aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
21 hoursUpdate overhead for AEGIS-256 with 32-bit noncesFrank Denis
21 hoursUpdate libaegisFrank Denis
21 hoursAllow 256-bit nonces even if is not usefulFrank Denis
21 hoursFix aegis available checksFrank Denis
21 hoursRmeove aegis from internal/stupidgcm/doc.goFrank Denis
21 hoursMove aegis out of stupidgcmFrank Denis
21 hoursRevert a few more thingsFrank Denis
21 hoursDo what @rfjakob asked me to doFrank Denis
21 hoursIntroduce the EMEKeyLen constantFrank Denis
21 hoursUse OPT_XCHACHA and OPT_AEGIS in the same commandFrank Denis
21 hoursAdd optional support for AEGIS encryptionFrank Denis
AEGIS is a new family of authenticated encryption algorithms that offers stronger security, higher usage limits, and better performance than AES-GCM. This pull request adds support for a new `-aegis` command-line flag, allowing AEGIS-128X2 to be used as an alternative to AES-GCM on CPUs with AES acceleration. It also introduces the ability to use ciphers with different key sizes. More information on AEGIS is available here: - https://cfrg.github.io/draft-irtf-cfrg-aegis-aead/draft-irtf-cfrg-aegis-aead.html - https://github.com/cfrg/draft-irtf-cfrg-aegis-aead gocryptfs -speed speed on Apple M1: AES-GCM-256-OpenSSL 3718.79 MB/s AES-GCM-256-Go 5083.43 MB/s (selected in auto mode) AES-SIV-512-Go 625.20 MB/s XChaCha20-Poly1305-OpenSSL 1358.63 MB/s (selected in auto mode) XChaCha20-Poly1305-Go 832.11 MB/s Aegis128X2-Go 11818.73 MB/s gocryptfs -speed speed on AMD Zen 4: AES-GCM-256-OpenSSL 5215.86 MB/s AES-GCM-256-Go 6918.01 MB/s (selected in auto mode) AES-SIV-512-Go 449.61 MB/s XChaCha20-Poly1305-OpenSSL 2643.48 MB/s XChaCha20-Poly1305-Go 3727.46 MB/s (selected in auto mode) Aegis128X2-Go 28109.92 MB/s
42 hoursgithub ci: clean up Go versionsHEADmasterci_too_manyJakob Unterwurzacher
go-libaegis does not support Go 1.18, Ubuntu 22.04 is old, drop it.
42 hoursgithub ci: bump nmount_max and print resulting fuse.confJakob Unterwurzacher
We have been getting /usr/bin/fusermount3: too many FUSE filesystems mounted; mount_max=N can be set in /etc/fuse.conf fs.Mount failed: fusermount exited with code 256 every now and then. I wonder why that is.
12 daysgo.mod: upgrade to golang.org/x/crypto@v0.33.0Jakob Unterwurzacher
I did NOT upgrade to x/crypto@v0.35.0 yet because this requires go 1.23.0 (https://go.googlesource.com/crypto/+/89ff08d67c4d79f9ac619aaf1f7388888798651f) and our github workflow tests go 1.18.x and newer.
2025-02-26go.mod: upgrade golang.org/x/sysJakob Unterwurzacher
Now that we have our own wrappers for Setreuid and friends, we can upgrade. $ go get golang.org/x/sys go: upgraded golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a => v0.30.0 $ go mod tidy
2025-02-26tests/root_test: use our own Setgroups/Setregid/Setreuid wrappersJakob Unterwurzacher
2025-02-26syscallcompat: use our own Setgroups/Setregid/Setreuid wrappersJakob Unterwurzacher
x/sys v0.1.0 (https://github.com/golang/sys/commit/d0df966e6959f00dc1c74363e537872647352d51) breaks our usecase. Switch to our own wrappers. Relates-to: https://github.com/rfjakob/gocryptfs/issues/892 Relates-to: https://github.com/rfjakob/gocryptfs/issues/893
2025-02-26syscallcompat: add docs for Setreuid/Setregid/SetgroupsJakob Unterwurzacher
2025-02-26syscallcompat: move getSupplementaryGroups to suser_linux.goJakob Unterwurzacher
It's only used there, so move it.
