File s390-tools-sles15sp1-0005-zkey-Add-keystore-implementation.patch of Package s390-tools.12120
Subject: zkey: Add keystore implementation
From: Philipp Rudo <prudo@linux.ibm.com>
Summary: zkey: Add support of protected key crypto for dm-crypt.
Description: Support the usage of protected key crypto for dm-crypt disks in
plain format by providing a tool to manage a key repository
allowing to associate secure keys with disk partitions or logical
volumes.
Upstream-ID: c944f23d7e1f983499b4c5fcf04430dc49902f04
Problem-ID: SEC1800
Upstream-Description:
zkey: Add keystore implementation
Add a keystore implementation that stores secure AES keys in a
key repository, located in a directory, e.g. '/etc/zkey/repository'.
The keystore allows you to generate, validate, re-encipher, modify,
list, delete, etc secure keys.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
---
zkey/Makefile | 3
zkey/keystore.c | 3299 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
zkey/keystore.h | 77 +
3 files changed, 3378 insertions(+), 1 deletion(-)
--- a/zkey/Makefile
+++ b/zkey/Makefile
@@ -27,8 +27,9 @@ libs = $(rootdir)/libutil/libutil.a
zkey.o: zkey.c pkey.h misc.h
pkey.o: pkey.c pkey.h
properties.o: properties.c properties.h
+keystore.o: keystore.c keystore.h properties.h
-zkey: zkey.o pkey.o properties.o $(libs)
+zkey: zkey.o pkey.o properties.o keystore.o $(libs)
install: all
$(INSTALL) -d -m 755 $(DESTDIR)$(USRBINDIR)
--- /dev/null
+++ b/zkey/keystore.c
@@ -0,0 +1,3299 @@
+/*
+ * zkey - Generate, re-encipher, and validate secure keys
+ *
+ * Keystore handling functions
+ *
+ * Copyright IBM Corp. 2018
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#include <argz.h>
+#include <dirent.h>
+#include <err.h>
+#include <errno.h>
+#include <fnmatch.h>
+#include <regex.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+#include <time.h>
+#include <unistd.h>
+#include <sys/file.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+
+#include "lib/util_base.h"
+#include "lib/util_file.h"
+#include "lib/util_libc.h"
+#include "lib/util_panic.h"
+#include "lib/util_path.h"
+#include "lib/util_rec.h"
+
+#include "keystore.h"
+#include "pkey.h"
+#include "properties.h"
+
+struct key_filenames {
+ char *skey_filename;
+ char *info_filename;
+ char *renc_filename;
+};
+
+#define FILE_EXTENSION_LEN 5
+#define SKEY_FILE_EXTENSION ".skey"
+#define INFO_FILE_EXTENSION ".info"
+#define RENC_FILE_EXTENSION ".renc"
+
+#define LOCK_FILE_NAME ".lock"
+
+#define PROP_NAME_KEY_TYPE "key-type"
+#define PROP_NAME_CIPHER "cipher"
+#define PROP_NAME_IV_MODE "iv-mode"
+#define PROP_NAME_DESCRIPTION "description"
+#define PROP_NAME_VOLUMES "volumes"
+#define PROP_NAME_APQNS "apqns"
+#define PROP_NAME_SECTOR_SIZE "sector-size"
+#define PROP_NAME_CREATION_TIME "creation-time"
+#define PROP_NAME_CHANGE_TIME "update-time"
+#define PROP_NAME_REENC_TIME "reencipher-time"
+
+#define IS_XTS(secure_key_size) (secure_key_size > SECURE_KEY_SIZE ? 1 : 0)
+
+#define REC_KEY "Key"
+#define REC_DESCRIPTION "Description"
+#define REC_SEC_KEY_SIZE "Secure key size"
+#define REC_CLR_KEY_SIZE "Clear key size"
+#define REC_XTS "XTS type key"
+#define REC_VOLUMES "Volumes"
+#define REC_APQNS "APQNs"
+#define REC_KEY_FILE "Key file name"
+#define REC_SECTOR_SIZE "Sector size"
+#define REC_STATUS "Status"
+#define REC_MASTERKEY "Encrypted with"
+#define REC_CREATION_TIME "Created"
+#define REC_CHANGE_TIME "Changed"
+#define REC_REENC_TIME "Re-enciphered"
+
+#define pr_verbose(keystore, fmt...) do { \
+ if (keystore->verbose) \
+ warnx(fmt); \
+ } while (0)
+
+/**
+ * Gets the file names of the .skey and .info and .renc files for a named
+ * key in the key strore's directory
+ *
+ * @param[in] keystore the key store
+ * @param[in] name the name of the key
+ * @param[out] names is filled with the names of the files
+ *
+ * @returns 0 for success or a negative errno in case of an error*
+ */
+static int _keystore_get_key_filenames(struct keystore *keystore,
+ const char *name,
+ struct key_filenames *names)
+{
+ if (strpbrk(name, "/\\ *?'\"")) {
+ warnx("Key name '%s' contains invalid characters", name);
+ return -EINVAL;
+ }
+
+ util_asprintf(&names->skey_filename, "%s/%s%s", keystore->directory,
+ name, SKEY_FILE_EXTENSION);
+ util_asprintf(&names->info_filename, "%s/%s%s", keystore->directory,
+ name, INFO_FILE_EXTENSION);
+ util_asprintf(&names->renc_filename, "%s/%s%s", keystore->directory,
+ name, RENC_FILE_EXTENSION);
+
+ pr_verbose(keystore, "File names for key '%s': '%s' and '%s'", name,
+ names->skey_filename, names->info_filename);
+ return 0;
+}
+
+/**
+ * Checks if the .renc file exists.
+ *
+ * @param[in] file_names names of the files
+ *
+ * @returns 1 if the file exist, 0 if the file do not exist
+ */
+static int _keystore_reencipher_key_exists(struct key_filenames *file_names)
+{
+ struct stat sb;
+ int rc;
+
+ rc = stat(file_names->renc_filename, &sb);
+ if (rc == 0 && !S_ISREG(sb.st_mode))
+ rc = 1;
+
+ return !rc;
+}
+
+/**
+ * Checks if both, the .skey and the .info (and .renc) files exist.
+ *
+ * @param[in] file_names names of the files
+ *
+ * @returns 1 if all files exist, 0 if all files do not exist, -1 if one
+ * file exists but other one does not exist (inconsistent state)
+ */
+static int _keystore_exists_keyfiles(struct key_filenames *file_names)
+{
+ struct stat sb_skey, sb_info;
+ int rc_skey, rc_info;
+
+ rc_skey = stat(file_names->skey_filename, &sb_skey);
+ if (rc_skey == 0 && !S_ISREG(sb_skey.st_mode))
+ rc_skey = 1;
+
+ rc_info = stat(file_names->info_filename, &sb_info);
+ if (rc_info == 0 && !S_ISREG(sb_info.st_mode))
+ rc_info = 1;
+
+ if (rc_skey == 0 && rc_info == 0)
+ return 1;
+ if (rc_skey != 0 && rc_info != 0 &&
+ _keystore_reencipher_key_exists(file_names) == 0)
+ return 0;
+ return -1;
+}
+
+/**
+ * Checks if the files belonging to a key exist. If not an appropriate error
+ * message is issued.
+ *
+ * @param[in] file_names names of the files
+ * @param[in] name name of the key
+ *
+ * @returns 0 if the files exist, -ENOENT if the files do not exist, -EPERM if
+ * one file exists but the other does not exist (inconsistent state)
+ */
+static int _keystore_ensure_keyfiles_exist(struct key_filenames *file_names,
+ const char *name)
+{
+ int rc;
+
+ rc = _keystore_exists_keyfiles(file_names);
+ if (rc == 0) {
+ warnx("Key '%s' does not exist", name);
+ return -ENOENT;
+ }
+ if (rc == -1) {
+ warnx("Key '%s' is in an inconsistent state", name);
+ return -EPERM;
+ }
+
+ return 0;
+}
+
+/**
+ * Checks if the files belonging to a key do not exist. If they files exist,
+ * an appropriate error message is issued.
+ *
+ * @param[in] file_names names of the files
+ * @param[in] name name of the key
+ *
+ * @returns 0 if the files exist, -EEXIST if the files exist already, -EPERM if
+ * one file exists but the other does not exist (inconsistent state)
+ */
+static int _keystore_ensure_keyfiles_not_exist(struct key_filenames *file_names,
+ const char *name)
+{
+ int rc;
+
+ rc = _keystore_exists_keyfiles(file_names);
+ if (rc == 1) {
+ warnx("Key '%s' exists already", name);
+ return -EEXIST;
+ }
+ if (rc == -1) {
+ warnx("Key '%s' is in an inconsistent state", name);
+ return -EPERM;
+ }
+
+ return 0;
+}
+
+/**
+ * Frees the file names stored inside the struct key_filenames
+ *
+ * @param[in] names names of the files
+ */
+static void _keystore_free_key_filenames(struct key_filenames *names)
+{
+ if (names->skey_filename)
+ free(names->skey_filename);
+ if (names->info_filename)
+ free(names->info_filename);
+ if (names->renc_filename)
+ free(names->renc_filename);
+}
+
+/**
+ * Sets the file permissions of the file to the permissions and the group
+ * of the repository directory
+ *
+ * @param[in] keystroe the keystore
+ * @param[in] filename the name of the file to set permissions for
+ *
+ * @returns 0 on success, or a negative errno value on failure
+ */
+static int _keystore_set_file_permission(struct keystore *keystore,
+ const char *filename)
+{
+ int rc;
+
+ if (chmod(filename, keystore->mode) != 0) {
+ rc = -errno;
+ warnx("chmod faild on file '%s': %s", filename, strerror(-rc));
+ return rc;
+ }
+
+ if (chown(filename, geteuid(), keystore->owner) != 0) {
+ rc = -errno;
+ warnx("chown faild on file '%s': %s", filename, strerror(-rc));
+ return rc;
+ }
+
+ return 0;
+}
+
+/**
+ * Checks if the sector size is power of two and in range 512 - 4096 bytes.
+ *
+ * @param[in] sector_size the sector size
+ *
+ * @returns 1 if the sector size is valid, 0 otherwise
+ */
+static int _keystore_valid_sector_size(size_t sector_size)
+{
+ if (sector_size == 0)
+ return 1;
+ if (sector_size < 512 || sector_size > 4096)
+ return 0;
+ if (sector_size & (sector_size - 1))
+ return 0;
+ return 1;
+}
+
+typedef int (*check_association_t)(const char *value, bool remove,
+ char **normalized, void *private);
+
+/**
+ * Set an association property. For each object set function check_func is
+ * called (if not NULL).
+ *
+ * @param[in/out] key_props the properties object to modify
+ * @param[in] property the name of the property to modify
+ * @param[in] newvalue the new value(s) to add, remove or set
+ * @param[in] msg_obj the name of the object for error messages
+ * @param[in] check_func a function to call on each object before it is
+ * added, removed or set to the property
+ * @param[in] check_private a private pointer passed to check_func
+ *
+ * @returns 0 for success, or a negative errno value in case of an error, or
+ * whatever check_func returns if check_func returns a non-zero value.
+ */
+static int _keystore_set_association(struct properties *key_props,
+ const char *property,
+ const char *newvalue,
+ const char *msg_obj,
+ check_association_t check_func,
+ void *check_private)
+{
+ char *normalized = NULL;
+ char **newvals = NULL;
+ char *value = NULL;
+ char *changedval;
+ char *newval;
+ int i, rc = 0;
+
+ newvals = str_list_split(newvalue);
+ if (newvals == NULL)
+ return -EINVAL;
+
+ for (i = 0; newvals[i] != NULL; i++) {
+ if (check_func != NULL) {
+ rc = check_func(newvals[i], 0, &normalized,
+ check_private);
+ if (rc != 0)
+ goto out;
+ }
+
+ newval = normalized != NULL ? normalized : newvals[i];
+ if (value == NULL)
+ changedval = str_list_add("", newval);
+ else
+ changedval = str_list_add(value, newval);
+ if (changedval == NULL) {
+ warnx("The %s '%s' is already specified or contains "
+ "invalid characters", msg_obj, newval);
+ rc = -EEXIST;
+ goto out;
+ }
+ if (normalized != NULL)
+ free(normalized);
+ normalized = NULL;
+ free(value);
+ value = changedval;
+ }
+
+ rc = properties_set(key_props, property, value != NULL ? value : "");
+ if (rc != 0)
+ warnx("Invalid characters in %ss", msg_obj);
+
+out:
+ if (newvals != NULL)
+ str_list_free_string_array(newvals);
+ if (value != NULL)
+ free(value);
+ if (normalized != NULL)
+ free(normalized);
+ return rc;
+}
+
+/**
+ * Add a value to an association property. For each object added function
+ * check_func is called (if not NULL).
+ *
+ * @param[in/out] key_props the properties object to modify
+ * @param[in] property the name of the property to modify
+ * @param[in] newvalue the new value(s) to add, remove or set
+ * @param[in] msg_obj the name of the object for error messages
+ * @param[in] check_func a function to call on each object before it is
+ * added, removed or set to the property
+ * @param[in] check_private a private pointer passed to check_func
+ *
+ * @returns 0 for success, or a negative errno value in case of an error, or
+ * whatever check_func returns if check_func returns a non-zero value.
