup before using this feature.
|
||||
|
||||
Changes since version 2.1.0
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
LUKS2 online reencryption
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The reencryption is intended to provide a reliable way to change
|
||||
volume key or an algorithm change while the encrypted device is still
|
||||
in use.
|
||||
|
||||
It is based on userspace-only approach (no kernel changes needed)
|
||||
that uses the device-mapper subsystem to remap active devices on-the-fly
|
||||
dynamically. The device is split into several segments (encrypted by old
|
||||
key, new key and so-called hotzone, where reencryption is actively running).
|
||||
|
||||
The flexible LUKS2 metadata format is used to store intermediate states
|
||||
(segment mappings) and both version of keyslots (old and new keys).
|
||||
Also, it provides a binary area (in the unused keyslot area space)
|
||||
to provide recovery metadata in the case of unexpected failure during
|
||||
reencryption. LUKS2 header is during the reencryption marked with
|
||||
"online-reencryption" keyword. After the reencryption is finished,
|
||||
this keyword is removed, and the device is backward compatible with all
|
||||
older cryptsetup tools (that support LUKS2).
|
||||
|
||||
The recovery supports three resilience modes:
|
||||
|
||||
- checksum: default mode, where individual checksums of ciphertext hotzone
|
||||
sectors are stored, so the recovery process can detect which sectors were
|
||||
already reencrypted. It requires that the device sector write is atomic.
|
||||
|
||||
- journal: the hotzone is journaled in the binary area
|
||||
(so the data are written twice)
|
||||
|
||||
- none: performance mode; there is no protection
|
||||
(similar to old offline reencryption)
|
||||
|
||||
These resilience modes are not available if reencryption uses data shift.
|
||||
|
||||
Note: until we have full documentation (both of the process and metadata),
|
||||
please refer to Ondrej's slides (some slight details are no longer relevant)
|
||||
https://okozina.fedorapeople.org/online-disk-reencryption-with-luks2-compact.pdf
|
||||
|
||||
The offline reencryption tool (cryptsetup-reencrypt) is still supported
|
||||
for both LUKS1 and LUKS2 format.
|
||||
|
||||
Cryptsetup examples for reencryption
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The reencryption feature is integrated directly into cryptsetup utility
|
||||
as the new "reencrypt" action (command).
|
||||
|
||||
There are three basic modes - to perform reencryption (change of already
|
||||
existing LUKS2 device), to add encryption to plaintext device and to remove
|
||||
encryption from a device (decryption).
|
||||
|
||||
In all cases, if existing LUKS2 metadata contains information about
|
||||
the ongoing reencryption process, following reencrypt command continues
|
||||
with the ongoing reencryption process until it is finished.
|
||||
|
||||
You can activate a device with ongoing reencryption as the standard LUKS2
|
||||
device, but the reencryption process will not continue until the cryptsetup
|
||||
reencrypt command is issued.
|
||||
|
||||
|
||||
1) Reencryption
|
||||
~~~~~~~~~~~~~~~
|
||||
This mode is intended to change any attribute of the data encryption
|
||||
(change of the volume key, algorithm or sector size).
|
||||
Note that authenticated encryption is not yet supported.
|
||||
|
||||
You can start the reencryption process by specifying a LUKS2 device or with
|
||||
a detached LUKS2 header.
|
||||
The code should automatically recognize if the device is in use (and if it
|
||||
should use online mode of reencryption).
|
||||
|
||||
If you do not specify parameters, only volume key is changed
|
||||
(a new random key is generated).
|
||||
|
||||
# cryptsetup reencrypt <device> [--header <hdr>]
|
||||
|
||||
You can also start reencryption using active mapped device name:
|
||||
# cryptsetup reencrypt --active-name <name>
|
||||
|
||||
You can also specify the resilience mode (none, checksum, journal) with
|
||||
--resilience=<mode> option, for checksum mode also the hash algorithm with
|
||||
--resilience-hash=<alg> (only hash algorithms supported by cryptographic
|
||||
backend are available).
|
||||
|
||||
The maximal size of reencryption hotzone can be limited by
|
||||
--hotzone-size=<size> option and applies to all reencryption modes.
