Serialize updates to the shared exception pointer and retain the first
reported error. Test concurrent failures through all three handlers,
exception cleanup and subsequent successful work.
Close admission and retain references for accepted requests, KDF workers
and submitters until they stop using pool resources. Run new work
synchronously while stopping, then join workers and release handles.
Test queued work, delayed requester wakeup, fallback and restart.
Join created workers and release allocated handles when startup fails before
the pool is published. Close worker handles on normal shutdown as well.
Test each startup allocation failure and subsequent restart.
Hold a requester reference until header parsing can no longer enqueue KDFs.
This prevents stale completion signals from allowing cleanup while workers
still use request-owned state.
Add bounded tests of the production pool and caller completion protocol.
Capture the parent before releasing a fragment slot on Windows and Unix.
This removes the completion code's dependency on the first-fragment slot
holding up the ring until the requester observes completion.
Use per-context software SHA-256/SHA-512 after a failed state save
without changing global dispatch. Return an error and clear Argon2's
output before its accelerated core can run.
Tests/response_apdu_test.cpp was not run by any workflow. Build and run
it in the Linux workflow before the packages are built, and start the
workflow when the test changes. Changes to the code it covers already
start it.
An empty language file made VeraCrypt access the first element of an
empty vector, and any language file without a language element crashed
it at startup, when LanguageStrings::Init took the first element of an
empty node list. A file with an unterminated tag made initialization
fail instead, so VeraCrypt could not start until the preferences file
was edited. Read the file only if it is not empty, and ignore a
language file that cannot be parsed or has no language element, keeping
the built-in English strings.
Also fall back when the optional language file cannot be opened or
read completely. Catch I/O failures at the resource loader, leaving
preference-loading errors outside the handler.
LoadFile read the file size with GetFileSize without its high-order
part, so a file of 4 GiB or more was loaded as if it were only as large
as its size modulo 4 GiB, without any error. Refuse such files with
ERROR_FILE_TOO_LARGE instead.
ApduProcessData sent GET RESPONSE for as long as the card answered
0x61XX, allowing an endless loop and unbounded response growth. Limit
each chain to 256 follow-up commands and erase the partial response
if the limit is exceeded.
PSE directory enumeration had a separate unbounded loop with an
eight-bit record counter. Read only records 1 through 254, stop on an
empty or unsuccessful response, and limit the accumulated directory
data to 254 short records before parsing. Malformed TLV responses
consume this budget too, so they cannot bypass either limit.
EMVToken::EMVCards keeps every EMV card that was read, together with
the ICC and issuer public key certificates and the CPLC data that make
up its keyfile, and keeps the card connected. Closing all security
token sessions, the option to close them after mounting and wiping the
cache on auto-dismount only closed PKCS#11 sessions, so this data
stayed in memory until VeraCrypt exited.
Add Token::CloseAllSessions, which also releases the cached cards so
that their data is erased and their connection closed, and use it
wherever all sessions are closed. This resolves the "TODO Use Token"
notes at these call sites on Windows.
Keep the EMV cache private and serialize reader enumeration, card reads,
and cache cleanup with the same mutex. Closing sessions waits for active
reads to release their local card references before erasing the cache,
so a read cannot race destruction or insert its card after cleanup.
PCSCException::Show on Windows was derived from the PKCS#11 version
but kept its trailing %s without the matching argument, so any PC/SC
error without a message of its own was formatted from a missing
argument. Remove the extra conversion.
Both platforms label these errors with PCSC_ERROR, which no language
file defined, so users saw a placeholder such as ?PCSC_ERROR? instead.
Append the English text to all language files as a fallback.
Unknown codes were printed in decimal after a 0x prefix. Print them in
hexadecimal, as Pkcs11Exception does.
Token::getTokenKeyfile returned null for a path that is neither a
PKCS#11 nor an EMV token path, and every caller dereferenced the
result. Keyfile application validates the path beforehand, but the
text-mode export does not, so entering an ordinary file path at the
--export-token-keyfile prompt crashed VeraCrypt. Throw
InvalidSecurityTokenKeyfilePath instead, which the user interfaces
already report.
