Add PKCS#11 3.2 attribute to NSSDB storage

This catches up nssdb to the changes happenning in NSS upstream

Signed-off-by: Simo Sorce <[email protected]>

Author: simo5

src/storage/nssdb/attrs.rs

@@ -43,27 +43,27 @@ const CKA_NSS_EMAIL_DISTRUST_AFTER: CK_ATTRIBUTE_TYPE = NSS_VENDOR_OFFSET + 36;
 
 const NSS_VENDOR_TRUST: CK_ULONG = NSS_VENDOR_OFFSET + 0x2000;
 
-const CKA_TRUST_DIGITAL_SIGNATURE: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 1;
-const CKA_TRUST_NON_REPUDIATION: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 2;
-const CKA_TRUST_KEY_ENCIPHERMENT: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 3;
-const CKA_TRUST_DATA_ENCIPHERMENT: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 4;
-const CKA_TRUST_KEY_AGREEMENT: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 5;
-const CKA_TRUST_KEY_CERT_SIGN: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 6;
-const CKA_TRUST_CRL_SIGN: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 7;
-const CKA_TRUST_SERVER_AUTH: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 8;
-const CKA_TRUST_CLIENT_AUTH: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 9;
-const CKA_TRUST_CODE_SIGNING: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 10;
-const CKA_TRUST_EMAIL_PROTECTION: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 11;
-const CKA_TRUST_IPSEC_END_SYSTEM: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 12;
-const CKA_TRUST_IPSEC_TUNNEL: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 13;
-const CKA_TRUST_IPSEC_USER: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 14;
-const CKA_TRUST_TIME_STAMPING: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 15;
-const CKA_TRUST_STEP_UP_APPROVED: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 16;
+const CKA_NSS_TRUST_DIGITAL_SIGNATURE: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 1;
+const CKA_NSS_TRUST_NON_REPUDIATION: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 2;
+const CKA_NSS_TRUST_KEY_ENCIPHERMENT: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 3;
+const CKA_NSS_TRUST_DATA_ENCIPHERMENT: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 4;
+const CKA_NSS_TRUST_KEY_AGREEMENT: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 5;
+const CKA_NSS_TRUST_KEY_CERT_SIGN: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 6;
+const CKA_NSS_TRUST_CRL_SIGN: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 7;
+const CKA_NSS_TRUST_SERVER_AUTH: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 8;
+const CKA_NSS_TRUST_CLIENT_AUTH: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 9;
+const CKA_NSS_TRUST_CODE_SIGNING: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 10;
+const CKA_NSS_TRUST_EMAIL_PROTECTION: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 11;
+const CKA_NSS_TRUST_IPSEC_END_SYSTEM: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 12;
+const CKA_NSS_TRUST_IPSEC_TUNNEL: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 13;
+const CKA_NSS_TRUST_IPSEC_USER: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 14;
+const CKA_NSS_TRUST_TIME_STAMPING: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 15;
+const CKA_NSS_TRUST_STEP_UP_APPROVED: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 16;
 
-const CKA_CERT_SHA1_HASH: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 100;
-const CKA_CERT_MD5_HASH: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 101;
+const CKA_NSS_CERT_SHA1_HASH: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 100;
+const CKA_NSS_CERT_MD5_HASH: CK_ATTRIBUTE_TYPE = NSS_VENDOR_TRUST + 101;
 
-const NSS_KA_LEN: usize = 121;
+const NSS_KA_LEN: usize = 191;
 
