diff options
| -rw-r--r-- | Documentation/MANPAGE.md | 9 | ||||
| -rw-r--r-- | cli_args.go | 14 | ||||
| -rw-r--r-- | init_dir.go | 1 | ||||
| -rw-r--r-- | internal/configfile/config_file.go | 25 | ||||
| -rw-r--r-- | internal/configfile/config_test.go | 12 |
5 files changed, 14 insertions, 47 deletions
diff --git a/Documentation/MANPAGE.md b/Documentation/MANPAGE.md index b9aa51b..acb0ff0 100644 --- a/Documentation/MANPAGE.md +++ b/Documentation/MANPAGE.md @@ -114,11 +114,10 @@ leaks information about identical file names across directories The resulting `gocryptfs.conf` has "DirIV" missing from "FeatureFlags". #### -devrandom -Use `/dev/random` for generating the master key instead of the default Go -implementation. This is especially useful on embedded systems with Go versions -prior to 1.9, which fall back to weak random data when the getrandom syscall -is blocking. Using this option can block indefinitely when the kernel cannot -harvest enough entropy. +Obsolete and ignored on gocryptfs v2.2 and later. + +See https://github.com/rfjakob/gocryptfs/commit/f3c777d5eaa682d878c638192311e52f9c204294 +and https://github.com/rfjakob/gocryptfs/issues/596 for background info. #### -hkdf Use HKDF to derive separate keys for content and name encryption from diff --git a/cli_args.go b/cli_args.go index 3eb92b2..0287741 100644 --- a/cli_args.go +++ b/cli_args.go @@ -30,7 +30,7 @@ type argContainer struct { plaintextnames, quiet, nosyslog, wpanic, longnames, allow_other, reverse, aessiv, nonempty, raw64, noprealloc, speed, hkdf, serialize_reads, forcedecode, hh, info, - sharedstorage, devrandom, fsck, one_file_system, deterministic_names, + sharedstorage, fsck, one_file_system, deterministic_names, xchacha bool // Mount options with opposites dev, nodev, suid, nosuid, exec, noexec, rw, ro, kernel_cache, acl bool @@ -177,7 +177,6 @@ func parseCliOpts(osArgs []string) (args argContainer) { flagSet.BoolVar(&args.hh, "hh", false, "Show this long help text") flagSet.BoolVar(&args.info, "info", false, "Display information about CIPHERDIR") flagSet.BoolVar(&args.sharedstorage, "sharedstorage", false, "Make concurrent access to a shared CIPHERDIR safer") - flagSet.BoolVar(&args.devrandom, "devrandom", false, "Use /dev/random for generating master key") flagSet.BoolVar(&args.fsck, "fsck", false, "Run a filesystem check on CIPHERDIR") flagSet.BoolVar(&args.one_file_system, "one-file-system", false, "Don't cross filesystem boundaries") flagSet.BoolVar(&args.deterministic_names, "deterministic-names", false, "Disable diriv file name randomisation") @@ -228,11 +227,16 @@ func parseCliOpts(osArgs []string) (args argContainer) { flagSet.DurationVar(&args.idle, "idle", 0, "Auto-unmount after specified idle duration (ignored in reverse mode). "+ "Durations are specified like \"500s\" or \"2h45m\". 0 means stay mounted indefinitely.") - var nofail bool - flagSet.BoolVar(&nofail, "nofail", false, "Ignored for /etc/fstab compatibility") - var dummyString string flagSet.StringVar(&dummyString, "o", "", "For compatibility with mount(1), options can be also passed as a comma-separated list to -o on the end.") + + // Ignored flags + { + var tmp bool + flagSet.BoolVar(&tmp, "nofail", false, "Ignored for /etc/fstab compatibility") + flagSet.BoolVar(&tmp, "devrandom", false, "Deprecated (ignored for compatibility)") + } + // Actual parsing err = flagSet.Parse(osArgsPreprocessed[1:]) if err == flag.ErrHelp { diff --git a/init_dir.go b/init_dir.go index c6539c8..00fb390 100644 --- a/init_dir.go +++ b/init_dir.go @@ -93,7 +93,6 @@ func initDir(args *argContainer) { LogN: args.scryptn, Creator: creator, AESSIV: args.aessiv, - Devrandom: args.devrandom, Fido2CredentialID: fido2CredentialID, Fido2HmacSalt: fido2HmacSalt, DeterministicNames: args.deterministic_names, diff --git a/internal/configfile/config_file.go b/internal/configfile/config_file.go index c1f93af..951dce8 100644 --- a/internal/configfile/config_file.go +++ b/internal/configfile/config_file.go @@ -5,9 +5,7 @@ package configfile import ( "encoding/json" "fmt" - "io" "io/ioutil" - "log" "syscall" "os" @@ -61,21 +59,6 @@ type ConfFile struct { filename string } -// randBytesDevRandom gets "n" random bytes from /dev/random or panics -func randBytesDevRandom(n int) []byte { - f, err := os.Open("/dev/random") - if err != nil { - log.Panic("Failed to open /dev/random: " + err.Error()) - } - defer f.Close() - b := make([]byte, n) - _, err = io.ReadFull(f, b) - if err != nil { - log.Panic("Failed to read random bytes: " + err.Error()) - } - return b -} - // CreateArgs exists because the argument list to Create became too long. type CreateArgs struct { Filename string @@ -84,7 +67,6 @@ type CreateArgs struct { LogN int Creator string AESSIV bool - Devrandom bool Fido2CredentialID []byte Fido2HmacSalt []byte DeterministicNames bool @@ -136,12 +118,7 @@ func Create(args *CreateArgs) error { } { // Generate new random master key - var key []byte - if args.Devrandom { - key = randBytesDevRandom(cryptocore.KeyLen) - } else { - key = cryptocore.RandBytes(cryptocore.KeyLen) - } + key := cryptocore.RandBytes(cryptocore.KeyLen) tlog.PrintMasterkeyReminder(key) // Encrypt it using the password // This sets ScryptObject and EncryptedKey diff --git a/internal/configfile/config_test.go b/internal/configfile/config_test.go index 021b6c1..b8012d3 100644 --- a/internal/configfile/config_test.go +++ b/internal/configfile/config_test.go @@ -86,18 +86,6 @@ func TestCreateConfDefault(t *testing.T) { } } -func TestCreateConfDevRandom(t *testing.T) { - err := Create(&CreateArgs{ - Filename: "config_test/tmp.conf", - Password: testPw, - LogN: 10, - Creator: "test", - Devrandom: true}) - if err != nil { - t.Fatal(err) - } -} - func TestCreateConfPlaintextnames(t *testing.T) { err := Create(&CreateArgs{ Filename: "config_test/tmp.conf", |