xref: /optee_os/ta/pkcs11/src/pkcs11_attributes.c (revision 2570cd0b8d773a181df1ddf8db266aa39a96518e)
1 // SPDX-License-Identifier: BSD-2-Clause
2 /*
3  * Copyright (c) 2017-2020, Linaro Limited
4  */
5 
6 #include <assert.h>
7 #include <inttypes.h>
8 #include <pkcs11_ta.h>
9 #include <stdlib.h>
10 #include <string_ext.h>
11 #include <tee_internal_api_extensions.h>
12 #include <tee_internal_api.h>
13 #include <trace.h>
14 #include <util.h>
15 
16 #include "attributes.h"
17 #include "handle.h"
18 #include "pkcs11_attributes.h"
19 #include "pkcs11_helpers.h"
20 #include "pkcs11_token.h"
21 #include "sanitize_object.h"
22 #include "serializer.h"
23 #include "token_capabilities.h"
24 
25 /* Byte size of CKA_ID attribute when generated locally */
26 #define PKCS11_CKA_DEFAULT_SIZE		16
27 
28 static uint32_t pkcs11_func2ckfm(enum processing_func function)
29 {
30 	switch (function) {
31 	case PKCS11_FUNCTION_DIGEST:
32 		return PKCS11_CKFM_DIGEST;
33 	case PKCS11_FUNCTION_GENERATE:
34 		return PKCS11_CKFM_GENERATE;
35 	case PKCS11_FUNCTION_GENERATE_PAIR:
36 		return PKCS11_CKFM_GENERATE_KEY_PAIR;
37 	case PKCS11_FUNCTION_DERIVE:
38 		return PKCS11_CKFM_DERIVE;
39 	case PKCS11_FUNCTION_WRAP:
40 		return PKCS11_CKFM_WRAP;
41 	case PKCS11_FUNCTION_UNWRAP:
42 		return PKCS11_CKFM_UNWRAP;
43 	case PKCS11_FUNCTION_ENCRYPT:
44 		return PKCS11_CKFM_ENCRYPT;
45 	case PKCS11_FUNCTION_DECRYPT:
46 		return PKCS11_CKFM_DECRYPT;
47 	case PKCS11_FUNCTION_SIGN:
48 		return PKCS11_CKFM_SIGN;
49 	case PKCS11_FUNCTION_VERIFY:
50 		return PKCS11_CKFM_VERIFY;
51 	case PKCS11_FUNCTION_SIGN_RECOVER:
52 		return PKCS11_CKFM_SIGN_RECOVER;
53 	case PKCS11_FUNCTION_VERIFY_RECOVER:
54 		return PKCS11_CKFM_VERIFY_RECOVER;
55 	default:
56 		return 0;
57 	}
58 }
59 
60 enum pkcs11_rc
61 check_mechanism_against_processing(struct pkcs11_session *session,
62 				   enum pkcs11_mechanism_id mechanism_type,
63 				   enum processing_func function,
64 				   enum processing_step step)
65 {
66 	bool allowed = false;
67 
68 	switch (step) {
69 	case PKCS11_FUNC_STEP_INIT:
70 		switch (function) {
71 		case PKCS11_FUNCTION_IMPORT:
72 		case PKCS11_FUNCTION_COPY:
73 		case PKCS11_FUNCTION_MODIFY:
74 		case PKCS11_FUNCTION_DESTROY:
75 			return PKCS11_CKR_OK;
76 		default:
77 			break;
78 		}
79 		/*
80 		 * Check that the returned PKCS11_CKFM_* flag from
81 		 * pkcs11_func2ckfm() is among the ones from
82 		 * mechanism_supported_flags().
83 		 */
84 		allowed = mechanism_supported_flags(mechanism_type) &
85 			  pkcs11_func2ckfm(function);
86 		break;
87 
88 	case PKCS11_FUNC_STEP_ONESHOT:
89 		if (session->processing->always_authen &&
90 		    !session->processing->relogged)
91 			return PKCS11_CKR_USER_NOT_LOGGED_IN;
92 
93 		if (session->processing->updated) {
94 			EMSG("Cannot perform one-shot on updated processing");
95 			return PKCS11_CKR_OPERATION_ACTIVE;
96 		}
97 
98 		allowed = true;
99 		break;
100 
101 	case PKCS11_FUNC_STEP_UPDATE:
102 		if (session->processing->always_authen &&
103 		    !session->processing->relogged)
104 			return PKCS11_CKR_USER_NOT_LOGGED_IN;
105 
106 		allowed = !mechanism_is_one_shot_only(mechanism_type);
107 		break;
108 
109 	case PKCS11_FUNC_STEP_FINAL:
110 		if (session->processing->always_authen &&
111 		    !session->processing->relogged)
112 			return PKCS11_CKR_USER_NOT_LOGGED_IN;
113 
114 		return PKCS11_CKR_OK;
115 
116 	default:
117 		TEE_Panic(step);
118 		break;
119 	}
120 
121 	if (!allowed) {
122 		EMSG("Processing %#x/%s not permitted (%u/%u)",
123 		     (unsigned int)mechanism_type, id2str_proc(mechanism_type),
124 		     function, step);
125 		return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
126 	}
127 
128 	return PKCS11_CKR_OK;
129 }
130 
131 /*
132  * Object default boolean attributes as per PKCS#11
133  */
134 static uint8_t *pkcs11_object_default_boolprop(uint32_t attribute)
135 {
136 	static const uint8_t bool_true = 1;
137 	static const uint8_t bool_false;
138 
139 	switch (attribute) {
140 	/* As per PKCS#11 default value */
141 	case PKCS11_CKA_MODIFIABLE:
142 	case PKCS11_CKA_COPYABLE:
143 	case PKCS11_CKA_DESTROYABLE:
144 		return (uint8_t *)&bool_true;
145 	case PKCS11_CKA_TOKEN:
146 	case PKCS11_CKA_PRIVATE:
147 	case PKCS11_CKA_WRAP_WITH_TRUSTED:
148 	case PKCS11_CKA_ALWAYS_AUTHENTICATE:
149 	case PKCS11_CKA_SENSITIVE:
150 		return (uint8_t *)&bool_false;
151 	/* Token specific default value */
152 	case PKCS11_CKA_SIGN:
153 	case PKCS11_CKA_VERIFY:
154 	case PKCS11_CKA_DERIVE:
155 	case PKCS11_CKA_ENCRYPT:
156 	case PKCS11_CKA_DECRYPT:
157 	case PKCS11_CKA_SIGN_RECOVER:
158 	case PKCS11_CKA_VERIFY_RECOVER:
159 	case PKCS11_CKA_WRAP:
160 	case PKCS11_CKA_UNWRAP:
161 	case PKCS11_CKA_EXTRACTABLE:
162 	case PKCS11_CKA_TRUSTED:
163 		return (uint8_t *)&bool_false;
164 	default:
165 		DMSG("No default for boolprop attribute %#"PRIx32, attribute);
166 		return NULL;
167 	}
168 }
169 
170 /*
171  * Object expects several boolean attributes to be set to a default value
172  * or to a validate client configuration value. This function append the input
173  * attribute (id/size/value) in the serialized object.
174  */
175 static enum pkcs11_rc pkcs11_import_object_boolprop(struct obj_attrs **out,
176 						    struct obj_attrs *templ,
177 						    uint32_t attribute)
178 {
179 	enum pkcs11_rc rc = PKCS11_CKR_OK;
180 	uint8_t bbool = 0;
181 	uint32_t size = sizeof(uint8_t);
182 	void *attr = NULL;
183 
184 	rc = get_attribute(templ, attribute, &bbool, &size);
185 	if (rc) {
186 		if (rc != PKCS11_RV_NOT_FOUND)
187 			return rc;
188 		attr = pkcs11_object_default_boolprop(attribute);
189 		if (!attr)
190 			return PKCS11_CKR_TEMPLATE_INCOMPLETE;
191 	} else {
192 		attr = &bbool;
193 	}
194 
195 	/* Boolean attributes are 1byte in the ABI, no alignment issue */
196 	return add_attribute(out, attribute, attr, sizeof(uint8_t));
197 }
198 
199 static enum pkcs11_rc set_mandatory_boolprops(struct obj_attrs **out,
200 					      struct obj_attrs *temp,
201 					      uint32_t const *bp,
202 					      size_t bp_count)
203 {
204 	enum pkcs11_rc rc = PKCS11_CKR_OK;
205 	size_t n = 0;
206 
207 	for (n = 0; n < bp_count; n++) {
208 		rc = pkcs11_import_object_boolprop(out, temp, bp[n]);
209 		if (rc)
210 			return rc;
211 	}
212 
213 	return rc;
214 }
215 
216 static enum pkcs11_rc set_mandatory_attributes(struct obj_attrs **out,
217 					       struct obj_attrs *temp,
218 					       uint32_t const *attrs,
219 					       size_t attrs_count)
220 {
221 	enum pkcs11_rc rc = PKCS11_CKR_OK;
222 	size_t n = 0;
223 
224 	for (n = 0; n < attrs_count; n++) {
225 		uint32_t size = 0;
226 		void *value = NULL;
227 
228 		if (get_attribute_ptr(temp, attrs[n], &value, &size))
229 			return PKCS11_CKR_TEMPLATE_INCOMPLETE;
230 
231 		rc = add_attribute(out, attrs[n], value, size);
232 		if (rc)
233 			return rc;
234 	}
235 
236 	return rc;
237 }
238 
239 static enum pkcs11_rc get_default_value(enum pkcs11_attr_id id, void **value,
240 					uint32_t *size)
241 {
242 	/* should have been taken care of already */
243 	assert(!pkcs11_attr_is_boolean(id));
244 
245 	if (id == PKCS11_CKA_PUBLIC_KEY_INFO) {
246 		EMSG("Cannot provide default PUBLIC_KEY_INFO");
247 		return PKCS11_CKR_TEMPLATE_INCONSISTENT;
248 	}
249 
250 	/* All other attributes have an empty default value */
251 	*value = NULL;
252 	*size = 0;
253 	return PKCS11_CKR_OK;
254 }
255 
256 static enum pkcs11_rc set_optional_attributes_with_def(struct obj_attrs **out,
257 						       struct obj_attrs *temp,
258 						       uint32_t const *attrs,
259 						       size_t attrs_count,
260 						       bool default_to_null)
261 {
262 	enum pkcs11_rc rc = PKCS11_CKR_OK;
263 	size_t n = 0;
264 
265 	for (n = 0; n < attrs_count; n++) {
266 		uint32_t size = 0;
267 		void *value = NULL;
268 
269 		rc = get_attribute_ptr(temp, attrs[n], &value, &size);
270 		if (rc == PKCS11_RV_NOT_FOUND) {
271 			if (default_to_null) {
272 				rc = get_default_value(attrs[n], &value, &size);
273 			} else {
274 				rc = PKCS11_CKR_OK;
275 				continue;
276 			}
277 		}
278 		if (rc)
279 			return rc;
280 
281 		rc = add_attribute(out, attrs[n], value, size);
282 		if (rc)
283 			return rc;
284 	}
285 
286 	return rc;
287 }
288 
289 static enum pkcs11_rc set_attributes_opt_or_null(struct obj_attrs **out,
290 						 struct obj_attrs *temp,
291 						 uint32_t const *attrs,
292 						 size_t attrs_count)
293 {
294 	return set_optional_attributes_with_def(out, temp, attrs, attrs_count,
295 						true /* defaults to empty */);
296 }
297 
298 static enum pkcs11_rc set_optional_attributes(struct obj_attrs **out,
299 					      struct obj_attrs *temp,
300 					      uint32_t const *attrs,
301 					      size_t attrs_count)
302 {
303 	return set_optional_attributes_with_def(out, temp, attrs, attrs_count,
304 						false /* no default value */);
305 }
306 
307 /*
308  * Below are listed the mandated or optional expected attributes for
309  * PKCS#11 storage objects.
310  *
311  * Note: boolprops (mandated boolean attributes) PKCS11_CKA_ALWAYS_SENSITIVE,
312  * and PKCS11_CKA_NEVER_EXTRACTABLE are set by the token, not provided
313  * in the client template.