+ */
+static int _keystore_add_association(struct properties *key_props,
+ const char *property,
+ const char *newvalue,
+ const char *msg_obj,
+ check_association_t check_func,
+ void *check_private)
+{
+ char *normalized = NULL;
+ char **newvals = NULL;
+ char *changedval;
+ char *newval;
+ int i, rc = 0;
+ char *value;
+
+ value = properties_get(key_props, property);
+ if (value == NULL)
+ return _keystore_set_association(key_props, property,
+ newvalue, msg_obj,
+ check_func, check_private);
+
+ newvals = str_list_split(newvalue);
+ if (newvals == NULL) {
+ rc = -EINVAL;
+ goto out;
+ }
+
+ for (i = 0; newvals[i] != NULL; i++) {
+ if (check_func != NULL) {
+ rc = check_func(newvals[i], 0, &normalized,
+ check_private);
+ if (rc != 0)
+ goto out;
+ }
+
+ newval = normalized != NULL ? normalized : newvals[i];
+ changedval = str_list_add(value, newval);
+ if (changedval == NULL) {
+ warnx("The %s '%s' is already associated with this key "
+ "or contains invalid characters", msg_obj,
+ newval);
+ rc = -EEXIST;
+ goto out;
+ }
+ if (normalized != NULL)
+ free(normalized);
+ normalized = NULL;
+ free(value);
+ value = changedval;
+ }
+
+ rc = properties_set(key_props, property, value);
+ if (rc != 0)
+ warnx("Invalid characters in %ss", msg_obj);
+
+out:
+ if (newvals != NULL)
+ str_list_free_string_array(newvals);
+ if (value != NULL)
+ free(value);
+ if (normalized != NULL)
+ free(normalized);
+ return rc;
+}
+
+/**
+ * Removes a value from an association property. For each object removed
+ * function check_func is called (if not NULL).
+ *
+ * @param[in/out] key_props the properties object to modify
+ * @param[in] property the name of the property to modify
+ * @param[in] delvalue the value(s) to remove
+ * @param[in] msg_obj the name of the object for error messages
+ * @param[in] check_func a function to call on each object before it is
+ * added, removed or set to the property
+ * @param[in] check_private a private pointer passed to check_func
+ *
+ * @returns 0 for success, or a negative errno value in case of an error, or
+ * whatever check_func returns if check_func returns a non-zero value.
+ */
+static int _keystore_remove_association(struct properties *key_props,
+ const char *property,
+ const char *delvalue,
+ const char *msg_obj,
+ check_association_t check_func,
+ void *check_private)
+{
+ char *normalized = NULL;
+ char **delvals = NULL;
+ char *changedval;
+ char *delval;
+ int i, rc = 0;
+ char *value;
+
+ value = properties_get(key_props, property);
+ if (value == NULL) {
+ warnx("No %ss are currently associated with this key", msg_obj);
+ return -ENOENT;
+ }
+
+ delvals = str_list_split(delvalue);
+ if (delvals == NULL) {
+ rc = -EINVAL;
+ goto out;
+ }
+
+ for (i = 0; delvals[i] != NULL; i++) {
+ if (check_func != NULL) {
+ rc = check_func(delvals[i], 1, &normalized,
+ check_private);
+ if (rc != 0)
+ goto out;
+ }
+
+ delval = normalized != NULL ? normalized : delvals[i];
+ changedval = str_list_remove(value, delval);
+ if (changedval == NULL) {
+ warnx("%s '%s' is not associated with this key",
+ msg_obj, delval);
+ rc = -ENOENT;
+ goto out;
+ }
+ if (normalized != NULL)
+ free(normalized);
+ normalized = NULL;
+ free(value);
+ value = changedval;
+ }
+
+ rc = properties_set(key_props, property, value);
+ if (rc != 0)
+ warnx("Invalid characters in %ss", msg_obj);
+
+out:
+ if (delvals != NULL)
+ str_list_free_string_array(delvals);
+ if (value != NULL)
+ free(value);
+ if (normalized != NULL)
+ free(normalized);
+ return rc;
+}
+
+/**
+ * Change an association property. This function adds the objects in the
+ * comma separated string when newvalue begins with a '+'. It removes the
+ * objects when newvalue begins with a '-', or it sets the property to
+ * newvalue when newvalue does not begin with '+' or '-'. For each object
+ * added, Removed or set function check_func is called (if not NULL).
+ *
+ * @param[in/out] key_props the properties object to modify
+ * @param[in] property the name of the property to modify
+ * @param[in] newvalue the new value(s) to add, remove or set
+ * @param[in] msg_obj the name of the object for error messages
+ * @param[in] check_func a function to call on each object before it is
+ * added, removed or set to the property
+ * @param[in] check_private a private pointer passed to check_func
+ *
+ * @returns 0 for success, or a negative errno value in case of an error, or
+ * whatever check_func returns if check_func returns a non-zero value.
+ */
+static int _keystore_change_association(struct properties *key_props,
+ const char *property,
+ const char *newvalue,
+ const char *msg_obj,
+ check_association_t check_func,
+ void *check_private)
+{
+ switch (*newvalue) {
+ case '+':
+ return _keystore_add_association(key_props, property,
+ &newvalue[1], msg_obj,
+ check_func, check_private);
+ case '-':
+ return _keystore_remove_association(key_props, property,
+ &newvalue[1], msg_obj,
+ check_func, check_private);
+ default:
+ return _keystore_set_association(key_props, property,
+ newvalue, msg_obj,
+ check_func, check_private);
+
+ }
+}
+
+/**
+ * Filter match function for APQNs
+ *
+ * @param[in] pattern the pattern to match
+ * @param[in] apqn the apqn to match
+ * @param[in] flags Not used here
+ *
+ * @returns Zero if string matches pattern, FNM_NOMATCH if there is no match
+ * or another nonzero value if there is an error.
+ */
+static int _keystore_apqn_match(const char *pattern, const char *apqn,
+ int UNUSED(flags))
+{
+ char *modified;
+ char *pattern_domain;
+ char *pattern_card;
+ char *copy;
+ int card, domain;
+ size_t i;
+ char *ch;
+ int rc;
+
+ if (sscanf(pattern, "%x.%x", &card, &domain) == 2) {
+ util_asprintf(&modified, "%02x.%04x", card, domain);
+ goto match;
+ }
+
+ copy = util_strdup(pattern);
+
+ ch = strchr(copy, '.');
+ if (ch != NULL) {
+ *ch = '\0';
+ pattern_card = copy;
+ pattern_domain = ch + 1;
+
+ modified = NULL;
+ if (strchr(pattern_card, '*') == NULL &&
+ strlen(pattern_card) < 2) {
+ for (i = 0; i < 2 - strlen(pattern_card); i++)
+ modified = util_strcat_realloc(modified, "0");
+ }
+ modified = util_strcat_realloc(modified, pattern_card);
+
+ modified = util_strcat_realloc(modified, ".");
+
+ if (strchr(pattern_domain, '*') == NULL &&
+ strlen(pattern_domain) < 4) {
+ for (i = 0; i < 4 - strlen(pattern_domain); i++)
+ modified = util_strcat_realloc(modified, "0");
+ }
+ modified = util_strcat_realloc(modified, pattern_domain);
+ } else {
+ modified = util_strdup(copy);
+ }
+ free(copy);
+
+match:
+ rc = fnmatch(modified, apqn, FNM_CASEFOLD);
+
+ free(modified);
+ return rc;
+}
+
+typedef int (*filter_match_t)(const char *pattern, const char *string,
+ int flags);
+
+/*
+ * Checks if the value matches the filter list. The value can be a comma
+ * separated string.
+ *
+ * If the filter values contain a second part separated by a colon (':'), then
+ * the filter matches only if both parts match. If the filter values do not
+ * contain a second part,then only the first part is checked, and the second
+ * parts of the values are ignored.
+ *
+ * @param[in] value the value to check
+ * @param[in] filter_list a list of filter strings to match the value with
+ * @param[in] match_func the filter match function. If NULL fnmatch() is used.
+ *
+ * @returns 1 for a match, 0 for not matched
+ */
+static int _keystore_match_filter(const char *value,
+ char **filter_list,
+ filter_match_t match_func)
+{
+ char **value_list;
+ int i, k, rc = 0;
+ char *ch;
+
+ if (filter_list == NULL)
+ return 1;
+
+ if (match_func == NULL)
+ match_func = fnmatch;
+
+ value_list = str_list_split(value);
+ for (i = 0; filter_list[i] != NULL && rc == 0; i++) {
+ for (k = 0; value_list[k] != NULL; k++) {
+ /*
+ * Ignore part after ':' of value if filter does
+ * not also contain a ':' part.
+ */
+ if (strchr(filter_list[i], ':') == NULL) {
+ ch = strchr(value_list[k], ':');
+ if (ch != NULL)
+ *ch = '\0';
+ }
+
+ if (match_func(filter_list[i], value_list[k], 0) == 0) {
+ rc = 1;
+ break;
+ }
+ }
+ }
+
+ str_list_free_string_array(value_list);
+ return rc;
+}
+
+/*
+ * Checks if the property value matches the filter list. The property value
+ * can be a comma separated string.
+ *
+ * If the filter values contain a second part separated by a colon (':'), then
+ * the filter matches only if both parts match. If the filter values do not
+ * contain a second part,then only the first part is checked, and the second
+ * parts of the values are ignored.
+ *
+ * @param[in] properties a properties object
+ * @param[in] property the name of the property to check
+ * @param[in] filter_list a list of filter strings to match the value with
+ * @param[in] match_func the filter match function. If NULL fnmatch() is used.
+ *
+ * @returns 1 for a match, 0 for not matched
+ */
+static int _keystore_match_filter_property(struct properties *properties,
+ const char *property,
+ char **filter_list,
+ filter_match_t match_func)
+{
+ char *value;
+ int rc;
+
+ if (filter_list == NULL)
+ return 1;
+
+ value = properties_get(properties, property);
+ if (value == NULL)
+ return 0;
+
+ rc = _keystore_match_filter(value, filter_list, match_func);
+
+ free(value);
+ return rc;
+}
+
+/**
+ * Checks if a key name matches a name filter
+ *
+ * @param[in] name the name to check
+ * @param[in] name_filter the name filter to match against
+ *
+ * @returns 1 if the filter matches, 0 otherwise
+ */
+static int _keystore_match_name_filter(const char *name,
+ const char *name_filter)
+{
+ if (name_filter == NULL)
+ return 1;
+
+ if (fnmatch(name_filter, name, 0) != 0)
+ return 0;
+
+ return 1;
+}
+
+/**
+ * Filters directory entries for scanfile(). Only entries that are regular
+ * files and who's name ends with '.info' are matched.
+ */
+static int _keystore_info_file_filter(const struct dirent *dirent)
+{
+ size_t len;
+
+ if (dirent->d_type != DT_REG)
+ return 0;
+
+ len = strlen(dirent->d_name);
+ if (len > FILE_EXTENSION_LEN &&
+ strcmp(&dirent->d_name[len - FILE_EXTENSION_LEN],
+ INFO_FILE_EXTENSION) == 0)
+ return 1;
+
+ return 0;
+}
+
+typedef int (*process_key_t)(struct keystore *keystore,
+ const char *name, struct properties *properties,
+ struct key_filenames *file_names, void *private);
+
+/**
+ * Iterates over all keys stored in the keystore. For every key that matches
+ * the specified filter process_func is called.
+ *
+ * @param[in] keystore the key store
+ * @param[in] name_filter the name filter. Can contain wild cards.
+ * NULL means no name filter.
+ * @param[in] volume_filter the volume filter. Can contain wild cards, and
+ * mutliple volume filters separated by commas.
+ * If the filter does not contain the ':dm-name' part,
+ * then the volumes are matched without the dm-name
+ * part. If the filter contains the ':dm-name' part,
+ * then the filter is matched including the dm-name
+ * part.
+ * NULL means no volume filter.
+ * specification is ignored for filter matching.
+ * @param[in] apqn_filter the APQN filter. Can contain wild cards, and
+ * mutliple APQN filters separated by commas.
+ * NULL means no APQN filter.
+ * @param[in] process_func the callback function called for a matching key
+ * @param[in/out] process_private private data passed to the process_func
+ *
+ * @returns 0 for success, or a negative errno value in case of an error, or
+ * whatever process_func returns if process_func returns a non-zero
+ * value.
+ */
+static int _keystore_process_filtered(struct keystore *keystore,
+ const char *name_filter,
+ const char *volume_filter,
+ const char *apqn_filter,
+ process_key_t process_func,
+ void *process_private)
+{
+ struct key_filenames file_names = { NULL, NULL, NULL };
+ char **apqn_filter_list = NULL;
+ char **vol_filter_list = NULL;
+ struct properties *key_props;
+ struct dirent **namelist;
+ int n, i, rc = 0;
+ bool skip = 0;
+ char *name;
+ int len;
+
+ pr_verbose(keystore, "Process_filtered: name_filter = '%s', "
+ "volume_filter = '%s', apqn_filter = '%s'", name_filter,
+ volume_filter, apqn_filter);
+
+ if (volume_filter != NULL)
+ vol_filter_list = str_list_split(volume_filter);
+ if (apqn_filter != NULL)
+ apqn_filter_list = str_list_split(apqn_filter);
+
+ n = scandir(keystore->directory, &namelist, _keystore_info_file_filter,
+ alphasort);
+ if (n == -1) {
+ rc = -errno;
+ pr_verbose(keystore, "scandir failed with: %s", strerror(-rc));
+ return rc;
+ }
+
+ for (i = 0; i < n ; i++) {
+ if (skip)
+ goto free;
+
+ name = namelist[i]->d_name;
+ len = strlen(name);
+ if (len > FILE_EXTENSION_LEN)
+ name[len - FILE_EXTENSION_LEN] = '\0';
+
+ if (_keystore_match_name_filter(name, name_filter) == 0) {
+ pr_verbose(keystore,
+ "Key '%s' filtered out due to name filter",
+ name);
+ goto free;
+ }
+
+ rc = _keystore_get_key_filenames(keystore, name, &file_names);
+ if (rc != 0)
+ goto free;
+
+ rc = _keystore_ensure_keyfiles_exist(&file_names, name);
+ if (rc != 0)
+ goto free_names;
+
+ key_props = properties_new();
+ rc = properties_load(key_props, file_names.info_filename, 1);
+ if (rc != 0) {
+ warnx("Key '%s' does not exist or is invalid", name);
+ goto free_prop;
+ }
+
+ rc = _keystore_match_filter_property(key_props,
+ PROP_NAME_VOLUMES,
+ vol_filter_list, NULL);
+ if (rc == 0) {
+ pr_verbose(keystore,
+ "Key '%s' filtered out due to volumes filter",
+ name);
+ goto free_prop;
+ }
+
+ rc = _keystore_match_filter_property(key_props,
+ PROP_NAME_APQNS,
+ apqn_filter_list,
+ _keystore_apqn_match);
+ if (rc == 0) {
+ pr_verbose(keystore,
+ "Key '%s' filtered out due to APQN filter",
+ name);
+ goto free_prop;
+ }
+
+ rc = process_func(keystore, name, key_props, &file_names,
+ process_private);
+ if (rc != 0) {
+ pr_verbose(keystore, "Process function returned %d",
+ rc);
+ skip = 1;
+ }
+
+free_prop:
+ properties_free(key_props);
+free_names:
+ _keystore_free_key_filenames(&file_names);
+free:
+ free(namelist[i]);
+ }
+ free(namelist);
+
+ if (vol_filter_list)
+ str_list_free_string_array(vol_filter_list);
+ if (apqn_filter_list)
+ str_list_free_string_array(apqn_filter_list);
+
+ pr_verbose(keystore, "Process_filtered rc = %d", rc);
+ return rc;
+}
+
+/**
+ * Checks if the specified APQN is of type CCA and is online
+ *
+ * @param[in] card card number
+ * @param[in] domain the domain
+ *
+ * @returns 1 if its a CCA card and is online, 0 if offline and -1 if its
+ * not a CCA card.