2025-02-26syscallcompat: rename thread_credentials files to include "linux"Jakob Unterwurzacher
As with the other files, include "linux" because the code only builds on linux renamed: internal/syscallcompat/thread_credentials.go -> internal/syscallcompat/thread_credentials_linux.go renamed: internal/syscallcompat/thread_credentials_368_arm.go -> internal/syscallcompat/thread_credentials_linux_368_arm.go renamed: internal/syscallcompat/thread_credentials_other.go -> internal/syscallcompat/thread_credentials_linux_other.go
2025-02-26syscallcompat: add asUser for darwin and make OpenatUser and friends sharedJakob Unterwurzacher
2025-02-26syscallcompat: move asUser to its own fileJakob Unterwurzacher
2025-02-23tests/root_test: add TestConcurrentUserOps and TestAsUserSleepJakob Unterwurzacher
Both work with golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a but break with golang.org/x/sys v0.30.0 https://github.com/rfjakob/gocryptfs/issues/893 https://github.com/rfjakob/gocryptfs/issues/892
2025-02-17tests: root_test: add TestMainJakob Unterwurzacher
I will add more tests for https://github.com/rfjakob/gocryptfs/issues/893 soon, these will also use DefaultPlainDir.
2025-02-17syscallcompat: add SetgroupsPanic,SetregidPanic,SetreuidPanicJakob Unterwurzacher
Will use those later.
2025-02-09github ci: also run on arm64github-arm64Jakob Unterwurzacher
2025-02-06syscallcompat: add thread_credentials.go & friendsJakob Unterwurzacher
Private copies of per-thread Setreuid/Setegid/Setgroups. https://github.com/rfjakob/gocryptfs/issues/893 https://github.com/rfjakob/gocryptfs/issues/892
2025-02-02github ci: unbreak upload-artifactJakob Unterwurzacher
Error: This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
2025-01-23README: add links for v2.5.1 issuesrfjakob
2025-01-23README: v2.5.1v2.5.1Jakob Unterwurzacher
2025-01-23go.mod: downgrade golang.org/x/sysJakob Unterwurzacher
The commit https://github.com/golang/sys/commit/d0df966e6959f00dc1c74363e537872647352d51 unix: support all Setuid/Setgid and related syscalls on Linux" changed the behavoir of Setreuid() and Setregid() to affect the whole process instead of just the current thread. This broke syscallcompat.asUser() which uses runtime.LockOSThread() plus Setreuid(). Partially revert 08b6ed16919b27a12a3228b17689d5d6d69eb10e bringing us back to a golang.org/x/sys version with the old behavoir. Fixes https://github.com/rfjakob/gocryptfs/issues/893
2025-01-23tests: add issue893.sh, a reproducer for #893 "mariadb crashing since 2.5.0"Jakob Unterwurzacher
https://github.com/rfjakob/gocryptfs/issues/893
2025-01-21README: mention known issue #893Jakob Unterwurzacher
2025-01-19README: mention go-fuse updateJakob Unterwurzacher
2025-01-18README: fix outdated go report card linkJakob Unterwurzacher
2025-01-18reverse: lookupDiriv: use deriveDirIV helperJakob Unterwurzacher
2025-01-18README: changelog for v2.5.0v2.5.0Jakob Unterwurzacher
2025-01-18tests: reverse: TestMtimePlus10: fix darwin buildJakob Unterwurzacher
Darwin does not have Stat_t.mtim: + go test -c -tags without_openssl -o /dev/null github.com/rfjakob/gocryptfs/v2/tests/reverse Error: tests/reverse/correctness_test.go:407:15: name_stat.Mtim undefined (type syscall.Stat_t has no field or method Mtim) Error: tests/reverse/correctness_test.go:407:37: long_stat.Mtim undefined (type syscall.Stat_t has no field or method Mtim) Error: tests/reverse/correctness_test.go:410:15: name_stat.Ctim undefined (type syscall.Stat_t has no field or method Ctim) Error: tests/reverse/correctness_test.go:410:37: long_stat.Ctim undefined (type syscall.Stat_t has no field or method Ctim) Error: tests/reverse/correctness_test.go:424:16: diriv_stat.Mtim undefined (type syscall.Stat_t has no field or method Mtim) Error: tests/reverse/correctness_test.go:424:42: workdirA_stat.Mtim undefined (type syscall.Stat_t has no field or method Mtim) Error: tests/reverse/correctness_test.go:427:16: diriv_stat.Ctim undefined (type syscall.Stat_t has no field or method Ctim) Error: tests/reverse/correctness_test.go:427:42: workdirA_stat.Ctim undefined (type syscall.Stat_t has no field or method Ctim) Switch to os.Stat.
