From b55cc396ce1a8e9e3961e8ad350a034ac5161348 Mon Sep 17 00:00:00 2001

From: Howard McLauchlan <hmclauchlan@fb.com>

Date: Tue, 16 Aug 2022 21:48:38 -0700

Subject: [PATCH 1/3] Shuffle GetPassPhrase{.h, .cpp} in makefile.am

Moving GetPassPhrase.o down into SEDUTIL_LINUX_CODE, since we need it

for the securemode/password-setting work.

This is fine since AFAICT linuxpba_SOURCES eventually gets consumed in

conjunction with SEDUTIL_LINUX_CODE, so that binary will get access to

the TU.

Keeping this as seperate commit since it might be a little bit subtle /

weird, depending on what Make is doing behind the scenes.

Signed-off-by: Howard McLauchlan <hmclauchlan@fb.com>

---

 Makefile.am | 6 +++---

 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Makefile.am b/Makefile.am

index 6656d593..82c51010 100644

--- a/Makefile.am

+++ b/Makefile.am

@@ -28,7 +28,8 @@ SEDUTIL_LINUX_CODE = \

 	linux/Version.h linux/os.h linux/DtaDevLinuxDrive.h \

 	linux/DtaDevLinuxNvme.cpp linux/DtaDevLinuxSata.cpp \

 	linux/DtaDevLinuxNvme.h linux/DtaDevLinuxSata.h \

-	linux/DtaDevOS.cpp linux/DtaDevOS.h 

+	linux/DtaDevOS.cpp linux/DtaDevOS.h \

+	LinuxPBA/GetPassPhrase.cpp LinuxPBA/GetPassPhrase.h

 sbin_PROGRAMS = sedutil-cli linuxpba

 sedutil_cli_SOURCES = Common/sedutil.cpp Common/DtaOptions.cpp \

 	Common/DtaOptions.h \

@@ -37,8 +38,7 @@ sedutil_cli_SOURCES = Common/sedutil.cpp Common/DtaOptions.cpp \

 CLEANFILES = linux/Version.h

 BUILT_SOURCES = linux/Version.h

 #

-linuxpba_SOURCES = LinuxPBA/LinuxPBA.cpp LinuxPBA/GetPassPhrase.cpp LinuxPBA/UnlockSEDs.cpp \

-	LinuxPBA/GetPassPhrase.h LinuxPBA/UnlockSEDs.h \

+linuxpba_SOURCES = LinuxPBA/LinuxPBA.cpp LinuxPBA/UnlockSEDs.cpp LinuxPBA/UnlockSEDs.h \

 	$(SEDUTIL_LINUX_CODE) \

 	$(SEDUTIL_COMMON_CODE)

 EXTRA_DIST = linux/GitVersion.sh linux/PSIDRevert_LINUX.txt linux/TestSuite.sh README.md docs/sedutil-cli.8

From fc3c2d35a98de84b18b7d6a11f65070147b74024 Mon Sep 17 00:00:00 2001

From: Howard McLauchlan <hmclauchlan@fb.com>

Date: Tue, 16 Aug 2022 22:11:04 -0700

Subject: [PATCH 2/3] Add securemode/password-setting

*BASICALLY CLEANED UP VERSION OF https://github.com/Drive-Trust-Alliance/sedutil/pull/271*

This commit does what the linked PR says, and also fixes a few bugs in

that original PR. I'm not sure what the right way to give credit is and

it was very painful to resurrect CVE's original patches and roll my own

on top, so the disclaimer here is that it's like 95% his code :).

A few notable things:

* We don't need to modify the makefiles, since we split that out in the

  prior commit.

* We fixed his original makefile, which didn't quite work: that change

  is folded naturally into prior commit.

* The generated makefiles don't need to change, because since CVE's

  original patchset, GetPassPhrase.o was introduced organically to the

  codebase, and ergo the makefiles.

The most interesting thing here is we allow hashing to be forced off by

`-n` even during secure mode.

The key issue we ran into was that if a drive is originally set with no

hashing, then hash'd invocations in the future will fail(obviously). As

implemented, CVE's original patches will silently debug output, and then

turn on hashing without telling the user.

Not a domain expert in why hashing is necessary here, but in either

case, I think we should support the case where a password was originally

set without hashing, by allowing hashing to be turned off _if_ specified

explicitly.

We also do some sneaky business by ensuring -n is evaluated after -s, so

-n will always override -s, if provided.