+ */
+static int _keystore_is_apqn_online(int card, int domain)
+{
+ long int online;
+ char *dev_path;
+ char type[20];
+ int rc = 1;
+
+ dev_path = util_path_sysfs("bus/ap/devices/card%02x", card);
+ if (!util_path_is_dir(dev_path)) {
+ rc = 0;
+ goto out;
+ }
+ if (util_file_read_l(&online, 10, "%s/online", dev_path) != 0) {
+ rc = 0;
+ goto out;
+ }
+ if (online == 0) {
+ rc = 0;
+ goto out;
+ }
+ if (util_file_read_line(type, sizeof(type), "%s/type", dev_path) != 0) {
+ rc = 0;
+ goto out;
+ }
+ if (strncmp(type, "CEX", 3) != 0 || strlen(type) < 5) {
+ rc = 0;
+ goto out;
+ }
+ if (type[4] != 'C') {
+ rc = -1;
+ goto out;
+ }
+ free(dev_path);
+
+ dev_path = util_path_sysfs("bus/ap/devices/card%02x/%02x.%04x", card,
+ card, domain);
+ if (!util_path_is_dir(dev_path)) {
+ rc = 0;
+ goto out;
+ }
+ if (util_file_read_l(&online, 10, "%s/online", dev_path) != 0) {
+ rc = 0;
+ goto out;
+ }
+ if (online == 0) {
+ rc = 0;
+ goto out;
+ }
+
+out:
+ free(dev_path);
+ return rc;
+}
+
+/**
+ * Checks an APQN value for its syntax. This is a callback function for
+ * function _keystore_change_association().
+ *
+ * @param[in] apqn the APQN value to check
+ * @param[in] remove if true the apqn is removed
+ * @param[out] normalized normalized value on return or NULL if no change
+ * @param[in] private private data (not used here)
+ *
+ * @returns 0 if successful, a negative errno value otherwise
+ */
+static int _keystore_apqn_check(const char *apqn, bool remove,
+ char **normalized, void *UNUSED(private))
+{
+ int rc, card, domain;
+ regmatch_t pmatch[1];
+ regex_t reg_buf;
+
+ *normalized = NULL;
+
+ rc = regcomp(®_buf, "[[:xdigit:]]+\\.[[:xdigit:]]", REG_EXTENDED);
+ if (rc != 0)
+ return -EIO;
+
+ rc = regexec(®_buf, apqn, (size_t) 1, pmatch, 0);
+ if (rc != 0) {
+ warnx("the APQN '%s' is not valid", apqn);
+ return -EINVAL;
+ }
+
+ if (sscanf(apqn, "%x.%x", &card, &domain) != 2)
+ return -EINVAL;
+
+ util_asprintf(normalized, "%02x.%04x", card, domain);
+
+ if (remove)
+ return 0;
+
+ rc = _keystore_is_apqn_online(card, domain);
+ if (rc != 1) {
+ warnx("The APQN %02x.%04x is %s", card, domain,
+ rc == -1 ? "not a CCA card" : "not online");
+ return -EIO;
+ }
+
+ return 0;
+}
+
+
+struct volume_check {
+ struct keystore *keystore;
+ const char *name;
+ const char *volume;
+};
+
+/**
+ * Processing callback function for the volume association check function.
+ *
+ * @param[in] keystore the keystore (not used here)
+ * @param[in] name the name of the key
+ * @param[in] properties the properties object of the key (not used here)
+ * @param[in] file_names the file names used by this key (not used here)
+ * @param[in] private private data: struct volume_check
+ *
+ * @returns 0 if the key name is equal to the key we are checking the volume
+ * associations for, -EINVAL otherwise (i.e. to indicate duplicate
+ * volume association)
+ */
+static int _keystore_volume_check_process(struct keystore *UNUSED(keystore),
+ const char *name,
+ struct properties *UNUSED(properties),
+ struct key_filenames
+ *UNUSED(file_names),
+ void *private)
+{
+ struct volume_check *info = (struct volume_check *)private;
+
+ warnx("Key '%s' is already associated with volume '%s'", name,
+ info->volume);
+ return -EINVAL;
+}
+
+/**
+ * Checks if the volume is a block device
+ *
+ * @param[in] volume the volume to check
+ *
+ * @return 1 if the volume is a block device, 0 otherwise
+ */
+static int _keystore_is_block_device(const char *volume)
+{
+ struct stat sb;
+
+ if (stat(volume, &sb))
+ return 0;
+ if (!S_ISBLK(sb.st_mode))
+ return 0;
+
+ return 1;
+}
+
+/**
+ * Checks an Volume value for its syntax and if it is already associated with
+ * another key. This is a callback function for function
+ * _keystore_change_association().
+ *
+ * @param[in] volume the Volume value to check
+ * @param[in] remove if true the volume is removed
+ * @param[out] normalized normalized value on return or NULL if no change
+ * @param[in] private private data: struct volume_check
+ *
+ * @returns 0 if successful, a negative errno value otherwise
+ */
+static int _keystore_volume_check(const char *volume, bool remove,
+ char **normalized, void *private)
+{
+ struct volume_check *info = (struct volume_check *)private;
+ char *ch;
+ int rc;
+
+ *normalized = NULL;
+
+ if (strpbrk(volume, "*?") != NULL) {
+ warnx("Volume name can not contain '*' or '?'");
+ return -EINVAL;
+ }
+
+ info->volume = util_strdup(volume);
+ ch = strchr(info->volume, ':');
+ if (ch == NULL || strlen(ch + 1) == 0) {
+ warnx("Volume specification must contain a dm-crypt mapping "
+ "name separated by a colon");
+ rc = -EINVAL;
+ goto out;
+ }
+
+ if (remove) {
+ rc = 0;
+ goto out;
+ }
+
+ /*
+ * Strip off the ':dm-name' part, so that the volume filter only
+ * matches the volume part.
+ */
+ *ch = '\0';
+
+ if (!_keystore_is_block_device(info->volume)) {
+ warnx("Volume '%s' is not a block device or is not available",
+ info->volume);
+ rc = -EINVAL;
+ goto out;
+ }
+
+ rc = _keystore_process_filtered(info->keystore, NULL, info->volume,
+ NULL, _keystore_volume_check_process,
+ info);
+out:
+ free((void *)info->volume);
+ info->volume = NULL;
+ return rc;
+}
+
+/**
+ * Locks the repository against other processes.
+ *
+ * @param[in] keystore the keystore
+ *
+ * @returns 0 if successful, a negative errno value otherwise
+ */
+static int _keystore_lock_repository(struct keystore *keystore)
+{
+ char *lock_file_name;
+ struct stat sb;
+ int rc;
+
+ util_asprintf(&lock_file_name, "%s/%s", keystore->directory,
+ LOCK_FILE_NAME);
+
+ if (stat(lock_file_name, &sb) == 0) {
+ keystore->lock_fd = open(lock_file_name, O_RDONLY);
+ if (keystore->lock_fd == -1) {
+ rc = -errno;
+ warnx("Failed to open lock file '%s': %s",
+ lock_file_name,
+ strerror(-rc));
+ goto out;
+ }
+ } else {
+ keystore->lock_fd = open(lock_file_name, O_CREAT | O_RDONLY,
+ keystore->mode);
+ if (keystore->lock_fd == -1) {
+ rc = -errno;
+ warnx("Failed to create lock file '%s': %s",
+ lock_file_name,
+ strerror(-rc));
+ goto out;
+ }
+
+ if (fchown(keystore->lock_fd, geteuid(),
+ keystore->owner) != 0) {
+ rc = -errno;
+ warnx("chown faild on file '%s': %s", lock_file_name,
+ strerror(-rc));
+ return rc;
+ }
+ }
+
+ rc = flock(keystore->lock_fd, LOCK_EX);
+ if (rc == -1) {
+ rc = -errno;
+ warnx("Failed to obtain the file lock on '%s': %s",
+ lock_file_name, strerror((-rc)));
+ }
+
+out:
+ free(lock_file_name);
+ return rc;
+}
+
+/**
+ * Unlocks the repository
+ *
+ * @param[in] keystore the keystore
+ *
+ * @returns 0 if successful, a negative errno value otherwise
+ */
+static int _keystore_unlock_repository(struct keystore *keystore)
+{
+ int rc;
+
+ if (keystore->lock_fd == -1)
+ return 0;
+
+ rc = flock(keystore->lock_fd, LOCK_UN);
+ if (rc == -1) {
+ rc = -errno;
+ warnx("Failed to release the file lock: %s", strerror((-rc)));
+ }
+
+ close(keystore->lock_fd);
+ keystore->lock_fd = -1;
+
+ return rc;
+}
+
+/**
+ * Allocates new keystore object
+ *
+ * @param[in] directory the directory where the keystore resides
+ * @param[in] verbose if true, verbose messages are printed
+ *
+ * @returns a new keystore object
+ */
+struct keystore *keystore_new(const char *directory, bool verbose)
+{
+ struct keystore *keystore;
+ struct stat sb;
+ int rc;
+
+ util_assert(directory != NULL, "Internal error: directory is NULL");
+
+ if (stat(directory, &sb) != 0) {
+ warnx("'%s' does not exist", directory);
+ return NULL;
+ }
+ if (!(sb.st_mode & S_IFDIR)) {
+ warnx("'%s' is not a directory", directory);
+ return NULL;
+ }
+ if (!util_path_is_readable(directory) ||
+ !util_path_is_writable(directory)) {
+ warnx("Permission denied for '%s'", directory);
+ return NULL;
+ }
+ if (sb.st_mode & S_IWOTH) {
+ warnx("Directory '%s' is writable for others, this is not "
+ "accepted", directory);
+ return NULL;
+ }
+
+ keystore = util_zalloc(sizeof(struct keystore));
+
+ keystore->owner = sb.st_gid;
+ keystore->mode = sb.st_mode & (S_IRUSR | S_IWUSR |
+ S_IRGRP | S_IWGRP |
+ S_IROTH);
+ keystore->lock_fd = -1;
+ keystore->verbose = verbose;
+ keystore->directory = util_strdup(directory);
+ if (keystore->directory[strlen(keystore->directory)-1] == '/')
+ keystore->directory[strlen(keystore->directory)-1] = '\0';
+
+ rc = _keystore_lock_repository(keystore);
+ if (rc != 0) {
+ keystore_free(keystore);
+ return NULL;
+ }
+
+ pr_verbose(keystore, "Keystore in directory '%s' opened successfully",
+ keystore->directory);
+ return keystore;
+}
+
+/**
+ * Sets a timestamp to be used as creation/update/reencipher time into
+ * the specified property
+ *
+ * @param[in] properties the properties object
+ * @param[in] property the name of the property to set
+ *
+ * @returns 0 on success, or a negative errno value on error
+ */
+static int _keystore_set_timestamp_property(struct properties *properties,
+ const char *property)
+{
+ char *time_str;
+ struct tm *tm;
+ time_t t;
+ int rc;
+
+ t = time(NULL);
+ tm = localtime(&t);
+ util_assert(tm != NULL, "Internal error: tm is NULL");
+
+ time_str = util_zalloc(200);
+ rc = strftime(time_str, 200, "%F %T", tm);
+ util_assert(rc > 0, "Internal error: strftime failed");
+
+ rc = properties_set(properties, property, time_str);
+
+ free(time_str);
+ return rc;
+}
+
+/**
+ * Sets the default properties of a key, such as key-type, cipher-name, and
+ * IV-mode
+ *
+ * @param[in] key_props the properties object
+ */
+static int _keystore_set_default_properties(struct properties *key_props)
+{
+ int rc;
+
+ rc = properties_set(key_props, PROP_NAME_KEY_TYPE, "CCA-AESDATA");
+ if (rc != 0)
+ return rc;
+
+ rc = properties_set(key_props, PROP_NAME_CIPHER, "paes");
+ if (rc != 0)
+ return rc;
+
+ rc = properties_set(key_props, PROP_NAME_IV_MODE, "plain64");
+ if (rc != 0)
+ return rc;
+
+ rc = _keystore_set_timestamp_property(key_props,
+ PROP_NAME_CREATION_TIME);
+ if (rc != 0)
+ return rc;
+
+ return 0;
+}
+
+/**
+ * Creates an initial .info file for a key
+ *
+ * @param[in] keystore the key store
+ * @param[in] name the name of the key
+ * @param[in] info_filename the file name of the key info file
+ * @param[in] description textual description of the key (optional, can be NULL)
+ * @param[in] volumes a comma separated list of volumes associated with this
+ * key (optional, can be NULL)
+ * @param[in] apqns a comma separated list of APQNs associated with this
+ * key (optional, can be NULL)
+ * @param[in] sector_size the sector size to use with dm-crypt. It must be power
+ * of two and in range 512 - 4096 bytes. 0 means that
+ * the sector size is not specified and the system
+ * default is used.
+ */
+static int _keystore_create_info_file(struct keystore *keystore,
+ const char *name,
+ const char *info_filename,
+ const char *description,
+ const char *volumes, const char *apqns,
+ size_t sector_size)
+{
+ struct volume_check vol_check = { .keystore = keystore, .name = name };
+ struct properties *key_props;
+ char temp[10];
+ int rc;
+
+ key_props = properties_new();
+ rc = _keystore_set_default_properties(key_props);
+ if (rc != 0)
+ goto out;
+
+ rc = properties_set(key_props, PROP_NAME_DESCRIPTION,
+ description != NULL ? description : "");
+ if (rc != 0) {
+ warnx("Invalid characters in description");
+ goto out;
+ }
+
+ rc = _keystore_change_association(key_props, PROP_NAME_VOLUMES,
+ volumes != NULL ? volumes : "",
+ "volume", _keystore_volume_check,
+ &vol_check);
+ if (rc != 0)
+ goto out;
+
+ rc = _keystore_change_association(key_props, PROP_NAME_APQNS,
+ apqns != NULL ? apqns : "",
+ "APQN", _keystore_apqn_check, NULL);
+ if (rc != 0)
+ goto out;
+
+ if (!_keystore_valid_sector_size(sector_size)) {
+ warnx("Invalid sector-size specified");
+ rc = -EINVAL;
+ goto out;
+ }
+ sprintf(temp, "%lu", sector_size);
+ rc = properties_set(key_props, PROP_NAME_SECTOR_SIZE,
+ temp);
+ if (rc != 0) {
+ warnx("Invalid characters in sector-size");
+ goto out;
+ }
+
+ rc = properties_save(key_props, info_filename, 1);
+ if (rc != 0) {
+ pr_verbose(keystore,
+ "Key info file '%s' could not be written: %s",
+ info_filename, strerror(-rc));
+ goto out;
+ }
+
+ rc = _keystore_set_file_permission(keystore, info_filename);
+ if (rc != 0) {
+ remove(info_filename);
+ goto out;
+ }
+
+out:
+ properties_free(key_props);
+ return rc;
+}
+
+/**
+ * Extracts a card/domain pair from the specified APQns, or uses AUTOSELECT
+ * if no APQNs are specified.
+ */
+static int _keystore_get_card_domain(const char *apqns, unsigned int *card,
+ unsigned int *domain)
+{
+ char **apqn_list;
+ char *normalized = NULL;
+ int rc = 0;
+
+ *card = AUTOSELECT;
+ *domain = AUTOSELECT;
+
+ if (apqns == NULL)
+ return 0;
+
+ apqn_list = str_list_split(apqns);
+ if (apqn_list[0] == NULL)
+ goto out;
+
+ rc = _keystore_apqn_check(apqn_list[0], 0, &normalized, NULL);
+ if (normalized != NULL)
+ free(normalized);
+ if (rc != 0)
+ goto out;
+
+ if (sscanf(apqn_list[0], "%x.%x", card, domain) != 2) {
+ rc = -EINVAL;
+ goto out;
+ }
+
+out:
+ str_list_free_string_array(apqn_list);
+ return rc;
+}
+
+/**
+ * Generates a secure key by random and adds it to the key store
+ *
+ * @param[in] keystore the key store
+ * @param[in] name the name of the key
+ * @param[in] description textual description of the key (optional, can be NULL)
+ * @param[in] volumes a comma separated list of volumes associated with this
+ * key (optional, can be NULL)
+ * @param[in] apqns a comma separated list of APQNs associated with this
+ * key (optional, can be NULL)
+ * @param[in] sector_size the sector size to use with dm-crypt. It must be power
+ * of two and in range 512 - 4096 bytes. 0 means that
+ * the sector size is not specified and the system
+ * default is used.
+ * @param[in] keybits cryptographical size of the key in bits
+ * @param[in] xts if true, an XTS key is generated
+ * @param[in] clear_key_file if not NULL the secure key is generated from the
+ * clear key contained in the file denoted here.
+ * if NULL, the secure key is generated by random.
+ * @param[in] pkey_fd the file descriptor of /dev/pkey
+ *
+ * @returns 0 for success or a negative errno in case of an error
+ */
+int keystore_generate_key(struct keystore *keystore, const char *name,
+ const char *description, const char *volumes,
+ const char *apqns, size_t sector_size,
+ size_t keybits, bool xts, const char *clear_key_file,
+ int pkey_fd)
+{
+ struct key_filenames file_names = { NULL, NULL, NULL };
+ struct properties *key_props = NULL;
+ unsigned int card, domain;
+ int rc;
+
+ util_assert(keystore != NULL, "Internal error: keystore is NULL");
+ util_assert(name != NULL, "Internal error: name is NULL");
+
+ rc = _keystore_get_key_filenames(keystore, name, &file_names);
+ if (rc != 0)
+ goto out_free_key_filenames;
+
+ rc = _keystore_ensure_keyfiles_not_exist(&file_names, name);
+ if (rc != 0)
+ goto out_free_key_filenames;
+
+ rc = _keystore_get_card_domain(apqns, &card, &domain);
+ if (rc != 0)
+ goto out_free_key_filenames;
+
+ if (clear_key_file == NULL)
+ rc = generate_secure_key_random(pkey_fd,
+ file_names.skey_filename,
+ keybits, xts, card, domain,
+ keystore->verbose);
+ else
+ rc = generate_secure_key_clear(pkey_fd,
+ file_names.skey_filename,
+ keybits, xts, clear_key_file,
+ card, domain,
+ keystore->verbose);
+ if (rc != 0)
+ goto out_free_props;
+
+ rc = _keystore_set_file_permission(keystore, file_names.skey_filename);
+ if (rc != 0)
+ goto out_free_props;
+
+ rc = _keystore_create_info_file(keystore, name,
+ file_names.info_filename,
+ description, volumes, apqns,
+ sector_size);
+ if (rc != 0)
+ goto out_free_props;
+
+ pr_verbose(keystore,
+ "Successfully generated a secure key in '%s' and key info "
+ "in '%s'", file_names.skey_filename,
+ file_names.info_filename);
+
+out_free_props:
+ if (key_props != NULL)
+ properties_free(key_props);
+ if (rc != 0 && rc != -EEXIST)
+ remove(file_names.skey_filename);
+out_free_key_filenames:
+ _keystore_free_key_filenames(&file_names);
+
+ if (rc != 0)
+ pr_verbose(keystore, "Failed to generate key '%s': %s",
+ name, strerror(-rc));
+ return rc;
+}
+
+/**
+ * Imports a secure key from a file and adds it to the key store
+ *
+ * @param[in] keystore the key store
+ * @param[in] name the name of the key
+ * @param[in] description textual description of the key (optional, can be NULL)
+ * @param[in] volumes a comma separated list of volumes associated with this
+ * key (optional, can be NULL)
+ * @param[in] apqns a comma separated list of APQNs associated with this
+ * key (optional, can be NULL)
+ * @param[in] sector_size the sector size to use with dm-crypt. It must be power
+ * of two and in range 512 - 4096 bytes. 0 means that
+ * the sector size is not specified and the system
+ * default is used.
+ * @param[in] import_file The name of a secure key containing the kley to import
+ *
+ * @returns 0 for success or a negative errno in case of an error
+ */
+int keystore_import_key(struct keystore *keystore, const char *name,
+ const char *description, const char *volumes,
+ const char *apqns, size_t sector_size,
+ const char *import_file)
+{
+ struct key_filenames file_names = { NULL, NULL, NULL };
+ struct properties *key_props = NULL;
+ size_t secure_key_size;
+ u8 *secure_key;
+ int rc;
+
+ util_assert(keystore != NULL, "Internal error: keystore is NULL");
+ util_assert(name != NULL, "Internal error: name is NULL");
+ util_assert(import_file != NULL, "Internal error: import_file is NULL");
+
+ rc = _keystore_get_key_filenames(keystore, name, &file_names);
+ if (rc != 0)
+ goto out_free_key_filenames;
+
+ rc = _keystore_ensure_keyfiles_not_exist(&file_names, name);
+ if (rc != 0)
+ goto out_free_key_filenames;
+
+ secure_key = read_secure_key(import_file, &secure_key_size,
+ keystore->verbose);
+ if (secure_key == NULL) {
+ rc = -ENOENT;
+ goto out_free_key_filenames;
+ }
+
+ rc = write_secure_key(file_names.skey_filename, secure_key,
+ secure_key_size, keystore->verbose);
+ free(secure_key);
+ if (rc != 0)
+ goto out_free_props;
+
+ rc = _keystore_set_file_permission(keystore, file_names.skey_filename);
+ if (rc != 0)
+ goto out_free_props;
+
+ rc = _keystore_create_info_file(keystore, name,
+ file_names.info_filename,
+ description, volumes, apqns,
+ sector_size);
+ if (rc != 0)
+ goto out_free_props;
+
+ pr_verbose(keystore,
+ "Successfully imported a secure key in '%s' and key info in '%s'",
+ file_names.skey_filename, file_names.info_filename);
+
+out_free_props:
+ if (key_props != NULL)
+ properties_free(key_props);
+ if (rc != 0 && rc != -EEXIST)
+ remove(file_names.skey_filename);
+out_free_key_filenames:
+ _keystore_free_key_filenames(&file_names);
+
+ if (rc != 0)
+ pr_verbose(keystore, "Failed to import key '%s': %s",
+ name, strerror(-rc));
+ return rc;
+}
+
+
+/**
+ * Changes properties of a key in the keystore.
+ *
+ * @param[in] keystore the key store
+ * @param[in] name the name of the key
+ * @param[in] description textual description of the key. If NULL then the
+ * description is not changed.
+ * @param[in] volumes a comma separated list of volumes associated with this
+ * key, or a volume prefixed with '+' or '-' to add or
+ * remove that volume respectively. If NULL then the
+ * volumes are not changed.
+ * @param[in] apqns a comma separated list of APQNs associated with this
+ * key, or an APQN prefixed with '+' or '-' to add or
+ * remove that APQN respectively. IfNULL then the APQNs
+ * are not changed.
+ * @param[in] sector_size the sector size to use with dm-crypt. It must be power
+ * of two and in range 512 - 4096 bytes. 0 means that
+ * the sector size is not specified and the system
+ * default is used. Specify -1 if this property should
+ * not be changed.
+ *
+ * @returns 0 for success or a negative errno in case of an error
+ *
+ */
+int keystore_change_key(struct keystore *keystore, const char *name,
+ const char *description, const char *volumes,
+ const char *apqns, long int sector_size)
+{
+ struct volume_check vol_check = { .keystore = keystore, .name = name };
+ struct key_filenames file_names = { NULL, NULL, NULL };
+ struct properties *key_props = NULL;
+ char temp[10];
+ int rc;
+
+ util_assert(keystore != NULL, "Internal error: keystore is NULL");
+ util_assert(name != NULL, "Internal error: name is NULL");
+
+ rc = _keystore_get_key_filenames(keystore, name, &file_names);
+ if (rc != 0)
+ goto out;
+
+ rc = _keystore_ensure_keyfiles_exist(&file_names, name);
+ if (rc != 0)
+ goto out;
+
+ key_props = properties_new();
+ rc = properties_load(key_props, file_names.info_filename, 1);
+ if (rc != 0) {
+ warnx("Key '%s' does not exist or is invalid", name);
+ goto out;
+ }
+
+ if (description != NULL) {
+ rc = properties_set(key_props, PROP_NAME_DESCRIPTION,
+ description);
+ if (rc != 0) {
+ warnx("Invalid characters in description");
+ goto out;
+ }
+ }
+
+ if (volumes != NULL) {
+ rc = _keystore_change_association(key_props, PROP_NAME_VOLUMES,
+ volumes, "volume",
+ _keystore_volume_check,
+ &vol_check);
+ if (rc != 0)
+ goto out;
+ }
+
+ if (apqns != NULL) {
+ rc = _keystore_change_association(key_props, PROP_NAME_APQNS,
+ apqns, "APQN",
+ _keystore_apqn_check, NULL);
+ if (rc != 0)
+ goto out;
+ }
+
+ if (sector_size >= 0) {
+ if (!_keystore_valid_sector_size(sector_size)) {
+ warnx("Invalid sector-size specified");
+ rc = -EINVAL;
+ goto out;
+ }
+
+ sprintf(temp, "%lu", sector_size);
+ rc = properties_set(key_props, PROP_NAME_SECTOR_SIZE,
+ temp);
+ if (rc != 0) {
+ warnx("Invalid characters in sector-size");
+ goto out;
+ }
+ }
+
+ rc = _keystore_set_timestamp_property(key_props, PROP_NAME_CHANGE_TIME);
+ if (rc != 0)
+ goto out;
+
+ rc = properties_save(key_props, file_names.info_filename, 1);
+ if (rc != 0) {
+ pr_verbose(keystore,
+ "Key info file '%s' could not be written: %s",
+ file_names.info_filename, strerror(-rc));
+ goto out;
+ }
+
+ rc = _keystore_set_file_permission(keystore, file_names.info_filename);
+ if (rc != 0)
+ goto out;
+
+ pr_verbose(keystore, "Successfully changed key '%s'", name);
+
+out:
+ _keystore_free_key_filenames(&file_names);
+ if (key_props != NULL)
+ properties_free(key_props);
+
+ if (rc != 0)
+ pr_verbose(keystore, "Failed to change key '%s': %s",
+ name, strerror(-rc));
+ return rc;
+}
+
+/**
+ * Renames a key in the keystore
+ *
+ * @param[in] keystore the key store
+ * @param[in] name the name of the key
+ * @param[in] newname the new name of the key
+ *
+ * @returns 0 for success or a negative errno in case of an error
+ */
+int keystore_rename_key(struct keystore *keystore, const char *name,
+ const char *newname)
+{
+ struct key_filenames file_names = { NULL, NULL, NULL };
+ struct key_filenames new_names = { NULL, NULL, NULL };
+ int rc;
+
+ util_assert(keystore != NULL, "Internal error: keystore is NULL");
+ util_assert(name != NULL, "Internal error: name is NULL");
+ util_assert(newname != NULL, "Internal error: newname is NULL");
+
+ rc = _keystore_get_key_filenames(keystore, name, &file_names);
+ if (rc != 0)
+ goto out;
+
+ rc = _keystore_ensure_keyfiles_exist(&file_names, name);
+ if (rc != 0)
+ goto out;
+
+ rc = _keystore_get_key_filenames(keystore, newname, &new_names);
+ if (rc != 0)
+ goto out;
+
+ rc = _keystore_ensure_keyfiles_not_exist(&new_names, newname);
+ if (rc != 0)
+ goto out;
+
+ if (rename(file_names.skey_filename, new_names.skey_filename) != 0) {
+ rc = -errno;
+ pr_verbose(keystore, "Failed to rename '%s': %s",
+ file_names.skey_filename, strerror(-rc));
+ goto out;
+ }
+ if (rename(file_names.info_filename, new_names.info_filename) != 0) {
+ rc = -errno;
+ pr_verbose(keystore, "Failed to rename '%s': %s",
+ file_names.info_filename, strerror(-rc));
+ rename(new_names.skey_filename, file_names.skey_filename);
+ }
+ if (_keystore_reencipher_key_exists(&file_names)) {
+ if (rename(file_names.renc_filename,
+ new_names.renc_filename) != 0) {
+ rc = -errno;
+ pr_verbose(keystore, "Failed to rename '%s': %s",
+ file_names.renc_filename, strerror(-rc));
+ rename(new_names.skey_filename,
+ file_names.skey_filename);
+ rename(new_names.info_filename,
+ file_names.info_filename);
+ }
+ }
+
+ pr_verbose(keystore, "Successfully renamed key '%s' to '%s'", name,
+ newname);
+
+out:
+ _keystore_free_key_filenames(&file_names);
+ _keystore_free_key_filenames(&new_names);
+
+ if (rc != 0)
+ pr_verbose(keystore, "Failed to rename key '%s'to '%s': %s",
+ name, newname, strerror(-rc));
+ return rc;
+}
+
+/**
+ * Sets up a util_rec used for displaying key information
+ *
+ * @param[in] validation if true the record is used for validate, else it is
+ * used for display
+ *
+ * @returns a pointer to a set up struct util_rec.
+ */
+static struct util_rec *_keystore_setup_record(bool validation)
+{
+ struct util_rec *rec;
+
+ rec = util_rec_new_long("-", ":", REC_KEY, 23, 54);
+ util_rec_def(rec, REC_KEY, UTIL_REC_ALIGN_LEFT, 54, REC_KEY);
+ if (validation)
+ util_rec_def(rec, REC_STATUS, UTIL_REC_ALIGN_LEFT, 54,
+ REC_STATUS);
+ util_rec_def(rec, REC_DESCRIPTION, UTIL_REC_ALIGN_LEFT, 54,
+ REC_DESCRIPTION);
+ util_rec_def(rec, REC_SEC_KEY_SIZE, UTIL_REC_ALIGN_LEFT, 20,
+ REC_SEC_KEY_SIZE);
+ util_rec_def(rec, REC_CLR_KEY_SIZE, UTIL_REC_ALIGN_LEFT, 20,
+ REC_CLR_KEY_SIZE);
+ util_rec_def(rec, REC_XTS, UTIL_REC_ALIGN_LEFT, 3, REC_XTS);
+ if (validation)
+ util_rec_def(rec, REC_MASTERKEY, UTIL_REC_ALIGN_LEFT, 54,
+ REC_MASTERKEY);
+ util_rec_def(rec, REC_VOLUMES, UTIL_REC_ALIGN_LEFT, 54, REC_VOLUMES);
+ util_rec_def(rec, REC_APQNS, UTIL_REC_ALIGN_LEFT, 54, REC_APQNS);
+ util_rec_def(rec, REC_KEY_FILE, UTIL_REC_ALIGN_LEFT, 54, REC_KEY_FILE);
+ util_rec_def(rec, REC_SECTOR_SIZE, UTIL_REC_ALIGN_LEFT, 54,
+ REC_SECTOR_SIZE);
+ util_rec_def(rec, REC_CREATION_TIME, UTIL_REC_ALIGN_LEFT, 54,
+ REC_CREATION_TIME);
+ util_rec_def(rec, REC_CHANGE_TIME, UTIL_REC_ALIGN_LEFT, 54,
+ REC_CHANGE_TIME);
+ util_rec_def(rec, REC_REENC_TIME, UTIL_REC_ALIGN_LEFT, 54,
+ REC_REENC_TIME);
+
+ return rec;
+}
+
+static void _keystore_print_record(struct util_rec *rec,
+ const char *name,
+ struct properties *properties,
+ bool validation, const char *skey_filename,
+ size_t secure_key_size,
+ size_t clear_key_bitsize, bool valid,
+ bool is_old_mk, bool reenc_pending)
+{
+ char *volumes_argz = NULL;
+ size_t volumes_argz_len;
+ char *apqns_argz = NULL;
+ size_t sector_size = 0;
+ size_t apqns_argz_len;
+ char *description;
+ char *reencipher;
+ char *creation;
+ char *volumes;
+ char *change;
+ char *apqns;
+ char *temp;
+
+ description = properties_get(properties, PROP_NAME_DESCRIPTION);
+ volumes = properties_get(properties, PROP_NAME_VOLUMES);
+ if (volumes != NULL)
+ util_assert(argz_create_sep(volumes, ',',
+ &volumes_argz,
+ &volumes_argz_len) == 0,
+ "Internal error: argz_create_sep failed");
+ apqns = properties_get(properties, PROP_NAME_APQNS);
+ if (apqns != NULL)
+ util_assert(argz_create_sep(apqns, ',',
+ &apqns_argz,
+ &apqns_argz_len) == 0,
+ "Internal error: argz_create_sep failed");
+
+ temp = properties_get(properties, PROP_NAME_SECTOR_SIZE);
+ if (temp != NULL) {
+ util_assert(sscanf(temp, "%lu", §or_size) == 1,
+ "Internal error: sscanf failed");
+ free(temp);
+ }
+
+ creation = properties_get(properties, PROP_NAME_CREATION_TIME);
+ change = properties_get(properties, PROP_NAME_CHANGE_TIME);
+ reencipher = properties_get(properties, PROP_NAME_REENC_TIME);
+
+ util_rec_set(rec, REC_KEY, name);
+ if (validation)
+ util_rec_set(rec, REC_STATUS, valid ? "Valid" : "Invalid");
+ util_rec_set(rec, REC_DESCRIPTION,
+ description != NULL ? description : "");
+ util_rec_set(rec, REC_SEC_KEY_SIZE, "%lu bytes", secure_key_size);
+ if (!validation || valid)
+ util_rec_set(rec, REC_CLR_KEY_SIZE, "%lu bits",
+ clear_key_bitsize);
+ else
+ util_rec_set(rec, REC_CLR_KEY_SIZE, "(unknown)");
+ util_rec_set(rec, REC_XTS,
+ IS_XTS(secure_key_size) ? "Yes" : "No");
+ if (validation) {
+ if (valid)
+ util_rec_set(rec, REC_MASTERKEY,
+ is_old_mk ? "OLD CCA master key" :
+ "CURRENT CCA master key");
+ else
+ util_rec_set(rec, REC_MASTERKEY, "(unknown)");
+ }
+ if (volumes_argz != NULL)
+ util_rec_set_argz(rec, REC_VOLUMES, volumes_argz,
+ volumes_argz_len);
+ else
+ util_rec_set(rec, REC_VOLUMES, "(none)");
+ if (apqns_argz != NULL)
+ util_rec_set_argz(rec, REC_APQNS,
+ apqns_argz, apqns_argz_len);
+ else
+ util_rec_set(rec, REC_APQNS, "(none)");
+ util_rec_set(rec, REC_KEY_FILE, skey_filename);
+ if (sector_size == 0)
+ util_rec_set(rec, REC_SECTOR_SIZE, "(system default)");
+ else
+ util_rec_set(rec, REC_SECTOR_SIZE, "%lu bytes",
+ sector_size);
+ util_rec_set(rec, REC_CREATION_TIME, creation);
+ util_rec_set(rec, REC_CHANGE_TIME,
+ change != NULL ? change : "(never)");
+ util_rec_set(rec, REC_REENC_TIME, "%s %s",
+ reencipher != NULL ? reencipher : "(never)",
+ reenc_pending ? "(re-enciphering pending)" : "");
+
+ util_rec_print(rec);
+
+ if (description != NULL)
+ free(description);
+ if (volumes != NULL)
+ free(volumes);
+ if (volumes_argz != NULL)
+ free(volumes_argz);
+ if (apqns != NULL)
+ free(apqns);
+ if (apqns_argz != NULL)
+ free(apqns_argz);
+ if (creation != NULL)
+ free(creation);
+ if (change != NULL)
+ free(change);
+ if (reencipher != NULL)
+ free(reencipher);
+}
+
+struct validate_info {
+ struct util_rec *rec;
+ int pkey_fd;
+ unsigned long int num_valid;
+ unsigned long int num_invalid;
+ unsigned long int num_warnings;
+};
+
+/**
+ * Displays the status of the associated APQNs.
+ *
+ * @param[in] properties the properties of the key
+ * @param[in] name the name of the key
+ *
+ * @returns 0 in case of success, 1 if at least one of the APQNs is not
+ * available
+ */
+static int _keystore_display_apqn_status(struct properties *properties,
+ const char *name)
+{
+ int i, rc, card, domain, warning = 0;
+ char **apqn_list;
+ char *apqns;
+
+ apqns = properties_get(properties, PROP_NAME_APQNS);
+ if (apqns == NULL)
+ return 0;
+ apqn_list = str_list_split(apqns);
+
+ for (i = 0; apqn_list[i] != NULL; i++) {
+
+ if (sscanf(apqn_list[i], "%x.%x", &card, &domain) != 2)
+ continue;
+
+ rc = _keystore_is_apqn_online(card, domain);
+ if (rc != 1) {
+ printf("WARNING: The APQN %02x.%04x associated with "
+ "key '%s' is %s\n", card, domain, name,
+ rc == -1 ? "not a CCA card" : "not online");
+ warning = 1;
+ }
+ }
+
+ if (warning)
+ printf("\n");
+
+ free(apqns);
+ str_list_free_string_array(apqn_list);
+ return warning;
+}
+/**
+ * Displays the status of the associated volumes.
+ *
+ * @param[in] properties the properties of the key
+ * @param[in] name the name of the key
+ *
+ * @returns 0 in case of success, 1 if at least one of the volumes is not
+ * available
+ */
+static int _keystore_display_volume_status(struct properties *properties,
+ const char *name)
+{
+ int i, warning = 0;
+ char **volume_list;
+ char *volumes;
+ char *ch;
+
+ volumes = properties_get(properties, PROP_NAME_VOLUMES);
+ if (volumes == NULL)
+ return 0;
+ volume_list = str_list_split(volumes);
+
+ for (i = 0; volume_list[i] != NULL; i++) {
+
+ ch = strchr(volume_list[i], ':');
+ if (ch != NULL)
+ *ch = '\0';
+
+ if (!_keystore_is_block_device(volume_list[i])) {
+ printf("WARNING: The volume '%s' associated with "
+ "key '%s' is not available\n", volume_list[i],
+ name);
+ warning = 1;
+ }
+ }
+
+ if (warning)
+ printf("\n");
+
+ free(volumes);
+ str_list_free_string_array(volume_list);
+ return warning;
+}
+
+/**
+ * Processing function for the key validate function. Prints validation
+ * information for the key to be validated.
