ipmitool/SOURCES/0003-ipmitool-1.8.11-set-kg-key.patch

diff -urNp old/doc/ipmitool.1 new/doc/ipmitool.1
--- old/doc/ipmitool.1	2017-02-06 10:20:02.254362909 +0100
+++ new/doc/ipmitool.1	2017-02-06 10:33:41.729294474 +0100
@@ -372,6 +372,20 @@ Configure user access information on the
 
 Displays the list of cipher suites supported for the given
 application (ipmi or sol) on the given channel.
+.TP
+\fIsetkg\fP <\fIhex\fP|\fIplain\fP> <\fBkey\fP> [<\fBchannel\fR>]
+.br
+
+Sets K_g key to given value. Use \fIplain\fP to specify \fBkey\fR as simple ASCII string.
+Use \fIhex\fP to specify \fBkey\fR as sequence of hexadecimal codes of ASCII charactes.
+I.e. following two examples are equivalent:
+
+.RS
+ipmitool channel setkg plain PASSWORD
+
+ipmitool channel setkg hex 50415353574F5244
+.RE
+
 .RE
 .RE
 .TP 
diff -urNp old/include/ipmitool/helper.h new/include/ipmitool/helper.h
--- old/include/ipmitool/helper.h	2017-02-06 10:20:02.254362909 +0100
+++ new/include/ipmitool/helper.h	2017-02-06 10:40:07.336136844 +0100
@@ -58,6 +58,8 @@
 # define IPMI_UID_MAX 63
 #endif
 
+#define IPMI_KG_BUFFER_SIZE       21 /* key plus null byte */
+
 struct ipmi_intf;
 
 struct valstr {
diff -urNp old/include/ipmitool/ipmi_channel.h new/include/ipmitool/ipmi_channel.h
--- old/include/ipmitool/ipmi_channel.h	2017-02-06 10:20:02.253316684 +0100
+++ new/include/ipmitool/ipmi_channel.h	2017-02-06 10:58:15.291287621 +0100
@@ -49,6 +49,10 @@
 #define IPMI_GET_USER_NAME             0x46
 #define IPMI_SET_USER_PASSWORD         0x47
 #define IPMI_GET_CHANNEL_CIPHER_SUITES 0x54
+#define IPMI_SET_CHANNEL_SECURITY_KEYS 0x56
+
+#define IPMI_KG_KEY_ID  1
+#define IPMI_SET_CHANNEL_SECURITY_KEYS_OP_SET 1
 
 /* These are for channel_info_t.session_support */
 #define IPMI_CHANNEL_SESSION_LESS 0x00
@@ -137,6 +141,40 @@ int _ipmi_set_channel_access(struct ipmi
 		struct channel_access_t channel_access, uint8_t access_option,
 		uint8_t privilege_option);
 
+struct set_channel_security_keys_req {
+#if WORDS_BIGENDIAN
+	uint8_t __reserved1			:4;
+	uint8_t channel				:4;
+	
+	uint8_t __reserved2			:6;
+	uint8_t operation			:2;
+	
+	uint8_t key_id;
+	unsigned char key_value[IPMI_KG_BUFFER_SIZE-1]; /* we don't want space for '\0' at the end */
+#else
+	uint8_t channel				:4;
+	uint8_t __reserved1			:4;
+	
+	uint8_t operation			:2;
+	uint8_t __reserved2			:6;
+	
+	uint8_t key_id;
+	unsigned char key_value[IPMI_KG_BUFFER_SIZE-1]; /* we don't want space for '\0' at the end */
+#endif
+} __attribute__ ((packed));
+
+struct set_channel_security_keys_rsp {
+#if WORDS_BIGENDIAN
+	uint8_t __reserved1			:6;
+	uint8_t lock_status			:2;
+	unsigned char key_value; /* just the first character, use &key_value to explore the rest */
+#else
+	uint8_t lock_status			:2;
+	uint8_t __reserved1			:6;
+	unsigned char key_value; /* just the first character, use &key_value to explore the rest */
+#endif
+} __attribute__ ((packed));
+
 uint8_t ipmi_get_channel_medium(struct ipmi_intf * intf, uint8_t channel);
 uint8_t ipmi_current_channel_medium(struct ipmi_intf * intf);
 int ipmi_channel_main(struct ipmi_intf * intf, int argc, char ** argv);
diff -urNp old/include/ipmitool/ipmi_intf.h new/include/ipmitool/ipmi_intf.h
--- old/include/ipmitool/ipmi_intf.h	2017-02-06 10:20:02.254362909 +0100
+++ new/include/ipmitool/ipmi_intf.h	2017-02-06 10:40:40.264577602 +0100
@@ -60,7 +60,6 @@ enum LANPLUS_SESSION_STATE {
 
 #define IPMI_AUTHCODE_BUFFER_SIZE 20
 #define IPMI_SIK_BUFFER_SIZE      IPMI_MAX_MD_SIZE
-#define IPMI_KG_BUFFER_SIZE       21 /* key plus null byte */
 
 struct ipmi_session_params {
 	char * hostname;
diff -urNp old/lib/ipmi_channel.c new/lib/ipmi_channel.c
--- old/lib/ipmi_channel.c	2017-02-06 10:20:02.255409134 +0100
+++ new/lib/ipmi_channel.c	2017-02-06 12:32:14.222282317 +0100
@@ -821,6 +821,92 @@ ipmi_set_user_access(struct ipmi_intf *i
 	return 0;
 }
 
+int 
+ipmi_set_channel_security_keys (struct ipmi_intf *intf, uint8_t channel, const char *method, const char *key)
+{
+	uint8_t kgkey[IPMI_KG_BUFFER_SIZE];
+	struct ipmi_rs *rsp;
+	struct ipmi_rq req;
+	struct set_channel_security_keys_req req_data;
+	int rc = -1;
+	
+	/* convert provided key to array of bytes */
+	if (strcmp(method, "hex") == 0) {
+		if (strlen(key) > (IPMI_KG_BUFFER_SIZE-1)*2) {
+			lprintf(LOG_ERR, "Provided key is too long, max. length is %d bytes", (IPMI_KG_BUFFER_SIZE-1));
+			printf_channel_usage();
+			return -1;
+		}
+
+		rc = ipmi_parse_hex(key, kgkey, sizeof(kgkey)-1);
+		if (rc == -1) {
+			lprintf(LOG_ERR, "Number of Kg key characters is not even");
+			return rc;
+		} else if (rc == -3) {
+			lprintf(LOG_ERR, "Kg key is not hexadecimal number");
+			return rc;
+		} else if (rc > (IPMI_KG_BUFFER_SIZE-1)) {
+			lprintf(LOG_ERR, "Kg key is too long");
+			return rc;
+		}
+		
+	} else if (strcmp(method, "plain") == 0) {
+		if (strlen(key) > IPMI_KG_BUFFER_SIZE-1) {
+			lprintf(LOG_ERR, "Provided key is too long, max. length is %d bytes", (IPMI_KG_BUFFER_SIZE -1));
+			printf_channel_usage();
+			return rc;
+		}
+		
+		strncpy(kgkey, key, IPMI_KG_BUFFER_SIZE-1);
+	} else {
+		printf_channel_usage();
+		return rc;
+	}
+	
+	/* assemble and send request to set kg key */
+	memset(&req_data, 0, sizeof(req_data));
+	req_data.channel = channel;
+	req_data.operation = IPMI_SET_CHANNEL_SECURITY_KEYS_OP_SET;
+	req_data.key_id = IPMI_KG_KEY_ID;
+	memcpy(req_data.key_value, kgkey, IPMI_KG_BUFFER_SIZE-1);
+	
+	memset(&req, 0, sizeof(req));
+	req.msg.netfn = IPMI_NETFN_APP;
+	req.msg.cmd = IPMI_SET_CHANNEL_SECURITY_KEYS;
+	req.msg.data = (uint8_t*) &req_data;
+	req.msg.data_len = sizeof(req_data);
+
+	rsp = intf->sendrecv(intf, &req);
+	if (rsp == NULL) {
+		lprintf(LOG_ERR, "Set Channel Security Keys command failed");
+		return rc;
+	}
+	if (rsp->ccode > 0) {
+		const char *error = NULL;
+		switch (rsp->ccode) {
+		case 0x80:
+			error = "Key is locked";
+			break;
+		case 0x81:
+			error = "Insufficient key bytes";
+			break;
+		case 0x82:
+			error = "Too many key bytes";
+			break;
+		case 0x83:
+			error = "Key value does not meet criteria for K_g key";
+			break;
+		default:
+			error = val2str(rsp->ccode, completion_code_vals);
+		}
+		lprintf(LOG_ERR, "Error setting security key: %X (%s)", rsp->ccode, error);
+		return rc;
+	}
+	
+	lprintf(LOG_NOTICE, "Set Channel Security Keys command succeeded");
+	return 0;
+}
+
 int
 ipmi_channel_main(struct ipmi_intf *intf, int argc, char **argv)
 {
@@ -890,6 +976,19 @@ ipmi_channel_main(struct ipmi_intf *intf
 		retval = ipmi_get_channel_cipher_suites(intf,
 							argv[1], /* ipmi | sol */
 							channel);
+	} else if (strncmp(argv[0], "setkg", 5) == 0) {
+		if (argc < 3 || argc > 4)
+			printf_channel_usage();
+		else {
+			uint8_t ch = 0xe;
+			char *method = argv[1];
+			char *key = argv[2];
+			if (argc == 4) {
+				ch = (uint8_t)strtol(argv[3], NULL, 0);
+			}
+				
+			retval = ipmi_set_channel_security_keys(intf, ch, method, key);
+		}
 	} else {
 		lprintf(LOG_ERR, "Invalid CHANNEL command: %s\n", argv[0]);
 		printf_channel_usage();
@@ -916,6 +1015,10 @@ printf_channel_usage()
 	lprintf(LOG_NOTICE,
 "");
 	lprintf(LOG_NOTICE,
+"                  setkg hex|plain <key> [channel]");
+	lprintf(LOG_NOTICE,
+"");
+	lprintf(LOG_NOTICE,
 "Possible privilege levels are:");
 	lprintf(LOG_NOTICE,
 "   1   Callback level");
diff -urNp old/src/plugins/ipmi_intf.c new/src/plugins/ipmi_intf.c
--- old/src/plugins/ipmi_intf.c	2017-02-06 10:20:02.257501584 +0100
+++ new/src/plugins/ipmi_intf.c	2017-02-06 10:42:12.585257810 +0100
@@ -55,6 +55,7 @@
 #include <ipmitool/ipmi.h>
 #include <ipmitool/ipmi_sdr.h>
 #include <ipmitool/log.h>
+#include <ipmitool/helper.h>
 
 #define IPMI_DEFAULT_PAYLOAD_SIZE   25