crypt/opencryptoki
1
0
Fork 0
mirror of https://github.com/opencryptoki/opencryptoki.git synced 2026-10-28 18:37:25 +03:00
Code Releases Activity

Check CKA_WRAP and CKA_UNWRAP also for token specific wrap/unwrap

Browse Source 
C_WrapKey must check for CKA_WRAP also if the token provides a token specific
wrap function. C_UnwrapKey must check for CKA_UNWRAP also if the token provides
a token specific unwrap function.

If the token does not provide wrap/unwrap functions, then the flags are already
checked by encrypt/decrypt manager.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2020-10-29 13:09:17 +01:00
committed by Patrick Steuer
parent 16413bcd28
commit cd1cdcb928
1 changed files with 29 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
usr/lib/common/key_mgr.c
View File

@@ -573,6 +573,20 @@ CK_RV key_mgr_wrap_key(STDLL_TokData_t *tokdata,
goto done;
}
rc = template_attribute_get_bool(wrapping_key_obj->template, CKA_WRAP,
&flag);
if (rc != CKR_OK) {
TRACE_ERROR("Could not find CKA_WRAP for the wrapping key.\n");
rc = CKR_KEY_FUNCTION_NOT_PERMITTED;
goto done;
}
if (flag == FALSE) {
TRACE_ERROR("CKA_WRAP is set to FALSE.\n");
rc = CKR_KEY_FUNCTION_NOT_PERMITTED;
goto done;
}
/* Is a wrapping key with CKA_TRUSTED = CK_TRUE required? */
rc = template_attribute_get_bool(key_obj->template, CKA_WRAP_WITH_TRUSTED,
&flag);
@@ -888,7 +902,7 @@ CK_RV key_mgr_unwrap_key(STDLL_TokData_t *tokdata,
CK_BYTE *data = NULL;
CK_ULONG data_len;
CK_ULONG keyclass = 0, keytype = 0, priv_keytype = 0;
CK_BBOOL fromend, not_opaque = FALSE;
CK_BBOOL fromend, not_opaque = FALSE, flag;
CK_RV rc;
if (!sess || !wrapped_key || !h_unwrapped_key) {
@@ -905,6 +919,20 @@ CK_RV key_mgr_unwrap_key(STDLL_TokData_t *tokdata,
goto done;
}
rc = template_attribute_get_bool(unwrapping_key_obj->template, CKA_UNWRAP,
&flag);
if (rc != CKR_OK) {
TRACE_ERROR("Could not find CKA_UNWRAP for the key.\n");
rc = CKR_KEY_FUNCTION_NOT_PERMITTED;
goto done;
}
if (flag == FALSE) {
TRACE_ERROR("CKA_UNWRAP is set to FALSE.\n");
rc = CKR_KEY_FUNCTION_NOT_PERMITTED;
goto done;
}
/*
* pkcs11v2-20
* C_WrapKey can be used in following situations: