When statistic counters would overflow, keep them at the maximum possible
value. Wrapping to zero is the worst possible outcome for an auditing tool,
it silently under-reports activity.
If a counter saturated, then the pkcsstatd display indicates this with
"[saturated]" instead of the counter value.
While at it also make the reset operation to operate in an per counter
atomic way. Otherwise counter increments might get lost while a reset is
performed.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Uids are typically unsigned ints (uid_t), but the code handles them as
signed int, possibly dropping the upper half values.
Also correct the statistics SHM file iterating matching logic.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Limit the number of slot to NUMBER_SLOTS_MANAGED when calculating the
size of the statistics shared memory segment.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
In case C_InitPIN or C_SetPIN fails, a warning message is printed, but the
the return code is not passed back to main(), but CKR_OK, or the failure
of the subsequent C_Logout or C_CloseSession. So the exit code of pkcsconf
most likely won't indicate an error although it failed.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Slot numbers are from 0 up to the max number of slots supported.
A negative slot number indicates a failure of get_slot().
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
When getting the slot list and the mechanism list, check the number of
entries to not overflow when doing the calculation for the allocation size.
Also check if the allocation worked, and handle the situation if it failed.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
While the read logic ensures that the string read is at max 32 characters
plus a NUL byte, with or without '\n' at the end, the subsequent memcpy()
uses strlen() as length argument which is fragile. Use strnlen() with
size of the target buffer as the limiting value to ensure it will never
copy more bytes than the target buffer can hold.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Restrict the token name (tokname) and config name (confname) that is
specified in opencryptoki.conf to only contain certain characters.
They must not be '.' or '..', and must not contain '/'.
If the confname specified an absolute path, no restriction is applied.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Restrict the token name (tokname) and config name (confname) that is
specified in opencryptoki.conf to only contain certain characters.
They must not be '.' or '..', and must not contain '/'.
If the confname specified an absolute path, no restriction is applied.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
In case signal is received before the shared memory was attached, or after it
has been detached, shmp is NULL and dereferencing it causes a crash.
Ignore the signal if shmp is NULL and exit early.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Handle the case when flock fails. This can realistically never happen, but
it is still safer to handle the error.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
If *pProcRWSessions is greater than *pGlobalRWSessions, then this indicates
an inconsistency. Set *pGlobalRWSessions to zero instead of subtracting
*pProcRWSessions which causes an underflow.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Instead of copying each member separately, copy the entire struct at once.
This also fixes a bug where the string fields uses memcpy with strlen,
which does not copy the trailing NUL character. The target struct is
zeroed before, so there anyway is a NUL character, but that is subtle.
While at it remove the unused field shm_addr.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
When reading /proc/<pid>/stat the content is scanned for a closing bracket.
If no closing bracket is found strrchr() returns NULL and the subsequent
write causes a NULL pointer dereference.
Check for NULL and return an error.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The EVP_MD_CTX is not freed when any of the steps fail. Rework the code
to use a common cleanup label.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Assign apiSessp->slotID and apiSessp->rw_session before adding the new
session to the global session list. Doing so afterwards leaves a small
window where the new session is already added to the global session list,
but these fields are not yet assigned. This could affect closing all
sessions of slot 0, incorrectly closing the newly added session
because the slot ID is not yet set and thus 0.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Limit the possible PRF values to 63 or 31 (dependent on the architecture),
to avoid undefined behavior with too large shift amounts.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Very large config files can theoretically be larger than 65535 lines long.
This would cause the line number to wrap to low values. There is no good
reason to use a short int for the line number.
Also update several printf format string to match the new type.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Correct the indentation of some lines, and remove the semicolon after the braces.
No functional change.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Update the comment to add a missing excluded type. Remove duplicate
CT_STRINGVAL from mask. Add safety checks for key being NULL in
confignode_find() and confignode_findidx().
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
In case an empty config file is parsed for policy.conf or strength.conf
the version check might cause a NULL pointer dereference.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Parsing values might return invalid data in case of number format
or strdup errors. Add error checking.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The apqns parameter can not be NULL here. First, it was already used above, and
second getopt_long guarantees that options with required arguments have a
non-NULL argument.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Use a stricter prefix check when removing file that belong to the current
operation. Remove files which are named either exactly like the operation
ID, or like the ID followed by a dash. This prevents removing files who's
name start with the ID, but still do not belong to that operation.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
When hsm_mk_change_lock_create() fails to set permissions or the owner of the
just opened lock file, it closes the lock file, but does not set the file
descriptor to -1. This might cause subsequent calls from reusing the file
descriptor, which might now belong to another file.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
In case hsm_mk_change_mkvps_unflatten() succeeded, but did not read the
expected amount of bytes, free the mkvp array, not only clean it.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Using scandir and then removing the files on a full path basis is not
symlink-following safe. While the remove() as such only removes the link,
but not the target, the scandir() call might follow symlinks, if the
directory to scan is already a symlink.
Change this to use opendir_nofollow() with a readdir() loop and
unlinkat() operating relatively on the directory file handle.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Check the sizes before doing the calculations.
These checks are mostly relevant when building on 32 bit
architectures, the overflows can not happen on 64 bit
architectures. Silence compiler warnings about that
using diagnostic pragmas.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reset tokenCount to MAX_RECORDS on each iteration, to be able to receive a
full page of records, not only the amount of records that the last
iteration retrieved.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The ICSF token name is retrieved from LPAP, and could theoretically contain
characters like '..' or '/' that could cause the config file name to be
created outside of the config directory. The token name must not be '.' or
'..', and must not contain '/'.
Create relative names for the confname field in the config entry.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
If adding the token fails, don't add it to the configuration, but return an
error immediately. Also if adding to the configuration fails, don't just
continue but fail.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The RACF password can only up to PIN_SIZE -1 bytes (79 bytes). Issue
a user friendly error message if it is too long.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Setting the pointer parameter to NULL has no effect. Instead clear the
passed record in case no one was found.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
