From 614ebd7f4c808b475c7df2a8da2417265e793b98 Mon Sep 17 00:00:00 2001 From: Paul Selkirk Date: Tue, 12 Feb 2019 16:24:42 -0500 Subject: Add CLI functions to manage the keywrap core, with new auto-zeroise functionality. --- projects/hsm/mgmt-keywrap.c | 164 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 164 insertions(+) create mode 100644 projects/hsm/mgmt-keywrap.c (limited to 'projects/hsm/mgmt-keywrap.c') diff --git a/projects/hsm/mgmt-keywrap.c b/projects/hsm/mgmt-keywrap.c new file mode 100644 index 0000000..23763fd --- /dev/null +++ b/projects/hsm/mgmt-keywrap.c @@ -0,0 +1,164 @@ +/* + * mgmt-keywrap.c + * -------------- + * CLI functions to manage the keywrap core + * + * Copyright (c) 2019, NORDUnet A/S All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are + * met: + * - Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither the name of the NORDUnet nor the names of its contributors may + * be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS + * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#define HAL_OK CMSIS_HAL_OK +#include "stm-init.h" +#include "mgmt-cli.h" +#include "mgmt-keywrap.h" +#undef HAL_OK + +#define HAL_OK LIBHAL_OK +#include "hal.h" +#include "hal_internal.h" +#undef HAL_OK + +#include +#include + +static int cmd_keywrap_core(struct cli_def *cli, const char *command, char *argv[], int argc) +{ + if (argc == 1) { + int onoff = -1; + if (strcmp(argv[0], "on") == 0) + onoff = 1; + else if (strcmp(argv[0], "off") == 0) + onoff = 0; + if (onoff >= 0) { + int ret = hal_aes_use_keywrap_core(onoff); + if (ret) + cli_print(cli, "keywrap core enabled"); + else if (onoff) + cli_print(cli, "keywrap core not found"); + else + cli_print(cli, "keywrap core disabled"); + return CLI_OK; + } + } + + cli_print(cli, "Syntax: %s ", command); + return CLI_ERROR; +} + +static int cmd_keywrap_stats_show(struct cli_def *cli, const char *command, char *argv[], int argc) +{ + command = command; + argv = argv; + argc = argc; + + unsigned load, skip; + hal_error_t err; + + if ((err = hal_aes_keywrap_get_stats(&load, &skip)) != LIBHAL_OK) { + cli_print(cli, "Error getting stats: %s", hal_error_string(err)); + return CLI_ERROR; + } + + cli_print(cli, "loaded %u, skipped %u", load, skip); + + return CLI_OK; +} + +static int cmd_keywrap_stats_reset(struct cli_def *cli, const char *command, char *argv[], int argc) +{ + cli = cli; + command = command; + argv = argv; + argc = argc; + + hal_aes_keywrap_reset_stats(); + + return CLI_OK; +} + +static int cmd_keywrap_zero(struct cli_def *cli, const char *command, char *argv[], int argc) +{ + command = command; + argv = argv; + argc = argc; + + hal_error_t err; + + if ((err = hal_aes_keywrap_zero(NULL)) != LIBHAL_OK) { + cli_print(cli, "Error zeroing KEK: %s", hal_error_string(err)); + return CLI_ERROR; + } + + return CLI_OK; +} + +static int cmd_keywrap_timeout(struct cli_def *cli, const char *command, char *argv[], int argc) +{ + if (argc != 1) { + errout: + cli_print(cli, "Syntax: %s ", command); + return CLI_ERROR; + } + + char *endptr; + unsigned long n = strtoul(argv[0], &endptr, 0); + if (n == 0 && endptr == argv[0]) + /* no valid digits */ + goto errout; + + hal_error_t err; + + if ((err = hal_aes_keywrap_set_timeout(NULL, n)) != LIBHAL_OK) { + cli_print(cli, "Error setting KEK timeout: %s", hal_error_string(err)); + return CLI_ERROR; + } + + return CLI_OK; +} + +void configure_cli_keywrap(struct cli_def *cli) +{ + struct cli_command *c_keywrap = cli_register_command(cli, NULL, "keywrap", NULL, 0, 0, NULL); + + /* keywrap core */ + cli_register_command(cli, c_keywrap, "core", cmd_keywrap_core, 0, 0, "Toggle use of the keywrap core"); + + struct cli_command *c_stats = cli_register_command(cli, c_keywrap, "stats", NULL, 0, 0, NULL); + + /* keywrap stats show */ + cli_register_command(cli, c_stats, "show", cmd_keywrap_stats_show, 0, 0, "Show the keywrap KEK stats"); + + /* keywrap stats reset */ + cli_register_command(cli, c_stats, "reset", cmd_keywrap_stats_reset, 0, 0, "Reset the keywrap KEK stats"); + + /* keywrap zero */ + cli_register_command(cli, c_keywrap, "zero", cmd_keywrap_zero, 0, 0, "Zero the KEK in the keywrap core"); + + /* keywrap timeout */ + cli_register_command(cli, c_keywrap, "timeout", cmd_keywrap_timeout, 0, 0, "Set the KEK timeout in the keywrap core"); +} -- cgit v1.2.3