kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Pass /dev/pkey file descriptor through to all functions

Browse Source 
To be able to calculate the key verification pattern of a key blob without
the use of AF_ALG, the file descriptor of the /dev/pkey device needs to
be passed through to all functions that might need to calculate the key
verification pattern.

Also make sure that all commands that might need to calculate the key
verification pattern have 'need_pkey_device = 1' so that the device is
opened.

Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2026-06-08 11:42:42 +02:00
committed by Jan Höppner
parent 30ce11b8da
commit 44d6020774
10 changed files with 131 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
zkey/keystore.c
View File

@@ -1612,12 +1612,14 @@ struct keystore *keystore_new(const char *directory,
* @param[in] vp buffer filled with the verification pattern
* @param[in] vp_len length of the buffer. Must be at
* least VERIFICATION_PATTERN_LEN bytes in size.
* @param[in] pkey_fd the pkey file descriptor
*
* @returns 0 for success or a negative errno in case of an error
*/
static int _keystore_generate_verification_pattern(struct keystore *keystore,
const char *keyfile,
char *vp, size_t vp_len)
const char *keyfile,
char *vp, size_t vp_len,
int pkey_fd)
{
size_t key_size;
u8 *key;
@@ -1626,12 +1628,13 @@ static int _keystore_generate_verification_pattern(struct keystore *keystore,
util_assert(keystore != NULL, "Internal error: keystore is NULL");
util_assert(keyfile != NULL, "Internal error: keyfile is NULL");
util_assert(vp != NULL, "Internal error: vp is NULL");
util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1");
key = read_secure_key(keyfile, &key_size, keystore->verbose);
if (key == NULL)
return -EIO;
rc = generate_key_verification_pattern(key, key_size,
rc = generate_key_verification_pattern(pkey_fd, key, key_size,
vp, vp_len, keystore->verbose);
free(key);
@@ -1645,12 +1648,14 @@ static int _keystore_generate_verification_pattern(struct keystore *keystore,
* @param[in] keystore the key store
* @param[in] file_names the file names of the key
* @param[in] key_props the properties of the key
* @param[in] pkey_fd the pkey file descriptor
*
* @returns 0 for success or a negative errno in case of an error
*/
static int _keystore_ensure_vp_exists(struct keystore *keystore,
const struct key_filenames *file_names,
struct properties *key_props)
struct properties *key_props,
int pkey_fd)
{
char vp[VERIFICATION_PATTERN_LEN];
char *temp;
@@ -1664,7 +1669,8 @@ static int _keystore_ensure_vp_exists(struct keystore *keystore,
rc = _keystore_generate_verification_pattern(keystore,
file_names->skey_filename,
vp, sizeof(vp));
vp, sizeof(vp),
pkey_fd);
if (rc != 0)
return rc;
@@ -2051,6 +2057,7 @@ out:
* @param[in] passphrase_file the file name of a file containing a passphrase
* for LUKS2 (optional, can be NULL)
* @param[in] kms the name of the KMS plugin, or NULL if no KMS is bound
* @param[in] pkey_fd the pkey file descriptor
*
* @returns 0 on success, or a negative errno value on error
*/
@@ -2065,7 +2072,8 @@ static int _keystore_create_info_file(struct keystore *keystore,
const char *key_type,
bool gen_passphrase,
const char *passphrase_file,
const char *kms)
const char *kms,
int pkey_fd)
{
struct properties *key_props = NULL;
int rc;
@@ -2088,7 +2096,8 @@ static int _keystore_create_info_file(struct keystore *keystore,
}
}
rc = _keystore_ensure_vp_exists(keystore, filenames, key_props);
rc = _keystore_ensure_vp_exists(keystore, filenames, key_props,
pkey_fd);
if (rc != 0) {
warnx("Failed to generate the key verification pattern: %s",
strerror(-rc));
@@ -2232,7 +2241,7 @@ int keystore_generate_key(struct keystore *keystore, const char *name,
description, volumes, apqns,
noapqncheck, sector_size, volume_type,
key_type, gen_passphrase,
passphrase_file, NULL);
passphrase_file, NULL, pkey_fd);
if (rc != 0)
goto out_free_props;
@@ -2279,6 +2288,7 @@ out_free_key_filenames:
* @param[in] kms_options an array of KMS options specified, or NULL if no
* KMS options have been specified
* @param[in] num_kms_options the number of options in above array
* @param[in] pkey_fd the pkey file descriptor
*
* @returns 0 for success or a negative errno in case of an error
