1 /*
2 // Copyright (c) 2020 Intel Corporation
3 //
4 // Licensed under the Apache License, Version 2.0 (the "License");
5 // you may not use this file except in compliance with the License.
6 // You may obtain a copy of the License at
7 //
8 //      http://www.apache.org/licenses/LICENSE-2.0
9 //
10 // Unless required by applicable law or agreed to in writing, software
11 // distributed under the License is distributed on an "AS IS" BASIS,
12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 // See the License for the specific language governing permissions and
14 // limitations under the License.
15 */
16 #pragma once
17 #include "config.h"
18 
19 #include <openssl/evp.h>
20 #include <openssl/hmac.h>
21 #include <openssl/sha.h>
22 
23 #include <nlohmann/json.hpp>
24 #include <sdbusplus/asio/object_server.hpp>
25 #include <sdbusplus/server.hpp>
26 #include <xyz/openbmc_project/BIOSConfig/Password/server.hpp>
27 
28 #include <filesystem>
29 #include <string>
30 
31 namespace bios_config_pwd
32 {
33 static constexpr auto objectPathPwd =
34     "/xyz/openbmc_project/bios_config/password";
35 constexpr auto biosPasswordFile = "passwordData";
36 constexpr auto biosSeedFile = "seedData";
37 constexpr uint8_t maxHashSize = 64;
38 constexpr uint8_t maxSeedSize = 32;
39 constexpr uint8_t maxPasswordLen = 32;
40 constexpr int iterValue = 1000;
41 
42 using Base = sdbusplus::xyz::openbmc_project::BIOSConfig::server::Password;
43 namespace fs = std::filesystem;
44 
45 /** @class Password
46  *
47  *  @brief Implements the BIOS Password
48  */
49 class Password : public Base
50 {
51   public:
52     Password() = delete;
53     ~Password() = default;
54     Password(const Password&) = delete;
55     Password& operator=(const Password&) = delete;
56     Password(Password&&) = delete;
57     Password& operator=(Password&&) = delete;
58 
59     /** @brief Constructs Password object.
60      *
61      *  @param[in] objectServer  - object server
62      *  @param[in] systemBus - bus connection
63      */
64     Password(sdbusplus::asio::object_server& objectServer,
65              std::shared_ptr<sdbusplus::asio::connection>& systemBus);
66 
67     /** @brief Set the BIOS attribute with a new value, the new value is added
68      *         to the PendingAttribute.
69      *
70      *  @param[in] userName - User name - user / admin.
71      *  @param[in] currentPassword - Current user/ admin Password.
72      *  @param[in] newPassword - New user/ admin Password.
73      */
74     void changePassword(std::string userName, std::string currentPassword,
75                         std::string newPassword) override;
76 
77   private:
78     void verifyPassword(std::string userName, std::string currentPassword,
79                         std::string newPassword);
80     bool compareDigest(const EVP_MD* digestFunc, size_t digestLen,
81                        const std::array<uint8_t, maxHashSize>& expected,
82                        const std::array<uint8_t, maxSeedSize>& seed,
83                        const std::string& rawData);
84     bool isMatch(const std::array<uint8_t, maxHashSize>& expected,
85                  const std::array<uint8_t, maxSeedSize>& seed,
86                  const std::string& rawData, const std::string& algo);
87     bool getParam(std::array<uint8_t, maxHashSize>& orgUsrPwdHash,
88                   std::array<uint8_t, maxHashSize>& orgAdminPwdHash,
89                   std::array<uint8_t, maxSeedSize>& seed,
90                   std::string& hashAlgo);
91     bool verifyIntegrityCheck(std::string& newPassword,
92                               std::array<uint8_t, maxSeedSize>& seed,
93                               unsigned int mdLen, const EVP_MD* digestFunc);
94     sdbusplus::asio::object_server& objServer;
95     std::shared_ptr<sdbusplus::asio::connection>& systemBus;
96     std::filesystem::path seedFile;
97     std::array<uint8_t, maxHashSize> mNewPwdHash;
98 };
99 
100 } // namespace bios_config_pwd
101