Signed-off-by: Howard McLauchlan <hmclauchlan@fb.com>

---

 Common/DtaDev.h             |  16 +++--

 Common/DtaDevEnterprise.cpp |  30 ++++++---

 Common/DtaDevEnterprise.h   |  16 +++--

 Common/DtaDevGeneric.cpp    |  12 ++--

 Common/DtaDevGeneric.h      |  17 +++--

 Common/DtaDevOpal.cpp       | 128 ++++++++++++++++++++++++++++--------

 Common/DtaDevOpal.h         |  26 ++++++--

 Common/DtaOptions.cpp       | 112 ++++++++++++++++++-------------

 Common/DtaOptions.h         |  36 +++++++---

 Common/sedutil.cpp          |  81 ++++++++++++-----------

 linux/os.h                  |   2 +

 11 files changed, 319 insertions(+), 157 deletions(-)

diff --git a/Common/DtaDev.h b/Common/DtaDev.h

index 473f7bd0..c73c179e 100644

--- a/Common/DtaDev.h

+++ b/Common/DtaDev.h

@@ -111,8 +111,9 @@ class DtaDev {

 	/** User command to prepare the device for management by sedutil.

 	 * Specific to the SSC that the device supports

 	 * @param password the password that is to be assigned to the SSC master entities

+     * @param securemode is the new password should be interactively asked

 	 */

-	virtual uint8_t initialSetup(char * password) = 0;

+	virtual uint8_t initialSetup(char * password, bool securemode = false) = 0;

 	/** User command to prepare the drive for Single User Mode and rekey a SUM locking range.

 	 * @param lockingrange locking range number to enable

 	 * @param start LBA to start locking range

@@ -120,28 +121,30 @@ class DtaDev {

 	 * @param Admin1Password admin1 password for TPer

 	 * @param password User password to set for locking range

 	 */

-	virtual uint8_t setup_SUM(uint8_t lockingrange, uint64_t start, uint64_t length, char *Admin1Password, char * password) = 0;

+	virtual uint8_t setup_SUM(uint8_t lockingrange, uint64_t start, uint64_t length, char *Admin1Password, char * password, bool securemode = false) = 0;

 	/** Set the SID password.

 	 * Requires special handling because password is not always hashed.

 	 * @param oldpassword  current SID password

 	 * @param newpassword  value password is to be changed to

 	 * @param hasholdpwd  is the old password to be hashed before being added to the bytestream

 	 * @param hashnewpwd  is the new password to be hashed before being added to the bytestream

+     * @param securemode is the new password should be interactively asked

 	 */

 	virtual uint8_t setSIDPassword(char * oldpassword, char * newpassword,

-		uint8_t hasholdpwd = 1, uint8_t hashnewpwd = 1) = 0;

+		uint8_t hasholdpwd = 1, uint8_t hashnewpwd = 1, bool securemode = false) = 0;

 	/** Set the password of a locking SP user.

 	 * @param password  current password

 	 * @param userid the userid whose password is to be changed

 	 * @param newpassword  value password is to be changed to

+     * @param securemode is the new password shoulb be interactively asked

 	 */

-	virtual uint8_t setPassword(char * password, char * userid, char * newpassword) = 0;

+	virtual uint8_t setPassword(char * password, char * userid, char * newpassword, bool securemode = false) = 0;

 	/** Set the password of a locking SP user in Single User Mode.

          * @param password  current user password

          * @param userid the userid whose password is to be changed

          * @param newpassword  value password is to be changed to

          */

-	virtual uint8_t setNewPassword_SUM(char * password, char * userid, char * newpassword) = 0;

+	virtual uint8_t setNewPassword_SUM(char * password, char * userid, char * newpassword, bool securemode = false) = 0;

 	/** Loads a disk image file to the shadow MBR table.

 	 * @param password the password for the administrative authority with access to the table

 	 * @param filename the filename of the disk image

@@ -230,8 +233,9 @@ class DtaDev {

 	virtual uint8_t eraseLockingRange_SUM(uint8_t lockingrange, char * password) = 0;

 	/** Change the SID password from it's MSID default

 	 * @param newpassword  new password for SID and locking SP admins

+     * @param securemode is the new password should be interactively asked

 	 */

-	virtual uint8_t takeOwnership(char * newpassword) = 0;

+	virtual uint8_t takeOwnership(char * newpassword, bool securemode = false) = 0;

 	/** Reset the Locking SP to its factory default condition

 	 * ERASES ALL DATA!

 	 * @param password of Administrative user

diff --git a/Common/DtaDevEnterprise.cpp b/Common/DtaDevEnterprise.cpp

index ae649ec5..ba2e97a7 100644

--- a/Common/DtaDevEnterprise.cpp

+++ b/Common/DtaDevEnterprise.cpp

@@ -171,12 +171,12 @@ DtaDevEnterprise::DtaDevEnterprise(const char * devref)

 DtaDevEnterprise::~DtaDevEnterprise()

 {

 }

-uint8_t DtaDevEnterprise::initialSetup(char * password)

+uint8_t DtaDevEnterprise::initialSetup(char * password, bool securemode)

 {

 	LOG(D1) << "Entering initialSetup()";

 	uint8_t lastRC;

-	if ((lastRC = takeOwnership(password)) != 0) {

+	if ((lastRC = takeOwnership(password, securemode)) != 0) {

 		LOG(E) << "Initial setup failed - unable to take ownership";

 		return lastRC;

