diff --git a/zkey/keystore.c b/zkey/keystore.c index 4945130a..3ec9e121 100644 --- a/zkey/keystore.c +++ b/zkey/keystore.c @@ -1612,12 +1612,14 @@ struct keystore *keystore_new(const char *directory, * @param[in] vp buffer filled with the verification pattern * @param[in] vp_len length of the buffer. Must be at * least VERIFICATION_PATTERN_LEN bytes in size. + * @param[in] pkey_fd the pkey file descriptor * * @returns 0 for success or a negative errno in case of an error */ static int _keystore_generate_verification_pattern(struct keystore *keystore, - const char *keyfile, - char *vp, size_t vp_len) + const char *keyfile, + char *vp, size_t vp_len, + int pkey_fd) { size_t key_size; u8 *key; @@ -1626,12 +1628,13 @@ static int _keystore_generate_verification_pattern(struct keystore *keystore, util_assert(keystore != NULL, "Internal error: keystore is NULL"); util_assert(keyfile != NULL, "Internal error: keyfile is NULL"); util_assert(vp != NULL, "Internal error: vp is NULL"); + util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1"); key = read_secure_key(keyfile, &key_size, keystore->verbose); if (key == NULL) return -EIO; - rc = generate_key_verification_pattern(key, key_size, + rc = generate_key_verification_pattern(pkey_fd, key, key_size, vp, vp_len, keystore->verbose); free(key); @@ -1645,12 +1648,14 @@ static int _keystore_generate_verification_pattern(struct keystore *keystore, * @param[in] keystore the key store * @param[in] file_names the file names of the key * @param[in] key_props the properties of the key + * @param[in] pkey_fd the pkey file descriptor * * @returns 0 for success or a negative errno in case of an error */ static int _keystore_ensure_vp_exists(struct keystore *keystore, const struct key_filenames *file_names, - struct properties *key_props) + struct properties *key_props, + int pkey_fd) { char vp[VERIFICATION_PATTERN_LEN]; char *temp; @@ -1664,7 +1669,8 @@ static int _keystore_ensure_vp_exists(struct keystore *keystore, rc = _keystore_generate_verification_pattern(keystore, file_names->skey_filename, - vp, sizeof(vp)); + vp, sizeof(vp), + pkey_fd); if (rc != 0) return rc; @@ -2051,6 +2057,7 @@ out: * @param[in] passphrase_file the file name of a file containing a passphrase * for LUKS2 (optional, can be NULL) * @param[in] kms the name of the KMS plugin, or NULL if no KMS is bound + * @param[in] pkey_fd the pkey file descriptor * * @returns 0 on success, or a negative errno value on error */ @@ -2065,7 +2072,8 @@ static int _keystore_create_info_file(struct keystore *keystore, const char *key_type, bool gen_passphrase, const char *passphrase_file, - const char *kms) + const char *kms, + int pkey_fd) { struct properties *key_props = NULL; int rc; @@ -2088,7 +2096,8 @@ static int _keystore_create_info_file(struct keystore *keystore, } } - rc = _keystore_ensure_vp_exists(keystore, filenames, key_props); + rc = _keystore_ensure_vp_exists(keystore, filenames, key_props, + pkey_fd); if (rc != 0) { warnx("Failed to generate the key verification pattern: %s", strerror(-rc)); @@ -2232,7 +2241,7 @@ int keystore_generate_key(struct keystore *keystore, const char *name, description, volumes, apqns, noapqncheck, sector_size, volume_type, key_type, gen_passphrase, - passphrase_file, NULL); + passphrase_file, NULL, pkey_fd); if (rc != 0) goto out_free_props; @@ -2279,6 +2288,7 @@ out_free_key_filenames: * @param[in] kms_options an array of KMS options specified, or NULL if no * KMS options have been specified * @param[in] num_kms_options the number of options in above array + * @param[in] pkey_fd the pkey file descriptor * * @returns 0 for success or a negative errno in case of an error */ @@ -2288,7 +2298,7 @@ int keystore_generate_key_kms(struct keystore *keystore, const char *name, const char *volume_type, const char *key_type, bool gen_passphrase, const char *passphrase_file, struct kms_option *kms_options, - size_t num_kms_options) + size_t num_kms_options, int pkey_fd) { struct key_filenames file_names = { 0 }; struct properties *key_props = NULL; @@ -2305,6 +2315,7 @@ int keystore_generate_key_kms(struct keystore *keystore, const char *name, util_assert(keystore != NULL, "Internal error: keystore is NULL"); util_assert(name != NULL, "Internal error: name is NULL"); + util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1"); kms_info = keystore->kms_info; if (kms_info->plugin_lib == NULL) { @@ -2371,7 +2382,8 @@ int keystore_generate_key_kms(struct keystore *keystore, const char *name, keybits, file_names.skey_filename, _keystore_passphrase_file_exists(&file_names) ? file_names.pass_filename : NULL, - kms_options, num_kms_options, keystore->verbose); + kms_options, num_kms_options, keystore->verbose, + pkey_fd); if (rc != 0) { warnx("KMS plugin '%s' failed to generate key '%s': %s", kms_info->plugin_name, name, strerror(-rc)); @@ -2383,7 +2395,8 @@ int keystore_generate_key_kms(struct keystore *keystore, const char *name, if (rc != 0) goto out_free_props; - rc = _keystore_ensure_vp_exists(keystore, &file_names, key_props); + rc = _keystore_ensure_vp_exists(keystore, &file_names, key_props, + pkey_fd); if (rc != 0) { warnx("Failed to generate the key verification pattern: %s", strerror(-rc)); @@ -2460,6 +2473,7 @@ out_free_key_filenames: * for LUKS2 (optional, can be NULL) * @param[in] exportable if true the key shall be exportable * @param[in] lib the external library struct + * @param[in] pkey_fd the pkey file descriptor * * @returns 0 for success or a negative errno in case of an error */ @@ -2469,7 +2483,7 @@ int keystore_import(struct keystore *keystore, unsigned char *secure_key, const char *apqns, bool noapqncheck, size_t sector_size, const char *volume_type, bool gen_passphrase, const char *passphrase_file, bool exportable, - struct ext_lib *lib) + struct ext_lib *lib, int pkey_fd) { struct key_filenames file_names = { 0 }; struct properties *key_props = NULL; @@ -2591,7 +2605,7 @@ write_key: description, volumes, apqns, noapqncheck, sector_size, volume_type, key_type, gen_passphrase, - passphrase_file, NULL); + passphrase_file, NULL, pkey_fd); if (rc != 0) goto out_free_props; @@ -2636,6 +2650,7 @@ out_free_key_filenames: * for LUKS2 (optional, can be NULL) * @param[in] exportable if true the key shall be exportable * @param[in] lib the external library struct + * @param[in] pkey_fd the pkey file descriptor * * @returns 0 for success or a negative errno in case of an error */ @@ -2644,7 +2659,7 @@ int keystore_import_key(struct keystore *keystore, const char *name, const char *apqns, bool noapqncheck, size_t sector_size, const char *import_file, const char *volume_type, bool gen_passphrase, const char *passphrase_file, - bool exportable, struct ext_lib *lib) + bool exportable, struct ext_lib *lib, int pkey_fd) { size_t secure_key_size; u8 *secure_key; @@ -2660,7 +2675,7 @@ int keystore_import_key(struct keystore *keystore, const char *name, rc = keystore_import(keystore, secure_key, secure_key_size, name, description, volumes, apqns, noapqncheck, sector_size, volume_type, gen_passphrase, - passphrase_file, exportable, lib); + passphrase_file, exportable, lib, pkey_fd); if (secure_key != NULL) free(secure_key); @@ -2698,6 +2713,7 @@ int keystore_import_key(struct keystore *keystore, const char *name, * @param[in] remove_passphrase if true, remove the (dummy) passphrase * @param[in] quiet if true no confirmation prompt is shown when removing * a (dummy) passphrase + * @param[in] pkey_fd the pkey file descriptor * * @returns 0 for success or a negative errno in case of an error * @@ -2707,7 +2723,7 @@ int keystore_change_key(struct keystore *keystore, const char *name, const char *apqns, bool noapqncheck, long int