kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Add KMS support for 'zkey generate' command

Browse Source 
When a repository that is bound to a key management system, the
keys are generated by the key management system by default. To
generate a local key, add option '--local'.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2020-06-08 15:40:42 +02:00
committed by Jan Höppner
parent 35dd59d04c
commit bb6a47db55
8 changed files with 758 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zkey/zkey.c
+60 -2
View File
@@ -255,6 +255,14 @@ static struct util_opt opt_vec[] = {
"omitted, the default is '"KEY_TYPE_CCA_AESDATA"'",
.command = COMMAND_GENERATE,
},
{
.option = { "local", 0, NULL, 'L'},
.desc = "Generate the key locally. This is the default when no "
"KMS plugin is bound to the repository. If the "
"repository is bound to a KMS plugin, then keys are "
"generated by the KMS per default.",
.command = COMMAND_GENERATE,
},
/***********************************************************/
{
.flags = UTIL_OPT_FLAG_SECTION,
@@ -976,6 +984,7 @@ struct zkey_command {
int need_keystore;
int use_kms_plugin;
char *kms_plugin_opts_cmd;
int need_kms_login;
struct zkey_command *sub_commands;
};
@@ -1090,6 +1099,8 @@ static struct zkey_command zkey_commands[] = {
.pos_arg_optional = 1,
.pos_arg_alternate = "--name/-N",
.arg_alternate_value = &g.name,
.use_kms_plugin = 1,
.kms_plugin_opts_cmd = KMS_COMMAND_GENERATE,
},
{
.command = COMMAND_REENCIPHER,
@@ -1392,11 +1403,44 @@ static int command_generate_repository(void)
if (g.sector_size < 0)
g.sector_size = 0;
if (g.kms_info.plugin_lib != NULL && !g.local) {
if (g.apqns != NULL) {
warnx("Option '--apqns|-a' is not valid for "
"generating a key in a KMS-bound repository");
util_prg_print_parse_error();
return EXIT_FAILURE;
}
if (g.clearkeyfile != NULL) {
warnx("Option '----clearkey|-c' is not valid for "
"generating a key in a KMS-bound repository, "
"unless option '--local|-L' is also specified");
util_prg_print_parse_error();
return EXIT_FAILURE;
}
rc = perform_kms_login(&g.kms_info, g.verbose);
if (rc != 0)
rc = EXIT_FAILURE;
rc = keystore_generate_key_kms(g.keystore, g.name,
g.description, g.volumes,
g.sector_size, g.keybits, g.xts,
g.volume_type, g.key_type,
g.kms_options,
g.num_kms_options);
goto out;
}
if (g.key_type == NULL)
g.key_type = KEY_TYPE_CCA_AESDATA;
rc = keystore_generate_key(g.keystore, g.name, g.description, g.volumes,
g.apqns, g.noapqncheck, g.sector_size,
g.keybits, g.xts, g.clearkeyfile,
g.volume_type, g.key_type, g.pkey_fd);
out:
return rc != 0 ? EXIT_FAILURE : EXIT_SUCCESS;
}
@@ -1422,10 +1466,10 @@ static int command_generate(void)
util_prg_print_parse_error();
return EXIT_FAILURE;
}
if (g.key_type == NULL)
g.key_type = KEY_TYPE_CCA_AESDATA;
if (g.name != NULL)
return command_generate_repository();
if (g.key_type == NULL)
g.key_type = KEY_TYPE_CCA_AESDATA;
if (g.pos_arg != NULL) {
if (g.volumes != NULL) {
warnx("Option '--volumes|-l' is not valid for "
@@ -1451,6 +1495,12 @@ static int command_generate(void)
util_prg_print_parse_error();
return EXIT_FAILURE;
}
if (g.local) {
warnx("Option '--local|-L' is not valid for "
"generating a key outside of the repository");
util_prg_print_parse_error();
return EXIT_FAILURE;
}
rc = cross_check_apqns(NULL, NULL,
get_min_card_level_for_keytype(g.key_type),
@@ -2767,6 +2817,14 @@ int main(int argc, char *argv[])
rc = EXIT_FAILURE;
goto out;
}
if (cmd->need_kms_login) {
rc = perform_kms_login(&g.kms_info, g.verbose);
if (rc != 0) {
rc = EXIT_FAILURE;
goto out;
}
}
}
umask(0077);