b764917cd5
lint fixes
2016-10-04 23:18:33 +02:00
31a8f8b839
tests: skip "go tool vet" if the command is not available
...
"vet" is not availably by default on Go 1.4.
2016-10-04 22:42:30 +02:00
49c73f84f5
tests: drop Go 1.3.3 from Travis testing
...
Does not support testing.M, which means we cannot run the
test suite, which means we cannot claim to support it at
all.
2016-10-04 22:34:13 +02:00
db5782028a
tests: skip tests with -openssl=false on Go 1.4 and lower
...
Go versions 1.4 and lower lack NewGCMWithNonceSize(), which causes
a panic in the test.
2016-10-04 22:34:12 +02:00
b80d01056f
tests: enable FUSE tests on Travis CI
2016-10-04 22:34:07 +02:00
67a959eebf
tests: symlink to "/" instead of "/etc/motd"
...
This file does not exist on all systems, causing spurious
test failures.
See #40 , #43
2016-10-04 22:01:47 +02:00
95db38912b
tests: fallocate: skip some disk usage checks on btrfs
...
The expected allocated sizes are verified for tmpfs and ext4.
btrfs gives different results, but that's not an error.
Also, simplify test_helpers.Du and several code paths.
Fixes #43 .
2016-10-04 21:57:13 +02:00
db72a4489d
fusefrontend_reverse cast Stat_t.Dev to uint64 ( #44 )
...
The [Stat_t.Dev](https://golang.org/pkg/syscall/#Stat_t ) docs say `Dev` is a `unit64`, but on [macOS amd64](https://golang.org/src/syscall/ztypes_darwin_amd64.go ) it's an `int32`.
2016-10-04 15:03:47 +02:00
b068ffbff9
maxlen.bash: result was 1 too high
...
Additionally, output 0 instead of 7 on permission errors.
2016-10-04 10:26:22 +02:00
56c0b19612
without_openssl: support compiling completely without openssl
...
Build helper script: build-without-openssl.bash
2016-10-04 09:51:14 +02:00
a00402cc47
cryptocore: rename "gcm" variable to generic "aeadCipher"
...
As we now also support AES-SIV the old name is no longer
correct.
2016-10-04 00:17:09 +02:00
bb52937834
cryptocore: derive 512-bit key for AES-SIV
...
AES-SIV uses 1/2 of the key for authentication, 1/2 for
encryption, so we need a 64-byte key for AES-256. Derive
it from the master key by hashing it with SHA-512.
2016-10-04 00:16:56 +02:00
46018785b4
siv_aead: Overhead is always 16
...
Add a test for that.
Also test operations using a 64-byte key.
2016-10-03 23:58:19 +02:00
b7be386e46
xray: print block offsets
2016-09-29 22:13:26 +02:00
a2510efe12
reverse: use per-purpose nonce generation
...
Also pull all the deterministic nonce code into fusefrontend_reverse
to greatly simplify the normal code path.
2016-09-29 21:56:49 +02:00
bce96b5095
reverse: move newDirIVFile into virtualfile.go
...
After all, is's a virtual file.
2016-09-28 23:30:13 +02:00
35fb6583e6
main: get rid of duplicate "extpass" message
...
$ gocryptfs -init -extpass "echo test" a
Using password provided via -extpass. <<< DUPLICATE
Reading password from extpass program
The gocryptfs filesystem has been created successfully.
You can now mount it using: gocryptfs a MOUNTPOINT
2016-09-28 20:47:01 +02:00
4b934f1a72
README: storage overhead is 32 bytes
...
As stated in file-format.md.
2016-09-26 23:46:37 +02:00
e9bb8b800c
reverse: switch from GCM-SIV to AES-SIV
...
GCM-SIV is not yet finalized, and the reference implemenation is
painfully slow at about 2 MB/s. Switch to AES-SIV.
2016-09-26 23:25:13 +02:00
d9fc652df0
siv_aead: add AES-SIV AEAD wrapper
2016-09-26 23:06:40 +02:00
0e277ba19e
stupidgcm: add GCM-SIV benchmark
...
On a CPU without AES-NI:
$ go test -bench .
Benchmark4kEncStupidGCM-2 50000 24155 ns/op 169.57 MB/s
Benchmark4kEncGoGCM-2 20000 93965 ns/op 43.59 MB/s
Benchmark4kEncGCMSIV-2 500 2576193 ns/op 1.59 MB/s
2016-09-25 20:04:55 +02:00
32e35adcad
tests: add reverse linux tarball test
2016-09-25 20:04:03 +02:00
28838a489d
nametransform: downgrade invalid length warning
...
This happens all the time in reverse mode when somebody stats
an encrypted symlink target.
2016-09-25 19:50:16 +02:00
5f4b16c00f
Implement changes proposed by gosimple.
...
Also delete the unused "dirIVNameStruct", found by deadcode.
2016-09-25 19:48:21 +02:00
166ba74a05
tests: enable all go vet checks
...
...and fix reported errors:
internal/fusefrontend_reverse/rfile.go:40: github.com/rfjakob/gocryptfs/internal/contentenc.FileHeader composite literal uses unkeyed fields
internal/fusefrontend_reverse/rfs.go:249: github.com/hanwen/go-fuse/fuse.DirEntry composite literal uses unkeyed fields
internal/fusefrontend_reverse/rfs.go:264: github.com/hanwen/go-fuse/fuse.DirEntry composite literal uses unkeyed fields
2016-09-25 19:02:12 +02:00
c7b3150afc
nametransform: delete unused function DecryptPathDirIV
2016-09-25 18:56:23 +02:00
abd61d968d
contentenc: rename constant "IVBitLen" to "DefaultIVBits" and clarify comment
...
