RootPtr createConfig( EncFS_Context *ctx,
const shared_ptr<EncFS_Opts> &opts )
{
const std::string rootDir = opts->rootDir;
bool enableIdleTracking = opts->idleTracking;
bool forceDecode = opts->forceDecode;
const std::string passwordProgram = opts->passwordProgram;
bool useStdin = opts->useStdin;
bool reverseEncryption = opts->reverseEncryption;
ConfigMode configMode = opts->configMode;
bool annotate = opts->annotate;
RootPtr rootInfo;
// creating new volume key.. should check that is what the user is
// expecting...
// xgroup(setup)
cout << _("Creating new encrypted volume.") << endl;
char answer[10] = {0};
if(configMode == Config_Prompt)
{
// xgroup(setup)
cout << _("Please choose from one of the following options:\n"
" enter \"x\" for expert configuration mode,\n"
" enter \"p\" for pre-configured paranoia mode,\n"
" anything else, or an empty line will select standard mode.\n"
"?> ");
if (annotate)
cerr << "$PROMPT$ config_option" << endl;
char *res = fgets( answer, sizeof(answer), stdin );
(void)res;
cout << "\n";
}
int keySize = 0;
int blockSize = 0;
CipherV1::CipherAlgorithm alg;
Interface nameIOIface;
int blockMACBytes = 0;
int blockMACRandBytes = 0;
bool uniqueIV = false;
bool chainedIV = false;
bool externalIV = false;
bool allowHoles = true;
long desiredKDFDuration = NormalKDFDuration;
if (reverseEncryption)
{
uniqueIV = false;
chainedIV = false;
externalIV = false;
blockMACBytes = 0;
blockMACRandBytes = 0;
}
if(configMode == Config_Paranoia || answer[0] == 'p')
{
if (reverseEncryption)
{
LOG(ERROR) << "Paranoia configuration not supported for --reverse";
return rootInfo;
}
// xgroup(setup)
cout << _("Paranoia configuration selected.") << "\n";
// look for AES with 256 bit key..
// Use block filename encryption mode.
// Enable per-block HMAC headers at substantial performance penalty..
// Enable per-file initialization vector headers.
// Enable filename initialization vector chaning
keySize = 256;
blockSize = DefaultBlockSize;
alg = findCipherAlgorithm("AES", keySize);
nameIOIface = BlockNameIO::CurrentInterface();
blockMACBytes = 8;
blockMACRandBytes = 0; // using uniqueIV, so this isn't necessary
uniqueIV = true;
chainedIV = true;
externalIV = true;
desiredKDFDuration = ParanoiaKDFDuration;
} else if(configMode == Config_Standard || answer[0] != 'x')
{
// xgroup(setup)
cout << _("Standard configuration selected.") << "\n";
// AES w/ 192 bit key, block name encoding, per-file initialization
// vectors are all standard.
keySize = 192;
blockSize = DefaultBlockSize;
alg = findCipherAlgorithm("AES", keySize);
blockMACBytes = 0;
externalIV = false;
nameIOIface = BlockNameIO::CurrentInterface();
if (reverseEncryption)
{
cout << _("--reverse specified, not using unique/chained IV")
<< "\n";
} else
{
uniqueIV = true;
chainedIV = true;
}
}
if(answer[0] == 'x' || alg.name.empty())
{
if(answer[0] != 'x')
{
// xgroup(setup)
cout << _("Sorry, unable to locate cipher for predefined "
"configuration...\n"
"Falling through to Manual configuration mode.");
} else
{
// xgroup(setup)
cout << _("Manual configuration mode selected.");
}
cout << endl;
// query user for settings..
alg = selectCipherAlgorithm();
keySize = selectKeySize( alg );
blockSize = selectBlockSize( alg );
nameIOIface = selectNameCoding( alg );
if (reverseEncryption)
{
cout << _("--reverse specified, not using unique/chained IV") << "\n";
} else
{
chainedIV = selectChainedIV();
uniqueIV = selectUniqueIV();
if(chainedIV && uniqueIV)
externalIV = selectExternalChainedIV();
else
{
// xgroup(setup)
cout << _("External chained IV disabled, as both 'IV chaining'\n"
"and 'unique IV' features are required for this option.")
