kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Cross check APQNs when validating secure keys

Browse Source 
Perform a cross check of the APQNs when a secure AES key is validated.
When a set of APQNs are associated to a secure key, these APQNs are
cross checked. If a secure key is validated outside of the key repository,
or no APQNs are associated to a secure key inside the key repository,
then all currently available APQNs are cross checked. If a master key
mismatch is detected, then an error message is issued.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2019-06-14 10:54:33 +02:00
committed by Jan Höppner
parent a5b58038a0
commit 7f8e31e861
2 changed files with 21 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zkey/keystore.c
+12 -22
View File
@@ -2252,43 +2252,32 @@ struct validate_info {
/**
* Displays the status of the associated APQNs.
*
* @param[in] keystore the key store
* @param[in] properties the properties of the key
* @param[in] name the name of the key
* @param[in] mkvp the master key verification pattern of the key
*
* @returns 0 in case of success, 1 if at least one of the APQNs is not
* available
* available or has a master key mismatch
*/
static int _keystore_display_apqn_status(struct properties *properties,
const char *name)
static int _keystore_display_apqn_status(struct keystore *keystore,
struct properties *properties,
u64 mkvp)
{
int i, rc, card, domain, warning = 0;
char **apqn_list;
int rc, warning = 0;
char *apqns;
apqns = properties_get(properties, PROP_NAME_APQNS);
if (apqns == NULL)
return 0;
apqn_list = str_list_split(apqns);
for (i = 0; apqn_list[i] != NULL; i++) {
if (sscanf(apqn_list[i], "%x.%x", &card, &domain) != 2)
continue;
rc = sysfs_is_apqn_online(card, domain);
if (rc != 1) {
printf("WARNING: The APQN %02x.%04x associated with "
"key '%s' is %s\n", card, domain, name,
rc == -1 ? "not a CCA card" : "not online");
warning = 1;
}
}
rc = cross_check_apqns(apqns, mkvp, true, keystore->verbose);
if (rc != 0 && rc != -ENOTSUP)
warning = 1;
if (warning)
printf("\n");
free(apqns);
str_list_free_string_array(apqn_list);
return warning;
}
/**
@@ -2405,7 +2394,8 @@ static int _keystore_process_validate(struct keystore *keystore,
info->num_warnings++;
}
if (info->noapqncheck == 0)
if (_keystore_display_apqn_status(properties, name) != 0)
if (_keystore_display_apqn_status(keystore, properties,
mkvp) != 0)
info->num_warnings++;
if (_keystore_display_volume_status(properties, name) != 0)
info->num_warnings++;
zkey/zkey.c
+9
View File
@@ -1380,6 +1380,15 @@ static int command_validate_file(void)
printf(" %.*s\n", VERIFICATION_PATTERN_LEN / 2,
&vp[VERIFICATION_PATTERN_LEN / 2]);
rc = cross_check_apqns(NULL, mkvp, true, g.verbose);
if (rc == -EINVAL)
return EXIT_FAILURE;
if (rc != 0 && rc != -ENOTSUP) {
warnx("Your master key setup is improper");
rc = EXIT_FAILURE;
goto out;
}
out:
free(secure_key);
return rc;