hare

commit 835f300845d7a6b489a07cf6a6c55c0d4a9bca1b
parent 0725fd9d099514a525b57187c1d7bb60af11eafc
Author: Drew DeVault <sir@cmpwn.com>
Date:   Tue, 29 Mar 2022 20:48:38 +0200

crypto::keystore: new module

Signed-off-by: Drew DeVault <sir@cmpwn.com>

Diffstat:
A
crypto/keystore/impl+linux.ha
 | 
22
++++++++++++++++++++++
A
crypto/keystore/impl.ha
 | 
28
++++++++++++++++++++++++++++

2 files changed, 50 insertions(+), 0 deletions(-)
diff --git a/crypto/keystore/impl+linux.ha b/crypto/keystore/impl+linux.ha
@@ -0,0 +1,22 @@
+use errors;
+use linux::keyctl;
+
+export type key = keyctl::serial;
+
+// Creates a new secure key. The caller should clear the secret buffer with
+// [[bytes::zero]] after initialization.
+export fn newkey(buf: []u8, name: str) (key | errors::error) = {
+	match (keyctl::add_key("user", name, buf, keyctl::PROCESS_KEYRING)) {
+	case keyctl::nokey => abort();
+	case let err: errors::error =>
+		return err;
+	case let key: keyctl::serial =>
+		return key;
+	};
+};
+
+// Reads secret data from a secure key. When the caller is done using the secret
+// buffer, they should use [[bytes::zero]] to securely wipe the buffer memory.
+export fn read(key: key, buf: []u8) size = {
+	return keyctl::read(key, buf)!;
+};
diff --git a/crypto/keystore/impl.ha b/crypto/keystore/impl.ha
@@ -0,0 +1,28 @@
+// TODO: At least use mlock or something
+use bytes;
+use errors;
+
+export type key = []u8;
+
+// Creates a new secure key. The caller should clear the secret buffer with
+// [[bytes::zero]] after initialization.
+export fn newkey(buf: []u8, name: str) (key | errors::error) = {
+	return alloc(buf...): []u8: key;
+};
+
+// Destroys a secure key.
+export fn destroy(key: key) void = {
+	bytes::zero(key[..]);
+	free(key);
+};
+
+// Reads secret data from a secure key. When the caller is done using the secret
+// buffer, they should use [[bytes::zero]] to securely wipe the buffer memory.
+export fn read(key: key, buf: []u8) void = {
+	let amt = len(buf);
+	if (len(key) < len(buf)) {
+		amt = len(key);
+	};
+	buf[..amt] = key[..amt];
+	return amt;
+};