314  */
315 
316 /* PKCS#11 specification for any object (session/token) of the storage */
317 static const uint32_t any_object_boolprops[] = {
318 	PKCS11_CKA_TOKEN, PKCS11_CKA_PRIVATE,
319 	PKCS11_CKA_MODIFIABLE, PKCS11_CKA_COPYABLE, PKCS11_CKA_DESTROYABLE,
320 };
321 
322 static const uint32_t any_object_opt_or_null[] = {
323 	PKCS11_CKA_LABEL,
324 };
325 
326 /* PKCS#11 specification for raw data object (+any_object_xxx) */
327 const uint32_t raw_data_opt_or_null[] = {
328 	PKCS11_CKA_OBJECT_ID, PKCS11_CKA_APPLICATION, PKCS11_CKA_VALUE,
329 };
330 
331 /* PKCS#11 specification for any key object (+any_object_xxx) */
332 static const uint32_t any_key_boolprops[] = {
333 	PKCS11_CKA_DERIVE,
334 };
335 
336 static const uint32_t any_key_opt_or_null[] = {
337 	PKCS11_CKA_ID,
338 	PKCS11_CKA_START_DATE, PKCS11_CKA_END_DATE,
339 };
340 
341 static const uint32_t any_key_optional[] = {
342 	PKCS11_CKA_ALLOWED_MECHANISMS,
343 };
344 
345 /* PKCS#11 specification for any symmetric key (+any_key_xxx) */
346 static const uint32_t symm_key_boolprops[] = {
347 	PKCS11_CKA_ENCRYPT, PKCS11_CKA_DECRYPT,
348 	PKCS11_CKA_SIGN, PKCS11_CKA_VERIFY,
349 	PKCS11_CKA_WRAP, PKCS11_CKA_UNWRAP,
350 	PKCS11_CKA_SENSITIVE, PKCS11_CKA_EXTRACTABLE,
351 	PKCS11_CKA_WRAP_WITH_TRUSTED, PKCS11_CKA_TRUSTED,
352 };
353 
354 static const uint32_t symm_key_opt_or_null[] = {
355 	PKCS11_CKA_WRAP_TEMPLATE, PKCS11_CKA_UNWRAP_TEMPLATE,
356 	PKCS11_CKA_DERIVE_TEMPLATE,
357 	PKCS11_CKA_VALUE, PKCS11_CKA_VALUE_LEN,
358 };
359 
360 /* PKCS#11 specification for any asymmetric public key (+any_key_xxx) */
361 static const uint32_t public_key_boolprops[] = {
362 	PKCS11_CKA_ENCRYPT, PKCS11_CKA_VERIFY, PKCS11_CKA_VERIFY_RECOVER,
363 	PKCS11_CKA_WRAP,
364 	PKCS11_CKA_TRUSTED,
365 };
366 
367 static const uint32_t public_key_mandated[] = {
368 	PKCS11_CKA_SUBJECT
369 };
370 
371 static const uint32_t public_key_opt_or_null[] = {
372 	PKCS11_CKA_WRAP_TEMPLATE, PKCS11_CKA_PUBLIC_KEY_INFO,
373 };
374 
375 /* PKCS#11 specification for any asymmetric private key (+any_key_xxx) */
376 static const uint32_t private_key_boolprops[] = {
377 	PKCS11_CKA_DECRYPT, PKCS11_CKA_SIGN, PKCS11_CKA_SIGN_RECOVER,
378 	PKCS11_CKA_UNWRAP,
379 	PKCS11_CKA_SENSITIVE, PKCS11_CKA_EXTRACTABLE,
380 	PKCS11_CKA_WRAP_WITH_TRUSTED, PKCS11_CKA_ALWAYS_AUTHENTICATE,
381 };
382 
383 static const uint32_t private_key_mandated[] = {
384 	PKCS11_CKA_SUBJECT
385 };
386 
387 static const uint32_t private_key_opt_or_null[] = {
388 	PKCS11_CKA_UNWRAP_TEMPLATE, PKCS11_CKA_PUBLIC_KEY_INFO,
389 };
390 
391 /* PKCS#11 specification for any RSA key (+public/private_key_xxx) */
392 static const uint32_t rsa_public_key_mandated[] = {
393 	PKCS11_CKA_MODULUS_BITS,
394 };
395 
396 static const uint32_t rsa_public_key_opt_or_null[] = {
397 	PKCS11_CKA_MODULUS, PKCS11_CKA_PUBLIC_EXPONENT,
398 };
399 
400 static const uint32_t rsa_private_key_opt_or_null[] = {
401 	PKCS11_CKA_MODULUS, PKCS11_CKA_PUBLIC_EXPONENT,
402 	PKCS11_CKA_PRIVATE_EXPONENT,
403 	PKCS11_CKA_PRIME_1, PKCS11_CKA_PRIME_2,
404 	PKCS11_CKA_EXPONENT_1, PKCS11_CKA_EXPONENT_2, PKCS11_CKA_COEFFICIENT,
405 };
406 
407 /* PKCS#11 specification for any EC key (+public/private_key_xxx) */
408 static const uint32_t ec_public_key_mandated[] = {
409 	PKCS11_CKA_EC_PARAMS,
410 };
411 
412 static const uint32_t ec_public_key_opt_or_null[] = {
413 	PKCS11_CKA_EC_POINT,
414 };
415 
416 static const uint32_t ec_private_key_mandated[] = {
417 	PKCS11_CKA_EC_PARAMS,
418 };
419 
420 static const uint32_t ec_private_key_opt_or_null[] = {
421 	PKCS11_CKA_VALUE,
422 };
423 
424 static enum pkcs11_rc create_storage_attributes(struct obj_attrs **out,
425 						struct obj_attrs *temp)
426 {
427 	enum pkcs11_class_id class = PKCS11_CKO_UNDEFINED_ID;
428 	enum pkcs11_rc rc = PKCS11_CKR_OK;
429 
430 	rc = init_attributes_head(out);
431 	if (rc)
432 		return rc;
433 
434 	/* Object class is mandatory */
435 	class = get_class(temp);
436 	if (class == PKCS11_CKO_UNDEFINED_ID) {
437 		EMSG("Class attribute not found");
438 
439 		return PKCS11_CKR_TEMPLATE_INCONSISTENT;
440 	}
441 	rc = add_attribute(out, PKCS11_CKA_CLASS, &class, sizeof(uint32_t));
442 	if (rc)
443 		return rc;
444 
445 	rc = set_mandatory_boolprops(out, temp, any_object_boolprops,
446 				     ARRAY_SIZE(any_object_boolprops));
447 	if (rc)
448 		return rc;
449 
450 	return set_attributes_opt_or_null(out, temp, any_object_opt_or_null,
451 					  ARRAY_SIZE(any_object_opt_or_null));
452 }
453 
454 static enum pkcs11_rc create_genkey_attributes(struct obj_attrs **out,
455 					       struct obj_attrs *temp)
456 {
457 	uint32_t type = PKCS11_CKO_UNDEFINED_ID;
458 	enum pkcs11_rc rc = PKCS11_CKR_OK;
459 
460 	rc = create_storage_attributes(out, temp);
461 	if (rc)
462 		return rc;
463 
464 	type = get_key_type(temp);
465 	if (type == PKCS11_CKK_UNDEFINED_ID) {
466 		EMSG("Key type attribute not found");
467 
468 		return PKCS11_CKR_TEMPLATE_INCONSISTENT;
469 	}
470 	rc = add_attribute(out, PKCS11_CKA_KEY_TYPE, &type, sizeof(uint32_t));
471 	if (rc)
472 		return rc;
473 
474 	rc = set_mandatory_boolprops(out, temp, any_key_boolprops,
475 				     ARRAY_SIZE(any_key_boolprops));
476 	if (rc)
477 		return rc;
478 
479 	rc = set_attributes_opt_or_null(out, temp, any_key_opt_or_null,
480 					ARRAY_SIZE(any_key_opt_or_null));
481 	if (rc)
482 		return rc;
483 
484 	return set_optional_attributes(out, temp, any_key_optional,
485 				       ARRAY_SIZE(any_key_optional));
486 
487 }
488 