+ *
+ * @param[in] keystore the keystore
+ * @param[in] name the name of the key
+ * @param[in] properties the properties object of the key
+ * @param[in] file_names the file names used by this key
+ * @param[in] private private data: struct validate_info
+ *
+ * @returns 0 if the validation is successful, a negative errno value otherwise
+ */
+static int _keystore_process_validate(struct keystore *keystore,
+ const char *name,
+ struct properties *properties,
+ struct key_filenames *file_names,
+ void *private)
+{
+ struct validate_info *info = (struct validate_info *)private;
+ size_t clear_key_bitsize;
+ size_t secure_key_size;
+ u8 *secure_key;
+ int is_old_mk;
+ int rc, valid;
+
+ rc = _keystore_ensure_keyfiles_exist(file_names, name);
+ if (rc != 0)
+ goto out;
+
+ secure_key = read_secure_key(file_names->skey_filename,
+ &secure_key_size, keystore->verbose);
+ if (secure_key == NULL) {
+ rc = -ENOENT;
+ goto out;
+ }
+
+ rc = validate_secure_key(info->pkey_fd, secure_key, secure_key_size,
+ &clear_key_bitsize, &is_old_mk,
+ keystore->verbose);
+ if (rc != 0) {
+ valid = 0;
+ info->num_invalid++;
+ rc = 0;
+ } else {
+ info->num_valid++;
+ valid = 1;
+ }
+ free(secure_key);
+
+ _keystore_print_record(info->rec, name, properties, 1,
+ file_names->skey_filename, secure_key_size,
+ clear_key_bitsize, valid, is_old_mk,
+ _keystore_reencipher_key_exists(file_names));
+
+ if (valid && is_old_mk) {
+ util_print_indented("WARNING: The secure key is currently "
+ "enciphered with the OLD CCA master key "
+ "and should be re-enciphered with the "
+ "CURRENT CCA master key as soon as "
+ "possible to avoid data loss\n", 0);
+ info->num_warnings++;
+ }
+ if (_keystore_display_apqn_status(properties, name) != 0)
+ info->num_warnings++;
+ if (_keystore_display_volume_status(properties, name) != 0)
+ info->num_warnings++;
+
+out:
+ if (rc != 0)
+ pr_verbose(keystore, "Failed to validate key '%s': %s",
+ name, strerror(-rc));
+ return rc;
+}
+
+/**
+ * Validates one or multiple keys in the keystore
+ *
+ * @param[in] keystore the key store
+ * @param[in] name_filter the name filter to select the key (can be NULL)
+ *
+ * @returns 0 for success or a negative errno in case of an error
+ */
+int keystore_validate_key(struct keystore *keystore, const char *name_filter,
+ const char *apqn_filter, int pkey_fd)
+{
+ struct validate_info info;
+ struct util_rec *rec;
+ int rc;
+
+ util_assert(keystore != NULL, "Internal error: keystore is NULL");
+
+ rec = _keystore_setup_record(1);
+
+ info.pkey_fd = pkey_fd;
+ info.rec = rec;
+ info.num_valid = 0;
+ info.num_invalid = 0;
+ info.num_warnings = 0;
+
+ rc = _keystore_process_filtered(keystore, name_filter, NULL,
+ apqn_filter,
+ _keystore_process_validate, &info);
+
+ util_rec_free(rec);
+
+ if (rc != 0) {
+ pr_verbose(keystore, "Failed to validate keys: %s",
+ strerror(-rc));
+ } else {
+ pr_verbose(keystore, "Successfully validated keys");
+ printf("%lu keys are valid, %lu keys are invalid, %lu "
+ "warnings\n", info.num_valid, info.num_invalid,
+ info.num_warnings);
+ }
+ return rc;
+}
+
+struct reencipher_params {
+ bool from_old;
+ bool to_new;
+ bool complete;
+ int inplace; /* -1 = autodetect, 0 = not in-place, 1 = in-place */
+};
+
+struct reencipher_info {
+ struct reencipher_params params;
+ int pkey_fd;
+ t_CSNBKTC dll_CSNBKTC;
+ unsigned long num_reenciphered;
+ unsigned long num_failed;
+ unsigned long num_skipped;
+};
+
+/**
+ * Perform the reencipherment of a key
+ *
+ * @param[in] keystore the keystore
+ * @param[in] name the name of the key
+ * @param[in] dll_CSNBKTC the CCA key token change function
+ * @param[in] params reenciphering parameters
+ * @param[in] secure_key a buffer containing the secure key
+ * @param[in] secure_key_size the size of the secure key
+ * @param[in] is_old_mk if true the key is currently re-enciphered with the
+ * OLD master key
+ * @returns 0 if the re-enciphering is successful, a negative errno value
+ * otherwise, 1 if it was skipped
+ */
+static int _keystore_perform_reencipher(struct keystore *keystore,
+ const char *name,
+ t_CSNBKTC dll_CSNBKTC,
+ struct reencipher_params *params,
+ u8 *secure_key, size_t secure_key_size,
+ bool is_old_mk)
+{
+ int rc;
+
+ if (!params->from_old && !params->to_new) {
+ /* Autodetect reencipher mode */
+ if (is_old_mk) {
+ params->from_old = 1;
+ util_print_indented("The secure key is currently "
+ "enciphered with the OLD CCA "
+ "master key and is being "
+ "re-enciphered with the CURRENT "
+ "CCA master key\n", 0);
+ } else {
+ params->to_new = 1;
+ util_print_indented("The secure key is currently "
+ "enciphered with the CURRENT CCA "
+ "master key and is being "
+ "re-enciphered with the NEW CCA "
+ "master key\n", 0);
+ }
+ }
+
+ if (params->from_old) {
+ if (!is_old_mk) {
+ printf("The secure key '%s' is already enciphered "
+ "with the CURRENT CCA master key\n", name);
+ return 1;
+ }
+
+ if (params->inplace == -1)
+ params->inplace = 1;
+
+ pr_verbose(keystore,
+ "Secure key '%s' will be re-enciphered from OLD "
+ "to the CURRENT CCA master key", name);
+
+ rc = key_token_change(dll_CSNBKTC,
+ secure_key, secure_key_size,
+ METHOD_OLD_TO_CURRENT,
+ keystore->verbose);
+ if (rc != 0) {
+ warnx("Failed to re-encipher '%s' from OLD to "
+ "CURRENT CCA master key", name);
+ return rc;
+ }
+ }
+ if (params->to_new) {
+ pr_verbose(keystore,
+ "Secure key '%s' will be re-enciphered from "
+ "CURRENT to the NEW CCA master key", name);
+
+ if (params->inplace == -1)
+ params->inplace = 0;
+
+ rc = key_token_change(dll_CSNBKTC,
+ secure_key, secure_key_size,
+ METHOD_CURRENT_TO_NEW,
+ keystore->verbose);
+ if (rc != 0) {
+ warnx("Failed to re-encipher '%s' from CURRENT to "
+ "NEW CCA master key", name);
+ return rc;
+ }
+ }
+
+ return 0;
+}
+
+/**
+ * Processing function for the key re-enciphering function.
+ *
+ * @param[in] keystore the keystore
+ * @param[in] name the name of the key
+ * @param[in] properties the properties object of the key (not used here)
+ * @param[in] file_names the file names used by this key
+ * @param[in] private private data: struct reencipher_info
+ *
+ * @returns 0 if the re-enciphering is successful, a negative errno value
+ * otherwise
+ */
+static int _keystore_process_reencipher(struct keystore *keystore,
+ const char *name,
+ struct properties *properties,
+ struct key_filenames *file_names,
+ void *private)
+{
+ struct reencipher_info *info = (struct reencipher_info *)private;
+ struct reencipher_params params = info->params;
+ size_t clear_key_bitsize;
+ size_t secure_key_size;
+ u8 *secure_key = NULL;
+ char *out_file;
+ int is_old_mk;
+ char *temp;
+ int rc;
+
+ rc = _keystore_ensure_keyfiles_exist(file_names, name);
+ if (rc != 0)
+ goto out;
+
+ pr_verbose(keystore, "Complete reencipher: %d", params.complete);
+ pr_verbose(keystore, "In-place reencipher: %d", params.inplace);
+
+ if (params.complete) {
+ if (!_keystore_reencipher_key_exists(file_names)) {
+ warnx("Staged re-enciphering in not pending for key "
+ "'%s', skipping",
+ name);
+ info->num_skipped++;
+ rc = 0;
+ goto out;
+ }
+
+ printf("Completing re-enciphering for key '%s'\n", name);
+
+ params.inplace = 1;
+ }
+
+ secure_key = read_secure_key(params.complete ?
+ file_names->renc_filename :
+ file_names->skey_filename,
+ &secure_key_size, keystore->verbose);
+ if (secure_key == NULL) {
+ rc = -ENOENT;
+ goto out;
+ }
+
+ rc = validate_secure_key(info->pkey_fd, secure_key, secure_key_size,
+ &clear_key_bitsize, &is_old_mk,
+ keystore->verbose);
+ if (rc != 0) {
+ if (params.complete) {
+ warnx("Key '%s' is not valid, re-enciphering is not "
+ "completed", name);
+ warnx("Possibly the CCA master key not yet been set?");
+ } else {
+ warnx("Key '%s' is not valid, it is not re-enciphered",
+ name);
+ info->num_skipped++;
+ rc = 0;
+ }
+ goto out;
+ }
+
+ if (!params.complete) {
+ printf("Re-enciphering key '%s'\n", name);
+
+ rc = _keystore_perform_reencipher(keystore, name,
+ info->dll_CSNBKTC, ¶ms,
+ secure_key, secure_key_size,
+ is_old_mk);
+ if (rc < 0)
+ goto out;
+ if (rc > 0) {
+ info->num_skipped++;
+ rc = 0;
+ goto out;
+ }
+ }
+
+ pr_verbose(keystore, "In-place reencipher: %d", params.inplace);
+
+ out_file = params.inplace == 1 ? file_names->skey_filename :
+ file_names->renc_filename;
+ rc = write_secure_key(out_file, secure_key,
+ secure_key_size, keystore->verbose);
+ if (rc != 0)
+ goto out;
+
+ rc = _keystore_set_file_permission(keystore, out_file);
+ if (rc != 0)
+ goto out;
+
+ if (params.complete || params.inplace == 1) {
+ rc = _keystore_set_timestamp_property(properties,
+ PROP_NAME_REENC_TIME);
+ if (rc != 0)
+ goto out;
+
+ rc = properties_save(properties, file_names->info_filename, 1);
+ if (rc != 0) {
+ pr_verbose(keystore,
+ "Failed to write key info file '%s': %s",
+ file_names->info_filename, strerror(-rc));
+ goto out;
+ }
+
+ rc = _keystore_set_file_permission(keystore,
+ file_names->info_filename);
+ if (rc != 0)
+ goto out;
+ }
+
+ if (params.complete ||
+ (params.inplace && _keystore_reencipher_key_exists(file_names))) {
+ if (remove(file_names->renc_filename) != 0) {
+ rc = -errno;
+ pr_verbose(keystore, "Failed to remove '%s': %s",
+ file_names->renc_filename, strerror(-rc));
+ goto out;
+ }
+ }
+
+ if (params.inplace != 1) {
+ util_asprintf(&temp, "Staged re-enciphering has completed for "
+ "key '%s'. Run 'zkey reencipher' with option "
+ "'--complete' when the NEW CCA master key has "
+ "been set (moved to the CURRENT master key "
+ "register) to complete the re-enciphering "
+ "process", name);
+ util_print_indented(temp, 0);
+ free(temp);
+ }
+
+ info->num_reenciphered++;
+
+out:
+ if (secure_key != NULL)
+ free(secure_key);
+
+ printf("\n");
+
+ if (rc != 0) {
+ info->num_failed++;
+ pr_verbose(keystore, "Failed to re-encipher key '%s': %s",
+ name, strerror(-rc));
+ rc = 0;
+ }
+ return rc;
+}
+
+/**
+ * Reenciphers a key in the keystore
+ *
+ * @param[in] keystore the key store
+ * @param[in] name_filter the name filter to select the key (can be NULL)
+ * @param[in] apqn_filter the APQN filter to seletc the key (can be NULL)
+ * @param[in] from_old If true the key is reenciphered from the OLD to the
+ * CURRENT CCA master key.
+ * @param[in] to_new If true the key is reenciphered from the CURRENT to
+ * the OLD CCA master key.
+ * @param[in] inplace if true, the key will be re-enciphere in-place
+ * @param[in] staged if true, the key will be re-enciphere not in-place
+ * @param[in] complete if true, a pending re-encipherment is completed
+ * Note: if both from Old and toNew are FALSE, then the reencipherement mode is
+ * detected automatically. If both are TRUE then the key is reenciphered
+ * from the OLD to the NEW CCA master key.
+ * Note: if both inplace and staged are FLASE, then the key is re-enciphered
+ * inplace when for OLD-to-CURRENT, and is reenciphered staged for
+ * CURRENT-to-NEW.
+ * @returns 0 for success or a negative errno in case of an error
+ */
+int keystore_reencipher_key(struct keystore *keystore, const char *name_filter,
+ const char *apqn_filter,
+ bool from_old, bool to_new, bool inplace,
+ bool staged, bool complete, int pkey_fd,
+ t_CSNBKTC dll_CSNBKTC)
+{
+ struct reencipher_info info;
+ int rc;
+
+ util_assert(keystore != NULL, "Internal error: keystore is NULL");
+
+ info.params.from_old = from_old;
+ info.params.to_new = to_new;
+ info.params.inplace = -1;
+ if (inplace)
+ info.params.inplace = 1;
+ if (staged)
+ info.params.inplace = 0;
+ info.params.complete = complete;
+ info.pkey_fd = pkey_fd;
+ info.dll_CSNBKTC = dll_CSNBKTC;
+ info.num_failed = 0;
+ info.num_reenciphered = 0;
+ info.num_skipped = 0;
+
+ rc = _keystore_process_filtered(keystore, name_filter, NULL,
+ apqn_filter,
+ _keystore_process_reencipher, &info);
+
+ if (rc != 0) {
+ pr_verbose(keystore, "Failed to re-encipher keys: %s",
+ strerror(-rc));
+ } else {
+ pr_verbose(keystore, "Successfully re-enciphered keys");
+ printf("%lu keys re-enciphered, %lu keys skipped, %lu keys "
+ "failed to re-encipher\n",
+ info.num_reenciphered, info.num_skipped,
+ info.num_failed);
+ if (info.num_failed > 0)
+ rc = -EIO;
+ }
+ return rc;
+}
+
+/**
+ * Copies (duplicates) a key in the keystore. Any existing volume associations
+ * are removed from the copy, because a volume can only be associated to one
+ * key. However, you can set new volume associations using the volumes
+ * parameter.