sector_size, const char *volume_type, bool gen_passphrase, const char *passphrase_file, - bool remove_passphrase, bool quiet) + bool remove_passphrase, bool quiet, int pkey_fd) { struct volume_check vol_check = { .keystore = keystore, .name = name, .set = 0, .nocheck = 0 }; @@ -2731,6 +2747,7 @@ int keystore_change_key(struct keystore *keystore, const char *name, util_assert(keystore != NULL, "Internal error: keystore is NULL"); util_assert(name != NULL, "Internal error: name is NULL"); + util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1"); rc = _keystore_get_key_filenames(keystore, name, &file_names); if (rc != 0) @@ -2960,7 +2977,8 @@ int keystore_change_key(struct keystore *keystore, const char *name, } } - rc = _keystore_ensure_vp_exists(keystore, &file_names, key_props); + rc = _keystore_ensure_vp_exists(keystore, &file_names, key_props, + pkey_fd); /* ignore return code, vp generation might fail if key is not valid */ rc = _keystore_set_timestamp_property(key_props, PROP_NAME_CHANGE_TIME); @@ -3890,7 +3908,7 @@ static int _keystore_process_reencipher(struct keystore *keystore, goto out; rc = _keystore_ensure_vp_exists(keystore, file_names, - properties); + properties, info->pkey_fd); if (rc != 0) { warnx("Failed to generate the key verification pattern " "for key '%s': %s", file_names->skey_filename, @@ -5940,6 +5958,7 @@ struct kms_import { unsigned long num_imported; unsigned long num_skipped; unsigned long num_failed; + int pkey_fd; }; /** @@ -6144,7 +6163,8 @@ prompt_alt_name: if (rc != 0) goto out_remove; - rc = generate_key_verification_pattern(secure_key, secure_key_size, + rc = generate_key_verification_pattern(import_data->pkey_fd, + secure_key, secure_key_size, vp, sizeof(vp), keystore->verbose); if (rc != 0) { @@ -6235,6 +6255,7 @@ out: * with an already existing name is to be imported. * @param[in] novolcheck if true, do not check the associated volumes for * existence and duplicate use + * @param[in] pkey_fd the pkey file descriptor * * @returns 0 for success or a negative errno in case of an error */ @@ -6245,12 +6266,14 @@ int keystore_import_kms_keys(struct keystore *keystore, const char *volume_type, struct kms_option *kms_options, size_t num_kms_options, - bool batch_mode, bool novolcheck) + bool batch_mode, bool novolcheck, + int pkey_fd) { struct kms_import import_data = { 0 }; int rc; util_assert(keystore != NULL, "Internal error: keystore is NULL"); + util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1"); if (keystore->kms_info->plugin_lib == NULL) { warnx("The repository is not bound to a KMS plugin"); @@ -6269,6 +6292,7 @@ int keystore_import_kms_keys(struct keystore *keystore, import_data.num_imported = 0; import_data.num_skipped = 0; import_data.num_failed = 0; + import_data.pkey_fd = pkey_fd; rc = process_kms_keys(keystore->kms_info, label_filter, name_filter, volume_filter, volume_type, @@ -6295,6 +6319,7 @@ struct kms_refresh { bool novolcheck; unsigned long num_refreshed; unsigned long num_failed; + int pkey_fd; }; /** @@ -6336,7 +6361,8 @@ static int _keystore_refresh_kms_key(struct keystore *keystore, file_names->skey_filename, file_names->pass_filename, key_type, - keystore->verbose); + keystore->verbose, + refresh_data->pkey_fd); if (rc != 0) { warnx("KMS plugin '%s' failed to refresh key '%s': %s", keystore->kms_info->plugin_name, name, strerror(-rc)); @@ -6485,6 +6511,7 @@ out: * @param[in] refresh_properties if true, also refresh the key's properties * @param[in] novolcheck if true, do not check the associated volumes for * existence and duplicate use + * @param[in] pkey_fd the pkey file descriptor * * @returns 0 for success or a negative errno in case of an error */ @@ -6492,12 +6519,14 @@ int keystore_refresh_kms_keys(struct keystore *keystore, const char *name_filter, const char *volume_filter, const char *volume_type, const char *key_type, - bool refresh_properties, bool novolcheck) + bool refresh_properties, bool novolcheck, + int pkey_fd) { struct kms_refresh refresh_data = { 0 }; int rc; util_assert(keystore != NULL, "Internal error: keystore is NULL"); + util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1"); if (keystore->kms_info->plugin_lib == NULL) { warnx("The repository is not bound to a KMS plugin"); @@ -6520,6 +6549,7 @@ int keystore_refresh_kms_keys(struct keystore *keystore, refresh_data.novolcheck = novolcheck; refresh_data.num_refreshed = 0; refresh_data.num_failed = 0; + refresh_data.pkey_fd = pkey_fd; rc = _keystore_process_filtered(keystore, name_filter, volume_filter, NULL, volume_type, key_type, false, diff --git a/zkey/keystore.h b/zkey/keystore.h index e8ee720c..188450d0 100644 --- a/zkey/keystore.h +++ b/zkey/keystore.h @@ -68,7 +68,7 @@ int keystore_generate_key_kms(struct keystore *keystore, const char *name, const char *volume_type, const char *key_type, bool gen_passphrase, const char *passphrase_file, struct kms_option *kms_options, - size_t num_kms_options); + size_t num_kms_options, int pkey_fd); int keystore_import(struct keystore *keystore, unsigned char *secure_key, size_t secure_key_size, const char *name, @@ -76,21 +76,21 @@ int keystore_import(struct keystore *keystore, unsigned char *secure_key, const char *apqns, bool noapqncheck, size_t sector_size, const char *volume_type, bool gen_passphrase, const char *passphrase_file, bool exportable, - struct ext_lib *lib); + struct ext_lib *lib, int pkey_fd); int keystore_import_key(struct keystore *keystore, const char *name, const char *description, const char *volumes, const char *apqns, bool noapqncheck, size_t sector_size, const char *import_file, const char *volume_type, bool gen_passphrase, const char *passphrase_file, - bool exportable, struct ext_lib *lib); + bool exportable, struct ext_lib *lib, int pkey_fd); int keystore_change_key(struct keystore *keystore, const char *name, const char *description, const char *volumes, const char *apqns, bool noapqncheck, long int sector_size, const char *volume_type, bool gen_passphrase, const char *passphrase_file, - bool remove_passphrase, bool quiet); + bool remove_passphrase, bool quiet, int pkey_fd); int keystore_rename_key(struct keystore *keystore, const char *name, const char *newname); @@ -157,13 +157,15 @@ int keystore_import_kms_keys(struct keystore *keystore, const char *volume_type, struct kms_option *kms_options, size_t num_kms_options, - bool batch_mode, bool novolcheck); + bool batch_mode, bool novolcheck, + int pkey_fd); int keystore_refresh_kms_keys(struct keystore *keystore, const char *name_filter, const char *volume_filter, const char *volume_type, const char *key_type, - bool refres_properties, bool novolcheck); + bool refres_properties, bool novolcheck, + int pkey_fd); void keystore_free(struct keystore *keystore); diff --git a/zkey/kms.c b/zkey/kms.c index 970ddbdb..05e50198 100644 --- a/zkey/kms.c +++ b/zkey/kms.c @@ -2127,6 +2127,7 @@ static char *_get_system_specific_prop_name(const char *prop_name) * KMS options have been specified * @param[in] num_kms_options the number of options in above array * @param[in] verbose if true, verbose messages are printed + * @param[in] pkey_fd the pkey file descriptor * * @returns 0 for success or a negative errno in case of an error. * If the KMS plugin does not support the key type, then -ENOTSUP is returned @@ -2136,7 +2137,7 @@ int generate_kms_key(struct kms_info *kms_info, const char *name, bool xts, size_t keybits, const char *filename, const char *passphrase_file, struct kms_option *kms_options, size_t num_kms_options, - bool verbose) + bool verbose, int pkey_fd) { char *cipher, *iv_mode, *description, *volumes, *vol_type, *sector_size; char key1_label[KMS_KEY_LABEL_SIZE + 14 + 1] = { 0 }; @@ -2159,6 +2160,7 @@ int generate_kms_key(struct kms_info *kms_info, const char *name, util_assert(key_type != NULL, "Internal error: key_type is NULL"); util_assert(key_props != NULL, "Internal error: key_props is NULL"); util_assert(filename != NULL, "Internal error: filename is NULL"); + util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1"); if (kms_info->plugin_lib == NULL) { warnx("The repository is not bound to a KMS plugin"); @@ -2254,7 +2256,7 @@ int generate_kms_key(struct kms_info *kms_info, const char *name, if (is_ep11_aes_key(key_blob, key_blob_size)) key_size = EP11_KEY_SIZE; - rc = generate_key_verification_pattern(key_blob, key_size, + rc = generate_key_verification_pattern(pkey_fd, key_blob, key_size, vp, sizeof(vp), verbose); if (rc != 0) { pr_verbose(verbose, "Failed to generate key verification " @@ -2320,7 +2322,8 @@ int generate_kms_key(struct kms_info *kms_info, const char *name, util_hexdump_grp(stderr, NULL, &key_blob[key_size], 4, key_blob_size, 0); - rc = generate_key_verification_pattern(&key_blob[key_size], key_size, + rc = generate_key_verification_pattern(pkey_fd, + &key_blob[key_size], key_size, vp, sizeof(vp), verbose); if (rc != 0) { pr_verbose(verbose, "Failed to generate key verification " @@ -3253,6 +3256,7 @@ out: * @param[in] passphrase_file the file name to store the dummy passphras in * @param[in] key_type the key type * @param[in] verbose if true, verbose messages are printed + * @param[in] pkey_fd the pkey file descriptor * * @returns 0 for success or a negative errno in case of an error. */ @@ -3260,7 +3264,7 @@ int refresh_kms_key(struct kms_info *kms_info, struct properties *key_props, char **description, char **cipher, char **iv_mode, char **volumes, char **volume_type, ssize_t *sector_size, const char *filename, const char *passphrase_file, - const char *key_type, bool verbose) + const char *key_type, bool verbose, int pkey_fd) { struct kms_property *properties = NULL; u8 key_blob[2 * MAX_SECURE_KEY_SIZE]; @@ -3275,6 +3279,7 @@ int refresh_kms_key(struct kms_info *kms_info, struct properties *key_props, int rc = 0; util_assert(kms_info != NULL, "Internal error: kms_info is NULL"); + util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1"); if (kms_info->plugin_lib == NULL) { warnx("The repository is not bound to a KMS plugin"); @@ -3440,7 +3445,8 @@ int refresh_kms_key(struct kms_info *kms_info, struct properties *key_props, orig_vp = properties_get(key_props, PROP_NAME_KEY_VP); if (orig_vp != NULL) { - rc = generate_key_verification_pattern(key_blob, key_blob_size, + rc = generate_key_verification_pattern(pkey_fd, + key_blob, key_blob_size, vp, sizeof(vp), verbose); if (rc != 0) { warnx("Failed to generate the verification pattern: %s", diff --git a/zkey/kms.h b/zkey/kms.h index 42aefe9e..336e935f 100644 --- a/zkey/kms.h +++ b/zkey/kms.h @@ -76,7 +76,7 @@ int generate_kms_key(struct kms_info *kms_info, const char *name, bool xts, size_t keybits, const char *filename, const char *passphrase_file, struct kms_option *kms_options, size_t num_kms_options, - bool verbose); + bool verbose, int pkey_fd); int set_kms_key_properties(struct kms_info *kms_info, struct properties *key_props, @@ -123,6 +123,6 @@ int refresh_kms_key(struct kms_info *kms_info, struct properties *key_props, char **description, char **cipher, char **iv_mode, char **volumes, char **volume_type, ssize_t *sector_size, const char *filename, const char *passphrase_file, - const char *key_type, bool verbose); + const char *key_type, bool verbose, int pkey_fd); #endif diff --git a/zkey/pkey.c b/zkey/pkey.c index 7941d675..26a4bcbe 100644 --- a/zkey/pkey.c +++ b/zkey/pkey.c @@ -1578,6 +1578,7 @@ out: * Generate a key verification pattern of a secure AES key by encrypting the all * zero message with the secure key using the AF_ALG interface * + * @param[in] pkey_fd the pkey file descriptor * @param[in] key the secure key token * @param[in] key_size the size of the secure key * @param[in] vp buffer where the verification pattern is returned @@ -1588,7 +1589,8 @@ out: * * @returns 0 on success, a negative errno in case of an error */ -int generate_aes_key_verification_pattern(const u8 *key, size_t key_size, +int generate_aes_key_verification_pattern(int pkey_fd, + const u8 *key, size_t key_size, char *vp, size_t vp_len, const char *cipher, bool verbose) @@ -1745,6 +1747,7 @@ out: * Generate a key verification pattern of a secure HMAC key by MACing the all * zero message with the secure key using the AF_ALG interface * + * @param[in] pkey_fd the pkey file descriptor * @param[in] key the secure key token * @param[in] key_size the size of the secure key * @param[in] vp buffer where the verification pattern is returned @@ -1753,7 +1756,8 @@ out: * * @returns 0 on success, a negative errno in case of an error */ -int generate_hmac_key_verification_pattern(const u8 *key, +int generate_hmac_key_verification_pattern(int pkey_fd, + const u8 *key, size_t key_size, char *vp, size_t vp_len, const char *cipher, @@ -1873,6 +1877,7 @@ out: * Generate a key verification pattern of a secure key by encrypting the all * zero message with the secure key using the AF_ALG interface * + * @param[in] pkey_fd the pkey file descriptor * @param[in] key the secure key token * @param[in] key_size the size of the secure key * @param[in] vp buffer where the verification pattern is returned @@ -1881,15 +1886,18 @@ out: * * @returns 0 on success, a negative errno in case of an error */ -int generate_key_verification_pattern(const u8 *key, size_t key_size, +int generate_key_verification_pattern(int pkey_fd, + const u8 *key, size_t key_size, char *vp, size_t vp_len, bool verbose) { if (is_aes_key(key, key_size)) - return generate_aes_key_verification_pattern(key, key_size, + return generate_aes_key_verification_pattern(pkey_fd, + key, key_size, vp, vp_len, NULL, verbose); if (is_hmac_key(key, key_size)) - return generate_hmac_key_verification_pattern(key, key_size, + return generate_hmac_key_verification_pattern(pkey_fd, + key, key_size, vp, vp_len, NULL, verbose); diff --git a/zkey/pkey.h b/zkey/pkey.h index 19da2e6e..2e70bce3 100644 --- a/zkey/pkey.h +++ b/zkey/pkey.h @@ -366,15 +366,18 @@ int validate_secure_key(int pkey_fd, size_t *clear_key_bitsize, int *is_old_mk, const char **apqns, bool verbose); -int generate_key_verification_pattern(const u8 *key, size_t key_size, +int generate_key_verification_pattern(int pkey_fd, + const u8 *key, size_t key_size, char *vp, size_t vp_len, bool verbose); -int generate_aes_key_verification_pattern(const u8 *key, size_t key_size, +int generate_aes_key_verification_pattern(int pkey_fd, + const u8 *key, size_t key_size, char *vp, size_t vp_len, const char *cipher, bool verbose); -int generate_hmac_key_verification_pattern(const u8 *key, +int generate_hmac_key_verification_pattern(int pkey_fd, + const u8 *key, size_t key_size, char *vp, size_t vp_len, const char *cipher, diff --git a/zkey/pvsecrets.c b/zkey/pvsecrets.c index b326447c..9f03561b 100644 --- a/zkey/pvsecrets.c +++ b/zkey/pvsecrets.c @@ -618,6 +618,7 @@ static int pvsecrets_build_key_blob_cb(u16 UNUSED(idx), u16 type, u32 len, * @param passphrase_file the file name of a file containing a passphrase * for LUKS2 (optional, can be NULL) * @param verbose if true, verbose messages are printed + * @param[in] pkey_fd the pkey file descriptor * * @returns 0 for success or a negative errno in case of an error */ @@ -626,7 +627,8 @@ int pvsecrets_import(struct keystore *keystore, int uv_fd, const char *name, const char *description, const char *volumes, const char *volume_type, long sector_size, bool gen_passphrase, - const char *passphrase_file, bool verbose) + const char *passphrase_file, bool verbose, + int pkey_fd) { struct build_secret_key_blob_data build_blob_data = { 0 }; int rc; @@ -674,7 +676,8 @@ int pvsecrets_import(struct keystore *keystore, int uv_fd, rc = keystore_import(keystore, (unsigned char *)&build_blob_data.token, sizeof(build_blob_data.token), name, description, volumes, NULL, false, sector_size, volume_type, - gen_passphrase, passphrase_file, false, NULL); + gen_passphrase, passphrase_file, false, NULL, + pkey_fd); return rc; } diff --git a/zkey/pvsecrets.h b/zkey/pvsecrets.h index 9503c515..2b5613ce 100644 --- a/zkey/pvsecrets.h +++ b/zkey/pvsecrets.h @@ -95,6 +95,7 @@ int pvsecrets_import(struct keystore *keystore, int uv_fd, const char *name, const char *description, const char *volumes, const char *volume_type, long sector_size, bool gen_passphrase, - const char *passphrase_file, bool verbose); + const char *passphrase_file, bool verbose, + int pkey_fd); #endif diff --git a/zkey/zkey-cryptsetup.c b/zkey/zkey-cryptsetup.c index f4649b56..e09afb46 100644 --- a/zkey/zkey-cryptsetup.c +++ b/zkey/zkey-cryptsetup.c @@ -1967,7 +1967,7 @@ static int reencipher_prepare(int token) if (rc != 0) goto out; - rc = generate_key_verification_pattern(key, securekeysize, + rc = generate_key_verification_pattern(g.pkey_fd, key, securekeysize, reenc_tok.verification_pattern, sizeof(reenc_tok.verification_pattern), g.verbose); @@ -1983,7 +1983,7 @@ static int reencipher_prepare(int token) sizeof(vp_tok.verification_pattern)); if (is_phmac_integrity) { - rc = generate_key_verification_pattern(integrity_key, + rc = generate_key_verification_pattern(g.pkey_fd, integrity_key, integrity_keysize, reenc_tok.int_verification_pattern, sizeof(reenc_tok.int_verification_pattern), @@ -2182,7 +2182,8 @@ static int reencipher_complete(int token) } - rc = generate_key_verification_pattern(key, securekeysize, vp, + rc = generate_key_verification_pattern(g.pkey_fd, + key, securekeysize, vp, sizeof(vp), g.verbose); if (rc != 0) { warnx("Failed to generate the verification pattern: %s", @@ -2200,7 +2201,8 @@ static int reencipher_complete(int token) } if (is_phmac_integrity) { - rc = generate_key_verification_pattern(integrity_key, + rc = generate_key_verification_pattern(g.pkey_fd, + integrity_key, integrity_keysize, vp, sizeof(vp), g.verbose); if (rc != 0) { @@ -2521,7 +2523,7 @@ static int command_setvp(void) integrity_keysize); seckeysize = keysize - integrity_keysize; - rc = generate_key_verification_pattern(key, seckeysize, + rc = generate_key_verification_pattern(g.pkey_fd, key, seckeysize, vp_tok.verification_pattern, sizeof(vp_tok.verification_pattern), g.verbose); @@ -2536,7 +2538,7 @@ static int command_setvp(void) if (is_phmac_integrity) { integrity_key = key + seckeysize; - rc = generate_key_verification_pattern(integrity_key, + rc = generate_key_verification_pattern(g.pkey_fd, integrity_key, integrity_keysize, vp_tok.int_verification_pattern, sizeof(vp_tok.int_verification_pattern), @@ -2694,7 +2696,7 @@ static int command_setkey(void) goto out; } - rc = generate_key_verification_pattern(newkey, newekey_size, + rc = generate_key_verification_pattern(g.pkey_fd, newkey, newekey_size, vp, sizeof(vp), g.verbose); if (rc != 0) { warnx("Failed to generate the verification pattern: %s", @@ -2705,7 +2707,8 @@ static int command_setkey(void) } if (is_phmac_integrity) { - rc = generate_key_verification_pattern(newkey + newekey_size, + rc = generate_key_verification_pattern(g.pkey_fd, + newkey + newekey_size, integrity_keysize, int_vp, sizeof(int_vp), g.verbose); @@ -2976,7 +2979,7 @@ static int command_convert(void) } } - rc = generate_key_verification_pattern(newkey, newekey_size, + rc = generate_key_verification_pattern(g.pkey_fd, newkey, newekey_size, new_vp, sizeof(new_vp), g.verbose); if (rc != 0) { @@ -2988,7 +2991,8 @@ static int command_convert(void) } if (is_phmac_integrity) { - rc = generate_key_verification_pattern(newkey + newekey_size, + rc = generate_key_verification_pattern(g.pkey_fd, + newkey + newekey_size, newikey_size, new_int_vp, sizeof(new_int_vp), @@ -3024,7 +3028,7 @@ static int command_convert(void) goto out; } - rc = generate_aes_key_verification_pattern(key, ekeysize, + rc = generate_aes_key_verification_pattern(g.pkey_fd, key, ekeysize, vp, sizeof(vp), is_xts ? "xts(aes)" : "cbc(aes)", @@ -3043,7 +3047,8 @@ static int command_convert(void) strcmp(ip.integrity, "hmac(sha512)") == 0) hmac_vp_alg = "hmac(sha512)"; - rc = generate_hmac_key_verification_pattern(key + ekeysize, + rc = generate_hmac_key_verification_pattern(g.pkey_fd, + key + ekeysize, integrity_keysize, int_vp, sizeof(int_vp), diff --git a/zkey/zkey.c b/zkey/zkey.c index 22bfc65d..ae05ad2f 100644 --- a/zkey/zkey.c +++ b/zkey/zkey.c @@ -1636,6 +1636,7 @@ static struct zkey_command zkey_kms_commands[] = { .has_options = 1, .use_kms_plugin = 1, .need_kms_login = 1, + .need_pkey_device = 1, .kms_plugin_opts_cmd = KMS_COMMAND_LIST_IMPORT, }, { @@ -1650,6 +1651,7 @@ static struct zkey_command zkey_kms_commands[] = { .has_options = 1, .use_kms_plugin = 1, .need_kms_login = 1, + .need_pkey_device = 1, }, { .command = NULL } }; @@ -1679,6 +1681,7 @@ static struct zkey_command zkey_pvsecrets_commands[] = { .has_options = 1, .need_keystore = 1, .need_uv_device = 1, + .need_pkey_device = 1, }, { .command = NULL } }; @@ -1735,6 +1738,7 @@ static struct zkey_command zkey_commands[] = { .command = COMMAND_IMPORT, .abbrev_len = 2, .function = command_import, + .need_pkey_device = 1, .short_desc = "Import a secure key", .long_desc = "Import a secure key from a file into the " "repository", @@ -1783,6 +1787,7 @@ static struct zkey_command zkey_commands[] = { .has_options = 1, .need_keystore = 1, .use_kms_plugin = 1, + .need_pkey_device = 1, }, { .command = COMMAND_RENAME, @@ -2090,7 +2095,8 @@ static int command_generate_repository(void) g.gen_passphrase, g.passphrase_file, g.kms_options, - g.num_kms_options); + g.num_kms_options, + g.pkey_fd); goto out; } @@ -2491,7 +2497,7 @@ static int command_validate_file(void) goto out; } - rc = generate_key_verification_pattern(secure_key, + rc = generate_key_verification_pattern(g.pkey_fd, secure_key, secure_key_size, vp, sizeof(vp), g.verbose); if (rc != 0) { @@ -2624,7 +2630,8 @@ static int command_import(void) rc = keystore_import_key(g.keystore, g.name, g.description, g.volumes, g.apqns, g.noapqncheck, g.sector_size, g.pos_arg, g.volume_type, g.gen_passphrase, - g.passphrase_file, g.exportable, &g.lib); + g.passphrase_file, g.exportable, &g.lib, + g.pkey_fd); return rc != 0 ? EXIT_FAILURE : EXIT_SUCCESS; } @@ -2742,7 +2749,7 @@ static int command_change(void) g.apqns, g.noapqncheck, g.sector_size, g.volume_type, g.gen_passphrase, g.passphrase_file, g.remove_passphrase, - g.force); + g.force, g.pkey_fd); return rc != 0 ? EXIT_FAILURE : EXIT_SUCCESS; } @@ -3283,7 +3290,7 @@ static int command_kms_import(void) rc = keystore_import_kms_keys(g.keystore, g.label, g.name, g.volumes, g.volume_type, g.kms_options, g.num_kms_options, g.batch_mode, - g.novolcheck); + g.novolcheck, g.pkey_fd); return rc != 0 ? EXIT_FAILURE : EXIT_SUCCESS; } @@ -3305,7 +3312,8 @@ static int command_kms_refresh(void) rc = keystore_refresh_kms_keys(g.keystore, g.name, g.volumes, g.volume_type, g.key_type, - g.refresh_properties, g.novolcheck); + g.refresh_properties, g.novolcheck, + g.pkey_fd); return rc != 0 ? EXIT_FAILURE : EXIT_SUCCESS; } @@ -3372,7 +3380,7 @@ static int command_pvsecrets_import(void) g.name != NULL ? g.name : g.secret_name, g.description, g.volumes, g.volume_type, g.sector_size, g.gen_passphrase, - g.passphrase_file, g.verbose); + g.passphrase_file, g.verbose, g.pkey_fd); return rc != 0 ? EXIT_FAILURE : EXIT_SUCCESS; }