Add support for VeraCrypt volumes and extend support for TCRYPT volumes #320

segfault3 · 2018-02-10T10:54:03Z

This adds support for:

VeraCrypt volumes
TCRYPT keyfiles
TCRYPT hidden containers
TCRYPT system volumes
VeraCrypt PIM

segfault3 · 2018-02-10T11:03:29Z

The corresponding udisks pull request: storaged-project/udisks#495.

vojtechtrefny · 2018-02-28T07:29:34Z

This is unfortunately an API change and we can't do that in minor version -- if you need the new options for bd_crypto_tc_open, you'll need to create a new function -- similar to bd_crypto_luks_open and bd_crypto_luks_open_blob.

segfault3 · 2018-02-28T23:29:20Z

I see. I moved the new code into a new function in 074814d.

vojtechtrefny · 2018-03-08T20:48:45Z

Thank you. Maybe bd_crypto_tc_open2 is not the best name for the new function, but I don't have better idea, so I guess it's ok.

vojtechtrefny · 2018-03-08T20:48:51Z

Jenkins, test this please.

vojtechtrefny · 2018-03-09T08:36:52Z

The veracrypt_pim parameter is available only in cryptsetup 2, please add some checks/ifdefs for this parameter so it works on older version of cryptsetup too.

TobiPeterG · 2018-03-09T12:36:09Z

How can I merge your changes on my system?

vpodzime

First of all -- THANKS a lot for these changes! There are a couple small things that can be made better, but other than that the changes are nice.

It would be nice if these changes didn't break git bisect. IOW, if the API wasn't broken even in the middle of the changes. @segfault3 please try to do that. If the rebase gets ridiculously complicated, feel free to give it up, though. :)

vpodzime · 2018-03-09T14:07:51Z

src/lib/plugin_apis/crypto.api

@@ -309,6 +309,27 @@ gboolean bd_crypto_luks_resize (const gchar *luks_device, guint64 size, GError *
 */
 gboolean bd_crypto_tc_open (const gchar *device, const gchar *name, const guint8* pass_data, gsize data_len, gboolean read_only, GError **error);

+/**
+ * bd_crypto_tc_open2:


I suggest bd_crypto_tc_open_full as a better name for this function.

Done in 94aca5c

I squashed commit 94aca5c into 9a7f054 during the rebasing.

vpodzime · 2018-03-09T14:09:08Z

src/plugins/crypto.c

+ *
+ * Tech category: %BD_CRYPTO_TECH_TRUECRYPT-%BD_CRYPTO_TECH_MODE_OPEN_CLOSE
+ */
+gboolean bd_crypto_tc_open (const gchar *device, const gchar *name, const guint8* pass_data, gsize data_len, gboolean read_only, GError **error) {


I think the old function should just call the new more universal one.

Makes sense. Done in 12841cf.

I also squahed 12841cf into 9a7f054 during the rebasing.

vpodzime · 2018-03-09T14:09:50Z

src/plugins/crypto.c

@@ -959,14 +959,16 @@ gboolean bd_crypto_luks_resize (const gchar *luks_device, guint64 size, GError *
 * @pass_data: (array length=data_len): a passphrase for the TrueCrypt/VeraCrypt volume (may contain arbitrary binary data)
 * @data_len: length of the @pass_data buffer
 * @read_only: whether to open as read-only or not (meaning read-write)
+ * @keyfiles: (array length=keyfiles_count) paths to the keyfiles for the TrueCrypt/VeraCrypt volume
+ * @keyfiles_count: length of the @keyfiles array


We do zero/NULL terminated arrays where possible.

Fixed in 8f0f434.

That is now done in commit 69a3223 after the rebasing.

segfault3 · 2018-03-09T20:01:33Z

The veracrypt_pim parameter is available only in cryptsetup 2, please add some checks/ifdefs for this parameter so it works on older version of cryptsetup too.

Done in 08a09b7.

segfault3 · 2018-03-09T20:08:03Z

First of all -- THANKS a lot for these changes!

I'm glad it's appreciated :)

There are a couple small things that can be made better, but other than that the changes are nice.

I think I addressed all of them now.

It would be nice if these changes didn't break git bisect. IOW, if the API wasn't broken even in the middle of the changes. @segfault3 please try to do that. If the rebase gets ridiculously complicated, feel free to give it up, though. :)

I rewrote git history and think that now none of the commit breaks the API. I squashed some commits to make the rebasing easier.

vojtechtrefny · 2018-03-10T09:43:04Z

Jenkins, ok to test.

vojtechtrefny · 2018-03-12T10:44:07Z

src/plugins/crypto.h

@@ -6,6 +6,10 @@

 #define BD_CRYPTO_LUKS_METADATA_SIZE (2 MiB)

+#define BD_CRYPTO_CHI_SQUARE_LOWER_LIMIT 136
+#define BD_CRYPTO_CHI_SQUARE_UPPER_LIMIT 426
+#define BD_CRYPTO_CHI_SQUARE_BYTES_TO_CHECK 512


This looks like something that might be better as parameters for bd_crypto_device_seems_encrypted. I don't know if there is a change that these will change in feature, but it might be better to not have to recompile libblockdev just because you want to change these limits.

Mmh, I don't really see the use case for changing these values - especially not in the higher level applications which will use this function. Why do you think they should be changeable without recompiling?