*/
@@ -2288,7 +2298,7 @@ int keystore_generate_key_kms(struct keystore *keystore, const char *name,
const char *volume_type, const char *key_type,
bool gen_passphrase, const char *passphrase_file,
struct kms_option *kms_options,
size_t num_kms_options)
size_t num_kms_options, int pkey_fd)
{
struct key_filenames file_names = { 0 };
struct properties *key_props = NULL;
@@ -2305,6 +2315,7 @@ int keystore_generate_key_kms(struct keystore *keystore, const char *name,
util_assert(keystore != NULL, "Internal error: keystore is NULL");
util_assert(name != NULL, "Internal error: name is NULL");
util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1");
kms_info = keystore->kms_info;
if (kms_info->plugin_lib == NULL) {
@@ -2371,7 +2382,8 @@ int keystore_generate_key_kms(struct keystore *keystore, const char *name,
keybits, file_names.skey_filename,
_keystore_passphrase_file_exists(&file_names) ?
file_names.pass_filename : NULL,
kms_options, num_kms_options, keystore->verbose);
kms_options, num_kms_options, keystore->verbose,
pkey_fd);
if (rc != 0) {
warnx("KMS plugin '%s' failed to generate key '%s': %s",
kms_info->plugin_name, name, strerror(-rc));
@@ -2383,7 +2395,8 @@ int keystore_generate_key_kms(struct keystore *keystore, const char *name,
if (rc != 0)
goto out_free_props;
rc = _keystore_ensure_vp_exists(keystore, &file_names, key_props);
rc = _keystore_ensure_vp_exists(keystore, &file_names, key_props,
pkey_fd);
if (rc != 0) {
warnx("Failed to generate the key verification pattern: %s",
strerror(-rc));
@@ -2460,6 +2473,7 @@ out_free_key_filenames:
* for LUKS2 (optional, can be NULL)
* @param[in] exportable if true the key shall be exportable
* @param[in] lib the external library struct
* @param[in] pkey_fd the pkey file descriptor
*
* @returns 0 for success or a negative errno in case of an error
*/
@@ -2469,7 +2483,7 @@ int keystore_import(struct keystore *keystore, unsigned char *secure_key,
const char *apqns, bool noapqncheck, size_t sector_size,
const char *volume_type, bool gen_passphrase,
const char *passphrase_file, bool exportable,
struct ext_lib *lib)
struct ext_lib *lib, int pkey_fd)
{
struct key_filenames file_names = { 0 };
struct properties *key_props = NULL;
@@ -2591,7 +2605,7 @@ write_key:
description, volumes, apqns,
noapqncheck, sector_size, volume_type,
key_type, gen_passphrase,
passphrase_file, NULL);
passphrase_file, NULL, pkey_fd);
if (rc != 0)
goto out_free_props;
@@ -2636,6 +2650,7 @@ out_free_key_filenames:
* for LUKS2 (optional, can be NULL)
* @param[in] exportable if true the key shall be exportable
* @param[in] lib the external library struct
* @param[in] pkey_fd the pkey file descriptor
*
* @returns 0 for success or a negative errno in case of an error
*/
@@ -2644,7 +2659,7 @@ int keystore_import_key(struct keystore *keystore, const char *name,
const char *apqns, bool noapqncheck, size_t sector_size,
const char *import_file, const char *volume_type,
bool gen_passphrase, const char *passphrase_file,
bool exportable, struct ext_lib *lib)
bool exportable, struct ext_lib *lib, int pkey_fd)
{
size_t secure_key_size;
u8 *secure_key;
@@ -2660,7 +2675,7 @@ int keystore_import_key(struct keystore *keystore, const char *name,
rc = keystore_import(keystore, secure_key, secure_key_size, name,
description, volumes, apqns, noapqncheck,
sector_size, volume_type, gen_passphrase,
passphrase_file, exportable, lib);
passphrase_file, exportable, lib, pkey_fd);
if (secure_key != NULL)
free(secure_key);
@@ -2698,6 +2713,7 @@ int keystore_import_key(struct keystore *keystore, const char *name,
* @param[in] remove_passphrase if true, remove the (dummy) passphrase
* @param[in] quiet if true no confirmation prompt is shown when removing
* a (dummy) passphrase
* @param[in] pkey_fd the pkey file descriptor
*
* @returns 0 for success or a negative errno in case of an error
*
@@ -2707,7 +2723,7 @@ int keystore_change_key(struct keystore *keystore, const char *name,
const char *apqns, bool noapqncheck,
long int sector_size, const char *volume_type,
bool gen_passphrase, const char *passphrase_file,
bool remove_passphrase, bool quiet)
bool remove_passphrase, bool quiet, int pkey_fd)
{
struct volume_check vol_check = { .keystore = keystore, .name = name,
.set = 0, .nocheck = 0 };