128-bit IVs are NOT used everywhere.
2016-09-25 18:40:29 +02:00
b883dd10a6
reverse: add symlink encryption and Readlink support
2016-09-25 18:01:24 +02:00
12808138ef
contentenc: add "ExternalNonce" mode
...
This will be used for strong symlink encryption in reverse mode.
2016-09-25 17:44:19 +02:00
32e55261ca
fusefrontend: handle Readlink directly
...
Calling into go-fuse's loopbackFileSystem does not add
any value here.
2016-09-25 17:01:39 +02:00
ffdb7cd47a
reverse: more thorough longname stat test
...
Now also verifies the returned file size.
2016-09-25 16:43:17 +02:00
2050c7f3b3
reverse: add gcmsiv flag and associated tests
2016-09-25 16:43:17 +02:00
f8da264222
tests: smarter error handling in ResetTmpDir
...
Look at the error code from os.Remove and decide about the
right thing to do.
Gets rid of spurious fusermount error messages.
2016-09-25 16:43:17 +02:00
7bbf6ad6ea
reverse: derive file ID and block IVs from file paths
2016-09-25 16:43:17 +02:00
3a9bd92754
xray: add "gocryptfs-xray", on-disk-format exploration tool
...
Example output for a file encrypted in reverse mode:
Header: Version: 2, Id: 0b7f5e2574e4afa859a9bb156a2e7772
Block 0: IV: 0b7f5e2574e4afa859a9bb156a2e7773, Tag: bf39279ac6b1ccd852567aaf26ee386b, Len: 4128
Block 1: IV: 0b7f5e2574e4afa859a9bb156a2e7774, Tag: a4f0f9cde7f70a752254aa8fe7718699, Len: 4128
Block 2: IV: 0b7f5e2574e4afa859a9bb156a2e7775, Tag: b467b153016fc1d531818b65ab9e24f6, Len: 4128
Block 3: IV: 0b7f5e2574e4afa859a9bb156a2e7776, Tag: 1fcb7ffd8f1816fbe807df8148718a5c, Len: 4128
Block 4: IV: 0b7f5e2574e4afa859a9bb156a2e7777, Tag: a217e7933ef434c9f03ad931bb5fde9b, Len: 4128
Block 5: IV: 0b7f5e2574e4afa859a9bb156a2e7778, Tag: f3e6240d75cd66371a0b301111d6f1fc, Len: 4128
Block 6: IV: 0b7f5e2574e4afa859a9bb156a2e7779, Tag: bc85d322ebc7761ae5ef114ea3903a56, Len: 4128
Block 7: IV: 0b7f5e2574e4afa859a9bb156a2e777a, Tag: efda01c6b794690f939a12d6d49ac3af, Len: 4128
Block 8: IV: 0b7f5e2574e4afa859a9bb156a2e777b, Tag: b198329d489d1392080f710206932ff0, Len: 2907
2016-09-25 16:43:17 +02:00
6c52c1a6e6
reverse: add longname benchmark
2016-09-25 16:43:17 +02:00
52a6f4f71e
reverse: add longnameParentCache
...
findLongnameParent has to read the whole directory to find the
right file; add a simple cache to avoid most directory scans.
2016-09-25 16:43:17 +02:00
6ffd07f02a
tests: extractloop: use tmp dir based on script name
...
This is how this should be done as well in future test scripts.
2016-09-25 16:43:17 +02:00
a6a7b424f8
reverse: resolve long names in Open and GetAttr
...
The last patch added functionality for generating gocryptfs.longname.*
files, this patch adds support for mapping them back to the full
filenames.
Note that resolving a long name needs a full readdir. A cache
will be implemented later on to improve performance.
2016-09-25 16:43:17 +02:00
35bcc2dca2
reverse: transform long names in OpenDir
2016-09-25 16:43:17 +02:00
b34a665da4
nametransform: implement ReadDirIV without Openat
...
As ReadDirIV operates on a path anyway, opening the directory
has no clear safety advantage w.r.t. concurrent renames.
If the backing directory is a reverse-mounted gocryptfs filesystem,
each directory open is an OPENDIR, and this causes a full directory
read!
This patch improves the "ls -lR" performance of an
DIR --> gocryptfs-reverse --> gocryptfs
chain by a factor of ~10.
OPENDIR counts for ls -lR:
Before 15570
After 2745
2016-09-25 16:43:17 +02:00
01c18dbcab
nametransform: return EINVAL on invalid padding
...
With the generic fmt.Errorf we trigger a warning from go-fuse:
2016/09/21 21:42:31 can't convert error type: Invalid padding
2016-09-25 16:43:17 +02:00
d76e7aadb4
reverse: use dynamic inode numbers
...
...with stable mappings for hard-linked files.
2016-09-25 16:43:17 +02:00
5f726aaa9d
contentenc: add GCM-SIV support
...
Also add ReverseDummyNonce nonce generation.
2016-09-25 16:43:17 +02:00
90f0bdc224
main: init: refuse overwriting .gocryptfs.reverse.conf
2016-09-25 16:43:17 +02:00
7f87ed78f2
cryptocore: add support for GCM-SIV
2016-09-25 16:43:17 +02:00
d1762c5b95
reverse: fix GetAttr for gocryptfs.conf
...
And also don't return the encrypted version of
.gocryptfs.reverse.conf in readdir.
2016-09-25 16:43:17 +02:00
5fb6c5cf58
reverse: enable init functionality
2016-09-25 16:43:17 +02:00
72efa5c9b1
main: move initDir into its own file
2016-09-25 16:43:17 +02:00
9ad49088fa
main: add explicit exit after forkChild
...
Trying to make it more obvious what is happening.
2016-09-25 16:43:17 +02:00
Valient Gough