From 672d2c75ccd3cd5f2317bb76af4c9cc4e5aa4a37 Mon Sep 17 00:00:00 2001

From: Petr Spacek <pspacek@redhat.com>

Date: Fri, 18 Jul 2014 16:19:36 +0200

Subject: [PATCH] add libhsm configuration option <AllowExtraction/>

This option allows user to generate private keys with CKA_EXTRACTABLE

flag set to TRUE. Defaults to FALSE.

---

 NEWS                    |  5 +++++

 conf/conf.rnc           |  5 ++++-

 conf/conf.xml.in        |  3 +++

 libhsm/src/lib/libhsm.c | 15 ++++++++++++---

 libhsm/src/lib/libhsm.h |  1 +

 5 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/NEWS b/NEWS

index 4db7038..2efa176 100644

--- a/NEWS

+++ b/NEWS

@@ -1,3 +1,8 @@

+* Enforcer: New repository option <AllowExtraction/> allows to generate keys

+  with CKA_EXTRACTABLE attribute set to TRUE so keys can be wrapped

+  and extracted from HSM.

+

+

 OpenDNSSEC 1.4.6 - 2014-07-21

 * Signer Engine: Print secondary server address when logging notify reply

diff --git a/conf/conf.rnc b/conf/conf.rnc

index 71d527f..65f837e 100644

--- a/conf/conf.rnc

+++ b/conf/conf.rnc

@@ -50,7 +50,10 @@ start = element Configuration {

 			element RequireBackup { empty }?,

 			# Do not maintain public keys in the repository (optional)

-			element SkipPublicKey { empty }?

+			element SkipPublicKey { empty }?,

+

+			# Generate extractable keys (CKA_EXTRACTABLE = TRUE) (optional)

+			element AllowExtraction { empty }?

 		}*

 	},

diff --git a/conf/conf.xml.in b/conf/conf.xml.in

index 0ef2ab9..0536681 100644

--- a/conf/conf.xml.in

+++ b/conf/conf.xml.in

@@ -9,6 +9,9 @@

 			<TokenLabel>OpenDNSSEC</TokenLabel>

 			<PIN>1234</PIN>

 			<SkipPublicKey/>

+			

+			<AllowExtraction/>

+			-->

 		</Repository>

diff --git a/libhsm/src/lib/libhsm.c b/libhsm/src/lib/libhsm.c

index d723b31..1f9720e 100644

--- a/libhsm/src/lib/libhsm.c

+++ b/libhsm/src/lib/libhsm.c

@@ -504,6 +504,7 @@ static void

 hsm_config_default(hsm_config_t *config)

 {

     config->use_pubkey = 1;

+    config->allow_extract = 0;

 }

 /* creates a session_t structure, and automatically adds and initializes

@@ -2054,6 +2055,8 @@ hsm_open(const char *config,

                     module_pin = (char *) xmlNodeGetContent(curNode);

                 if (xmlStrEqual(curNode->name, (const xmlChar *)"SkipPublicKey"))

                     module_config.use_pubkey = 0;

+                if (xmlStrEqual(curNode->name, (const xmlChar *)"AllowExtraction"))

+                    module_config.allow_extract = 1;

                 curNode = curNode->next;

             }

@@ -2341,10 +2344,12 @@ hsm_generate_rsa_key(hsm_ctx_t *ctx,

     CK_BBOOL ctrue = CK_TRUE;

     CK_BBOOL cfalse = CK_FALSE;

     CK_BBOOL ctoken = CK_TRUE;

+    CK_BBOOL cextractable = CK_FALSE;

     if (!ctx) ctx = _hsm_ctx;

     session = hsm_find_repository_session(ctx, repository);

     if (!session) return NULL;

+    cextractable = session->module->config->allow_extract ? CK_TRUE : CK_FALSE;

     /* check whether this key doesn't happen to exist already */

     do {

@@ -2380,7 +2385,7 @@ hsm_generate_rsa_key(hsm_ctx_t *ctx,

         { CKA_SENSITIVE,   &ctrue,   sizeof (ctrue) },

         { CKA_TOKEN,       &ctrue,   sizeof (ctrue)  },

         { CKA_PRIVATE,     &ctrue,   sizeof (ctrue)  },

-        { CKA_EXTRACTABLE, &cfalse,  sizeof (cfalse) }

+        { CKA_EXTRACTABLE, &cextractable,  sizeof (cextractable) }

     };

     rv = ((CK_FUNCTION_LIST_PTR)session->module->sym)->C_GenerateKeyPair(session->session,

@@ -2420,6 +2425,7 @@ hsm_generate_dsa_key(hsm_ctx_t *ctx,

     CK_OBJECT_HANDLE domainPar, publicKey, privateKey;

     CK_BBOOL ctrue = CK_TRUE;

     CK_BBOOL cfalse = CK_FALSE;

+    CK_BBOOL cextractable = CK_FALSE;

     /* ids we create are 16 bytes of data */

     unsigned char id[16];

@@ -2466,12 +2472,13 @@ hsm_generate_dsa_key(hsm_ctx_t *ctx,

         { CKA_SENSITIVE,           &ctrue,   sizeof(ctrue)   },

         { CKA_TOKEN,               &ctrue,   sizeof(ctrue)   },

         { CKA_PRIVATE,             &ctrue,   sizeof(ctrue)   },

-        { CKA_EXTRACTABLE,         &cfalse,  sizeof(cfalse)  }

+        { CKA_EXTRACTABLE, &cextractable,  sizeof (cextractable) }

     };

     if (!ctx) ctx = _hsm_ctx;

     session = hsm_find_repository_session(ctx, repository);

     if (!session) return NULL;

+    cextractable = session->module->config->allow_extract ? CK_TRUE : CK_FALSE;

     /* check whether this key doesn't happen to exist already */

@@ -2533,6 +2540,7 @@ hsm_generate_gost_key(hsm_ctx_t *ctx,

     CK_OBJECT_HANDLE publicKey, privateKey;

     CK_BBOOL ctrue = CK_TRUE;

     CK_BBOOL cfalse = CK_FALSE;

+    CK_BBOOL cextractable = CK_FALSE;

     /* ids we create are 16 bytes of data */

     unsigned char id[16];

@@ -2569,12 +2577,13 @@ hsm_generate_gost_key(hsm_ctx_t *ctx,

         { CKA_SENSITIVE,           &ctrue,   sizeof(ctrue)   },

         { CKA_TOKEN,               &ctrue,   sizeof(ctrue)   },

         { CKA_PRIVATE,             &ctrue,   sizeof(ctrue)   },

-        { CKA_EXTRACTABLE,         &cfalse,  sizeof(cfalse)  }

+        { CKA_EXTRACTABLE,         &cextractable,  sizeof (cextractable) }

     };

     if (!ctx) ctx = _hsm_ctx;

     session = hsm_find_repository_session(ctx, repository);

     if (!session) return NULL;

+    cextractable = session->module->config->allow_extract ? CK_TRUE : CK_FALSE;

     /* check whether this key doesn't happen to exist already */

diff --git a/libhsm/src/lib/libhsm.h b/libhsm/src/lib/libhsm.h

index 45d110a..08224b8 100644

--- a/libhsm/src/lib/libhsm.h

+++ b/libhsm/src/lib/libhsm.h

@@ -75,6 +75,7 @@

 /*! HSM configuration */

 typedef struct {

     unsigned int use_pubkey;     /*!< Maintain public keys in HSM */

+    unsigned int allow_extract;  /*!< Generate CKA_EXTRACTABLE private keys */

 } hsm_config_t;

 /*! Data type to describe an HSM */

-- 

1.9.3