Free the key-info buffer and owned crypto context on pre-KDF errors,
preserving borrowed contexts and avoiding uninitialized drain resources.
Inject every setup allocation and event failure to verify cleanup.
Record cloning, formatting and allocation failures without allocating, then
complete and drain the request before reporting an error. This prevents
worker loss and avoids treating incomplete cipher or KDF output as valid.
Test ordinary exceptions, capture failures and subsequent pool recovery.
Retain accepted callers and KDF workers until completion, and run later
requests synchronously. Clear joined threads and unwind partial startup
so serialized restarts do not retain stale workers.
Cover shutdown boundaries and startup failures with gated tests.
Serialize updates to the shared exception pointer and retain the first
reported error. Test concurrent failures through all three handlers,
exception cleanup and subsequent successful work.
Close admission and retain references for accepted requests, KDF workers
and submitters until they stop using pool resources. Run new work
synchronously while stopping, then join workers and release handles.
Test queued work, delayed requester wakeup, fallback and restart.
Join created workers and release allocated handles when startup fails before
the pool is published. Close worker handles on normal shutdown as well.
Test each startup allocation failure and subsequent restart.
Hold a requester reference until header parsing can no longer enqueue KDFs.
This prevents stale completion signals from allowing cleanup while workers
still use request-owned state.
Add bounded tests of the production pool and caller completion protocol.
Capture the parent before releasing a fragment slot on Windows and Unix.
This removes the completion code's dependency on the first-fragment slot
holding up the ring until the requester observes completion.
Use per-context software SHA-256/SHA-512 after a failed state save
without changing global dispatch. Return an error and clear Argon2's
output before its accelerated core can run.
An empty language file made VeraCrypt access the first element of an
empty vector, and any language file without a language element crashed
it at startup, when LanguageStrings::Init took the first element of an
empty node list. A file with an unterminated tag made initialization
fail instead, so VeraCrypt could not start until the preferences file
was edited. Read the file only if it is not empty, and ignore a
language file that cannot be parsed or has no language element, keeping
the built-in English strings.
Also fall back when the optional language file cannot be opened or
read completely. Catch I/O failures at the resource loader, leaving
preference-loading errors outside the handler.
LoadFile read the file size with GetFileSize without its high-order
part, so a file of 4 GiB or more was loaded as if it were only as large
as its size modulo 4 GiB, without any error. Refuse such files with
ERROR_FILE_TOO_LARGE instead.
ApduProcessData sent GET RESPONSE for as long as the card answered
0x61XX, allowing an endless loop and unbounded response growth. Limit
each chain to 256 follow-up commands and erase the partial response
if the limit is exceeded.
PSE directory enumeration had a separate unbounded loop with an
eight-bit record counter. Read only records 1 through 254, stop on an
empty or unsuccessful response, and limit the accumulated directory
data to 254 short records before parsing. Malformed TLV responses
consume this budget too, so they cannot bypass either limit.
EMVToken::EMVCards keeps every EMV card that was read, together with
the ICC and issuer public key certificates and the CPLC data that make
up its keyfile, and keeps the card connected. Closing all security
token sessions, the option to close them after mounting and wiping the
cache on auto-dismount only closed PKCS#11 sessions, so this data
stayed in memory until VeraCrypt exited.
Add Token::CloseAllSessions, which also releases the cached cards so
that their data is erased and their connection closed, and use it
wherever all sessions are closed. This resolves the "TODO Use Token"
notes at these call sites on Windows.
Keep the EMV cache private and serialize reader enumeration, card reads,
and cache cleanup with the same mutex. Closing sessions waits for active
reads to release their local card references before erasing the cache,
so a read cannot race destruction or insert its card after cleanup.
PCSCException::Show on Windows was derived from the PKCS#11 version
but kept its trailing %s without the matching argument, so any PC/SC
error without a message of its own was formatted from a missing
argument. Remove the extra conversion.
Both platforms label these errors with PCSC_ERROR, which no language
file defined, so users saw a placeholder such as ?PCSC_ERROR? instead.
Append the English text to all language files as a fallback.
Unknown codes were printed in decimal after a 0x prefix. Print them in
hexadecimal, as Pkcs11Exception does.
Token::getTokenKeyfile returned null for a path that is neither a
PKCS#11 nor an EMV token path, and every caller dereferenced the
result. Keyfile application validates the path beforehand, but the
text-mode export does not, so entering an ordinary file path at the
--export-token-keyfile prompt crashed VeraCrypt. Throw
InvalidSecurityTokenKeyfilePath instead, which the user interfaces
already report.
Use a single file-length measurement for both the non-empty check
and the vector allocation in GUI and text token imports. Reject
lengths exceeding vector::max_size before converting to size_t,
while retaining the cleanup guard before reading.
EMV keyfile cleanup did not cover APDU response storage, temporary
copies, or transport buffers on exceptions. Wipe responses on clear,
replacement, destruction and growth, avoid redundant response and PAN
copies, and install transport cleanup guards before use.
Add standalone checks for erasure before release, aliasing, allocation
failures, exception unwinding and const TLV input.
BufferPtr::Erase() previously delegated to Zero()/memset even though
its current callers use it to wipe sensitive data. Expand burn()
directly in the inline Erase implementation, matching VeraCrypt's
established erasure design without adding an out-of-line wrapper.
Install vector-referencing cleanup guards before token keyfile reads
and fetches in the four GUI and text-mode import/export paths. This
ensures partially populated data is wiped when an operation throws
and avoids retaining a stale BufferPtr if the vector reallocates.
Reject empty token exports before accessing vector::front().
Memory::Zero(), Buffer::Erase(), and the existing password guards
remain unchanged.
Co-authored-by: Damian Rickard <damian@rickard.us>
Use the Windows SDK winres.h header in Driver.rc and its resource-editor
metadata. Remove the obsolete MFC include-path override from the legacy
driver build script.
Check wrapper type alignment in both test suites so incidental alignment
can't hide an empty CRYPTOPP_ALIGN_DATA, including in ASan builds.
Clarify that the compiler may fold the existing address checks.
The macro falls through to an empty definition for the MSVC bootloader build
(TC_WINDOWS_BOOT) and for compilers that are neither MSVC nor GCC/Clang. The
ks and ks2 members of CRYPTO_INFO are compiled into the bootloader and are
declared with it, so the caveat is reachable.
The macro expands to nothing for compilers that are neither MSVC nor
GCC/Clang, and the SIMD backends issue aligned loads against buffers declared
with it, so a silent expansion to nothing would fault at run time. Nothing
verified this so far.
Add TC_IS_ALIGNED next to the existing alignment constants and check both of
them from the platform self-test suites. The probe buffers stay below the
alignment under test because the ABI already aligns larger objects by itself,
which would make the check pass vacuously.
The check is skipped in the Windows driver: a failing self-test there reaches
TC_BUG_CHECK and would bugcheck the machine.
A volume file opened with the credentials of the requesting user is
served by a file system that belongs to that user's session. Ejecting
the share or logging out while the volume is mounted can lose data, and
GVfs does not refuse to eject a share whose file is in use. Warn after
each such mount that the share must stay mounted and the session active
until the volume is unmounted. Append the English message to all
language files as a fallback.
The indicator reaches the UI with the mount result, through a new
MountVolumeRequestV2/ResponseV2 pair: a service that predates it rejects
the new request before mounting, and legacy requests keep their legacy
response, so that an older UI still works with a newer service. The
control file format is unchanged.
A FUSE file system mounted without allow_other, such as a GVfs share,
denies root access to files that its owner can open. Mounting a volume
stored there, or formatting a new one with a non-FAT file system, failed
with "Permission denied".
When root is denied opening an existing volume file, re-execute
VeraCrypt with the internal option --requester-helper. The helper
permanently takes the credentials of the user who requested elevation
through sudo or doas, opens the file and passes the descriptor back.
Root does all I/O through that descriptor and mounts the volume through
the FUSE volume image. Another helper restores the timestamps when the
FUSE service closes the file.
This also lets volumes on NFS with root_squash mount read-write instead
of falling back to read-only.
Fixes#23
* Fix build with NOSSE2
Disable AESNI and SHANI code that depends on SSE2 availability if NOSSE2
is enabled.
* Fix NOSSE2 builds while preserving runtime AES acceleration
Keep AES/Camellia acceleration enabled and honor NOSSE2 with NOAESNI.
Include stddef.h outside UEFI to provide wchar_t for Camellia.
Match the SHA probe guard to its implementation, keeping NOASM and
UEFI exclusions.
---------
Co-authored-by: Mounir IDRASSI <mounir.idrassi@amcrypto.jp>
Use a size_t counter in burn so large erasures retain their full length.