Use a single file-length measurement for both the non-empty check
and the vector allocation in GUI and text token imports. Reject
lengths exceeding vector::max_size before converting to size_t,
while retaining the cleanup guard before reading.
EMV keyfile cleanup did not cover APDU response storage, temporary
copies, or transport buffers on exceptions. Wipe responses on clear,
replacement, destruction and growth, avoid redundant response and PAN
copies, and install transport cleanup guards before use.
Add standalone checks for erasure before release, aliasing, allocation
failures, exception unwinding and const TLV input.
BufferPtr::Erase() previously delegated to Zero()/memset even though
its current callers use it to wipe sensitive data. Expand burn()
directly in the inline Erase implementation, matching VeraCrypt's
established erasure design without adding an out-of-line wrapper.
Install vector-referencing cleanup guards before token keyfile reads
and fetches in the four GUI and text-mode import/export paths. This
ensures partially populated data is wiped when an operation throws
and avoids retaining a stale BufferPtr if the vector reallocates.
Reject empty token exports before accessing vector::front().
Memory::Zero(), Buffer::Erase(), and the existing password guards
remain unchanged.
Co-authored-by: Damian Rickard <damian@rickard.us>
Remove obsolete MFC prerequisites and replace outdated assembler images
with version checks. Clarify release configurations, Spectre libraries,
and signing instructions.
Verified the guide end-to-end on a clean Windows 11 + VS2022 Community
17.14 machine (Release|x64 and Release|Win32 both build with 0 errors).
Fixes for the issues found along the way:
- Recommend a current NASM release instead of 2.08 (2010); NASM 2.16.03
verified against all assembly sources. Fix the Path example for the
64-bit installer location.
- Simplify YASM setup: the build only invokes yasm.exe from the Path.
Drop the zip/vsyasm download and the YASMPATH system variable, which
nothing in the build references.
- Add a "Common build errors" section to Known Issues mapping the three
errors every default VS2022 install hits (MSB8040 Spectre libs, C1083
atlbase.h, MSB8066 exit 9009) to the components that fix them.
- Explain why the Release|Win32 pass is needed (Setup/Portable/COMReg
are only built by that configuration).
Addresses #1488.
Co-authored-by: 0xDarkMatter <0xDarkMatter@users.noreply.github.com>
Use the Windows SDK winres.h header in Driver.rc and its resource-editor
metadata. Remove the obsolete MFC include-path override from the legacy
driver build script.
Check wrapper type alignment in both test suites so incidental alignment
can't hide an empty CRYPTOPP_ALIGN_DATA, including in ASan builds.
Clarify that the compiler may fold the existing address checks.
The macro falls through to an empty definition for the MSVC bootloader build
(TC_WINDOWS_BOOT) and for compilers that are neither MSVC nor GCC/Clang. The
ks and ks2 members of CRYPTO_INFO are compiled into the bootloader and are
declared with it, so the caveat is reachable.
The macro expands to nothing for compilers that are neither MSVC nor
GCC/Clang, and the SIMD backends issue aligned loads against buffers declared
with it, so a silent expansion to nothing would fault at run time. Nothing
verified this so far.
Add TC_IS_ALIGNED next to the existing alignment constants and check both of
them from the platform self-test suites. The probe buffers stay below the
alignment under test because the ABI already aligns larger objects by itself,
which would make the check pass vacuously.
The check is skipped in the Windows driver: a failing self-test there reaches
TC_BUG_CHECK and would bugcheck the machine.
Add a Troubleshooting entry for volume files that root cannot open on a
file system mounted by the user, such as a GVfs share: what VeraCrypt
now does, why the share and the session must stay available, when
keyfiles stored there can be used, and the alternatives of a kernel CIFS
mount or allow_root. Add release notes for the requester access and its
effect on NFS with root_squash.