I don't know, but the limits just look like something that users of libblockdev might want to change eventually. But if you think this isn't something that makes sense to change from e.g. udisks, we can keep it this way.

I don't see why these values should be changed from udisks. We explained at https://tails.boum.org/blueprint/veracrypt/#detection why, with these values, the chi-squared test should only produce false negatives with negligible probability (1 in 10 billion). And devices with (non-encrypted) filesystem headers will never pass the test. The only reason I can think of to change these values is to handle strange filesystems, which don't have their header at least partly in the first 512 Bytes (I don't know of any such filesystem), but then I think we should handle this in libblockdev and not udisks or similar.

Ok, you convinced me, we can keep it this way.

vojtechtrefny

Looks good to me now.

vojtechtrefny · 2018-03-14T07:03:38Z

src/lib/plugin_apis/crypto.api

+ *
+ * Tech category: %BD_CRYPTO_TECH_TRUECRYPT-%BD_CRYPTO_TECH_MODE_QUERY
+ */
+gboolean bd_crypto_device_seems_encrypted (const gchar *device, GError **error);


Please add the new functions to docs/libblockdev-sections.txt too.

Done in b8d8bd7.

segfault3 · 2018-03-14T10:48:16Z

I fixed a URL in 2d15e2d.

vpodzime

Thanks a ton @segfault3!

segfault3 mentioned this pull request Feb 10, 2018

Support TCRYPT storaged-project/udisks#495

Merged

intrigeri mentioned this pull request Feb 26, 2018

RFE: support TrueCrypt encryption storaged-project/udisks#282

Closed

segfault3 force-pushed the add_veracrypt branch from 06ff56f to 074814d Compare February 28, 2018 23:26

vpodzime requested changes Mar 9, 2018

View reviewed changes

segfault3 added 7 commits March 9, 2018 20:09

Support unlocking VeraCrypt volumes

9a7f054

Support TCRYPT keyfiles

1d2b82c

Support TCRYPT hidden containers

b1782c3

Support TCRYPT system volumes

50ef01f

Support VeraCrypt PIM

74f4227

Add function bd_crypto_device_seems_encrypted

eb54aeb

Make keyfiles parameter to bd_crypto_tc_open_full zero terminated

69a3223

segfault3 force-pushed the add_veracrypt branch from 8f0f434 to 69a3223 Compare March 9, 2018 19:18

segfault3 added 2 commits March 9, 2018 20:21

Merge remote-tracking branch 'upstream/master' into add_veracrypt

42dfbfe

Don't use VeraCrypt PIM if compiled against libcryptsetup < 2.0

08a09b7

vojtechtrefny reviewed Mar 12, 2018

View reviewed changes

vojtechtrefny approved these changes Mar 14, 2018

View reviewed changes

segfault3 added 2 commits March 14, 2018 11:22

Make a link point to the relevant section

2d15e2d

Add new functions to docs/libblockdev-sections.txt

b8d8bd7

vpodzime approved these changes Mar 19, 2018

View reviewed changes

vojtechtrefny merged commit ff922e1 into storaged-project:master Mar 20, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for VeraCrypt volumes and extend support for TCRYPT volumes #320

Add support for VeraCrypt volumes and extend support for TCRYPT volumes #320

segfault3 commented Feb 10, 2018

segfault3 commented Feb 10, 2018

vojtechtrefny commented Feb 28, 2018 •

edited

Loading

segfault3 commented Feb 28, 2018

vojtechtrefny commented Mar 8, 2018

vojtechtrefny commented Mar 8, 2018

vojtechtrefny commented Mar 9, 2018

TobiPeterG commented Mar 9, 2018

vpodzime left a comment

vpodzime Mar 9, 2018

segfault3 Mar 9, 2018

segfault3 Mar 9, 2018

vpodzime Mar 9, 2018

segfault3 Mar 9, 2018

segfault3 Mar 9, 2018

vpodzime Mar 9, 2018

segfault3 Mar 9, 2018

segfault3 Mar 9, 2018

segfault3 commented Mar 9, 2018

segfault3 commented Mar 9, 2018

vojtechtrefny commented Mar 10, 2018

vojtechtrefny Mar 12, 2018

segfault3 Mar 12, 2018

vojtechtrefny Mar 13, 2018

segfault3 Mar 13, 2018

vojtechtrefny Mar 14, 2018

vojtechtrefny left a comment

vojtechtrefny Mar 14, 2018

segfault3 Mar 14, 2018

segfault3 commented Mar 14, 2018

vpodzime left a comment

Add support for VeraCrypt volumes and extend support for TCRYPT volumes #320

Add support for VeraCrypt volumes and extend support for TCRYPT volumes #320

Conversation

segfault3 commented Feb 10, 2018

segfault3 commented Feb 10, 2018

vojtechtrefny commented Feb 28, 2018 • edited Loading

segfault3 commented Feb 28, 2018

vojtechtrefny commented Mar 8, 2018

vojtechtrefny commented Mar 8, 2018

vojtechtrefny commented Mar 9, 2018

TobiPeterG commented Mar 9, 2018

vpodzime left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

segfault3 commented Mar 9, 2018

segfault3 commented Mar 9, 2018

vojtechtrefny commented Mar 10, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vojtechtrefny left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

segfault3 commented Mar 14, 2018

vpodzime left a comment

Choose a reason for hiding this comment

vojtechtrefny commented Feb 28, 2018 •

edited

Loading