489 static enum pkcs11_rc create_symm_key_attributes(struct obj_attrs **out,
490 						 struct obj_attrs *temp)
491 {
492 	enum pkcs11_rc rc = PKCS11_CKR_OK;
493 
494 	assert(get_class(temp) == PKCS11_CKO_SECRET_KEY);
495 
496 	rc = create_genkey_attributes(out, temp);
497 	if (rc)
498 		return rc;
499 
500 	assert(get_class(*out) == PKCS11_CKO_SECRET_KEY);
501 
502 	switch (get_key_type(*out)) {
503 	case PKCS11_CKK_GENERIC_SECRET:
504 	case PKCS11_CKK_AES:
505 	case PKCS11_CKK_MD5_HMAC:
506 	case PKCS11_CKK_SHA_1_HMAC:
507 	case PKCS11_CKK_SHA256_HMAC:
508 	case PKCS11_CKK_SHA384_HMAC:
509 	case PKCS11_CKK_SHA512_HMAC:
510 	case PKCS11_CKK_SHA224_HMAC:
511 		break;
512 	default:
513 		EMSG("Invalid key type %#"PRIx32"/%s",
514 		     get_key_type(*out), id2str_key_type(get_key_type(*out)));
515 
516 		return PKCS11_CKR_TEMPLATE_INCONSISTENT;
517 	}
518 
519 	rc = set_mandatory_boolprops(out, temp, symm_key_boolprops,
520 				     ARRAY_SIZE(symm_key_boolprops));
521 	if (rc)
522 		return rc;
523 
524 	return set_attributes_opt_or_null(out, temp, symm_key_opt_or_null,
525 					  ARRAY_SIZE(symm_key_opt_or_null));
526 }
527 
528 static enum pkcs11_rc create_data_attributes(struct obj_attrs **out,
529 					     struct obj_attrs *temp)
530 {
531 	enum pkcs11_rc rc = PKCS11_CKR_OK;
532 
533 	assert(get_class(temp) == PKCS11_CKO_DATA);
534 
535 	rc = create_storage_attributes(out, temp);
536 	if (rc)
537 		return rc;
538 
539 	assert(get_class(*out) == PKCS11_CKO_DATA);
540 
541 	return set_attributes_opt_or_null(out, temp, raw_data_opt_or_null,
542 					  ARRAY_SIZE(raw_data_opt_or_null));
543 }
544 
545 static enum pkcs11_rc create_pub_key_attributes(struct obj_attrs **out,
546 						struct obj_attrs *temp)
547 {
548 	uint32_t const *mandated = NULL;
549 	uint32_t const *opt_or_null = NULL;
550 	size_t mandated_count = 0;
551 	size_t opt_or_null_count = 0;
552 	enum pkcs11_rc rc = PKCS11_CKR_OK;
553 
554 	assert(get_class(temp) == PKCS11_CKO_PUBLIC_KEY);
555 
556 	rc = create_genkey_attributes(out, temp);
557 	if (rc)
558 		return rc;
559 
560 	assert(get_class(*out) == PKCS11_CKO_PUBLIC_KEY);
561 
562 	rc = set_mandatory_boolprops(out, temp, public_key_boolprops,
563 				     ARRAY_SIZE(public_key_boolprops));
564 	if (rc)
565 		return rc;
566 
567 	rc = set_mandatory_attributes(out, temp, public_key_mandated,
568 				      ARRAY_SIZE(public_key_mandated));
569 	if (rc)
570 		return rc;
571 
572 	rc = set_attributes_opt_or_null(out, temp,
573 					public_key_opt_or_null,
574 					ARRAY_SIZE(public_key_opt_or_null));
575 	if (rc)
576 		return rc;
577 
578 	switch (get_key_type(*out)) {
579 	case PKCS11_CKK_RSA:
580 		mandated = rsa_public_key_mandated;
581 		opt_or_null = rsa_public_key_opt_or_null;
582 		mandated_count = ARRAY_SIZE(rsa_public_key_mandated);
583 		opt_or_null_count = ARRAY_SIZE(rsa_public_key_opt_or_null);
584 		break;
585 	case PKCS11_CKK_EC:
586 		mandated = ec_public_key_mandated;
587 		opt_or_null = ec_public_key_opt_or_null;
588 		mandated_count = ARRAY_SIZE(ec_public_key_mandated);
589 		opt_or_null_count = ARRAY_SIZE(ec_public_key_opt_or_null);
590 		break;
591 	default:
592 		EMSG("Invalid key type %#"PRIx32"/%s",
593 		     get_key_type(*out), id2str_key_type(get_key_type(*out)));
594 
595 		return PKCS11_CKR_TEMPLATE_INCONSISTENT;
596 	}
597 
598 	rc = set_mandatory_attributes(out, temp, mandated, mandated_count);
599 	if (rc)
600 		return rc;
601 
602 	return set_attributes_opt_or_null(out, temp, opt_or_null,
603 					  opt_or_null_count);
604 }
605 
606 static enum pkcs11_rc create_priv_key_attributes(struct obj_attrs **out,
607 						 struct obj_attrs *temp)
608 {
609 	uint32_t const *mandated = NULL;
610 	uint32_t const *opt_or_null = NULL;
611 	size_t mandated_count = 0;
612 	size_t opt_or_null_count = 0;
613 	enum pkcs11_rc rc = PKCS11_CKR_OK;
614 
615 	assert(get_class(temp) == PKCS11_CKO_PRIVATE_KEY);
616 
617 	rc = create_genkey_attributes(out, temp);
618 	if (rc)
619 		return rc;
620 
621 	assert(get_class(*out) == PKCS11_CKO_PRIVATE_KEY);
622 
623 	rc = set_mandatory_boolprops(out, temp, private_key_boolprops,
624 				     ARRAY_SIZE(private_key_boolprops));
625 	if (rc)
626 		return rc;
627 
628 	rc = set_mandatory_attributes(out, temp, private_key_mandated,
629 				      ARRAY_SIZE(private_key_mandated));
630 	if (rc)
631 		return rc;
632 
633 	rc = set_attributes_opt_or_null(out, temp, private_key_opt_or_null,
634 					ARRAY_SIZE(private_key_opt_or_null));
635 	if (rc)
636 		return rc;
637 
638 	switch (get_key_type(*out)) {
639 	case PKCS11_CKK_RSA:
640 		opt_or_null = rsa_private_key_opt_or_null;
641 		opt_or_null_count = ARRAY_SIZE(rsa_private_key_opt_or_null);
642 		break;
643 	case PKCS11_CKK_EC:
644 		mandated = ec_private_key_mandated;
645 		opt_or_null = ec_private_key_opt_or_null;
646 		mandated_count = ARRAY_SIZE(ec_private_key_mandated);
647 		opt_or_null_count = ARRAY_SIZE(ec_private_key_opt_or_null);
648 		break;
649 	default:
650 		EMSG("Invalid key type %#"PRIx32"/%s",
651 		     get_key_type(*out), id2str_key_type(get_key_type(*out)));
652 
653 		return PKCS11_CKR_TEMPLATE_INCONSISTENT;
654 	}
655 
656 	rc = set_mandatory_attributes(out, temp, mandated, mandated_count);
657 	if (rc)
658 		return rc;
659 
660 	return set_attributes_opt_or_null(out, temp, opt_or_null,
661 					  opt_or_null_count);
662 }
663 
664 /*
665  * Create an attribute list for a new object from a template and a parent
666  * object (optional) for an object generation function (generate, copy,
667  * derive...).