The test compiles the requester helper code into a small harness and runs
it as root on an ordinary file owned by an unprivileged user. It checks
that the helper runs in a freshly executed process with a reduced
environment, descriptors 0-2 on /dev/null and no other inherited
descriptor, with and without close_range, including when a library is
found only through LD_LIBRARY_PATH, as in the AppImage. It also checks
that a failed or incomplete start is reported as a startup failure and
never falls back to read-only access, and that invalid requests and a
request socket whose peer is not root are refused.
As an unprivileged user, the test mounts a passthrough FUSE fixture
without allow_other, so that root is denied as with a GVfs share. It then
runs VeraCrypt as root with the sudo attribution of that user. It covers
writable and read-only mounting, the read-only fallbacks, missing or
invalid attribution, wrong passwords, special files, hidden volume
protection, slow servers, timestamp restoration and the mount warning.
A volume file opened with the credentials of the requesting user is
served by a file system that belongs to that user's session. Ejecting
the share or logging out while the volume is mounted can lose data, and
GVfs does not refuse to eject a share whose file is in use. Warn after
each such mount that the share must stay mounted and the session active
until the volume is unmounted. Append the English message to all
language files as a fallback.
The indicator reaches the UI with the mount result, through a new
MountVolumeRequestV2/ResponseV2 pair: a service that predates it rejects
the new request before mounting, and legacy requests keep their legacy
response, so that an older UI still works with a newer service. The
control file format is unchanged.
A FUSE file system mounted without allow_other, such as a GVfs share,
denies root access to files that its owner can open. Mounting a volume
stored there, or formatting a new one with a non-FAT file system, failed
with "Permission denied".
When root is denied opening an existing volume file, re-execute
VeraCrypt with the internal option --requester-helper. The helper
permanently takes the credentials of the user who requested elevation
through sudo or doas, opens the file and passes the descriptor back.
Root does all I/O through that descriptor and mounts the volume through
the FUSE volume image. Another helper restores the timestamps when the
FUSE service closes the file.
This also lets volumes on NFS with root_squash mount read-write instead
of falling back to read-only.
Fixes#23
* Fix build with NOSSE2
Disable AESNI and SHANI code that depends on SSE2 availability if NOSSE2
is enabled.
* Fix NOSSE2 builds while preserving runtime AES acceleration
Keep AES/Camellia acceleration enabled and honor NOSSE2 with NOAESNI.
Include stddef.h outside UEFI to provide wchar_t for Camellia.
Match the SHA probe guard to its implementation, keeping NOASM and
UEFI exclusions.
---------
Co-authored-by: Mounir IDRASSI <mounir.idrassi@amcrypto.jp>
Use a size_t counter in burn so large erasures retain their full length.
Install cleanup guards before token verification and keyfile application,
including the Windows token export path.
Reserve the complete EMV keyfile output before copying its components,
and wipe temporary components on every exit. Erase cached card data before
clearing or replacing it, including when copying a card fails.
Validation: Linux console and GUI builds with algorithm tests; cleanup
checks with GCC and Clang UBSan. PR 1816 still applies cleanly.
Unmounting released the loop device and device-mapper devices recorded
at mount time, by name. After a dismount that failed partway, for
example on a busy auxiliary FUSE mount, these names could be reused by
unrelated objects, which the listing then showed as the volume's and a
retry, emergency cleanup, filesystem check or auto-dismount released.
Without kernel cryptography, the loop device, which carries the
decrypted volume, was also released while the filesystem was mounted
elsewhere or the device was held open. A failed mount could remove a
pre-existing device-mapper device of the same name, and a failed
cascade mount could leave its layers and loop device behind.
Each destructive step now acts only on a device verified to belong to
the volume. A loop device must be bound to the container or volume
image (LOOP_GET_STATUS64). Device-mapper devices get the UUID
VERACRYPT-<serial>-<name> and are removed by UUID; those of earlier
versions, which have none, are verified through their sysfs slaves,
and the dismount fails, saying why, if that is not possible. Emergency
cleanup is not offered then, as it would hide the volume but leave its
devices. While the filesystem is mounted elsewhere, the dismount fails
and keeps the volume's devices. With kernel cryptography, the loop
device is marked for autoclear as soon as it is attached and verified,
so the kernel detaches it once device-mapper releases it; a process
holding it open sees only ciphertext and does not fail the dismount.
Without kernel cryptography, the dismount also fails while the loop
device is held open. Dismount, emergency cleanup, filesystem check and
the listing re-read the volume's devices from its auxiliary mount, and
the English emergency warning mentions these causes.
Add Tests/test_linux_loop_identity.py, covering these cases with and
without kernel cryptography, and with --legacy-binary, volumes mounted
by an earlier version. All 89 checks pass, as do the 11 added by
--legacy-binary 1.26.29; 1.26.29 itself fails 21 of the 89.
Return the SetWindowPlacement result so SC_RESTORE falls back to
normal handling on failure.
Describe the observed window state without assuming its cause.
* Windows: bring the main window back on screen when its restore position is off screen
A minimized window is parked by Windows at (-32000,-32000). When the display
topology changes while it is minimized - which happens on every session lock
that powers off a monitor - Windows can copy that parking position into the
window's restore rectangle and clear WS_MINIMIZE. The window then is, by every
API, a normal visible window living 32000 pixels off screen: IsIconic returns
FALSE, IsWindowVisible returns TRUE, and ShowWindow (SW_RESTORE) is a no-op
because the restore rectangle is exactly where the window already is.
The user is left with an application that answers its notification area icon
but whose main window cannot be shown by any means, and only restarting
VeraCrypt recovers it.
Validate the restore rectangle and re-center it on the primary monitor when it
intersects none. The repair runs from the three paths that show the window and,
because clicking the taskbar button of an already visible window runs no
application code at all, also on WM_DISPLAYCHANGE. showCmd is left as
GetWindowPlacement returned it, so a legitimately minimized window stays
minimized and only its future restore position is corrected.
The window size is captured once after the dialog has been laid out: a parked
window carries the parking size, so it cannot serve as a source for the normal
dimensions.
Verified on Windows 11 26200.8875 with two monitors at different scale factors,
the primary one being powered off by the session lock: GetWindowPlacement
returned rcNormalPosition = (-32000,-32000)-(-31840,-31972), and neither a
notification area click nor an explicit minimize/restore cycle brought the
window back.
* Windows: fix the size, offset and trigger of the main window repair
The size used by RepairMainWindowPlacement was measured on the window at
the end of InitMainDialog whenever the window was not minimized. In the
state the repair handles, the window is not minimized but has the
parking dimensions, and InitMainDialog can run on it, for example when
the language is changed from Preferences opened from the notification
area. The font compensation then grows the height and keeps the parking
width, so the kept size became 160x456. The size is now taken once from
the newly created window, whose width never changes, and follows the
font compensation only while the window has that width: in a window as
narrow as a parked one the menu bar wraps and moves the controls down,
so the compensation height is meaningless there too.
A restore rectangle that is no larger than a minimized window in either
dimension is now repaired. Before, both dimensions had to be that small,
so a 160x456 rectangle was left as it was.
The repaired position was converted with the work area origin of the
primary monitor, and the visibility test passed rcNormalPosition to
MonitorFromRect unconverted. Workspace coordinates are offset by the
position of the work area within the monitor associated with the
window, so the offset of that monitor is now used, both to convert a
copy of the rectangle to screen coordinates for the visibility test and
to express the repaired position. With an appbar on the left, a window
just beyond the right edge was taken as visible; with an appbar on top
of the primary monitor only, a window repaired on another monitor was
placed too high.
The repair also runs on WM_ACTIVATE. The session notification that
triggers it after an unlock is registered only while the background task
is enabled, and activating a window that is not minimized, from its
taskbar button or with Alt+Tab, runs none of the other repair paths.
