kmsAttributeUtil.c revision 4f14b0f29aa144cc03efdde5508ae126ae197acf
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*
*/
#include <stdlib.h>
#include <string.h>
#include <security/cryptoki.h>
#include <aes_impl.h>
#include "kmsGlobal.h"
#include "kmsObject.h"
#include "kmsSession.h"
#include "kmsSlot.h"
/*
* This attribute table is used by the kms_lookup_attr()
* to validate the attributes.
*/
CK_ATTRIBUTE_TYPE attr_map[] = {
};
/*
* attributes that exists only in secret key objects
* Note: some attributes may also exist in one or two
* other object classes, but they are also listed
* because not all object have them.
*/
{
};
/*
* Validate the attribute by using binary search algorithm.
*/
{
lower = 0;
/* Always starts from middle. */
/* Adjust the lower bound to upper half. */
continue;
}
/* Found it. */
return (CKR_OK);
}
/* Adjust the upper bound to lower half. */
continue;
}
}
/* Failed to find the matching attribute from the attribute table. */
return (CKR_ATTRIBUTE_TYPE_INVALID);
}
/*
* Validate the attribute by using the following search algorithm:
*
* 1) Search for the most frequently used attributes first.
* 2) If not found, search for the usage-purpose attributes - these
* attributes have dense set of values, therefore compiler will
* optimize it with a branch table and branch to the appropriate
* case.
* 3) If still not found, use binary search for the rest of the
* attributes in the attr_map[] table.
*/
{
CK_ULONG i;
for (i = 0; i < ulAttrNum; i++) {
/* First tier search */
case CKA_CLASS:
break;
case CKA_TOKEN:
break;
case CKA_KEY_TYPE:
break;
case CKA_VALUE:
break;
case CKA_VALUE_LEN:
break;
case CKA_VALUE_BITS:
break;
default:
/* Second tier search */
case CKA_ENCRYPT:
break;
case CKA_DECRYPT:
break;
case CKA_WRAP:
break;
case CKA_UNWRAP:
break;
case CKA_SIGN:
break;
case CKA_SIGN_RECOVER:
break;
case CKA_VERIFY:
break;
case CKA_VERIFY_RECOVER:
break;
case CKA_DERIVE:
break;
default:
/* Third tier search */
return (rv);
break;
}
break;
}
}
return (rv);
}
/*
* Clean up and release all the storage in the extra attribute list
* of an object.
*/
void
{
return;
while (extra_attr) {
/*
* All extra attributes in the extra attribute
* list have pValue points to the value of the
* attribute (with simple byte array type).
* Free the storage for the value of the attribute.
*/
/* Free the storage for the attribute_info struct. */
extra_attr = tmp;
}
}
/*
* Create the attribute_info struct to hold the object's attribute,
* and add it to the extra attribute list of an object.
*/
{
/* Allocate the storage for the attribute_info struct. */
return (CKR_HOST_MEMORY);
}
/* Set up attribute_info struct. */
(template->ulValueLen > 0)) {
/* Allocate storage for the value of the attribute. */
return (CKR_HOST_MEMORY);
}
} else {
}
/* Insert the new attribute in front of extra attribute list. */
} else {
}
return (CKR_OK);
}
/*
* Copy the attribute_info struct from the old object to a new attribute_info
* struct, and add that new struct to the extra attribute list of the new
* object.
*/
{
/* Allocate attribute_info struct. */
return (CKR_HOST_MEMORY);
}
return (CKR_HOST_MEMORY);
}
} else {
}
/* Insert the new attribute in front of extra attribute list */
} else {
}
return (CKR_OK);
}
/*
* Get the attribute triple from the extra attribute list in the object
* (if the specified attribute type is found), and copy it to a template.
* Note the type of the attribute to be copied is specified by the template,
* and the storage is pre-allocated for the atrribute value in the template
* for doing the copy.