|
||||
Note that for checksum and journal mode hotzone size is also limited
|
||||
by available space in binary keyslot area.
|
||||
|
||||
2) Encryption
|
||||
~~~~~~~~~~~~~
|
||||
This mode provides a way to encrypt a plaintext device to LUKS2 format.
|
||||
This option requires reduction of device size (for LUKS2 header) or new
|
||||
detached header.
|
||||
|
||||
# cryptsetup reencrypt <device> --encrypt --reduce-device-size <size>
|
||||
|
||||
Or with detached header:
|
||||
# cryptsetup reencrypt <device> --encrypt --header <hdr>
|
||||
|
||||
3) Decryption
|
||||
~~~~~~~~~~~~~
|
||||
This mode provides the removal of existing LUKS2 encryption and replacing
|
||||
a device with plaintext content only.
|
||||
For now, we support only decryption with a detached header.
|
||||
|
||||
# cryptsetup reencrypt <device> --decrypt --header <hdr>
|
||||
|
||||
For all three modes, you can split the process to metadata initialization
|
||||
(prepare keyslots and segments but do not run reencryption yet) and the data
|
||||
reencryption step by using --init-only option.
|
||||
|
||||
Prepares metadata:
|
||||
# cryptsetup reencrypt --init-only <parameters>
|
||||
|
||||
Starts the data processing:
|
||||
# cryptsetup reencrypt <device>
|
||||
|
||||
Please note, that due to the Linux kernel limitation, the encryption or
|
||||
decryption process cannot be run entirely online - there must be at least
|
||||
short offline window where operation adds/removes device-mapper crypt (LUKS2) layer.
|
||||
This step should also include modification of /etc/crypttab and fstab UUIDs,
|
||||
but it is out of the scope of cryptsetup tools.
|
||||
|
||||
Limitations
|
||||
~~~~~~~~~~~
|
||||
Most of these limitations will be (hopefully) fixed in next versions.
|
||||
|
||||
* Only one active keyslot is supported (all old keyslots will be removed
|
||||
after reencryption).
|
||||
|
||||
* Only block devices are now supported as parameters. As a workaround
|
||||
for images in a file, please explicitly map a loop device over the image
|
||||
and use the loop device as the parameter.
|
||||
|
||||
* Devices with authenticated encryption are not supported. (Later it will
|
||||
be limited by the fixed per-sector metadata, per-sector metadata size
|
||||
cannot be changed without a new device format operation.)
|
||||
|
||||
* The reencryption uses userspace crypto library, with fallback to
|
||||
the kernel (if available). There can be some specific configurations
|
||||
where the fallback does not provide optimal performance.
|
||||
|
||||
* There are no translations of error messages until the final release
|
||||
(some messages can be rephrased as well).
|
||||
|
||||
* The repair command is not finished; the recovery of interrupted
|
||||
reencryption is made automatically on the first device activation.
|
||||
|
||||
* Reencryption triggers too many udev scans on metadata updates (on closing
|
||||
write enabled file descriptors). This has a negative performance impact on the whole
|
||||
reencryption and generates excessive I/O load on the system.
|
||||
|
||||
New libcryptsetup reencryption API
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
The libcryptsetup contains new API calls that are used to setup and
|
||||
run the reencryption.
|
||||
|
||||
Note that there can be some changes in API implementation of these functions
|
||||
and/or some new function can be introduced in final cryptsetup 2.2 release.
|
||||
|
||||
New API symbols (see documentation in libcryptsetup.h)
|
||||
* struct crypt_params_reencrypt - reencryption parameters
|
||||
|
||||
* crypt_reencrypt_init_by_passphrase
|
||||
* crypt_reencrypt_init_by_keyring
|
||||
- function to configure LUKS2 metadata for reencryption;
|
||||
if metadata already exists, it configures the context from this metadata
|
||||
|
||||
* crypt_reencrypt
|
||||
- run the reencryption process (processing the data)
|
||||
- the optional callback function can be used to interrupt the reencryption
|
||||
or report the progress.
|
||||
|
||||
* crypt_reencrypt_status
|
||||
- function to query LUKS2 metadata about the reencryption state
|
||||
|
||||
Other changes and fixes
|
||||
~~~~~~~~~~~~~~~~~~~~~~~
|
||||
* Add optional global serialization lock for memory hard PBKDF.
