mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
Steffen Eiden
080a6678fb
All pvattest subcommands use the command line option -i <input> and -o <output> to specify file input and output respectively. pvsecret however uses mostly positional arguments for <input> and <output> exclusively, e.g. pvattest check input.bin output.yaml $ pvsecret add secret.bin This provides an inconsistent user interface within the Secure Execution tools and may confuse users. Add the -i and -o option to the subcommands if applicable. Input/output can then be specified like so: $ pvsecret add -i secret.bin $ pvsecret list -o list.yaml $ pvsecret verify -i FILE -o out.yaml $ pvsecret retrieve -i ID -o id.yaml Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
49 lines
1.6 KiB
Rust
49 lines
1.6 KiB
Rust
// SPDX-License-Identifier: MIT
|
|
//
|
|
// Copyright IBM Corp. 2024
|
|
|
|
use crate::cli::{VerifyOpt, VerifyOptComb};
|
|
use anyhow::{anyhow, Context, Result};
|
|
use log::warn;
|
|
use pv::misc::{read_certs, read_file};
|
|
use pv::{
|
|
request::openssl::pkey::{PKey, Public},
|
|
secret::verify_asrcb_and_get_user_data,
|
|
};
|
|
use utils::{get_reader_from_cli_file_arg, get_writer_from_cli_file_arg};
|
|
|
|
/// read the content of a DER or PEM x509 and return the public key
|
|
fn read_sgn_key(path: &str) -> Result<PKey<Public>> {
|
|
read_certs(read_file(path, "user-signing key")?)?
|
|
.first()
|
|
.ok_or(anyhow!("File does not contain a X509 certificate"))?
|
|
.public_key()
|
|
.map_err(anyhow::Error::new)
|
|
}
|
|
|
|
pub fn verify(opt: &VerifyOpt) -> Result<()> {
|
|
let opt_comb = VerifyOptComb::from(opt);
|
|
let mut rd_in = get_reader_from_cli_file_arg(opt_comb.input)?;
|
|
let mut data_in = Vec::with_capacity(0x1000);
|
|
rd_in
|
|
.read_to_end(&mut data_in)
|
|
.with_context(|| format!("Cannot read input file {}", opt_comb.input))?;
|
|
|
|
let verify_cert = opt_comb
|
|
.user_cert
|
|
.map(read_sgn_key)
|
|
.transpose()
|
|
.context("Cannot read user-verification certificate.")?;
|
|
|
|
let user_data = verify_asrcb_and_get_user_data(data_in, verify_cert)
|
|
.context("Could not verify the the Add-secret request")?;
|
|
|
|
if let Some(user_data) = user_data {
|
|
get_writer_from_cli_file_arg(opt_comb.output)?
|
|
.write_all(&user_data)
|
|
.with_context(|| format!("Cannot write user data to {}", opt_comb.output))?;
|
|
}
|
|
warn!("Successfully verified the request.");
|
|
Ok(())
|
|
}
|