@@ -2731,6 +2747,7 @@ int keystore_change_key(struct keystore *keystore, const char *name,
util_assert(keystore != NULL, "Internal error: keystore is NULL");
util_assert(name != NULL, "Internal error: name is NULL");
util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1");
rc = _keystore_get_key_filenames(keystore, name, &file_names);
if (rc != 0)
@@ -2960,7 +2977,8 @@ int keystore_change_key(struct keystore *keystore, const char *name,
}
}
rc = _keystore_ensure_vp_exists(keystore, &file_names, key_props);
rc = _keystore_ensure_vp_exists(keystore, &file_names, key_props,
pkey_fd);
/* ignore return code, vp generation might fail if key is not valid */
rc = _keystore_set_timestamp_property(key_props, PROP_NAME_CHANGE_TIME);
@@ -3890,7 +3908,7 @@ static int _keystore_process_reencipher(struct keystore *keystore,
goto out;
rc = _keystore_ensure_vp_exists(keystore, file_names,
properties);
properties, info->pkey_fd);
if (rc != 0) {
warnx("Failed to generate the key verification pattern "
"for key '%s': %s", file_names->skey_filename,
@@ -5940,6 +5958,7 @@ struct kms_import {
unsigned long num_imported;
unsigned long num_skipped;
unsigned long num_failed;
int pkey_fd;
};
/**
@@ -6144,7 +6163,8 @@ prompt_alt_name:
if (rc != 0)
goto out_remove;
rc = generate_key_verification_pattern(secure_key, secure_key_size,
rc = generate_key_verification_pattern(import_data->pkey_fd,
secure_key, secure_key_size,
vp, sizeof(vp),
keystore->verbose);
if (rc != 0) {
@@ -6235,6 +6255,7 @@ out:
* with an already existing name is to be imported.
* @param[in] novolcheck if true, do not check the associated volumes for
* existence and duplicate use
* @param[in] pkey_fd the pkey file descriptor
*
* @returns 0 for success or a negative errno in case of an error
*/
@@ -6245,12 +6266,14 @@ int keystore_import_kms_keys(struct keystore *keystore,
const char *volume_type,
struct kms_option *kms_options,
size_t num_kms_options,
bool batch_mode, bool novolcheck)
bool batch_mode, bool novolcheck,
int pkey_fd)
{
struct kms_import import_data = { 0 };
int rc;
util_assert(keystore != NULL, "Internal error: keystore is NULL");
util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1");
if (keystore->kms_info->plugin_lib == NULL) {
warnx("The repository is not bound to a KMS plugin");
@@ -6269,6 +6292,7 @@ int keystore_import_kms_keys(struct keystore *keystore,
import_data.num_imported = 0;
import_data.num_skipped = 0;
import_data.num_failed = 0;
import_data.pkey_fd = pkey_fd;
rc = process_kms_keys(keystore->kms_info, label_filter, name_filter,
volume_filter, volume_type,
@@ -6295,6 +6319,7 @@ struct kms_refresh {
bool novolcheck;
unsigned long num_refreshed;
unsigned long num_failed;
int pkey_fd;
};
/**
@@ -6336,7 +6361,8 @@ static int _keystore_refresh_kms_key(struct keystore *keystore,
file_names->skey_filename,
file_names->pass_filename,
key_type,
keystore->verbose);
keystore->verbose,
refresh_data->pkey_fd);
if (rc != 0) {
warnx("KMS plugin '%s' failed to refresh key '%s': %s",
keystore->kms_info->plugin_name, name, strerror(-rc));
@@ -6485,6 +6511,7 @@ out:
* @param[in] refresh_properties if true, also refresh the key's properties
* @param[in] novolcheck if true, do not check the associated volumes for
* existence and duplicate use
* @param[in] pkey_fd the pkey file descriptor
*
* @returns 0 for success or a negative errno in case of an error
*/
@@ -6492,12 +6519,14 @@ int keystore_refresh_kms_keys(struct keystore *keystore,
const char *name_filter,
const char *volume_filter,
const char *volume_type, const char *key_type,
bool refresh_properties, bool novolcheck)
bool refresh_properties, bool novolcheck,
int pkey_fd)
{
struct kms_refresh refresh_data = { 0 };
int rc;
util_assert(keystore != NULL, "Internal error: keystore is NULL");
util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1");
if (keystore->kms_info->plugin_lib == NULL) {
warnx("The repository is not bound to a KMS plugin");
@@ -6520,6 +6549,7 @@ int keystore_refresh_kms_keys(struct keystore *keystore,
refresh_data.novolcheck = novolcheck;
refresh_data.num_refreshed = 0;
refresh_data.num_failed = 0;
refresh_data.pkey_fd = pkey_fd;
rc = _keystore_process_filtered(keystore, name_filter, volume_filter,
NULL, volume_type, key_type, false,

