Skip to content

Commit a88b4b5

Browse files
JakujeJakuje
committed
tests: Verify objects have appropriate validation flags
Signed-off-by: Jakub Jelen <[email protected]>
1 parent 5c2a24f commit a88b4b5

File tree

7 files changed

+82
-1
lines changed

7 files changed

+82
-1
lines changed

‎src/tests/aes.rs

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ fn test_aes_operations() {
5050
(CKA_UNWRAP, true),
5151
],
5252
));
53+
assert_eq!(check_validation(session, 1), true);
54+
assert_eq!(check_object_validation(session, handle, 1), true);
5355

5456
{
5557
/* AES ECB */
@@ -690,6 +692,7 @@ fn test_aes_operations() {
690692
Ok(k) => k,
691693
Err(e) => panic!("{}", e),
692694
};
695+
assert_eq!(check_object_validation(session, key_handle, 1), true);
693696

694697
let ciphertext = hex::decode("4154c0be71072945d8156f5f046d198d")
695698
.expect("Failed to decode ciphertext");
@@ -718,6 +721,8 @@ fn test_aes_operations() {
718721
Ok(k) => k,
719722
Err(e) => panic!("{}", e),
720723
};
724+
assert_eq!(check_object_validation(session, key_handle, 1), true);
725+
721726
let iv = hex::decode("1dbbeb2f19abb448af849796244a19d7")
722727
.expect("Failed to decode IV");
723728
let plaintext = hex::decode(
@@ -759,6 +764,8 @@ fn test_aes_operations() {
759764
Ok(k) => k,
760765
Err(e) => panic!("{}", e),
761766
};
767+
assert_eq!(check_object_validation(session, key_handle, 1), true);
768+
762769
let (iv, aad, tag, ct, plaintext) = get_gcm_test_data();
763770

764771
let param = CK_GCM_PARAMS {
@@ -795,6 +802,8 @@ fn test_aes_operations() {
795802
Ok(k) => k,
796803
Err(e) => panic!("{}", e),
797804
};
805+
assert_eq!(check_object_validation(session, key_handle, 1), true);
806+
798807
let iv = hex::decode("0007bdfd5cbd60278dcc091200000001")
799808
.expect("failed to decode iv");
800809
let plaintext = hex::decode(
@@ -911,6 +920,7 @@ fn test_aes_operations() {
911920
&mut wp_handle2,
912921
);
913922
assert_eq!(ret, CKR_OK);
923+
assert_eq!(check_object_validation(session, wp_handle2, 1), true);
914924

915925
let mut value = [0u8; AES_BLOCK_SIZE];
916926
let mut extract_template = make_ptrs_template(&[(
@@ -1033,6 +1043,7 @@ fn test_aes_operations() {
10331043
Ok(k) => k,
10341044
Err(e) => panic!("{}", e),
10351045
};
1046+
assert_eq!(check_object_validation(session, key_handle, 1), true);
10361047
let (iv, aad, tag, ct, plaintext) = get_gcm_test_data();
10371048

10381049
let ret = fn_message_decrypt_init(session, &mut mechanism, key_handle);
@@ -1272,6 +1283,7 @@ fn test_aes_macs() {
12721283
&[],
12731284
&[(CKA_SIGN, true), (CKA_VERIFY, true),],
12741285
));
1286+
assert_eq!(check_object_validation(session, handle, 1), true);
12751287

12761288
#[cfg(not(feature = "fips"))]
12771289
{

‎src/tests/keys.rs

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -447,6 +447,15 @@ fn test_ec_keys() {
447447
(CKA_EXTRACTABLE, true),
448448
],
449449
));
450+
assert_eq!(check_validation(session, t.fips_indicator), true);
451+
assert_eq!(
452+
check_object_validation(session, pubkey, t.fips_indicator),
453+
true
454+
);
455+
assert_eq!(
456+
check_object_validation(session, prikey, t.fips_indicator),
457+
true
458+
);
450459

451460
if t.op_flags.1 == CKA_SIGN {
452461
let sig = ret_or_panic!(sig_gen(
@@ -526,6 +535,10 @@ fn test_ec_keys() {
526535
assert_eq!(ret, CKR_OK);
527536

528537
assert_eq!(check_validation(session, t.fips_indicator), true);
538+
assert_eq!(
539+
check_object_validation(session, prikey2, t.fips_indicator),
540+
true
541+
);
529542

530543
if t.op_flags.1 == CKA_SIGN {
531544
/* Test the unwrapped key can be used */

‎src/tests/rsa.rs

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -392,6 +392,8 @@ fn test_rsa_operations() {
392392
));
393393

394394
assert_eq!(check_validation(session, 1), true);
395+
assert_eq!(check_object_validation(session, hpri, 1), true);
396+
assert_eq!(check_object_validation(session, hpub, 1), true);
395397

396398
let label = "Public Key test 1";
397399
let mut template = make_ptrs_template(&[(
@@ -583,6 +585,8 @@ fn test_rsa_mechs() {
583585
));
584586

585587
assert_eq!(check_validation(session, 1), true);
588+
assert_eq!(check_object_validation(session, pubkey, 1), true);
589+
assert_eq!(check_object_validation(session, prikey, 1), true);
586590

587591
/* Classic PKCS 1.5 */
588592
for mech in [

‎src/tests/simplekdf.rs

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ fn test_concatenate_kdf() {
6767
);
6868
assert_eq!(ret, CKR_OK);
6969
assert_eq!(check_validation(session, 0), true);
70+
assert_eq!(check_object_validation(session, dk_handle, 0), true);
7071

7172
let exp_value = hex::decode("0123456789abcdef").unwrap();
7273
let value = ret_or_panic!(extract_key_value(session, dk_handle));
@@ -96,6 +97,7 @@ fn test_concatenate_kdf() {
9697
);
9798
assert_eq!(ret, CKR_OK);
9899
assert_eq!(check_validation(session, 0), true);
100+
assert_eq!(check_object_validation(session, dk_handle, 0), true);
99101

100102
let exp_value = hex::decode("0123456789abcdef").unwrap();
101103
let value = ret_or_panic!(extract_key_value(session, dk_handle));
@@ -125,6 +127,7 @@ fn test_concatenate_kdf() {
125127
);
126128
assert_eq!(ret, CKR_OK);
127129
assert_eq!(check_validation(session, 0), true);
130+
assert_eq!(check_object_validation(session, dk_handle, 0), true);
128131

129132
let exp_value = hex::decode("89abcdef01234567").unwrap();
130133
let value = ret_or_panic!(extract_key_value(session, dk_handle));
@@ -154,6 +157,7 @@ fn test_concatenate_kdf() {
154157
);
155158
assert_eq!(ret, CKR_OK);
156159
assert_eq!(check_validation(session, 0), true);
160+
assert_eq!(check_object_validation(session, dk_handle, 0), true);
157161

158162
let exp_value = hex::decode("88888888").unwrap();
159163
let value = ret_or_panic!(extract_key_value(session, dk_handle));
@@ -229,6 +233,7 @@ fn test_concatenate_kdf_fips() {
229233
let value = ret_or_panic!(extract_key_value(session, dk_handle));
230234
assert_eq!(value, exp_value);
231235
assert_eq!(check_validation(session, 1), true);
236+
assert_eq!(check_object_validation(session, dk_handle, 1), true);
232237

233238
// Concatenate base and data
234239
let data = hex::decode("0e0f").unwrap();
@@ -254,6 +259,7 @@ fn test_concatenate_kdf_fips() {
254259
);
255260
assert_eq!(ret, CKR_OK);
256261
assert_eq!(check_validation(session, 1), true);
262+
assert_eq!(check_object_validation(session, dk_handle, 1), true);
257263

258264
let exp_value = hex::decode("000102030405060708090a0b0c0d0e0f").unwrap();
259265
let value = ret_or_panic!(extract_key_value(session, dk_handle));
@@ -283,6 +289,7 @@ fn test_concatenate_kdf_fips() {
283289
);
284290
assert_eq!(ret, CKR_OK);
285291
assert_eq!(check_validation(session, 1), true);
292+
assert_eq!(check_object_validation(session, dk_handle, 1), true);
286293

287294
let exp_value = hex::decode("0e0f000102030405060708090a0b0c0d").unwrap();
288295
let value = ret_or_panic!(extract_key_value(session, dk_handle));
@@ -312,6 +319,7 @@ fn test_concatenate_kdf_fips() {
312319
);
313320
assert_eq!(ret, CKR_OK);
314321
assert_eq!(check_validation(session, 1), true);
322+
assert_eq!(check_object_validation(session, dk_handle, 1), true);
315323

316324
let exp_value = hex::decode("00112233445566778899aabbccdd").unwrap();
317325
let value = ret_or_panic!(extract_key_value(session, dk_handle));
@@ -361,6 +369,7 @@ fn test_concatenate_kdf_fips() {
361369
let value = ret_or_panic!(extract_key_value(session, dk_handle));
362370
assert_eq!(value, exp_value);
363371
assert_eq!(check_validation(session, 0), true);
372+
assert_eq!(check_object_validation(session, dk_handle, 0), true);
364373

365374
testtokn.finalize();
366375
}

‎src/tests/tls.rs

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -474,6 +474,8 @@ fn test_tls_mechanisms() {
474474
(CKA_DERIVE, true),
475475
],
476476
));
477+
assert_eq!(check_validation(session, 1), true);
478+
assert_eq!(check_object_validation(session, handle, 1), true);
477479

478480
let params = CK_TLS_MAC_PARAMS {
479481
prfHashMechanism: CKM_SHA256,
@@ -566,6 +568,7 @@ fn test_tls_mechanisms() {
566568
);
567569
assert_eq!(ret, CKR_OK);
568570
assert_eq!(check_validation(session, 1), true);
571+
assert_eq!(check_object_validation(session, handle, 1), true);
569572

570573
/* Try again with non-FIPS-approved hash */
571574
let params = CK_TLS12_KEY_MAT_PARAMS {
@@ -588,13 +591,14 @@ fn test_tls_mechanisms() {
588591
pParameter: void_ptr!(&params),
589592
ulParameterLen: paramslen,
590593
};
594+
let mut dk_handle = CK_INVALID_HANDLE;
591595
let ret = fn_derive_key(
592596
session,
593597
&derive_mech as *const _ as CK_MECHANISM_PTR,
594598
handle,
595599
derive_template.as_ptr() as *mut _,
596600
derive_template.len() as CK_ULONG,
597-
std::ptr::null_mut(),
601+
&mut dk_handle,
598602
);
599603
assert_eq!(ret, CKR_OK);
600604
assert_eq!(check_validation(session, 0), true);
@@ -639,6 +643,7 @@ fn test_tls_mechanisms() {
639643
);
640644
assert_eq!(ret, CKR_OK);
641645
assert_eq!(check_validation(session, 0), true);
646+
assert_eq!(check_object_validation(session, dk_handle, 0), true);
642647

643648
/* The End */
644649
testtokn.finalize();
@@ -666,6 +671,8 @@ fn test_tls_ems_mechanisms() {
666671
(CKA_DERIVE, true),
667672
],
668673
));
674+
assert_eq!(check_validation(session, 1), true);
675+
assert_eq!(check_object_validation(session, handle, 1), true);
669676

670677
/* test CKM_TLS12_EXTENDED_MASTER_KEY_DERIVE */
671678
let hash = hex::decode("9bbe436ba940f017b17652849a71db35").unwrap();
@@ -704,6 +711,7 @@ fn test_tls_ems_mechanisms() {
704711
);
705712
assert_eq!(ret, CKR_OK);
706713
assert_eq!(check_validation(session, 1), true);
714+
assert_eq!(check_object_validation(session, dk_handle, 1), true);
707715

708716
/* Try again with non-FIPS-approved hash */
709717
let params = CK_TLS12_EXTENDED_MASTER_KEY_DERIVE_PARAMS {
@@ -728,6 +736,7 @@ fn test_tls_ems_mechanisms() {
728736
);
729737
assert_eq!(ret, CKR_OK);
730738
assert_eq!(check_validation(session, 0), true);
739+
assert_eq!(check_object_validation(session, dk_handle, 0), true);
731740

732741
/* ensure Version fields were filled */
733742
//assert_not_eq!(version.major.as_slice(), 0);
@@ -756,6 +765,7 @@ fn test_tls_ems_mechanisms() {
756765
);
757766
assert_eq!(ret, CKR_OK);
758767
assert_eq!(check_validation(session, 1), true);
768+
assert_eq!(check_object_validation(session, handle, 1), true);
759769

760770
/* ensure Version fields were filled */
761771
//assert_not_eq!(version.major.as_slice(), 0);

‎src/tests/util.rs

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -622,3 +622,32 @@ pub fn check_validation(session: CK_SESSION_HANDLE, expect: CK_FLAGS) -> bool {
622622
pub fn check_validation(_: CK_SESSION_HANDLE, _: CK_FLAGS) -> bool {
623623
return true;
624624
}
625+
626+
#[cfg(feature = "fips")]
627+
pub fn check_object_validation(
628+
session: CK_SESSION_HANDLE,
629+
handle: CK_OBJECT_HANDLE,
630+
expect: CK_FLAGS,
631+
) -> bool {
632+
#[allow(unused_mut)]
633+
let mut flag: CK_ULONG = 0;
634+
let mut template = make_ptrs_template(&[(
635+
CKA_OBJECT_VALIDATION_FLAGS,
636+
void_ptr!(std::ptr::addr_of!(flag)),
637+
std::mem::size_of::<CK_ULONG>(),
638+
)]);
639+
let ret = fn_get_attribute_value(session, handle, template.as_mut_ptr(), 1);
640+
if ret != CKR_OK {
641+
return false;
642+
}
643+
return flag == expect;
644+
}
645+
646+
#[cfg(not(feature = "fips"))]
647+
pub fn check_object_validation(
648+
_: CK_SESSION_HANDLE,
649+
_: CK_OBJECT_HANDLE,
650+
_: CK_FLAGS,
651+
) -> bool {
652+
return true;
653+
}

‎testdata/test_aes_operations.json

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
"CKA_PRIVATE": true,
1212
"CKA_SENSITIVE": true,
1313
"CKA_VALUE": "LBRBN1HDHicwVwujNhx4aw==",
14+
"CKA_VALUE_LEN": 16,
1415
"CKA_TOKEN": true
1516
}
1617
}, {
@@ -26,6 +27,7 @@
2627
"CKA_PRIVATE": true,
2728
"CKA_SENSITIVE": true,
2829
"CKA_VALUE": "qB/WylZoPQ9URWWd3k2ZXcZfS84giWMFPijX8t9RfOQ=",
30+
"CKA_VALUE_LEN": 32,
2931
"CKA_TOKEN": true
3032
}
3133
}, {
@@ -41,6 +43,7 @@
4143
"CKA_PRIVATE": true,
4244
"CKA_SENSITIVE": true,
4345
"CKA_VALUE": "Zg63bz2LbsVOAbijYmMSSw==",
46+
"CKA_VALUE_LEN": 16,
4447
"CKA_TOKEN": true
4548
}
4649
}, {
@@ -56,6 +59,7 @@
5659
"CKA_PRIVATE": true,
5760
"CKA_SENSITIVE": true,
5861
"CKA_VALUE": "Ar85HujssVm5WWF7CWUnm/WbYKeG0+D+",
62+
"CKA_VALUE_LEN": 24,
5963
"CKA_TOKEN": true
6064
}
6165
}]}

0 commit comments

Comments
 (0)