 	}

@@ -196,7 +196,7 @@ uint8_t DtaDevEnterprise::initialSetup(char * password)

 	LOG(D1) << "Exiting initialSetup()";

 	return 0;

 }

-uint8_t DtaDevEnterprise::setup_SUM(uint8_t lockingrange, uint64_t start, uint64_t length, char *Admin1Password, char * password)

+uint8_t DtaDevEnterprise::setup_SUM(uint8_t lockingrange, uint64_t start, uint64_t length, char *Admin1Password, char * password, bool securemode)

 {

 	LOG(D1) << "Entering DtaDevEnterprise::setup_SUM";

 	LOG(I) << "setup_SUM not supported on DtaDevEnterprise";

@@ -377,13 +377,18 @@ uint8_t DtaDevEnterprise::revertLockingSP(char * password, uint8_t keep)

 	LOG(D1) << "Exiting DtaDevEnterprise::revertLockingSP()";

 	return 0;

 }

-uint8_t DtaDevEnterprise::setPassword(char * password, char * userid, char * newpassword)

+uint8_t DtaDevEnterprise::setPassword(char * password, char * userid, char * newpassword, bool securemode)

 {

 	LOG(D1) << "Entering DtaDevEnterprise::setPassword" ;

-	uint8_t lastRC;

+	uint8_t lastRC = 0;

 	string defaultPassword;

 	char *pwd = password, *newpwd = newpassword;

+    if (securemode) {

+        LOG(I) << "setSIDPassword in secure mode in the Enterprise SSC is not supported";

+        return lastRC;

+    }

+

 	if (11 > strnlen(userid, 15)) {

 		LOG(E) << "Invalid Userid " << userid;

 		return DTAERROR_INVALID_PARAMETER;

@@ -463,7 +468,7 @@ uint8_t DtaDevEnterprise::setPassword(char * password, char * userid, char * new

 	LOG(D1) << "Exiting DtaDevEnterprise::setPassword()";

 	return 0;

 }

-uint8_t DtaDevEnterprise::setNewPassword_SUM(char * password, char * userid, char * newpassword)

+uint8_t DtaDevEnterprise::setNewPassword_SUM(char * password, char * userid, char * newpassword, bool securemode)

 {

 	LOG(D1) << "Entering DtaDevEnterprise::setNewPassword_SUM()";

 	LOG(I) << "setNewPassword_SUM is not in the Enterprise SSC and not supported";

@@ -1022,7 +1027,7 @@ uint8_t DtaDevEnterprise::eraseLockingRange_SUM(uint8_t lockingrange, char * pas

 	LOG(D1) << "Exiting DtaDevEnterprise::eraseLockingRange_SUM()";

 	return DTAERROR_INVALID_PARAMETER;

 }

-uint8_t DtaDevEnterprise::takeOwnership(char * newpassword)

+uint8_t DtaDevEnterprise::takeOwnership(char * newpassword, bool securemode)

 {

 	string defaultPassword;

 	uint8_t lastRC;

@@ -1033,7 +1038,7 @@ uint8_t DtaDevEnterprise::takeOwnership(char * newpassword)

 		return lastRC;

 	}

 	defaultPassword = response.getString(5);

-	if ((lastRC = setSIDPassword((char *)defaultPassword.c_str(), newpassword, 0)) != 0) {

+	if ((lastRC = setSIDPassword((char *)defaultPassword.c_str(), newpassword, 0, 1, securemode)) != 0) {

 		LOG(E) << "takeOwnership failed unable to set new SID password";

 		return lastRC;

 	}

@@ -1270,10 +1275,15 @@ uint8_t DtaDevEnterprise::printDefaultPassword()

     return 0;

 }

 uint8_t DtaDevEnterprise::setSIDPassword(char * oldpassword, char * newpassword,

-	uint8_t hasholdpwd, uint8_t hashnewpwd)

+	uint8_t hasholdpwd, uint8_t hashnewpwd, bool securemode)

 {

 	LOG(D1) << "Entering DtaDevEnterprise::setSIDPassword()";

-	uint8_t lastRC;

+	uint8_t lastRC = 0;

+

+    if (securemode) {

+        LOG(I) << "setSIDPassword in the Enterprise SSC is not supported";

+        return lastRC;

+    }

 	vector<uint8_t> user;

     set8(user, OPALUID[OPAL_SID_UID]);

diff --git a/Common/DtaDevEnterprise.h b/Common/DtaDevEnterprise.h

index 5350da5c..4a6d2e2e 100644

--- a/Common/DtaDevEnterprise.h

+++ b/Common/DtaDevEnterprise.h

@@ -57,8 +57,9 @@ class DtaDevEnterprise : public DtaDevOS {

 	uint16_t comID();

         /** Change the SID password from it's MSID default 

          * @param newpassword  new password for SID 

+         * @param securemode is the new password should be interactively asked

          */

-	uint8_t takeOwnership(char * newpassword);

+	uint8_t takeOwnership(char * newpassword, bool securemode = false);

         /** Change the passwords for the enabled Bandmasters and the Erasemaster 

          * from the MSID default.

          * @param defaultPassword the MSID password

@@ -80,9 +81,10 @@ class DtaDevEnterprise : public DtaDevOS {

          * @param newpassword  value password is to be changed to

          * @param hasholdpwd  is the old password to be hashed before being added to the bytestream

          * @param hashnewpwd  is the new password to be hashed before being added to the bytestream

+         * @param securemode is the new password should be interactively asked

          */ 

 	uint8_t setSIDPassword(char * oldpassword, char * newpassword,

-		uint8_t hasholdpwd = 1, uint8_t hashnewpwd = 1);

+		uint8_t hasholdpwd = 1, uint8_t hashnewpwd = 1, bool securemode = false);

         /** set a single column in an object table 

          * @param table the UID of the table

          * @param name the column name to be set

@@ -124,10 +126,11 @@ class DtaDevEnterprise : public DtaDevOS {

          * @param password  current password

          * @param userid the userid whose password is to be changed 

          * @param newpassword  value password is to be changed to

+         * @param securemode is the new password should be interactively asked

          */

-	uint8_t setPassword(char * password, char * userid, char * newpassword);

+	uint8_t setPassword(char * password, char * userid, char * newpassword, bool securemode = false);

 	/** dummy code not implemented in the enterprise SSC*/

-	uint8_t setNewPassword_SUM(char * password, char * userid, char * newpassword);

+	uint8_t setNewPassword_SUM(char * password, char * userid, char * newpassword, bool securemode = false);

 	uint8_t setLockingRange(uint8_t lockingrange, uint8_t lockingstate,

 		char * password);

 	/** dummy code not implemented in the enterprise SSC*/

@@ -180,10 +183,11 @@ class DtaDevEnterprise : public DtaDevOS {

          /** User command to prepare the device for management by sedutil. 

          * Specific to the SSC that the device supports

          * @param password the password that is to be assigned to the SSC master entities 

+         * @param securemode is the new password should be interactively asked

          */

-	uint8_t initialSetup(char * password);

+	uint8_t initialSetup(char * password, bool securemode = false);

 	/** dummy code not implemented in the enterprise SSC*/

-	uint8_t setup_SUM(uint8_t lockingrange, uint64_t start, uint64_t length, char *Admin1Password, char * password);

+	uint8_t setup_SUM(uint8_t lockingrange, uint64_t start, uint64_t length, char *Admin1Password, char * password, bool securemode = false);

         /** Displays the identify and discovery 0 information */

 	void puke();

          /** Dumps an object for diagnostic purposes

diff --git a/Common/DtaDevGeneric.cpp b/Common/DtaDevGeneric.cpp

index 6f5d57c6..8e1bdc91 100644

--- a/Common/DtaDevGeneric.cpp

+++ b/Common/DtaDevGeneric.cpp

@@ -62,13 +62,13 @@ DtaDevGeneric::~DtaDevGeneric()

 void DtaDevGeneric::init(const char * devref)

 {

 }

-uint8NOCODE(initialSetup, char *password)

+uint8NOCODE(initialSetup, char *password, bool securemode)

 uint8NOCODE(configureLockingRange,uint8_t lockingrange, 

 	uint8_t enabled, char * password)

 uint8NOCODE(revertLockingSP,char * password, uint8_t keep)

-uint8NOCODE(setup_SUM, uint8_t lockingrange, uint64_t start, uint64_t length, char *Admin1Password, char * password)

-uint8NOCODE(setPassword,char * password, char * userid, char * newpassword)

-uint8NOCODE(setNewPassword_SUM,char * password, char * userid, char * newpassword)

+uint8NOCODE(setup_SUM, uint8_t lockingrange, uint64_t start, uint64_t length, char *Admin1Password, char * password, bool securemode)

+uint8NOCODE(setPassword,char * password, char * userid, char * newpassword, bool securemode)

+uint8NOCODE(setNewPassword_SUM,char * password, char * userid, char * newpassword, bool securemode)

 uint8NOCODE(setMBREnable,uint8_t mbrstate, char * Admin1Password)

 uint8NOCODE(setMBRDone,uint8_t mbrstate, char * Admin1Password)

 uint8NOCODE(setLockingRange,uint8_t lockingrange, uint8_t lockingstate,

@@ -90,9 +90,9 @@ uint8NOCODE(loadPBA,char * password, char * filename)

 uint8NOCODE(activateLockingSP,char * password)

 uint8NOCODE(activateLockingSP_SUM,uint8_t lockingrange, char * password)

 uint8NOCODE(eraseLockingRange_SUM, uint8_t lockingrange, char * password)

-uint8NOCODE(takeOwnership, char * newpassword)

