diff options
Diffstat (limited to 'projects/hsm')
| -rw-r--r-- | projects/hsm/Makefile | 1 | ||||
| -rw-r--r-- | projects/hsm/mgmt-cli.c | 2 | ||||
| -rw-r--r-- | projects/hsm/mgmt-keywrap.c | 164 | ||||
| -rw-r--r-- | projects/hsm/mgmt-keywrap.h | 42 | ||||
| -rw-r--r-- | projects/hsm/mgmt-masterkey.c | 6 | ||||
| -rw-r--r-- | projects/hsm/mgmt-misc.c | 31 |
6 files changed, 215 insertions, 31 deletions
diff --git a/projects/hsm/Makefile b/projects/hsm/Makefile index 37c552d..0bd7930 100644 --- a/projects/hsm/Makefile +++ b/projects/hsm/Makefile @@ -9,6 +9,7 @@ OBJS = mgmt-cli.o \ mgmt-masterkey.o \ mgmt-misc.o \ mgmt-task.o \ + mgmt-keywrap.o \ log.o \ $(TOPLEVEL)/task.o diff --git a/projects/hsm/mgmt-cli.c b/projects/hsm/mgmt-cli.c index 2b5be1f..83e30b0 100644 --- a/projects/hsm/mgmt-cli.c +++ b/projects/hsm/mgmt-cli.c @@ -49,6 +49,7 @@ #include "mgmt-keystore.h" #include "mgmt-masterkey.h" #include "mgmt-task.h" +#include "mgmt-keywrap.h" #undef HAL_OK #define HAL_OK LIBHAL_OK @@ -197,6 +198,7 @@ int cli_main(void) configure_cli_bootloader(cli); configure_cli_misc(cli); configure_cli_task(cli); + configure_cli_keywrap(cli); while (1) { control_mgmt_uart_dma_rx(DMA_RX_START); diff --git a/projects/hsm/mgmt-keywrap.c b/projects/hsm/mgmt-keywrap.c new file mode 100644 index 0000000..23763fd --- /dev/null +++ b/projects/hsm/mgmt-keywrap.c @@ -0,0 +1,164 @@ +/* + * mgmt-keywrap.c + * -------------- + * CLI functions to manage the keywrap core + * + * Copyright (c) 2019, NORDUnet A/S All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are + * met: + * - Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither the name of the NORDUnet nor the names of its contributors may + * be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS + * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#define HAL_OK CMSIS_HAL_OK +#include "stm-init.h" +#include "mgmt-cli.h" +#include "mgmt-keywrap.h" +#undef HAL_OK + +#define HAL_OK LIBHAL_OK +#include "hal.h" +#include "hal_internal.h" +#undef HAL_OK + +#include <stdlib.h> +#include <string.h> + +static int cmd_keywrap_core(struct cli_def *cli, const char *command, char *argv[], int argc) +{ + if (argc == 1) { + int onoff = -1; + if (strcmp(argv[0], "on") == 0) + onoff = 1; + else if (strcmp(argv[0], "off") == 0) + onoff = 0; + if (onoff >= 0) { + int ret = hal_aes_use_keywrap_core(onoff); + if (ret) + cli_print(cli, "keywrap core enabled"); + else if (onoff) + cli_print(cli, "keywrap core not found"); + else + cli_print(cli, "keywrap core disabled"); + return CLI_OK; + } + } + + cli_print(cli, "Syntax: %s <on|off>", command); + return CLI_ERROR; +} + +static int cmd_keywrap_stats_show(struct cli_def *cli, const char *command, char *argv[], int argc) +{ + command = command; + argv = argv; + argc = argc; + + unsigned load, skip; + hal_error_t err; + + if ((err = hal_aes_keywrap_get_stats(&load, &skip)) != LIBHAL_OK) { + cli_print(cli, "Error getting stats: %s", hal_error_string(err)); + return CLI_ERROR; + } + + cli_print(cli, "loaded %u, skipped %u", load, skip); + + return CLI_OK; +} + +static int cmd_keywrap_stats_reset(struct cli_def *cli, const char *command, char *argv[], int argc) +{ + cli = cli; + command = command; + argv = argv; + argc = argc; + + hal_aes_keywrap_reset_stats(); + + return CLI_OK; +} + +static int cmd_keywrap_zero(struct cli_def *cli, const char *command, char *argv[], int argc) +{ + command = command; + argv = argv; + argc = argc; + + hal_error_t err; + + if ((err = hal_aes_keywrap_zero(NULL)) != LIBHAL_OK) { + cli_print(cli, "Error zeroing KEK: %s", hal_error_string(err)); + return CLI_ERROR; + } + + return CLI_OK; +} + +static int cmd_keywrap_timeout(struct cli_def *cli, const char *command, char *argv[], int argc) +{ + if (argc != 1) { + errout: + cli_print(cli, "Syntax: %s <cycle count>", command); + return CLI_ERROR; + } + + char *endptr; + unsigned long n = strtoul(argv[0], &endptr, 0); + if (n == 0 && endptr == argv[0]) + /* no valid digits */ + goto errout; + + hal_error_t err; + + if ((err = hal_aes_keywrap_set_timeout(NULL, n)) != LIBHAL_OK) { + cli_print(cli, "Error setting KEK timeout: %s", hal_error_string(err)); + return CLI_ERROR; + } + + return CLI_OK; +} + +void configure_cli_keywrap(struct cli_def *cli) +{ + struct cli_command *c_keywrap = cli_register_command(cli, NULL, "keywrap", NULL, 0, 0, NULL); + + /* keywrap core */ + cli_register_command(cli, c_keywrap, "core", cmd_keywrap_core, 0, 0, "Toggle use of the keywrap core"); + + struct cli_command *c_stats = cli_register_command(cli, c_keywrap, "stats", NULL, 0, 0, NULL); + + /* keywrap stats show */ + cli_register_command(cli, c_stats, "show", cmd_keywrap_stats_show, 0, 0, "Show the keywrap KEK stats"); + + /* keywrap stats reset */ + cli_register_command(cli, c_stats, "reset", cmd_keywrap_stats_reset, 0, 0, "Reset the keywrap KEK stats"); + + /* keywrap zero */ + cli_register_command(cli, c_keywrap, "zero", cmd_keywrap_zero, 0, 0, "Zero the KEK in the keywrap core"); + + /* keywrap timeout */ + cli_register_command(cli, c_keywrap, "timeout", cmd_keywrap_timeout, 0, 0, "Set the KEK timeout in the keywrap core"); +} diff --git a/projects/hsm/mgmt-keywrap.h b/projects/hsm/mgmt-keywrap.h new file mode 100644 index 0000000..5426de3 --- /dev/null +++ b/projects/hsm/mgmt-keywrap.h @@ -0,0 +1,42 @@ +/* + * mgmt-keywrap.h + * -------------- + * CLI functions to manage the keywrap core + * + * Copyright (c) 2019, NORDUnet A/S All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are + * met: + * - Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither the name of the NORDUnet nor the names of its contributors may + * be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS + * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#ifndef __STM32_CLI_MGMT_KEYWRAP_H +#define __STM32_CLI_MGMT_KEYWRAP_H + +#include <libcli.h> + +extern void configure_cli_keywrap(struct cli_def *cli); + +#endif /* __STM32_CLI_MGMT_KEYWRAP_H */ diff --git a/projects/hsm/mgmt-masterkey.c b/projects/hsm/mgmt-masterkey.c index e63e0e0..d89e5ea 100644 --- a/projects/hsm/mgmt-masterkey.c +++ b/projects/hsm/mgmt-masterkey.c @@ -167,6 +167,12 @@ static int _masterkey_set(struct cli_def *cli, char *argv[], int argc, } else { cli_print(cli, "Failed writing key to %s memory: %s", label, hal_error_string(err)); } + + if ((err = hal_aes_keywrap_zero(NULL)) != LIBHAL_OK) { + cli_print(cli, "Error zeroing keywrap core: %s", hal_error_string(err)); + return CLI_ERROR; + } + return CLI_OK; } diff --git a/projects/hsm/mgmt-misc.c b/projects/hsm/mgmt-misc.c index 72ee1f2..86f1be8 100644 --- a/projects/hsm/mgmt-misc.c +++ b/projects/hsm/mgmt-misc.c @@ -155,39 +155,8 @@ static int cmd_reboot(struct cli_def *cli, const char *command, char *argv[], in return CLI_OK; } -static int cmd_keywrap_core(struct cli_def *cli, const char *command, char *argv[], int argc) -{ - command = command; - - if (argc == 1) { - int onoff = -1; - if (strcmp(argv[0], "on") == 0) - onoff = 1; - else if (strcmp(argv[0], "off") == 0) - onoff = 0; - if (onoff >= 0) { - int ret = hal_aes_use_keywrap_core(onoff); - if (ret) - cli_print(cli, "keywrap core enabled"); - else if (onoff) - cli_print(cli, "keywrap core not found"); - else - cli_print(cli, "keywrap core disabled"); - return CLI_OK; - } - } - - cli_print(cli, "Syntax: keywrap core <on|off>"); - return CLI_ERROR; -} - void configure_cli_misc(struct cli_def *cli) { - struct cli_command *c_keywrap = cli_register_command(cli, NULL, "keywrap", NULL, 0, 0, NULL); - - /* keywrap core */ - cli_register_command(cli, c_keywrap, "core", cmd_keywrap_core, 0, 0, "Toggle use of the keywrap core"); - #ifdef DO_PROFILING struct cli_command *c_profile = cli_register_command(cli, NULL, "profile", NULL, 0, 0, NULL); |