|
||||
(The --serialize-memory-hard-pbkdf option in cryptsetup and
|
||||
CRYPT_ACTIVATE_SERIALIZE_MEMORY_HARD_PBKDF in activation flag.)
|
||||
|
||||
This is an "ugly" optional workaround for a situation when multiple devices
|
||||
are being activated in parallel (like systemd crypttab activation).
|
||||
The system instead of returning ENOMEM (no memory available) starts
|
||||
out-of-memory (OOM) killer to kill processes randomly.
|
||||
|
||||
Until we find a reliable way how to work with memory-hard function
|
||||
in these situations, cryptsetup provide a way how to serialize memory-hard
|
||||
unlocking among parallel cryptsetup instances to workaround this problem.
|
||||
This flag is intended to be used only in very specific situations,
|
||||
never use it directly :-)
|
||||
|
||||
* Abort conversion to LUKS1 with incompatible sector size that is
|
||||
not supported in LUKS1.
|
||||
|
||||
* Report error (-ENOENT) if no LUKS keyslots are available. User can now
|
||||
distinguish between a wrong passphrase and no keyslot available.
|
||||
|
||||
* Fix a possible segfault in detached header handling (double free).
|
||||
|
||||
* Add integritysetup support for bitmap mode introduced in Linux kernel 5.2.
|
||||
Integritysetup now supports --integrity-bitmap-mode option and
|
||||
--bitmap-sector-per-bit and --bitmap-flush-time commandline options.
|
||||
|
||||
In the bitmap operation mode, if a bit in the bitmap is 1, the corresponding
|
||||
region's data and integrity tags are not synchronized - if the machine
|
||||
crashes, the unsynchronized regions will be recalculated.
|
||||
The bitmap mode is faster than the journal mode because we don't have
|
||||
to write the data twice, but it is also less reliable, because if data
|
||||
corruption happens when the machine crashes, it may not be detected.
|
||||
This can be used only for standalone devices, not with dm-crypt.
|
||||
|
||||
* The libcryptsetup now keeps all file descriptors to underlying device
|
||||
open during the whole lifetime of crypt device context to avoid excessive
|
||||
scanning in udev (udev run scan on every descriptor close).
|
||||
|
||||
* The luksDump command now prints more info for reencryption keyslot
|
||||
(when a device is in-reencryption).
|
||||
|
||||
* New --device-size parameter is supported for LUKS2 reencryption.
|
||||
It may be used to encrypt/reencrypt only the initial part of the data
|
||||
device if the user is aware that the rest of the device is empty.
|
||||
|
||||
Note: This change causes API break since the last rc0 release
|
||||
(crypt_params_reencrypt structure contains additional field).
|
||||
|
||||
* New --resume-only parameter is supported for LUKS2 reencryption.
|
||||
This flag resumes reencryption process if it exists (not starting
|
||||
new reencryption).
|
||||
|
||||
* The repair command now tries LUKS2 reencryption recovery if needed.
|
||||
|
||||
* If reencryption device is a file image, an interactive dialog now
|
||||
asks if reencryption should be run safely in offline mode
|
||||
(if autodetection of active devices failed).
|
||||
|
||||
* Fix activation through a token where dm-crypt volume key was not
|
||||
set through keyring (but using old device-mapper table parameter mode).
|
||||
|
||||
* Online reencryption can now retain all keyslots (if all passphrases
|
||||
are provided). Note that keyslot numbers will change in this case.
|
||||
|
||||
* Allow volume key file to be used if no LUKS2 keyslots are present.
|
||||
If all keyslots are removed, LUKS2 has no longer information about
|
||||
the volume key size (there is only key digest present).
|
||||
Please use --key-size option to open the device or add a new keyslot
|
||||
in these cases.
|
||||
|
||||
* Print a warning if online reencrypt is called over LUKS1 (not supported).
|
||||
|
||||
* Fix TCRYPT KDF failure in FIPS mode.
|
||||
Some crypto backends support plain hash in FIPS mode but not for PBKDF2.
|
||||
|
||||
* Remove FIPS mode restriction for crypt_volume_key_get.
|
||||
It is an application responsibility to use this API in the proper context.
|
||||
|
||||
* Reduce keyslots area size in luksFormat when the header device is too small.
|
||||
Unless user explicitly asks for keyslots areas size (either via
|
||||
--luks2-keyslots-size or --offset) reduce keyslots size so that it fits
|
||||
in metadata device.
|
||||
|
||||
* Make resize action accept --device-size parameter (supports units suffix).
|
||||
@@ -1,36 +0,0 @@
|
||||
Cryptsetup 2.2.1 Release Notes
|
||||
==============================
|
||||
Stable bug-fix release.
|
||||
|
||||
This version contains a fix for a possible data corruption bug
|
||||
on 32-bit platforms.
|
||||
All users of cryptsetup 2.1 and 2.2 should upgrade to this version.
|
||||
|
||||
Changes since version 2.2.0
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Fix possible data length and IV offset overflow on 32bit architectures.
|
||||
Other 64-bit architectures are not affected.
|
||||
|
||||
The flawed helper function prototypes (introduced in version 2.1.0) used
|
||||
size_t type, that is 32-bit integer on 32-bit systems.
|
||||
This patch fixes the problem to properly use 64-bit types.
|
||||
|
||||
If the offset parameter addresses devices larger than 2TB, the value
|
||||
overflows and stores incorrect information in the metadata.
|
||||
For example, integrity device is smaller than expected size if used
|
||||
over large disk on 32-bit architecture.
|
||||
|
||||
This issue is not present with the standard LUKS1/LUKS2 devices without
|
||||
integrity extensions.
|
||||
|
||||
* Fix a regression in TrueCrypt/VeraCrypt system partition activation.
|
||||
|
||||
* Reinstate missing backing file hint for loop device.
|
||||
|
||||
If the encrypted device is backed by a file (loopback), cryptsetup now
|
||||
shows the path to the backing file in passphrase query (as in 1.x version).
|
||||
|
||||
* LUKS2 reencryption block size is now aligned to reported optimal IO size.
|
||||
This change eliminates possible non-aligned device warnings in kernel log
|
||||
during reencryption.
|
||||
@@ -1,56 +0,0 @@
|
||||
Cryptsetup 2.2.2 Release Notes
|
||||
==============================
|
||||
Stable bug-fix release.
|
||||
|
||||
All users of cryptsetup 2.1 and 2.2 should upgrade to this version.
|
||||
|
||||
Changes since version 2.2.1
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Print error message if a keyslot open failed for a different reason
|
||||
than wrong passwords (for example there is not enough memory).
|
||||
Only an exit code was present in this case.
|
||||
|
||||
* The progress function switches unit sizes (B/s to GiB/s) according
|
||||
to the actual speed. Also, it properly calculates speed in the case
|
||||
of a resumed reencryption operation.
|
||||
|
||||
* The --version now supports short -V short option and better handles
|
||||
common option priorities.
|
||||
|
||||
* If cryptsetup wipes signatures during format actions through blkid,
|
||||
it also prints signature device offsets.
|
||||
|
||||
* Compilation now properly uses LTLIBINTL gettext setting in Makefiles.
|
||||
|
||||
* Device-mapper backend now supports new DM_GET_TARGET_VERSION ioctl
|
||||
(available since Linux kernel 5.4).
|
||||
This should help to detect some kernel/userspace incompatibilities
|
||||
earlier later after a failed device activation.
|
||||
|
||||
* Fixes LUKS2 reencryption on systems without kernel keyring.
|
||||
|
||||
* Fixes unlocking prompt for partitions mapped through loop devices
|
||||
(to properly show the backing device).
|
||||
|
||||
* For LUKS2 decryption, a device is now marked for deferred removal
|
||||
to be automatically deactivated.
|
||||
|
||||
* Reencryption now limits hotzone size to be maximal 1 GiB or 1/4
|
||||
system memory (if lower).
|
||||
|
||||
* Reencryption now retains activation flags during online reencryption.
|
||||
|
||||
* Reencryption now allows LUKS2 device to activate device right after
|
||||
LUKS2 encryption is initialized through optional active device name
|
||||
for cryptsetup reencrypt --encrypt command.