<< "\n";
externalIV = false;
}
selectBlockMAC(&blockMACBytes, &blockMACRandBytes);
allowHoles = selectZeroBlockPassThrough();
}
desiredKDFDuration = selectKDFDuration();
}
shared_ptr<CipherV1> cipher = CipherV1::New( alg.iface, keySize );
if(!cipher)
{
LOG(ERROR) << "Unable to instanciate cipher " << alg.name
<< ", key size " << keySize << ", block size " << blockSize;
return rootInfo;
} else
{
VLOG(1) << "Using cipher " << alg.name
<< ", key size " << keySize << ", block size " << blockSize;
}
EncfsConfig config;
config.mutable_cipher()->MergeFrom( cipher->interface() );
config.set_block_size( blockSize );
config.mutable_naming()->MergeFrom( nameIOIface );
config.set_creator( "EncFS " VERSION );
config.set_revision( ProtoSubVersion );
config.set_block_mac_bytes( blockMACBytes );
config.set_block_mac_rand_bytes( blockMACRandBytes );
config.set_unique_iv( uniqueIV );
config.set_chained_iv( chainedIV );
config.set_external_iv( externalIV );
config.set_allow_holes( allowHoles );
EncryptedKey *key = config.mutable_key();
key->clear_salt();
key->clear_kdf_iterations(); // filled in by keying function
key->set_kdf_duration( desiredKDFDuration );
key->set_size(keySize / 8);
cout << "\n";
// xgroup(setup)
cout << _("Configuration finished. The filesystem to be created has\n"
"the following properties:") << endl;
showFSInfo( config );
if( config.external_iv() )
{
cout <<
_("-------------------------- WARNING --------------------------\n")
<<
_("The external initialization-vector chaining option has been\n"
"enabled. This option disables the use of hard links on the\n"
"filesystem. Without hard links, some programs may not work.\n"
"The programs 'mutt' and 'procmail' are known to fail. For\n"
"more information, please see the encfs mailing list.\n"
"If you would like to choose another configuration setting,\n"
"please press CTRL-C now to abort and start over.") << endl;
cout << endl;
}
// xgroup(setup)
cout << _("Now you will need to enter a password for your filesystem.\n"
"You will need to remember this password, as there is absolutely\n"
"no recovery mechanism. However, the password can be changed\n"
"later using encfsctl.\n\n");
int encodedKeySize = cipher->encodedKeySize();
unsigned char *encodedKey = new unsigned char[ encodedKeySize ];
CipherKey volumeKey = cipher->newRandomKey();
// get user key and use it to encode volume key
CipherKey userKey;
VLOG(1) << "useStdin: " << useStdin;
if(useStdin)
{
if (annotate)
cerr << "$PROMPT$ new_passwd" << endl;
}
userKey = getNewUserKey( config, useStdin, passwordProgram, rootDir );
cipher->setKey( userKey );
cipher->writeKey( volumeKey, encodedKey );
userKey.reset();
key->set_ciphertext(encodedKey, encodedKeySize);
delete[] encodedKey;
if(!volumeKey.valid())
{
LOG(ERROR) << "Failure generating new volume key! "
<< "Please report this error.";
return rootInfo;
}
cipher->setKey( volumeKey );
if(!saveConfig( rootDir, config ))
return rootInfo;
// fill in config struct
shared_ptr<NameIO> nameCoder = NameIO::New( config.naming(), cipher );
if(!nameCoder)
{
LOG(WARNING) << "Name coding interface not supported";
cout << _("The filename encoding interface requested is not available")
<< endl;
return rootInfo;
}
nameCoder->setChainedNameIV( config.chained_iv() );
nameCoder->setReverseEncryption( reverseEncryption );
FSConfigPtr fsConfig (new FSConfig);
fsConfig->cipher = cipher;
fsConfig->key = volumeKey;
fsConfig->nameCoding = nameCoder;
fsConfig->config = shared_ptr<EncfsConfig>(new EncfsConfig(config));
fsConfig->forceDecode = forceDecode;
fsConfig->reverseEncryption = reverseEncryption;
fsConfig->idleTracking = enableIdleTracking;
fsConfig->opts = opts;
rootInfo = RootPtr( new EncFS_Root );
rootInfo->cipher = cipher;
rootInfo->volumeKey = volumeKey;
rootInfo->root = shared_ptr<DirNode>(
new DirNode( ctx, rootDir, fsConfig ));
return rootInfo;
}
// Read a boost::serialization config file using an Xml reader..
