diff options
| -rw-r--r-- | GNUmakefile | 2 | ||||
| -rw-r--r-- | ks.c | 26 | ||||
| -rw-r--r-- | rpc_misc.c | 5 |
3 files changed, 22 insertions, 11 deletions
diff --git a/GNUmakefile b/GNUmakefile index 151ce5c..c8160a9 100644 --- a/GNUmakefile +++ b/GNUmakefile @@ -181,7 +181,7 @@ endif TFMDIR := $(abspath ../thirdparty/libtfm) CFLAGS += -g3 -Wall -std=c99 -Wno-strict-aliasing -I${TFMDIR} -LDFLAGS := -g3 -L${TFMDIR} -ltfm +LDFLAGS += -g3 -L${TFMDIR} -ltfm CFLAGS += -DHAL_STATIC_HASH_STATE_BLOCKS=${STATIC_HASH_STATE_BLOCKS} CFLAGS += -DHAL_STATIC_HMAC_STATE_BLOCKS=${STATIC_HMAC_STATE_BLOCKS} @@ -371,27 +371,35 @@ hal_error_t hal_ks_get_pin(const hal_user_t user, default: return HAL_ERROR_BAD_ARGUMENTS; } +#warning Need better "Have we been initialized yet?" test /* * If we were looking for the WHEEL PIN and it appears to be * completely unset, return the compiled-in last-gasp PIN. This is - * not a great answer, but we need some kind of bootstrapping + * a terrible answer, but we need some kind of bootstrapping * mechanism. Feel free to suggest something better. * * We probably need some more general "have we been initialized?" * state somewhere, and might want to refuse to do things like * storing keys until we've been initialized and the appropriate * PINs have been set. + * + * Just to make things more fun, some drivers return all zeros for + * "this has never been set", some return all ones to indicate the + * same thing. REALLY need a flag somewhere. */ - if (user == HAL_USER_WHEEL && (*pin)->iterations == 0) { - uint8_t u = 0; - for (int i = 0; i < sizeof((*pin)->pin); i++) - u |= (*pin)->pin[i]; - for (int i = 0; i < sizeof((*pin)->salt); i++) - u |= (*pin)->salt[i]; - if (u == 0) - *pin = &hal_last_gasp_pin; + uint8_t u00 = 0x00, uFF = 0xFF; + for (int i = 0; i < sizeof((*pin)->pin); i++) { + u00 |= (*pin)->pin[i]; + uFF &= (*pin)->pin[i]; + } + for (int i = 0; i < sizeof((*pin)->salt); i++) { + u00 |= (*pin)->salt[i]; + uFF &= (*pin)->salt[i]; } + if (user == HAL_USER_WHEEL && ((u00 == 0x00 && (*pin)->iterations == 0x00000000) || + (uFF == 0xFF && (*pin)->iterations == 0xFFFFFFFF))) + *pin = &hal_last_gasp_pin; return HAL_OK; } @@ -210,7 +210,10 @@ static hal_error_t set_pin(const hal_client_handle_t client, hal_ks_pin_t p = *pp; - if (p.iterations == 0) + /* + * Another all-zeros vs all-ones disagreement between drivers. + */ + if (p.iterations == 0x00000000 || p.iterations == 0xffffffff) p.iterations = HAL_PIN_DEFAULT_ITERATIONS; if ((err = hal_get_random(NULL, p.salt, sizeof(p.salt))) != HAL_OK || |