 /// Static array listing all standard and NSS vendor-specific attributes
 /// known and potentially stored by this NSS backend implementation.
@@ -72,6 +72,7 @@ pub static NSS_KNOWN_ATTRIBUTES: [CK_ATTRIBUTE_TYPE; NSS_KA_LEN] = [
     CKA_TOKEN,
     CKA_PRIVATE,
     CKA_LABEL,
+    CKA_UNIQUE_ID,
     CKA_APPLICATION,
     CKA_VALUE,
     CKA_OBJECT_ID,
@@ -87,6 +88,7 @@ pub static NSS_KNOWN_ATTRIBUTES: [CK_ATTRIBUTE_TYPE; NSS_KA_LEN] = [
     CKA_URL,
     CKA_HASH_OF_SUBJECT_PUBLIC_KEY,
     CKA_HASH_OF_ISSUER_PUBLIC_KEY,
+    CKA_NAME_HASH_ALGORITHM,
     CKA_CHECK_VALUE,
     CKA_KEY_TYPE,
     CKA_SUBJECT,
@@ -126,12 +128,34 @@ pub static NSS_KNOWN_ATTRIBUTES: [CK_ATTRIBUTE_TYPE; NSS_KA_LEN] = [
     CKA_ALWAYS_SENSITIVE,
     CKA_KEY_GEN_MECHANISM,
     CKA_MODIFIABLE,
+    CKA_COPYABLE,
+    CKA_DESTROYABLE,
     CKA_EC_PARAMS,
     CKA_EC_POINT,
     DEPRECATED_CKA_SECONDARY_AUTH,
     DEPRECATED_CKA_AUTH_PIN_FLAGS,
     CKA_ALWAYS_AUTHENTICATE,
     CKA_WRAP_WITH_TRUSTED,
+    CKA_WRAP_TEMPLATE,
+    CKA_UNWRAP_TEMPLATE,
+    CKA_DERIVE_TEMPLATE,
+    CKA_OTP_FORMAT,
+    CKA_OTP_LENGTH,
+    CKA_OTP_TIME_INTERVAL,
+    CKA_OTP_USER_FRIENDLY_MODE,
+    CKA_OTP_CHALLENGE_REQUIREMENT,
+    CKA_OTP_TIME_REQUIREMENT,
+    CKA_OTP_COUNTER_REQUIREMENT,
+    CKA_OTP_PIN_REQUIREMENT,
+    CKA_OTP_COUNTER,
+    CKA_OTP_TIME,
+    CKA_OTP_USER_IDENTIFIER,
+    CKA_OTP_SERVICE_IDENTIFIER,
+    CKA_OTP_SERVICE_LOGO,
+    CKA_OTP_SERVICE_LOGO_TYPE,
+    CKA_GOSTR3410_PARAMS,
+    CKA_GOSTR3411_PARAMS,
+    CKA_GOST28147_PARAMS,
     CKA_HW_FEATURE_TYPE,
     CKA_RESET_ON_INIT,
     CKA_HAS_RESET,
@@ -149,8 +173,56 @@ pub static NSS_KNOWN_ATTRIBUTES: [CK_ATTRIBUTE_TYPE; NSS_KA_LEN] = [
     CKA_REQUIRED_CMS_ATTRIBUTES,
     CKA_DEFAULT_CMS_ATTRIBUTES,
     CKA_SUPPORTED_CMS_ATTRIBUTES,
-    CKA_WRAP_TEMPLATE,
-    CKA_UNWRAP_TEMPLATE,
+    CKA_PROFILE_ID,
+    CKA_X2RATCHET_BAG,
+    CKA_X2RATCHET_BAGSIZE,
+    CKA_X2RATCHET_BOBS1STMSG,
+    CKA_X2RATCHET_CKR,
+    CKA_X2RATCHET_CKS,
+    CKA_X2RATCHET_DHP,
+    CKA_X2RATCHET_DHR,
+    CKA_X2RATCHET_DHS,
+    CKA_X2RATCHET_HKR,
+    CKA_X2RATCHET_HKS,
+    CKA_X2RATCHET_ISALICE,
+    CKA_X2RATCHET_NHKR,
+    CKA_X2RATCHET_NHKS,
+    CKA_X2RATCHET_NR,
+    CKA_X2RATCHET_NS,
+    CKA_X2RATCHET_PNS,
+    CKA_X2RATCHET_RK,
+    CKA_HSS_LEVELS,
+    CKA_HSS_LMS_TYPE,
+    CKA_HSS_LMOTS_TYPE,
+    CKA_HSS_LMS_TYPES,
+    CKA_HSS_LMOTS_TYPES,
+    CKA_HSS_KEYS_REMAINING,
+    CKA_OBJECT_VALIDATION_FLAGS,
+    CKA_VALIDATION_TYPE,
+    CKA_VALIDATION_VERSION,
+    CKA_VALIDATION_LEVEL,
+    CKA_VALIDATION_MODULE_ID,
+    CKA_VALIDATION_FLAG,
+    CKA_VALIDATION_AUTHORITY_TYPE,
+    CKA_VALIDATION_COUNTRY,
+    CKA_VALIDATION_CERTIFICATE_IDENTIFIER,
+    CKA_VALIDATION_CERTIFICATE_URI,
+    CKA_VALIDATION_PROFILE,
+    CKA_VALIDATION_VENDOR_URI,
+    CKA_ENCAPSULATE_TEMPLATE,
+    CKA_DECAPSULATE_TEMPLATE,
+    CKA_TRUST_SERVER_AUTH,
+    CKA_TRUST_CLIENT_AUTH,
+    CKA_TRUST_CODE_SIGNING,
+    CKA_TRUST_EMAIL_PROTECTION,
+    CKA_TRUST_IPSEC_IKE,
+    CKA_TRUST_TIME_STAMPING,
+    CKA_TRUST_OCSP_SIGNING,
+    CKA_ENCAPSULATE,
+    CKA_DECAPSULATE,
+    CKA_HASH_OF_CERTIFICATE,
+    CKA_PUBLIC_CRC64_VALUE,
+    CKA_SEED,
     CKA_NSS_TRUST,
     CKA_NSS_URL,
     CKA_NSS_EMAIL,
@@ -168,27 +240,25 @@ pub static NSS_KNOWN_ATTRIBUTES: [CK_ATTRIBUTE_TYPE; NSS_KA_LEN] = [
     CKA_NSS_OVERRIDE_EXTENSIONS,
     CKA_NSS_SERVER_DISTRUST_AFTER,
     CKA_NSS_EMAIL_DISTRUST_AFTER,
-    CKA_TRUST_DIGITAL_SIGNATURE,
-    CKA_TRUST_NON_REPUDIATION,
-    CKA_TRUST_KEY_ENCIPHERMENT,
-    CKA_TRUST_DATA_ENCIPHERMENT,
-    CKA_TRUST_KEY_AGREEMENT,
-    CKA_TRUST_KEY_CERT_SIGN,
-    CKA_TRUST_CRL_SIGN,
-    CKA_TRUST_SERVER_AUTH,
-    CKA_TRUST_CLIENT_AUTH,
-    CKA_TRUST_CODE_SIGNING,
-    CKA_TRUST_EMAIL_PROTECTION,
-    CKA_TRUST_IPSEC_END_SYSTEM,
-    CKA_TRUST_IPSEC_TUNNEL,
-    CKA_TRUST_IPSEC_USER,
-    CKA_TRUST_TIME_STAMPING,
-    CKA_TRUST_STEP_UP_APPROVED,
-    CKA_CERT_SHA1_HASH,
-    CKA_CERT_MD5_HASH,
+    CKA_NSS_TRUST_DIGITAL_SIGNATURE,
+    CKA_NSS_TRUST_NON_REPUDIATION,
+    CKA_NSS_TRUST_KEY_ENCIPHERMENT,
+    CKA_NSS_TRUST_DATA_ENCIPHERMENT,
+    CKA_NSS_TRUST_KEY_AGREEMENT,
+    CKA_NSS_TRUST_KEY_CERT_SIGN,
+    CKA_NSS_TRUST_CRL_SIGN,
+    CKA_NSS_TRUST_SERVER_AUTH,
+    CKA_NSS_TRUST_CLIENT_AUTH,
+    CKA_NSS_TRUST_CODE_SIGNING,
+    CKA_NSS_TRUST_EMAIL_PROTECTION,
+    CKA_NSS_TRUST_IPSEC_END_SYSTEM,
+    CKA_NSS_TRUST_IPSEC_TUNNEL,
+    CKA_NSS_TRUST_IPSEC_USER,
+    CKA_NSS_TRUST_TIME_STAMPING,
+    CKA_NSS_TRUST_STEP_UP_APPROVED,
+    CKA_NSS_CERT_SHA1_HASH,
+    CKA_NSS_CERT_MD5_HASH,
     CKA_NSS_DB,
-    CKA_ENCAPSULATE,
-    CKA_DECAPSULATE,
 ];
 