Install cleanup guards before token verification and keyfile application,
including the Windows token export path.
Reserve the complete EMV keyfile output before copying its components,
and wipe temporary components on every exit. Erase cached card data before
clearing or replacing it, including when copying a card fails.
Validation: Linux console and GUI builds with algorithm tests; cleanup
checks with GCC and Clang UBSan. PR 1816 still applies cleanly.
Unmounting released the loop device and device-mapper devices recorded
at mount time, by name. After a dismount that failed partway, for
example on a busy auxiliary FUSE mount, these names could be reused by
unrelated objects, which the listing then showed as the volume's and a
retry, emergency cleanup, filesystem check or auto-dismount released.
Without kernel cryptography, the loop device, which carries the
decrypted volume, was also released while the filesystem was mounted
elsewhere or the device was held open. A failed mount could remove a
pre-existing device-mapper device of the same name, and a failed
cascade mount could leave its layers and loop device behind.
Each destructive step now acts only on a device verified to belong to
the volume. A loop device must be bound to the container or volume
image (LOOP_GET_STATUS64). Device-mapper devices get the UUID
VERACRYPT-<serial>-<name> and are removed by UUID; those of earlier
versions, which have none, are verified through their sysfs slaves,
and the dismount fails, saying why, if that is not possible. Emergency
cleanup is not offered then, as it would hide the volume but leave its
devices. While the filesystem is mounted elsewhere, the dismount fails
and keeps the volume's devices. With kernel cryptography, the loop
device is marked for autoclear as soon as it is attached and verified,
so the kernel detaches it once device-mapper releases it; a process
holding it open sees only ciphertext and does not fail the dismount.
Without kernel cryptography, the dismount also fails while the loop
device is held open. Dismount, emergency cleanup, filesystem check and
the listing re-read the volume's devices from its auxiliary mount, and
the English emergency warning mentions these causes.
Add Tests/test_linux_loop_identity.py, covering these cases with and
without kernel cryptography, and with --legacy-binary, volumes mounted
by an earlier version. All 89 checks pass, as do the 11 added by
--legacy-binary 1.26.29; 1.26.29 itself fails 21 of the 89.
Return the SetWindowPlacement result so SC_RESTORE falls back to
normal handling on failure.
Describe the observed window state without assuming its cause.
* Windows: bring the main window back on screen when its restore position is off screen
A minimized window is parked by Windows at (-32000,-32000). When the display
topology changes while it is minimized - which happens on every session lock
that powers off a monitor - Windows can copy that parking position into the
window's restore rectangle and clear WS_MINIMIZE. The window then is, by every
API, a normal visible window living 32000 pixels off screen: IsIconic returns
FALSE, IsWindowVisible returns TRUE, and ShowWindow (SW_RESTORE) is a no-op
because the restore rectangle is exactly where the window already is.
The user is left with an application that answers its notification area icon
but whose main window cannot be shown by any means, and only restarting
VeraCrypt recovers it.
Validate the restore rectangle and re-center it on the primary monitor when it
intersects none. The repair runs from the three paths that show the window and,
because clicking the taskbar button of an already visible window runs no
application code at all, also on WM_DISPLAYCHANGE. showCmd is left as
GetWindowPlacement returned it, so a legitimately minimized window stays
minimized and only its future restore position is corrected.
The window size is captured once after the dialog has been laid out: a parked
window carries the parking size, so it cannot serve as a source for the normal
dimensions.
Verified on Windows 11 26200.8875 with two monitors at different scale factors,
the primary one being powered off by the session lock: GetWindowPlacement
returned rcNormalPosition = (-32000,-32000)-(-31840,-31972), and neither a
notification area click nor an explicit minimize/restore cycle brought the
window back.
* Windows: fix the size, offset and trigger of the main window repair
The size used by RepairMainWindowPlacement was measured on the window at
the end of InitMainDialog whenever the window was not minimized. In the
state the repair handles, the window is not minimized but has the
parking dimensions, and InitMainDialog can run on it, for example when
the language is changed from Preferences opened from the notification
area. The font compensation then grows the height and keeps the parking
width, so the kept size became 160x456. The size is now taken once from
the newly created window, whose width never changes, and follows the
font compensation only while the window has that width: in a window as
narrow as a parked one the menu bar wraps and moves the controls down,
so the compensation height is meaningless there too.
A restore rectangle that is no larger than a minimized window in either
dimension is now repaired. Before, both dimensions had to be that small,
so a 160x456 rectangle was left as it was.