|
||||
This could help with automated encryption during boot.
|
||||
|
||||
NOTE: It means that part of the device is still not encrypted during
|
||||
activation. Use with care!
|
||||
|
||||
* Fixes failure in resize and plain format activation if activated device
|
||||
size was not aligned to underlying logical device size.
|
||||
|
||||
* Fixes conversion to LUKS2 format with detached header if a detached
|
||||
header size was smaller than the expected aligned LUKS1 header size.
|
||||
@@ -1,209 +0,0 @@
|
||||
Cryptsetup 2.3.0 Release Notes
|
||||
==============================
|
||||
Stable release with new experimental features and bug fixes.
|
||||
|
||||
Cryptsetup 2.3 version introduces support for BitLocker-compatible
|
||||
devices (BITLK format). This format is used in Windows systems,
|
||||
and in combination with a filesystem driver, cryptsetup now provides
|
||||
native read-write access to BitLocker Full Disk Encryption devices.
|
||||
|
||||
The BITLK implementation is based on publicly available information
|
||||
and it is an independent and opensource implementation that allows
|
||||
one to access this proprietary disk encryption.
|
||||
|
||||
Changes since version 2.2.2
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* BITLK (Windows BitLocker compatible) device access
|
||||
|
||||
BITLK userspace implementation is based on the master thesis and code
|
||||
provided by Vojtech Trefny. Also, thanks to other opensource projects
|
||||
like libbde (that provide alternative approach to decode this format)
|
||||
we were able to verify cryptsetup implementation.
|
||||
|
||||
NOTE: Support for the BITLK device is EXPERIMENTAL and will require
|
||||
a lot of testing. If you get some error message (mainly unsupported
|
||||
metadata in the on-disk header), please help us by submitting an issue
|
||||
to cryptsetup project, so we can fix it. Thank you!
|
||||
|
||||
Cryptsetup supports BITLK activation through passphrase or recovery
|
||||
passphrase for existing devices (BitLocker and Bitlocker to Go).
|
||||
|
||||
Activation through TPM, SmartCard, or any other key protector
|
||||
is not supported. And in some situations, mainly for TPM bind to some
|
||||
PCR registers, it could be even impossible on Linux in the future.
|
||||
|
||||
All metadata (key protectors) are handled read-only, cryptsetup cannot
|
||||
create or modify them. Except for old devices (created in old Vista
|
||||
systems), all format variants should be recognized.
|
||||
|
||||
Data devices can be activated read-write (followed by mounting through
|
||||
the proper filesystem driver). To access filesystem on the decrypted device
|
||||
you need properly installed driver (vfat, NTFS or exFAT).
|
||||
|
||||
Foe AES-XTS, activation is supported on all recent Linux kernels.
|
||||
|
||||
For older AES-CBC encryption, Linux Kernel version 5.3 is required
|
||||
(support for special IV variant); for AES-CBC with Elephant diffuser,
|
||||
Linux Kernel 5.6 is required.
|
||||
|
||||
Please note that CBC variants are legacy, and we provide it only
|
||||
for backward compatibility (to be able to access old drives).
|
||||
|
||||
Cryptsetup command now supports the new "bitlk" format and implement dump,
|
||||
open, status, and close actions.
|
||||
|
||||
To activate a BITLK device, use
|
||||
|
||||
# cryptsetup open --type bitlk <device> <name>
|
||||
or with alias
|
||||
# cryptsetup bitlkOpen <device> <name>
|
||||
|
||||
Then with properly installed fs driver (usually NTFS, vfat or exFAT),
|
||||
you can mount the plaintext device /dev/mapper<name> device as a common
|
||||
filesystem.
|
||||
|
||||
To print metadata information about BITLK device, use
|
||||
# crypotsetup bitlkDump <device>
|
||||
|
||||
To print information about the active device, use
|
||||
# cryptsetup status <name>
|
||||
|
||||
Example (activation of disk image):
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Recent blkid recognizes BitLocker device,just to verity
|
||||
# blkid bitlocker_xts_ntfs.img
|
||||
bitlocker_xts_ntfs.img: TYPE="BitLocker"
|
||||
|
||||
# Print visible metadata information (on-disk, form the image)
|
||||
# cryptsetup bitlkDump bitlocker_xts_ntfs.img
|
||||
Info for BITLK device bitlocker_xts_ntfs.img.