bool readV6Config( const char *configFile,
EncfsConfig &cfg, ConfigInfo *info)
{
(void)info;
XmlReader rdr;
if (!rdr.load(configFile))
{
LOG(ERROR) << "Failed to load config file " << configFile;
return false;
}
XmlValuePtr serialization = rdr["boost_serialization"];
XmlValuePtr config = (*serialization)["cfg"];
if (!config) {
config = (*serialization)["config"];
}
if (!config) {
LOG(ERROR) << "Unable to find XML configuration in file " << configFile;
return false;
}
int version;
if (!config->read("version", &version) &&
!config->read("@version", &version)) {
LOG(ERROR) << "Unable to find version in config file";
return false;
}
// version numbering was complicated by boost::archive
if (version == 20 || version >= 20100713)
{
VLOG(1) << "found new serialization format";
cfg.set_revision(version);
} else if (version == 26800)
{
VLOG(1) << "found 20080816 version";
cfg.set_revision(20080816);
} else if (version == 26797)
{
VLOG(1) << "found 20080813";
cfg.set_revision(20080813);
} else if (version < V5Latest)
{
LOG(ERROR) << "Invalid version " << version
<< " - please fix config file";
} else
{
LOG(INFO) << "Boost <= 1.41 compatibility mode";
cfg.set_revision(version);
}
VLOG(1) << "subVersion = " << cfg.revision();
config->read("creator", cfg.mutable_creator());
config->read("cipherAlg", cfg.mutable_cipher());
config->read("nameAlg", cfg.mutable_naming());
//(*config)["keySize"] >> cfg.keySize;
int blockSize, blockMacBytes, blockMacRandBytes;
bool uniqueIv, chainedNameIv, externalIv, allowHoles;
config->read("blockSize", &blockSize);
config->read("uniqueIV", &uniqueIv);
config->read("chainedNameIV", &chainedNameIv);
config->read("externalIVChaining", &externalIv);
config->read("blockMACBytes", &blockMacBytes);
config->read("blockMACRandBytes", &blockMacRandBytes);
config->read("allowHoles", &allowHoles);
cfg.set_block_size(blockSize);
cfg.set_unique_iv(uniqueIv);
cfg.set_chained_iv(chainedNameIv);
cfg.set_external_iv(externalIv);
cfg.set_block_mac_bytes(blockMacBytes);
cfg.set_block_mac_rand_bytes(blockMacRandBytes);
cfg.set_allow_holes(allowHoles);
EncryptedKey *encryptedKey = cfg.mutable_key();
int encodedSize;
config->read("encodedKeySize", &encodedSize);
unsigned char *key = new unsigned char[encodedSize];
config->readB64("encodedKeyData", key, encodedSize);
encryptedKey->set_ciphertext(key, encodedSize);
delete[] key;
int keySize;
config->read("keySize", &keySize);
encryptedKey->set_size(keySize / 8); // save as size in bytes
if(cfg.revision() >= 20080816)
{
int saltLen;
config->read("saltLen", &saltLen);
unsigned char *salt = new unsigned char[saltLen];
config->readB64("saltData", salt, saltLen);
encryptedKey->set_salt(salt, saltLen);
delete[] salt;
int kdfIterations, desiredKDFDuration;
config->read("kdfIterations", &kdfIterations);
config->read("desiredKDFDuration", &desiredKDFDuration);
encryptedKey->set_kdf_iterations(kdfIterations);
encryptedKey->set_kdf_duration(desiredKDFDuration);
} else
{
encryptedKey->clear_salt();
encryptedKey->set_kdf_iterations(16);
encryptedKey->clear_kdf_duration();
}
return true;
}