The repaired position was converted with the work area origin of the
primary monitor, and the visibility test passed rcNormalPosition to
MonitorFromRect unconverted. Workspace coordinates are offset by the
position of the work area within the monitor associated with the
window, so the offset of that monitor is now used, both to convert a
copy of the rectangle to screen coordinates for the visibility test and
to express the repaired position. With an appbar on the left, a window
just beyond the right edge was taken as visible; with an appbar on top
of the primary monitor only, a window repaired on another monitor was
placed too high.
The repair also runs on WM_ACTIVATE. The session notification that
triggers it after an unlock is registered only while the background task
is enabled, and activating a window that is not minimized, from its
taskbar button or with Alt+Tab, runs none of the other repair paths.
Two comments that said a taskbar click runs none of our code are
corrected.
* Show Secure Desktop dialogs on the monitor of their parent window
Dialogs shown through SecureDesktopDialogBoxParam (the password prompt,
mount options and the security token PIN prompt) are created on the
Secure Desktop without an owner, because their parent window stays on
the original desktop. Without an owner, DS_CENTER puts them on the
primary monitor even when the main window is on another one, so the
password is typed on one monitor and the wait dialog then appears on
the other.
Before switching desktops, take the middle of the work area of the
monitor that Windows associates with the parent window, and create a
hidden owner window at that point on the Secure Desktop. The DS_CENTER
dialog is then centered on the same monitor as without Secure Desktop,
and the dialogs opened from it follow it. If the parent window is hidden
or minimized, or the owner can't be created, the dialog has no owner as
before.
The monitor lookup added to ShowWaitDialogEx in #1865 moves into a
helper used by both.
* Windows: read signed coordinates in the Keyfiles context menu handlers
The WM_CONTEXTMENU handlers of the password dialog, the mount options
dialog and the VeraCrypt Expander password dialog took the click
position with LOWORD and HIWORD and compared it with the signed
rectangle from GetWindowRect. On a monitor to the left of or above the
primary one the screen coordinates are negative, LOWORD and HIWORD
return them as large positive values, and a right click on the
Keyfiles button was ignored. Use GET_X_LPARAM and GET_Y_LPARAM, as the
other WM_CONTEXTMENU handlers in Mount.c already do.
Now that the Secure Desktop prompt opens on the monitor of its parent
window, this case is easier to reach.
Look up NixOS helpers only when trusted system metadata identifies NixOS
and each path component passes ownership and permission checks. Keep the
existing helper search on other distributions.
Detect NoNewPrivs before prompting for administrator credentials, with a
clear error for restricted launchers. Add regression coverage to Linux CI
and append the English fallback message to all language files.
Refs #1911
With DEBUG enabled, including StringConverter.h reaches SystemLog.h through
PlatformBase.h before StringConverter is declared. The inline
WriteException implementation then fails to compile.
Move WriteException into Unix/SystemLog.cpp and include StringConverter.h
there, keeping the logging behavior unchanged while removing the header
dependency cycle.
* Build: let a parent make control the wxWidgets build jobs
The wxbuild target always runs the wxWidgets sub-make with -j 4. When
VeraCrypt is built from a parent "make -jN" (for example by a
distribution or embedded build system), the explicit -j 4 overrides the
parent's job count and jobserver: the wx build ignores -j1 and the
configured parallelism and can oversubscribe the machine.
Keep -j 4 as the default for a standalone build, but leave the job count
to the parent make when it was started with -j: MFLAGS then contains -j,
-jN or the jobserver option (-j1 since GNU make 4.2; older makes treat a
-j1 parent like a serial one without -j). MFLAGS is used rather than
MAKEFLAGS because it holds only options, not command-line variable
definitions, so a variable value containing "-j" cannot match.
See also #717, which proposed dropping -j 4 for the same reason.
Signed-off-by: Ville Takio <ville+git@takio.fi>
* Build: also detect grouped -j flags; pass OpenWrt jobs to wxbuild
Address review:
- GNU make 3.81 can group single-letter options in MFLAGS, e.g. "-sj"
for the -s this Makefile adds plus a bare -j, which the previous
pattern missed. Look for "j" in every single-dash option word instead,
skipping the options that take an argument (-C, -E, -I, -O, -W, -f,
-o). An option argument containing a space followed by "-j" can still
be mistaken for a job option; this is documented next to the variable.