668  *
669  * PKCS#11 directives on the supplied template and expected return value:
670  * - template has an invalid attribute ID: ATTRIBUTE_TYPE_INVALID
671  * - template has an invalid value for an attribute: ATTRIBUTE_VALID_INVALID
672  * - template has value for a read-only attribute: ATTRIBUTE_READ_ONLY
673  * - template+default+parent => still miss an attribute: TEMPLATE_INCONSISTENT
674  *
675  * INFO on PKCS11_CMD_COPY_OBJECT:
676  * - parent PKCS11_CKA_COPYIABLE=false => return ACTION_PROHIBITED.
677  * - template can specify PKCS11_CKA_TOKEN, PKCS11_CKA_PRIVATE,
678  *   PKCS11_CKA_MODIFIABLE, PKCS11_CKA_DESTROYABLE.
679  * - SENSITIVE can change from false to true, not from true to false.
680  * - LOCAL is the parent LOCAL
681  */
682 enum pkcs11_rc
683 create_attributes_from_template(struct obj_attrs **out, void *template,
684 				size_t template_size,
685 				struct obj_attrs *parent __unused,
686 				enum processing_func function,
687 				enum pkcs11_mechanism_id mecha,
688 				enum pkcs11_class_id template_class __unused)
689 {
690 	struct obj_attrs *temp = NULL;
691 	struct obj_attrs *attrs = NULL;
692 	enum pkcs11_rc rc = PKCS11_CKR_OK;
693 	uint8_t local = 0;
694 	uint8_t always_sensitive = 0;
695 	uint8_t never_extract = 0;
696 	uint32_t class = PKCS11_UNDEFINED_ID;
697 	uint32_t type = PKCS11_UNDEFINED_ID;
698 	uint32_t mechanism_id = PKCS11_CKM_UNDEFINED_ID;
699 
700 #ifdef DEBUG	/* Sanity: check function argument */
701 	trace_attributes_from_api_head("template", template, template_size);
702 	switch (function) {
703 	case PKCS11_FUNCTION_GENERATE:
704 	case PKCS11_FUNCTION_IMPORT:
705 		break;
706 	default:
707 		TEE_Panic(TEE_ERROR_NOT_SUPPORTED);
708 	}
709 #endif
710 
711 	/*
712 	 * For PKCS11_FUNCTION_GENERATE, find the class and type
713 	 * based on the mechanism. These will be passed as hint
714 	 * sanitize_client_object() and added in temp if not
715 	 * already present
716 	 */
717 	if (function == PKCS11_FUNCTION_GENERATE) {
718 		switch (mecha) {
719 		case PKCS11_CKM_GENERIC_SECRET_KEY_GEN:
720 			class = PKCS11_CKO_SECRET_KEY;
721 			type = PKCS11_CKK_GENERIC_SECRET;
722 			break;
723 		case PKCS11_CKM_AES_KEY_GEN:
724 			class = PKCS11_CKO_SECRET_KEY;
725 			type = PKCS11_CKK_AES;
726 			break;
727 		default:
728 			TEE_Panic(TEE_ERROR_NOT_SUPPORTED);
729 		}
730 	}
731 
732 	rc = sanitize_client_object(&temp, template, template_size, class,
733 				    type);
734 	if (rc)
735 		goto out;
736 
737 	/*
738 	 * Check if class and type in temp are consistent with the mechanism
739 	 */
740 	switch (mecha) {
741 	case PKCS11_CKM_GENERIC_SECRET_KEY_GEN:
742 		if (get_class(temp) != PKCS11_CKO_SECRET_KEY ||
743 		    get_key_type(temp) != PKCS11_CKK_GENERIC_SECRET) {
744 			rc = PKCS11_CKR_TEMPLATE_INCONSISTENT;
745 			goto out;
746 		}
747 		break;
748 	case PKCS11_CKM_AES_KEY_GEN:
749 		if (get_class(temp) != PKCS11_CKO_SECRET_KEY ||
750 		    get_key_type(temp) != PKCS11_CKK_AES) {
751 			rc = PKCS11_CKR_TEMPLATE_INCONSISTENT;
752 			goto out;
753 		}
754 		break;
755 	default:
756 		break;
757 	}
758 
759 	if (!sanitize_consistent_class_and_type(temp)) {
760 		EMSG("Inconsistent class/type");
761 		rc = PKCS11_CKR_TEMPLATE_INCONSISTENT;
762 		goto out;
763 	}
764 
765 	switch (get_class(temp)) {
766 	case PKCS11_CKO_DATA:
767 		rc = create_data_attributes(&attrs, temp);
768 		break;
769 	case PKCS11_CKO_SECRET_KEY:
770 		rc = create_symm_key_attributes(&attrs, temp);
771 		break;
772 	case PKCS11_CKO_PUBLIC_KEY:
773 		rc = create_pub_key_attributes(&attrs, temp);
774 		break;
775 	case PKCS11_CKO_PRIVATE_KEY:
776 		rc = create_priv_key_attributes(&attrs, temp);
777 		break;
778 	default:
779 		DMSG("Invalid object class %#"PRIx32"/%s",
780 		     get_class(temp), id2str_class(get_class(temp)));
781 
782 		rc = PKCS11_CKR_TEMPLATE_INCONSISTENT;
783 		break;
784 	}
785 	if (rc)
786 		goto out;
787 
788 	if (get_attribute_ptr(temp, PKCS11_CKA_LOCAL, NULL, NULL) !=
789 	    PKCS11_RV_NOT_FOUND) {
790 		rc = PKCS11_CKR_TEMPLATE_INCONSISTENT;
791 		goto out;
792 	}
793 
794 	if (get_attribute_ptr(temp, PKCS11_CKA_KEY_GEN_MECHANISM, NULL, NULL) !=
795 	    PKCS11_RV_NOT_FOUND) {
796 		rc = PKCS11_CKR_TEMPLATE_INCONSISTENT;
797 		goto out;
798 	}
799 
800 	switch (function) {
801 	case PKCS11_FUNCTION_GENERATE:
802 		local = PKCS11_TRUE;
803 		break;
804 	case PKCS11_FUNCTION_IMPORT:
805 	default:
806 		local = PKCS11_FALSE;
807 		break;
808 	}
809 	rc = add_attribute(&attrs, PKCS11_CKA_LOCAL, &local, sizeof(local));
810 	if (rc)
811 		goto out;
812 
813 	switch (get_class(attrs)) {
814 	case PKCS11_CKO_SECRET_KEY:
815 	case PKCS11_CKO_PRIVATE_KEY:
816 	case PKCS11_CKO_PUBLIC_KEY:
817 		always_sensitive = PKCS11_FALSE;
818 		never_extract = PKCS11_FALSE;
819 
820 		switch (function) {
821 		case PKCS11_FUNCTION_GENERATE:
