"The worst offender in my experience is the "Verified by VISA" program. They restrict you to a subset of characters (alphanumeric, if I recall correctly) and even restrict the maximum length! You know what the worst part of it is, though? If they were using a widely-published, widely-analyzed, and widely-reviewed secure hash standard like SHA-1, Whirlpool, or any number of alternatives, these restrictions wouldn't be in place. This tells me that they're likely not using a well-reviewed standard, and instead have probably come up with their own bastardized password "encryption"."I'm a bit worried by this, but I'm moving my customers to Verfied by VISA and Mastercard 3DSecure because of the carrot-and-stick used by the payment gateways. Am I sleepwalking off the cliff here?
set -e
dev=$1
luks=$(mktemp)
cryptdev=$(basename $dev)_crypt
pvsize=$(pvs -o pe_start,pv_size --units s --noheadings --nosuffix "$dev" awk ' print $1 + $2 ')
devsize=$(blockdev --getsz "$dev")
mchunk=8
The script takes the physical volume device to convert as an argument. Note there is no check for the validity of its value.
dd of="$luks" seek=$devsize count=0 bs=512 2> /dev/null
luksdev=$(losetup -f)
losetup "$luksdev" "$luks"
trap "losetup -d \"$luksdev\"; rm -f \"$luks\"" EXIT
Next, we create a sparse luks file the same size as the device (in case luksFormat would use the size somehow, but I believe it doesn’t), and a loopback device on this file. The trap is here to avoid leaving the loopback device and the file when an error occurs later (though during the conversion itself, it will be pointless).
cryptsetup luksFormat -q "$luksdev"
cryptsetup luksOpen "$luksdev" $ cryptdev _real
read start length crypt format key IVoff cdev offset <<EOF
$(dmsetup table $ cryptdev _real)
EOF
We create a LUKS device, so that we can get the encryption key ($key), and the size of the LUKS header ($offset). Note you need to add –showkey to the dmsetup table command on sid.
if [ $(expr $devsize - $pvsize) -lt $offset ]; then
echo Not enough free space after LVM physical volume
cryptsetup luksClose $ cryptdev _real
exit
fi
Check we have enough space after the LVM physical volume to offset everything by the size of the LUKS header. If not, you can still try again after you reduce the size of the LVM physical volume by an extent.
if [ $(expr $devsize % $offset % $mchunk) -gt 0 ]; then
echo Last
cryptsetup luksClose $ cryptdev _real
exit
fi
This is another check to avoid surprises at the end, when dealing with the last chunk. As the script is written for the moment, it doesn’t support cases where this last chunk is not a multiple of $mchunk. So we need to abort in these.
read major minor <<EOF
$(stat -t "$dev" awk ' print $10,$11 ')
EOF
maps=$(dmsetup deps awk -F: "/\($major, $minor\)/ print \$1 ")
dmsetup create $cryptdev <<EOF
0 $length linear $dev 0
EOF
dmsetup reload $ cryptdev _real <<EOF
$start $length crypt $format $key $IVoff $dev $offset
EOF
dmsetup resume $ cryptdev _real
for map in $ maps ; do
dmsetup table "$map" sed s,$major:$minor,/dev/mapper/$cryptdev, dmsetup reload "$map"
dmsetup resume "$map"
done
Here, we create the dev_crypt device mapper that is our fake LUKS device, which starts as a simple linear mapper and will end as a complete crypt mapper. This fake LUKS device is inserted as an intermediate mapper between the LVM device mapper and the real device. So, the LVM device mapper will have this fake LUKS device as backend, and, at the beginning, the fake LUKS device maps linearly to the real device.
Note we look for all device mappers using the real device as backend before creating the fake LUKS device to avoid finding the fake LUKS device in the list.