*/
{
while (extra_attr) {
/* Found it. */
break;
} else {
/* Does not match, try next one. */
}
}
if (extra_attr == NULL) {
/* A valid but un-initialized attribute. */
template->ulValueLen = 0;
return (CKR_OK);
}
/*
* We found the attribute in the extra attribute list.
*/
return (CKR_OK);
}
/*
* The buffer provided by the application is large
* enough to hold the value of the attribute.
*/
return (CKR_OK);
} else {
/*
* The buffer provided by the application does
* not have enough space to hold the value.
*/
return (CKR_BUFFER_TOO_SMALL);
}
}
/*
* Modify the attribute triple in the extra attribute list of the object
* if the specified attribute type is found. Otherwise, just add it to
* list.
*/
{
while (extra_attr) {
/* Found it. */
break;
} else {
/* Does not match, try next one. */
}
}
if (extra_attr == NULL) {
/*
* This attribute is a new one, go ahead adding it to
* the extra attribute list.
*/
}
/* We found the attribute in the extra attribute list. */
(template->ulValueLen > 0)) {
/* The old buffer is too small to hold the new value. */
/* Free storage for the old attribute value. */
/* Allocate storage for the new attribute value. */
return (CKR_HOST_MEMORY);
}
}
/* Replace the attribute with new value. */
} else {
}
return (CKR_OK);
}
/*
* Copy the boolean data type attribute value from an object for the
* specified attribute to the template.
*/
{
return (CKR_OK);
}
/*
* The buffer provided by the application is large
* enough to hold the value of the attribute.
*/
} else {
}
return (CKR_OK);
} else {
/*
* The buffer provided by the application does
* not have enough space to hold the value.
*/
return (CKR_BUFFER_TOO_SMALL);
}
}
/*
* Set the boolean data type attribute value in the object.
*/
{
else
return (CKR_OK);
}
/*
* Copy the CK_ULONG data type attribute value from an object to the
* template.
*/
{
return (CKR_OK);
}
/*
* The buffer provided by the application is large
* enough to hold the value of the attribute.
*/
return (CKR_OK);
} else {
/*
* The buffer provided by the application does
* not have enough space to hold the value.
*/
return (CKR_BUFFER_TOO_SMALL);
}
}
{
(src->ulValueLen > 0)) {
/* Allocate storage for the value of the attribute. */
return (CKR_HOST_MEMORY);
}
src->ulValueLen);
} else {
dest->ulValueLen = 0;
}
return (CKR_OK);
}
void
{
template->ulValueLen = 0;
}
}
/*
* Parse the common attributes. Return to caller with appropriate return
* value to indicate if the supplied template specifies a valid attribute
* with a valid value.
*/
static CK_RV
{
case CKA_CLASS:
break;
case CKA_TOKEN:
*attr_mask_p |= TOKEN_BOOL_ON;
break;
case CKA_PRIVATE:
/*
* Cannot create a private object if the token
* has a keystore and the user isn't logged in.
*/
} else {
}
}
break;
case CKA_MODIFIABLE:
}
break;
case CKA_LABEL:
break;
default:
}
return (rv);
}
/*
* Build a Secret Key Object.
*
* - Parse the object's template, and when an error is detected such as
* invalid attribute type, invalid attribute value, etc., return
* with appropriate return value.
* - Set up attribute mask field in the object for the supplied common
* attributes that have boolean type.
* - Build the attribute_info struct to hold the value of each supplied
* attribute that has byte array type. Link attribute_info structs
* together to form the extra attribute list of the object.
* - Allocate storage for the Secret Key object.
* - Build the Secret Key object. Allocate storage to hold the big integer
* value for the attribute CKA_VALUE that is required for all the key
* types supported by secret key object.
*
*/
{
int i;
int isLabel = 0;
/* Must not set flags */
int isValueLen = 0;
/*
* If the object was pulled from the KMS, the
* attributes are encoded in the object record
* before this function is called, we don't
* want to overwrite them unless the attribute
* template says differently.
