kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey-cryptsetup: Support PHMAC integrity with setvp command

Browse Source 
In case the volume is integrity protected, and the integrity algorithm is
PHMAC, then the setvp command also adds the verification pattern of the
integrity key into the token.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2024-03-15 11:01:09 +01:00
committed by Jan Höppner
parent 8dd5758341
commit f11c71237e
1 changed files with 30 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
zkey/zkey-cryptsetup.c
View File

@@ -2373,9 +2373,12 @@ out:
*/
static int command_setvp(void)
{
size_t integrity_keysize = 0;
size_t integrity_keysize = 0, seckeysize;
char *integrity_spec = NULL;
struct vp_token vp_tok;
int is_phmac_integrity;
size_t keysize = 0;
u8 *integrity_key;
u8 *key = NULL;
char *prompt;
int token;
@@ -2383,8 +2386,8 @@ static int command_setvp(void)
util_asprintf(&prompt, "Enter passphrase for '%s': ", g.pos_arg);
rc = validate_keyslot(CRYPT_ANY_SLOT, &key, &keysize,
&integrity_keysize, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, prompt, NULL, NULL);
&integrity_keysize, &integrity_spec, NULL, NULL,
NULL, NULL, NULL, NULL, prompt, NULL, NULL);
free(prompt);
if (rc < 0)
goto out;
@@ -2395,7 +2398,11 @@ static int command_setvp(void)
token = find_token(g.cd, PAES_VP_TOKEN_NAME);
rc = generate_key_verification_pattern(key, keysize - integrity_keysize,
is_phmac_integrity = is_integrity_phmac(integrity_spec,
integrity_keysize);
seckeysize = keysize - integrity_keysize;
rc = generate_key_verification_pattern(key, seckeysize,
vp_tok.verification_pattern,
sizeof(vp_tok.verification_pattern),
g.verbose);
@@ -2407,6 +2414,23 @@ static int command_setvp(void)
goto out;
}
if (is_phmac_integrity) {
integrity_key = key + seckeysize;
rc = generate_key_verification_pattern(integrity_key,
integrity_keysize,
vp_tok.int_verification_pattern,
sizeof(vp_tok.int_verification_pattern),
g.verbose);
if (rc != 0) {
warnx("Failed to generate the verification pattern: %s",
strerror(-rc));
warnx("Make sure that kernel module 'phmac_s390' is "
"loaded and that the 'phmac' cipher is available");
goto out;
}
}
rc = put_vp_token(g.cd, token, &vp_tok);
if (rc < 0)
goto out;
@@ -2415,6 +2439,8 @@ static int command_setvp(void)
out:
secure_free(key, keysize);
if (integrity_spec != NULL)
free(integrity_spec);
return rc < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
}