From cd1cdcb92825b6f7cabfbcabb2f2f4e237871914 Mon Sep 17 00:00:00 2001
From: Ingo Franzki <ifranzki@linux.ibm.com>
Date: Thu, 29 Oct 2020 13:09:17 +0100
Subject: [PATCH] Check CKA_WRAP and CKA_UNWRAP also for token specific
 wrap/unwrap

C_WrapKey must check for CKA_WRAP also if the token provides a token specific
wrap function. C_UnwrapKey must check for CKA_UNWRAP also if the token provides
a token specific unwrap function.

If the token does not provide wrap/unwrap functions, then the flags are already
checked by encrypt/decrypt manager.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
---
 usr/lib/common/key_mgr.c | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/usr/lib/common/key_mgr.c b/usr/lib/common/key_mgr.c
index bf2304e1..06cad96e 100644
--- a/usr/lib/common/key_mgr.c
+++ b/usr/lib/common/key_mgr.c
@@ -573,6 +573,20 @@ CK_RV key_mgr_wrap_key(STDLL_TokData_t *tokdata,
         goto done;
     }
 
+    rc = template_attribute_get_bool(wrapping_key_obj->template, CKA_WRAP,
+                                     &flag);
+    if (rc != CKR_OK) {
+        TRACE_ERROR("Could not find CKA_WRAP for the wrapping key.\n");
+        rc = CKR_KEY_FUNCTION_NOT_PERMITTED;
+        goto done;
+    }
+
+    if (flag == FALSE) {
+        TRACE_ERROR("CKA_WRAP is set to FALSE.\n");
+        rc = CKR_KEY_FUNCTION_NOT_PERMITTED;
+        goto done;
+    }
+
     /* Is a wrapping key with CKA_TRUSTED = CK_TRUE required? */
     rc = template_attribute_get_bool(key_obj->template, CKA_WRAP_WITH_TRUSTED,
                                      &flag);
@@ -888,7 +902,7 @@ CK_RV key_mgr_unwrap_key(STDLL_TokData_t *tokdata,
     CK_BYTE *data = NULL;
     CK_ULONG data_len;
     CK_ULONG keyclass = 0, keytype = 0, priv_keytype = 0;
-    CK_BBOOL fromend, not_opaque = FALSE;
+    CK_BBOOL fromend, not_opaque = FALSE, flag;
     CK_RV rc;
 
     if (!sess || !wrapped_key || !h_unwrapped_key) {
@@ -905,6 +919,20 @@ CK_RV key_mgr_unwrap_key(STDLL_TokData_t *tokdata,
         goto done;
     }
 
+    rc = template_attribute_get_bool(unwrapping_key_obj->template, CKA_UNWRAP,
+                                     &flag);
+    if (rc != CKR_OK) {
+        TRACE_ERROR("Could not find CKA_UNWRAP for the key.\n");
+        rc = CKR_KEY_FUNCTION_NOT_PERMITTED;
+        goto done;
+    }
+
+    if (flag == FALSE) {
+        TRACE_ERROR("CKA_UNWRAP is set to FALSE.\n");
+        rc = CKR_KEY_FUNCTION_NOT_PERMITTED;
+        goto done;
+    }
+
     /*
      * pkcs11v2-20
      * C_WrapKey can be used in following situations: