Now as no users of get_verified_hkds exists, replace it with
get_verified_hkds_new.
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Allow the creation of Add-secret requests using hybrid (=quantum safe)
keys. This results in using the headers in version 2 (0x200).
Co-developed-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a HostKey enum (currently V1(PKey<Public>)) and introduce a
versioned Keyslot enum (V1(KeyslotV1)). Rename the existing Keyslot type
to KeyslotV1 to prepare for future format extensions.
Update pv, pvattest, pvimg, and pvsecret to use the new enums.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Return the Secure Execution header version in addition to tags. This
comes handy as soon as multiple Secure Execution header versions are
supported.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Bump MSRV to 1.85.0 and upgrade all dependencies using 'cargo upgrade'
from cargo-edit. The bump to 1.85.0 is requiered to get at least openssl
version 0.10.79 including fixes for a couple security issues.
Link: https://crates.io/crates/cargo-edit
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
+ Sort and group the imports
+ Normalize and format comments (100 characters width)
Command used:
$ cargo +nightly fmt --
Acked-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
All pvattest subcommands use the command line option -i <input> and -o
<output> to specify file input and output respectively. pvsecret however
uses mostly positional arguments for <input> and <output> exclusively,
e.g. pvattest check input.bin output.yaml
$ pvsecret add secret.bin
This provides an inconsistent user interface within the Secure
Execution tools and may confuse users.
Add the -i and -o option to the subcommands if applicable.
Input/output can then be specified like so:
$ pvsecret add -i secret.bin
$ pvsecret list -o list.yaml
$ pvsecret verify -i FILE -o out.yaml
$ pvsecret retrieve -i ID -o id.yaml
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add two new command-line options to pvsecret create for Early Boot
Customization (EBC) Table of Contents (TOC) support:
1. --policy FILE
Links an Add-Secret-Request (ASR) to a policy file by embedding a
PolicyReference in the ASR's user data field. The PolicyReference
contains the relative file path and SHA512 hash of the policy file,
enabling integrity verification of the policy. This option conflicts
with --user-data as both use the same user data field in the ASR
structure.
2. --toc-policy FILE
Appends the AES-GCM authentication tag (MAC tag - last 16 bytes of
the encrypted ASR) to the specified TOC policy file. This enables
the TOC policy to maintain a list of all ASR MAC tags for
completeness verification during boot. The TOC can verify that all
expected ASRs are present and unmodified by checking their MAC tags
against this list. This option also conflicts with --user-data.
Both options support the EBC multi-party workflow where an ISV/CSP builds
a generic SEL image and customers customize it with their own secrets. The
TOC mechanism ensures the integrity and completeness of all EBC resources
during the boot process.
Assisted-by: IBM Bob:1.0.1
Acked-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
If pvsecret {add, list, retrieve} is executed with options on a non-s390
system the user gets misleading error messages as the options are not
defined.
> pvsecret add -i secret.bin
error: unexpected argument '-i' found
This may lead the user to think wrong arguments where chosen, which is
not entirely true as they are valid on s390. The more helpful error
message would be
error: Command only available on s390x
Which is already the case if no arguments are given.
Solve this by allowing non-s390 systems to parse the options:
> pvsecret add -i secret.bin
error: Command only available on s390x
Reported-by: Carlo Della Giusta <carlo.dellagiusta@suse.com>
Fixes: dd82c26f87 ("rust: Add tool to manage UV-secrets")
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Update pvattest and pvsecret mapnages and README.md, as for example the
'pvsecret create update-cck' was not documented.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The ultravisor supports a new secret type in `add-secret` to update
the customer communication key (CCK). Support this new secret
type (0x16).
[seiden@linux.ibm.com: Constify CCK Header struct usage]
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jakob Naucke <naucke@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Denies the addition of secrets with an ID that is already stored in the
secret store. This can be overruled by using the force option.
This is considered a breaking change as adding duplicated IDs was
possible without the '--force' option before.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Tested-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Warn a user that there are multiple secrets in the secret store with the
same secret id, but retrieve one of them anyways.
This helps users to notice issues before they happen, as retrieve may
not retrieve the expected secret due to duplicated IDs.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Tested-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Warn a user that the secret-id to be added is already in the secret
store, but add it anyways.
This helps users to notice issues before they happen, as retrieve may
not retrieve the expected secret due to duplicated IDs.
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Tested-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
There are a couple place with incorrectly used font escape sequences.