+uint8NOCODE(takeOwnership, char * newpassword, bool securemode)

 uint8NOCODE(setSIDPassword,char * oldpassword, char * newpassword,

-	uint8_t hasholdpwd, uint8_t hashnewpwd)

+	uint8_t hasholdpwd, uint8_t hashnewpwd, bool securemode)

 uint16_t DtaDevGeneric::comID()

 {

 	LOG(E) << "Generic Device class does not support function " << "comID" << std::endl; 

diff --git a/Common/DtaDevGeneric.h b/Common/DtaDevGeneric.h

index 9f5f9752..07728781 100644

--- a/Common/DtaDevGeneric.h

+++ b/Common/DtaDevGeneric.h

@@ -56,36 +56,40 @@ class DtaDevGeneric : public DtaDevOS {

          * Specific to the SSC that the device supports

          * @param password the password that is to be assigned to the SSC master entities 

          */

-	 uint8_t initialSetup(char * password) ;

+	 uint8_t initialSetup(char * password, bool securemode) ;

 	/** User command to prepare the drive for Single User Mode and rekey a SUM locking range.

          * @param lockingrange locking range number to enable

          * @param start LBA to start locking range

          * @param length length (in blocks) for locking range

          * @param Admin1Password admin1 password for TPer

          * @param password User password to set for locking range

+         * @param securemode is the new password shoulb be interactively asked

          */

-         uint8_t setup_SUM(uint8_t lockingrange, uint64_t start, uint64_t length, char *Admin1Password, char * password);

+         uint8_t setup_SUM(uint8_t lockingrange, uint64_t start, uint64_t length, char *Admin1Password, char * password, bool securemode = false);

           /** Set the SID password.

          * Requires special handling because password is not always hashed.

          * @param oldpassword  current SID password

          * @param newpassword  value password is to be changed to

          * @param hasholdpwd  is the old password to be hashed before being added to the bytestream

          * @param hashnewpwd  is the new password to be hashed before being added to the bytestream

+         * @param securemode is the new password shoulb be interactively asked

          */ 

 	 uint8_t setSIDPassword(char * oldpassword, char * newpassword,

-		uint8_t hasholdpwd = 1, uint8_t hashnewpwd = 1) ;

+		uint8_t hasholdpwd = 1, uint8_t hashnewpwd = 1, bool securemode = false) ;

          /** Set the password of a locking SP user.

           * @param password  current password

          * @param userid the userid whose password is to be changed 

          * @param newpassword  value password is to be changed to

+         * @param securemode is the new password should be interactively asked

          */

-	 uint8_t setPassword(char * password, char * userid, char * newpassword) ;

+	 uint8_t setPassword(char * password, char * userid, char * newpassword, bool securemode = false) ;

 	 /** Set the password of a locking SP user in Single User Mode.

          * @param password  current user password

          * @param userid the userid whose password is to be changed

          * @param newpassword  value password is to be changed to

+         * @param securemode is the new password should be interactively asked

          */

-	 uint8_t setNewPassword_SUM(char * password, char * userid, char * newpassword) ;

+	 uint8_t setNewPassword_SUM(char * password, char * userid, char * newpassword, bool securemode = false) ;

           /** Loads a disk image file to the shadow MBR table.

          * @param password the password for the administrative authority with access to the table

          * @param filename the filename of the disk image

@@ -174,8 +178,9 @@ class DtaDevGeneric : public DtaDevOS {

         uint8_t eraseLockingRange_SUM(uint8_t lockingrange, char * password);

         /** Change the SID password from it's MSID default 

          * @param newpassword  new password for SID and locking SP admins

+         * @param securemode is the new password should be interactively asked

          */ 

-	 uint8_t takeOwnership(char * newpassword) ;

+	 uint8_t takeOwnership(char * newpassword, bool securemode = false) ;

          /** Reset the Locking SP to its factory default condition

          * ERASES ALL DATA!

          * @param password of Administrative user

diff --git a/Common/DtaDevOpal.cpp b/Common/DtaDevOpal.cpp

index 1cb5701a..0f6ccc70 100644

--- a/Common/DtaDevOpal.cpp

+++ b/Common/DtaDevOpal.cpp

@@ -50,31 +50,43 @@ void DtaDevOpal::init(const char * devref)

 	if((lastRC = properties()) != 0) { LOG(E) << "Properties exchange failed";}

 }

-uint8_t DtaDevOpal::initialSetup(char * password)

+uint8_t DtaDevOpal::initialSetup(char * password, bool securemode)

 {

 	LOG(D1) << "Entering initialSetup()";

+    std::string newpwd;

 	uint8_t lastRC;

-	if ((lastRC = takeOwnership(password)) != 0) {

+

+#ifdef __linux__

+    if (securemode) {

+        if (askNewPassword(newpwd, true) != OPALSTATUSCODE::SUCCESS) {

+            LOG(E) << "Wrong password confirmation. Failure of password update.";

