diff options
Diffstat (limited to 'system/ipmitool/patches/0003-ipmitool-1.8.11-set-kg-key.patch')
| -rw-r--r-- | system/ipmitool/patches/0003-ipmitool-1.8.11-set-kg-key.patch | 240 |
1 files changed, 240 insertions, 0 deletions
diff --git a/system/ipmitool/patches/0003-ipmitool-1.8.11-set-kg-key.patch b/system/ipmitool/patches/0003-ipmitool-1.8.11-set-kg-key.patch new file mode 100644 index 0000000000..00a396e230 --- /dev/null +++ b/system/ipmitool/patches/0003-ipmitool-1.8.11-set-kg-key.patch @@ -0,0 +1,240 @@ +diff -urNp old/doc/ipmitool.1 new/doc/ipmitool.1 +--- old/doc/ipmitool.1 2017-02-06 10:20:02.254362909 +0100 ++++ new/doc/ipmitool.1 2017-02-06 10:33:41.729294474 +0100 +@@ -372,6 +372,20 @@ Configure user access information on the + + Displays the list of cipher suites supported for the given + application (ipmi or sol) on the given channel. ++.TP ++\fIsetkg\fP <\fIhex\fP|\fIplain\fP> <\fBkey\fP> [<\fBchannel\fR>] ++.br ++ ++Sets K_g key to given value. Use \fIplain\fP to specify \fBkey\fR as simple ASCII string. ++Use \fIhex\fP to specify \fBkey\fR as sequence of hexadecimal codes of ASCII charactes. ++I.e. following two examples are equivalent: ++ ++.RS ++ipmitool channel setkg plain PASSWORD ++ ++ipmitool channel setkg hex 50415353574F5244 ++.RE ++ + .RE + .RE + .TP +diff -urNp old/include/ipmitool/helper.h new/include/ipmitool/helper.h +--- old/include/ipmitool/helper.h 2017-02-06 10:20:02.254362909 +0100 ++++ new/include/ipmitool/helper.h 2017-02-06 10:40:07.336136844 +0100 +@@ -58,6 +58,8 @@ + # define IPMI_UID_MAX 63 + #endif + ++#define IPMI_KG_BUFFER_SIZE 21 /* key plus null byte */ ++ + struct ipmi_intf; + + struct valstr { +diff -urNp old/include/ipmitool/ipmi_channel.h new/include/ipmitool/ipmi_channel.h +--- old/include/ipmitool/ipmi_channel.h 2017-02-06 10:20:02.253316684 +0100 ++++ new/include/ipmitool/ipmi_channel.h 2017-02-06 10:58:15.291287621 +0100 +@@ -49,6 +49,10 @@ + #define IPMI_GET_USER_NAME 0x46 + #define IPMI_SET_USER_PASSWORD 0x47 + #define IPMI_GET_CHANNEL_CIPHER_SUITES 0x54 ++#define IPMI_SET_CHANNEL_SECURITY_KEYS 0x56 ++ ++#define IPMI_KG_KEY_ID 1 ++#define IPMI_SET_CHANNEL_SECURITY_KEYS_OP_SET 1 + + /* These are for channel_info_t.session_support */ + #define IPMI_CHANNEL_SESSION_LESS 0x00 +@@ -137,6 +141,40 @@ int _ipmi_set_channel_access(struct ipmi + struct channel_access_t channel_access, uint8_t access_option, + uint8_t privilege_option); + ++struct set_channel_security_keys_req { ++#if WORDS_BIGENDIAN ++ uint8_t __reserved1 :4; ++ uint8_t channel :4; ++ ++ uint8_t __reserved2 :6; ++ uint8_t operation :2; ++ ++ uint8_t key_id; ++ unsigned char key_value[IPMI_KG_BUFFER_SIZE-1]; /* we don't want space for '\0' at the end */ ++#else ++ uint8_t channel :4; ++ uint8_t __reserved1 :4; ++ ++ uint8_t operation :2; ++ uint8_t __reserved2 :6; ++ ++ uint8_t key_id; ++ unsigned char key_value[IPMI_KG_BUFFER_SIZE-1]; /* we don't want space for '\0' at the end */ ++#endif ++} __attribute__ ((packed)); ++ ++struct set_channel_security_keys_rsp { ++#if WORDS_BIGENDIAN ++ uint8_t __reserved1 :6; ++ uint8_t lock_status :2; ++ unsigned char key_value; /* just the first character, use &key_value to explore the rest */ ++#else ++ uint8_t lock_status :2; ++ uint8_t __reserved1 :6; ++ unsigned char key_value; /* just the first character, use &key_value to explore the rest */ ++#endif ++} __attribute__ ((packed)); ++ + uint8_t ipmi_get_channel_medium(struct ipmi_intf * intf, uint8_t channel); + uint8_t ipmi_current_channel_medium(struct ipmi_intf * intf); + int ipmi_channel_main(struct ipmi_intf * intf, int argc, char ** argv); +diff -urNp old/include/ipmitool/ipmi_intf.h new/include/ipmitool/ipmi_intf.h +--- old/include/ipmitool/ipmi_intf.h 2017-02-06 10:20:02.254362909 +0100 ++++ new/include/ipmitool/ipmi_intf.h 2017-02-06 10:40:40.264577602 +0100 +@@ -60,7 +60,6 @@ enum LANPLUS_SESSION_STATE { + + #define IPMI_AUTHCODE_BUFFER_SIZE 20 + #define IPMI_SIK_BUFFER_SIZE IPMI_MAX_MD_SIZE +-#define IPMI_KG_BUFFER_SIZE 21 /* key plus null byte */ + + struct ipmi_session_params { + char * hostname; +diff -urNp old/lib/ipmi_channel.c new/lib/ipmi_channel.c +--- old/lib/ipmi_channel.c 2017-02-06 10:20:02.255409134 +0100 ++++ new/lib/ipmi_channel.c 2017-02-06 12:32:14.222282317 +0100 +@@ -821,6 +821,92 @@ ipmi_set_user_access(struct ipmi_intf *i + return 0; + } + ++int ++ipmi_set_channel_security_keys (struct ipmi_intf *intf, uint8_t channel, const char *method, const char *key) ++{ ++ uint8_t kgkey[IPMI_KG_BUFFER_SIZE]; ++ struct ipmi_rs *rsp; ++ struct ipmi_rq req; ++ struct set_channel_security_keys_req req_data; ++ int rc = -1; ++ ++ /* convert provided key to array of bytes */ ++ if (strcmp(method, "hex") == 0) { ++ if (strlen(key) > (IPMI_KG_BUFFER_SIZE-1)*2) { ++ lprintf(LOG_ERR, "Provided key is too long, max. length is %d bytes", (IPMI_KG_BUFFER_SIZE-1)); ++ printf_channel_usage(); ++ return -1; ++ } ++ ++ rc = ipmi_parse_hex(key, kgkey, sizeof(kgkey)-1); ++ if (rc == -1) { ++ lprintf(LOG_ERR, "Number of Kg key characters is not even"); ++ return rc; ++ } else if (rc == -3) { ++ lprintf(LOG_ERR, "Kg key is not hexadecimal number"); ++ return rc; ++ } else if (rc > (IPMI_KG_BUFFER_SIZE-1)) { ++ lprintf(LOG_ERR, "Kg key is too long"); ++ return rc; ++ } ++ ++ } else if (strcmp(method, "plain") == 0) { ++ if (strlen(key) > IPMI_KG_BUFFER_SIZE-1) { ++ lprintf(LOG_ERR, "Provided key is too long, max. length is %d bytes", (IPMI_KG_BUFFER_SIZE -1)); ++ printf_channel_usage(); ++ return rc; ++ } ++ ++ strncpy(kgkey, key, IPMI_KG_BUFFER_SIZE-1); ++ } else { ++ printf_channel_usage(); ++ return rc; ++ } ++ ++ /* assemble and send request to set kg key */ ++ memset(&req_data, 0, sizeof(req_data)); ++ req_data.channel = channel; ++ req_data.operation = IPMI_SET_CHANNEL_SECURITY_KEYS_OP_SET; ++ req_data.key_id = IPMI_KG_KEY_ID; ++ memcpy(req_data.key_value, kgkey, IPMI_KG_BUFFER_SIZE-1); ++ ++ memset(&req, 0, sizeof(req)); ++ req.msg.netfn = IPMI_NETFN_APP; ++ req.msg.cmd = IPMI_SET_CHANNEL_SECURITY_KEYS; ++ req.msg.data = (uint8_t*) &req_data; ++ req.msg.data_len = sizeof(req_data); ++ ++ rsp = intf->sendrecv(intf, &req); ++ if (rsp == NULL) { ++ lprintf(LOG_ERR, "Set Channel Security Keys command failed"); ++ return rc; ++ } ++ if (rsp->ccode > 0) { ++ const char *error = NULL; ++ switch (rsp->ccode) { ++ case 0x80: ++ error = "Key is locked"; ++ break; ++ case 0x81: ++ error = "Insufficient key bytes"; ++ break; ++ case 0x82: ++ error = "Too many key bytes"; ++ break; ++ case 0x83: ++ error = "Key value does not meet criteria for K_g key"; ++ break; ++ default: ++ error = val2str(rsp->ccode, completion_code_vals); ++ } ++ lprintf(LOG_ERR, "Error setting security key: %X (%s)", rsp->ccode, error); ++ return rc; ++ } ++ ++ lprintf(LOG_NOTICE, "Set Channel Security Keys command succeeded"); ++ return 0; ++} ++ + int + ipmi_channel_main(struct ipmi_intf *intf, int argc, char **argv) + { +@@ -890,6 +976,19 @@ ipmi_channel_main(struct ipmi_intf *intf + retval = ipmi_get_channel_cipher_suites(intf, + argv[1], /* ipmi | sol */ + channel); ++ } else if (strncmp(argv[0], "setkg", 5) == 0) { ++ if (argc < 3 || argc > 4) ++ printf_channel_usage(); ++ else { ++ uint8_t ch = 0xe; ++ char *method = argv[1]; ++ char *key = argv[2]; ++ if (argc == 4) { ++ ch = (uint8_t)strtol(argv[3], NULL, 0); ++ } ++ ++ retval = ipmi_set_channel_security_keys(intf, ch, method, key); ++ } + } else { + lprintf(LOG_ERR, "Invalid CHANNEL command: %s\n", argv[0]); + printf_channel_usage(); +@@ -916,6 +1015,10 @@ printf_channel_usage() + lprintf(LOG_NOTICE, + ""); + lprintf(LOG_NOTICE, ++" setkg hex|plain <key> [channel]"); ++ lprintf(LOG_NOTICE, ++""); ++ lprintf(LOG_NOTICE, + "Possible privilege levels are:"); + lprintf(LOG_NOTICE, + " 1 Callback level"); +diff -urNp old/src/plugins/ipmi_intf.c new/src/plugins/ipmi_intf.c +--- old/src/plugins/ipmi_intf.c 2017-02-06 10:20:02.257501584 +0100 ++++ new/src/plugins/ipmi_intf.c 2017-02-06 10:42:12.585257810 +0100 +@@ -55,6 +55,7 @@ + #include <ipmitool/ipmi.h> + #include <ipmitool/ipmi_sdr.h> + #include <ipmitool/log.h> ++#include <ipmitool/helper.h> + + #define IPMI_DEFAULT_PAYLOAD_SIZE 25 + |