$ man --warnings -E UTF-8 -l -Tutf8 -Z rust/pvsecret/man/pvsecret.1
troff:<standard input>:107: warning: cannot select font 'F'
troff:<standard input>:107: warning: cannot select font 'E'
$ man --warnings -E UTF-8 -l -Tutf8 -Z rust/pvsecret/man/pvsecret-verify.1
troff:<standard input>:119: warning: cannot select font 'F'
troff:<standard input>:119: warning: cannot select font 'F'
troff:<standard input>:119: warning: cannot select font 'F'
troff:<standard input>:119: warning: cannot select font 'F'
troff:<standard input>:119: warning: cannot select font 'F'
troff:<standard input>:131: warning: cannot select font 'F'
Use the correct escape sequences and regenerate the man pages.
Github-ID: https://github.com/ibm-s390-linux/s390-tools/issues/170
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The key supplied in the plain bytes file with 'pvsecret create retrievable'
with type 'hmac-sha' is they key 'K_0' as of FIPS-198-1, i.e. the key 'K'
after any necessary pre-processing. The pre-processing must be performed
by the user prior to creating the retrievable secret.
Describe in detail how that pre-processing must be performed.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Secret IDs identify a secret in the store. Tooling (pvsecret) calculates
them by hashing a user-defined string. With this patch it is now
possible to skip the hash step and directly use the input string as the
ID. Up to the first 31 bytes of the input ASCII-string are used. The last byte
is the NUL char. During list pvsecret tries to interpret the secret
as ASCII string and if possible displays the ASCII characters alongside
the hex number.
Also, use the Upper/Lower Hex formatters for the hexstring formatting of
SecretId. Display will, additionally show the ASCII representation if
applicable.
While at it, use Self wherever possible.
Acked-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make use of the enhanced list secrets UAPI for the uvdevice in the latest kernel
version. This allows fetching secret lists with more than 85 entries via
reserving more userspace memory in the IOCTL argument.
While at it, move the errno readout next to the ioctl-syscall.
Acked-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Rename `Aes256*` to `Aes256Gcm*` and add a deprecated constant with the
old name for backward compatibility. Adapt existing code to use the new
enum variant.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Write the secret metadata into the same directory as the generated
secret request. Before, the metadata was accidentally written into the
working directory.
Fixes: dd82c26f87 ("rust: Add tool to manage UV-secrets")
Suggested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix the new `cargo clippy` and `cargo doc` findings that were triggered
with the recent policy addition.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Create one implementation for the verbose option to be used by all
tools. While at it, add a quiet option to decrease the verbosity.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Define and set the minimal supported Rust version (MSRV) to 1.75.0. This
is the (current) minimal supported version over all supported distros
that use rust in s390-tools.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
It's uncommon and prone to error to silently stop decoding/parsing a
hex-string if there is an invalid character. Therefore, add a new
function `decode_hex` which fixes this behavior and use it in the code.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Do some formatting that are in experimental stage but improve the code
readability.
Use rustfmt with a nightly toolchain and enable:
format_code_in_doc_comments = true
reorder_impl_items = true
comment_width = 100
wrap_comments = true
normalize_comments = true
(see .rustfmt.toml)
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Renames pv crate to s390_pv and pv_core to s390_pv_core. pv was already
taken on crates.io.
Bump the versions of all crates to 0.10.0. From now on we follow Semver
compatibility rules when it comes to updates. patch-level updates will
not introduce any backwards incompatible changes. For now all crates in
this directory will have the same version number. A version update may,
therefore, not add any new things.
Library users in this repository still use the non prefixed names and
rename the crate in the Cargo.toml. Doc-tests have to use the new name
however.
Add some Cargo metadata to the Cargo.toml.
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Use `AsRef<Path>` instead of `&Path`, &str, .... to be more versatile
and accept more input types. In addition, use `PathBuf` and `Path` for
paths instead of `String` and `str`.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Prepare pv & pv_core crates to be released on crates.io:
* Remove any unused API to stay flexible
* Remove utils dependency
* Move cli, tmpfile and version utilities to local utils crate
* Use the new utilities in the pv tools
* Rename Secret into Confidential to avoid confusion of Secret (now
Confidential) and AddSecret requests.
* Move the uvsecret module out of the request module and change the name
to secret.
* Cleanup dependencies
* Precise and correct minimal dependency versions
* Inline `Aes256Key::from_digest`
The cleanup ensures that the code also compiles with the dependencies
resolved to their minimal versions using:
$ cargo +nightly -Z minimal-versions update
$ cargo build
For more information refer to this blog post:
https://users.rust-lang.org/t/psa-please-specify-precise-dependency-versions-in-cargo-toml/71277/8
Signed-off-by: Marc Hartmayer <mhartmay@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