14
zkey/keystore.h
View File

@@ -68,7 +68,7 @@ int keystore_generate_key_kms(struct keystore *keystore, const char *name,
const char *volume_type, const char *key_type,
bool gen_passphrase, const char *passphrase_file,
struct kms_option *kms_options,
size_t num_kms_options);
size_t num_kms_options, int pkey_fd);
int keystore_import(struct keystore *keystore, unsigned char *secure_key,
size_t secure_key_size, const char *name,
@@ -76,21 +76,21 @@ int keystore_import(struct keystore *keystore, unsigned char *secure_key,
const char *apqns, bool noapqncheck, size_t sector_size,
const char *volume_type, bool gen_passphrase,
const char *passphrase_file, bool exportable,
struct ext_lib *lib);
struct ext_lib *lib, int pkey_fd);
int keystore_import_key(struct keystore *keystore, const char *name,
const char *description, const char *volumes,
const char *apqns, bool noapqncheck, size_t sector_size,
const char *import_file, const char *volume_type,
bool gen_passphrase, const char *passphrase_file,
bool exportable, struct ext_lib *lib);
bool exportable, struct ext_lib *lib, int pkey_fd);
int keystore_change_key(struct keystore *keystore, const char *name,
const char *description, const char *volumes,
const char *apqns, bool noapqncheck,
long int sector_size, const char *volume_type,
bool gen_passphrase, const char *passphrase_file,
bool remove_passphrase, bool quiet);
bool remove_passphrase, bool quiet, int pkey_fd);
int keystore_rename_key(struct keystore *keystore, const char *name,
const char *newname);
@@ -157,13 +157,15 @@ int keystore_import_kms_keys(struct keystore *keystore,
const char *volume_type,
struct kms_option *kms_options,
size_t num_kms_options,
bool batch_mode, bool novolcheck);
bool batch_mode, bool novolcheck,
int pkey_fd);
int keystore_refresh_kms_keys(struct keystore *keystore,
const char *name_filter,
const char *volume_filter,
const char *volume_type, const char *key_type,
bool refres_properties, bool novolcheck);
bool refres_properties, bool novolcheck,
int pkey_fd);
void keystore_free(struct keystore *keystore);

