kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

pvimg: Report host-key document type mismatches

Browse Source 
Report host-key document type mismatches before hash verification.

For example, when testing a v2 Secure Execution header with a classical
host-key document, report that a hybrid host-key document is required
instead of failing with a generic header validation error.

Before:

$ pvimg -- test --host-key-document v1.hkd se.v2.img
error: Invalid Secure Execution header

After:

$ pvimg -- test --host-key-document v1.hkd se.v2.img
Host-key document 'v1.hkd' is not a hybrid host-key document.
error: The provided host key document in v1.hkd contains the wrong number of keys!

Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2026-07-28 18:05:39 +02:00
committed by Steffen Eiden
parent 0263637d9f
commit ed74e84862
2 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
rust/pvimg/src/cmd/test.rs
View File

@@ -74,7 +74,11 @@ where
let mut result = false;
for path in host_key_documents {
let hkd = HkdLoader::load_and_verify(path, &NoVerifyHkd, HkdVersionSelection::Auto)?;
let hkd = HkdLoader::load_and_verify(
path,
&NoVerifyHkd,
HkdVersionSelection::Explicit(hdr.common.version.into()),
)?;
if hdr.contains(hkd)? {
result = true;
log_println!(

11
rust/pvimg/src/pv_utils/se_hdr/brb.rs
View File

@@ -12,7 +12,7 @@ use pv::request::openssl::pkey::{PKey, Private, Public};
use pv::request::{seek_se_hdr_start, Aes256XtsKey, Confidential, SymKey, SymKeyType};
use pv::static_assert;
use serde::{Deserialize, Serialize};
use utils::S390ToolsMetaData;
use utils::{HkdVersion, S390ToolsMetaData};
pub use super::hdr_v1::{SeHdrBinV1, SeHdrDataV1};
pub use super::hdr_v2::{SeHdrBinV2, SeHdrDataV2};
@@ -65,6 +65,15 @@ pub enum SeHdrVersion {
V2 = 0x200,
}
impl From<SeHdrVersion> for HkdVersion {
fn from(val: SeHdrVersion) -> Self {
match val {
SeHdrVersion::V1 => Self::Classical,
SeHdrVersion::V2 => Self::Hybrid,
}
}
}
impl Display for SeHdrVersion {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
write!(