*/
if (new_object->bool_attr_mask != 0)
else
/* Allocate storage for Secret Key Object. */
goto fail_cleanup;
}
for (i = 0; i < ulAttrNum; i++) {
/* Secret Key Object Attributes */
/* common key attributes */
case CKA_KEY_TYPE:
break;
case CKA_ID:
case CKA_START_DATE:
case CKA_END_DATE:
/*
* Allocate storage to hold the attribute
* value with byte array type, and add it to
* the extra attribute list of the object.
*/
goto fail_cleanup;
}
break;
/*
* The following key related attribute types must
* not be specified by C_CreateObject.
*/
case CKA_LOCAL:
case CKA_KEY_GEN_MECHANISM:
case CKA_ALWAYS_SENSITIVE:
case CKA_NEVER_EXTRACTABLE:
goto fail_cleanup;
/* Key related boolean attributes */
case CKA_DERIVE:
break;
case CKA_SENSITIVE:
break;
case CKA_ENCRYPT:
else
attr_mask &= ~ENCRYPT_BOOL_ON;
break;
case CKA_DECRYPT:
else
attr_mask &= ~DECRYPT_BOOL_ON;
break;
case CKA_SIGN:
else
attr_mask &= ~SIGN_BOOL_ON;
break;
case CKA_VERIFY:
else
attr_mask &= ~VERIFY_BOOL_ON;
break;
case CKA_WRAP:
break;
case CKA_UNWRAP:
break;
case CKA_EXTRACTABLE:
else
break;
case CKA_VALUE:
if ((template[i].ulValueLen == 0) ||
goto fail_cleanup;
}
/*
* Copyin attribute from template
* to a local variable.
*/
goto fail_cleanup;
}
template[i].ulValueLen);
break;
case CKA_VALUE_LEN:
isValueLen = 1;
sck->sk_value_len =
else
sck->sk_value_len = 0;
break;
case CKA_LABEL:
isLabel = 1;
&template[i]);
goto fail_cleanup;
break;
default:
goto fail_cleanup;
break;
}
} /* For */
goto fail_cleanup;
}
/* Supported key types of the Secret Key Object */
switch (keytype) {
case CKK_AES:
if (!isValueLen) {
goto fail_cleanup;
}
goto fail_cleanup;
}
break;
case CKK_RC4:
case CKK_GENERIC_SECRET:
case CKK_BLOWFISH:
case CKK_DES:
case CKK_DES2:
case CKK_DES3:
default:
goto fail_cleanup;
}
/* Set up object. */
if (isLabel) {
goto fail_cleanup;
}
return (rv);
/*
* cleanup the storage allocated to the local variables.
*/
/*
* cleanup the storage allocated inside the object itself.
*/
return (rv);
}
/*
* Validate the attribute types in the object's template. Then,
* call the appropriate build function according to the class of
* the object specified in the template.
*
* Note: The following classes of objects are supported:
* - CKO_SECRET_KEY
*/
{
return (CKR_ARGUMENTS_BAD);
}
/* Validate the attribute type in the template. */
return (rv);
return (CKR_TEMPLATE_INCOMPLETE);
/*
* Call the appropriate function based on the supported class
* of the object.
*/
switch (class) {
case CKO_SECRET_KEY:
break;
case CKO_DOMAIN_PARAMETERS:
case CKO_DATA:
case CKO_CERTIFICATE:
case CKO_HW_FEATURE:
case CKO_VENDOR_DEFINED:
case CKO_PUBLIC_KEY:
case CKO_PRIVATE_KEY:
default:
return (CKR_ATTRIBUTE_VALUE_INVALID);
}
return (rv);
}
/*
* Get the value of a requested attribute that is common to all supported
* classes (i.e. public key, private key, secret key classes).
*/
{
case CKA_CLASS:
template));
/* default boolean attributes */
case CKA_TOKEN:
return (CKR_OK);
}
break;
case CKA_PRIVATE:
return (CKR_OK);
}
} else {
}
break;
case CKA_MODIFIABLE:
return (CKR_OK);
}
else
break;
case CKA_LABEL:
return (get_extra_attr_from_object(object_p,
template));
break;
default:
/*
* The specified attribute for the object is invalid.
