kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
bb6a47db554cbdbbe28bdf5238b0edc914b49740
s390-tools/zkey/kms.c
Ingo Franzki bb6a47db55 zkey: Add KMS support for 'zkey generate' command 
When a repository that is bound to a key management system, the
keys are generated by the key management system by default. To
generate a local key, add option '--local'.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
2020-10-12 13:11:21 +02:00

2312 lines
63 KiB
C
Raw Blame History

/*
* zkey - Generate, re-encipher, and validate secure keys
*
* Copyright IBM Corp. 2020
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
*/
#include <ctype.h>
#include <dlfcn.h>
#include <dirent.h>
#include <err.h>
#include <errno.h>
#include <regex.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/utsname.h>
#include <unistd.h>
#include "lib/util_base.h"
#include "lib/util_libc.h"
#include "lib/util_rec.h"
#include "lib/util_panic.h"
#include "lib/util_prg.h"
#include "kms.h"
#include "utils.h"
#include "pkey.h"
#define ENVVAR_ZKEY_REPOSITORY "ZKEY_REPOSITORY"
#define DEFAULT_KEYSTORE "/etc/zkey/repository"
#define ENVVAR_ZKEY_KMS_PLUGINS "ZKEY_KMS_PLUGINS"
#define DEFAULT_KMS_PLUGINS "/etc/zkey/kms-plugins.conf"
#define KMS_CONFIG_FILE "kms.conf"
#define KMS_CONFIG_PROP_KMS "kms"
#define KMS_CONFIG_PROP_KMS_CONFIG "config"
#define KMS_CONFIG_PROP_APQNS "apqns"
#define KMS_CONFIG_PROP_CCA_APQNS "ep11_apqns"
#define KMS_CONFIG_PROP_EP11_APQNS "cca_apqns"
#define KMS_CONFIG_LOCAL "local"
#define KMS_KEY_PROP_NAME "zkey-name"
#define KMS_KEY_PROP_CIPHER "cipher"
#define KMS_KEY_PROP_IV_MODE "iv-mode"
#define KMS_KEY_PROP_DESCRIPTION "description"
#define KMS_KEY_PROP_VOLUMES "volumes"
#define KMS_KEY_PROP_VOLUME_TYPE "volume-type"
#define KMS_KEY_PROP_SECTOR_SIZE "sector-size"
#define KMS_KEY_PROP_XTS_KEY "xts-key"
#define KMS_KEY_PROP_XTS_KEY1_ID "xts-key1-id"
#define KMS_KEY_PROP_XTS_KEY2_ID "xts-key2-id"
#define KMS_KEY_PROP_XTS_KEY1_LABEL "xts-key1-label"
#define KMS_KEY_PROP_XTS_KEY2_LABEL "xts-key2-label"
static const char * const key_types[] = {
KEY_TYPE_CCA_AESDATA,
KEY_TYPE_CCA_AESCIPHER,
KEY_TYPE_EP11_AES,
NULL
};
typedef const struct kms_functions *(*kms_get_functions_t)(void);
#define pr_verbose(verbose, fmt...) do { \
if (verbose) \
warnx(fmt); \
} while (0)
#define ARRAY_ADD(array, num_elemnts, element_size, new_element) \
do { \
(num_elemnts)++; \
(array) = util_realloc((array), \
(num_elemnts) * element_size); \
memcpy(&(array)[(num_elemnts) - 1], new_element, \
element_size); \
} while (0)
#define ARRAY_REMOVE(array, num_elemnts, element_size, index) \
do { \
if ((index) < (num_elemnts) - 1) \
memmove(&(array)[(index)], \
&(array)[(index) + 1], \
((num_elemnts) - (index) - 1) * \
element_size); \
(num_elemnts)--; \
if ((num_elemnts) > 0) { \
(array) = util_realloc((array), \
(num_elemnts) * element_size); \
} \
} while (0)
/**
* Opens kms-plugins.conf. Looks for the file in /etc/zkey/, or if environment
* variable ZKEY_KMS_PLUGINS is set then it uses the file name and path
* specified there.
*/
static FILE *open_kms_plugins_file(bool verbose)
{
char *conf;
FILE *fp;
conf = getenv(ENVVAR_ZKEY_KMS_PLUGINS);
if (conf == NULL)
conf = DEFAULT_KMS_PLUGINS;
pr_verbose(verbose, "Opening KMS plugins config file '%s'", conf);
fp = fopen(conf, "r");
if (fp == NULL) {
warnx("File '%s': %s", conf, strerror(errno));
return NULL;
}
return fp;
}
/**
* Lists the KMS plugins defined in kms-plugins.conf
*
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
*/
int list_kms_plugins(bool verbose)
{
struct util_rec *rec;
char line[4096];
int rc = 0;
size_t len;
FILE *fp;
char *ch;
fp = open_kms_plugins_file(verbose);
if (fp == NULL)
return -EIO;
rec = util_rec_new_wide("-");
util_rec_def(rec, "PLUGIN", UTIL_REC_ALIGN_LEFT, 25, "KMS-Plugin");
util_rec_def(rec, "LIB", UTIL_REC_ALIGN_LEFT, 25, "Shared library");
util_rec_print_hdr(rec);
while (fgets(line, sizeof(line), fp) != NULL) {
len = strlen(line);
if (len < 1)
continue;
if (line[0] == '#')
continue;
if (line[len - 1] == '\n')
line[len - 1] = '\0';
ch = strchr(line, '=');
if (ch == NULL) {
rc = -EPERM;
warnx("Syntax error in kms-plugins.conf. Line: '%s'",
line);
goto out;
}
*ch = '\0';
ch++;
util_rec_set(rec, "PLUGIN", line);
util_rec_set(rec, "LIB", ch);
util_rec_print(rec);
}
out:
util_rec_free(rec);
fclose(fp);
return rc;
}
/**
* Loads a KMS plugin by its plugin name. Looks up the shared library in
* kms-plugins.conf for the specified plugin name, and loads the shared library
* via dlopen
*
* @param[in] plugin the plugin name (as in kms-plugins.conf)
* @param[out] kms_functions the plugin functions obtain from the plugin
* @param[out] plugin_lib the library handle (free with dlclose)
* @param[out] plugin_name the full name of the plugin loaded
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
*/
static int load_kms_plugin(const char *plugin,
const struct kms_functions **kms_functions,
void **plugin_lib, char **plugin_name, bool verbose)
{
kms_get_functions_t _kms_get_functions;
char *so_name = NULL;
FILE *fp = NULL;
char line[4096];
int rc = 0;
size_t len;
char *ch;
util_assert(plugin != NULL, "Internal error: plugin is NULL");
util_assert(kms_functions != NULL,
"Internal error: kms_functions is NULL");
util_assert(plugin_lib != NULL, "Internal error: plugin_lib is NULL");
util_assert(plugin_name != NULL, "Internal error: plugin_name is NULL");
fp = open_kms_plugins_file(verbose);
if (fp == NULL)
return -EIO;
while (fgets(line, sizeof(line), fp) != NULL) {
len = strlen(line);
if (len < 1)
continue;
if (line[0] == '#')
continue;
if (line[len - 1] == '\n')
line[len - 1] = '\0';
ch = strchr(line, '=');
if (ch == NULL) {
rc = -EPERM;
warnx("Syntax error in kms-plugins.conf. Line: '%s'",
line);
goto out;
}
*ch = '\0';
ch++;
if (strcasecmp(line, plugin) == 0) {
so_name = ch;
*plugin_name = util_strdup(line);
break;
}
}
if (so_name == NULL) {
rc = -ENOENT;
warnx("KMS plugin '%s' not found.", plugin);
goto out;
}
pr_verbose(verbose, "Loading KMS plugin '%s': '%s'", *plugin_name,
so_name);
*plugin_lib = dlopen(so_name, RTLD_GLOBAL | RTLD_NOW);
if (*plugin_lib == NULL) {
pr_verbose(verbose, "%s", dlerror());
warnx("Failed to load KMS plugin '%s': '%s'", *plugin_name,
so_name);
rc = -ELIBACC;
goto out;
}
_kms_get_functions = (kms_get_functions_t)dlsym(*plugin_lib,
"kms_get_functions");
if (_kms_get_functions == NULL) {
pr_verbose(verbose, "%s", dlerror());
warnx("Failed to load KMS plugin '%s': '%s'", *plugin_name,
so_name);
rc = -ELIBACC;
goto out;
}
*kms_functions = _kms_get_functions();
if (*kms_functions == NULL) {
pr_verbose(verbose, "kms_get_functions() reutned NULL");
warnx("Failed to load KMS plugin '%s': '%s'", *plugin_name,
so_name);
rc = -ELIBACC;
goto out;
}
pr_verbose(verbose, "Successfully loaded KMS plugin '%s': '%s' (API "
"version: %u)", *plugin_name, so_name,
(*kms_functions)->api_version);
out:
if (fp != NULL)
fclose(fp);
if (rc != 0 && *plugin_lib != NULL) {
dlclose(*plugin_lib);
*plugin_lib = NULL;
}
if (rc != 0 && *plugin_name != NULL) {
free(*plugin_name);
*plugin_name = NULL;
}
return rc;
}
/**
* Load the kms.conf properties file that is located in the repository
* directory. The returned properties object must be freed by the caller using
* properties_free() when no longer needed.