Also note dmsetup reload only loads a new table in the INACTIVE slot, and dmsetup resume makes this inactive table LIVE.
cursor=$length
chunk=$offset
while [ $cursor -gt 0 ]; do
cursor=$(expr $cursor - $chunk)
if [ $cursor -lt 0 ]; then
chunk=$(expr $chunk + $cursor)
cursor=0
fi
(
[ $cursor -ne 0 ] && echo 0 $cursor linear $dev 0
echo $cursor $chunk mirror core 1 $mchunk 2 $dev $cursor /dev/mapper/$ cryptdev _real $cursor
[ $cursor -lt $(expr $length - $chunk) ] && echo $(expr $cursor + $chunk) $(expr $length - $cursor - $chunk) crypt $format $key $(expr $IVoff + $cursor + $chunk) $dev $(expr $offset + $cursor + $chunk)
) dmsetup reload "$cryptdev"
dmsetup resume "$cryptdev"
chunks=$(expr $chunk / $mchunk)
while ! dmsetup status "$cryptdev" grep "$chunks/$chunks"; do
true
done
done
This is where the main work is done : moving the data around. We actually just let the device mapper deal with the data duplication, $offset blocks by $offset blocks ($offset being the LUKS header size), using a mirror target for the chunk being moved. So our disk looks like the following:
dmsetup status, dmsetup wait doesn’t seem to be very helpful here.
dmsetup reload "$cryptdev" <<EOF
$start $length crypt $format $key $IVoff $dev $offset
EOF
dmsetup resume "$cryptdev"
dmsetup remove "$ cryptdev _real"
dd if="$luks" of=$dev count=$offset bs=512 2> /dev/null
Final steps of the conversion : our dev_crypt device becomes a full LUKS volume, so we can remove dev_crypt_real and add the LUKS headers at the top of the device we converted.
At this moment, the LUKS volume is setup just as if it had been setup by cryptsetup. For LVM to recognize the change properly, you need to run pvscan. Once you ran it, you can do whatever you want with LVM.
Now, you may want to add the following to your /etc/crypttab file:
$cryptdev $dev none luks
i.e. hda5_crypt /dev/hda5 none luks if the device was /dev/hda5.
And if the LVM volume you converted contains your root filesystem, you should run (for Debian systems):
update-initramfs -u
I tested this successfully under qemu and will give it a shot on my laptop some time soon.
Now, because I had a hard time not finding much about the mirror target of the device mapper, here is what I could gather about it. The target syntax is as follows:
<logical_start_sector> <num_sectors> mirror [ core disk ] <num_params> <param> ... <num_mirrors> [ <destination > <start_sector> ] ...
logical_start_sector, num_sectors, destination and start_sector have the same meaning as in other targets.core and disk are two different log types (to track differences between mirrors), respectively in memory and on disk.num_params and params depend on the log type:
core, num_params can be either 1 or 2.region_size, which is the size (in blocks) of the chunks the mirror log tracks for synchronization. It can’t be less than the page size divided by 512, i.e. 8 on x86, must be a power of 2, and must not exceed num_sectors. Apparently, it is not a problem if num_sectors is not a multiple of region_size.sync or nosync, meaning of which I’m not sure. I think it determines whether the mirror should do the initial synchronization (sync) or not (nosync).disk, num_params can be either 2 or 3, with params being log_device (device where the logs are kept), region_size, as above, and an optional sync or nosync, as above too.num_mirrors is the number of mirrors and for each mirror, we have a pair destination and start_sector.
[ Update: after a quick look at the device mapper source code in Linus’s git tree, updated the mirror target description ]

alioth% /var/lib/gforge/chroot/home/users/adeodato/bzr-hookless-email/alioth_helper.sh $PROJECT_NAME -d(And ensure that the process does not die, or gets restarted when it does. I guess I could add code for that in the helper script, hm.)
