zkey: Add keystore implementation

Add a keystore implementation that stores secure AES keys in a
key repository, located in a directory, e.g. '/etc/zkey/repository'.
The keystore allows you to generate, validate, re-encipher, modify,
list, delete, etc secure keys.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

zkey/Makefile

@@ -27,8 +27,9 @@ libs = $(rootdir)/libutil/libutil.a
 zkey.o: zkey.c pkey.h misc.h
 pkey.o: pkey.c pkey.h
 properties.o: properties.c properties.h
+keystore.o: keystore.c keystore.h properties.h
 
-zkey: zkey.o pkey.o properties.o $(libs)
+zkey: zkey.o pkey.o properties.o keystore.o $(libs)
 
 install: all
 	$(INSTALL) -d -m 755 $(DESTDIR)$(USRBINDIR)

zkey/keystore.h

@@ -0,0 +1,77 @@
+/*
+ * zkey - Generate, re-encipher, and validate secure keys
+ *
+ * Keystore handling functions
+ *
+ * Copyright IBM Corp. 2018
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef KEYSTORE_H
+#define KEYSTORE_H
+
+#include <stdbool.h>
+
+#include "pkey.h"
+
+struct keystore {
+	bool verbose;
+	char *directory;
+	int lock_fd;
+	mode_t mode;
+	gid_t owner;
+};
+
+struct keystore *keystore_new(const char *directory, bool verbose);
+
+int keystore_generate_key(struct keystore *keystore, const char *name,
+			  const char *description, const char *volumes,
+			  const char *apqns, size_t sector_size,
+			  size_t keybits, bool xts, const char *clear_key_file,
+			  int pkey_fd);
+
+int keystore_import_key(struct keystore *keystore, const char *name,
+			const char *description, const char *volumes,
+			const char *apqns, size_t sector_size,
+			const char *import_file);
+
+int keystore_change_key(struct keystore *keystore, const char *name,
+			const char *description, const char *volumes,
+			const char *apqns, long int sector_size);
+
+int keystore_rename_key(struct keystore *keystore, const char *name,
+			const char *newname);
+
+int keystore_validate_key(struct keystore *keystore, const char *name_filter,
+			  const char *apqn_filter, int pkey_fd);
+
+int keystore_reencipher_key(struct keystore *keystore, const char *name_filter,
+			    const char *apqn_filter,
+			    bool from_old, bool to_new, bool inplace,
+			    bool staged, bool complete, int pkey_fd,
+			    t_CSNBKTC dll_CSNBKTC);
+
+int keystore_copy_key(struct keystore *keystore, const char *name,
+		      const char *newname, const char *volumes);
+
+int keystore_export_key(struct keystore *keystore, const char *name,
+			const char *export_file);
+
+int keystore_remove_key(struct keystore *keystore, const char *name,
+			bool quiet);
+
+int keystore_list_keys(struct keystore *keystore, const char *name_filter,
+		       const char *volume_filter, const char *apqn_filter);
+
+int keystore_cryptsetup(struct keystore *keystore, const char *volume_filter,
+			bool execute);
+
+int keystore_crypttab(struct keystore *keystore, const char *volume_filter);
+
+void keystore_free(struct keystore *keystore);
+
+
+
+#endif