 /// Static array listing attributes that NSS protects with an internal
@@ -197,16 +267,22 @@ pub static NSS_KNOWN_ATTRIBUTES: [CK_ATTRIBUTE_TYPE; NSS_KA_LEN] = [
 ///
 /// NSS has a hardcoded list of attributes that are authenticated,
 /// some are vendor defined attributes */
-pub static AUTHENTICATED_ATTRIBUTES: [CK_ATTRIBUTE_TYPE; 10] = [
+pub static AUTHENTICATED_ATTRIBUTES: [CK_ATTRIBUTE_TYPE; 16] = [
     CKA_MODULUS,
     CKA_PUBLIC_EXPONENT,
-    CKA_CERT_SHA1_HASH,
-    CKA_CERT_MD5_HASH,
+    CKA_NSS_CERT_SHA1_HASH,
+    CKA_NSS_CERT_MD5_HASH,
+    CKA_NSS_TRUST_SERVER_AUTH,
+    CKA_NSS_TRUST_CLIENT_AUTH,
+    CKA_NSS_TRUST_EMAIL_PROTECTION,
+    CKA_NSS_TRUST_CODE_SIGNING,
+    CKA_NSS_TRUST_STEP_UP_APPROVED,
+    CKA_HASH_OF_CERTIFICATE,
+    CKA_NAME_HASH_ALGORITHM,
     CKA_TRUST_SERVER_AUTH,
     CKA_TRUST_CLIENT_AUTH,
     CKA_TRUST_EMAIL_PROTECTION,
     CKA_TRUST_CODE_SIGNING,
-    CKA_TRUST_STEP_UP_APPROVED,
     CKA_NSS_OVERRIDE_EXTENSIONS,
 ];
 