|
||||
Version: 2
|
||||
GUID: ...
|
||||
Created: Wed Oct 23 17:38:15 2019
|
||||
Description: DESKTOP-xxxxxxx E: 23.10.2019
|
||||
Cipher name: aes
|
||||
Cipher mode: xts-plain64
|
||||
Cipher key: 128 bits
|
||||
|
||||
Keyslots:
|
||||
0: VMK
|
||||
GUID: ...
|
||||
Protection: VMK protected with passphrase
|
||||
Salt: ...
|
||||
Key data size: 44 [bytes]
|
||||
1: VMK
|
||||
GUID: ...
|
||||
Protection: VMK protected with recovery passphrase
|
||||
Salt: ...
|
||||
Key data size: 44 [bytes]
|
||||
2: FVEK
|
||||
Key data size: 44 [bytes]
|
||||
|
||||
# Activation (recovery passphrase works the same as password)
|
||||
# cryptsetup bitlkOpen bitlocker_xts_ntfs.img test -v
|
||||
Enter passphrase for bitlocker_xts_ntfs.img:
|
||||
Command successful.
|
||||
|
||||
# Information about the active device
|
||||
# cryptsetup status test
|
||||
/dev/mapper/test is active.
|
||||
type: BITLK
|
||||
cipher: aes-xts-plain64
|
||||
keysize: 128 bits
|
||||
...
|
||||
|
||||
# Plaintext device should now contain decrypted NTFS filesystem
|
||||
# blkid /dev/mapper/test
|
||||
/dev/mapper/test: UUID="..." TYPE="ntfs"
|
||||
|
||||
# And can be mounted
|
||||
# mount /dev/mapper/test /mnt/tst
|
||||
|
||||
# Deactivation
|
||||
# umount /mnt/tst
|
||||
# cryptsetup close test
|
||||
|
||||
* Veritysetup now supports activation with additional PKCS7 signature
|
||||
of root hash through --root-hash-signature option.
|
||||
The signature uses an in-kernel trusted key to validate the signature
|
||||
of the root hash during activation. This option requires Linux kernel
|
||||
5.4 with DM_VERITY_VERIFY_ROOTHASH_SIG option.
|
||||
|
||||
Verity devices activated with signature now has a special flag
|
||||
(with signature) active in device status (veritysetup status <name>).
|
||||
|
||||
Usage:
|
||||
# veritysetup open <data_device> name <hash_device> <root_hash> \
|
||||
--root-hash-signature=<roothash_p7_sig_file>
|
||||
|
||||
* Integritysetup now calculates hash integrity size according to algorithm
|
||||
instead of requiring an explicit tag size.
|
||||
|
||||
Previously, when integritysetup formats a device with hash or
|
||||
HMAC integrity checksums, it required explicitly tag size entry from
|
||||
a user (or used default value).
|
||||
This led to confusion and unexpected shortened tag sizes.
|
||||
|
||||
Now, libcryptsetup calculates tag size according to real hash output.
|
||||
Tag size can also be specified, then it warns if these values differ.
|
||||
|
||||
* Integritysetup now supports fixed padding for dm-integrity devices.
|
||||
|
||||
There was an in-kernel bug that wasted a lot of space when using metadata
|
||||
areas for integrity-protected devices if a larger sector size than
|
||||
512 bytes was used.
|
||||
This problem affects both stand-alone dm-integrity and also LUKS2 with
|
||||
authenticated encryption and larger sector size.
|
||||
|
||||
The new extension to dm-integrity superblock is needed, so devices
|
||||
with the new optimal padding cannot be activated on older systems.
|
||||
|
||||
Integritysetup/Cryptsetup will use new padding automatically if it
|
||||
detects the proper kernel. To create a compatible device with
|
||||
the old padding, use --integrity-legacy-padding option.
|
||||
|
||||
* A lot of fixes to online LUKS2 reecryption.
|
||||
|
||||
* Add crypt_resume_by_volume_key() function to libcryptsetup.