* (the object does not possess such an attribute.)
*/
return (CKR_ATTRIBUTE_TYPE_INVALID);
}
return (rv);
}
/*
* Get the value of a requested attribute that is common to all key objects
* (i.e. public key, private key and secret key).
*/
{
case CKA_KEY_TYPE:
template));
case CKA_ID:
case CKA_START_DATE:
case CKA_END_DATE:
/*
* The above extra attributes have byte array type.
*/
return (get_extra_attr_from_object(object_p,
template));
/* Key related boolean attributes */
case CKA_LOCAL:
return (get_bool_attr_from_object(object_p,
case CKA_DERIVE:
return (get_bool_attr_from_object(object_p,
case CKA_KEY_GEN_MECHANISM:
template));
default:
return (CKR_ATTRIBUTE_TYPE_INVALID);
}
}
/*
* Get the value of a requested attribute of a Secret Key Object.
*
* Rule: All the attributes in the secret key object can be revealed
* except those marked with footnote number "7" when the object
* has its CKA_SENSITIVE attribute set to TRUE or its
* CKA_EXTRACTABLE attribute set to FALSE.
*/
{
/* Key related boolean attributes */
case CKA_SENSITIVE:
return (get_bool_attr_from_object(object_p,
case CKA_ENCRYPT:
return (get_bool_attr_from_object(object_p,
case CKA_DECRYPT:
return (get_bool_attr_from_object(object_p,
case CKA_SIGN:
return (get_bool_attr_from_object(object_p,
SIGN_BOOL_ON, template));
case CKA_VERIFY:
return (get_bool_attr_from_object(object_p,
case CKA_WRAP:
return (get_bool_attr_from_object(object_p,
WRAP_BOOL_ON, template));
case CKA_UNWRAP:
return (get_bool_attr_from_object(object_p,
case CKA_EXTRACTABLE:
return (get_bool_attr_from_object(object_p,
case CKA_ALWAYS_SENSITIVE:
return (get_bool_attr_from_object(object_p,
case CKA_NEVER_EXTRACTABLE:
return (get_bool_attr_from_object(object_p,
case CKA_VALUE:
/*
* If the specified attribute for the secret key object
* cannot be revealed because the object is sensitive
* or unextractable, then the ulValueLen is set to -1.
*/
return (CKR_ATTRIBUTE_SENSITIVE);
}
switch (keytype) {
case CKK_AES:
/*
* Copy secret key object attributes to template.
*/
return (CKR_OK);
}
template->ulValueLen = 0;
return (CKR_OK);
}
if (template->ulValueLen >=
return (CKR_OK);
} else {
return (CKR_BUFFER_TOO_SMALL);
}
case CKK_RC4:
case CKK_GENERIC_SECRET:
case CKK_RC5:
case CKK_DES:
case CKK_DES2:
case CKK_DES3:
case CKK_CDMF:
case CKK_BLOWFISH:
default:
break;
}
break;
case CKA_VALUE_LEN:
template));
default:
/*
* First, get the value of the request attribute defined
* in the list of common key attributes. If the request
* attribute is not found in that list, then get the
* attribute from the list of common attributes.
*/
if (rv == CKR_ATTRIBUTE_TYPE_INVALID) {
}
break;
}
return (rv);
}
/*
* Call the appropriate get attribute function according to the class
* of object.
*
* The caller of this function holds the lock on the object.
*/
{
switch (class) {
case CKO_SECRET_KEY:
break;
case CKO_PRIVATE_KEY:
case CKO_PUBLIC_KEY:
default:
/*
* If the specified attribute for the object is invalid
* (the object does not possess such as attribute), then
* the ulValueLen is modified to hold the value -1.