@@ -230,24 +306,24 @@ static NSS_VENDOR_ATTRIBUTES: [CK_ATTRIBUTE_TYPE; 36] = [
     CKA_NSS_OVERRIDE_EXTENSIONS,
     CKA_NSS_SERVER_DISTRUST_AFTER,
     CKA_NSS_EMAIL_DISTRUST_AFTER,
-    CKA_TRUST_DIGITAL_SIGNATURE,
-    CKA_TRUST_NON_REPUDIATION,
-    CKA_TRUST_KEY_ENCIPHERMENT,
-    CKA_TRUST_DATA_ENCIPHERMENT,
-    CKA_TRUST_KEY_AGREEMENT,
-    CKA_TRUST_KEY_CERT_SIGN,
-    CKA_TRUST_CRL_SIGN,
-    CKA_TRUST_SERVER_AUTH,
-    CKA_TRUST_CLIENT_AUTH,
-    CKA_TRUST_CODE_SIGNING,
-    CKA_TRUST_EMAIL_PROTECTION,
-    CKA_TRUST_IPSEC_END_SYSTEM,
-    CKA_TRUST_IPSEC_TUNNEL,
-    CKA_TRUST_IPSEC_USER,
-    CKA_TRUST_TIME_STAMPING,
-    CKA_TRUST_STEP_UP_APPROVED,
-    CKA_CERT_SHA1_HASH,
-    CKA_CERT_MD5_HASH,
+    CKA_NSS_TRUST_DIGITAL_SIGNATURE,
+    CKA_NSS_TRUST_NON_REPUDIATION,
+    CKA_NSS_TRUST_KEY_ENCIPHERMENT,
+    CKA_NSS_TRUST_DATA_ENCIPHERMENT,
+    CKA_NSS_TRUST_KEY_AGREEMENT,
+    CKA_NSS_TRUST_KEY_CERT_SIGN,
+    CKA_NSS_TRUST_CRL_SIGN,
+    CKA_NSS_TRUST_SERVER_AUTH,
+    CKA_NSS_TRUST_CLIENT_AUTH,
+    CKA_NSS_TRUST_CODE_SIGNING,
+    CKA_NSS_TRUST_EMAIL_PROTECTION,
+    CKA_NSS_TRUST_IPSEC_END_SYSTEM,
+    CKA_NSS_TRUST_IPSEC_TUNNEL,
+    CKA_NSS_TRUST_IPSEC_USER,
+    CKA_NSS_TRUST_TIME_STAMPING,
+    CKA_NSS_TRUST_STEP_UP_APPROVED,
+    CKA_NSS_CERT_SHA1_HASH,
+    CKA_NSS_CERT_MD5_HASH,
     CKA_NSS_DB,
 ];
 
