kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Check crypto card level during APQN cross checking

Browse Source 
Secure keys of type CCA-AESCIPHER require a CEX6C or newer crypto
card. Also check for the minimum required card level during cross
checking of APQNs. Also display the card level in the APQN report.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2019-07-26 11:18:58 +02:00
committed by Jan Höppner
parent 560b672bfa
commit b7bb90c552
6 changed files with 126 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zkey/keystore.c
+19 -6
View File
@@ -1722,7 +1722,9 @@ int keystore_generate_key(struct keystore *keystore, const char *name,
if (rc != 0)
goto out_free_key_filenames;
rc = cross_check_apqns(apqns, 0, true, keystore->verbose);
rc = cross_check_apqns(apqns, 0,
get_min_card_level_for_keytype(key_type), true,
keystore->verbose);
if (rc == -EINVAL)
goto out_free_key_filenames;
if (rc != 0 && rc != -ENOTSUP && noapqncheck == 0) {
@@ -1850,7 +1852,9 @@ int keystore_import_key(struct keystore *keystore, const char *name,
goto out_free_key;
}
rc = cross_check_apqns(apqns, mkvp, true, keystore->verbose);
rc = cross_check_apqns(apqns, mkvp,
get_min_card_level_for_keytype(key_type), true,
keystore->verbose);
if (rc == -EINVAL)
goto out_free_key;
if (rc != 0 && rc != -ENOTSUP && noapqncheck == 0) {
@@ -1937,8 +1941,8 @@ int keystore_change_key(struct keystore *keystore, const char *name,
.nomsg = 0 };
struct key_filenames file_names = { NULL, NULL, NULL };
struct properties *key_props = NULL;
char *apqns_prop, *key_type;
size_t secure_key_size;
char *apqns_prop;
u8 *secure_key;
char temp[30];
u64 mkvp;
@@ -2005,9 +2009,12 @@ int keystore_change_key(struct keystore *keystore, const char *name,
goto out;
apqns_prop = properties_get(key_props, PROP_NAME_APQNS);
rc = cross_check_apqns(apqns_prop, mkvp, true,
keystore->verbose);
key_type = properties_get(key_props, PROP_NAME_KEY_TYPE);
rc = cross_check_apqns(apqns_prop, mkvp,
get_min_card_level_for_keytype(key_type),
true, keystore->verbose);
free(apqns_prop);
free(key_type);
if (rc == -ENOTSUP)
rc = 0;
if (rc != 0 && noapqncheck == 0) {
@@ -2373,12 +2380,17 @@ static int _keystore_display_apqn_status(struct keystore *keystore,
{
int rc, warning = 0;
char *apqns;
char *key_type;
apqns = properties_get(properties, PROP_NAME_APQNS);
if (apqns == NULL)
return 0;
rc = cross_check_apqns(apqns, mkvp, true, keystore->verbose);
apqns = properties_get(properties, PROP_NAME_APQNS);
key_type = properties_get(properties, PROP_NAME_KEY_TYPE);
rc = cross_check_apqns(apqns, mkvp,
get_min_card_level_for_keytype(key_type), true,
keystore->verbose);
if (rc != 0 && rc != -ENOTSUP)
warning = 1;
@@ -2386,6 +2398,7 @@ static int _keystore_display_apqn_status(struct keystore *keystore,
printf("\n");
free(apqns);
free(key_type);
return warning;
}
/**