- The OpenWrt recipe built wxWidgets without the package's job settings,
so it still ran 4 jobs. Pass $(PKG_JOBS) and an empty WX_MAKE_JOBS, so
the wxWidgets build follows OpenWrt's settings, including serial
builds.
Signed-off-by: Ville Takio <ville+git@takio.fi>
---------
Signed-off-by: Ville Takio <ville+git@takio.fi>
* Show mount/wait dialog on the monitor of the main window
* Place the wait dialog owner on the monitor chosen by MonitorFromWindow
Instead of the centre of the creator window, put the temporary owner in the
middle of the work area of the monitor returned by MonitorFromWindow
(MONITOR_DEFAULTTONEAREST). The centre point can lie on a different monitor
than most of the window when displays are offset, and Windows may make the
owner larger than the requested 1x1, so an owner close to a monitor edge
could spill onto the neighbouring monitor and take the wait dialog with it.
* Crypto: use alignment-safe loads and stores on all hosts
SHA-2, BLAKE2s, Twofish and Kuznyechik read and write words in caller
buffers directly on little-endian hosts, Streebog's stage2() reads 64-bit
words from the input, and the Unix XTS code XORs whitening values through
uint64 pointers. On strict-alignment CPUs (ARMv5-v7 for LDRD/LDM, MIPS,
mips64) this raises SIGBUS when a caller passes an unaligned buffer; real
volume operations use aligned buffers, but test vectors and future
callers need not.
- SHA-2, BLAKE2s, Twofish and Kuznyechik use the VcLoad*/VcStore* helpers
on all hosts, not only on big-endian ones.
- On GCC/Clang little-endian targets the helpers copy with memcpy, which
compiles to single loads and stores where unaligned access is allowed,
so the C paths keep their speed. MSVC targets keep native accesses, as
before.
- Streebog takes the direct path only for 8-byte-aligned input; other
input goes through the existing copy into CTX->buffer.
- XTS (Unix, without the x64 SSE path) XORs the whitening values through
memcpy.
Output is unchanged: known-answer comparisons for every offset from 0 to
15 match on x86_64, armv7, mips, mipsel and mips64, and an
alignment-checking (UBSan) build is clean.
Signed-off-by: Ville Takio <ville+git@takio.fi>
* Crypto: keep direct word accesses where unaligned access is safe
Address review: limit the alignment fix to the targets that need it.
VC_UNALIGNED_ACCESS_OK (config.h) is 1 on x86, x64, ARMv8 (including
MSVC ARM64) and PowerPC, where unaligned 32- and 64-bit accesses are
safe; there SHA-2, BLAKE2s, Twofish, Kuznyechik, Streebog and XTS
compile exactly as before. On other targets (32-bit ARM, whose
unaligned support does not cover LDRD/LDM, MIPS, ...), they load and
store through the VcLoad*/VcStore* helpers; SHA-2 keeps its byte swaps
and only the input load changes.
The object code of the changed files is identical to master with GCC
and Clang on x86_64 and with GCC on AArch64. On armv7, mips, mipsel and
mips64 (qemu-user), the known-answer outputs at buffer offsets 0..15
match x86_64.
Signed-off-by: Ville Takio <ville+git@takio.fi>
---------
Signed-off-by: Ville Takio <ville+git@takio.fi>
CRYPTOPP_ALLOW_UNALIGNED_DATA_ACCESS was defined whenever
__ARM_FEATURE_UNALIGNED is set, which includes 32-bit ARMv6/ARMv7. There
the hardware handles unaligned single-word loads and stores, but not
LDRD/STRD/LDM, which the compiler uses for 64-bit words. Camellia
(camellia_load64/camellia_store64) and Whirlpool (HashMultipleBlocks on
unaligned input) then access 64-bit words through unaligned pointers.
camellia_set_key() raised SIGBUS in the XTS self-test on an ARMv7
(cortex-a15) build whose test key happened to be only 2-byte aligned.
Define the macro for AArch64 only among the ARM targets; on 32-bit ARM
the memcpy and aligned-copy paths are used instead.
Signed-off-by: Ville Takio <ville+git@takio.fi>
* Argon2: fix build with -march=x86-64-v3/v4 and XOP targets
blamka-round-opt.h picked its SSE2, AVX2 or AVX-512 definitions only from
the compiler flags. With global flags such as -march=x86-64-v3 or
-march=x86-64-v4, opt_sse2.c (and with v4 also opt_avx2.c) saw __AVX2__
or __AVX512F__ and got definitions that do not match its code, so the
build failed.