+            lastRC =  OPALSTATUSCODE::FAIL;

+            return lastRC;

+        }

+    }

+#endif

+

+	if ((lastRC = takeOwnership((securemode)?(char*)newpwd.c_str():password)) != 0) {

 		LOG(E) << "Initial setup failed - unable to take ownership";

 		return lastRC;

 	}

-	if ((lastRC = activateLockingSP(password)) != 0) {

+	if ((lastRC = activateLockingSP((securemode)?(char*)newpwd.c_str():password)) != 0) {

 		LOG(E) << "Initial setup failed - unable to activate LockingSP";

 		return lastRC;

 	}

-	if ((lastRC = configureLockingRange(0, DTA_DISABLELOCKING, password)) != 0) {

+	if ((lastRC = configureLockingRange(0, DTA_DISABLELOCKING, (securemode)?(char*)newpwd.c_str():password)) != 0) {

 		LOG(E) << "Initial setup failed - unable to configure global locking range";

 		return lastRC;

 	}

-	if ((lastRC = setLockingRange(0, OPAL_LOCKINGSTATE::READWRITE, password)) != 0) {

+	if ((lastRC = setLockingRange(0, OPAL_LOCKINGSTATE::READWRITE, (securemode)?(char*)newpwd.c_str():password)) != 0) {

 		LOG(E) << "Initial setup failed - unable to set global locking range RW";

 		return lastRC;

 	}

-	if ((lastRC = setMBRDone(1, password)) != 0){

+	if ((lastRC = setMBRDone(1, (securemode)?(char*)newpwd.c_str():password)) != 0){

 		LOG(E) << "Initial setup failed - unable to Enable MBR shadow";

 		return lastRC;

 	}

-	if ((lastRC = setMBREnable(1, password)) != 0){

+	if ((lastRC = setMBREnable(1, (securemode)?(char*)newpwd.c_str():password)) != 0){

 		LOG(E) << "Initial setup failed - unable to Enable MBR shadow";

 		return lastRC;

 	}

@@ -84,7 +96,7 @@ uint8_t DtaDevOpal::initialSetup(char * password)

 	return 0;

 }

-uint8_t DtaDevOpal::setup_SUM(uint8_t lockingrange, uint64_t start, uint64_t length, char *Admin1Password, char * password)

+uint8_t DtaDevOpal::setup_SUM(uint8_t lockingrange, uint64_t start, uint64_t length, char *Admin1Password, char * password, bool securemode)

 {

 	LOG(D1) << "Entering setup_SUM()";

 	uint8_t lastRC;

@@ -108,7 +120,7 @@ uint8_t DtaDevOpal::setup_SUM(uint8_t lockingrange, uint64_t start, uint64_t len

 	if (!disk_info.Locking_lockingEnabled)

 	{

 		LOG(D1) << "LockingSP not enabled. Beginning initial setup flow.";

-		if ((lastRC = takeOwnership(Admin1Password)) != 0) {

+		if ((lastRC = takeOwnership(Admin1Password, securemode)) != 0) {

 			LOG(E) << "Setup_SUM failed - unable to take ownership";

 			return lastRC;

 		}

@@ -147,7 +159,7 @@ uint8_t DtaDevOpal::setup_SUM(uint8_t lockingrange, uint64_t start, uint64_t len

 		LOG(E) << "Setup_SUM failed - unable to enable locking range";

 		return lastRC;

 	}

-	if ((lastRC = setNewPassword_SUM(defaultPW, (char *)userId.c_str(), password)) != 0) {

+	if ((lastRC = setNewPassword_SUM(defaultPW, (char *)userId.c_str(), password, securemode)) != 0) {

 		LOG(E) << "Setup_SUM failed - unable to set new locking range password";

 		return lastRC;

 	}

@@ -688,12 +700,13 @@ uint8_t DtaDevOpal::getAuth4User(char * userid, uint8_t uidorcpin, std::vector

 	LOG(D1) << "Exiting DtaDevOpal::getAuth4User()";

 	return 0;

 }

-uint8_t DtaDevOpal::setPassword(char * password, char * userid, char * newpassword)

+uint8_t DtaDevOpal::setPassword(char * password, char * userid, char * newpassword, bool securemode)

 {

 	LOG(D1) << "Entering DtaDevOpal::setPassword" ;

 	uint8_t lastRC;

 	std::vector<uint8_t> userCPIN, hash;

 	session = new DtaSession(this);

+

 	if (NULL == session) {

 		LOG(E) << "Unable to create session object ";

 		return DTAERROR_OBJECT_CREATE_FAILED;

@@ -707,7 +720,28 @@ uint8_t DtaDevOpal::setPassword(char * password, char * userid, char * newpasswo

 		delete session;

 		return lastRC;

 	}

-	DtaHashPwd(hash, newpassword, this);

+

+    // Ask and confirm new password

+#ifdef __linux__

+    if (securemode) {

+        std::string newpwd;

