Fix C_GetMechanismInfo to fail on non-allowed mechanisms (#648)

* Respect allowed mechanisms also in C_GetMechanismInfo
* tests: Verify the C_GetMechanismInfo does fails for not allowed mechanisms

Signed-off-by: Jakub Jelen <[email protected]>

Author: Jakuje

src/lib/SoftHSM.cpp

@@ -938,6 +938,8 @@ CK_RV SoftHSM::C_GetMechanismInfo(CK_SLOT_ID slotID, CK_MECHANISM_TYPE type, CK_
 	{
 		return CKR_SLOT_ID_INVALID;
 	}
+	if (!isMechanismPermitted(NULL, type))
+		return CKR_MECHANISM_INVALID;
 
 	AsymmetricAlgorithm* rsa = CryptoFactory::i()->getAsymmetricAlgorithm(AsymAlgo::RSA);
 	if (rsa != NULL)
@@ -2205,7 +2207,7 @@ CK_RV SoftHSM::SymEncryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech
 		return CKR_KEY_FUNCTION_NOT_PERMITTED;
 
 	// Check if the specified mechanism is allowed for the key
-	if (!isMechanismPermitted(key, pMechanism))
+	if (!isMechanismPermitted(key, pMechanism->mechanism))
 		return CKR_MECHANISM_INVALID;
 
 	// Get key info
@@ -2935,7 +2937,7 @@ CK_RV SoftHSM::SymDecryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech
 
 
 	// Check if the specified mechanism is allowed for the key
-	if (!isMechanismPermitted(key, pMechanism))
+	if (!isMechanismPermitted(key, pMechanism->mechanism))
 		return CKR_MECHANISM_INVALID;
 
 	// Get key info
@@ -3183,7 +3185,7 @@ CK_RV SoftHSM::AsymDecryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMec
 		return CKR_KEY_FUNCTION_NOT_PERMITTED;
 
 	// Check if the specified mechanism is allowed for the key
-	if (!isMechanismPermitted(key, pMechanism))
+	if (!isMechanismPermitted(key, pMechanism->mechanism))
 		return CKR_MECHANISM_INVALID;
 
 	// Get key info
@@ -3985,7 +3987,7 @@ CK_RV SoftHSM::MacSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechani
 		return CKR_KEY_FUNCTION_NOT_PERMITTED;
 
 	// Check if the specified mechanism is allowed for the key
-	if (!isMechanismPermitted(key, pMechanism))
+	if (!isMechanismPermitted(key, pMechanism->mechanism))
 		return CKR_MECHANISM_INVALID;
 
 	// Get key info
@@ -4137,7 +4139,7 @@ CK_RV SoftHSM::AsymSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechan
 		return CKR_KEY_FUNCTION_NOT_PERMITTED;
 
 	// Check if the specified mechanism is allowed for the key
-	if (!isMechanismPermitted(key, pMechanism))
+	if (!isMechanismPermitted(key, pMechanism->mechanism))
 		return CKR_MECHANISM_INVALID;
 
 	// Get the asymmetric algorithm matching the mechanism
@@ -4988,7 +4990,7 @@ CK_RV SoftHSM::MacVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMecha
 		return CKR_KEY_FUNCTION_NOT_PERMITTED;
 
 	// Check if the specified mechanism is allowed for the key
-	if (!isMechanismPermitted(key, pMechanism))
+	if (!isMechanismPermitted(key, pMechanism->mechanism))
 		return CKR_MECHANISM_INVALID;
 
 	// Get key info
@@ -5140,7 +5142,7 @@ CK_RV SoftHSM::AsymVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech
 		return CKR_KEY_FUNCTION_NOT_PERMITTED;
 
 	// Check if the specified mechanism is allowed for the key
-	if (!isMechanismPermitted(key, pMechanism))
+	if (!isMechanismPermitted(key, pMechanism->mechanism))
 		return CKR_MECHANISM_INVALID;
 
 	// Get the asymmetric algorithm matching the mechanism
@@ -6721,7 +6723,7 @@ CK_RV SoftHSM::C_WrapKey
 		return CKR_KEY_FUNCTION_NOT_PERMITTED;
 
 	// Check if the specified mechanism is allowed for the wrapping key
-	if (!isMechanismPermitted(wrapKey, pMechanism))
+	if (!isMechanismPermitted(wrapKey, pMechanism->mechanism))
 		return CKR_MECHANISM_INVALID;
 
 	// Check the to be wrapped key handle.
@@ -7350,7 +7352,7 @@ CK_RV SoftHSM::C_UnwrapKey
 		return CKR_KEY_FUNCTION_NOT_PERMITTED;
 
 	// Check if the specified mechanism is allowed for the unwrap key
-	if (!isMechanismPermitted(unwrapKey, pMechanism))
+	if (!isMechanismPermitted(unwrapKey, pMechanism->mechanism))
 		return CKR_MECHANISM_INVALID;
 
