kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Cross check APQNs when importing secure keys

Browse Source 
Perform a cross check of the APQNs when an existing secure AES key is
imported into the key repository. When a set of APQNs are associated to
the imported secure key, these APQNs are cross checked. If no APQNs are
associated to imported secure key, then all currently available
APQNs are cross checked. If a master key mismatch is detected, then
the key import is rejected.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2019-06-14 11:25:45 +02:00
committed by Jan Höppner
parent 7f8e31e861
commit d854aed4b8
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zkey/keystore.c
+21
View File
@@ -1770,6 +1770,7 @@ int keystore_import_key(struct keystore *keystore, const char *name,
struct properties *key_props = NULL;
size_t secure_key_size;
u8 *secure_key;
u64 mkvp;
int rc;
util_assert(keystore != NULL, "Internal error: keystore is NULL");
@@ -1791,9 +1792,26 @@ int keystore_import_key(struct keystore *keystore, const char *name,
goto out_free_key_filenames;
}
rc = get_master_key_verification_pattern(secure_key, secure_key_size,
&mkvp, keystore->verbose);
if (rc != 0) {
warnx("Failed to get the master key verification pattern: %s",
strerror(-rc));
goto out_free_key;
}
rc = cross_check_apqns(apqns, mkvp, true, keystore->verbose);
if (rc == -EINVAL)
goto out_free_key;
if (rc != 0 && rc != -ENOTSUP && noapqncheck == 0) {
warnx("Your master key setup is improper");
goto out_free_key;
}
rc = write_secure_key(file_names.skey_filename, secure_key,
secure_key_size, keystore->verbose);
free(secure_key);
secure_key = NULL;
if (rc != 0)
goto out_free_props;
@@ -1811,6 +1829,9 @@ int keystore_import_key(struct keystore *keystore, const char *name,
"Successfully imported a secure key in '%s' and key info in '%s'",
file_names.skey_filename, file_names.info_filename);
out_free_key:
if (secure_key != NULL)
free(secure_key);
out_free_props:
if (key_props != NULL)
properties_free(key_props);