822 			always_sensitive = get_bool(attrs,
823 						    PKCS11_CKA_SENSITIVE);
824 			never_extract = !get_bool(attrs,
825 						  PKCS11_CKA_EXTRACTABLE);
826 			break;
827 		default:
828 			break;
829 		}
830 
831 		rc = add_attribute(&attrs, PKCS11_CKA_ALWAYS_SENSITIVE,
832 				   &always_sensitive, sizeof(always_sensitive));
833 		if (rc)
834 			goto out;
835 
836 		rc = add_attribute(&attrs, PKCS11_CKA_NEVER_EXTRACTABLE,
837 				   &never_extract, sizeof(never_extract));
838 		if (rc)
839 			goto out;
840 
841 		/* Keys mandate attribute PKCS11_CKA_KEY_GEN_MECHANISM */
842 		if (local)
843 			mechanism_id = mecha;
844 		else
845 			mechanism_id = PKCS11_CK_UNAVAILABLE_INFORMATION;
846 
847 		rc = add_attribute(&attrs, PKCS11_CKA_KEY_GEN_MECHANISM,
848 				   &mechanism_id, sizeof(mechanism_id));
849 		if (rc)
850 			goto out;
851 		break;
852 
853 	default:
854 		break;
855 	}
856 
857 	*out = attrs;
858 
859 #ifdef DEBUG
860 	trace_attributes("object", attrs);
861 #endif
862 
863 out:
864 	TEE_Free(temp);
865 	if (rc)
866 		TEE_Free(attrs);
867 
868 	return rc;
869 }
870 
871 static enum pkcs11_rc check_attrs_misc_integrity(struct obj_attrs *head)
872 {
873 	if (get_bool(head, PKCS11_CKA_NEVER_EXTRACTABLE) &&
874 	    get_bool(head, PKCS11_CKA_EXTRACTABLE)) {
875 		DMSG("Never/Extractable attributes mismatch %d/%d",
876 		     get_bool(head, PKCS11_CKA_NEVER_EXTRACTABLE),
877 		     get_bool(head, PKCS11_CKA_EXTRACTABLE));
878 
879 		return PKCS11_CKR_TEMPLATE_INCONSISTENT;
880 	}
881 
882 	if (get_bool(head, PKCS11_CKA_ALWAYS_SENSITIVE) &&
883 	    !get_bool(head, PKCS11_CKA_SENSITIVE)) {
884 		DMSG("Sensitive/always attributes mismatch %d/%d",
885 		     get_bool(head, PKCS11_CKA_SENSITIVE),
886 		     get_bool(head, PKCS11_CKA_ALWAYS_SENSITIVE));
887 
888 		return PKCS11_CKR_TEMPLATE_INCONSISTENT;
889 	}
890 
891 	return PKCS11_CKR_OK;
892 }
893 
894 bool object_is_private(struct obj_attrs *head)
895 {
896 	if (get_class(head) == PKCS11_CKO_PRIVATE_KEY)
897 		return true;
898 
899 	if (get_bool(head, PKCS11_CKA_PRIVATE))
900 		return true;
901 
902 	return false;
903 }
904 
905 /*
906  * Check access to object against authentication to token
907  */
908 enum pkcs11_rc check_access_attrs_against_token(struct pkcs11_session *session,
909 						struct obj_attrs *head)
910 {
911 	bool private = true;
912 
913 	switch (get_class(head)) {
914 	case PKCS11_CKO_SECRET_KEY:
915 	case PKCS11_CKO_PUBLIC_KEY:
916 	case PKCS11_CKO_DATA:
917 		private = get_bool(head, PKCS11_CKA_PRIVATE);
918 		break;
919 	case PKCS11_CKO_PRIVATE_KEY:
920 		break;
921 	default:
922 		return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
923 	}
924 
925 	if (private && (pkcs11_session_is_public(session) ||
926 			pkcs11_session_is_so(session))) {
927 		DMSG("Private object access from a public or SO session");
928 
929 		return PKCS11_CKR_USER_NOT_LOGGED_IN;
930 	}
931 
932 	return PKCS11_CKR_OK;
933 }
934 
935 /*
936  * Check the attributes of a to-be-created object matches the token state
937  */
938 enum pkcs11_rc check_created_attrs_against_token(struct pkcs11_session *session,
939 						 struct obj_attrs *head)
940 {
941 	enum pkcs11_rc rc = PKCS11_CKR_OK;
942 
943 	rc = check_attrs_misc_integrity(head);
944 	if (rc)
945 		return rc;
946 
947 	if (get_bool(head, PKCS11_CKA_TRUSTED) &&
948 	    !pkcs11_session_is_so(session)) {
949 		DMSG("Can't create trusted object");
950 
951 		return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
952 	}
953 
954 	if (get_bool(head, PKCS11_CKA_TOKEN) &&
955 	    !pkcs11_session_is_read_write(session)) {
956 		DMSG("Can't create persistent object");
957 
958 		return PKCS11_CKR_SESSION_READ_ONLY;
959 	}
960 
961 	/*
962 	 * TODO: START_DATE and END_DATE: complies with current time?
963 	 */
964 	return PKCS11_CKR_OK;
965 }
966 
967 #define DMSG_BAD_BBOOL(attr, proc, head)				\
968 	do {								\
969 		uint32_t __maybe_unused _attr = (attr);			\
970 		uint8_t __maybe_unused _bvalue = 0;			\
971 		enum pkcs11_rc __maybe_unused _rc = PKCS11_CKR_OK;	\
972 									\
973 		_rc = get_attribute((head), _attr, &_bvalue, NULL);	\
974 		DMSG("%s issue for %s: %sfound, value %"PRIu8,		\
975 		     id2str_attr(_attr), id2str_proc((proc)),		\
976 		     _rc ? "not " : "", _bvalue);			\
977 	} while (0)
978 
979 static bool __maybe_unused check_attr_bval(uint32_t proc_id __maybe_unused,
980 					   struct obj_attrs *head,
981 					   uint32_t attribute, bool val)
982 {
983 	uint8_t bbool = 0;
984 	uint32_t sz = sizeof(bbool);
985 
986 	if (!get_attribute(head, attribute, &bbool, &sz) && !!bbool == val)
987 		return true;
988 
989 	DMSG_BAD_BBOOL(attribute, proc_id, head);
990 	return false;
991 }
992 
993 /*
994  * Check the attributes of a new secret match the processing/mechanism
995  * used to create it.
