aboutsummaryrefslogtreecommitdiff
path: root/libhal.py
diff options
context:
space:
mode:
Diffstat (limited to 'libhal.py')
-rw-r--r--libhal.py31
1 files changed, 25 insertions, 6 deletions
diff --git a/libhal.py b/libhal.py
index 93746e1..3063398 100644
--- a/libhal.py
+++ b/libhal.py
@@ -405,6 +405,7 @@ class PKey(Handle):
class HSM(object):
mixed_mode = False
+ debug_io = False
def _raise_if_error(self, status):
if status != 0:
@@ -417,7 +418,8 @@ class HSM(object):
def _send(self, msg): # Expects an xdrlib.Packer
msg = slip_encode(msg.get_buffer())
- #logger.debug("send: %s", ":".join("{:02x}".format(ord(c)) for c in msg))
+ if self.debug_io:
+ logger.debug("send: %s", ":".join("{:02x}".format(ord(c)) for c in msg))
self.socket.sendall(msg)
def _recv(self, code): # Returns an xdrlib.Unpacker
@@ -428,7 +430,8 @@ class HSM(object):
if msg[-1] == "":
raise HAL_ERROR_RPC_TRANSPORT()
msg.append(self.sockfile.read(1))
- #logger.debug("recv: %s", ":".join("{:02x}".format(ord(c)) for c in msg))
+ if self.debug_io:
+ logger.debug("recv: %s", ":".join("{:02x}".format(ord(c)) for c in msg))
msg = slip_decode("".join(msg))
if not msg:
continue
@@ -545,25 +548,41 @@ class HSM(object):
def pkey_load(self, type, curve, der, flags = 0, client = 0, session = 0):
with self.rpc(RPC_FUNC_PKEY_LOAD, session, type, curve, der, flags, client = client) as r:
- return PKey(self, r.unpack_uint(), UUID(bytes = r.unpack_bytes()))
+ pkey = PKey(self, r.unpack_uint(), UUID(bytes = r.unpack_bytes()))
+ logger.debug("Loaded pkey %s", pkey.uuid)
+ return pkey
def pkey_open(self, uuid, flags = 0, client = 0, session = 0):
with self.rpc(RPC_FUNC_PKEY_OPEN, session, uuid, flags, client = client) as r:
- return PKey(self, r.unpack_uint(), uuid)
+ pkey = PKey(self, r.unpack_uint(), uuid)
+ logger.debug("Opened pkey %s", pkey.uuid)
+ return pkey
def pkey_generate_rsa(self, keylen, exponent = "\x01\x00\x01", flags = 0, client = 0, session = 0):
with self.rpc(RPC_FUNC_PKEY_GENERATE_RSA, session, keylen, exponent, flags, client = client) as r:
- return PKey(self, r.unpack_uint(), UUID(bytes = r.unpack_bytes()))
+ pkey = PKey(self, r.unpack_uint(), UUID(bytes = r.unpack_bytes()))
+ logger.debug("Generated RSA pkey %s", pkey.uuid)
+ return pkey
def pkey_generate_ec(self, curve, flags = 0, client = 0, session = 0):
with self.rpc(RPC_FUNC_PKEY_GENERATE_EC, session, curve, flags, client = client) as r:
- return PKey(self, r.unpack_uint(), UUID(bytes = r.unpack_bytes()))
+ pkey = PKey(self, r.unpack_uint(), UUID(bytes = r.unpack_bytes()))
+ logger.debug("Generated EC pkey %s", pkey.uuid)
+ return pkey
def pkey_close(self, pkey):
+ try:
+ logger.debug("Closing pkey %s", pkey.uuid)
+ except AttributeError:
+ pass
with self.rpc(RPC_FUNC_PKEY_CLOSE, pkey):
return
def pkey_delete(self, pkey):
+ try:
+ logger.debug("Deleting pkey %s", pkey.uuid)
+ except AttributeError:
+ pass
with self.rpc(RPC_FUNC_PKEY_DELETE, pkey):
return
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-01 21:01:12 +0000
                                                       


                                                 
                                                                            











                                                      
                                                 














                                                    
#!/usr/bin/env python

"""
Somewhere, the HSM has to have a last-gasp default PIN, even if it's
only the null string, because there has to be **some** way to
initialize the poor thing.  Absent a better plan (feel free to
suggest one!), this last-gasp default is compiled in.

The normal value of this last-gasp PIN is deliberately chosen to be
annoying, so that people will change it, but since the derevation
requires running PBKDF2 and you might want a different default if
you're compiling this for yourself, we provide the script that
generates the default.
"""

# Author: Rob Austein
# Copyright (c) 2016, NORDUnet A/S
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
# - Redistributions of source code must retain the above copyright notice,
#   this list of conditions and the following disclaimer.
#
# - Redistributions in binary form must reproduce the above copyright
#   notice, this list of conditions and the following disclaimer in the
#   documentation and/or other materials provided with the distribution.
#
# - Neither the name of the NORDUnet nor the names of its contributors may
#   be used to endorse or promote products derived from this software
#   without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
# IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
# PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

from argparse                   import ArgumentParser, ArgumentDefaultsHelpFormatter
from os                         import urandom
from Crypto.Protocol.KDF        import PBKDF2
from Crypto.Hash                import SHA256, HMAC

parser = ArgumentParser(description = __doc__, formatter_class = ArgumentDefaultsHelpFormatter)
parser.add_argument("-p", "--pin",
                    default = "YouReallyNeedToChangeThisPINRightNowWeAreNotKidding",
                    help    = "PIN plaintext before PBKDF2 processing")
parser.add_argument("-i", "--iterations",
                    type    = int,
                    default = 1000,
                    help    = "PBKDF2 iteration count")
parser.add_argument("-d", "--derived-key-length",
                    type    = int,
                    default = 64,
                    help    = "length of PBKDF2 output (must match libhal)")
args = parser.parse_args()

def HMAC_SHA256(pin, salt):
    return HMAC.new(pin, salt, SHA256).digest()

def hexify(value):
    return ", ".join("0x%02x" % ord(v) for v in value)

salt = urandom(16)

pin  = PBKDF2(password = args.pin,
              salt     = salt,
              dkLen    = args.derived_key_length,
              count    = args.iterations,
              prf      = HMAC_SHA256)

print '''\
/*
 * Automatically generated by a script, do not edit.
 */

static const hal_ks_pin_t hal_last_gasp_pin = {{
  {iterations},
  {{{pin}}},
  {{{salt}}}
}};'''.format(iterations = args.iterations,
              pin        = hexify(pin),
              salt       = hexify(salt))