Let opt_sse2.c and opt_avx2.c select the variant they implement, and
fall back to the compiler flags for other includers. This needs no new
compiler options, so it also works with old compilers and with the
plain objects used by NOASM=1 builds.
With XOP targets (-march=bdver*), the header skipped its
_mm_roti_epi64 fallback but did not include the intrinsic; include
<x86intrin.h> for GCC and Clang there.
Hashes are identical through the AVX2, SSE2 and reference code paths,
and match an unmodified build.
Fixes#1867
Refs #1871
* Argon2: update branch comments in blamka-round-opt.h
The #else/#endif comments still named __AVX2__ and __AVX512F__, but the
branches are now selected by ARGON2_BLAMKA_USE_SSE2/AVX2.
Refs #1867
MountVolumeNative attaches a loop device only for a volume in a file,
but it recorded the volume path as the loop device in every case. For
a volume on a block device mounted with kernel cryptography, that is
the host device itself, so DismountVolume and EmergencyDismountVolume
ran losetup -d on it. A loop device that the user had attached, for
example to open a volume inside a disk image, was detached, or marked
for autoclear when emergency cleanup ran while the filesystem was
busy. On other devices, such as partitions, losetup failed and was
retried for about 1.2 seconds before the error was ignored. This code
comes from TrueCrypt 7.1a.
Record the loop device only when MountVolumeNative attached one, as
its error path already does. A volume mounted by an earlier version
keeps its FUSE service after an upgrade, and that service still
reports the host device, so the unmount functions also skip a loop
device that is the volume's own path. A loop device that VeraCrypt
attached is never the volume path.
Validated with console builds as root, for volumes on a loop device,
on a partition of a loop device attached with --partscan, and with
--emergency-unmount while the filesystem was busy: losetup no longer
runs, the loop device stays attached, and the partition case unmounts
in 0.18 s instead of 1.43 s. The same holds when these volumes are
mounted by 1.26.29 and unmounted by this build. Volumes in files and
nokernelcrypto mounts still detach the loop device that VeraCrypt
attached, also when mounting fails.
* Crypto: fix portable C code on big-endian CPUs
On big-endian CPUs (e.g. MIPS and PowerPC) the portable C code of
several algorithms assumes a little-endian host, so ciphertext, hashes
and derived keys are wrong and "veracrypt --text --test" fails:
- Twofish: the key-dependent S-box bytes are read back from 32-bit
words through a union, and blocks are loaded/stored as native words.
- Camellia: blocks and keys are always byte-swapped to big-endian.
- Kuznyechik: keys and blocks are loaded/stored as native 64-bit words
while the tables expect the little-endian interpretation.
- SHA-256/SHA-512: message words, length and digest are always
byte-swapped.
- BLAKE2s: the parameter block and message words are read as native
little-endian data. The parameter block is now built from its fields,
so it is right for any parameters, not only the ones VeraCrypt uses.
- Streebog: the existing big-endian code path is never enabled, and
BSWAP64 used by it is not defined (its buffer512 initializer also has
one pair of braces too many). Its add512() also differs from the
little-endian one, which drops a carry on purpose (existing volumes
depend on it); do the same limb arithmetic on big-endian.
- misc.h: the rotate-based bswap_32 (non-Linux, non-Apple, non-MSVC
builds) lacks outer parentheses, so "bswap_32(a) ^ b" is parsed
wrongly, and the fallback bswap_64 does not parenthesise its argument.
- PBKDF2: the block number is always byte-swapped.
Swap only where the host byte order differs from the data, and enable
the Streebog big-endian path. On big-endian hosts the message words,
keys and blocks of SHA-2, BLAKE2s, Twofish and Kuznyechik are read and
written byte-wise (new VcLoad*/VcStore* inline helpers in misc.h), so
these paths also work on misaligned buffers on strict-alignment CPUs.
On little-endian CPUs the code is unchanged: the object files of all
touched sources are byte-identical before and after this change
(checked on x86_64, aarch64 and mipsel). With it, all self-tests pass on
mips (big-endian) under qemu.