+        if (askNewPassword(newpwd, true) == OPALSTATUSCODE::SUCCESS) {

+            DtaHashPwd(hash, (char*)newpwd.c_str(), this);

+        }

+        else {

+            LOG(E) << "Wrong password confirmation. Failure of password update.";

+            delete session;

+            lastRC =  OPALSTATUSCODE::FAIL;

+            return lastRC;

+        }

+    }

+    else {

+#endif //__linux__

+        DtaHashPwd(hash, newpassword, this);

+#ifdef __linux__

+    }

+#endif //__linux__

+

 	if ((lastRC = setTable(userCPIN, OPAL_TOKEN::PIN, hash)) != 0) {

 		LOG(E) << "Unable to set user " << userid << " new password ";

 		delete session;

@@ -718,7 +752,7 @@ uint8_t DtaDevOpal::setPassword(char * password, char * userid, char * newpasswo

 	LOG(D1) << "Exiting DtaDevOpal::setPassword()";

 	return 0;

 }

-uint8_t DtaDevOpal::setNewPassword_SUM(char * password, char * userid, char * newpassword)

+uint8_t DtaDevOpal::setNewPassword_SUM(char * password, char * userid, char * newpassword, bool securemode)

 {

 	LOG(D1) << "Entering DtaDevOpal::setNewPassword_SUM";

 	uint8_t lastRC;

@@ -1391,7 +1425,7 @@ uint8_t DtaDevOpal::eraseLockingRange_SUM(uint8_t lockingrange, char * password)

 	return 0;

 }

-uint8_t DtaDevOpal::takeOwnership(char * newpassword)

+uint8_t DtaDevOpal::takeOwnership(char * newpassword, bool securemode)

 {

 	LOG(D1) << "Entering DtaDevOpal::takeOwnership()";

 	uint8_t lastRC;

@@ -1399,7 +1433,7 @@ uint8_t DtaDevOpal::takeOwnership(char * newpassword)

 		LOG(E) << "Unable to read MSID password ";

 		return lastRC;

 	}

-	if ((lastRC = setSIDPassword((char *)response.getString(4).c_str(), newpassword, 0)) != 0) {

+	if ((lastRC = setSIDPassword((char *)response.getString(4).c_str(), newpassword, 0, 1, securemode)) != 0) {

 		LOG(E) << "takeOwnership failed";

 		return lastRC;

 	}

@@ -1447,7 +1481,7 @@ uint8_t DtaDevOpal::printDefaultPassword()

     return 0;

 }

 uint8_t DtaDevOpal::setSIDPassword(char * oldpassword, char * newpassword,

-	uint8_t hasholdpwd, uint8_t hashnewpwd)

+	uint8_t hasholdpwd, uint8_t hashnewpwd, bool securemode)

 {

 	vector<uint8_t> hash, table;

 	LOG(D1) << "Entering DtaDevOpal::setSIDPassword()";

@@ -1468,17 +1502,39 @@ uint8_t DtaDevOpal::setSIDPassword(char * oldpassword, char * newpassword,

 	for (int i = 0; i < 8; i++) {

 		table.push_back(OPALUID[OPAL_UID::OPAL_C_PIN_SID][i]);

 	}

+

 	hash.clear();

-	if (hashnewpwd) {

-		DtaHashPwd(hash, newpassword, this);

-	}

-	else {

-		hash.push_back(0xd0);

-		hash.push_back((uint8_t)strnlen(newpassword, 255));

-		for (uint16_t i = 0; i < strnlen(newpassword, 255); i++) {

-			hash.push_back(newpassword[i]);

-		}

-	}

+

+#ifdef __linux__

+    if (securemode) {

+        // In secure mode, the password hashing is mandatory

+        std::string newpwd;

+        if (askNewPassword(newpwd, true) == OPALSTATUSCODE::SUCCESS) {

+            DtaHashPwd(hash, (char*)newpwd.c_str(), this);

+        }

+        else {

+            LOG(E) << "Wrong password confirmation. Failure of password update.";

+            delete session;

+            lastRC =  DTAERROR_INVALID_PARAMETER;

+            return lastRC;

+        }

+    }

+    else {

+#endif //__linux__

+        if (hashnewpwd) {

+            DtaHashPwd(hash, newpassword, this);

+        }

+        else {

+            hash.push_back(0xd0);

+            hash.push_back((uint8_t)strnlen(newpassword, 255));

+            for (uint16_t i = 0; i < strnlen(newpassword, 255); i++) {

+                hash.push_back(newpassword[i]);

+            }

+        }

+#ifdef __linux__

+    }

+#endif //__linux__

+

 	if ((lastRC = setTable(table, OPAL_TOKEN::PIN, hash)) != 0) {

 		LOG(E) << "Unable to set new SID password ";

 		delete session;

@@ -1833,4 +1889,22 @@ uint8_t DtaDevOpal::rawCmd(char *sp, char * hexauth, char *pass,

 	delete session;

