kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Pass /dev/pkey file descriptor through to all functions

Browse Source 
To be able to calculate the key verification pattern of a key blob without
the use of AF_ALG, the file descriptor of the /dev/pkey device needs to
be passed through to all functions that might need to calculate the key
verification pattern.

Also make sure that all commands that might need to calculate the key
verification pattern have 'need_pkey_device = 1' so that the device is
opened.

Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2026-06-08 11:42:42 +02:00
committed by Jan Höppner
parent 30ce11b8da
commit 44d6020774
10 changed files with 131 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zkey/zkey-cryptsetup.c
+17 -12
View File
@@ -1967,7 +1967,7 @@ static int reencipher_prepare(int token)
if (rc != 0)
goto out;
rc = generate_key_verification_pattern(key, securekeysize,
rc = generate_key_verification_pattern(g.pkey_fd, key, securekeysize,
reenc_tok.verification_pattern,
sizeof(reenc_tok.verification_pattern),
g.verbose);
@@ -1983,7 +1983,7 @@ static int reencipher_prepare(int token)
sizeof(vp_tok.verification_pattern));
if (is_phmac_integrity) {
rc = generate_key_verification_pattern(integrity_key,
rc = generate_key_verification_pattern(g.pkey_fd, integrity_key,
integrity_keysize,
reenc_tok.int_verification_pattern,
sizeof(reenc_tok.int_verification_pattern),
@@ -2182,7 +2182,8 @@ static int reencipher_complete(int token)
}
rc = generate_key_verification_pattern(key, securekeysize, vp,
rc = generate_key_verification_pattern(g.pkey_fd,
key, securekeysize, vp,
sizeof(vp), g.verbose);
if (rc != 0) {
warnx("Failed to generate the verification pattern: %s",
@@ -2200,7 +2201,8 @@ static int reencipher_complete(int token)
}
if (is_phmac_integrity) {
rc = generate_key_verification_pattern(integrity_key,
rc = generate_key_verification_pattern(g.pkey_fd,
integrity_key,
integrity_keysize, vp,
sizeof(vp), g.verbose);
if (rc != 0) {
@@ -2521,7 +2523,7 @@ static int command_setvp(void)
integrity_keysize);
seckeysize = keysize - integrity_keysize;
rc = generate_key_verification_pattern(key, seckeysize,
rc = generate_key_verification_pattern(g.pkey_fd, key, seckeysize,
vp_tok.verification_pattern,
sizeof(vp_tok.verification_pattern),
g.verbose);
@@ -2536,7 +2538,7 @@ static int command_setvp(void)
if (is_phmac_integrity) {
integrity_key = key + seckeysize;
rc = generate_key_verification_pattern(integrity_key,
rc = generate_key_verification_pattern(g.pkey_fd, integrity_key,
integrity_keysize,
vp_tok.int_verification_pattern,
sizeof(vp_tok.int_verification_pattern),
@@ -2694,7 +2696,7 @@ static int command_setkey(void)
goto out;
}
rc = generate_key_verification_pattern(newkey, newekey_size,
rc = generate_key_verification_pattern(g.pkey_fd, newkey, newekey_size,
vp, sizeof(vp), g.verbose);
if (rc != 0) {
warnx("Failed to generate the verification pattern: %s",
@@ -2705,7 +2707,8 @@ static int command_setkey(void)
}
if (is_phmac_integrity) {
rc = generate_key_verification_pattern(newkey + newekey_size,
rc = generate_key_verification_pattern(g.pkey_fd,
newkey + newekey_size,
integrity_keysize,
int_vp, sizeof(int_vp),
g.verbose);
@@ -2976,7 +2979,7 @@ static int command_convert(void)
}
}
rc = generate_key_verification_pattern(newkey, newekey_size,
rc = generate_key_verification_pattern(g.pkey_fd, newkey, newekey_size,
new_vp, sizeof(new_vp),
g.verbose);
if (rc != 0) {
@@ -2988,7 +2991,8 @@ static int command_convert(void)
}
if (is_phmac_integrity) {
rc = generate_key_verification_pattern(newkey + newekey_size,
rc = generate_key_verification_pattern(g.pkey_fd,
newkey + newekey_size,
newikey_size,
new_int_vp,
sizeof(new_int_vp),
@@ -3024,7 +3028,7 @@ static int command_convert(void)
goto out;
}
rc = generate_aes_key_verification_pattern(key, ekeysize,
rc = generate_aes_key_verification_pattern(g.pkey_fd, key, ekeysize,
vp, sizeof(vp),
is_xts ?
"xts(aes)" : "cbc(aes)",
@@ -3043,7 +3047,8 @@ static int command_convert(void)
strcmp(ip.integrity, "hmac(sha512)") == 0)
hmac_vp_alg = "hmac(sha512)";
rc = generate_hmac_key_verification_pattern(key + ekeysize,
rc = generate_hmac_key_verification_pattern(g.pkey_fd,
key + ekeysize,
integrity_keysize,
int_vp,
sizeof(int_vp),