Signed-off-by: Ville Takio <ville+git@takio.fi>
* Volume: avoid unaligned 64-bit header and test vector accesses
The volume header (de)serialisation and TestXtsAES read and write 64-bit
fields through casted pointers into byte buffers at offsets that are
only 4-byte aligned (e.g. the header field at offset 12). CPUs that trap
on misaligned access without kernel fix-up (SPARC, MIPS64 on some
systems, qemu-user) then fail with SIGBUS in "veracrypt --test" and when
creating or opening any volume. Use memcpy instead, and have
DeserializeEntryAt check that the whole entry, not only its start, lies
inside the header.
The XTS code also accesses its local byte arrays (whitening values,
data unit number) through uint64 pointers; declare them 8-byte aligned
instead of relying on the compiler's stack layout.
Signed-off-by: Ville Takio <ville+git@takio.fi>
* Volume: test multi-block PBKDF2 output and the Streebog carry case
The PBKDF2 self-tests only check the first 4 bytes of each derivation,
so the block counter of the second and later output blocks is never
checked. Also compare the complete output of a 192-byte derivation for
every PRF, which covers the later blocks and how they are joined, and
hash a message whose block sum hits the carry case of Streebog's
add512(), which has to stay bit-compatible across CPUs. The message
buffer is 8-byte aligned, as the portable Streebog code reads it as
64-bit words. The expected values are those of the existing
little-endian code, and match independent implementations for all five
PRFs (Python hashlib/hmac, OpenSSL for Whirlpool, gostcrypto for
Streebog).
Signed-off-by: Ville Takio <ville+git@takio.fi>
---------
Signed-off-by: Ville Takio <ville+git@takio.fi>
The FAT formatter stored multi-byte boot sector and FSInfo fields by
casting positions in the sector buffer to integer pointers, and
GetMaxHiddenVolumeSize read the outer volume's boot sector the same
way. Several FAT fields start at odd offsets (bytes per sector at 11,
root directory entry count at 17, total sectors at 19, and the volume
ID at 39 or 67), so these accesses were misaligned. That is undefined
behavior whatever the byte order, and it can fault on targets that
require aligned accesses. An alignment-sanitized build reported the
stores in PutBoot and, for FAT12 and FAT16 outer volumes, the read of
the root directory entry count.
Copy each field between the buffer and a local integer with memcpy,
keeping the Endian::Little conversions, and copy the volume ID as its
four random bytes. Fields at even offsets use the same helpers: they
were aligned only because the sector buffer comes from malloc. The FAT
scan for the last used cluster is unchanged; it reads 32-bit words at
multiples of four in a malloc'd buffer and only tests them for zero.
Validated with x86_64 builds using -fsanitize=alignment and big-endian
s390x builds under qemu. With fixed volume ID bytes, the formatter
output for 18 FAT12, FAT16 and FAT32 layouts, including the FAT32
backup boot sector, is byte-identical before and after. The hidden
volume size of 16 volumes created and populated through the CLI is
unchanged and matches a separate implementation; the s390x checks used
the big-endian crypto fixes from #1899 to open the volumes. The
sanitizer and trap builds no longer report these accesses.
Volumes encrypted in user space are mounted through a loop device on the
FUSE volume image, and their writes end in buffered pwrite() calls to the
backing file or device. The FUSE service had no fsync callback, so libfuse
answered the fsync requests that the loop device issues for block-layer
flushes with ENOSYS, which Linux FUSE reports as success. Synced data
could therefore remain dirty in the host cache, and writeback errors were
not reported.
Register an fsync callback that syncs the backing storage for the volume
image and returns its errors through the existing mapping. Never return
ENOSYS, which would make Linux FUSE stop forwarding fsync for the whole
mount: report a backing ENOSYS as EIO, as the loop driver does, and
return success for the other files. Other Unix platforms are outside this
change.
Add regression coverage on device- and file-backed volumes: fsync must
flush the backing device, a backing failure must be reported as EIO, and
synced data must survive a simulated power cut. Without this change, the
synced data is lost. Validated with FUSE2 and FUSE3 builds.
Without dmsetup, MountVolumeNative fails with "dmsetup not found in
system directories" instead of using the FUSE path, so on systems that
do not ship device-mapper tools (for example OpenWrt) every mount and
the filesystem formatting step of --create need an explicit
--mount-options=nokernelcrypto. Treat a missing dmsetup like the other
cases where kernel crypto cannot be used.
Signed-off-by: Ville Takio <ville+git@takio.fi>
Mounir IDRASSI
Mounir IDRASSI
Bernard LadenthinandGitHub
amail80andGitHub
Ville TakioandGitHub
felixandGitHub