2025-01-18tests: skip TestFileHoleCopy for nowJakob Unterwurzacher
This problem potentially causes extra disk usage for sparse files but is otherwise harmless. Skip the test for now.
2025-01-18go.mod: update golang.org/x/cryptoJakob Unterwurzacher
Closes https://github.com/rfjakob/gocryptfs/pull/883 Closes https://github.com/rfjakob/gocryptfs/security/dependabot/10
2025-01-18reverse: advance mtime & ctime for virtual files by 10 secondsJakob Unterwurzacher
With inode number reuse and hard links, we could have returned wrong data for gocryptfs.diriv and gocryptfs.xyz.longname files, respectively (https://github.com/rfjakob/gocryptfs/issues/802). Now that this is fixed, ensure that rsync and similar tools pick up the new correct files by advancing mtime and ctime by 10 seconds, which should be more than any filesytems' timestamp granularity (FAT32 has 2 seconds).
2025-01-18tests: reverse: factor out newWorkdirJakob Unterwurzacher
Will be used in a new test in the next commit.
2024-12-30manpage: fix typo in -passfile examplePaul Pazderski
2024-12-05ci: allow manual executionJakob Unterwurzacher
https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflow_dispatch
2024-12-04tests: ignore pidfd in fd leak testJakob Unterwurzacher
This is not a real leak: fd leak in test process? before, after: [0r=/dev/null 3r=/proc/940141/fd 5rw=anon_inode:[eventfd] (filtered: pipe:[2454797], pipe:[2454797], anon_inode:[eventpoll])] [0r=/dev/null 3r=/proc/940141/fd 5rw=anon_inode:[eventfd] 12rw=anon_inode:[pidfd] (filtered: pipe:[2454797], pipe:[2454797], anon_inode:[eventpoll], pipe:[2460158])] Ignore pidfd.
2024-12-04gocryptfs -passwd: fix the tests I just brokeJakob Unterwurzacher
Turns out at least the tests depended on the old behavoir. Fixes d5bd98eb3f4cbfb8dd9d0b2eb64dbff69c3c88b1
2024-12-04gocryptfs -passwd: ignore -extpass and -passfile for new passwordJakob Unterwurzacher
Using the same "-extpass" or "-passfile" for both old and new password makes little sense, and it causes real problems as seen here: https://github.com/rfjakob/gocryptfs/discussions/882 I hope nobody depends on this or I'll have to revert. Fixes https://github.com/rfjakob/gocryptfs/issues/287 Fixes https://github.com/rfjakob/gocryptfs/discussions/882
2024-12-04changePassword: drop useless castJakob Unterwurzacher
2024-12-04passfile: drop byte counter from trailing garbage warningJakob Unterwurzacher
We don't know the exact value as we only read 2kiB. Relates-to: https://github.com/rfjakob/gocryptfs/discussions/882
2024-11-11Report inode number for the root nodeJakob Unterwurzacher
Now that https://github.com/hanwen/go-fuse/issues/399 has landed we can report an inode number for the root node. Fixes https://github.com/rfjakob/gocryptfs/issues/580
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-13 16:50:30 +0000