996  *
997  * @proc_id - PKCS11_CKM_xxx
998  * @head - head of the attributes of the to-be-created object.
999  */
1000 enum pkcs11_rc check_created_attrs_against_processing(uint32_t proc_id,
1001 						      struct obj_attrs *head)
1002 {
1003 	/*
1004 	 * Processings that do not create secrets are not expected to call
1005 	 * this function which would panic.
1006 	 */
1007 	switch (proc_id) {
1008 	case PKCS11_PROCESSING_IMPORT:
1009 		assert(check_attr_bval(proc_id, head, PKCS11_CKA_LOCAL, false));
1010 		break;
1011 	case PKCS11_CKM_GENERIC_SECRET_KEY_GEN:
1012 	case PKCS11_CKM_AES_KEY_GEN:
1013 		assert(check_attr_bval(proc_id, head, PKCS11_CKA_LOCAL, true));
1014 		break;
1015 	default:
1016 		TEE_Panic(proc_id);
1017 		break;
1018 	}
1019 
1020 	switch (proc_id) {
1021 	case PKCS11_CKM_GENERIC_SECRET_KEY_GEN:
1022 		assert(get_key_type(head) == PKCS11_CKK_GENERIC_SECRET);
1023 		break;
1024 	case PKCS11_CKM_AES_KEY_GEN:
1025 		assert(get_key_type(head) == PKCS11_CKK_AES);
1026 		break;
1027 	case PKCS11_PROCESSING_IMPORT:
1028 	default:
1029 		break;
1030 	}
1031 
1032 	return PKCS11_CKR_OK;
1033 }
1034 
1035 static void get_key_min_max_sizes(enum pkcs11_key_type key_type,
1036 				  uint32_t *min_key_size,
1037 				  uint32_t *max_key_size)
1038 {
1039 	enum pkcs11_mechanism_id mechanism = PKCS11_CKM_UNDEFINED_ID;
1040 
1041 	switch (key_type) {
1042 	case PKCS11_CKK_GENERIC_SECRET:
1043 		mechanism = PKCS11_CKM_GENERIC_SECRET_KEY_GEN;
1044 		break;
1045 	case PKCS11_CKK_AES:
1046 		mechanism = PKCS11_CKM_AES_KEY_GEN;
1047 		break;
1048 	case PKCS11_CKK_MD5_HMAC:
1049 		mechanism = PKCS11_CKM_MD5_HMAC;
1050 		break;
1051 	case PKCS11_CKK_SHA_1_HMAC:
1052 		mechanism = PKCS11_CKM_SHA_1_HMAC;
1053 		break;
1054 	case PKCS11_CKK_SHA224_HMAC:
1055 		mechanism = PKCS11_CKM_SHA224_HMAC;
1056 		break;
1057 	case PKCS11_CKK_SHA256_HMAC:
1058 		mechanism = PKCS11_CKM_SHA256_HMAC;
1059 		break;
1060 	case PKCS11_CKK_SHA384_HMAC:
1061 		mechanism = PKCS11_CKM_SHA384_HMAC;
1062 		break;
1063 	case PKCS11_CKK_SHA512_HMAC:
1064 		mechanism = PKCS11_CKM_SHA512_HMAC;
1065 		break;
1066 	default:
1067 		TEE_Panic(key_type);
1068 		break;
1069 	}
1070 
1071 	mechanism_supported_key_sizes(mechanism, min_key_size,
1072 				      max_key_size);
1073 }
1074 
1075 enum pkcs11_rc check_created_attrs(struct obj_attrs *key1,
1076 				   struct obj_attrs *key2)
1077 {
1078 	enum pkcs11_rc rc = PKCS11_CKR_OK;
1079 	struct obj_attrs *secret = NULL;
1080 	uint32_t max_key_size = 0;
1081 	uint32_t min_key_size = 0;
1082 	uint32_t key_length = 0;
1083 
1084 	switch (get_class(key1)) {
1085 	case PKCS11_CKO_SECRET_KEY:
1086 		secret = key1;
1087 		break;
1088 	default:
1089 		return PKCS11_CKR_ATTRIBUTE_VALUE_INVALID;
1090 	}
1091 
1092 	if (key2)
1093 		return PKCS11_CKR_ATTRIBUTE_VALUE_INVALID;
1094 
1095 	if (secret) {
1096 		switch (get_key_type(secret)) {
1097 		case PKCS11_CKK_AES:
1098 		case PKCS11_CKK_GENERIC_SECRET:
1099 		case PKCS11_CKK_MD5_HMAC:
1100 		case PKCS11_CKK_SHA_1_HMAC:
1101 		case PKCS11_CKK_SHA224_HMAC:
1102 		case PKCS11_CKK_SHA256_HMAC:
1103 		case PKCS11_CKK_SHA384_HMAC:
1104 		case PKCS11_CKK_SHA512_HMAC:
1105 			break;
1106 		default:
1107 			return PKCS11_CKR_TEMPLATE_INCONSISTENT;
1108 		}
1109 
1110 		/* Get key size */
1111 		rc = get_u32_attribute(secret, PKCS11_CKA_VALUE_LEN,
1112 				       &key_length);
1113 		if (rc)
1114 			return PKCS11_CKR_TEMPLATE_INCOMPLETE;
1115 	}
1116 
1117 	get_key_min_max_sizes(get_key_type(key1), &min_key_size, &max_key_size);
1118 	if (key_length < min_key_size || key_length > max_key_size) {
1119 		EMSG("Length %"PRIu32" vs range [%"PRIu32" %"PRIu32"]",
1120 		     key_length, min_key_size, max_key_size);
1121 
1122 		return PKCS11_CKR_KEY_SIZE_RANGE;
1123 	}
1124 
1125 	return PKCS11_CKR_OK;
1126 }
1127 
1128 /* Check processing ID against attribute ALLOWED_MECHANISMS if any */
1129 static bool parent_key_complies_allowed_processings(uint32_t proc_id,
1130 						    struct obj_attrs *head)
1131 {
1132 	char *attr = NULL;
1133 	uint32_t size = 0;
1134 	uint32_t proc = 0;
1135 	size_t count = 0;
1136 	enum pkcs11_rc rc = PKCS11_CKR_GENERAL_ERROR;
1137 
1138 	rc = get_attribute_ptr(head, PKCS11_CKA_ALLOWED_MECHANISMS,
1139 			       (void *)&attr, &size);
1140 	if (rc == PKCS11_RV_NOT_FOUND)
1141 		return true;
1142 	if (rc) {
1143 		EMSG("unexpected attributes state");
1144 		TEE_Panic(TEE_ERROR_BAD_STATE);
1145 	}
1146 
1147 	for (count = size / sizeof(uint32_t); count; count--) {
1148 		TEE_MemMove(&proc, attr, sizeof(uint32_t));
1149 		attr += sizeof(uint32_t);
1150 
1151 		if (proc == proc_id)
1152 			return true;
1153 	}
1154 
1155 	DMSG("can't find %s in allowed list", id2str_proc(proc_id));
1156 	return false;
1157 }
1158 
1159 static enum pkcs11_attr_id func_to_attr(enum processing_func func)
