1 /*
2 // Copyright (c) 2020 Intel Corporation
3 //
4 // Licensed under the Apache License, Version 2.0 (the "License");
5 // you may not use this file except in compliance with the License.
6 // You may obtain a copy of the License at
7 //
8 //      http://www.apache.org/licenses/LICENSE-2.0
9 //
10 // Unless required by applicable law or agreed to in writing, software
11 // distributed under the License is distributed on an "AS IS" BASIS,
12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 // See the License for the specific language governing permissions and
14 // limitations under the License.
15 */
16 #pragma once
17 #include "config.h"
18 
19 #include <openssl/evp.h>
20 #include <openssl/hmac.h>
21 #include <openssl/sha.h>
22 
23 #include <nlohmann/json.hpp>
24 #include <sdbusplus/asio/object_server.hpp>
25 #include <sdbusplus/server.hpp>
26 #include <xyz/openbmc_project/BIOSConfig/Password/server.hpp>
27 
28 #include <filesystem>
29 #include <string>
30 
31 namespace bios_config_pwd
32 {
33 static constexpr auto objectPathPwd =
34     "/xyz/openbmc_project/bios_config/password";
35 constexpr auto biosSeedFile = "seedData";
36 constexpr uint8_t maxHashSize = 64;
37 constexpr uint8_t maxSeedSize = 32;
38 constexpr uint8_t maxPasswordLen = 32;
39 constexpr int iterValue = 1000;
40 
41 using Base = sdbusplus::xyz::openbmc_project::BIOSConfig::server::Password;
42 namespace fs = std::filesystem;
43 
44 /** @class Password
45  *
46  *  @brief Implements the BIOS Password
47  */
48 class Password : public Base
49 {
50   public:
51     Password() = delete;
52     ~Password() = default;
53     Password(const Password&) = delete;
54     Password& operator=(const Password&) = delete;
55     Password(Password&&) = delete;
56     Password& operator=(Password&&) = delete;
57 
58     /** @brief Constructs Password object.
59      *
60      *  @param[in] objectServer  - object server
61      *  @param[in] systemBus - bus connection
62      */
63     Password(sdbusplus::asio::object_server& objectServer,
64              std::shared_ptr<sdbusplus::asio::connection>& systemBus);
65 
66     /** @brief Set the BIOS attribute with a new value, the new value is added
67      *         to the PendingAttribute.
68      *
69      *  @param[in] userName - User name - user / admin.
70      *  @param[in] currentPassword - Current user/ admin Password.
71      *  @param[in] newPassword - New user/ admin Password.
72      */
73     void changePassword(std::string userName, std::string currentPassword,
74                         std::string newPassword) override;
75 
76   private:
77     void verifyPassword(std::string userName, std::string currentPassword,
78                         std::string newPassword);
79     bool compareDigest(const EVP_MD* digestFunc, size_t digestLen,
80                        const std::array<uint8_t, maxHashSize>& expected,
81                        const std::array<uint8_t, maxSeedSize>& seed,
82                        const std::string& rawData);
83     bool isMatch(const std::array<uint8_t, maxHashSize>& expected,
84                  const std::array<uint8_t, maxSeedSize>& seed,
85                  const std::string& rawData, const std::string& algo);
86     bool getParam(std::array<uint8_t, maxHashSize>& orgUsrPwdHash,
87                   std::array<uint8_t, maxHashSize>& orgAdminPwdHash,
88                   std::array<uint8_t, maxSeedSize>& seed,
89                   std::string& hashAlgo);
90     bool verifyIntegrityCheck(std::string& newPassword,
91                               std::array<uint8_t, maxSeedSize>& seed,
92                               unsigned int mdLen, const EVP_MD* digestFunc);
93     sdbusplus::asio::object_server& objServer;
94     std::shared_ptr<sdbusplus::asio::connection>& systemBus;
95     std::filesystem::path seedFile;
96     std::array<uint8_t, maxHashSize> mNewPwdHash;
97 };
98 
99 } // namespace bios_config_pwd
100