Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix C_GetMechanismInfo to fail on non-allowed mechanisms #648

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Fix C_GetMechanismInfo to fail on non-allowed mechanisms #648

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eb398b8
Respect allowed mechanisms also in C_GetMechanismInfo
Jakuje Sep 6, 2021
c6bdb9a
tests: Verify the C_GetMechanismInfo does fails for not allowed mecha…
Jakuje Sep 6, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 24 additions & 17 deletions src/lib/SoftHSM.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -932,6 +932,8 @@ CK_RV SoftHSM::C_GetMechanismInfo(CK_SLOT_ID slotID, CK_MECHANISM_TYPE type, CK_
{
return CKR_SLOT_ID_INVALID;
}
if (!isMechanismPermitted(NULL, type))
return CKR_MECHANISM_INVALID;

AsymmetricAlgorithm* rsa = CryptoFactory::i()->getAsymmetricAlgorithm(AsymAlgo::RSA);
if (rsa != NULL)
Expand Down Expand Up @@ -2186,7 +2188,7 @@ CK_RV SoftHSM::SymEncryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech
return CKR_KEY_FUNCTION_NOT_PERMITTED;

// Check if the specified mechanism is allowed for the key
if (!isMechanismPermitted(key, pMechanism))
if (!isMechanismPermitted(key, pMechanism->mechanism))
return CKR_MECHANISM_INVALID;

// Get key info
Expand Down Expand Up @@ -2916,7 +2918,7 @@ CK_RV SoftHSM::SymDecryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech


// Check if the specified mechanism is allowed for the key
if (!isMechanismPermitted(key, pMechanism))
if (!isMechanismPermitted(key, pMechanism->mechanism))
return CKR_MECHANISM_INVALID;

// Get key info
Expand Down Expand Up @@ -3164,7 +3166,7 @@ CK_RV SoftHSM::AsymDecryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMec
return CKR_KEY_FUNCTION_NOT_PERMITTED;

// Check if the specified mechanism is allowed for the key
if (!isMechanismPermitted(key, pMechanism))
if (!isMechanismPermitted(key, pMechanism->mechanism))
return CKR_MECHANISM_INVALID;

// Get key info
Expand Down Expand Up @@ -3966,7 +3968,7 @@ CK_RV SoftHSM::MacSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechani
return CKR_KEY_FUNCTION_NOT_PERMITTED;

// Check if the specified mechanism is allowed for the key
if (!isMechanismPermitted(key, pMechanism))
if (!isMechanismPermitted(key, pMechanism->mechanism))
return CKR_MECHANISM_INVALID;

// Get key info
Expand Down Expand Up @@ -4118,7 +4120,7 @@ CK_RV SoftHSM::AsymSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechan
return CKR_KEY_FUNCTION_NOT_PERMITTED;

// Check if the specified mechanism is allowed for the key
if (!isMechanismPermitted(key, pMechanism))
if (!isMechanismPermitted(key, pMechanism->mechanism))
return CKR_MECHANISM_INVALID;

// Get the asymmetric algorithm matching the mechanism
Expand Down Expand Up @@ -4944,7 +4946,7 @@ CK_RV SoftHSM::MacVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMecha
return CKR_KEY_FUNCTION_NOT_PERMITTED;

// Check if the specified mechanism is allowed for the key
if (!isMechanismPermitted(key, pMechanism))
if (!isMechanismPermitted(key, pMechanism->mechanism))
return CKR_MECHANISM_INVALID;

// Get key info
Expand Down Expand Up @@ -5096,7 +5098,7 @@ CK_RV SoftHSM::AsymVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech
return CKR_KEY_FUNCTION_NOT_PERMITTED;

// Check if the specified mechanism is allowed for the key
if (!isMechanismPermitted(key, pMechanism))
if (!isMechanismPermitted(key, pMechanism->mechanism))
return CKR_MECHANISM_INVALID;

// Get the asymmetric algorithm matching the mechanism
Expand Down Expand Up @@ -6549,7 +6551,7 @@ CK_RV SoftHSM::C_WrapKey
return CKR_KEY_FUNCTION_NOT_PERMITTED;

// Check if the specified mechanism is allowed for the wrapping key
if (!isMechanismPermitted(wrapKey, pMechanism))
if (!isMechanismPermitted(wrapKey, pMechanism->mechanism))
return CKR_MECHANISM_INVALID;

// Check the to be wrapped key handle.
Expand Down Expand Up @@ -7017,7 +7019,7 @@ CK_RV SoftHSM::C_UnwrapKey
return CKR_KEY_FUNCTION_NOT_PERMITTED;

// Check if the specified mechanism is allowed for the unwrap key
if (!isMechanismPermitted(unwrapKey, pMechanism))
if (!isMechanismPermitted(unwrapKey, pMechanism->mechanism))
return CKR_MECHANISM_INVALID;

// Extract information from the template that is needed to create the object.
Expand Down Expand Up @@ -7300,7 +7302,7 @@ CK_RV SoftHSM::C_DeriveKey
return CKR_KEY_FUNCTION_NOT_PERMITTED;

// Check if the specified mechanism is allowed for the key
if (!isMechanismPermitted(key, pMechanism))
if (!isMechanismPermitted(key, pMechanism->mechanism))
return CKR_MECHANISM_INVALID;

// Extract information from the template that is needed to create the object.
Expand Down Expand Up @@ -12858,22 +12860,27 @@ CK_RV SoftHSM::MechParamCheckRSAPKCSOAEP(CK_MECHANISM_PTR pMechanism)
return CKR_OK;
}

bool SoftHSM::isMechanismPermitted(OSObject* key, CK_MECHANISM_PTR pMechanism)
bool SoftHSM::isMechanismPermitted(OSObject* key, CK_MECHANISM_TYPE mechanism)
{
std::list<CK_MECHANISM_TYPE> mechs = supportedMechanisms;
/* First check if the algorithm is enabled in the global configuration */
auto it = std::find(mechs.begin(), mechs.end(), pMechanism->mechanism);
auto it = std::find(mechs.begin(), mechs.end(), mechanism);
if (it == mechs.end())
return false;

OSAttribute attribute = key->getAttribute(CKA_ALLOWED_MECHANISMS);
std::set<CK_MECHANISM_TYPE> allowed = attribute.getMechanismTypeSetValue();
/* If we have object, consult also its allowed mechanisms */
if (key) {
OSAttribute attribute = key->getAttribute(CKA_ALLOWED_MECHANISMS);
std::set<CK_MECHANISM_TYPE> allowed = attribute.getMechanismTypeSetValue();

if (allowed.empty()) {
/* empty allow list means we allowing everything that is built-in */
if (allowed.empty()) {
Jakuje marked this conversation as resolved.
Show resolved Hide resolved
return true;
}
return allowed.find(mechanism) != allowed.end();
} else {
return true;
}

return allowed.find(pMechanism->mechanism) != allowed.end();
}

bool SoftHSM::detectFork(void) {
Expand Down
2 changes: 1 addition & 1 deletion src/lib/SoftHSM.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -489,7 +489,7 @@ class SoftHSM

CK_RV MechParamCheckRSAPKCSOAEP(CK_MECHANISM_PTR pMechanism);

bool isMechanismPermitted(OSObject* key, CK_MECHANISM_PTR pMechanism);
bool isMechanismPermitted(OSObject* key, CK_MECHANISM_TYPE mechanism);
void prepareSupportedMechanisms(std::map<std::string, CK_MECHANISM_TYPE> &t);
bool detectFork(void);
};
Expand Down
15 changes: 15 additions & 0 deletions src/lib/test/InfoTests.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -329,6 +329,7 @@ void InfoTests::testGetMechanismListConfig()
CK_RV rv;
CK_ULONG ulMechCount = 0;
CK_MECHANISM_TYPE_PTR pMechanismList;
CK_MECHANISM_INFO info;

#ifndef _WIN32
setenv("SOFTHSM2_CONF", "./softhsm2-mech.conf", 1);
Expand Down Expand Up @@ -358,6 +359,20 @@ void InfoTests::testGetMechanismListConfig()
CPPUNIT_ASSERT(pMechanismList[1] == CKM_RSA_PKCS);
free(pMechanismList);

/* Get good mechanism info */
rv = CRYPTOKI_F_PTR( C_GetMechanismInfo(m_initializedTokenSlotID, CKM_RSA_X_509, &info) );
CPPUNIT_ASSERT(rv == CKR_OK);
CPPUNIT_ASSERT(info.flags & CKF_SIGN);
rv = CRYPTOKI_F_PTR( C_GetMechanismInfo(m_initializedTokenSlotID, CKM_RSA_PKCS, &info) );
CPPUNIT_ASSERT(rv == CKR_OK);
CPPUNIT_ASSERT(info.flags & CKF_SIGN);

/* Get bad mechanism info */
rv = CRYPTOKI_F_PTR( C_GetMechanismInfo(m_initializedTokenSlotID, CKM_ECDSA, &info) );
CPPUNIT_ASSERT(rv == CKR_MECHANISM_INVALID);
rv = CRYPTOKI_F_PTR( C_GetMechanismInfo(m_initializedTokenSlotID, CKM_DSA, &info) );
CPPUNIT_ASSERT(rv == CKR_MECHANISM_INVALID);

CRYPTOKI_F_PTR( C_Finalize(NULL_PTR) );
#ifndef _WIN32
setenv("SOFTHSM2_CONF", "./softhsm2.conf", 1);
Expand Down