 	// Extract information from the template that is needed to create the object.
@@ -7645,7 +7647,7 @@ CK_RV SoftHSM::C_DeriveKey
 		return CKR_KEY_FUNCTION_NOT_PERMITTED;
 
 	// Check if the specified mechanism is allowed for the key
-	if (!isMechanismPermitted(key, pMechanism))
+	if (!isMechanismPermitted(key, pMechanism->mechanism))
 		return CKR_MECHANISM_INVALID;
 
 	// Extract information from the template that is needed to create the object.
@@ -13253,22 +13255,27 @@ CK_RV SoftHSM::MechParamCheckRSAAESKEYWRAP(CK_MECHANISM_PTR pMechanism)
 	return CKR_OK;
 }
 
-bool SoftHSM::isMechanismPermitted(OSObject* key, CK_MECHANISM_PTR pMechanism)
+bool SoftHSM::isMechanismPermitted(OSObject* key, CK_MECHANISM_TYPE mechanism)
 {
 	std::list<CK_MECHANISM_TYPE> mechs = supportedMechanisms;
 	/* First check if the algorithm is enabled in the global configuration */
-	auto it = std::find(mechs.begin(), mechs.end(), pMechanism->mechanism);
+	auto it = std::find(mechs.begin(), mechs.end(), mechanism);
 	if (it == mechs.end())
 		return false;
 
-	OSAttribute attribute = key->getAttribute(CKA_ALLOWED_MECHANISMS);
-	std::set<CK_MECHANISM_TYPE> allowed = attribute.getMechanismTypeSetValue();
+	/* If we have object, consult also its allowed mechanisms */
+	if (key) {
+		OSAttribute attribute = key->getAttribute(CKA_ALLOWED_MECHANISMS);
+		std::set<CK_MECHANISM_TYPE> allowed = attribute.getMechanismTypeSetValue();
 
-	if (allowed.empty()) {
+		/* empty allow list means we allowing everything that is built-in */
+		if (allowed.empty()) {
+			return true;
+		}
+		return allowed.find(mechanism) != allowed.end();
+	} else {
 		return true;
 	}
-
-	return allowed.find(pMechanism->mechanism) != allowed.end();
 }
 
 bool SoftHSM::detectFork(void) {

src/lib/SoftHSM.h

@@ -510,7 +510,7 @@ class SoftHSM
 	CK_RV MechParamCheckRSAPKCSOAEP(CK_MECHANISM_PTR pMechanism);
 	CK_RV MechParamCheckRSAAESKEYWRAP(CK_MECHANISM_PTR pMechanism);
 
-	bool isMechanismPermitted(OSObject* key, CK_MECHANISM_PTR pMechanism);
+	bool isMechanismPermitted(OSObject* key, CK_MECHANISM_TYPE mechanism);
 	void prepareSupportedMechanisms(std::map<std::string, CK_MECHANISM_TYPE> &t);
 	bool detectFork(void);
 };

src/lib/test/InfoTests.cpp

@@ -329,6 +329,7 @@ void InfoTests::testGetMechanismListConfig()
 	CK_RV rv;
 	CK_ULONG ulMechCount = 0;
 	CK_MECHANISM_TYPE_PTR pMechanismList;
+	CK_MECHANISM_INFO info;
 
 #ifndef _WIN32
 	setenv("SOFTHSM2_CONF", "./softhsm2-mech.conf", 1);
@@ -358,6 +359,20 @@ void InfoTests::testGetMechanismListConfig()
 	CPPUNIT_ASSERT(pMechanismList[1] == CKM_RSA_PKCS);
 	free(pMechanismList);
 
+	/* Get good mechanism info */
+	rv = CRYPTOKI_F_PTR( C_GetMechanismInfo(m_initializedTokenSlotID, CKM_RSA_X_509, &info) );
+	CPPUNIT_ASSERT(rv == CKR_OK);
+	CPPUNIT_ASSERT(info.flags & CKF_SIGN);
+	rv = CRYPTOKI_F_PTR( C_GetMechanismInfo(m_initializedTokenSlotID, CKM_RSA_PKCS, &info) );
+	CPPUNIT_ASSERT(rv == CKR_OK);
+	CPPUNIT_ASSERT(info.flags & CKF_SIGN);
+
+	/* Get bad mechanism info */
+	rv = CRYPTOKI_F_PTR( C_GetMechanismInfo(m_initializedTokenSlotID, CKM_ECDSA, &info) );
+	CPPUNIT_ASSERT(rv == CKR_MECHANISM_INVALID);
+	rv = CRYPTOKI_F_PTR( C_GetMechanismInfo(m_initializedTokenSlotID, CKM_DSA, &info) );
+	CPPUNIT_ASSERT(rv == CKR_MECHANISM_INVALID);
+
 	CRYPTOKI_F_PTR( C_Finalize(NULL_PTR) );
 #ifndef _WIN32
 	setenv("SOFTHSM2_CONF", "./softhsm2.conf", 1);