*/
return (CKR_ATTRIBUTE_TYPE_INVALID);
}
return (rv);
}
/*
* Set the value of an attribute that is common to all key objects
* (i.e. public key, private key and secret key).
*/
static CK_RV
{
case CKA_LABEL:
/*
* Only the LABEL can be modified in the common storage
* object attributes after the object is created.
*/
return (set_extra_attr_to_object(object_p,
case CKA_ID:
return (set_extra_attr_to_object(object_p,
case CKA_START_DATE:
return (set_extra_attr_to_object(object_p,
case CKA_END_DATE:
return (set_extra_attr_to_object(object_p,
CKA_END_DATE, template));
case CKA_DERIVE:
return (set_bool_attr_to_object(object_p,
case CKA_CLASS:
case CKA_KEY_TYPE:
case CKA_LOCAL:
return (CKR_ATTRIBUTE_READ_ONLY);
case CKA_PRIVATE:
if (!copy) {
/* called from C_SetAttributeValue() */
return (CKR_ATTRIBUTE_READ_ONLY);
}
/* called from C_CopyObject() */
return (CKR_OK);
}
/*
* Cannot create a private object if the token
* has a keystore and the user isn't logged in.
*/
} else {
}
return (rv);
case CKA_MODIFIABLE:
if (copy) {
} else {
}
return (rv);
default:
return (CKR_TEMPLATE_INCONSISTENT);
}
}
/*
* Set the value of an attribute of a Secret Key Object.
*
* Rule: The attributes marked with footnote number "8" in the PKCS11
* spec may be modified (p.88 in PKCS11 spec.).
*/
static CK_RV
{
case CKA_SENSITIVE:
/*
* Cannot set SENSITIVE to FALSE if it is already ON.
*/
return (CKR_ATTRIBUTE_READ_ONLY);
}
return (CKR_OK);
case CKA_ENCRYPT:
return (set_bool_attr_to_object(object_p,
case CKA_DECRYPT:
return (set_bool_attr_to_object(object_p,
case CKA_SIGN:
return (set_bool_attr_to_object(object_p,
SIGN_BOOL_ON, template));
case CKA_VERIFY:
return (set_bool_attr_to_object(object_p,
case CKA_WRAP:
return (set_bool_attr_to_object(object_p,
WRAP_BOOL_ON, template));
case CKA_UNWRAP:
return (set_bool_attr_to_object(object_p,
case CKA_EXTRACTABLE:
/*
* Cannot set EXTRACTABLE to TRUE if it is already OFF.
*/
return (CKR_ATTRIBUTE_READ_ONLY);
}
return (CKR_OK);
case CKA_VALUE:
return (CKR_ATTRIBUTE_READ_ONLY);
case CKA_VALUE_LEN:
(keytype == CKK_GENERIC_SECRET) ||
(keytype == CKK_BLOWFISH))
return (CKR_ATTRIBUTE_READ_ONLY);
break;
default:
/*
* Set the value of a common key attribute.
*/
return (kms_set_common_key_attribute(object_p,
}
/*
* If we got this far, then the combination of key type
* and requested attribute is invalid.
*/
return (CKR_ATTRIBUTE_TYPE_INVALID);
}
/*
* Call the appropriate set attribute function according to the class
* of object.
*
* The caller of this function does not hold the lock on the original
* object, since this function is setting the attribute on the new object
* that is being modified.
*
*/
{
switch (class) {
case CKO_SECRET_KEY:
copy);
break;
case CKO_PUBLIC_KEY:
case CKO_PRIVATE_KEY:
default:
/*
* If the template specifies a value of an attribute
* which is incompatible with other existing attributes
* of the object, then fails with return code
* CKR_TEMPLATE_INCONSISTENT.
*/
break;
}
return (rv);
}
{
return (CKR_HOST_MEMORY);
}
/* copy the secret key value */
return (CKR_HOST_MEMORY);
}
return (CKR_OK);
}
/*
* If CKA_CLASS not given, guess CKA_CLASS using
* attributes on template.