+ *
+ * @param[in] keystore the key store
+ * @param[in] name the name of the key
+ * @param[in] newname the new name of the key
+ * @param[in] volumes a comma separated list of volumes associated with this
+ * key (optional, can be NULL)
+ *
+ * @returns 0 for success or a negative errno in case of an error
+ */
+int keystore_copy_key(struct keystore *keystore, const char *name,
+ const char *newname, const char *volumes)
+{
+ struct volume_check vol_check = { .keystore = keystore,
+ .name = newname };
+ struct key_filenames file_names = { NULL, NULL, NULL };
+ struct key_filenames new_names = { NULL, NULL, NULL };
+ struct properties *key_prop = NULL;
+ size_t secure_key_size;
+ u8 *secure_key;
+ int rc;
+
+ util_assert(keystore != NULL, "Internal error: keystore is NULL");
+ util_assert(name != NULL, "Internal error: name is NULL");
+ util_assert(newname != NULL, "Internal error: newname is NULL");
+
+ rc = _keystore_get_key_filenames(keystore, name, &file_names);
+ if (rc != 0)
+ goto out;
+
+ rc = _keystore_ensure_keyfiles_exist(&file_names, name);
+ if (rc != 0)
+ goto out;
+
+ rc = _keystore_get_key_filenames(keystore, newname, &new_names);
+ if (rc != 0)
+ goto out;
+
+ rc = _keystore_ensure_keyfiles_not_exist(&new_names, newname);
+ if (rc != 0)
+ goto out;
+
+ secure_key = read_secure_key(file_names.skey_filename,
+ &secure_key_size, keystore->verbose);
+ if (secure_key == NULL) {
+ rc = -ENOENT;
+ goto out;
+ }
+
+ rc = write_secure_key(new_names.skey_filename, secure_key,
+ secure_key_size, keystore->verbose);
+ free(secure_key);
+ if (rc != 0)
+ goto out;
+
+ rc = _keystore_set_file_permission(keystore, new_names.skey_filename);
+ if (rc != 0)
+ goto out;
+
+ key_prop = properties_new();
+ rc = properties_load(key_prop, file_names.info_filename, 1);
+ if (rc != 0) {
+ warnx("Key '%s' does not exist or is invalid", name);
+ remove(file_names.skey_filename);
+ goto out;
+ }
+
+ /*
+ * Remove any volume association, since a volume can only be associated
+ * with one key
+ */
+ rc = properties_set(key_prop, PROP_NAME_VOLUMES, "");
+ if (rc != 0)
+ goto out;
+
+ if (volumes != NULL) {
+ rc = _keystore_change_association(key_prop, PROP_NAME_VOLUMES,
+ volumes,
+ "volume",
+ _keystore_volume_check,
+ &vol_check);
+ if (rc != 0)
+ goto out;
+ }
+
+ rc = properties_remove(key_prop, PROP_NAME_CHANGE_TIME);
+ if (rc != 0 && rc != -ENOENT)
+ goto out;
+
+ rc = properties_remove(key_prop, PROP_NAME_REENC_TIME);
+ if (rc != 0 && rc != -ENOENT)
+ goto out;
+
+ rc = _keystore_set_timestamp_property(key_prop,
+ PROP_NAME_CREATION_TIME);
+ if (rc != 0)
+ goto out;
+
+ rc = properties_save(key_prop, new_names.info_filename, 1);
+ if (rc != 0) {
+ pr_verbose(keystore,
+ "Key info file '%s' could not be written: %s",
+ new_names.info_filename, strerror(-rc));
+ remove(new_names.skey_filename);
+ goto out;
+ }
+
+ rc = _keystore_set_file_permission(keystore, new_names.info_filename);
+ if (rc != 0)
+ goto out;
+
+ pr_verbose(keystore, "Successfully copied key '%s' to '%s'", name,
+ newname);
+
+out:
+ if (rc != 0) {
+ remove(new_names.skey_filename);
+ remove(new_names.info_filename);
+ }
+
+ _keystore_free_key_filenames(&file_names);
+ _keystore_free_key_filenames(&new_names);
+ if (key_prop != NULL)
+ properties_free(key_prop);
+
+ if (rc != 0)
+ pr_verbose(keystore, "Failed to copy key '%s'to '%s': %s",
+ name, newname, strerror(-rc));
+ return rc;
+}
+
+/**
+ * Exports a key from the keystore to a file
+ *
+ * @param[in] keystore the key store
+ * @param[in] name the name of the key
+ * @param[in] export_file the name of the file to export the key to
+ *
+ * @returns 0 for success or a negative errno in case of an error
+ */
+int keystore_export_key(struct keystore *keystore, const char *name,
+ const char *export_file)
+{
+ struct key_filenames file_names = { NULL, NULL, NULL };
+ size_t secure_key_size;
+ u8 *secure_key;
+ int rc;
+
+ util_assert(keystore != NULL, "Internal error: keystore is NULL");
+ util_assert(name != NULL, "Internal error: name is NULL");
+ util_assert(export_file != NULL, "Internal error: export_file is NULL");
+
+ rc = _keystore_get_key_filenames(keystore, name, &file_names);
+ if (rc != 0)
+ goto out;
+
+ rc = _keystore_ensure_keyfiles_exist(&file_names, name);
+ if (rc != 0)
+ goto out;
+
+ secure_key = read_secure_key(file_names.skey_filename,
+ &secure_key_size, keystore->verbose);
+ if (secure_key == NULL) {
+ rc = -ENOENT;
+ goto out;
+ }
+
+ rc = write_secure_key(export_file, secure_key,
+ secure_key_size, keystore->verbose);
+ free(secure_key);
+
+ pr_verbose(keystore, "Successfully exported key '%s' to '%s'", name,
+ export_file);
+
+out:
+ _keystore_free_key_filenames(&file_names);
+
+ if (rc != 0)
+ pr_verbose(keystore, "Failed to export key '%s': %s",
+ name, strerror(-rc));
+ return rc;
+}
+
+/**
+ * Prompts the user to confirm deletion of a key
+ *
+ * @param[in] keystore the key store
+ * @param[in] name the name of the key
+ * @param[in] file_names the file names of the key
+ *
+ * @returnd 0 if the user confirmed the deletion, a negative errno value
+ * otherwise
+ */
+static int _keystore_propmp_for_remove(struct keystore *keystore,
+ const char *name,
+ struct key_filenames *file_names)
+{
+ struct properties *key_prop;
+ char *volumes = NULL;
+ char **volume_list = NULL;
+ char str[20];
+ int rc, i;
+
+ key_prop = properties_new();
+ rc = properties_load(key_prop, file_names->info_filename, 1);
+ if (rc != 0) {
+ warnx("Key '%s' does not exist or is invalid", name);
+ goto out;
+ }
+
+ volumes = properties_get(key_prop, PROP_NAME_VOLUMES);
+ if (volumes != NULL && strlen(volumes) > 0) {
+ volume_list = str_list_split(volumes);
+
+ warnx("When you remove key '%s' the following volumes will "
+ "no longer be usable:", name);
+ for (i = 0; volume_list[i] != NULL; i++)
+ fprintf(stderr, "%s\n", volume_list[i]);
+ }
+
+ printf("%s: Remove key '%s'? ", program_invocation_short_name, name);
+ if (fgets(str, sizeof(str), stdin) == NULL) {
+ rc = -EIO;
+ goto out;
+ }
+ if (str[strlen(str) - 1] == '\n')
+ str[strlen(str) - 1] = '\0';
+ pr_verbose(keystore, "Prompt reply: '%s'", str);
+ if (strcasecmp(str, "y") != 0 && strcasecmp(str, "yes") != 0) {
+ rc = -ECANCELED;
+ goto out;
+ }
+
+out:
+ properties_free(key_prop);
+ if (volume_list != NULL)
+ str_list_free_string_array(volume_list);
+
+ return rc;
+}
+
+/**
+ * Removes a key from the keystore
+ *
+ * @param[in] keystore the key store
+ * @param[in] name the name of the key
+ * @param[in] quiet if true no confirmation prompt is shown
+ *
+ * @returns 0 for success or a negative errno in case of an error
+ */
+int keystore_remove_key(struct keystore *keystore, const char *name,
+ bool quiet)
+{
+ struct key_filenames file_names = { NULL, NULL, NULL };
+ int rc;
+
+ util_assert(keystore != NULL, "Internal error: keystore is NULL");
+ util_assert(name != NULL, "Internal error: name is NULL");
+
+ rc = _keystore_get_key_filenames(keystore, name, &file_names);
+ if (rc != 0)
+ goto out;
+
+ rc = _keystore_ensure_keyfiles_exist(&file_names, name);
+ if (rc != 0)
+ goto out;
+
+ if (!quiet) {
+ if (_keystore_propmp_for_remove(keystore, name,
+ &file_names) != 0)
+ goto out;
+ }
+
+ if (remove(file_names.skey_filename) != 0) {
+ rc = -errno;
+ pr_verbose(keystore, "Failed to remove '%s': %s",
+ file_names.skey_filename, strerror(-rc));
+ goto out;
+ }
+ if (remove(file_names.info_filename) != 0) {
+ rc = -errno;
+ pr_verbose(keystore, "Failed to remove '%s': %s",
+ file_names.info_filename, strerror(-rc));
+ }
+ if (_keystore_reencipher_key_exists(&file_names)) {
+ if (remove(file_names.renc_filename) != 0) {
+ rc = -errno;
+ pr_verbose(keystore, "Failed to remove '%s': %s",
+ file_names.renc_filename, strerror(-rc));
+ }
+ }
+ pr_verbose(keystore, "Successfully removed key '%s'", name);
+
+out:
+ _keystore_free_key_filenames(&file_names);
+
+ if (rc != 0)
+ pr_verbose(keystore, "Failed to remove key '%s': %s",
+ name, strerror(-rc));
+ return rc;
+}
+
+/**
+ * Processing function for the key display function.
+ *
+ * @param[in] keystore the keystore
+ * @param[in] name the name of the key
+ * @param[in] properties the properties object of the key
+ * @param[in] file_names the file names used by this key
+ * @param[in] private private data: struct reencipher_info
+ *
+ * @returns 0 if the display is successful, a negative errno value otherwise
+ */
+static int _keystore_display_key(struct keystore *keystore,
+ const char *name,
+ struct properties *properties,
+ struct key_filenames *file_names,
+ void *private)
+{
+ struct util_rec *rec = (struct util_rec *)private;
+ struct secaeskeytoken *secure_key;
+ size_t secure_key_size;
+ int rc = 0;
+
+ secure_key = (struct secaeskeytoken *)
+ read_secure_key(file_names->skey_filename,
+ &secure_key_size, keystore->verbose);
+ if (secure_key == NULL)
+ return -EIO;
+
+ if (secure_key_size < SECURE_KEY_SIZE) {
+ pr_verbose(keystore,
+ "Size of secure key is too small: %lu expected %lu",
+ secure_key_size, SECURE_KEY_SIZE);
+ rc = -EIO;
+ goto out;
+ }
+
+ _keystore_print_record(rec, name, properties, 0,
+ file_names->skey_filename, secure_key_size,
+ IS_XTS(secure_key_size) ? secure_key->bitsize * 2
+ : secure_key->bitsize,
+ 0, 0,
+ _keystore_reencipher_key_exists(file_names));
+
+out:
+ free(secure_key);
+ return rc;
+}
+
+/**
+ * Lists keys in the keystore that matches the filters
+ *
+ * @param[in] keystore the key store
+ * @param[in] name_filter the name filter. Can contain wild cards.
+ * NULL means no name filter.
+ * @param[in] volume_filter the volume filter. Can contain wild cards, and
+ * mutliple volume filters separated by commas.
+ * The ':dm-name' part of the volume is optional
+ * for the volume filter. If not specified, the filter
+ * checks the volume part only.
+ * NULL means no volume filter.
+ * @param[in] apqn_filter the APQN filter. Can contain wild cards, and
+ * mutliple APQN filters separated by commas.
+ * NULL means no APQN filter.
+ *
+ * @returns 0 for success or a negative errno in case of an error
+ */
+int keystore_list_keys(struct keystore *keystore, const char *name_filter,
+ const char *volume_filter, const char *apqn_filter)
+{
+ struct util_rec *rec;
+ int rc;
+
+ util_assert(keystore != NULL, "Internal error: keystore is NULL");
+
+ rec = _keystore_setup_record(0);
+
+ rc = _keystore_process_filtered(keystore, name_filter, volume_filter,
+ apqn_filter, _keystore_display_key,
+ rec);
+ util_rec_free(rec);
+
+ if (rc != 0)
+ pr_verbose(keystore, "Failed to list keys: %s",
+ strerror(-rc));
+ else
+ pr_verbose(keystore, "Successfully listed keys");
+ return rc;
+}
+
+/**
+ * Executes a command via system().
+ *
+ * @param[in] cmd the command to execute
+ * @param[in] msg_cmd the short command name (for messages)
+ *
+ * @returns the exit code of the command execution, or -1 in case of an error
+ */
+static int _keystore_execute_cmd(const char *cmd,
+ const char *msg_cmd)
+{
+ int rc;
+
+ rc = setenv("PATH", "/bin:/usr/bin:/usr/sbin", 1);
+ if (rc < 0)
+ return rc;
+
+ rc = system(cmd);
+ if (WIFEXITED(rc)) {
+ rc = WEXITSTATUS(rc);
+ if (rc != 0)
+ printf("%s exit code: %d\n", msg_cmd, rc);
+ } else {
+ rc = -EIO;
+ warnx("%s terminated abnormally", msg_cmd);
+ }
+
+ return rc;
+}
+
+
+struct crypt_info {
+ bool execute;
+ char **volume_filter;
+ int (*process_func)(struct keystore *keystore,
+ const char *volume,
+ const char *dmname,
+ const char *cipher_spec,
+ const char *key_file_name,
+ size_t key_file_size,
+ size_t sector_size,
+ struct crypt_info *info);
+};
+
+/**
+ * Processing function for the cryptsetup function. Builds a cryptsetup command
+ * line and optionally executes it.
+ *
+ * @param[in] keystore the keystore (not used here)
+ * @param[in] volume the volume to mount
+ * @param[in] dmname the debice mapper name
+ * @param[in] cipher_spec the cipher specification
+ * @param[in] key_file_name the key file name
+ * @param[in] key_file_size the size of the key file in bytes
+ * @param sector_size the sector size in bytes or 0 if not specified
+ * @param[in] info processing info
+ *
+ * @returns 0 if successful, a negative errno value otherwise
+ */
+static int _keystore_process_cryptsetup(struct keystore *keystore,
+ const char *volume,
+ const char *dmname,
+ const char *cipher_spec,
+ const char *key_file_name,
+ size_t key_file_size,
+ size_t sector_size,
+ struct crypt_info *info)
+{
+ char temp[100];
+ int rc = 0;
+ char *cmd;
+
+ sprintf(temp, "--sector-size %lu ", sector_size);
+ util_asprintf(&cmd,
+ "cryptsetup plainOpen %s--key-file '%s' --key-size %lu "
+ "--cipher %s %s%s %s",
+ keystore->verbose ? "-v " : "", key_file_name,
+ key_file_size * 8, cipher_spec,
+ sector_size > 0 ? temp : "", volume, dmname);
+
+ if (info->execute) {
+ printf("Executing: %s\n", cmd);
+ rc = _keystore_execute_cmd(cmd, "cryptsetup");
+ } else {
+ printf("%s\n", cmd);
+ }
+
+ free(cmd);
+ return rc;
+}
+
+/**
+ * Processing function for the crypttab function. Builds a crypttab entry
+ * and prints it.
+ *
+ * @param[in] keystore the keystore (not used here)
+ * @param[in] volume the volume to mount
+ * @param[in] dmname the debice mapper name
+ * @param[in] cipher_spec the cipher specification
+ * @param[in] key_file_name the key file name
+ * @param[in] key_file_size the size of the key file in bytes
+ * @param sector_size the sector size in bytes or 0 if not specified
+ * @param[in] info processing info (not used here)
+ *
+ * @returns 0 if successful, a negative errno value otherwise
+ */
+
+static int _keystore_process_crypttab(struct keystore *UNUSED(keystore),
+ const char *volume,
+ const char *dmname,
+ const char *cipher_spec,
+ const char *key_file_name,
+ size_t key_file_size,
+ size_t sector_size,
+ struct crypt_info *UNUSED(info))
+{
+ char temp[1000];
+
+ if (sector_size > 0) {
+ sprintf(temp,
+ "WARNING: volume '%s' is using a sector size of %lu. "
+ "At the time this utility was developed, systemd's "
+ "support of crypttab did not support to specify a "
+ "sector size with plain dm-crypt devices. The generated "
+ "crypttab entry may or may not work, and may need "
+ "manual adoptions.", volume, sector_size);
+ util_print_indented(temp, 0);
+ }
+
+ sprintf(temp, ",sector-size=%lu", sector_size);
+ printf("%s\t%s\t%s\tplain,cipher=%s,size=%lu,hash=plain%s\n",
+ dmname, volume, key_file_name, cipher_spec, key_file_size * 8,
+ sector_size > 0 ? temp : "");
+
+ return 0;
+}
+
+/**
+ * Builds a cipher specification for cryptsetup/crypttab
+ *
+ * @param properties the key properties
+ * @param is_xts if true, the key is an XTS key
+ *
+ * @returns the cipher spec string (must be freed by the caller)
+ */
+static char *_keystore_build_cipher_spec(struct properties *properties,
+ bool is_xts)
+{
+ char *cipher_spec = NULL;
+ char *cipher = NULL;
+ char *ivmode = NULL;
+
+ cipher = properties_get(properties, PROP_NAME_CIPHER);
+ if (cipher == NULL)
+ goto out;
+
+ ivmode = properties_get(properties, PROP_NAME_IV_MODE);
+ if (ivmode == NULL)
+ goto out;
+
+ util_asprintf(&cipher_spec, "%s-%s-%s", cipher, is_xts ? "xts" : "cbc",
+ ivmode);
+
+out:
+ if (cipher != NULL)
+ free(cipher);
+ if (ivmode != NULL)
+ free(ivmode);
+
+ return cipher_spec;
+}
+
+/**
+ * Returns the size of the secure key file
+ *
+ * @param[in] keystore the keystore
+ * @param[in] skey_filename the file name of the secure key
+ *
+ * @returns the size of the secure key, or -1 in case of an error
+ */
+static size_t _keystore_get_key_file_size(struct keystore *keystore,
+ const char *skey_filename)
+{
+ size_t secure_key_size;
+ struct stat sb;
+
+ if (stat(skey_filename, &sb)) {
+ pr_verbose(keystore, "Key file '%s': %s",
+ skey_filename, strerror(errno));
+ return -1;
+ }
+
+ secure_key_size = sb.st_size;
+ if (secure_key_size < SECURE_KEY_SIZE) {
+ pr_verbose(keystore,
+ "Size of secure key is too small: %lu expected %lu",
+ secure_key_size, SECURE_KEY_SIZE);
+ return -1;
+ }
+
+ return secure_key_size;
+}
+
+/**
+ * Processing function for the cryptsetup and crypttab functions.
+ * Extracts the required information and calls the secondary processing function
+ * contained in struct crypt_info.
+ *
+ * @param[in] keystore the keystore
+ * @param[in] name the name of the key
+ * @param[in] properties the properties object of the key
+ * @param[in] file_names the file names used by this key
+ * @param[in] private private data: struct crypt_info
+ *
+ * @returns 0 if the validation is successful, a negative errno value otherwise
+ */
+static int _keystore_process_crypt(struct keystore *keystore,
+ const char *name,
+ struct properties *properties,
+ struct key_filenames *file_names,
+ void *private)
+{
+ struct crypt_info *info = (struct crypt_info *)private;
+ char **volume_list = NULL;
+ char *cipher_spec = NULL;
+ size_t secure_key_size;
+ size_t sector_size = 0;
+ char *volumes = NULL;
+ char *dmname;
+ char *temp;
+ int rc = 0;
+ char *vol;
+ char *ch;
+ int i;
+
+ secure_key_size = _keystore_get_key_file_size(keystore,
+ file_names->skey_filename);
+ if (secure_key_size < SECURE_KEY_SIZE) {
+ pr_verbose(keystore,
+ "Size of secure key is too small: %lu expected %lu",
+ secure_key_size, SECURE_KEY_SIZE);
+ rc = -EIO;
+ goto out;
+ }
+
+ cipher_spec = _keystore_build_cipher_spec(properties,
+ IS_XTS(secure_key_size));
+ if (cipher_spec == NULL) {
+ rc = -EINVAL;
+ goto out;
+ }
+
+ volumes = properties_get(properties, PROP_NAME_VOLUMES);
+ if (volumes == NULL)
+ return -EINVAL;
+ volume_list = str_list_split(volumes);
+
+ temp = properties_get(properties, PROP_NAME_SECTOR_SIZE);
+ if (temp != NULL) {
+ util_assert(sscanf(temp, "%lu", §or_size) == 1,
+ "Internal error: sscanf failed");
+ free(temp);
+ }
+
+ for (i = 0; volume_list[i] != NULL && rc == 0; i++) {
+ vol = volume_list[i];
+ if (_keystore_match_filter(vol, info->volume_filter,
+ NULL) != 0) {
+ ch = strchr(vol, ':');
+ if (ch == NULL) {
+ warnx("Volume does not contain a dm-name part."
+ " Key: '%s'", name);
+ rc = -EINVAL;
+ break;
+ }
+ *ch = '\0';
+ dmname = ch + 1;
+
+ rc = info->process_func(keystore, vol, dmname,
+ cipher_spec, file_names->skey_filename,
+ secure_key_size, sector_size, info);
+ if (rc != 0)
+ break;
+ }
+ }
+
+out:
+ if (volumes != NULL)
+ free(volumes);
+ if (volume_list != NULL)
+ str_list_free_string_array(volume_list);
+ if (cipher_spec != NULL)
+ free(cipher_spec);
+ return rc;
+}
+
+/**
+ * Generates cryptsetup commands for one or multiple volumes.
+ *
+ * @param[in] keystore the key store
+ * @param[in] volume_filter the volume filter. Can contain wild cards, and
+ * mutliple volume filters separated by commas.
+ * The ':dm-name' part of the volume is optional
+ * for the volume filter. If not specified, the filter
+ * checks the volume part only.
+ * @param[in] execute If TRUE the cryptsetup command is executed,
+ * otherwise it is printed to stdout
+ *
+ * @returns 0 for success or a negative errno in case of an error
+ */
+int keystore_cryptsetup(struct keystore *keystore, const char *volume_filter,
+ bool execute)
+{
+ struct crypt_info info = { 0 };
+ int rc;
+
+ util_assert(keystore != NULL, "Internal error: keystore is NULL");
+
+ if (volume_filter == NULL)
+ volume_filter = "*";
+ info.execute = execute;
+ info.volume_filter = str_list_split(volume_filter);
+ info.process_func = _keystore_process_cryptsetup;
+
+ rc = _keystore_process_filtered(keystore, NULL, volume_filter, NULL,
+ _keystore_process_crypt, &info);
+
+ str_list_free_string_array(info.volume_filter);
+
+ if (rc < 0)
+ pr_verbose(keystore, "Cryptsetup failed with: %s",
+ strerror(-rc));
+ else if (rc > 0)
+ pr_verbose(keystore, "Cryptsetup failed with: %d", rc);
+ else
+ pr_verbose(keystore,
+ "Successfully generated cryptsetup commands");
+
+ return rc;
+}
+
+/**
+ * Generates crypttab entries for one or multiple volumes.
+ *
+ * @param[in] keystore the key store
+ * @param[in] volume_filter the volume filter. Can contain wild cards, and
+ * mutliple volume filters separated by commas.
+ * The ':dm-name' part of the volume is optional
+ * for the volume filter. If not specified, the filter
+ * checks the volume part only.
+ *
+ * @returns 0 for success or a negative errno in case of an error
+ */
+int keystore_crypttab(struct keystore *keystore, const char *volume_filter)
+{
+ struct crypt_info info = { 0 };
+ int rc;
+
+ util_assert(keystore != NULL, "Internal error: keystore is NULL");
+
+ if (volume_filter == NULL)
+ volume_filter = "*";
+ info.volume_filter = str_list_split(volume_filter);
+ info.process_func = _keystore_process_crypttab;
+
+ rc = _keystore_process_filtered(keystore, NULL, volume_filter, NULL,
+ _keystore_process_crypt, &info);
+
+ str_list_free_string_array(info.volume_filter);
+
+ if (rc != 0)
+ pr_verbose(keystore, "Cryptsetup failed with: %s",
+ strerror(-rc));
+ else
+ pr_verbose(keystore, "Successfully generated crypttab entries");
+
+ return rc;
+}
+
+/**
+ * Frees a keystore object
+ *
+ * @param[in] keystore the key store
+ */
+void keystore_free(struct keystore *keystore)
+{
+ util_assert(keystore != NULL, "Internal error: keystore is NULL");
+
+ _keystore_unlock_repository(keystore);
+ free(keystore->directory);
+ free(keystore);
+}
--- /dev/null
+++ b/zkey/keystore.h
@@ -0,0 +1,77 @@
+/*
+ * zkey - Generate, re-encipher, and validate secure keys
+ *
+ * Keystore handling functions
+ *
+ * Copyright IBM Corp. 2018
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef KEYSTORE_H
+#define KEYSTORE_H
+
+#include <stdbool.h>
+
+#include "pkey.h"
+
+struct keystore {
+ bool verbose;
+ char *directory;
+ int lock_fd;
+ mode_t mode;
+ gid_t owner;
+};
+
+struct keystore *keystore_new(const char *directory, bool verbose);
+
+int keystore_generate_key(struct keystore *keystore, const char *name,
+ const char *description, const char *volumes,
+ const char *apqns, size_t sector_size,
+ size_t keybits, bool xts, const char *clear_key_file,
+ int pkey_fd);
+
+int keystore_import_key(struct keystore *keystore, const char *name,
+ const char *description, const char *volumes,
+ const char *apqns, size_t sector_size,
+ const char *import_file);
+
+int keystore_change_key(struct keystore *keystore, const char *name,
+ const char *description, const char *volumes,
+ const char *apqns, long int sector_size);
+
+int keystore_rename_key(struct keystore *keystore, const char *name,
+ const char *newname);
+
+int keystore_validate_key(struct keystore *keystore, const char *name_filter,
+ const char *apqn_filter, int pkey_fd);
+
+int keystore_reencipher_key(struct keystore *keystore, const char *name_filter,
+ const char *apqn_filter,
+ bool from_old, bool to_new, bool inplace,
+ bool staged, bool complete, int pkey_fd,
+ t_CSNBKTC dll_CSNBKTC);
+
+int keystore_copy_key(struct keystore *keystore, const char *name,
+ const char *newname, const char *volumes);
+
+int keystore_export_key(struct keystore *keystore, const char *name,
+ const char *export_file);
+
+int keystore_remove_key(struct keystore *keystore, const char *name,
+ bool quiet);
+
+int keystore_list_keys(struct keystore *keystore, const char *name_filter,
+ const char *volume_filter, const char *apqn_filter);
+
+int keystore_cryptsetup(struct keystore *keystore, const char *volume_filter,
+ bool execute);
+
+int keystore_crypttab(struct keystore *keystore, const char *volume_filter);
+
+void keystore_free(struct keystore *keystore);
+
+
+
+#endif