 	LOG(D1) << "Exiting DtaDevEnterprise::rawCmd";

 	return 0;

-}

\ No newline at end of file

+}

+#ifdef __linux__

+uint8_t DtaDevOpal::askNewPassword(std::string &password, bool confirm) {

+    uint8_t lastRC = OPALSTATUSCODE::SUCCESS;

+    password = GetPassPhrase("Please enter the new password ");

+

+    if (confirm) {

+        std::string pwdcheck = GetPassPhrase("Please confirm the new password ");

+

+        if (password != pwdcheck) {

+            password.clear();

+            lastRC = OPALSTATUSCODE::FAIL;

+        }

+    }

+

+    return lastRC;

+}

+#endif //__linux__

+

diff --git a/Common/DtaDevOpal.h b/Common/DtaDevOpal.h

index 60004db4..389b97f9 100644

--- a/Common/DtaDevOpal.h

+++ b/Common/DtaDevOpal.h

@@ -61,8 +61,9 @@ class DtaDevOpal : public DtaDevOS {

 	virtual uint16_t comID() = 0;

         /** Change the SID password from it's MSID default 

          * @param newpassword  new password for SID 

+         * @param securemode is the new password should be interactively asked

          */

-	uint8_t takeOwnership(char * newpassword);

+	uint8_t takeOwnership(char * newpassword, bool securemode = false);

         /** retrieve the MSID password */

 	uint8_t printDefaultPassword();

         /** retrieve a single row from a table 

@@ -78,9 +79,10 @@ class DtaDevOpal : public DtaDevOS {

          * @param newpassword  value password is to be changed to

          * @param hasholdpwd  is the old password to be hashed before being added to the bytestream

          * @param hashnewpwd  is the new password to be hashed before being added to the bytestream

+         * @param securemode is the new password should be interactively asked

          */ 

 	uint8_t setSIDPassword(char * oldpassword, char * newpassword,

-		uint8_t hasholdpwd = 1, uint8_t hashnewpwd = 1);

+		uint8_t hasholdpwd = 1, uint8_t hashnewpwd = 1, bool securemode = false);

          /** set a single column in an object table 

          * @param table the UID of the table

          * @param name the column name to be set

@@ -143,14 +145,16 @@ class DtaDevOpal : public DtaDevOS {

          * @param password  current password

          * @param userid the userid whose password is to be changed 

          * @param newpassword  value password is to be changed to

+         * @param securemode is the new password should be interactively asked

          */

-	uint8_t setPassword(char * password, char * userid, char * newpassword);

+	uint8_t setPassword(char * password, char * userid, char * newpassword, bool securemode = false);

 	/** Set the password of a locking SP user in Single User Mode.

          * @param password  current user password

          * @param userid the userid whose password is to be changed

          * @param newpassword  value password is to be changed to

+         * @param securemode is the new password should be interactively asked

          */

-	uint8_t setNewPassword_SUM(char * password, char * userid, char * newpassword);

+	uint8_t setNewPassword_SUM(char * password, char * userid, char * newpassword, bool securemode = false);

         /** User command to manipulate the state of a locking range.

          * RW|RO|LK are the supported states @see OPAL_LOCKINGSTATE

          * @param lockingrange locking range number

@@ -229,16 +233,18 @@ class DtaDevOpal : public DtaDevOS {

         /** User command to prepare the device for management by sedutil. 

          * Specific to the SSC that the device supports

          * @param password the password that is to be assigned to the SSC master entities 

+         * @param securemode is the new password should be interactively asked

          */

-	uint8_t initialSetup(char * password);

+	uint8_t initialSetup(char * password, bool securemode);

 	/** User command to prepare the drive for Single User Mode and rekey a SUM locking range.

          * @param lockingrange locking range number to enable

          * @param start LBA to start locking range

          * @param length length (in blocks) for locking range

          * @param Admin1Password admin1 password for TPer

          * @param password User password to set for locking range

+         * @param securemode is the new password should be interactively asked

          */

-        uint8_t setup_SUM(uint8_t lockingrange, uint64_t start, uint64_t length, char *Admin1Password, char * password);

+        uint8_t setup_SUM(uint8_t lockingrange, uint64_t start, uint64_t length, char *Admin1Password, char * password, bool securemode = false);

           /** Displays the identify and discovery 0 information */

 	void puke();

          /** Dumps an object for diagnostic purposes

@@ -289,4 +295,12 @@ class DtaDevOpal : public DtaDevOS {

 	 */

 	lrStatus_t getLockingRange_status(uint8_t lockingrange, char * password);

+    /** Ask the user to input a new password.

+      * This function fails if the first password and it's confirmation differs

+      * @param password The new password entered by the user

+      * @param confirm Is a double check necessary

+      */

+#ifdef __linux__

+    uint8_t askNewPassword(std::string &password, bool confirm = false);

+#endif //__linux__

 };