|
||||
If a user has a volume key available, the LUKS device can be resumed
|
||||
directly using the provided volume key.
|
||||
No keyslot derivation is needed, only the key digest is checked.
|
||||
|
||||
* Implement active device suspend info.
|
||||
Add CRYPT_ACTIVATE_SUSPENDED bit to crypt_get_active_device() flags
|
||||
that informs the caller that device is suspended (luksSuspend).
|
||||
|
||||
* Allow --test-passphrase for a detached header.
|
||||
Before this fix, we required a data device specified on the command
|
||||
line even though it was not necessary for the passphrase check.
|
||||
|
||||
* Allow --key-file option in legacy offline encryption.
|
||||
The option was ignored for LUKS1 encryption initialization.
|
||||
|
||||
* Export memory safe functions.
|
||||
To make developing of some extensions simpler, we now export
|
||||
functions to handle memory with proper wipe on deallocation.
|
||||
|
||||
* Fail crypt_keyslot_get_pbkdf for inactive LUKS1 keyslot.
|
||||
|
||||
Libcryptsetup API extensions
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
The libcryptsetup API is backward compatible for existing symbols.
|
||||
|
||||
New symbols
|
||||
crypt_set_compatibility
|
||||
crypt_get_compatibility;
|
||||
crypt_resume_by_volume_key;
|
||||
crypt_activate_by_signed_key;
|
||||
crypt_safe_alloc;
|
||||
crypt_safe_realloc;
|
||||
crypt_safe_free;
|
||||
crypt_safe_memzero;
|
||||
|
||||
New defines introduced :
|
||||
CRYPT_BITLK "BITLK" - BITLK (BitLocker-compatible mode
|
||||
CRYPT_COMPAT_LEGACY_INTEGRITY_PADDING - dm-integrity legacy padding
|
||||
CRYPT_VERITY_ROOT_HASH_SIGNATURE - dm-verity root hash signature
|
||||
CRYPT_ACTIVATE_SUSPENDED - device suspended info flag
|
||||
@@ -1,45 +0,0 @@
|
||||
Cryptsetup 2.3.1 Release Notes
|
||||
==============================
|
||||
Stable bug-fix release.
|
||||
|
||||
All users of cryptsetup 2.x should upgrade to this version.
|
||||
|
||||
Changes since version 2.3.0
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Support VeraCrypt 128 bytes passwords.
|
||||
VeraCrypt now allows passwords of maximal length 128 bytes
|
||||
(compared to legacy TrueCrypt where it was limited by 64 bytes).
|
||||
|
||||
* Strip extra newline from BitLocker recovery keys
|
||||
There might be a trailing newline added by the text editor when
|
||||
the recovery passphrase was passed using the --key-file option.
|
||||
|
||||
* Detect separate libiconv library.
|
||||
It should fix compilation issues on distributions with iconv
|
||||
implemented in a separate library.
|
||||
|
||||
* Various fixes and workarounds to build on old Linux distributions.
|
||||
|
||||
* Split lines with hexadecimal digest printing for large key-sizes.
|
||||
|
||||
* Do not wipe the device with no integrity profile.
|
||||
With --integrity none we performed useless full device wipe.
|
||||
|
||||
* Workaround for dm-integrity kernel table bug.
|
||||
Some kernels show an invalid dm-integrity mapping table
|
||||
if superblock contains the "recalculate" bit. This causes
|
||||
integritysetup to not recognize the dm-integrity device.
|
||||
Integritysetup now specifies kernel options such a way that
|
||||
even on unpatched kernels mapping table is correct.
|
||||
|
||||
* Print error message if LUKS1 keyslot cannot be processed.
|
||||
If the crypto backend is missing support for hash algorithms
|
||||
used in PBKDF2, the error message was not visible.
|
||||
|
||||
* Properly align LUKS2 keyslots area on conversion.
|
||||
If the LUKS1 payload offset (data offset) is not aligned
|
||||
to 4 KiB boundary, new LUKS2 keyslots area in now aligned properly.
|
||||
|
||||
* Validate LUKS2 earlier on conversion to not corrupt the device
|
||||
if binary keyslots areas metadata are not correct.
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user