16
zkey/kms.c
View File

@@ -2127,6 +2127,7 @@ static char *_get_system_specific_prop_name(const char *prop_name)
* KMS options have been specified
* @param[in] num_kms_options the number of options in above array
* @param[in] verbose if true, verbose messages are printed
* @param[in] pkey_fd the pkey file descriptor
*
* @returns 0 for success or a negative errno in case of an error.
* If the KMS plugin does not support the key type, then -ENOTSUP is returned
@@ -2136,7 +2137,7 @@ int generate_kms_key(struct kms_info *kms_info, const char *name,
bool xts, size_t keybits, const char *filename,
const char *passphrase_file,
struct kms_option *kms_options, size_t num_kms_options,
bool verbose)
bool verbose, int pkey_fd)
{
char *cipher, *iv_mode, *description, *volumes, *vol_type, *sector_size;
char key1_label[KMS_KEY_LABEL_SIZE + 14 + 1] = { 0 };
@@ -2159,6 +2160,7 @@ int generate_kms_key(struct kms_info *kms_info, const char *name,
util_assert(key_type != NULL, "Internal error: key_type is NULL");
util_assert(key_props != NULL, "Internal error: key_props is NULL");
util_assert(filename != NULL, "Internal error: filename is NULL");
util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1");
if (kms_info->plugin_lib == NULL) {
warnx("The repository is not bound to a KMS plugin");
@@ -2254,7 +2256,7 @@ int generate_kms_key(struct kms_info *kms_info, const char *name,
if (is_ep11_aes_key(key_blob, key_blob_size))
key_size = EP11_KEY_SIZE;
rc = generate_key_verification_pattern(key_blob, key_size,
rc = generate_key_verification_pattern(pkey_fd, key_blob, key_size,
vp, sizeof(vp), verbose);
if (rc != 0) {
pr_verbose(verbose, "Failed to generate key verification "
@@ -2320,7 +2322,8 @@ int generate_kms_key(struct kms_info *kms_info, const char *name,
util_hexdump_grp(stderr, NULL, &key_blob[key_size], 4,
key_blob_size, 0);
rc = generate_key_verification_pattern(&key_blob[key_size], key_size,
rc = generate_key_verification_pattern(pkey_fd,
&key_blob[key_size], key_size,
vp, sizeof(vp), verbose);
if (rc != 0) {
pr_verbose(verbose, "Failed to generate key verification "
@@ -3253,6 +3256,7 @@ out:
* @param[in] passphrase_file the file name to store the dummy passphras in
* @param[in] key_type the key type
* @param[in] verbose if true, verbose messages are printed
* @param[in] pkey_fd the pkey file descriptor
*
* @returns 0 for success or a negative errno in case of an error.
*/
@@ -3260,7 +3264,7 @@ int refresh_kms_key(struct kms_info *kms_info, struct properties *key_props,
char **description, char **cipher, char **iv_mode,
char **volumes, char **volume_type, ssize_t *sector_size,
const char *filename, const char *passphrase_file,
const char *key_type, bool verbose)
const char *key_type, bool verbose, int pkey_fd)
{
struct kms_property *properties = NULL;
u8 key_blob[2 * MAX_SECURE_KEY_SIZE];
@@ -3275,6 +3279,7 @@ int refresh_kms_key(struct kms_info *kms_info, struct properties *key_props,
int rc = 0;
util_assert(kms_info != NULL, "Internal error: kms_info is NULL");
util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1");
if (kms_info->plugin_lib == NULL) {
warnx("The repository is not bound to a KMS plugin");
@@ -3440,7 +3445,8 @@ int refresh_kms_key(struct kms_info *kms_info, struct properties *key_props,
orig_vp = properties_get(key_props, PROP_NAME_KEY_VP);
if (orig_vp != NULL) {
rc = generate_key_verification_pattern(key_blob, key_blob_size,
rc = generate_key_verification_pattern(pkey_fd,
key_blob, key_blob_size,
vp, sizeof(vp), verbose);
if (rc != 0) {
warnx("Failed to generate the verification pattern: %s",

4
zkey/kms.h
View File

@@ -76,7 +76,7 @@ int generate_kms_key(struct kms_info *kms_info, const char *name,
bool xts, size_t keybits, const char *filename,
const char *passphrase_file,
struct kms_option *kms_options, size_t num_kms_options,
bool verbose);
bool verbose, int pkey_fd);
int set_kms_key_properties(struct kms_info *kms_info,
struct properties *key_props,
@@ -123,6 +123,6 @@ int refresh_kms_key(struct kms_info *kms_info, struct properties *key_props,
char **description, char **cipher, char **iv_mode,
char **volumes, char **volume_type, ssize_t *sector_size,
const char *filename, const char *passphrase_file,
const char *key_type, bool verbose);
const char *key_type, bool verbose, int pkey_fd);
#endif

18
zkey/pkey.c
View File

@@ -1578,6 +1578,7 @@ out:
* Generate a key verification pattern of a secure AES key by encrypting the all
* zero message with the secure key using the AF_ALG interface
*
* @param[in] pkey_fd the pkey file descriptor
* @param[in] key the secure key token
* @param[in] key_size the size of the secure key
* @param[in] vp buffer where the verification pattern is returned
@@ -1588,7 +1589,8 @@ out:
*
* @returns 0 on success, a negative errno in case of an error
*/
int generate_aes_key_verification_pattern(const u8 *key, size_t key_size,
int generate_aes_key_verification_pattern(int pkey_fd,
const u8 *key, size_t key_size,
char *vp, size_t vp_len,
const char *cipher,
bool verbose)
@@ -1745,6 +1747,7 @@ out:
* Generate a key verification pattern of a secure HMAC key by MACing the all
* zero message with the secure key using the AF_ALG interface
*
* @param[in] pkey_fd the pkey file descriptor
* @param[in] key the secure key token
* @param[in] key_size the size of the secure key
* @param[in] vp buffer where the verification pattern is returned
@@ -1753,7 +1756,8 @@ out:
*
* @returns 0 on success, a negative errno in case of an error
*/
int generate_hmac_key_verification_pattern(const u8 *key,
int generate_hmac_key_verification_pattern(int pkey_fd,
const u8 *key,
size_t key_size,
char *vp, size_t vp_len,
const char *cipher,
@@ -1873,6 +1877,7 @@ out:
* Generate a key verification pattern of a secure key by encrypting the all
* zero message with the secure key using the AF_ALG interface
*
* @param[in] pkey_fd the pkey file descriptor
* @param[in] key the secure key token
* @param[in] key_size the size of the secure key
* @param[in] vp buffer where the verification pattern is returned
@@ -1881,15 +1886,18 @@ out:
*
* @returns 0 on success, a negative errno in case of an error
*/
int generate_key_verification_pattern(const u8 *key, size_t key_size,
int generate_key_verification_pattern(int pkey_fd,
const u8 *key, size_t key_size,
char *vp, size_t vp_len, bool verbose)
{
if (is_aes_key(key, key_size))
return generate_aes_key_verification_pattern(key, key_size,
return generate_aes_key_verification_pattern(pkey_fd,
key, key_size,
vp, vp_len,
NULL, verbose);
if (is_hmac_key(key, key_size))
return generate_hmac_key_verification_pattern(key, key_size,
return generate_hmac_key_verification_pattern(pkey_fd,
key, key_size,
vp, vp_len,
NULL, verbose);

9
zkey/pkey.h
View File

@@ -366,15 +366,18 @@ int validate_secure_key(int pkey_fd,
size_t *clear_key_bitsize, int *is_old_mk,
const char **apqns, bool verbose);
int generate_key_verification_pattern(const u8 *key, size_t key_size,
int generate_key_verification_pattern(int pkey_fd,
const u8 *key, size_t key_size,
char *vp, size_t vp_len, bool verbose);
int generate_aes_key_verification_pattern(const u8 *key, size_t key_size,
int generate_aes_key_verification_pattern(int pkey_fd,
const u8 *key, size_t key_size,
char *vp, size_t vp_len,
const char *cipher,
bool verbose);
int generate_hmac_key_verification_pattern(const u8 *key,
int generate_hmac_key_verification_pattern(int pkey_fd,
const u8 *key,
size_t key_size,
char *vp, size_t vp_len,
const char *cipher,

7
zkey/pvsecrets.c
View File

@@ -618,6 +618,7 @@ static int pvsecrets_build_key_blob_cb(u16 UNUSED(idx), u16 type, u32 len,
* @param passphrase_file the file name of a file containing a passphrase
* for LUKS2 (optional, can be NULL)
* @param verbose if true, verbose messages are printed
* @param[in] pkey_fd the pkey file descriptor
*
* @returns 0 for success or a negative errno in case of an error
*/
@@ -626,7 +627,8 @@ int pvsecrets_import(struct keystore *keystore, int uv_fd,
const char *name, const char *description,
const char *volumes, const char *volume_type,
long sector_size, bool gen_passphrase,
const char *passphrase_file, bool verbose)
const char *passphrase_file, bool verbose,
int pkey_fd)
{
struct build_secret_key_blob_data build_blob_data = { 0 };
int rc;
@@ -674,7 +676,8 @@ int pvsecrets_import(struct keystore *keystore, int uv_fd,
rc = keystore_import(keystore, (unsigned char *)&build_blob_data.token,
sizeof(build_blob_data.token), name, description,
volumes, NULL, false, sector_size, volume_type,
gen_passphrase, passphrase_file, false, NULL);
gen_passphrase, passphrase_file, false, NULL,
pkey_fd);
return rc;
}

3
zkey/pvsecrets.h
View File

@@ -95,6 +95,7 @@ int pvsecrets_import(struct keystore *keystore, int uv_fd,
const char *name, const char *description,
const char *volumes, const char *volume_type,
long sector_size, bool gen_passphrase,
const char *passphrase_file, bool verbose);
const char *passphrase_file, bool verbose,
int pkey_fd);
#endif

29
zkey/zkey-cryptsetup.c
View File

@@ -1967,7 +1967,7 @@ static int reencipher_prepare(int token)
if (rc != 0)
goto out;
rc = generate_key_verification_pattern(key, securekeysize,
rc = generate_key_verification_pattern(g.pkey_fd, key, securekeysize,
reenc_tok.verification_pattern,
sizeof(reenc_tok.verification_pattern),
g.verbose);
@@ -1983,7 +1983,7 @@ static int reencipher_prepare(int token)
sizeof(vp_tok.verification_pattern));
if (is_phmac_integrity) {
rc = generate_key_verification_pattern(integrity_key,
rc = generate_key_verification_pattern(g.pkey_fd, integrity_key,
integrity_keysize,
reenc_tok.int_verification_pattern,
sizeof(reenc_tok.int_verification_pattern),
@@ -2182,7 +2182,8 @@ static int reencipher_complete(int token)
}
rc = generate_key_verification_pattern(key, securekeysize, vp,
rc = generate_key_verification_pattern(g.pkey_fd,
key, securekeysize, vp,
sizeof(vp), g.verbose);
if (rc != 0) {
warnx("Failed to generate the verification pattern: %s",
@@ -2200,7 +2201,8 @@ static int reencipher_complete(int token)
}
if (is_phmac_integrity) {
rc = generate_key_verification_pattern(integrity_key,
rc = generate_key_verification_pattern(g.pkey_fd,
integrity_key,
integrity_keysize, vp,
sizeof(vp), g.verbose);
if (rc != 0) {
@@ -2521,7 +2523,7 @@ static int command_setvp(void)
integrity_keysize);
seckeysize = keysize - integrity_keysize;
rc = generate_key_verification_pattern(key, seckeysize,
rc = generate_key_verification_pattern(g.pkey_fd, key, seckeysize,
vp_tok.verification_pattern,
sizeof(vp_tok.verification_pattern),
g.verbose);
@@ -2536,7 +2538,7 @@ static int command_setvp(void)
if (is_phmac_integrity) {
integrity_key = key + seckeysize;
rc = generate_key_verification_pattern(integrity_key,
rc = generate_key_verification_pattern(g.pkey_fd, integrity_key,
integrity_keysize,
vp_tok.int_verification_pattern,
sizeof(vp_tok.int_verification_pattern),
@@ -2694,7 +2696,7 @@ static int command_setkey(void)
goto out;
}
rc = generate_key_verification_pattern(newkey, newekey_size,
rc = generate_key_verification_pattern(g.pkey_fd, newkey, newekey_size,
vp, sizeof(vp), g.verbose);
if (rc != 0) {
warnx("Failed to generate the verification pattern: %s",
@@ -2705,7 +2707,8 @@ static int command_setkey(void)
}
if (is_phmac_integrity) {
rc = generate_key_verification_pattern(newkey + newekey_size,
rc = generate_key_verification_pattern(g.pkey_fd,
newkey + newekey_size,
integrity_keysize,
int_vp, sizeof(int_vp),
g.verbose);
@@ -2976,7 +2979,7 @@ static int command_convert(void)
}
}
rc = generate_key_verification_pattern(newkey, newekey_size,
rc = generate_key_verification_pattern(g.pkey_fd, newkey, newekey_size,
new_vp, sizeof(new_vp),
g.verbose);
if (rc != 0) {
@@ -2988,7 +2991,8 @@ static int command_convert(void)
}
if (is_phmac_integrity) {
rc = generate_key_verification_pattern(newkey + newekey_size,
rc = generate_key_verification_pattern(g.pkey_fd,
newkey + newekey_size,
newikey_size,
new_int_vp,
sizeof(new_int_vp),
@@ -3024,7 +3028,7 @@ static int command_convert(void)
goto out;
}
rc = generate_aes_key_verification_pattern(key, ekeysize,
rc = generate_aes_key_verification_pattern(g.pkey_fd, key, ekeysize,
vp, sizeof(vp),
is_xts ?
"xts(aes)" : "cbc(aes)",
@@ -3043,7 +3047,8 @@ static int command_convert(void)
strcmp(ip.integrity, "hmac(sha512)") == 0)
hmac_vp_alg = "hmac(sha512)";
rc = generate_hmac_key_verification_pattern(key + ekeysize,
rc = generate_hmac_key_verification_pattern(g.pkey_fd,
key + ekeysize,
integrity_keysize,
int_vp,
sizeof(int_vp),