*
* Some attributes are specific to an object class. If one or more
* of these attributes are in the template, make a list of classes
* that can have these attributes. This would speed up the search later,
* because we can immediately skip an object if the class of that
* object can not possibly contain one of the attributes.
*
*/
void
{
ulong_t i;
int j;
int num_secret_key_attrs;
int num_pclasses = 0;
for (i = 0; i < ulCount; i++) {
/*
* don't need to guess the class, it is specified.
* Just record the class, and return.
*/
pclasses[0] =
*num_result_pclasses = 1;
return;
}
}
sizeof (SECRET_KEY_ATTRS) / sizeof (CK_ATTRIBUTE_TYPE);
/*
* Get the list of objects class that might contain
* some attributes.
*/
for (i = 0; i < ulCount; i++) {
if (!secret_found) {
for (j = 0; j < num_secret_key_attrs; j++) {
pclasses[num_pclasses++] =
break;
}
}
}
}
}
{
ulong_t i;
/*
* Check if the class of this object match with any
* of object classes that can possibly contain the
* requested attributes.
*/
if (num_pclasses > 0) {
for (i = 0; i < num_pclasses; i++) {
break;
}
}
if (i == num_pclasses) {
/*
* this object can't possibly contain one or
* more attributes, don't need to check this object
*/
return (B_FALSE);
}
}
/* need to examine everything */
for (i = 0; i < num_attr; i++) {
/* First, check the most common attributes */
case CKA_CLASS:
return (B_FALSE);
}
break;
case CKA_KEY_TYPE:
return (B_FALSE);
}
break;
case CKA_ENCRYPT:
break;
case CKA_DECRYPT:
break;
case CKA_WRAP:
break;
case CKA_UNWRAP:
break;
case CKA_SIGN:
break;
case CKA_SIGN_RECOVER:
break;
case CKA_VERIFY:
break;
case CKA_VERIFY_RECOVER:
break;
case CKA_DERIVE:
break;
case CKA_LOCAL:
break;
case CKA_SENSITIVE:
break;
case CKA_SECONDARY_AUTH:
break;
case CKA_TRUSTED:
break;
case CKA_EXTRACTABLE:
break;
case CKA_ALWAYS_SENSITIVE:
break;
case CKA_NEVER_EXTRACTABLE:
break;
case CKA_TOKEN:
break;
case CKA_PRIVATE:
break;
case CKA_MODIFIABLE:
break;
case CKA_SUBJECT:
case CKA_ID:
case CKA_START_DATE:
case CKA_END_DATE:
case CKA_KEY_GEN_MECHANISM:
case CKA_LABEL:
/* find these attributes from extra_attrlistp */
break;
case CKA_VALUE_LEN:
/* only secret key has this attribute */
OBJ_SEC_VALUE_LEN(obj)) {
return (B_FALSE);
}
} else {
return (B_FALSE);
}
break;
case CKA_VALUE:
case CKO_SECRET_KEY:
break;
default:
return (B_FALSE);
}
break;
case CKA_VALUE_BITS:
case CKA_PRIME_BITS:
case CKA_SUBPRIME_BITS:
default:
/*
* any other attributes are currently not supported.
* so, it's not possible for them to be in the
* object
*/
return (B_FALSE);
}
if (compare_boolean) {
if (attr_mask) {
} else {
}
return (B_FALSE);
}
} else if (compare_attr) {
/*
* The attribute type is valid, and its value
* has not been initialized in the object. In
* this case, it only matches the template's
* attribute if the template's value length
* is 0.
*/
if (tmpl_attr->ulValueLen != 0)
return (B_FALSE);
} else {
if (tmpl_attr->ulValueLen !=
obj_attr->ulValueLen) {
return (B_FALSE);
}
tmpl_attr->ulValueLen) != 0) {
return (B_FALSE);
}
}
}
}
return (B_TRUE);
}
{
}
}
/* if get there, the specified attribute is not found */
return (NULL);
}