Merge branch 'main' into propq

Author: simo5

.github/workflows/openjdk-integration.yml

@@ -26,7 +26,12 @@ jobs:
           dnf --assumeyes --disable-repo=fedora-cisco-openh264 \
             install git cargo clang-devel openssl-devel zlib-devel sed \
             sqlite-devel openssl opensc unzip wget \
-            java-${{ env.openjdk_feature }}-openjdk-devel
+            java-${{ env.openjdk_feature }}-openjdk-devel \
+            'perl(FindBin)' 'perl(lib)' 'perl(File::Compare)' \
+            'perl(File::Copy)' 'perl(bigint)' 'perl(Time::HiRes)' \
+            'perl(IPC::Cmd)' 'perl(Pod::Html)' 'perl(Digest::SHA)' \
+            'perl(Module::Load::Conditional)' 'perl(File::Temp)' \
+            'perl(Test::Harness)' 'perl(Test::More)' 'perl(Math::BigInt)'
 
       # Kryoptic build steps; try to keep in sync with relevant build.yml steps.
       - name: Checkout Repository

ossl/src/asymcipher.rs

@@ -28,7 +28,7 @@ pub struct RsaOaepParams {
 pub fn rsa_enc_params(
     alg: EncAlg,
     oaep_params: Option<&RsaOaepParams>,
-) -> Result<OsslParam, Error> {
+) -> Result<OsslParam<'_>, Error> {
     let mut params_builder = crate::OsslParamBuilder::new();
 
     match alg {

ossl/src/fips.rs

@@ -340,7 +340,7 @@ struct MemBio<'a> {
 }
 
 impl MemBio<'_> {
-    fn new(v: &mut [u8]) -> MemBio {
+    fn new(v: &mut [u8]) -> MemBio<'_> {
         MemBio { mem: v, cursor: 0 }
     }
 

ossl/src/pkey.rs

@@ -850,7 +850,7 @@ impl EvpPkey {
     ///
     /// The `selection` argument specifies which components to export
     /// (e.g., public, private, parameters).
-    fn export_params(&self, selection: u32) -> Result<OsslParam, Error> {
+    fn export_params(&self, selection: u32) -> Result<OsslParam<'_>, Error> {
         let mut params_builder = OsslParamBuilder::new();
         params_builder.zeroize = true;
         let ret = unsafe {

ossl/src/signature.rs

@@ -300,7 +300,7 @@ pub struct RsaPssParams {
 pub fn rsa_sig_params(
     alg: SigAlg,
     pss_params: &Option<RsaPssParams>,
-) -> Result<Option<OsslParam>, Error> {
+) -> Result<Option<OsslParam<'_>>, Error> {
     match alg {
         SigAlg::RsaNoPad => {
             let mut params_builder = OsslParamBuilder::new();

src/attribute.rs

@@ -462,6 +462,7 @@ impl Attribute {
     }
 
     /// Constructs an attribute passing in the value as a slice
+    #[cfg(feature = "nssdb")]
     pub fn from_attr_slice(
         id: CK_ULONG,
         at: AttrType,

src/fips/indicators.rs

@@ -283,7 +283,7 @@ struct FipsMechanism {
 /// Struct that holds FIPS properties for keys and mechanisms
 struct FipsChecks {
     keys: [FipsKeyType; 17],
-    mechs: [FipsMechanism; 91],
+    mechs: [FipsMechanism; 93],
 }
 
 /// A constant instantiation of FIPS properties with a list
@@ -552,6 +552,19 @@ const FIPS_CHECKS: FipsChecks = FipsChecks {
             restrictions: [restrict!(CKK_EC), restrict!()],
             genflags: 0,
         },
+        /* EDDSA */
+        FipsMechanism {
+            mechanism: CKM_EC_EDWARDS_KEY_PAIR_GEN,
+            operations: CKF_GENERATE_KEY_PAIR,
+            restrictions: [restrict!(CKK_EC_EDWARDS), restrict!()],
+            genflags: CKF_SIGN | CKF_VERIFY,
+        },
+        FipsMechanism {
+            mechanism: CKM_EDDSA,
+            operations: CKF_SIGN | CKF_VERIFY,
+            restrictions: [restrict!(CKK_EC_EDWARDS), restrict!()],
+            genflags: 0,
+        },
         /* AES */
         FipsMechanism {
             mechanism: CKM_AES_KEY_GEN,
@@ -1315,6 +1328,17 @@ pub fn is_key_approved(key: &Object, op: CK_FLAGS) -> bool {
     check_key(key, op, None, None)
 }
 
+/// Adds validation flag to the object, if it is not yet present
+/// and if the object passes validation rules.
+pub fn add_missing_validation_flag(key: &mut Object) {
+    if let Ok(_) = key.get_attr_as_ulong(CKA_OBJECT_VALIDATION_FLAGS) {
+        return;
+    }
+    if is_key_approved(key, CK_UNAVAILABLE_INFORMATION) {
+        add_fips_flag(key);
+    }
+}
+
 /// Helper to check if an operation is approved
 ///
 /// Applies key checks as well as mechanism checks according to the

src/kasn1/mod.rs

@@ -207,7 +207,7 @@ impl PrivateKeyInfo<'_> {
     }
 
     /// Returns the key type (as an OID)
-    pub fn get_algorithm(&self) -> &pkcs::AlgorithmIdentifier {
+    pub fn get_algorithm(&self) -> &pkcs::AlgorithmIdentifier<'_> {
         &self.algorithm
     }
 

src/object.rs

@@ -850,6 +850,9 @@ pub trait ObjectFactory: Debug + Send + Sync {
             match attrs.iter().find(|a| a.get_type() == ck_attr.type_) {
                 None => return Err(CKR_ATTRIBUTE_TYPE_INVALID)?,
                 Some(attr) => {
+                    if attr.is(OAFlags::NeverSettable) {
+                        return Err(CKR_ACTION_PROHIBITED)?;
+                    }
                     if attr.is(OAFlags::Unchangeable) {
                         if attr.attribute.get_attrtype() == AttrType::BoolType {
                             let val = ck_attr.to_bool()?;

src/storage/format.rs

@@ -11,6 +11,8 @@ use std::fmt::Debug;
 
 use crate::attribute::{Attribute, CkAttrs};
 use crate::error::Result;
+#[cfg(feature = "fips")]
+use crate::fips::indicators::add_missing_validation_flag;
 use crate::object::Object;
 use crate::pkcs11::*;
 use crate::storage::aci::{StorageACI, StorageAuthInfo};
@@ -297,6 +299,13 @@ impl Storage for StdStorageFormat {
              * some attributes or not */
             attrs.add_missing_ulong(CKA_SENSITIVE, &dnm);
             attrs.add_missing_ulong(CKA_EXTRACTABLE, &dnm);
+            #[cfg(feature = "fips")]
+            {
+                /* We need these to be able to derive object validation flag */
+                attrs.add_missing_ulong(CKA_EC_PARAMS, &dnm);
+                attrs.add_missing_ulong(CKA_VALUE_LEN, &dnm);
+                attrs.add_missing_ulong(CKA_MODULUS, &dnm);
+            }
         }
 
         let mut obj = self.store.fetch_by_uid(&uid, attrs.as_slice())?;
@@ -315,6 +324,9 @@ impl Storage for StdStorageFormat {
             }
         }
 
+        #[cfg(feature = "fips")]
+        add_missing_validation_flag(&mut obj);
+
         obj.set_handle(handle);
         Ok(obj)
     }