Rename `Aes256*` to `Aes256Gcm*` and add a deprecated constant with the
old name for backward compatibility. Adapt existing code to use the new
enum variant.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Write the secret metadata into the same directory as the generated
secret request. Before, the metadata was accidentally written into the
working directory.
Fixes: dd82c26f87 ("rust: Add tool to manage UV-secrets")
Suggested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Check if the SE-guests machine firmware is in an IBM approved state.
The machine firmware version can be obtained via setting a flag in the
attestation request.
The opaque 320 byte value from firmware is forwarded to an IBM server
that verifies the firmware value and confirms if the machine is in an
IBM approved firmware state.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a check to verify the hash over the Secret Store in the guest UV
storage. During 'create' the user can request that hash via a flag. During
'check' the user specifies the Add Secret requests and check whether the store is
locked. If the calculated hash over this state matches the one reported
by attestation, this check is successful.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a new command: check. This allows users to perform policy checks on
the Attestation result.
The host-key hashes, and the user-data can be tested for certain values.
While at it fix some typos and enable CSV parsing for the Additional-data flags.
Example:
```
pvattest check attestresp checkresult -k hkd0.crt,hkd1.crt
--host-key-check AttKeyCheck
```
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add additional data for the Attestation request. The secret store hash
measures all added secrets and the state of the store (locked or not)
with a single hash. The hash is computed by concatenating all add-secret
request tags (16 bytes each) and a byte stating the locked state (1 for
locked, 0 for not locked). The firmware state is an opaque state
description of the systems firmware status to be interpreted by an IBM
service. Add request flags and fields in the additional data structure.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add an unrecognized field to the AdditionalData struct that contains any
data that is not known by the library. Generalize the intention of the
additional data read function and make extensions to Additional data
easier. Add tests for serialization.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Rename 'ATT_ADD_HASH_SIZE' to 'PHKH_SIZE'. The new name describes the
value better. It is the size of the Public Host-Key Hash and not the
size of a generic additional-data item.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Fix the new `cargo clippy` and `cargo doc` findings that were triggered
with the recent policy addition.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Sync all install targets implementations. Some did quote the target
directories some don't. Remove all quotations. This fixes wrong install
locations of install paths that have a '~'. With quotes '~' is
interpreted literally instead of using the home dir.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Enables API users to get the request tag of an Add-Secret request.
This enables them to check for attestation policies.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Allows API users to inspect the value of additional data to use it as
part of a policy check.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This struct is not exported. Prevent any accidental exports by reducing
the visibility to pub(crate).
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Rename the previous "default" `new` constructor [1] to `with_prefix` and
add a new default `new` constructor that takes no argument is therefore
easier to use.
In addition, improve the overall documentation, add more tests, and
examples to the code.
[1] https://doc.rust-lang.org/nomicon/constructors.html
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Use the `enum_dispatch` macro for providing the `From` and `TryInto`
functionalities. In addition, it makes dynamic dispatching using enums
much easier.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Implement `From<SymKeyType> for Nid`. This makes it easier to implement
generalized functions.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This is currently the only key type supported, therefore rename the
function to make this clear. In addition, improve the documentation of
the function as function is now exported.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The library is used by multiple PV related tools, not only for managing
the guest secret store.
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Make EcPubKeyCoord available, after renaming it from EcdhPubkeyCoord.
This enables API users to calculate the hash of a public host-key and
compare it to a hash from attestation.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Create one implementation for the verbose option to be used by all
tools. While at it, add a quiet option to decrease the verbosity.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Define and set the minimal supported Rust version (MSRV) to 1.75.0. This
is the (current) minimal supported version over all supported distros
that use rust in s390-tools.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
String is more or less a Vec<u8> with some extra invariants (i.e. only
UFF-8 chars). Zeroroize is implemented by calling the Vec<u8>
implementation. The zero byte is a valid UTF-8 symbol. The String
invariant is uphold by the clearing code.
Also, implement a into_inner function for clone-able inner types.
This allows converting confidential types into no-confidential types.
As Drop is implemented this requires a clone (see E0509).
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Generalize the `Confidential` impl over Vec<T> and [COUNT; T] instead of
specializing T to u8.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Migrate Confidential to pv_core crate. This has no impact on the public
API of pv as the migrated symbols are reexported.
This enables pv_core to manage confidential data as well.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The size of an EC-secp521r1 signature can be up to 139 bytes (if ASN1
encoded). There is no lower bound, although sizes lower than 137 are
very unlikely but possible.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
The new cpacfinfo command provides information about CPACF, such as which CPACF functions are installed, and make use of the new MSA 13 Query Authentication Information function.
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Add a new format option to HexSlice to print every byte with a separated
space in between. Additionally the old format option 'alternate'
together with the new one results in another new format which prints
every byte separated by a space AND every byte has a leading '0x'.
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Co-developed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
It's uncommon and prone to error to silently stop decoding/parsing a
hex-string if there is an invalid character. Therefore, add a new
function `decode_hex` which fixes this behavior and use it in the code.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make it possible to convert internal key format to OpenSSL public key
format and vice versa. E.g. this can be useful when reading UV data
structures.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This makes it possible to reuse the constant. In addition, change the
type from i32 to usize since the value describes a size.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The size of an AES key depends on the mode of operation, so add this
information at least in the comments, as the API cannot be changed as it
is already published.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use Self instead of the struct name whenever possible.
Automagically replace struct name with Self:
`cargo clippy --fix -- -W clippy::use_self`
This streamlines the code.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