22
zkey/zkey.c
View File

@@ -1636,6 +1636,7 @@ static struct zkey_command zkey_kms_commands[] = {
.has_options = 1,
.use_kms_plugin = 1,
.need_kms_login = 1,
.need_pkey_device = 1,
.kms_plugin_opts_cmd = KMS_COMMAND_LIST_IMPORT,
},
{
@@ -1650,6 +1651,7 @@ static struct zkey_command zkey_kms_commands[] = {
.has_options = 1,
.use_kms_plugin = 1,
.need_kms_login = 1,
.need_pkey_device = 1,
},
{ .command = NULL }
};
@@ -1679,6 +1681,7 @@ static struct zkey_command zkey_pvsecrets_commands[] = {
.has_options = 1,
.need_keystore = 1,
.need_uv_device = 1,
.need_pkey_device = 1,
},
{ .command = NULL }
};
@@ -1735,6 +1738,7 @@ static struct zkey_command zkey_commands[] = {
.command = COMMAND_IMPORT,
.abbrev_len = 2,
.function = command_import,
.need_pkey_device = 1,
.short_desc = "Import a secure key",
.long_desc = "Import a secure key from a file into the "
"repository",
@@ -1783,6 +1787,7 @@ static struct zkey_command zkey_commands[] = {
.has_options = 1,
.need_keystore = 1,
.use_kms_plugin = 1,
.need_pkey_device = 1,
},
{
.command = COMMAND_RENAME,
@@ -2090,7 +2095,8 @@ static int command_generate_repository(void)
g.gen_passphrase,
g.passphrase_file,
g.kms_options,
g.num_kms_options);
g.num_kms_options,
g.pkey_fd);
goto out;
}
@@ -2491,7 +2497,7 @@ static int command_validate_file(void)
goto out;
}
rc = generate_key_verification_pattern(secure_key,
rc = generate_key_verification_pattern(g.pkey_fd, secure_key,
secure_key_size, vp, sizeof(vp),
g.verbose);
if (rc != 0) {
@@ -2624,7 +2630,8 @@ static int command_import(void)
rc = keystore_import_key(g.keystore, g.name, g.description, g.volumes,
g.apqns, g.noapqncheck, g.sector_size,
g.pos_arg, g.volume_type, g.gen_passphrase,
g.passphrase_file, g.exportable, &g.lib);
g.passphrase_file, g.exportable, &g.lib,
g.pkey_fd);
return rc != 0 ? EXIT_FAILURE : EXIT_SUCCESS;
}
@@ -2742,7 +2749,7 @@ static int command_change(void)
g.apqns, g.noapqncheck, g.sector_size,
g.volume_type, g.gen_passphrase,
g.passphrase_file, g.remove_passphrase,
g.force);
g.force, g.pkey_fd);
return rc != 0 ? EXIT_FAILURE : EXIT_SUCCESS;
}
@@ -3283,7 +3290,7 @@ static int command_kms_import(void)
rc = keystore_import_kms_keys(g.keystore, g.label, g.name, g.volumes,
g.volume_type, g.kms_options,
g.num_kms_options, g.batch_mode,
g.novolcheck);
g.novolcheck, g.pkey_fd);
return rc != 0 ? EXIT_FAILURE : EXIT_SUCCESS;
}
@@ -3305,7 +3312,8 @@ static int command_kms_refresh(void)
rc = keystore_refresh_kms_keys(g.keystore, g.name, g.volumes,
g.volume_type, g.key_type,
g.refresh_properties, g.novolcheck);
g.refresh_properties, g.novolcheck,
g.pkey_fd);
return rc != 0 ? EXIT_FAILURE : EXIT_SUCCESS;
}
@@ -3372,7 +3380,7 @@ static int command_pvsecrets_import(void)
g.name != NULL ? g.name : g.secret_name,
g.description, g.volumes, g.volume_type,
g.sector_size, g.gen_passphrase,
g.passphrase_file, g.verbose);
g.passphrase_file, g.verbose, g.pkey_fd);
return rc != 0 ? EXIT_FAILURE : EXIT_SUCCESS;
}