Two comments that said a taskbar click runs none of our code are
corrected.
* Show Secure Desktop dialogs on the monitor of their parent window
Dialogs shown through SecureDesktopDialogBoxParam (the password prompt,
mount options and the security token PIN prompt) are created on the
Secure Desktop without an owner, because their parent window stays on
the original desktop. Without an owner, DS_CENTER puts them on the
primary monitor even when the main window is on another one, so the
password is typed on one monitor and the wait dialog then appears on
the other.
Before switching desktops, take the middle of the work area of the
monitor that Windows associates with the parent window, and create a
hidden owner window at that point on the Secure Desktop. The DS_CENTER
dialog is then centered on the same monitor as without Secure Desktop,
and the dialogs opened from it follow it. If the parent window is hidden
or minimized, or the owner can't be created, the dialog has no owner as
before.
The monitor lookup added to ShowWaitDialogEx in #1865 moves into a
helper used by both.
* Windows: read signed coordinates in the Keyfiles context menu handlers
The WM_CONTEXTMENU handlers of the password dialog, the mount options
dialog and the VeraCrypt Expander password dialog took the click
position with LOWORD and HIWORD and compared it with the signed
rectangle from GetWindowRect. On a monitor to the left of or above the
primary one the screen coordinates are negative, LOWORD and HIWORD
return them as large positive values, and a right click on the
Keyfiles button was ignored. Use GET_X_LPARAM and GET_Y_LPARAM, as the
other WM_CONTEXTMENU handlers in Mount.c already do.
Now that the Secure Desktop prompt opens on the monitor of its parent
window, this case is easier to reach.
The Linux workflow checks the content of the Tests/*.hc volumes by
mounting them, which needs root, FUSE and the installed package, and so
only runs on x86_64. Add a test that recovers the same data through the
volume layer instead, so it also runs on other architectures, e.g. on the
big-endian cross build under qemu-user.
Tests/volume_read_test.cpp opens a volume read-only and reads its data
area with Volume::ReadSectors: in one call, as multi-sector ranges at
nonzero offsets with odd sector counts, again with the encryption thread
pool running, and one sector at a time; every read must match the first.
CPU features are detected as in the application, and the character set
is taken from the environment (LC_CTYPE) so that paths with non-ASCII
characters work; if that locale is unavailable, the test continues in the
C locale and says so.
Tests/test_volume_read.py builds it against Volume.a and Platform.a of a
finished standard Linux build (CXX and NM can be set for a cross build)
and checks the plaintext of every Tests/test.*.hc volume: the FAT boot
sector, DUMMY.TXT with the content "Dummy" at the cluster given by the
root directory, and a known SHA-256 digest of the whole data area. A
volume without a digest, or a digest without a volume, is an error.
It runs in the Linux workflow after the .deb build and in the build job
of the big-endian workflow (test.sha512.hc only in the automatic check,
all volumes in the full run), and requires the thread pool there.
Signed-off-by: Ville Takio <ville+git@takio.fi>
Look up NixOS helpers only when trusted system metadata identifies NixOS
and each path component passes ownership and permission checks. Keep the
existing helper search on other distributions.
Detect NoNewPrivs before prompting for administrator credentials, with a
clear error for restricted launchers. Add regression coverage to Linux CI
and append the English fallback message to all language files.
Refs #1911
With DEBUG enabled, including StringConverter.h reaches SystemLog.h through
PlatformBase.h before StringConverter is declared. The inline
WriteException implementation then fails to compile.
Move WriteException into Unix/SystemLog.cpp and include StringConverter.h
there, keeping the logging behavior unchanged while removing the header
dependency cycle.
Mounir IDRASSI
PatriccolluandGitHub
nkh0472andGitHub
MatthaiksandGitHub
Mounir IDRASSI
Jonatan NybergandGitHub
Marius KjærstadandGitHub
Bernard LadenthinandGitHub
amail80andGitHub
Ville TakioandGitHub