{"id":138552,"date":"2025-06-30T11:11:56","date_gmt":"2025-06-30T09:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dostupen-cryptsetup-2-8-s-podderzhkoj-inline-rezhima-hraneniya-metadannyh"},"modified":"2025-06-30T11:11:56","modified_gmt":"2025-06-30T09:11:56","slug":"dostupen-cryptsetup-2-8-s-podderzhkoj-inline-rezhima-hraneniya-metadannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/dostupen-cryptsetup-2-8-s-podderzhkoj-inline-rezhima-hraneniya-metadannyh","title":{"rendered":"K dispozici je Cryptsetup 2.8 s podporou inline re\u017eimu pro ukl\u00e1d\u00e1n\u00ed metadat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Byl zve\u0159ejn\u011bn set n\u00e1stroj\u016f Cryptsetup 2.8, ur\u010den\u00fd pro konfiguraci \u0161ifrov\u00e1n\u00ed diskov\u00fdch odd\u00edl\u016f v Linuxu pomoc\u00ed modulu dm-crypt. Podporov\u00e1na je pr\u00e1ce s odd\u00edly dm-crypt, LUKS, LUKS2, BITLK, loop-AES a TrueCrypt\/VeraCrypt. Sou\u010d\u00e1st\u00ed jsou tak\u00e9 n\u00e1stroje veritysetup a integritysetup pro nastaven\u00ed kontroly integrity dat na z\u00e1klad\u011b modul\u016f dm-verity a dm-integrity. <\/p>\n
Byla p\u0159id\u00e1na podpora inline re\u017eimu, kter\u00fd umo\u017e\u0148uje pou\u017e\u00edvat roz\u0161\u00ed\u0159en\u00e9 sektory s dodate\u010dnou oblast\u00ed pro ukl\u00e1d\u00e1n\u00ed metadat. Takov\u00e9 sektory podporuj\u00ed n\u011bkter\u00e9 NVMe \u00falo\u017ei\u0161t\u011b, kter\u00e1 umo\u017e\u0148uj\u00ed krom\u011b oblasti s daty um\u00edstit do sektoru tak\u00e9 blok metadat (nap\u0159. 4096 byt\u016f pro data + 64 byt\u016f pro metadata).\n
Cryptsetup m\u016f\u017ee vyu\u017e\u00edt oblast metadat v sektoru pro ukl\u00e1d\u00e1n\u00ed servisn\u00edch informac\u00ed, co\u017e eliminuje pot\u0159ebu zav\u00e1d\u011bn\u00ed dal\u0161\u00ed vrstvy zalo\u017een\u00e9 na dm-integrity, kter\u00e1 by se starala o alokaci m\u00edsta pro metadata. Odpov\u00eddaj\u00edc\u00edm zp\u016fsobem se lze obej\u00edt bez veden\u00ed protokolu dm-integrity, co\u017e je \u00fazk\u00e9 m\u00edsto negativn\u011b ovliv\u0148uj\u00edc\u00ed v\u00fdkon. V Linuxov\u00e9m j\u00e1d\u0159e jsou mo\u017enosti pot\u0159ebn\u00e9 pro pr\u00e1ci v inline re\u017eimu p\u0159\u00edtomny od verze 6.11. Pro aktivaci inline re\u017eimu byla p\u0159id\u00e1na volba \u2018\u2014integrity-inline\u2019. <\/p>\n
Byl p\u0159ipraven API Keyslot Context pro manipulaci se sloty kl\u00ed\u010d\u016f. Nov\u00fd API umo\u017enil roz\u0161\u00ed\u0159it funk\u010dnost mnoha existuj\u00edc\u00edch p\u0159\u00edkaz\u016f o takov\u00e9 funkce, jako je aktivace token\u016f, obnoven\u00ed pr\u00e1ce s pozastaven\u00fdm \u0161ifrovan\u00fdm za\u0159\u00edzen\u00edm a proveden\u00ed op\u011btovn\u00e9ho \u0161ifrov\u00e1n\u00ed (reencryption).\n
Do n\u00e1stroje cryptsetup byly p\u0159id\u00e1ny volby \u2018\u2014key-description\u2019 a \u2018\u2014new-key-description\u2019 pro p\u0159i\u0159azen\u00ed popisu k kl\u00ed\u010d\u016fm.\n
Byla zavedena mo\u017enost obnoven\u00ed pozastaven\u00e9 operace op\u011btovn\u00e9ho \u0161ifrov\u00e1n\u00ed (reencryption) pomoc\u00ed tokenu a kl\u00ed\u010d\u016f odd\u00edlu.\n
Do implementace p\u0159\u00edkazu \u2018repair\u2019 byla p\u0159id\u00e1na kontrola po\u0161kozen\u00ed oblast\u00ed se sloty kl\u00ed\u010d\u016f LUKS.\n
Do p\u0159\u00edkazu veritysetup byla p\u0159id\u00e1na volba \u2018\u2014error-as-corruption\u2019, p\u0159i kter\u00e9 jsou jak\u00e9koli chyby zpracov\u00e1v\u00e1ny jako po\u0161kozen\u00ed dat, a je tedy mo\u017en\u00e9 nastavit restart nebo p\u0159echod do stavu panic p\u0159i chyb\u00e1ch, pokud jsou pou\u017eity volby \u2018\u2014restart-on-corruption\u2019 a \u2018\u2014panic-on-corruption\u2019.\n
Byla p\u0159id\u00e1na voliteln\u00e1 mo\u017enost vyu\u017eit\u00ed knihovny Mbed-TLS jako kryptografick\u00e9ho backendu (aktivuje se p\u0159i kompilaci s volbou \u2018\u2014with-crypto_backend=mbedtls\u2019). <\/ul>\n