In case a regular directory was specified, rather than a device node,
the check if the device exists will pass. The following code paths then
assume a slot id was specified. This in turn may lead to a buffer
overflow when the device data is copied to to the zpci_device struct.
Check if the specified path is a regular directory and prevent a
possible later buffer overflow and copying wrong data respectively.
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Also mark FCP devices with CHPID that is logically varied off,
e.g. after running "chchp -v 0 60".
Such FCP devices can be online, not failed, and are not defunct,
so the other existing markers do not appear.
Shows potential issues with FCP devices at one glance.
Examples:
$ lszfcp -He
0.0.1900 host0 NotAvailable
$ lszfcp -HeV
/sys/devices/css0/0.0.010d/0.0.1900 NotAvailable
/sys/class/fc_host/host0
/sys/class/scsi_host/host0
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Complements: 4036e80b26 ("lszfcp: add new output marker for non-good FCP devices (hosts)")
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The zcryptstats tool displays usage statistics of IBM Crypto Express
adapters. It obtains cryptographic performance measurement data
periodically and displays the data for each cryptographic device for
each interval. A cryptographic device can be either a card device or
a queue device (APQN).
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
I often use "systool -v -m zfcp" but that's a bit longish to type
and contains more output than just the parameters I'm interested in.
"tail /sys/module/zfcp/parameters/*" is also not so nice.
"lszfcp -Z" makes it very easy and can be combined with the other
existing output options of lszfcp.
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Since zfcp lazily allocates Scsi_Host et al. on setting an FCP device
online for the first time since the last driver core bind to zfcp
(such as zfcp kernel module load),
lszfcp has only been showing FCP devices (vHBAs) that have been online
at least once including those that have been set offline again.
This is somewhat confusing.
Also it would be nice if lszfcp could be an easier to type replacement for
"lscss -t 17032/03" to simply show all devices bound to the zfcp device
driver.
Of course those FCP devices that have never been online, won't have any
zfcp-specific attribute details, only CIO attributes from the CCW bus.
They also do not have a Scsi_Host nor fc_host.
In order not to break any scripting or expectations around lszfcp,
make the new feature depend on the extended output command line option.
Example:
$ lszfcp -He
0.0.1880 - offline
$ lszfcp -HeV
/sys/devices/css0/0.0.010b/0.0.1880 offline
-
-
$ lszfcp -Hea
0.0.1880 - offline
Bus = "ccw"
availability = "good"
cmb_enable = "0"
cutype = "1731/03"
devtype = "1732/03"
modalias = "ccw:t1731m03dt1732dm03"
online = "0"
uevent = "DRIVER=zfcp"
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Fedor Loshakov <loshakov@linux.ibm.com>
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
s390-tools-1.8.1 introduced a new error message.
It gave the same and thus misleading error message as if no FCP device
(vHBA) found.
In order not to break any scripting built around lszfcp output,
only print the fixed error message depending on the extended output
command line option.
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
s390-tools-1.8.0 introduced a regression skipping all FCP devices
that are currently "defunct".
Changing
$SYSFS/devices/css0/*/*/host*
to
$SYSFS/devices/css0/[0-9]*/[0-9]*/host*
was too strict as it won't match
$SYSFS/devices/css0/defunct/[0-9]*/host*
anymore.
Fix:
$SYSFS/devices/css0/[0-9d]*/[0-9]*/host*
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
s390-tools-1.8.1 introduced a regression skipping all fc_rports
with port_state != Online. While we need to skip some output parts
for a zfcp_port which does not exist anymore due to port_remove,
there are other cases with port_state != Online for which we should
not skip an fc_rport.
Such as port_state "Blocked" after a cable pull beyond host-adjacent switch
or port_state "Not Present" after dev_loss_tmo ran out.
This way the user can see the previously discovered ports,
even if they might currently not be usable for traffic.
Non-good ports are marked in the short output with suffix "NotOnline".
In order not to break scripting or expectations around lszfcp, make the new
feature depend on the extended output command line option.
Sysfs path globbing does not work for a removed zfcp_port
to obtain the FCP device bus-ID. Instead, properly walk the sysfs.
Examples with a removed zfcp_port:
$ lszfcp -Pe
0.0.50c0/0x500507680b2481fa rport-6:0-2
$ lszfcp -PeV
- (NoMoreZfcpPort:0.0.50c0/0x500507680b2481fa)
/sys/class/fc_remote_ports/rport-6:0-2
Examples with an existing zfcp_port but pulled fibre:
$ lszfcp -Pe
0.0.3c40/0x500507680b2181fb rport-7:0-4
$ lszfcp -PeV
/sys/devices/css0/defunct/0.0.3c40/0x500507680b2181fb
/sys/class/fc_remote_ports/rport-7:0-4
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Used in subsequent patches to guard their changes in order not to break
any scripting or expectations around the lszfcp output format.
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When re-enciphering or setting LUKS2 volume keys using zkey-cryptsetup,
allow to specify the --batch-mode|-q option to suppress confirmation
questions.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For LUKS2 volumes the cryptsetup command currently generates
'cryptsetup luksFormat' commands, but for plain mode volumes it
generates 'cryptsetup plainOpen' commands.
With the --open option it can now also generate 'cryptsetup luksOpen'
commands for opening LUKS2 volumes. With the --format option you can
limit the generated commands to only generate 'cryptsetup luksFormat'
commands for LUKS2 volumes, and skip plain mode volumes.
The default behavior (i.e. if none of the two options specified),
remains the same as before.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When generating crypttab entries for LUKS2 volumes, allow to
specify common passphrase options like --key-file, --keyfile-offset,
--keyfile-size and --tries and pass those to the generated crypttab
entries.
Note that not all distributions support the keyfile-offset and
keyfile-size options in crypttab entries.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For some device driver SysFS attributes, values read may not be
acceptable input values for that attribute.
An example would be the group of qeth VNICC attributes that return "n/a"
when VNICC setup is not supported, but only accept "0" and "1" as valid
values that can be written to it.
This leads to errors such as the following when data for such attributes
is imported:
# chzdev f500 --import test.conf
Importing configuration data from test.conf
QETH device 0.0.f500:0.0.f501:0.0.f502 configure failed
Error: Invalid value for qeth attribute: vnicc/flooding=n/a (*)
Acceptable values:
- Integers in the range 0 - 1
Use 'chzdev qeth --help-attribute vnicc/flooding' for more information
Note: You can use --force to override safety checks (*)
To fix this, change chzdev's --export function to skip any attribute
value that is not acceptable for that attribute.
Fixes: e831269e74 ("zdev: Add support for VNIC Characteristics")
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Remove 'hash=plain' option for plain type entries, add 'none luks'
for LUKS type entries.
Note that the format of a crypttab entry is distribution specific.
On some distributions only the first 2 fields are required, the
remaining are optional, on other distributions all 4 fields are
required. With this patch correct crypttab entries are generated
for all distributions.
Closes: https://github.com/ibm-s390-tools/s390-tools/pull/55
Fixes: https://github.com/ibm-s390-tools/s390-tools/issues/57
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With libcryptsetup version 2.1 a new debug level was introduced
to log the JSON structures when adding key slots, digests, etc
into the LUKS2 header.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Messages from libcryptsetup for logging level CRYPT_LOG_DEBUG
do not include an EOL.
Prior to libcryptsetup version 2.1 debug messages were not printed
through the log callback, but using printf directly within
libcryptsetup. Now they are also printed through the log callback,
but without an EOL terminating the text.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For zkey-cryptsetup commands reencipher and setkey, use the
same password-based key derivation function (PBKDF) when
creating unbound key-sots that the key slot uses, which was
unlocked through the specified passphrase. That way the
unlocked key slots created by these commands inherit the
PBKDF from the existing key slot.
This feature requires libcryptsetup version 2.1 or later.
If an older libcryptsetup version is available at compile
time, then PBKDF2 is used for newly created unbound key slots.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The output of lsof command is sometimes too long and makes it difficult
to search in runtime.out. Move the output to a separate file.
Signed-off-by: Sa Liu <saliu@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Running lscpumf -i as regular user causes a warning when trying to
disply sampling buffer sizes. The root cause is in the cpumf_helper
that returns "0,0" instead of a list reference "[0,0]".
This happened when running as regular user because the sampling buffer
size sysfs attribute is not readable for them.
Remove the shortcut and always return a list reference.
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
LUKS2 encrypted volumes use Argon2i as default password based key
derivation function (PBKDF). Argon2i is a so-called memory-hard
function. It requires a certain amount of physical memory to make
dictionary attacks more costly.
Unfortunately, when multiple encrypted volumes are unlocked
automatically during system startup via /etc/crypttab, the use of
Argon2i will most likely cause an out-of-memory error in systemd.
To avoid the out-of-memory error, use PBKDF2 instead. Because PAES
uses secure keys as volume keys, the security of the key derivation
function used to derive the key to encrypt the volume key in the LUKS
key slots is of less relevance. Thus it is safe to use a weaker key
derivation function.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
LUKS2 encrypted volumes use Argon2i as default password based key
derivation function (PBKDF). Argon2i is a so-called memory-hard
function. It requires a certain amount of physical memory to make
dictionary attacks more costly.
Unfortunately, when multiple encrypted volumes are unlocked
automatically during system startup via /etc/crypttab, the use of
Argon2i will most likely cause an out-of-memory error in systemd.
To avoid the out-of-memory error, use PBKDF2 instead. Because PAES
uses secure keys as volume keys, the security of the key derivation
function used to derive the key to encrypt the volume key in the LUKS
key slots is of less relevance. Thus it is safe to use a weaker key
derivation function.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When a user that is in the zkeyadm group, but is not the owner
of the key file changes a key in the zkey repository, then
error "Operation not permitted" occurs. This is due to a superfluous
call to chmod on the key file. When key files are changed then the
permissions of that file are retained anyway.
Also fix a typo in the error message when chmod fails.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Enable zdsfs to access datasets that were created after zdsfs was
mounted without the need to remount zdsfs.
This is done by re-reading the VTOC with every readdir system call.
To ensure a consistent VTOC state the DASD device is reserved for
every VTOC read and released afterwards.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Added some explanations about the columns shown with the
lszcrypt verbose output.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Show how to use util_rec_set_indent() and util_rec_print_separator()
in util_rec_example.c
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In wide format the header is separated from the rest of the
records by a separator line. Add support to print such a
separator line also between some records.
Add function util_rec_print_separator() that prints the
separator line for wide format only. For other formats this
is a NOP.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Functions rec_print_xxx allows to print records in
different formats. Add support to optionally indent
the output by a specific number of characters.
The indention is set using a new function util_rec_set_indent().
The default indention is zero, thus existing applications
will behave the same as before.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