fnreduce :: [(a->a)]->a->a
fnreduce [] value = value
fnreduce (a:as) value = freduce as $ a value
fnreduce as value = (foldr (flip (.)) id as) value
f . (g . (h . id)) = ((id . f) . g) . h
fnreduce as value = foldr (.) id (reverse as) value
fnreduce as value = foldl (flip ($)) value as
module Test where
data TransformList a b where
Nil :: TransformList a a
Cons :: (a -> b) -> TransformList b c -> TransformList a c
apply :: TransformList a b -> a -> b
apply Nil = id
apply (Cons f fs) = (apply fs) . f
> apply (Cons (\x -> x + 1) (Cons (\x -> show x) Nil)) 5
"6"
> ((\x -> show x) . (\x -> x + 1)) 5
"6"
traceIntermediates Nil x = (x, [])
traceIntermediates (Cons f l) x = let x' = f x
(x'', ss) = traceIntermediates l x'
in
(x'', (show x'):ss)
data ShowTransformList a b where
Nil :: (Show a) => ShowTransformList a a
Cons :: (Show a, Show b, Show c) => (a -> b) -> ShowTransformList b c -> ShowTransformList a c
traceIntermediates :: ShowTransformList a b -> a -> (b, [String])
traceIntermediates Nil x = (x, [])
traceIntermediates (Cons f l) x = let x' = f x
(x'', ss) = traceIntermediates l x'
in
(x'', (show x'):ss)
apply :: ShowTransformList a b -> a -> b
apply Nil = id
apply (Cons f fs) = (apply fs) . f
> traceIntermediates
(Cons (\x -> x + 1)
(Cons (\x -> x * 2)
(Cons (\x -> x - 5)
(Cons show
(Cons (read :: String -> Double)
Nil))))) 5
(7.0,["6","12","7","\"7\"","7.0"])
(Some more pics from there are in
Maykel Moya's gallery
Tomorrow: Geeks On A Train
Also an eye from
native English speakers will be appreciated, no matter if you speak
Vim or not.
PS please do not tell bzed about that, he will probably be hating
me for "wasting" time on Vim rather then on polishing the first Zenoss package
ever
elegiac$ dcmd scp -C /tmp/1/dasher_4.4.2-1.dsc romain@yeast:/tmpIts only limitation is that the .dsc/.changes must be local in order for Python to parse it.
dasher_4.4.2.orig.tar.gz 100% 8728KB 4.3MB/s 00:02
dasher_4.4.2-1.diff.gz 100% 5231 5.1KB/s 00:00
dasher_4.4.2-1.dsc 100% 1259 1.2KB/s 00:00
elegiac$
elegiac$ dcmd sha1sum dasher_4.4.2-2_amd64.changesSound useful?
87cd6eb29d5f54c1547b2bf7531a0e303dbc2fa3 dasher_4.4.2-2.dsc
70d0729c8955309efa230832cf5e82bd5e28cf7c dasher_4.4.2-2.diff.gz
a5c15d3e6c3b297897651e9a5aa40451c73b2420 dasher-data_4.4.2-2_all.deb
68383058289fb41cdf19d57225afafafd4032719 dasher_4.4.2-2_amd64.deb
481e2008ad78be0721335634954dbe3a0439914b dasher_4.4.2-2_amd64.changes
elegiac$
There s still a lot of work waiting for Fabio, Stefano and me, but it s great to see the first results. It s really great to work together with them, here on the Debconf. I m really happy that I can be here. At the moment we re waiting for Sean Finney no arrive, as we have some questions about dbconfig-common.
hacklab pano 3
Again, here s another pano from the hacklab 1, taken yesterday evening. Sorry for the bad stitching, didn t have the time to fix it, but I hope it ll still give am impression of the great atmosphere here in the Teviot.
THE GATHERING OF THE INDIGENOUS PEOPLE OF THE AMERICAS Which will take place the 11st, 12nd, 13rd, and 14th days of October, 2007 in the community of V cam, Yaqui Territory, Municipality of Guaymas, State of Sonora, Mexico, to address the following
TOPICS
1 The war of capitalist conquest in the indigenous communities in the Americas.
2 The resistance of the indigenous peoples of the Americas and our defense of
mother earth, our territories, and our cultures.