*
* @param[in] repository the repository directory
* @param[out] kms_props On return: a new properties object with the
* properties read from kms.conf.
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
*/
static int load_kms_properties(const char *repository,
struct properties **kms_props, bool verbose)
{
struct properties *props = NULL;
char *filename = NULL;
int rc;
util_assert(repository != NULL, "Internal error: repository is NULL");
util_assert(kms_props != NULL, "Internal error: kms_props is NULL");
util_asprintf(&filename, "%s/%s", repository, KMS_CONFIG_FILE);
pr_verbose(verbose, "Trying to load '%s'", filename);
props = properties_new();
rc = properties_load(props, filename, true);
if (rc != 0) {
pr_verbose(verbose, "Failed to load '%s': %s", filename,
strerror(-rc));
goto out;
}
*kms_props = props;
out:
if (filename != NULL)
free(filename);
if (rc != 0)
properties_free(props);
return rc;
}
/**
* Save the kms.conf properties file that is located in the repository
* directory.
*
* @param[in] keystore the keystore
* @param[in] kms_props The properties object to save to kms.conf.
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
*/
static int _save_kms_properties(const struct keystore *keystore,
struct properties *kms_props, bool verbose)
{
char *filename = NULL;
int rc;
util_assert(keystore != NULL, "Internal error: keystore is NULL");
util_assert(kms_props != NULL, "Internal error: kms_props is NULL");
util_asprintf(&filename, "%s/%s", keystore->directory, KMS_CONFIG_FILE);
pr_verbose(verbose, "Saving '%s'", filename);
rc = properties_save(kms_props, filename, true);
if (rc != 0) {
pr_verbose(verbose, "Failed to save '%s': %s", filename,
strerror(-rc));
goto out;
}
if (chmod(filename, keystore->mode) != 0) {
rc = -errno;
warnx("chmod failed on file '%s': %s", filename, strerror(-rc));
return rc;
}
if (chown(filename, geteuid(), keystore->owner) != 0) {
rc = -errno;
warnx("chown failed on file '%s': %s", filename, strerror(-rc));
return rc;
}
out:
if (filename != NULL)
free(filename);
return rc;
}
/**
* Check if a KMS plugin is configured for the current repository, and if so,
* load the KMS plugin.
*
* @param[out] kms_info Filled with information about the KMS plugin and
* configuration. If no KMS plugin is configured,
* all fields are set to NULL.
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
* Note: It is not an error case of no plugin is configured.
*/
int check_for_kms_plugin(struct kms_info *kms_info, bool verbose)
{
char *directory, *plugin = NULL;
int rc;
util_assert(kms_info != NULL, "Internal error: kms_info is NULL");
memset(kms_info, 0, sizeof(*kms_info));
directory = getenv(ENVVAR_ZKEY_REPOSITORY);
if (directory == NULL)
directory = DEFAULT_KEYSTORE;
rc = load_kms_properties(directory, &kms_info->props, verbose);
if (rc != 0) {
pr_verbose(verbose, "No KMS plugin is configured");
rc = 0;
goto out;
}
plugin = properties_get(kms_info->props, KMS_CONFIG_PROP_KMS);
if (plugin == NULL || strcasecmp(plugin, KMS_CONFIG_LOCAL) == 0) {
pr_verbose(verbose, "No KMS plugin is configured");
rc = 0;
goto out;
}
rc = load_kms_plugin(plugin, &kms_info->funcs, &kms_info->plugin_lib,
&kms_info->plugin_name, verbose);
if (rc != 0)
goto out;
out:
if (plugin != NULL)
free(plugin);
if (rc != 0)
free_kms_plugin(kms_info);
return rc;
}
/**
* Initializes the KMS plugin.
*
* @param[in] kms_info The KMS Plugin info
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
*/
int init_kms_plugin(struct kms_info *kms_info, bool verbose)
{
char *config_path = NULL;
char **apqn_list = NULL;
char *apqns = NULL;
int i, rc = 0;
util_assert(kms_info != NULL, "Internal error: kms_info is NULL");
config_path = properties_get(kms_info->props,
KMS_CONFIG_PROP_KMS_CONFIG);
if (config_path == NULL) {
warnx("Incomplete KMS configuration");
rc = -EIO;
goto out;
}
if (kms_info->funcs->kms_initialize != NULL) {
kms_info->handle = kms_info->funcs->kms_initialize(config_path,
verbose);
if (kms_info->handle == NULL) {
warnx("KMS plugin '%s' failed to initialize",
kms_info->plugin_name);
rc = -EIO;
goto out;
}
}
apqns = properties_get(kms_info->props, KMS_CONFIG_PROP_APQNS);
if (apqns != NULL && strlen(apqns) > 0) {
apqn_list = str_list_split(apqns);
for (i = 0; apqn_list[i] != NULL; i++)
;
kms_info->num_apqns = i;
kms_info->apqns = util_malloc(i * sizeof(struct kms_apqn));
for (i = 0; apqn_list[i] != NULL; i++) {
if (sscanf(apqn_list[i], "%hx.%hx",
&kms_info->apqns[i].card,
&kms_info->apqns[i].domain) != 2) {
warnx("The APQN '%s' is not valid",
apqn_list[i]);
rc = -EINVAL;
goto out;
}
}
}
out:
if (config_path != NULL)
free(config_path);
if (apqns != NULL)
free(apqns);
if (apqn_list != NULL)
str_list_free_string_array(apqn_list);
return rc;
}
/**
* Terminates, free and close a KMS plugin
*
* @param[in] kms_info The KMS Plugin info to free
*/
void free_kms_plugin(struct kms_info *kms_info)
{
if (kms_info == NULL)
return;
if (kms_info->handle != NULL && kms_info->funcs != NULL &&
kms_info->funcs->kms_terminate != NULL)
kms_info->funcs->kms_terminate(kms_info->handle);
kms_info->handle = NULL;
if (kms_info->props != NULL)
properties_free(kms_info->props);
kms_info->props = NULL;
if (kms_info->plugin_lib != NULL)
dlclose(kms_info->plugin_lib);
kms_info->plugin_lib = NULL;
kms_info->funcs = NULL;
if (kms_info->plugin_name != NULL)
free(kms_info->plugin_name);
kms_info->plugin_name = NULL;
if (kms_info->apqns != NULL)
free(kms_info->apqns);
kms_info->apqns = NULL;
kms_info->num_apqns = 0;
}
/**
* Prints the error message from the KMS plugin's last error
*/
void print_last_kms_error(const struct kms_info *kms_info)
{
const char *msg;
if (kms_info == NULL || kms_info->funcs == NULL ||
kms_info->funcs->kms_get_last_error == NULL ||
kms_info->handle == NULL)
return;
msg = kms_info->funcs->kms_get_last_error(kms_info->handle);
if (msg == NULL)
return;
util_print_indented(msg, 0);
}
/**
* Binds the specified KMS plugin to the current repository.
* If the repository is already bound to a KMS plugin, then -EALREADY is
* returned.
*
* @param[in] keystore the keystore to bind to the plugin
* @param[in] plugin the name of the KMS plugin to bind
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
*/
int bind_kms_plugin(struct keystore *keystore, const char *plugin,
bool verbose)
{
char *directory, *config_dir = NULL;
const struct kms_functions *funcs;
struct properties *props = NULL;
char *plugin_name = NULL;
void *plugin_lib = NULL;
bool created = false;
int rc;
util_assert(keystore != NULL, "Internal error: keystore is NULL");
util_assert(plugin != NULL, "Internal error: plugin is NULL");
rc = load_kms_properties(keystore->directory, &props, verbose);
if (rc == 0) {
plugin_name = properties_get(props, KMS_CONFIG_PROP_KMS);
if (plugin_name != NULL &&
strcasecmp(plugin_name, KMS_CONFIG_LOCAL) != 0) {
warnx("The repository is already bound to KMS plugin "
"'%s'", plugin_name);
rc = -EALREADY;
goto out;
}
properties_free(props);
props = NULL;
}
rc = load_kms_plugin(plugin, &funcs, &plugin_lib, &plugin_name,
verbose);
if (rc != 0)
goto out;
directory = getenv(ENVVAR_ZKEY_REPOSITORY);
if (directory == NULL)
directory = DEFAULT_KEYSTORE;
util_asprintf(&config_dir, "%s/%s", directory, plugin_name);
pr_verbose(verbose, "Plugin config dir: '%s'", config_dir);
rc = mkdir(config_dir, keystore->mode);
if (rc != 0) {
rc = -errno;
warnx("Failed to create directory '%s': %s", config_dir,
strerror(-rc));
goto out;
}
created = true;
if (chmod(config_dir, keystore->mode) != 0) {
rc = -errno;
warnx("chmod failed on directory '%s': %s", config_dir,
strerror(-rc));
return rc;
}
if (chown(config_dir, geteuid(), keystore->owner) != 0) {
rc = -errno;
warnx("chown failed on directory '%s': %s", config_dir,
strerror(-rc));
return rc;
}
if (funcs->kms_bind != NULL) {
rc = funcs->kms_bind(config_dir);
if (rc != 0) {
warnx("KMS plugin '%s' failed to bind to the "
"repository: %s", plugin_name, strerror(-rc));
goto out;
}
}
props = properties_new();
rc = properties_set(props, KMS_CONFIG_PROP_KMS, plugin_name);
if (rc != 0)
goto out;
rc = properties_set(props, KMS_CONFIG_PROP_KMS_CONFIG, config_dir);
if (rc != 0)
goto out;
rc = _save_kms_properties(keystore, props, verbose);
if (rc != 0) {
warnx("Failed to save kms.conf into repository directory");
goto out;
}
out:
if (plugin_name != NULL)
free(plugin_name);
if (props != NULL)
properties_free(props);
if (plugin_lib != NULL)
dlclose(plugin_lib);
if (config_dir != NULL) {
if (rc != 0 && created)
rmdir(config_dir);
free(config_dir);
}
return rc;
}
/**
* Removes a directory and all its contents.
*/
static int remove_directory_recursively(const char *directory)
{
char *filename = NULL;
struct dirent *de;
DIR *dirp;
int rc = 0;
dirp = opendir(directory);
if (dirp == NULL) {
rc = -errno;
warnx("Failed to open directory '%s'", directory);
return rc;
}
while ((de = readdir(dirp))) {
util_asprintf(&filename, "%s/%s", directory, de->d_name);
if (de->d_type == DT_DIR) {
if (strcmp(de->d_name, ".") != 0 &&
strcmp(de->d_name, "..") != 0)
rc = remove_directory_recursively(filename);
} else {
rc = remove(filename);
if (rc != 0) {
rc = -errno;
warnx("Failed to remove '%s': %s", filename,
strerror(-rc));
}
}
free(filename);
if (rc != 0)
break;
}
closedir(dirp);
if (rc != 0)
goto out;
if (rmdir(directory) != 0) {
rc = -errno;
warnx("Failed to remove '%s': %s", filename, strerror(-rc));
goto out;
}
out:
return rc;
}
/**
* Unbinds the currently bound KMS plugin from the current repository.
* If the repository is not bound to a KMS plugin, then -ENOENT is
* returned.
*
* @param[in] kms_info information of the currently bound plugin.
* This function does NOT free the plugin, this must
* be done by the caller using free_kms_plugin().
* @param[in] keystore the keystore to bind to the plugin
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
*/
int unbind_kms_plugin(struct kms_info *kms_info, struct keystore *keystore,
bool UNUSED(verbose))
{
char *config_dir = NULL;
char *filename = NULL;
int rc;
util_assert(kms_info != NULL, "Internal error: kms_info is NULL");
util_assert(keystore != NULL, "Internal error: keystore is NULL");
if (kms_info->plugin_lib == NULL) {
rc = -ENOENT;
warnx("The repository is not bound to a KMS plugin");
goto out;
}
if (kms_info->funcs->kms_deconfigure != NULL &&
kms_info->handle != NULL) {
rc = kms_info->funcs->kms_deconfigure(kms_info->handle);
if (rc != 0) {
warnx("KMS plugin '%s' failed to unbind from the "
"repository: %s", kms_info->plugin_name,
strerror(-rc));
print_last_kms_error(kms_info);
goto out;
}
}
config_dir = properties_get(kms_info->props,
KMS_CONFIG_PROP_KMS_CONFIG);
if (config_dir != NULL) {
rc = remove_directory_recursively(config_dir);
if (rc != 0) {
warnx("Failed to remove the KMS plugin's config "
"directory: %s", strerror(-rc));
goto out;
}
}
util_asprintf(&filename, "%s/%s", keystore->directory, KMS_CONFIG_FILE);
rc = remove(filename);
if (rc != 0) {
rc = -errno;
warnx("Failed to remove '%s': %s", filename, strerror(-rc));
goto out;
}
out:
if (config_dir != NULL)
free(config_dir);
if (filename != NULL)
free(filename);
return rc;
}
/**
* Displays information about the KMS plugin and its configuration
*
* @param[in] kms_info information of the currently bound plugin.
*
* @returns 0 for success or a negative errno in case of an error.
*/
int print_kms_info(struct kms_info *kms_info)
{
bool first;
int rc = 0;
size_t i;
util_assert(kms_info != NULL, "Internal error: kms_info is NULL");
if (kms_info->plugin_lib == NULL) {
rc = -ENOENT;
warnx("The repository is not bound to a KMS plugin");
goto out;
}
printf("KMS-Plugin: %s\n", kms_info->plugin_name);
if (kms_info->funcs->kms_supports_key_type != NULL) {
for (i = 0, first = true; key_types[i] != NULL; i++) {
if (kms_info->funcs->kms_supports_key_type(
kms_info->handle, key_types[i])) {
printf(" %s %s\n", first ?
"Supported key types:" :
" ", key_types[i]);
first = false;
}
}
if (first)
printf(" Supported key types: (none)\n");
} else {
printf(" Supported key types: (unknown)\n");
}
if (kms_info->apqns == NULL || kms_info->num_apqns == 0) {
printf(" APQNs: (configuration required)\n");
goto kms_info;
}
for (i = 0; i < kms_info->num_apqns; i++)
printf(" %s %02x.%04x\n",
i == 0 ? "APQNs:" : " ",
kms_info->apqns[i].card,
kms_info->apqns[i].domain);
kms_info:
if (kms_info->funcs->kms_display_info == NULL)
goto out;
rc = kms_info->funcs->kms_display_info(kms_info->handle);
if (rc != 0) {
warnx("Failed to display information about the plugin: %s",
strerror(-rc));
print_last_kms_error(kms_info);
goto out;
}
out:
return rc;
}
/**
* Gets the KMS plugin command specific option vector and puts them into the
* placeholder slots in opt_vec.
*
* @param[in] kms_info information of the currently bound plugin.
* @param[in] opt_vec the option vector to modify.
* @param[in] placeholder_cmd the command with which the placeholder option
* vector entries are marked
* @param[in] plugin_command the plugin command to get the options for
* @param[in] opt_vec_command the command to use in the option vector entries
* @param[out] first_plugin_opt on return: the index of the first plugin option
* in opt_vec, or -1 if no plugin options are used.
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
*/
int get_kms_options(struct kms_info *kms_info, struct util_opt *opt_vec,
const char *placeholder_cmd, const char *plugin_command,
const char *opt_vec_command, int *first_plugin_opt,
bool verbose)
{
const struct util_opt *plugin_opts;
int i, k, first = 0, num_slots = 0;
util_assert(kms_info != NULL, "Internal error: kms_info is NULL");
util_assert(opt_vec != NULL, "Internal error: opt_vec is NULL");
util_assert(placeholder_cmd != NULL,
"Internal error: placeholder_cmd is NULL");
util_assert(plugin_command != NULL,
"Internal error: plugin_command is NULL");
util_assert(first_plugin_opt != NULL,
"Internal error: first_plugin_opt is NULL");
*first_plugin_opt = -1;
if (kms_info->plugin_lib == NULL) {
pr_verbose(verbose, "not bound to a KMS plugin");
return 0;
}
if (kms_info->funcs->kms_get_command_options == NULL) {
pr_verbose(verbose, "Plugin does not support command options");
return 0;
}
if (strcmp(plugin_command, KMS_COMMAND_CONFIGURE) != 0 &&
strcmp(plugin_command, KMS_COMMAND_REENCIPHER) != 0 &&
strcmp(plugin_command, KMS_COMMAND_GENERATE) != 0 &&
strcmp(plugin_command, KMS_COMMAND_REMOVE) != 0 &&
strcmp(plugin_command, KMS_COMMAND_LIST) != 0 &&
strcmp(plugin_command, KMS_COMMAND_LIST_IMPORT) != 0) {
pr_verbose(verbose, "Command %s is not eligible for plugin "
"options", plugin_command);
return 0;
}
for (i = 0; opt_vec[i].desc != NULL; i++) {
if (opt_vec[i].command != NULL &&
strcmp(opt_vec[i].command, placeholder_cmd) == 0) {
if (first == 0)
first = i;
num_slots++;
}
}
pr_verbose(verbose, "%u placeholder slots found", num_slots);
plugin_opts = kms_info->funcs->kms_get_command_options(plugin_command,
num_slots);
if (plugin_opts == NULL) {
pr_verbose(verbose, "No plugin options for command %s",
plugin_command);
return 0;
}
for (k = 0, i = first; plugin_opts[k].desc != NULL &&
i < first + num_slots; i++, k++) {
memcpy(&opt_vec[i], &plugin_opts[k], sizeof(struct util_opt));
opt_vec[i].command = (char *)opt_vec_command;
}
pr_verbose(verbose, "%u plugin options", k);
*first_plugin_opt = first;
return 0;
}
/**
* Checks if the option is a KMS plugin specific option and if so, adds it to
* list of KMS options. If the option is not handled by the plugin, then
* -ENOENT is returned.
*
* @param[in] kms_info information of the currently bound plugin.
* @param[in] opt_vec the option vector.
* @param[in] first_kms_option index of first KMS option in opt_vec
* @param[in] command the plugin command to handle
* @param[in] option the option character to handle
* @param[in] optarg the option argument or NULL
* @param[out] kms_options on return: an array of KMS options handled. The
* array is resized to add more options.
* @param[out] num_kms_options on return: The number of options in above array
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
*
*/
int handle_kms_option(struct kms_info *kms_info, struct util_opt *opt_vec,
int first_kms_option, const char *command, int option,
const char *optarg, struct kms_option **kms_options,
size_t *num_kms_options, bool verbose)
{
struct kms_option opt = { .option = option, .argument = optarg };
int i;
util_assert(kms_info != NULL, "Internal error: kms_info is NULL");
util_assert(opt_vec != NULL, "Internal error: opt_vec is NULL");
util_assert(command != NULL, "Internal error: command is NULL");
util_assert(kms_options != NULL, "Internal error: kms_options is NULL");
util_assert(num_kms_options != NULL,
"Internal error: num_kms_options is NULL");
if (kms_info->plugin_lib == NULL) {
pr_verbose(verbose, "not bound to a KMS plugin");
return -ENOENT;
}
if (first_kms_option < 0) {
pr_verbose(verbose, "No plugin specific options");
return -ENOENT;
}
for (i = first_kms_option; opt_vec[i].command != NULL &&
strcmp(opt_vec[i].command, command) == 0; i++) {
if ((opt_vec[i].flags & UTIL_OPT_FLAG_SECTION) == 0 &&
opt_vec[i].option.val == option) {
ARRAY_ADD(*kms_options, *num_kms_options,
sizeof(struct kms_option), &opt);
return 0;
}
}
return -ENOENT;
}
struct card_info {
enum card_type type;
int min_level;
struct fw_version min_fw_version;
struct kms_apqn *apqns;
size_t num_apqns;
};
/**
* Parses an APQN and checks if it is online.
*
* @param[in] apqn the APQN to parse
* @param[out] kms_apqn the parse APQN is filled in
* @param{in] check if true, the APQN is checked to be online
* @param[in] cards An array of cards types with its requirements
* @param[in] num_cards The number of elements in above array
*
* @returns 0 for success or a negative errno in case of an error.
*/
static int _parse_and_check_apqn(const char *apqn, struct kms_apqn *kms_apqn,
bool check, struct card_info *cards,
size_t num_cards)
{
struct card_info *card_info = NULL;
struct fw_version fw_version;
int rc, card, domain, level;
enum card_type type;
regmatch_t pmatch[1];
regex_t reg_buf;
unsigned int num;
size_t i;
rc = regcomp(&reg_buf, "[[:xdigit:]]+\\.[[:xdigit:]]", REG_EXTENDED);
if (rc != 0)
return -EIO;
rc = regexec(&reg_buf, apqn, (size_t)1, pmatch, 0);
if (rc != 0) {
warnx("The APQN '%s' is not valid", apqn);
rc = -EINVAL;
goto out;
}
if (sscanf(apqn, "%x.%x%n", &card, &domain, &num) != 2 ||
num != strlen(apqn) || card < 0 || card > 0xff ||
domain < 0 || domain > 0xFFFF) {
warnx("The APQN '%s' is not valid", apqn);
rc = -EINVAL;
goto out;
}
kms_apqn->card = card;
kms_apqn->domain = domain;
if (!check) {
rc = 0;
goto out;
}
type = sysfs_get_card_type(card);
if (type == -1) {
warnx("The APQN %02x.%04x is not available or has an "
"unsupported type", card, domain);
rc = -EIO;
goto out;
}
rc = sysfs_is_apqn_online(card, domain, CARD_TYPE_ANY);
if (rc != 1) {
warnx("The APQN %02x.%04x is not available or not online",
card, domain);
rc = -EIO;
goto out;
}
for (i = 0, card_info = NULL; i < num_cards; i++) {
if (cards[i].type == type) {
card_info = &cards[i];
break;
}
}
if (card_info == NULL) {
warnx("APQN %02x.%04x: The card type is not supported by the "
"KMS plugin", card, domain);
rc = -EIO;
goto out;
}
level = sysfs_get_card_level(card);
if (level < card_info->min_level) {
warnx("APQN %02x.%04x: The card level is less than CEX%dn.",
card, domain, card_info->min_level);
rc = -EIO;
goto out;
}
rc = sysfs_get_firmware_version(card, &fw_version, false);
if (rc == 0) {
if (fw_version.api_ordinal <
card_info->min_fw_version.api_ordinal) {
warnx("APQN %02x.%04x: The firmware version is too "
"less", card, domain);
rc = -EIO;
goto out;
}
if (card_info->min_level > 0 && card_info->min_level == level &&
(fw_version.major < card_info->min_fw_version.major ||
(fw_version.major == card_info->min_fw_version.major &&
fw_version.minor < card_info->min_fw_version.minor))) {
warnx("APQN %02x.%04x: The firmware version is too "
"less", card, domain);
rc = -EIO;
goto out;
}
}
rc = 0;
out:
regfree(&reg_buf);
return rc;
}
/**
* Add APQNs to the current APQN association of the KMS plugin
*
* @param[in] kms_info information of the currently bound plugin.
* @param[in] apqns the APQNs specification from --apqns option
* @param[in] cards An array of card types with its requirements
* @param[in] num_cardsqs The number of elements in above array
*
* @returns 0 for success or a negative errno in case of an error.
*/
static int _add_kms_apqns(struct kms_info *kms_info, const char *apqns,
struct card_info *cards, size_t num_cards)
{
struct kms_apqn kms_apqn;
char **new_apqns;
int i, rc = 0;
size_t k;
new_apqns = str_list_split(apqns);
for (i = 0; new_apqns[i] != NULL; i++) {
rc = _parse_and_check_apqn(new_apqns[i], &kms_apqn, true,
cards, num_cards);
if (rc != 0)
goto out;
for (k = 0; k < kms_info->num_apqns; k++) {
if (kms_apqn.card == kms_info->apqns[k].card &&
kms_apqn.domain == kms_info->apqns[k].domain) {
warnx("APQN %02x.%04x is already associated "
"with the KMS plugin", kms_apqn.card,
kms_apqn.domain);
rc = -EEXIST;
goto out;
}
}
ARRAY_ADD(kms_info->apqns, kms_info->num_apqns,
sizeof(struct kms_apqn), &kms_apqn);
}
out:
str_list_free_string_array(new_apqns);
return rc;
}
/**
* Remove APQNs from the current APQN association of the KMS plugin
*
* @param[in] kms_info information of the currently bound plugin.
* @param[in] apqns the APQNs specification from --apqns option
* @param[in] cards An array of card types with its requirements
* @param[in] num_cards The number of elements in above array
*
* @returns 0 for success or a negative errno in case of an error.
*/
static int _remove_kms_apqns(struct kms_info *kms_info, const char *apqns,
struct card_info *cards, size_t num_cards)
{
struct kms_apqn kms_apqn;
char **rem_apqns;
int i, rc = 0;
size_t k;
rem_apqns = str_list_split(apqns);
for (i = 0; rem_apqns[i] != NULL; i++) {
rc = _parse_and_check_apqn(rem_apqns[i], &kms_apqn, false,
cards, num_cards);
if (rc != 0)
goto out;
for (k = 0; k < kms_info->num_apqns; k++) {
if (kms_apqn.card == kms_info->apqns[k].card &&
kms_apqn.domain == kms_info->apqns[k].domain) {
ARRAY_REMOVE(kms_info->apqns,
kms_info->num_apqns,
sizeof(struct kms_apqn), k);
rc = 0;
goto out;
}
}
warnx("APQN %02x.%04x is not associated with the KMS plugin",
kms_apqn.card, kms_apqn.domain);
rc = -ENOENT;
goto out;
}
out:
free(rem_apqns);
return rc;
}
/**
* Set the APQN association of the KMS plugin
*
* @param[in] kms_info information of the currently bound plugin.
* @param[in] apqns the APQNs specification from --apqns option
* @param[in] cards An array of card types with its requirements
* @param[in] num_cards The number of elements in above array
*
* @returns 0 for success or a negative errno in case of an error.
*/
static int _set_kms_apqns(struct kms_info *kms_info, const char *apqns,
struct card_info *cards, size_t num_cards)
{
if (kms_info->apqns != NULL)
free(kms_info->apqns);
kms_info->apqns = NULL;
kms_info->num_apqns = 0;
if (strlen(apqns) == 0) {
/* Indicate empty list specified */
kms_info->apqns = util_malloc(sizeof(struct kms_apqn));
return 0;
}
return _add_kms_apqns(kms_info, apqns, cards, num_cards);
}
/**
* Change the APQN association of the KMS plugin
*
* @param[in] kms_info information of the currently bound plugin.
* @param[in] apqns the APQNs specification from --apqns option
* @param[in] cards An array of card types with its requirements
* @param[in] num_cards The number of elements in above array
*
* @returns 0 for success or a negative errno in case of an error.
*/
static int _change_kms_apqns(struct kms_info *kms_info, const char *apqns,
struct card_info *cards, size_t num_cards)
{
switch (*apqns) {
case '+':
if (kms_info->apqns != NULL && kms_info->num_apqns > 0)
return _add_kms_apqns(kms_info, &apqns[1], cards,
num_cards);
else
return _set_kms_apqns(kms_info, &apqns[1], cards,
num_cards);
case '-':
if (kms_info->apqns != NULL && kms_info->num_apqns > 0)
return _remove_kms_apqns(kms_info, &apqns[1], cards,
num_cards);
warnx("No APQNs are currently associated with the KMS plugin");
return -ENOENT;
default:
return _set_kms_apqns(kms_info, apqns, cards, num_cards);
}
}
/**
* Returns the crypto card requirements per card type base on the key types that
* the KMS plugin supports.
*
* @param[in] kms_info information of the currently bound plugin.
* @param[out] cards on return: An array of card types with its
* requirements. The caller must free this array if
* no longer used.
* @param[out] num_cards on return: The number of elements in above array
* @param[in] verbose if true, verbose messages are printed
*
* @returns the card type
*/
static int _get_supported_card_types(struct kms_info *kms_info,
struct card_info **cards,
size_t *num_cards, bool verbose)
{
struct card_info new_card = { 0 };
const struct fw_version *fw_ver;
struct card_info *req;
enum card_type type;
int i, level;
size_t k;
util_assert(kms_info != NULL, "Internal error: kms_info is NULL");
util_assert(cards != NULL, "Internal error: reqs is NULL");
util_assert(num_cards != NULL, "Internal error: num_reqs is NULL");
*cards = NULL;
*num_cards = 0;
if (kms_info->funcs->kms_supports_key_type == NULL)
return 0;
for (i = 0; key_types[i] != NULL; i++) {
if (kms_info->funcs->kms_supports_key_type(kms_info->handle,
key_types[i])) {
pr_verbose(verbose, "KMS plugin supports key type %s",
key_types[i]);
type = get_card_type_for_keytype(key_types[i]);
level = get_min_card_level_for_keytype(key_types[i]);
fw_ver = get_min_fw_version_for_keytype(key_types[i]);
for (req = NULL, k = 0; k < *num_cards; k++) {
if ((*cards)[k].type == type)
req = &(*cards)[k];
}
if (req == NULL) {
new_card.type = type;
new_card.min_level = level;
if (fw_ver != NULL)
new_card.min_fw_version = *fw_ver;
ARRAY_ADD(*cards, *num_cards,
sizeof(struct card_info),
&new_card);
req = &(*cards)[*num_cards - 1];
}
if (req->min_level < level) {
req->min_level = level;
if (fw_ver != NULL) {
if (req->min_fw_version.api_ordinal <
fw_ver->api_ordinal ||
req->min_fw_version.major <
fw_ver->major ||
(req->min_fw_version.major ==
fw_ver->major &&
req->min_fw_version.minor <
fw_ver->minor))
req->min_fw_version = *fw_ver;
}
}
pr_verbose(verbose, "Card type: %d", req->type);
pr_verbose(verbose, "Card level: %d", req->min_level);
pr_verbose(verbose, "Fw version: %d.%d (API: %d)",
req->min_fw_version.major,
req->min_fw_version.minor,
req->min_fw_version.api_ordinal);
}
}
pr_verbose(verbose, "%lu card type are supported", *num_cards);
return 0;
}
/**
* Builds an APQN list per card type.
*
* @param[in] kms_info information of the currently bound plugin.
* @param[in] cards An array of card types to build APQNs lists for
* @param[in] num_cards The number of elements in above array
*
* @returns 0 for success or a negative errno in case of an error.
*/
static int _get_apqns_per_card_type(struct kms_info *kms_info,
struct card_info *cards, size_t num_cards)
{
enum card_type type;
size_t i, k;
bool found;
for (i = 0; i < kms_info->num_apqns; i++) {
if (!sysfs_is_apqn_online(kms_info->apqns[i].card,
kms_info->apqns[i].domain, 0)) {
warnx("The APQN %02x.%04x is not online",
kms_info->apqns[i].card,
kms_info->apqns[i].domain);
return -EIO;
}
type = sysfs_get_card_type(kms_info->apqns[i].card);
for (k = 0, found = false; k < num_cards; k++) {
if (cards[k].type == type) {
ARRAY_ADD(cards[k].apqns, cards[k].num_apqns,
sizeof(struct kms_apqn),
&kms_info->apqns[i]);
found = true;
}
}
if (!found) {
warnx("The APQN %02x.%04x is not available of has an "
"unsupported type", kms_info->apqns[i].card,
kms_info->apqns[i].domain);
return -EIO;
}
}
return 0;
}
/**
* Build an APQN string from an APQN array
*
* @param[in] apqns An array of APQNs
* @param[in] num_apqns The number of elements in above array
*
* @return an allocated string with the APQNs
*/
static char *_build_apqn_string(struct kms_apqn *apqns, size_t num_apqns)
{
char *apqn_str, *str;
size_t size, i;
if (num_apqns == 0) {
apqn_str = util_malloc(1);
*apqn_str = '\0';
return apqn_str;
}
size = num_apqns * 8; /* 'cc.dddd' plus ',' or '\0' */
apqn_str = util_malloc(size);
str = apqn_str;
for (i = 0; i < num_apqns; i++) {
if (i != 0) {
*str = ',';
str++;
}
sprintf(str, "%02x.%04x", apqns[i].card, apqns[i].domain);
str += 7;
}
return apqn_str;
}
/**
* Update the APQNS properties in the KMS properties to reflect the list of
* APQNs contained in kms_info and supported card types.
*
* @param[in] kms_info information of the currently bound plugin.
