Skip to content

Commit 3fb11fb

Browse files
hug-devhug-dev
committed
Add tests for operations edge cases
Adds many tests to make sure that the operations API is respected. Fixes in the service the parts that are not compliant. Also fixes #139 Signed-off-by: Hugues de Valon <hugues.devalon@arm.com>
1 parent b595ff7 commit 3fb11fb

File tree

13 files changed

+754
-90
lines changed

13 files changed

+754
-90
lines changed

‎Cargo.lock

Lines changed: 78 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,12 @@ derivative = "1.0.3"
4040
version = "3.0.0"
4141

4242
[dev-dependencies]
43-
parsec-client-test = { git = "https://github.com/parallaxsecond/parsec-client-test", tag = "0.2.2" }
43+
parsec-client-test = { git = "https://github.com/parallaxsecond/parsec-client-test", tag = "0.3.0" }
4444
num_cpus = "1.10.1"
45+
picky-asn1-der = "0.2.2"
46+
picky-asn1 = "0.2.1"
47+
serde = { version = "1.0", features = ["derive"] }
48+
sha2 = "0.8.1"
4549

4650
[build-dependencies]
4751
bindgen = "0.50.0"

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,7 @@ This project uses the following third party crates:
141141
* flexi_logger (MIT and Apache-2.0)
142142
* lazy_static (MIT and Apache-2.0)
143143
* version (MIT and Apache-2.0)
144+
* sha2 (MIT and Apache-2.0)
144145

145146
This project uses the following third party libraries:
146147
* [**Mbed Crypto**](https://github.com/ARMmbed/mbed-crypto) (Apache-2.0)

‎src/providers/mbed_provider/mod.rs

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -278,7 +278,16 @@ impl Provide for MbedProvider {
278278
&mut local_ids_handle,
279279
)?;
280280

281-
let key_attrs = utils::convert_key_attributes(&key_attributes, key_id)?;
281+
let key_attrs = utils::convert_key_attributes(&key_attributes, key_id).or_else(|e| {
282+
remove_key_id(
283+
&key_triple,
284+
key_id,
285+
&mut *store_handle,
286+
&mut local_ids_handle,
287+
)?;
288+
error!("Failed converting key attributes.");
289+
Err(e)
290+
})?;
282291

283292
let _guard = self
284293
.key_handle_mutex
@@ -331,7 +340,16 @@ impl Provide for MbedProvider {
331340
&mut local_ids_handle,
332341
)?;
333342

334-
let key_attrs = utils::convert_key_attributes(&key_attributes, key_id)?;
343+
let key_attrs = utils::convert_key_attributes(&key_attributes, key_id).or_else(|e| {
344+
remove_key_id(
345+
&key_triple,
346+
key_id,
347+
&mut *store_handle,
348+
&mut local_ids_handle,
349+
)?;
350+
error!("Failed converting key attributes.");
351+
Err(e)
352+
})?;
335353

336354
let _guard = self
337355
.key_handle_mutex

‎src/providers/mbed_provider/utils.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,11 +114,11 @@ pub fn convert_key_usage(operation: &psa_key_attributes::UsageFlags) -> psa_key_
114114
usage |= PSA_KEY_USAGE_EXPORT;
115115
}
116116

117-
if operation.sign_message || operation.sign_hash {
117+
if operation.sign_message && operation.sign_hash {
118118
usage |= PSA_KEY_USAGE_SIGN;
119119
}
120120

121-
if operation.verify_message || operation.verify_hash {
121+
if operation.verify_message && operation.verify_hash {
122122
usage |= PSA_KEY_USAGE_VERIFY;
123123
}
124124

‎src/providers/pkcs11_provider/mod.rs

Lines changed: 38 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -632,6 +632,11 @@ impl Provide for Pkcs11Provider {
632632

633633
let modulus_object = &public_key.modulus.as_unsigned_bytes_be();
634634
let exponent_object = &public_key.public_exponent.as_unsigned_bytes_be();
635+
let key_bits = key_attributes.key_bits;
636+
if key_bits != 0 && modulus_object.len() * 8 != key_bits as usize {
637+
error!("If the key_bits field is non-zero (value is {}) it must be equal to the size of the key in data.", key_attributes.key_bits);
638+
return Err(ResponseStatus::PsaErrorInvalidArgument);
639+
}
635640

636641
template.push(
637642
CK_ATTRIBUTE::new(pkcs11::types::CKA_CLASS)
@@ -711,9 +716,7 @@ impl Provide for Pkcs11Provider {
711716
let key_name = op.key_name;
712717
let key_triple = KeyTriple::new(app_name, ProviderID::Pkcs11, key_name);
713718
let store_handle = self.key_id_store.read().expect("Key store lock poisoned");
714-
let (key_id, key_attributes) = get_key_id(&key_triple, &*store_handle)?;
715-
716-
key_attributes.can_export()?;
719+
let (key_id, _key_attributes) = get_key_id(&key_triple, &*store_handle)?;
717720

718721
let session = Session::new(self, ReadWriteSession::ReadOnly)?;
719722
info!(
@@ -869,8 +872,8 @@ impl Provide for Pkcs11Provider {
869872
info!("Pkcs11 Provider - Asym Sign");
870873

871874
let key_name = op.key_name;
872-
let alg = op.alg;
873875
let mut hash = op.hash;
876+
let alg = op.alg;
874877
let key_triple = KeyTriple::new(app_name, ProviderID::Pkcs11, key_name);
875878
let store_handle = self.key_id_store.read().expect("Key store lock poisoned");
876879
let (key_id, key_attributes) = get_key_id(&key_triple, &*store_handle)?;
@@ -890,17 +893,27 @@ impl Provide for Pkcs11Provider {
890893
}
891894
}
892895

896+
if alg
897+
!= (AsymmetricSignature::RsaPkcs1v15Sign {
898+
hash_alg: Hash::Sha256,
899+
})
900+
{
901+
error!(
902+
"The PKCS 11 provider currently only supports signature algorithm to be RSA PKCS#1 v1.5 and the text hashed with SHA-256.");
903+
return Err(ResponseStatus::PsaErrorNotSupported);
904+
}
905+
906+
if hash.len() != 32 {
907+
error!("The SHA-256 hash must be 32 bytes long.");
908+
return Err(ResponseStatus::PsaErrorInvalidArgument);
909+
}
910+
893911
let mech = CK_MECHANISM {
894912
mechanism: pkcs11::types::CKM_RSA_PKCS,
895913
pParameter: std::ptr::null_mut(),
896914
ulParameterLen: 0,
897915
};
898916

899-
if hash.len() != 32 {
900-
error!("The PKCS11 provider currently only supports 256 bits long digests.");
901-
return Err(ResponseStatus::PsaErrorNotSupported);
902-
}
903-
904917
let session = Session::new(self, ReadWriteSession::ReadWrite)?;
905918
info!("Asymmetric sign in session {}", session.session_handle());
906919

@@ -946,9 +959,9 @@ impl Provide for Pkcs11Provider {
946959
info!("Pkcs11 Provider - Asym Verify");
947960

948961
let key_name = op.key_name;
949-
let alg = op.alg;
950962
let mut hash = op.hash;
951963
let signature = op.signature;
964+
let alg = op.alg;
952965
let key_triple = KeyTriple::new(app_name, ProviderID::Pkcs11, key_name);
953966
let store_handle = self.key_id_store.read().expect("Key store lock poisoned");
954967
let (key_id, key_attributes) = get_key_id(&key_triple, &*store_handle)?;
@@ -968,18 +981,28 @@ impl Provide for Pkcs11Provider {
968981
}
969982
}
970983

984+
if alg
985+
!= (AsymmetricSignature::RsaPkcs1v15Sign {
986+
hash_alg: Hash::Sha256,
987+
})
988+
{
989+
error!(
990+
"The PKCS 11 provider currently only supports signature algorithm to be RSA PKCS#1 v1.5 and the text hashed with SHA-256.");
991+
return Err(ResponseStatus::PsaErrorNotSupported);
992+
}
993+
994+
if hash.len() != 32 {
995+
error!("The SHA-256 hash must be 32 bytes long.");
996+
return Err(ResponseStatus::PsaErrorInvalidArgument);
997+
}
998+
971999
let mech = CK_MECHANISM {
9721000
// Verify without hashing.
9731001
mechanism: pkcs11::types::CKM_RSA_PKCS,
9741002
pParameter: std::ptr::null_mut(),
9751003
ulParameterLen: 0,
9761004
};
9771005

