You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
240 lines
7.5 KiB
240 lines
7.5 KiB
diff -urNp old/doc/ipmitool.1 new/doc/ipmitool.1 |
|
--- old/doc/ipmitool.1 2017-02-06 10:20:02.254362909 +0100 |
|
+++ new/doc/ipmitool.1 2017-02-06 10:33:41.729294474 +0100 |
|
@@ -372,6 +372,20 @@ Configure user access information on the |
|
|
|
Displays the list of cipher suites supported for the given |
|
application (ipmi or sol) on the given channel. |
|
+.TP |
|
+\fIsetkg\fP <\fIhex\fP|\fIplain\fP> <\fBkey\fP> [<\fBchannel\fR>] |
|
+.br |
|
+ |
|
+Sets K_g key to given value. Use \fIplain\fP to specify \fBkey\fR as simple ASCII string. |
|
+Use \fIhex\fP to specify \fBkey\fR as sequence of hexadecimal codes of ASCII charactes. |
|
+I.e. following two examples are equivalent: |
|
+ |
|
+.RS |
|
+ipmitool channel setkg plain PASSWORD |
|
+ |
|
+ipmitool channel setkg hex 50415353574F5244 |
|
+.RE |
|
+ |
|
.RE |
|
.RE |
|
.TP |
|
diff -urNp old/include/ipmitool/helper.h new/include/ipmitool/helper.h |
|
--- old/include/ipmitool/helper.h 2017-02-06 10:20:02.254362909 +0100 |
|
+++ new/include/ipmitool/helper.h 2017-02-06 10:40:07.336136844 +0100 |
|
@@ -58,6 +58,8 @@ |
|
# define IPMI_UID_MAX 63 |
|
#endif |
|
|
|
+#define IPMI_KG_BUFFER_SIZE 21 /* key plus null byte */ |
|
+ |
|
struct ipmi_intf; |
|
|
|
struct valstr { |
|
diff -urNp old/include/ipmitool/ipmi_channel.h new/include/ipmitool/ipmi_channel.h |
|
--- old/include/ipmitool/ipmi_channel.h 2017-02-06 10:20:02.253316684 +0100 |
|
+++ new/include/ipmitool/ipmi_channel.h 2017-02-06 10:58:15.291287621 +0100 |
|
@@ -49,6 +49,10 @@ |
|
#define IPMI_GET_USER_NAME 0x46 |
|
#define IPMI_SET_USER_PASSWORD 0x47 |
|
#define IPMI_GET_CHANNEL_CIPHER_SUITES 0x54 |
|
+#define IPMI_SET_CHANNEL_SECURITY_KEYS 0x56 |
|
+ |
|
+#define IPMI_KG_KEY_ID 1 |
|
+#define IPMI_SET_CHANNEL_SECURITY_KEYS_OP_SET 1 |
|
|
|
/* These are for channel_info_t.session_support */ |
|
#define IPMI_CHANNEL_SESSION_LESS 0x00 |
|
@@ -137,6 +141,40 @@ int _ipmi_set_channel_access(struct ipmi |
|
struct channel_access_t channel_access, uint8_t access_option, |
|
uint8_t privilege_option); |
|
|
|
+struct set_channel_security_keys_req { |
|
+#if WORDS_BIGENDIAN |
|
+ uint8_t __reserved1 :4; |
|
+ uint8_t channel :4; |
|
+ |
|
+ uint8_t __reserved2 :6; |
|
+ uint8_t operation :2; |
|
+ |
|
+ uint8_t key_id; |
|
+ unsigned char key_value[IPMI_KG_BUFFER_SIZE-1]; /* we don't want space for '\0' at the end */ |
|
+#else |
|
+ uint8_t channel :4; |
|
+ uint8_t __reserved1 :4; |
|
+ |
|
+ uint8_t operation :2; |
|
+ uint8_t __reserved2 :6; |
|
+ |
|
+ uint8_t key_id; |
|
+ unsigned char key_value[IPMI_KG_BUFFER_SIZE-1]; /* we don't want space for '\0' at the end */ |
|
+#endif |
|
+} __attribute__ ((packed)); |
|
+ |
|
+struct set_channel_security_keys_rsp { |
|
+#if WORDS_BIGENDIAN |
|
+ uint8_t __reserved1 :6; |
|
+ uint8_t lock_status :2; |
|
+ unsigned char key_value; /* just the first character, use &key_value to explore the rest */ |
|
+#else |
|
+ uint8_t lock_status :2; |
|
+ uint8_t __reserved1 :6; |
|
+ unsigned char key_value; /* just the first character, use &key_value to explore the rest */ |
|
+#endif |
|
+} __attribute__ ((packed)); |
|
+ |
|
uint8_t ipmi_get_channel_medium(struct ipmi_intf * intf, uint8_t channel); |
|
uint8_t ipmi_current_channel_medium(struct ipmi_intf * intf); |
|
int ipmi_channel_main(struct ipmi_intf * intf, int argc, char ** argv); |
|
diff -urNp old/include/ipmitool/ipmi_intf.h new/include/ipmitool/ipmi_intf.h |
|
--- old/include/ipmitool/ipmi_intf.h 2017-02-06 10:20:02.254362909 +0100 |
|
+++ new/include/ipmitool/ipmi_intf.h 2017-02-06 10:40:40.264577602 +0100 |
|
@@ -60,7 +60,6 @@ enum LANPLUS_SESSION_STATE { |
|
|
|
#define IPMI_AUTHCODE_BUFFER_SIZE 20 |
|
#define IPMI_SIK_BUFFER_SIZE IPMI_MAX_MD_SIZE |
|
-#define IPMI_KG_BUFFER_SIZE 21 /* key plus null byte */ |
|
|
|
struct ipmi_session_params { |
|
char * hostname; |
|
diff -urNp old/lib/ipmi_channel.c new/lib/ipmi_channel.c |
|
--- old/lib/ipmi_channel.c 2017-02-06 10:20:02.255409134 +0100 |
|
+++ new/lib/ipmi_channel.c 2017-02-06 12:32:14.222282317 +0100 |
|
@@ -821,6 +821,92 @@ ipmi_set_user_access(struct ipmi_intf *i |
|
return 0; |
|
} |
|
|
|
+int |
|
+ipmi_set_channel_security_keys (struct ipmi_intf *intf, uint8_t channel, const char *method, const char *key) |
|
+{ |
|
+ uint8_t kgkey[IPMI_KG_BUFFER_SIZE]; |
|
+ struct ipmi_rs *rsp; |
|
+ struct ipmi_rq req; |
|
+ struct set_channel_security_keys_req req_data; |
|
+ int rc = -1; |
|
+ |
|
+ /* convert provided key to array of bytes */ |
|
+ if (strcmp(method, "hex") == 0) { |
|
+ if (strlen(key) > (IPMI_KG_BUFFER_SIZE-1)*2) { |
|
+ lprintf(LOG_ERR, "Provided key is too long, max. length is %d bytes", (IPMI_KG_BUFFER_SIZE-1)); |
|
+ printf_channel_usage(); |
|
+ return -1; |
|
+ } |
|
+ |
|
+ rc = ipmi_parse_hex(key, kgkey, sizeof(kgkey)-1); |
|
+ if (rc == -1) { |
|
+ lprintf(LOG_ERR, "Number of Kg key characters is not even"); |
|
+ return rc; |
|
+ } else if (rc == -3) { |
|
+ lprintf(LOG_ERR, "Kg key is not hexadecimal number"); |
|
+ return rc; |
|
+ } else if (rc > (IPMI_KG_BUFFER_SIZE-1)) { |
|
+ lprintf(LOG_ERR, "Kg key is too long"); |
|
+ return rc; |
|
+ } |
|
+ |
|
+ } else if (strcmp(method, "plain") == 0) { |
|
+ if (strlen(key) > IPMI_KG_BUFFER_SIZE-1) { |
|
+ lprintf(LOG_ERR, "Provided key is too long, max. length is %d bytes", (IPMI_KG_BUFFER_SIZE -1)); |
|
+ printf_channel_usage(); |
|
+ return rc; |
|
+ } |
|
+ |
|
+ strncpy(kgkey, key, IPMI_KG_BUFFER_SIZE-1); |
|
+ } else { |
|
+ printf_channel_usage(); |
|
+ return rc; |
|
+ } |
|
+ |
|
+ /* assemble and send request to set kg key */ |
|
+ memset(&req_data, 0, sizeof(req_data)); |
|
+ req_data.channel = channel; |
|
+ req_data.operation = IPMI_SET_CHANNEL_SECURITY_KEYS_OP_SET; |
|
+ req_data.key_id = IPMI_KG_KEY_ID; |
|
+ memcpy(req_data.key_value, kgkey, IPMI_KG_BUFFER_SIZE-1); |
|
+ |
|
+ memset(&req, 0, sizeof(req)); |
|
+ req.msg.netfn = IPMI_NETFN_APP; |
|
+ req.msg.cmd = IPMI_SET_CHANNEL_SECURITY_KEYS; |
|
+ req.msg.data = (uint8_t*) &req_data; |
|
+ req.msg.data_len = sizeof(req_data); |
|
+ |
|
+ rsp = intf->sendrecv(intf, &req); |
|
+ if (rsp == NULL) { |
|
+ lprintf(LOG_ERR, "Set Channel Security Keys command failed"); |
|
+ return rc; |
|
+ } |
|
+ if (rsp->ccode > 0) { |
|
+ const char *error = NULL; |
|
+ switch (rsp->ccode) { |
|
+ case 0x80: |
|
+ error = "Key is locked"; |
|
+ break; |
|
+ case 0x81: |
|
+ error = "Insufficient key bytes"; |
|
+ break; |
|
+ case 0x82: |
|
+ error = "Too many key bytes"; |
|
+ break; |
|
+ case 0x83: |
|
+ error = "Key value does not meet criteria for K_g key"; |
|
+ break; |
|
+ default: |
|
+ error = val2str(rsp->ccode, completion_code_vals); |
|
+ } |
|
+ lprintf(LOG_ERR, "Error setting security key: %X (%s)", rsp->ccode, error); |
|
+ return rc; |
|
+ } |
|
+ |
|
+ lprintf(LOG_NOTICE, "Set Channel Security Keys command succeeded"); |
|
+ return 0; |
|
+} |
|
+ |
|
int |
|
ipmi_channel_main(struct ipmi_intf *intf, int argc, char **argv) |
|
{ |
|
@@ -890,6 +976,19 @@ ipmi_channel_main(struct ipmi_intf *intf |
|
retval = ipmi_get_channel_cipher_suites(intf, |
|
argv[1], /* ipmi | sol */ |
|
channel); |
|
+ } else if (strncmp(argv[0], "setkg", 5) == 0) { |
|
+ if (argc < 3 || argc > 4) |
|
+ printf_channel_usage(); |
|
+ else { |
|
+ uint8_t ch = 0xe; |
|
+ char *method = argv[1]; |
|
+ char *key = argv[2]; |
|
+ if (argc == 4) { |
|
+ ch = (uint8_t)strtol(argv[3], NULL, 0); |
|
+ } |
|
+ |
|
+ retval = ipmi_set_channel_security_keys(intf, ch, method, key); |
|
+ } |
|
} else { |
|
lprintf(LOG_ERR, "Invalid CHANNEL command: %s\n", argv[0]); |
|
printf_channel_usage(); |
|
@@ -916,6 +1015,10 @@ printf_channel_usage() |
|
lprintf(LOG_NOTICE, |
|
""); |
|
lprintf(LOG_NOTICE, |
|
+" setkg hex|plain <key> [channel]"); |
|
+ lprintf(LOG_NOTICE, |
|
+""); |
|
+ lprintf(LOG_NOTICE, |
|
"Possible privilege levels are:"); |
|
lprintf(LOG_NOTICE, |
|
" 1 Callback level"); |
|
diff -urNp old/src/plugins/ipmi_intf.c new/src/plugins/ipmi_intf.c |
|
--- old/src/plugins/ipmi_intf.c 2017-02-06 10:20:02.257501584 +0100 |
|
+++ new/src/plugins/ipmi_intf.c 2017-02-06 10:42:12.585257810 +0100 |
|
@@ -55,6 +55,7 @@ |
|
#include <ipmitool/ipmi.h> |
|
#include <ipmitool/ipmi_sdr.h> |
|
#include <ipmitool/log.h> |
|
+#include <ipmitool/helper.h> |
|
|
|
#define IPMI_DEFAULT_PAYLOAD_SIZE 25 |
|
|
|
|