mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
7fffdcfe8c
Instead of using AF_ALG to calculate key verification patterns, transform the key blob into a protected key and calculate the key verification patterns with CAPCF calls. The 'zkey-cryptsetup convert' command also calculates key verification patterns from clear keys. Support this, too. Reviewed-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
161 lines
4.8 KiB
Makefile
161 lines
4.8 KiB
Makefile
include ../common.mak
|
|
|
|
ifneq (${HAVE_OPENSSL},0)
|
|
ifneq (${HAVE_CRYPTSETUP2},0)
|
|
BUILD_TARGETS += zkey
|
|
INSTALL_TARGETS += install-zkey
|
|
ifneq (${HAVE_JSONC},0)
|
|
ifneq (${HAVE_LIBCURL},0)
|
|
SUB_DIRS += ekmfweb
|
|
ifneq (${HAVE_LIBXML2},0)
|
|
SUB_DIRS += kmip
|
|
endif
|
|
endif
|
|
endif
|
|
else
|
|
BUILD_TARGETS += zkey-skip-cryptsetup2
|
|
INSTALL_TARGETS += zkey-skip-cryptsetup2
|
|
endif
|
|
else
|
|
BUILD_TARGETS += zkey-skip-openssl
|
|
INSTALL_TARGETS += zkey-skip-openssl
|
|
endif
|
|
|
|
ifneq (${HAVE_CRYPTSETUP2},0)
|
|
ifneq (${HAVE_JSONC},0)
|
|
ifneq (${HAVE_OPENSSL},0)
|
|
BUILD_TARGETS += zkey-cryptsetup
|
|
INSTALL_TARGETS += install-zkey-cryptsetup
|
|
else
|
|
BUILD_TARGETS += zkey-cryptsetup-skip-openssl
|
|
INSTALL_TARGETS += zkey-cryptsetup-skip-openssl
|
|
endif
|
|
else
|
|
BUILD_TARGETS += zkey-cryptsetup-skip-jsonc
|
|
INSTALL_TARGETS += zkey-cryptsetup-skip-jsonc
|
|
endif
|
|
else
|
|
BUILD_TARGETS += zkey-cryptsetup-skip-cryptsetup2
|
|
INSTALL_TARGETS += zkey-cryptsetup-skip-cryptsetup2
|
|
endif
|
|
|
|
libs = $(rootdir)/libutil/libutil.a
|
|
|
|
ALL_CFLAGS += -DKMS_PLUGIN_LOCATION=\"$(ZKEYKMSPLUGINDIR)\" \
|
|
-D_FILE_OFFSET_BITS=64
|
|
|
|
detect-libcryptsetup.dep:
|
|
echo "#include <libcryptsetup.h>" > detect-libcryptsetup.dep
|
|
echo "#ifndef CRYPT_REQUIREMENT_INLINE_HW_TAGS" >> detect-libcryptsetup.dep
|
|
echo " #error libcryptsetup version 2.8.2 is required" >> detect-libcryptsetup.dep
|
|
echo "#endif" >> detect-libcryptsetup.dep
|
|
echo "int i = CRYPT_SLOT_UNBOUND;" >> detect-libcryptsetup.dep
|
|
echo "int test(void) { return crypt_reencrypt_init_by_keyslot_context(NULL, NULL, NULL, NULL, 0, 0, NULL, NULL, NULL); }" >> detect-libcryptsetup.dep
|
|
|
|
check-dep-zkey: detect-libcryptsetup.dep
|
|
$(call check_dep, \
|
|
"zkey", \
|
|
"openssl/evp.h", \
|
|
"openssl-devel", \
|
|
"HAVE_OPENSSL=0")
|
|
$(call check_dep, \
|
|
"zkey", \
|
|
"detect-libcryptsetup.dep", \
|
|
"cryptsetup-devel version 2.8.2", \
|
|
"HAVE_CRYPTSETUP2=0", \
|
|
-I. -lcryptsetup)
|
|
touch check-dep-zkey
|
|
|
|
check-dep-zkey-cryptsetup: detect-libcryptsetup.dep
|
|
$(call check_dep, \
|
|
"zkey-cryptsetup", \
|
|
"detect-libcryptsetup.dep", \
|
|
"cryptsetup-devel version 2.8.2", \
|
|
"HAVE_CRYPTSETUP2=0", \
|
|
-I. -lcryptsetup)
|
|
$(call check_dep, \
|
|
"zkey-cryptsetup", \
|
|
"json-c/json.h", \
|
|
"json-c-devel", \
|
|
"HAVE_JSONC=0")
|
|
touch check-dep-zkey-cryptsetup
|
|
|
|
zkey-skip-openssl:
|
|
echo " SKIP zkey due to HAVE_OPENSSL=0"
|
|
|
|
zkey-skip-cryptsetup2:
|
|
echo " SKIP zkey due to HAVE_CRYPTSETUP2=0"
|
|
|
|
zkey-cryptsetup-skip-cryptsetup2:
|
|
echo " SKIP zkey-cryptsetup due to HAVE_CRYPTSETUP2=0"
|
|
|
|
zkey-cryptsetup-skip-jsonc:
|
|
echo " SKIP zkey-cryptsetup due to HAVE_JSONC=0"
|
|
|
|
zkey-cryptsetup-skip-openssl:
|
|
echo " SKIP zkey-cryptsetup due to HAVE_OPENSSL=0"
|
|
|
|
all: $(BUILD_TARGETS) $(SUB_DIRS)
|
|
|
|
zkey.o: check-dep-zkey zkey.c pkey.h cca.h ep11.h misc.h
|
|
pkey.o: pkey.c pkey.h cca.h ep11.h utils.h cpacf.h
|
|
cca.o: cca.c cca.h pkey.h ep11.h utils.h
|
|
ep11.o: ep11.c ep11.h pkey.h cca.h utils.h
|
|
utils.o: utils.h pkey.h cca.h ep11.h
|
|
properties.o: check-dep-zkey properties.c properties.h
|
|
keystore.o: check-dep-zkey keystore.c keystore.h properties.h pkey.h cca.h \
|
|
ep11.h utils.h
|
|
zkey-cryptsetup.o: check-dep-zkey-cryptsetup zkey-cryptsetup.c pkey.h cca.h \
|
|
ep11.h misc.h utils.h
|
|
kms.o: kms.c kms.h kms-plugin.h utils.h pkey.h
|
|
pvsecrets.o: pvsecrets.h
|
|
cpacf.o: cpacf.c cpacf.h pkey.h
|
|
|
|
zkey: LDLIBS = -ldl -lcrypto
|
|
zkey: zkey.o pkey.o cca.o ep11.o properties.o keystore.o utils.o kms.o \
|
|
pvsecrets.o cpacf.o $(libs)
|
|
$(LINK) $(ALL_LDFLAGS) $^ $(LDLIBS) -o $@
|
|
|
|
zkey-cryptsetup: LDLIBS = -ldl -lcryptsetup -ljson-c -lcrypto
|
|
zkey-cryptsetup: zkey-cryptsetup.o pkey.o cca.o ep11.o utils.o cpacf.o $(libs)
|
|
$(LINK) $(ALL_LDFLAGS) $^ $(LDLIBS) -o $@
|
|
|
|
install-common:
|
|
$(INSTALL) -d -m 755 $(DESTDIR)$(USRBINDIR)
|
|
$(INSTALL) -d -m 755 $(DESTDIR)$(MANDIR)/man1
|
|
$(MAKE) -C initramfs install
|
|
$(MAKE) -C dracut install
|
|
|
|
install-zkey: zkey
|
|
$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 zkey $(DESTDIR)$(USRBINDIR)
|
|
$(INSTALL) -m 644 -c zkey.1 $(DESTDIR)$(MANDIR)/man1
|
|
$(INSTALL) -d -m 770 $(DESTDIR)$(SYSCONFDIR)/zkey
|
|
$(INSTALL) -d -m 770 $(DESTDIR)$(SYSCONFDIR)/zkey/repository
|
|
$(INSTALL) -m 644 -c kms-plugins.conf $(DESTDIR)$(SYSCONFDIR)/zkey
|
|
|
|
install-zkey-cryptsetup: zkey-cryptsetup
|
|
$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 zkey-cryptsetup $(DESTDIR)$(USRBINDIR)
|
|
$(INSTALL) -m 644 -c zkey-cryptsetup.1 $(DESTDIR)$(MANDIR)/man1
|
|
|
|
install: install-common $(INSTALL_TARGETS) $(SUB_DIRS)
|
|
|
|
clean: $(SUB_DIRS)
|
|
rm -f *.o zkey zkey-cryptsetup detect-libcryptsetup.dep \
|
|
check-dep-zkey check-dep-zkey-cryptsetup
|
|
|
|
#
|
|
# For simple "make" we explicitly set the MAKECMDGOALS to "all".
|
|
#
|
|
ifeq ($(MAKECMDGOALS),)
|
|
MAKECMDGOALS = all
|
|
endif
|
|
|
|
$(SUB_DIRS):
|
|
$(foreach goal,$(MAKECMDGOALS), \
|
|
$(MAKE) -C $@ TOPDIR=$(TOPDIR) HOST_ARCH=$(HOST_ARCH) $(goal) ;)
|
|
.PHONY: $(SUB_DIRS)
|
|
|
|
.PHONY: all install clean zkey-skip-cryptsetup2 zkey-skip-openssl \
|
|
zkey-cryptsetup-skip-cryptsetup2 zkey-cryptsetup-skip-jsonc \
|
|
install-common install-zkey install-zkey-cryptsetup
|