@@ -267,14 +343,15 @@ pub fn ignore_attribute(attr: CK_ATTRIBUTE_TYPE) -> bool {
 
 /// Static array listing attributes that NSS considers sensitive and encrypts
 /// when storing private or secret key objects in the key database (keyN.db).
-pub static NSS_SENSITIVE_ATTRIBUTES: [CK_ATTRIBUTE_TYPE; 7] = [
+pub static NSS_SENSITIVE_ATTRIBUTES: [CK_ATTRIBUTE_TYPE; 8] = [
     CKA_VALUE,
     CKA_PRIVATE_EXPONENT,
     CKA_PRIME_1,
     CKA_PRIME_2,
     CKA_EXPONENT_1,
     CKA_EXPONENT_2,
     CKA_COEFFICIENT,
+    CKA_SEED,
 ];
 
 /// Checks if an attribute type is considered sensitive by NSS (and should be
@@ -288,15 +365,10 @@ pub fn is_db_attribute(attr: CK_ATTRIBUTE_TYPE) -> bool {
     NSS_KNOWN_ATTRIBUTES.contains(&attr)
 }
 
-/// Static array listing attributes that are typically managed internally
-/// (like `CKA_UNIQUE_ID`) or derived/implicit (`CKA_ALLOWED_MECHANISMS`)
-/// and are not directly stored as columns in the NSS database tables.
-pub static NSS_SKIP_ATTRIBUTES: [CK_ATTRIBUTE_TYPE; 4] = [
-    CKA_UNIQUE_ID,
-    CKA_COPYABLE,
-    CKA_DESTROYABLE,
-    CKA_ALLOWED_MECHANISMS,
-];
+/// Static array listing attributes that are used by us but not supported by
+/// NSS for storage in the DB (like `CKA_ALLOWED_MECHANISMS`).
+pub static NSS_SKIP_ATTRIBUTES: [CK_ATTRIBUTE_TYPE; 1] =
+    [CKA_ALLOWED_MECHANISMS];
 
 /// Checks if an attribute type is one that should be skipped (not directly
 /// stored or retrieved as a column) when interacting with the NSS DB.

src/storage/nssdb/mod.rs

@@ -512,8 +512,10 @@ impl NSSStorage {
             }
             /* In NSSDB sensitive attributes are encrypted, so we can check
              * if the template is searching for any of the encrypted
-             * attributes and if so just fail immediately */
-            if is_sensitive_attribute(attr.type_) {
+             * attributes and if so just fail immediately.
+             * Do this only for private objects otherwise we incorrectly
+             * match attributes like CKA_VALUE in public objects. */
+            if do_private && is_sensitive_attribute(attr.type_) {
                 return Err(CKR_ATTRIBUTE_SENSITIVE)?;
             }
         }