aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPaul Selkirk <paul@psgd.org>2016-06-26 01:02:44 -0400
committerPaul Selkirk <paul@psgd.org>2016-06-26 01:07:14 -0400
commita16159562d5e7a2998654c3f88ba0f88a3aaa42e (patch)
tree9b3c5ebc327a2ddf4e8b7960e3b834eb6177de24
parent0cd8850c6158ca5d263c21b52b8906c974b3cfcc (diff)
Add hal_set_pin_default_iterations so the CLI can use hal_rpc_set_pin with control over iterations.
-rw-r--r--hal_internal.h3
-rw-r--r--rpc_misc.c22
2 files changed, 19 insertions, 6 deletions
diff --git a/hal_internal.h b/hal_internal.h
index 0c38c00..bd8e97d 100644
--- a/hal_internal.h
+++ b/hal_internal.h
@@ -316,6 +316,9 @@ typedef struct {
} hal_ks_keydb_t;
+extern hal_error_t hal_set_pin_default_iterations(const hal_client_handle_t client,
+ const uint32_t iterations);
+
/*
* Internal functions within the keystore implementation. Think of
* these as concrete methods for the keystore API subclassed onto
diff --git a/rpc_misc.c b/rpc_misc.c
index 8176c6f..1902b71 100644
--- a/rpc_misc.c
+++ b/rpc_misc.c
@@ -85,6 +85,8 @@ typedef struct {
#define HAL_PIN_DEFAULT_ITERATIONS 20000
#endif
+static uint32_t hal_pin_default_iterations = HAL_PIN_DEFAULT_ITERATIONS;
+
#ifndef HAL_STATIC_CLIENT_STATE_BLOCKS
#define HAL_STATIC_CLIENT_STATE_BLOCKS 10
#endif
@@ -135,7 +137,7 @@ static hal_error_t login(const hal_client_handle_t client,
return err;
uint8_t buf[sizeof(p->pin)];
- const uint32_t iterations = p->iterations == 0 ? HAL_PIN_DEFAULT_ITERATIONS : p->iterations;
+ const uint32_t iterations = p->iterations == 0 ? hal_pin_default_iterations : p->iterations;
if ((err = hal_pbkdf2(NULL, hal_hash_sha256, (const uint8_t *) pin, pin_len,
p->salt, sizeof(p->salt), buf, sizeof(buf), iterations)) != HAL_OK)
@@ -210,11 +212,7 @@ static hal_error_t set_pin(const hal_client_handle_t client,
hal_ks_pin_t p = *pp;
- /*
- * Another all-zeros vs all-ones disagreement between drivers.
- */
- if (p.iterations == 0x00000000 || p.iterations == 0xffffffff)
- p.iterations = HAL_PIN_DEFAULT_ITERATIONS;
+ p.iterations = hal_pin_default_iterations;
if ((err = hal_get_random(NULL, p.salt, sizeof(p.salt))) != HAL_OK ||
(err = hal_pbkdf2(NULL, hal_hash_sha256,
@@ -227,6 +225,18 @@ static hal_error_t set_pin(const hal_client_handle_t client,
return HAL_OK;
}
+hal_error_t hal_set_pin_default_iterations(const hal_client_handle_t client,
+ const uint32_t iterations)
+{
+ if ((is_logged_in(client, HAL_USER_WHEEL) != HAL_OK) &&
+ (is_logged_in(client, HAL_USER_SO) != HAL_OK))
+ return HAL_ERROR_FORBIDDEN;
+
+ /* should probably store this in flash somewhere */
+ hal_pin_default_iterations = (iterations == 0) ? HAL_PIN_DEFAULT_ITERATIONS : iterations;
+ return HAL_OK;
+}
+
const hal_rpc_misc_dispatch_t hal_rpc_local_misc_dispatch = {
set_pin,
login,