You've already forked opencryptoki
mirror of
https://github.com/opencryptoki/opencryptoki.git
synced 2026-10-24 05:39:17 +03:00
8df74e7c8d
Implement strength and policy parsing and enforce policies in all tokens. The main object of the policy is the struct objstrength which carries the strength of a key along with a flag specifying if the EC is allowed, and a (maximal) signature length if this key is used to sign or verify and the length of the signature depends on the key. A valid strength configuration has to be found. If no policy configuration is found, policies are simply deactivated and keys are only classified according to the strength definition, but can be used without restrictions. If both, a strength and a policy configuration, are available, both have to be valid for OpenCryptoki to start. If either of these two configurations fails to parse or validate, OpenCryptoki will fail with a general error since the system is not in a valid state. The configuration files have to be owned by root:pkcs11 and have to have modes 0640. This is done for security reasons to prevent anybody except root from altering the policy or strength definitions. Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
22 lines
683 B
C
22 lines
683 B
C
/*
|
|
* COPYRIGHT (c) International Business Machines Corp. 2021
|
|
*
|
|
* This program is provided under the terms of the Common Public License,
|
|
* version 1.0 (CPL-1.0). Any use, reproduction or distribution for this
|
|
* software constitutes recipient's acceptance of CPL-1.0 terms which can be
|
|
* found in the file LICENSE file or at
|
|
* https://opensource.org/licenses/cpl1.0.php
|
|
*/
|
|
|
|
#include "pkcs11types.h"
|
|
#include "h_extern.h"
|
|
|
|
CK_RV policy_get_attr_from_template(void *data,
|
|
CK_ATTRIBUTE_TYPE type,
|
|
CK_ATTRIBUTE **attr)
|
|
{
|
|
TEMPLATE *t = data;
|
|
|
|
return template_attribute_get_non_empty(t, type, attr);
|
|
}
|