* @param[in] cards An array of card types supported
* @param[in] num_cards The number of elements in above array
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
*/
static int _update_apqns_properties(struct kms_info *kms_info,
struct card_info *cards, size_t num_cards,
bool verbose)
{
char *apqns = NULL;
char *prop;
size_t i;
int rc;
rc = properties_remove(kms_info->props,
KMS_CONFIG_PROP_CCA_APQNS);
if (rc != 0 && rc != -ENOENT) {
pr_verbose(verbose, "Failed to remove the APQNS "
"property: %s", strerror(-rc));
return rc;
}
rc = properties_remove(kms_info->props,
KMS_CONFIG_PROP_EP11_APQNS);
if (rc != 0 && rc != -ENOENT) {
pr_verbose(verbose, "Failed to remove the APQNS "
"property: %s", strerror(-rc));
return rc;
}
if (kms_info->num_apqns == 0) {
rc = properties_remove(kms_info->props, KMS_CONFIG_PROP_APQNS);
if (rc != 0 && rc != -ENOENT) {
pr_verbose(verbose, "Failed to remove the APQNS "
"property: %s", strerror(-rc));
return rc;
}
pr_verbose(verbose, "APQNs: none");
return 0;
}
apqns = _build_apqn_string(kms_info->apqns, kms_info->num_apqns);
pr_verbose(verbose, "APQNs: '%s'", apqns);
rc = properties_set(kms_info->props, KMS_CONFIG_PROP_APQNS, apqns);
free(apqns);
if (rc != 0) {
pr_verbose(verbose, "Failed to set the APQNS property: %s",
strerror(-rc));
goto out;
}
for (i = 0; i < num_cards; i++) {
switch (cards[i].type) {
case CARD_TYPE_CCA:
prop = KMS_CONFIG_PROP_CCA_APQNS;
break;
case CARD_TYPE_EP11:
prop = KMS_CONFIG_PROP_EP11_APQNS;
break;
default:
continue;
}
apqns = _build_apqn_string(cards[i].apqns, cards[i].num_apqns);
pr_verbose(verbose, "%s: '%s'", prop, apqns);
rc = properties_set(kms_info->props, prop, apqns);
free(apqns);
if (rc != 0) {
pr_verbose(verbose, "Failed to set the %s property: %s",
prop, strerror(-rc));
goto out;
}
}
out:
return rc;
}
/**
* Cross checks the APQNs per card type
*
* @param[in] kms_info information of the currently bound plugin.
* @param[in] cards An array of card types to build APQNs lists for
* @param[in] num_cards The number of elements in above array
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
*/
static int _cross_check_apqns(struct card_info *cards, size_t num_cards,
bool verbose)
{
char *apqns;
size_t i;
int rc;
for (i = 0; i < num_cards; i++) {
if (cards[i].num_apqns == 0)
continue;
apqns = _build_apqn_string(cards[i].apqns, cards[i].num_apqns);
rc = cross_check_apqns(apqns, NULL, cards[i].min_level,
&cards[i].min_fw_version, cards[i].type,
true, verbose);
free(apqns);
if (rc == -ENOTSUP)
continue;
if (rc != 0)
return rc;
}
return 0;
}
/**
* Checks existing KMS-bound keys in the keystore of the new set of APQNs
* would make them unusable. The user is prompted if so.
*
* @param[in] keystore the keystore
* @param[in] cards An array of card types
* @param[in] num_cards The number of elements in above array
*
* @returns 0 for success or a negative errno in case of an error.
*/
static int _check_keystore_keys(struct keystore *keystore,
struct card_info *cards, size_t num_cards)
{
struct kms_info *kms_info = keystore->kms_info;
struct card_info *card = NULL;
enum card_type type;
size_t i, k;
char *msg;
int rc;
for (i = 0; key_types[i] != NULL; i++) {
type = get_card_type_for_keytype(key_types[i]);
if (type <= 0)
continue;
for (k = 0; k < num_cards; k++) {
if (cards[k].type == type) {
card = &cards[k];
break;
}
}
if (card == NULL)
continue;
pr_verbose(keystore->verbose, "Checking repository for "
"KMS-bound keys of type %s", key_types[i]);
if (card->num_apqns > 0) {
pr_verbose(keystore->verbose, "Set of APQNs for key "
"type %s is not empty", key_types[i]);
continue;
}
util_asprintf(&msg, "The following keys of type '%s' are bound "
"to KMS plugin '%s', and may become unusable "
"with this set of APQNs:", key_types[i],
kms_info->plugin_name);
rc = keystore_msg_for_kms_key(keystore, key_types[i], msg);
free(msg);
if (rc == -ENOENT) {
pr_verbose(keystore->verbose, "No keys of type %s "
"found", key_types[i]);
continue;
}
if (rc != 0)
return rc;
printf("Do you want to continue [y/N]? ");
if (!prompt_for_yes(keystore->verbose)) {
warnx("Operation aborted");
return -ECANCELED;
}
}
return 0;
}
/**
* Updates existing KMS-bound keys in the keystore with the set of APQNs that
* match the key type.
*
* @param[in] keystore the keystore
* @param[in] cards An array of card types
* @param[in] num_cards The number of elements in above array
*
* @returns 0 for success or a negative errno in case of an error.
*/
static int _update_keystore_keys(struct keystore *keystore,
struct card_info *cards, size_t num_cards)
{
struct card_info *card = NULL;
enum card_type type;
size_t i, k;
char *apqns;
int rc;
for (i = 0; key_types[i] != NULL; i++) {
type = get_card_type_for_keytype(key_types[i]);
if (type <= 0)
continue;
for (k = 0; k < num_cards; k++) {
if (cards[k].type == type) {
card = &cards[k];
break;
}
}
if (card == NULL)
continue;
apqns = _build_apqn_string(card->apqns, card->num_apqns);
pr_verbose(keystore->verbose, "Changing KMS-bound keys of "
"type %s to: '%s'", key_types[i], apqns);
rc = keystore_kms_keys_set_property(keystore, key_types[i],
PROP_NAME_APQNS, apqns);
free(apqns);
if (rc != 0) {
warnx("Failed to update APQNs for KMS-bound keys of "
"type %s: %s", key_types[i], strerror(-rc));
return rc;
}
}
return 0;
}
/**
* Performs configuration of the KMS plugin.
*
* @param[in] keystore the keystore
* @param[in] apqns the APQNs specification from --apqns option, or
* NULL if the option was not specified
* @param[in] kms_options an array of KMS options specified, or NULL if no
* KMS options have been specified
* @param[in] num_kms_options the number of options in above array
* @param[in] has_plugin_optins if true, then the KMS plugin uses KMS specific
* options, false of no options are supported
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
* -EAGAIN to indicate that the specified configuration was accepted so far, but
* the configuration is still incomplete, and needs to be completed.
*/
int configure_kms_plugin(struct keystore *keystore, const char *apqns,
struct kms_option *kms_options, size_t num_kms_options,
bool has_plugin_optins, bool verbose)
{
struct card_info *cards = NULL;
struct kms_info *kms_info;
bool incomplete = false;
size_t i, num_cards = 0;
int rc = 0;
util_assert(keystore != NULL, "Internal error: keystore is NULL");
kms_info = keystore->kms_info;
if (kms_info->plugin_lib == NULL) {
rc = -ENOENT;
warnx("The repository is not bound to a KMS plugin");
goto out;
}
if (apqns == NULL) {
if (kms_info->apqns == NULL || kms_info->num_apqns == 0) {
warnx("Option '--apqns|-a' is required when no APQNS "
"are associated with the KMS plugin");
util_prg_print_parse_error();
rc = -EINVAL;
goto out;
}
if (has_plugin_optins && num_kms_options == 0) {
warnx("At least one option is required");
util_prg_print_parse_error();
rc = -EINVAL;
goto out;
}
}
if (apqns != NULL) {
rc = _get_supported_card_types(kms_info, &cards, &num_cards,
verbose);
if (rc != 0)
goto out;
if (num_cards == 0) {
warnx("The KMS plugin does not support any key type");
rc = -EIO;
goto out;
}
rc = _change_kms_apqns(kms_info, apqns, cards, num_cards);
if (rc != 0)
goto out;
rc = _get_apqns_per_card_type(kms_info, cards, num_cards);
if (rc != 0)
goto out;
rc = _cross_check_apqns(cards, num_cards, verbose);
if (rc != 0)
goto out;
rc = _check_keystore_keys(keystore, cards, num_cards);
if (rc != 0)
goto out;
rc = _update_apqns_properties(kms_info, cards, num_cards,
verbose);
if (rc != 0) {
warnx("Failed to update the APQNs: %s", strerror(-rc));
goto out;
}
}
if (kms_info->funcs->kms_configure != NULL) {
rc = kms_info->funcs->kms_configure(kms_info->handle,
apqns != NULL ?
kms_info->apqns : NULL,
apqns != NULL ?
kms_info->num_apqns : 0,
kms_options,
num_kms_options);
if (rc == -EAGAIN) {
incomplete = true;
rc = 0;
}
if (rc != 0) {
warnx("Failed to configure the KMS plugin: '%s'",
strerror(-rc));
print_last_kms_error(kms_info);
goto out;
}
}
if (apqns != NULL) {
rc = _save_kms_properties(keystore, kms_info->props, verbose);
if (rc != 0)
goto out;
rc = _update_keystore_keys(keystore, cards, num_cards);
if (rc != 0)
goto out;
if (kms_info->num_apqns == 0)
incomplete = true;
}
out:
if (cards != NULL) {
for (i = 0; i < num_cards; i++)
if (cards[i].apqns != NULL)
free(cards[i].apqns);
free(cards);
}
if (rc == 0 && incomplete)
rc = -EAGAIN;
return rc;
}
/**
* Performs re-enciphering of secure keys internally used by the KMS plugin
*
* @param[in] kms_info information of the currently bound plugin.
* @param[in] from_old If true the keys are reenciphered from the OLD to
* the CURRENT master key.
* @param[in] to_new If true the keys are reenciphered from the CURRENT
* to the OLD master key.
* @param[in] inplace if true, the key will be re-enciphere in-place
* @param[in] staged if true, the key will be re-enciphere not in-place
* @param[in] complete if true, a pending re-encipherment is completed
* @param[in] kms_options an array of KMS options specified, or NULL if no
* KMS options have been specified
* @param[in] num_kms_options the number of options in above array
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
* -EAGAIN to indicate that the specified configuration was accepted so far, but
* the configuration is still incomplete, and needs to be completed.
*/
int reencipher_kms(struct kms_info *kms_info, bool from_old, bool to_new,
bool inplace, bool staged, bool complete,
struct kms_option *kms_options, size_t num_kms_options,
bool verbose)
{
enum kms_reencipher_mode mode = KMS_REENC_MODE_AUTO;
enum kms_reenc_mkreg mkreg = KMS_REENC_MKREG_AUTO;
int rc = 0;
util_assert(kms_info != NULL, "Internal error: kms_info is NULL");
if (kms_info->plugin_lib == NULL) {
rc = -ENOENT;
warnx("The repository is not bound to a KMS plugin");
goto out;
}
if (kms_info->funcs->kms_reenciper == NULL) {
pr_verbose(verbose, "The KMS plugin does not support "
"reencipher");
goto out;
}
if (inplace)
mode = KMS_REENC_MODE_IN_PLACE;
else if (staged)
mode = KMS_REENC_MODE_STAGED;
else if (complete)
mode = KMS_REENC_MODE_STAGED_COMPLETE;
if (from_old && !to_new) {
mkreg = KMS_REENC_MKREG_FROM_OLD;
if (mode == KMS_REENC_MODE_AUTO)
mode = KMS_REENC_MODE_IN_PLACE;
} else if (to_new && !from_old) {
mkreg = KMS_REENC_MKREG_TO_NEW;
if (mode == KMS_REENC_MODE_AUTO)
mode = KMS_REENC_MODE_STAGED;
} else if (from_old && to_new) {
mkreg = KMS_REENC_MKREG_FROM_OLD_TO_NEW;
if (mode == KMS_REENC_MODE_AUTO)
mode = KMS_REENC_MODE_STAGED;
}
rc = kms_info->funcs->kms_reenciper(kms_info->handle, mode, mkreg,
kms_options, num_kms_options);
if (rc != 0) {
warnx("Failed to reencipher KMS plugin internal keys: %s",
strerror(-rc));
print_last_kms_error(kms_info);
goto out;
}
out:
return rc;
}
/**
* Performs a login with the KMS plugin, if one is configured
*
* @param[in] kms_info information of the currently bound plugin.
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
*/
int perform_kms_login(struct kms_info *kms_info, bool verbose)
{
int rc = 0;
util_assert(kms_info != NULL, "Internal error: kms_info is NULL");
if (kms_info->plugin_lib == NULL) {
rc = -ENOENT;
warnx("The repository is not bound to a KMS plugin");
goto out;
}
if (kms_info->funcs->kms_login == NULL) {
pr_verbose(verbose, "The KMS plugin does not support login");
goto out;
}
rc = kms_info->funcs->kms_login(kms_info->handle);
if (rc != 0) {
warnx("Failed to login into the KMS: %s",
strerror(-rc));
print_last_kms_error(kms_info);
goto out;
}
out:
return rc;
}
/**
* Gets the subset of the APQNs of a KMS plugin for a specific key type
*
* @param[in] kms_info information of the currently bound plugin.
* @param[in] key_type the key type to get the APQNs for, or NULL to
* get all APQNs associated with the KMS
* @param[in] cross_check if true, the APQNs are cross checked
* @param[out] apqns On return the list of APQNs as comma separated
* string. Must be freed by the caller.
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
* If the KMS plugin does not support the key type, then -ENOTSUP is returned
*/
int get_kms_apqns_for_key_type(struct kms_info *kms_info, const char *key_type,
bool cross_check, char **apqns, bool verbose)
{
const struct fw_version *fw_version;
const char *prop_name;
int rc = 0, min_level;
enum card_type type;
util_assert(kms_info != NULL, "Internal error: kms_info is NULL");
util_assert(apqns != NULL, "Internal error: apqns is NULL");
if (kms_info->plugin_lib == NULL) {
warnx("The repository is not bound to a KMS plugin");
return -ENOENT;
}
if (key_type != NULL) {
if (kms_info->funcs->kms_supports_key_type == NULL)
return -ENOTSUP;
if (!kms_info->funcs->kms_supports_key_type(kms_info->handle,
key_type))
return -ENOTSUP;
}
type = get_card_type_for_keytype(key_type);
switch (type) {
case CARD_TYPE_CCA:
prop_name = KMS_CONFIG_PROP_CCA_APQNS;
break;
case CARD_TYPE_EP11:
prop_name = KMS_CONFIG_PROP_EP11_APQNS;
break;
default:
prop_name = KMS_CONFIG_PROP_APQNS;
break;
}
*apqns = properties_get(kms_info->props, prop_name);
if (*apqns == NULL)
return -ENOTSUP;
if (str_list_count(*apqns) == 0) {
rc = -ENOTSUP;
goto out;
}
if (cross_check) {
min_level = get_min_card_level_for_keytype(key_type);
fw_version = get_min_fw_version_for_keytype(key_type);
rc = cross_check_apqns(*apqns, NULL, min_level, fw_version,
type, true, verbose);
if (rc == -ENOTSUP)
rc = 0;
if (rc != 0) {
warnx("Your master key setup is improper");
goto out;
}
}
out:
if (rc != 0) {
free(*apqns);
*apqns = NULL;
}
return rc;
}
/**
* Returns a system specific version of the specified properties name.
* The properties name does not contain any special characters, except '-'
* and '_'. The returned string mst be freed by the caller.
*
* @param[in] prop_name the base property name
*
* @returns an allocated string
*/
static char *_get_system_specific_prop_name(const char *prop_name)
{
struct utsname utsname;
char *ret;
int i;
if (uname(&utsname)) {
warnx("uname failed: %s", strerror(errno));
return NULL;
}
for (i = 0; utsname.nodename[i] != '\0'; i++)
if (!isalnum(utsname.nodename[i]))
utsname.nodename[i] = '_';
util_asprintf(&ret, "%s-%s", prop_name, utsname.nodename);
return ret;
}
#define ADD_KMS_PROPS(props, num, pname, pvalue) \
do { \
util_assert((num) * sizeof(struct kms_property) < \
sizeof(props), " Internal error: kss " \
"property array is full"); \
(props)[num].name = (pname); \
(props)[num].value = (pvalue); \
(num)++; \
} while (0)
/**
* Requests the KMS plugin to generate a key of the specified key type, size
* and mode, and stores the secure key blob into the specified file.
*
* For an XTS-mode key, 2 keys are generated and those are cross linked using
* its properties.
*
* The key ID(s) and label(s) of the generated keys (2 for XTS) are set into
* the properties object.
*
* @param[in] kms_info information of the currently bound plugin.
* @param[in] name the name of the key to generate
* @param[in] key_type the key type o the key to generate
* @param[in] key_props a properties object containing the key's initial
* properties. On return additional properties are
* added/set for the key ID(s) and label(s).
* @param[in] xts if true, an XTS key (i.e 2 keys) is generated
* @param[in] keybits the key bit size (e.g. 128, 196, 256, 0 to use the
* plugin's default)
* @param[in] filename the file name to store the key in
* @param[in] kms_options an array of KMS options specified, or NULL if no
* KMS options have been specified
* @param[in] num_kms_options the number of options in above array
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 for success or a negative errno in case of an error.
* If the KMS plugin does not support the key type, then -ENOTSUP is returned
*/
int generate_kms_key(struct kms_info *kms_info, const char *name,
const char *key_type, struct properties *key_props,
bool xts, size_t keybits, const char *filename,
struct kms_option *kms_options, size_t num_kms_options,
bool verbose)
{
char *cipher, *iv_mode, *description, *volumes, *vol_type, *sector_size;
unsigned char key_blob[MAX_SECURE_KEY_SIZE * 2];
char key1_label[KMS_KEY_LABEL_SIZE + 1] = { 0 };
char key2_label[KMS_KEY_LABEL_SIZE + 1] = { 0 };
char key1_id[KMS_KEY_ID_SIZE + 1] = { 0 };
char key2_id[KMS_KEY_ID_SIZE + 1] = { 0 };
struct kms_property kms_props[12];
int xts_mode_prop = -1, rc = 0;
size_t key_size, key_blob_size;
enum kms_key_mode key_mode;
size_t num_kms_props = 0;
char *sys_volumes = NULL;
util_assert(kms_info != NULL, "Internal error: kms_info is NULL");
util_assert(name != NULL, "Internal error: name is NULL");
util_assert(key_type != NULL, "Internal error: key_type is NULL");
util_assert(key_props != NULL, "Internal error: key_props is NULL");
util_assert(filename != NULL, "Internal error: filename is NULL");
if (kms_info->plugin_lib == NULL) {
warnx("The repository is not bound to a KMS plugin");
return -ENOENT;
}
if (kms_info->funcs->kms_generate_key == NULL ||
kms_info->funcs->kms_set_key_properties == NULL) {
pr_verbose(verbose, "The KMS plugin does not support to "
"generate keys or set properties");
return -ENOTSUP;
}
if (strcasecmp(key_type, KEY_TYPE_CCA_AESDATA) == 0)
key_size = AESDATA_KEY_SIZE;
else if (strcasecmp(key_type, KEY_TYPE_CCA_AESCIPHER) == 0)
key_size = AESCIPHER_KEY_SIZE;
else if (strcasecmp(key_type, KEY_TYPE_EP11_AES) == 0)
key_size = EP11_KEY_SIZE;
else
return -ENOTSUP;
memset(key_blob, 0, sizeof(key_blob));
cipher = properties_get(key_props, PROP_NAME_CIPHER);
iv_mode = properties_get(key_props, PROP_NAME_IV_MODE);
description = properties_get(key_props, PROP_NAME_DESCRIPTION);
volumes = properties_get(key_props, PROP_NAME_VOLUMES);
vol_type = properties_get(key_props, PROP_NAME_VOLUME_TYPE);
sector_size = properties_get(key_props, PROP_NAME_SECTOR_SIZE);
ADD_KMS_PROPS(kms_props, num_kms_props, KMS_KEY_PROP_NAME, name);
ADD_KMS_PROPS(kms_props, num_kms_props, KMS_KEY_PROP_CIPHER,
cipher != NULL ? cipher : "");
ADD_KMS_PROPS(kms_props, num_kms_props, KMS_KEY_PROP_IV_MODE,
iv_mode != NULL ? iv_mode : "");
ADD_KMS_PROPS(kms_props, num_kms_props, KMS_KEY_PROP_DESCRIPTION,
description != NULL ? description : "");
ADD_KMS_PROPS(kms_props, num_kms_props, KMS_KEY_PROP_VOLUMES,
volumes != NULL ? volumes : "");
sys_volumes = _get_system_specific_prop_name(KMS_KEY_PROP_VOLUMES);
if (sys_volumes == NULL)
return -ENOMEM;
ADD_KMS_PROPS(kms_props, num_kms_props, sys_volumes,
volumes != NULL ? volumes : "");
ADD_KMS_PROPS(kms_props, num_kms_props, KMS_KEY_PROP_VOLUME_TYPE,
vol_type != NULL ? vol_type : "");
ADD_KMS_PROPS(kms_props, num_kms_props, KMS_KEY_PROP_SECTOR_SIZE,
sector_size != NULL ? sector_size : "");
if (xts) {
xts_mode_prop = num_kms_props;
ADD_KMS_PROPS(kms_props, num_kms_props, KMS_KEY_PROP_XTS_KEY,
"XTS-KEY-1");
}
key_mode = xts ? KMS_KEY_MODE_XTS_1 : KMS_KEY_MODE_NON_XTS;
key_blob_size = key_size;
rc = kms_info->funcs->kms_generate_key(kms_info->handle, key_type,
keybits, key_mode,
kms_props, num_kms_props,
kms_options, num_kms_options,
key_blob, &key_blob_size,
key1_id, sizeof(key1_id),
key1_label, sizeof(key1_label));
if (rc != 0) {
pr_verbose(verbose, "KMS plugin failed to generate key #1: %s",
strerror(-rc));
goto out;
}
pr_verbose(verbose, "Key1: ID: '%s' Label: '%s'", key1_id, key1_label);
pr_verbose(verbose, "Keyblob #1: %lu bytes:'", key_blob_size);
if (verbose)
util_hexdump_grp(stderr, NULL, key_blob, 4, key_blob_size, 0);
/* Save ID and label of 1st key */
rc = properties_set(key_props, xts ? PROP_NAME_KMS_XTS_KEY1_ID :
PROP_NAME_KMS_KEY_ID, key1_id);
if (rc != 0) {
pr_verbose(verbose, "Failed to set key id of key #1: %s",
strerror(-rc));
goto out;
}
rc = properties_set(key_props, xts ? PROP_NAME_KMS_XTS_KEY1_LABEL :
PROP_NAME_KMS_KEY_LABEL, key1_label);
if (rc != 0) {
pr_verbose(verbose, "Failed to set key label of key #1: %s",
strerror(-rc));
goto out;
}
if (!xts)
goto save_key;
/* Generate 2nd key of the XTS key */
kms_props[xts_mode_prop].value = "XTS-KEY-2";
key_mode = KMS_KEY_MODE_XTS_2;
/* Cross link key 1 with key 2 */
ADD_KMS_PROPS(kms_props, num_kms_props, KMS_KEY_PROP_XTS_KEY1_ID,
key1_id);
ADD_KMS_PROPS(kms_props, num_kms_props, KMS_KEY_PROP_XTS_KEY1_LABEL,
key1_label);
key_blob_size = key_size;
rc = kms_info->funcs->kms_generate_key(kms_info->handle, key_type,
keybits, key_mode,
kms_props, num_kms_props,
kms_options, num_kms_options,
&key_blob[key_size],
&key_blob_size,
key2_id, sizeof(key2_id),
key2_label, sizeof(key2_label));
if (rc != 0) {
pr_verbose(verbose, "KMS plugin failed to generate key #2: %s",
strerror(-rc));
goto out;
}
pr_verbose(verbose, "Key2: ID: '%s' Label: '%s'", key1_id, key1_label);
pr_verbose(verbose, "Keyblob #2: %lu bytes:'", key_blob_size);
if (verbose)
util_hexdump_grp(stderr, NULL, &key_blob[key_size], 4,
key_blob_size, 0);
/* Save ID and label of 2nd key */
rc = properties_set(key_props, PROP_NAME_KMS_XTS_KEY2_ID, key2_id);
if (rc != 0) {
pr_verbose(verbose, "Failed to set key id of key #2: %s",
strerror(-rc));
goto out;
}
rc = properties_set(key_props, PROP_NAME_KMS_XTS_KEY2_LABEL,
key2_label);
if (rc != 0) {
pr_verbose(verbose, "Failed to set key label of key #2: %s",
strerror(-rc));
goto out;
}
/* Cross link key 2 with key 1 */
num_kms_props = 0;
ADD_KMS_PROPS(kms_props, num_kms_props, KMS_KEY_PROP_XTS_KEY2_ID,
key2_id);
ADD_KMS_PROPS(kms_props, num_kms_props, KMS_KEY_PROP_XTS_KEY2_LABEL,
key2_label);
rc = kms_info->funcs->kms_set_key_properties(kms_info->handle, key1_id,
kms_props, num_kms_props);
if (rc != 0) {
pr_verbose(verbose, "KMS plugin failed to set properties of "
"key #1: %s", strerror(-rc));
goto out;
}
save_key:
rc = write_secure_key(filename, key_blob, xts ? key_size * 2 : key_size,
verbose);
if (rc != 0)
goto out;
out:
if (cipher != NULL)
free(cipher);
if (iv_mode != NULL)
free(iv_mode);
if (description != NULL)
free(description);
if (volumes != NULL)
free(volumes);
if (vol_type != NULL)
free(vol_type);
if (sector_size != NULL)
free(sector_size);
if (sys_volumes != NULL)
free(sys_volumes);
return rc;
}
Reference in New Issue View Git Blame Copy Permalink