rust/pvsecret: User defined signatures and verifications

Introduces the ability to `pvsecret` to add a signature (ecdsa or rsa)
to the program-reserved space (user-data) of an add-secret request
during the request creation. Additionally, some arbitrary data may be
inserted.

The new command `verify` checks if add-secret requests are sane (e.g.
start with the correct magic value). If the request contains a
user-signature `verify` will also verify this signature.

Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

rust/pvsecret/src/cmd/create.rs

@@ -8,7 +8,7 @@ use log::{debug, info, trace, warn};
 use pv::{
     misc::{
         get_writer_from_cli_file_arg, open_file, parse_hex, pv_guest_bit_set, read_certs,
-        read_exact_file, read_file, try_parse_u128, try_parse_u64, write,
+        read_exact_file, read_file, read_private_key, try_parse_u128, try_parse_u64, write,
     },
     request::{
         openssl::pkey::{PKey, Public},
@@ -106,6 +106,27 @@ fn build_asrcb(opt: &CreateSecretOpt) -> Result<AddSecretRequest> {
         asrcb.set_ext_secret(ExtSecret::Derived(read_exact_file(path, "CCK")?.into()))?;
     }
 
+    // add user data
+    let user_data = opt
+        .user_data
+        .as_ref()
+        .map(|p| read_file(p, "user-data"))
+        .transpose()?;
+    if user_data.as_ref().is_some_and(|data| data.is_empty()) {
+        warn!("Added empty user-data file.");
+    }
+
+    let user_key = opt
+        .user_sign_key
+        .as_ref()
+        .map(|p| read_file(p, "User-signing key"))
+        .transpose()?
+        .map(|buf| read_private_key(&buf))
+        .transpose()?;
+
+    if user_data.is_some() || user_key.is_some() {
+        asrcb.set_user_data(user_data.unwrap_or_default(), user_key)?;
+    }
     Ok(asrcb)
 }
 
@@ -140,7 +161,7 @@ fn try_from_val(val: Value) -> anyhow::Result<ConfigUid> {
     .ok_or(anyhow!("No 'cuid' entry found"))?;
     let cuid = cuid
         .strip_prefix("0x")
-        .ok_or(anyhow!("Value starts not with 0x".to_string()))?
+        .ok_or(anyhow!("CUID value starts not with 0x".to_string()))?
         .to_owned();
     if cuid.len() != ::std::mem::size_of::<ConfigUid>() * 2 {
         return Err(anyhow!(format!("len invalid ({})", cuid.len())));

rust/pvsecret/src/cmd/verify.rs

@@ -0,0 +1,46 @@
+use anyhow::{anyhow, Context, Result};
+use log::warn;
+use pv::{
+    misc::{get_reader_from_cli_file_arg, get_writer_from_cli_file_arg, read_certs, read_file},
+    request::{
+        openssl::pkey::{PKey, Public},
+        uvsecret::verify_asrcb_and_get_user_data,
+    },
+};
+
+use crate::cli::VerifyOpt;
+
+/// read the content of a DER or PEM x509 and return the public key
+fn read_sgn_key(path: &str) -> Result<PKey<Public>> {
+    read_certs(&read_file(path, "user-signing key")?)?
+        .get(0)
+        .ok_or(anyhow!("File does not contain a X509 certificate"))?
+        .public_key()
+        .map_err(anyhow::Error::new)
+}
+
+pub fn verify(opt: &VerifyOpt) -> Result<()> {
+    let mut rd_in = get_reader_from_cli_file_arg(&opt.input)?;
+    let mut data_in = Vec::with_capacity(0x1000);
+    rd_in
+        .read_to_end(&mut data_in)
+        .with_context(|| format!("Cannot read input file {}", opt.input))?;
+
+    let verify_cert = opt
+        .user_cert
+        .as_ref()
+        .map(|p| read_sgn_key(p))
+        .transpose()
+        .context("Cannot read user-verification certificate.")?;
+
+    let user_data = verify_asrcb_and_get_user_data(data_in, verify_cert)
+        .context("Could not verify the the Add-secret request")?;
+
+    if let Some(user_data) = user_data {
+        get_writer_from_cli_file_arg(&opt.output)?
+            .write_all(&user_data)
+            .with_context(|| format!("Cannot write user data to {}", opt.output))?;
+    }
+    warn!("Successfully verified the request.");
+    Ok(())
+}