978-
if hash.len() != 32 {
979-
error!("The PKCS11 provider currently only supports 256 bits long digests.");
980-
return Err(ResponseStatus::PsaErrorNotSupported);
981-
}
982-
9831006
let session = Session::new(self, ReadWriteSession::ReadWrite)?;
9841007
info!("Asymmetric verify in session {}", session.session_handle());
9851008

‎src/providers/tpm_provider/mod.rs

Lines changed: 32 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -251,8 +251,14 @@ impl Provide for TpmProvider {
251251
return Err(ResponseStatus::PsaErrorNotSupported);
252252
}
253253
let key_data = public_key.modulus.as_unsigned_bytes_be();
254-
255254
let len = key_data.len();
255+
256+
let key_bits = attributes.key_bits;
257+
if key_bits != 0 && len * 8 != key_bits as usize {
258+
error!("If the key_bits field is non-zero (value is {}) it must be equal to the size of the key in data.", attributes.key_bits);
259+
return Err(ResponseStatus::PsaErrorInvalidArgument);
260+
}
261+
256262
if len != 128 && len != 256 {
257263
error!(
258264
"The TPM provider only supports 1024 and 2048 bits RSA public keys ({} bits given).",
@@ -295,9 +301,7 @@ impl Provide for TpmProvider {
295301
.lock()
296302
.expect("ESAPI Context lock poisoned");
297303

298-
let (password_context, key_attributes) = get_password_context(&*store_handle, key_triple)?;
299-
300-
key_attributes.can_export()?;
304+
let (password_context, _key_attributes) = get_password_context(&*store_handle, key_triple)?;
301305

302306
let pub_key_data = esapi_context
303307
.read_public_key(password_context.context)
@@ -361,12 +365,21 @@ impl Provide for TpmProvider {
361365
.lock()
362366
.expect("ESAPI Context lock poisoned");
363367

364-
let len = hash.len();
365-
if len > 64 {
366-
error!("The buffer given to sign is too big. Its length is {} and maximum authorised in the TPM provider is 64.", len);
368+
if alg
369+
!= (AsymmetricSignature::RsaPkcs1v15Sign {
370+
hash_alg: Hash::Sha256,
371+
})
372+
{
373+
error!(
374+
"The TPM provider currently only supports signature algorithm to be RSA PKCS#1 v1.5 and the text hashed with SHA-256.");
367375
return Err(ResponseStatus::PsaErrorNotSupported);
368376
}
369377

378+
if hash.len() != 32 {
379+
error!("The SHA-256 hash must be 32 bytes long.");
380+
return Err(ResponseStatus::PsaErrorInvalidArgument);
381+
}
382+
370383
let (password_context, key_attributes) = get_password_context(&*store_handle, key_triple)?;
371384

372385
key_attributes.can_sign_hash()?;
@@ -417,12 +430,21 @@ impl Provide for TpmProvider {
417430
.lock()
418431
.expect("ESAPI Context lock poisoned");
419432

420-
let len = hash.len();
421-
if len > 64 {
422-
error!("The buffer given to sign is too big. Its length is {} and maximum authorised is 64 in the TPM provider.", len);
433+
if alg
434+
!= (AsymmetricSignature::RsaPkcs1v15Sign {
435+
hash_alg: Hash::Sha256,
436+
})
437+
{
438+
error!(
439+
"The TPM provider currently only supports signature algorithm to be RSA PKCS#1 v1.5 and the text hashed with SHA-256.");
423440
return Err(ResponseStatus::PsaErrorNotSupported);
424441
}
425442

443+
if hash.len() != 32 {
444+
error!("The SHA-256 hash must be 32 bytes long.");
445+
return Err(ResponseStatus::PsaErrorInvalidArgument);
446+
}
447+
426448
let signature = Signature {
427449
scheme: AsymSchemeUnion::RSASSA(TPM2_ALG_SHA256),
428450
signature,

0 commit comments

Comments
 (0)