1160 {
1161 	switch (func) {
1162 	case PKCS11_FUNCTION_ENCRYPT:
1163 		return PKCS11_CKA_ENCRYPT;
1164 	case PKCS11_FUNCTION_DECRYPT:
1165 		return PKCS11_CKA_DECRYPT;
1166 	case PKCS11_FUNCTION_SIGN:
1167 		return PKCS11_CKA_SIGN;
1168 	case PKCS11_FUNCTION_VERIFY:
1169 		return PKCS11_CKA_VERIFY;
1170 	case PKCS11_FUNCTION_WRAP:
1171 		return PKCS11_CKA_WRAP;
1172 	case PKCS11_FUNCTION_UNWRAP:
1173 		return PKCS11_CKA_UNWRAP;
1174 	case PKCS11_FUNCTION_DERIVE:
1175 		return PKCS11_CKA_DERIVE;
1176 	default:
1177 		return PKCS11_CKA_UNDEFINED_ID;
1178 	}
1179 }
1180 
1181 enum pkcs11_rc
1182 check_parent_attrs_against_processing(enum pkcs11_mechanism_id proc_id,
1183 				      enum processing_func function,
1184 				      struct obj_attrs *head)
1185 {
1186 	enum pkcs11_class_id key_class = get_class(head);
1187 	enum pkcs11_key_type key_type = get_key_type(head);
1188 	enum pkcs11_attr_id attr = func_to_attr(function);
1189 
1190 	if (!get_bool(head, attr)) {
1191 		DMSG("%s not permitted", id2str_attr(attr));
1192 		return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
1193 	}
1194 
1195 	/* Check processing complies with parent key family */
1196 	switch (proc_id) {
1197 	case PKCS11_CKM_AES_ECB:
1198 	case PKCS11_CKM_AES_CBC:
1199 	case PKCS11_CKM_AES_CBC_PAD:
1200 	case PKCS11_CKM_AES_CTS:
1201 	case PKCS11_CKM_AES_CTR:
1202 		if (key_class == PKCS11_CKO_SECRET_KEY &&
1203 		    key_type == PKCS11_CKK_AES)
1204 			break;
1205 
1206 		DMSG("%s invalid key %s/%s", id2str_proc(proc_id),
1207 		     id2str_class(key_class), id2str_key_type(key_type));
1208 
1209 		return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
1210 
1211 	case PKCS11_CKM_MD5_HMAC:
1212 	case PKCS11_CKM_SHA_1_HMAC:
1213 	case PKCS11_CKM_SHA224_HMAC:
1214 	case PKCS11_CKM_SHA256_HMAC:
1215 	case PKCS11_CKM_SHA384_HMAC:
1216 	case PKCS11_CKM_SHA512_HMAC:
1217 		if (key_class != PKCS11_CKO_SECRET_KEY)
1218 			return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
1219 
1220 		if (key_type == PKCS11_CKK_GENERIC_SECRET)
1221 			break;
1222 
1223 		switch (proc_id) {
1224 		case PKCS11_CKM_MD5_HMAC:
1225 			if (key_type == PKCS11_CKK_MD5_HMAC)
1226 				break;
1227 			return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
1228 		case PKCS11_CKM_SHA_1_HMAC:
1229 			if (key_type == PKCS11_CKK_SHA_1_HMAC)
1230 				break;
1231 			return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
1232 		case PKCS11_CKM_SHA224_HMAC:
1233 			if (key_type == PKCS11_CKK_SHA224_HMAC)
1234 				break;
1235 			return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
1236 		case PKCS11_CKM_SHA256_HMAC:
1237 			if (key_type == PKCS11_CKK_SHA256_HMAC)
1238 				break;
1239 			return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
1240 		case PKCS11_CKM_SHA384_HMAC:
1241 			if (key_type == PKCS11_CKK_SHA384_HMAC)
1242 				break;
1243 			return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
1244 		case PKCS11_CKM_SHA512_HMAC:
1245 			if (key_type == PKCS11_CKK_SHA512_HMAC)
1246 				break;
1247 			return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
1248 		default:
1249 			return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
1250 		}
1251 		break;
1252 
1253 	default:
1254 		DMSG("Invalid processing %#"PRIx32"/%s", proc_id,
1255 		     id2str_proc(proc_id));
1256 
1257 		return PKCS11_CKR_MECHANISM_INVALID;
1258 	}
1259 
1260 	if (!parent_key_complies_allowed_processings(proc_id, head)) {
1261 		DMSG("Allowed mechanism failed");
1262 		return PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED;
1263 	}
1264 
1265 	return PKCS11_CKR_OK;
1266 }
1267 
1268 bool attribute_is_exportable(struct pkcs11_attribute_head *req_attr,
1269 			     struct pkcs11_object *obj)
1270 {
1271 	uint8_t boolval = 0;
1272 	uint32_t boolsize = 0;
1273 	enum pkcs11_rc rc = PKCS11_CKR_GENERAL_ERROR;
1274 	enum pkcs11_class_id key_class = get_class(obj->attributes);
1275 
1276 	if (key_class != PKCS11_CKO_SECRET_KEY &&
1277 	    key_class != PKCS11_CKO_PRIVATE_KEY)
1278 		return true;
1279 
1280 	switch (req_attr->id) {
1281 	case PKCS11_CKA_PRIVATE_EXPONENT:
1282 	case PKCS11_CKA_PRIME_1:
1283 	case PKCS11_CKA_PRIME_2:
1284 	case PKCS11_CKA_EXPONENT_1:
1285 	case PKCS11_CKA_EXPONENT_2:
1286 	case PKCS11_CKA_COEFFICIENT:
1287 	case PKCS11_CKA_VALUE:
1288 		boolsize = sizeof(boolval);
1289 		rc = get_attribute(obj->attributes, PKCS11_CKA_EXTRACTABLE,
1290 				   &boolval, &boolsize);
1291 		if (rc || boolval == PKCS11_FALSE)
1292 			return false;
1293 
1294 		boolsize = sizeof(boolval);
1295 		rc = get_attribute(obj->attributes, PKCS11_CKA_SENSITIVE,
1296 				   &boolval, &boolsize);
1297 		if (rc || boolval == PKCS11_TRUE)
1298 			return false;
1299 		break;
1300 	default:
1301 		break;
1302 	}
1303 
1304 	return true;
1305 }
1306