3 Why do we, the indigenous peoples of the Americas, struggle?
ORGANIZATIONAL PRINCIPLES
1st Principal. Delegates, observers, and communications media workers attending the Gathering will abide by the regulations of the Yaqui Tribe devised by their Traditional Authorities in order to govern their presence while in attendance.
2nd Principal. All participating indigenous communities, tribes, and nations are invited to demonstrate their clothing, songs, dances, and other traditional forms of expression.
3rd Principal. Authorities and Representatives of indigenous communities, tribes, and nations of the Americas are invited to participate as delegates with voice and vote.
4th Principal. Individuals and members of social movements and civil organizations in solidarity with the struggles of indigenous peoples of the Americas invited by the organizing commission will be able to participate as observers.
5th Principal. National and international communications media workers that are accredited by the organizing commission will be able to cover the event.
6th Principal. All agreements adopted at the Gathering will be made by consensus of the participants and not through the method of voting.
7th Principal. Organization of the Gathering, the national and international distribution of its publicity, as well as accreditation of participating delegates, invitees, and any unforeseen issues will be resolved only by the organizing commission in conformity with the Traditional Authorities of the Community of V cam, Yaqui Tribe, The National Indigenous Congress (CNI), and the Sixth Commission of the Zapatista National Liberation Front.
Information: 1. Office of the Sixth Commission of the EZLN, located on Zapotecos St. No 7 Col.Obrera, C.P. 06800 Mexico, D.F. Telephone: (01 or 011) 55 67 61 42 36 Monday thru Friday, 10 AM 8 PM., Saturday, 10 AM 6 PM.
webpage: www.encuentroindignea.org e-mail: informes@encuentroindigena.org
2. Official Precinct Office of the Traditional Guard of the Yaqui Tribe, Vicam Station ,Colonia Yaqui, Municipio de Guaymas, Sonora, Mexico. Telephone: (045 or 001) 64 49 98 94 08.
3. Office of the Organization of Indigenous and Campesino Communities, de Tuxpan, Jalisco, in Nicolas Bravo, No. 65 , Tuxpan, Jalisco,. Telephone: (01 or 011) 371 41 764 15 from Monday Saturday, 10 AM 8 PM. e-mail: comunidad_tuxpan@hotmail.com
Written - April 22nd, 2007 in Tohono O Odham Territory of the Tohono O Odham Nation, Sonora, Mexico.
Attentively,
Wa-a itom yo Lutu-ria yoribetchibo, intoka a Wiutinepo Amani
(Por el respeto a nuestros usos y costumbres, nuestra identidad y cultura y nuestra verdad que permanezcan en el tiempo y no se olviden)
Never Again, a Mexico Without Us ~ Liberty, Justice, and Democracy
Nde Cultural Historical Organization
(Organizaci n Cultural e Hist rica de la Naci n Nde/Apache)
Tierra y Libertad / Chicana Indigenous Organization, Tucson, Arizona
(Tierra y Libertad / Organizaci n Xicana Ind gena, Tucson, Arizona
Native and Immigrant Indigenous Development Organization
(Desarrollo de Los Pueblos Indios Inmigrantes y Nativos, A.C.)
Michelle Cook (Dene Nation)
(Nacion Dene/Navajo)
Tohono O Odham Nation Mexico United States
(Nacion Tohono O Odham M xico - Los Estados Unidos de America)
Traditonal Authorities of Vicam Community, Yaqui Tribe
(Autoridades Tradicionales del Pueblo V cam, Tribu Yaqui)
National indigenous Congress (Congreso Nacional Ind gena)
Clandestine Revolutionary Committee, General Command of
the Zapatista National Liberation Army (EZLN)
(Comit Clandestino Revolucionario Ind gena-Comandancia General del
Ej rcito Zapatista de Liberaci n Nacional)
Update: Here s another hackish pano of one of the hacklabs we re using since today. The stitching is not perfect again, I ll probably fix this when I m home again - or not
Next.