Skip to content

Comments

Add missing OBJECT_VALIDATION attributes to objects#315

Merged
simo5 merged 5 commits intolatchset:mainfrom
Jakuje:object-validation
Aug 29, 2025
Merged

Add missing OBJECT_VALIDATION attributes to objects#315
simo5 merged 5 commits intolatchset:mainfrom
Jakuje:object-validation

Conversation

@Jakuje
Copy link
Contributor

@Jakuje Jakuje commented Aug 18, 2025

Description

The object validation flags were somehow properly checked in the session for the validation state and missing flags on objects were ignored as they were computed on the fly. But these attributes could never make it to the user as even if they would be set during key generation, they were stripped while saving the attributes to the database (and never set for imported keys).

Fixes also bunch of related issues.

Built on top of #314 to have the build working.

Checklist

  • Test suite updated with functionality tests
  • Test suite updated with negative tests
  • Rustdoc string were added or updated
  • [~] CHANGELOG and/or other documentation added or updated
  • [~] This is not a code change

Reviewer's checklist:

  • Any issues marked for closing are fully addressed
  • There is a test suite reasonably covering new functionality or modifications
  • This feature/change has adequate documentation added
  • A changelog entry is added if the change is significant
  • Code conform to coding style that today cannot yet be enforced via the check style test
  • Commits have short titles and sensible text
  • Doc string are properly updated

@Jakuje Jakuje force-pushed the object-validation branch 2 times, most recently from f0637de to 8979def Compare August 19, 2025 12:57
Jakuje added a commit to Jakuje/kryoptic that referenced this pull request Aug 21, 2025
Cherry-picked from latchset#315

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Copy link
Member

@simo5 simo5 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will cause us to pay the price of key validation on each retrieval ... we may want/need to add some form of caching later...
But otherwise I think this is fine for now.

Jakuje added 5 commits August 29, 2025 11:01
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
The CKA_OBJECT_VALIDATION_FLAGS was removed from the skip attributes
in f541d13 so this block of code
did not run since January.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
@simo5 simo5 force-pushed the object-validation branch from efba240 to ef7bffe Compare August 29, 2025 15:01
@simo5 simo5 merged commit 85cb68d into latchset:main Aug 29, 2025
49 checks passed
@Jakuje
Copy link
Contributor Author

Jakuje commented Aug 29, 2025

This will cause us to pay the price of key validation on each retrieval ... we may want/need to add some form of caching later... But otherwise I think this is fine for now.

The NSS code had e907d3e which basically considered any key in DB valid. I got to think about that only after implementing this change, but it might be also an option to set this attribute for really everything in the DB. But then we would need to be more precise to make sure we do not let in any non-fips objects :) So feel free to open a separate issue if you have some thoughts about this further.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants