summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorwtchang%redhat.com <devnull@localhost>2006-10-02 22:58:51 +0000
committerwtchang%redhat.com <devnull@localhost>2006-10-02 22:58:51 +0000
commitffefc59cf7f0f63e694914df8712d8844f02e1af (patch)
treec95f0eb28488f05a82cf820348b08790bee77daa
parent63c34f693d96f0e4d58117ac638aa01507899d90 (diff)
downloadnss-hg-ffefc59cf7f0f63e694914df8712d8844f02e1af.tar.gz
Bugzilla Bug 354900: audit the modifications, accesses, deletions, and
additions of cryptographic keys. r=glen.beasley,relyea. Modified files: fipstest.c fipstokn.c manifest.mn pkcs11c.c softoken.h Added file: fipsaudt.c Tag: NSS_3_11_BRANCH
-rw-r--r--security/nss/lib/softoken/fipstest.c86
-rw-r--r--security/nss/lib/softoken/fipstokn.c221
-rw-r--r--security/nss/lib/softoken/manifest.mn1
-rw-r--r--security/nss/lib/softoken/pkcs11c.c2
-rw-r--r--security/nss/lib/softoken/softoken.h65
5 files changed, 313 insertions, 62 deletions
diff --git a/security/nss/lib/softoken/fipstest.c b/security/nss/lib/softoken/fipstest.c
index 942bd4034..4e6461db0 100644
--- a/security/nss/lib/softoken/fipstest.c
+++ b/security/nss/lib/softoken/fipstest.c
@@ -45,6 +45,8 @@
#include "lowkeyi.h" /* Required for RSA and DSA. */
#include "pkcs11.h" /* Required for PKCS #11. */
#include "secerr.h"
+#include "prenv.h"
+#include "prprf.h"
#ifdef NSS_ENABLE_ECC
#include "secdert.h" /* Required for ECDSA */
@@ -147,6 +149,12 @@ sftk_fips_RC2_PowerUpSelfTest( void )
unsigned int rc2_bytes_decrypted;
SECStatus rc2_status;
+ const char *envp = NULL;
+
+ if ((envp = PR_GetEnv("sftk_fips_RC2_PowerUpSelfTest")) != NULL) {
+ PR_fprintf(PR_STDERR, "sftk_fips_RC2_PowerUpSelfTest failing\n");
+ return CKR_DEVICE_ERROR;
+ }
/******************************************************/
/* RC2-ECB Single-Round Known Answer Encryption Test: */
@@ -271,6 +279,12 @@ sftk_fips_RC4_PowerUpSelfTest( void )
unsigned int rc4_bytes_encrypted;
unsigned int rc4_bytes_decrypted;
SECStatus rc4_status;
+ const char *envp = NULL;
+
+ if ((envp = PR_GetEnv("sftk_fips_RC4_PowerUpSelfTest")) != NULL) {
+ PR_fprintf(PR_STDERR, "sftk_fips_RC4_PowerUpSelfTest failing\n");
+ return CKR_DEVICE_ERROR;
+ }
/**************************************************/
@@ -346,6 +360,12 @@ sftk_fips_DES_PowerUpSelfTest( void )
unsigned int des_bytes_encrypted;
unsigned int des_bytes_decrypted;
SECStatus des_status;
+ const char *envp = NULL;
+
+ if ((envp = PR_GetEnv("sftk_fips_DES_PowerUpSelfTest")) != NULL) {
+ PR_fprintf(PR_STDERR, "sftk_fips_DES_PowerUpSelfTest failing\n");
+ return CKR_DEVICE_ERROR;
+ }
/******************************************************/
@@ -473,6 +493,12 @@ sftk_fips_DES3_PowerUpSelfTest( void )
unsigned int des3_bytes_encrypted;
unsigned int des3_bytes_decrypted;
SECStatus des3_status;
+ const char *envp = NULL;
+
+ if ((envp = PR_GetEnv("sftk_fips_DES3_PowerUpSelfTest")) != NULL) {
+ PR_fprintf(PR_STDERR, "sftk_fips_DES3_PowerUpSelfTest failing\n");
+ return CKR_DEVICE_ERROR;
+ }
/*******************************************************/
@@ -635,7 +661,12 @@ sftk_fips_AES_PowerUpSelfTest( int aes_key_size )
unsigned int aes_bytes_encrypted;
unsigned int aes_bytes_decrypted;
SECStatus aes_status;
+ const char *envp = NULL;
+ if ((envp = PR_GetEnv("sftk_fips_AES_PowerUpSelfTest")) != NULL) {
+ PR_fprintf(PR_STDERR, "sftk_fips_AES_PowerUpSelfTest failing\n");
+ return CKR_DEVICE_ERROR;
+ }
/*check if aes_key_size is 128, 192, or 256 bits */
if ((aes_key_size != FIPS_AES_128_KEY_SIZE) &&
(aes_key_size != FIPS_AES_192_KEY_SIZE) &&
@@ -761,6 +792,12 @@ sftk_fips_MD2_PowerUpSelfTest( void )
MD2Context * md2_context;
unsigned int md2_bytes_hashed;
PRUint8 md2_computed_digest[MD2_LENGTH];
+ const char *envp = NULL;
+
+ if ((envp = PR_GetEnv("sftk_fips_MD2_PowerUpSelfTest")) != NULL) {
+ PR_fprintf(PR_STDERR, "sftk_fips_MD2_PowerUpSelfTest failing\n");
+ return CKR_DEVICE_ERROR;
+ }
/***********************************************/
@@ -801,6 +838,12 @@ sftk_fips_MD5_PowerUpSelfTest( void )
/* MD5 variables. */
PRUint8 md5_computed_digest[MD5_LENGTH];
SECStatus md5_status;
+ const char *envp = NULL;
+
+ if ((envp = PR_GetEnv("sftk_fips_MD5_PowerUpSelfTest")) != NULL) {
+ PR_fprintf(PR_STDERR, "sftk_fips_MD5_PowerUpSelfTest failing\n");
+ return CKR_DEVICE_ERROR;
+ }
/***********************************************/
@@ -900,6 +943,12 @@ sftk_fips_HMAC_PowerUpSelfTest( void )
SECStatus hmac_status;
PRUint8 hmac_computed[HASH_LENGTH_MAX];
+ const char *envp = NULL;
+
+ if ((envp = PR_GetEnv("sftk_fips_HMAC_PowerUpSelfTest")) != NULL) {
+ PR_fprintf(PR_STDERR, "sftk_fips_HMAC_PowerUpSelfTest failing\n");
+ return CKR_DEVICE_ERROR;
+ }
/***************************************************/
/* HMAC SHA-1 Single-Round Known Answer HMAC Test. */
@@ -1007,6 +1056,12 @@ sftk_fips_SHA_PowerUpSelfTest( void )
/* SHA-X variables. */
PRUint8 sha_computed_digest[HASH_LENGTH_MAX];
SECStatus sha_status;
+ const char *envp = NULL;
+
+ if ((envp = PR_GetEnv("sftk_fips_SHA_PowerUpSelfTest")) != NULL) {
+ PR_fprintf(PR_STDERR, "sftk_fips_SHA_PowerUpSelfTest failing\n");
+ return CKR_DEVICE_ERROR;
+ }
/*************************************************/
/* SHA-1 Single-Round Known Answer Hashing Test. */
@@ -1076,6 +1131,12 @@ sftk_fips_RSA_PowerUpSigSelfTest (HASH_HashType shaAlg,
unsigned int rsa_bytes_signed;
unsigned char rsa_computed_signature[FIPS_RSA_SIGNATURE_LENGTH];
SECStatus rv;
+ const char *envp = NULL;
+
+ if ((envp = PR_GetEnv("sftk_fips_RSA_PowerUpSigSelfTest")) != NULL) {
+ PR_fprintf(PR_STDERR, "sftk_fips_RSA_PowerUpSigSelfTest failing\n");
+ return CKR_DEVICE_ERROR;
+ }
if (shaAlg == HASH_AlgSHA1) {
if (SHA1_HashBuf(sha, rsa_known_msg, rsa_kmsg_length)
@@ -1392,6 +1453,12 @@ sftk_fips_RSA_PowerUpSelfTest( void )
NSSLOWKEYPrivateKey low_private_key = { NULL, NSSLOWKEYRSAKey, };
PRUint8 rsa_computed_ciphertext[FIPS_RSA_ENCRYPT_LENGTH];
PRUint8 rsa_computed_plaintext[FIPS_RSA_DECRYPT_LENGTH];
+ const char *envp = NULL;
+
+ if ((envp = PR_GetEnv("sftk_fips_RSA_PowerUpSelfTest")) != NULL) {
+ PR_fprintf(PR_STDERR, "sftk_fips_RSA_PowerUpSelfTest failing\n");
+ return CKR_DEVICE_ERROR;
+ }
/****************************************/
/* Compose RSA Public/Private Key Pair. */
@@ -1521,6 +1588,12 @@ sftk_fips_ECDSA_Test(const PRUint8 *encodedParams,
ECPrivateKey *ecdsa_private_key = NULL;
ECPublicKey ecdsa_public_key;
SECStatus ecdsaStatus = SECSuccess;
+ const char *envp = NULL;
+
+ if ((envp = PR_GetEnv("sftk_fips_ECDSA_PowerUpSelfTest")) != NULL) {
+ PR_fprintf(PR_STDERR, "sftk_fips_ECDSA_PowerUpSelfTest failing\n");
+ return CKR_DEVICE_ERROR;
+ }
/* construct the ECDSA private/public key pair */
encodedparams.type = siBuffer;
@@ -1755,6 +1828,13 @@ sftk_fips_DSA_PowerUpSelfTest( void )
{ FIPS_DSA_TYPE, (unsigned char *)dsa_Q, FIPS_DSA_SUBPRIME_LENGTH },
{ FIPS_DSA_TYPE, (unsigned char *)dsa_G, FIPS_DSA_BASE_LENGTH }};
+ const char *envp = NULL;
+
+ if ((envp = PR_GetEnv("sftk_fips_DSA_PowerUpSelfTest")) != NULL) {
+ PR_fprintf(PR_STDERR, "sftk_fips_DSA_PowerUpSelfTest failing\n");
+ return CKR_DEVICE_ERROR;
+ }
+
/*******************************************/
/* Generate a DSA public/private key pair. */
/*******************************************/
@@ -1847,6 +1927,12 @@ sftk_fips_RNG_PowerUpSelfTest( void )
PRUint8 GENX[2*SHA1_LENGTH];
PRUint8 DSAX[FIPS_DSA_SUBPRIME_LENGTH];
PRUint8 XKey[FIPS_RNG_XKEY_LENGTH];
+ const char *envp = NULL;
+
+ if ((envp = PR_GetEnv("sftk_fips_RNG_PowerUpSelfTest")) != NULL) {
+ PR_fprintf(PR_STDERR, "sftk_fips_RNG_PowerUpSelfTest failing\n");
+ return CKR_DEVICE_ERROR;
+ }
PORT_Memcpy (XKey, XKeyValue, FIPS_RNG_XKEY_LENGTH);
diff --git a/security/nss/lib/softoken/fipstokn.c b/security/nss/lib/softoken/fipstokn.c
index 1e86b3796..81f1238a6 100644
--- a/security/nss/lib/softoken/fipstokn.c
+++ b/security/nss/lib/softoken/fipstokn.c
@@ -295,21 +295,27 @@ static CK_FUNCTION_LIST sftk_fipsTable = {
#undef __PASTE
+/* CKO_NOT_A_KEY can be any object class that's not a key object. */
+#define CKO_NOT_A_KEY CKO_DATA
+
+#define SFTK_IS_KEY_OBJECT(objClass) \
+ (((objClass) == CKO_PUBLIC_KEY) || \
+ ((objClass) == CKO_PRIVATE_KEY) || \
+ ((objClass) == CKO_SECRET_KEY))
+
+#define SFTK_IS_SECURE_KEY_OBJECT(objClass) \
+ (((objClass) == CKO_PRIVATE_KEY) || ((objClass) == CKO_SECRET_KEY))
+
static CK_RV
-fips_login_if_key_object(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject)
+fips_get_object_class(CK_SESSION_HANDLE hSession,
+ CK_OBJECT_HANDLE hObject, CK_OBJECT_CLASS *pObjClass)
{
CK_RV rv;
- CK_OBJECT_CLASS objClass;
CK_ATTRIBUTE class;
class.type = CKA_CLASS;
- class.pValue = &objClass;
- class.ulValueLen = sizeof(objClass);
+ class.pValue = pObjClass;
+ class.ulValueLen = sizeof(*pObjClass);
rv = NSC_GetAttributeValue(hSession, hObject, &class, 1);
- if (rv == CKR_OK) {
- if ((objClass == CKO_PRIVATE_KEY) || (objClass == CKO_SECRET_KEY)) {
- rv = sftk_fipsCheck();
- }
- }
return rv;
}
@@ -568,7 +574,7 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
NSSAuditSeverity severity = (rv == CKR_OK) ?
NSS_AUDIT_INFO : NSS_AUDIT_ERROR;
PR_snprintf(msg,sizeof msg,
- "C_InitPIN(hSession=%lu)=0x%08lX",
+ "C_InitPIN(hSession=0x%08lX)=0x%08lX",
(PRUint32)hSession,(PRUint32)rv);
sftk_LogAuditMessage(severity, msg);
}
@@ -590,7 +596,7 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
NSSAuditSeverity severity = (rv == CKR_OK) ?
NSS_AUDIT_INFO : NSS_AUDIT_ERROR;
PR_snprintf(msg,sizeof msg,
- "C_SetPIN(hSession=%lu)=0x%08lX",
+ "C_SetPIN(hSession=0x%08lX)=0x%08lX",
(PRUint32)hSession,(PRUint32)rv);
sftk_LogAuditMessage(severity, msg);
}
@@ -650,7 +656,7 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
NSSAuditSeverity severity;
severity = successful ? NSS_AUDIT_INFO : NSS_AUDIT_ERROR;
PR_snprintf(msg,sizeof msg,
- "C_Login(hSession=%lu, userType=%lu)=0x%08lX",
+ "C_Login(hSession=0x%08lX, userType=%lu)=0x%08lX",
(PRUint32)hSession,(PRUint32)userType,(PRUint32)rv);
sftk_LogAuditMessage(severity, msg);
}
@@ -669,7 +675,7 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
NSSAuditSeverity severity = (rv == CKR_OK) ?
NSS_AUDIT_INFO : NSS_AUDIT_ERROR;
PR_snprintf(msg,sizeof msg,
- "C_Logout(hSession=%lu)=0x%08lX",
+ "C_Logout(hSession=0x%08lX)=0x%08lX",
(PRUint32)hSession,(PRUint32)rv);
sftk_LogAuditMessage(severity, msg);
}
@@ -687,10 +693,15 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
if (classptr == NULL) return CKR_TEMPLATE_INCOMPLETE;
/* FIPS can't create keys from raw key material */
- if ((*classptr == CKO_SECRET_KEY) || (*classptr == CKO_PRIVATE_KEY)) {
- return CKR_ATTRIBUTE_VALUE_INVALID;
+ if (SFTK_IS_SECURE_KEY_OBJECT(*classptr)) {
+ rv = CKR_ATTRIBUTE_VALUE_INVALID;
+ } else {
+ rv = NSC_CreateObject(hSession,pTemplate,ulCount,phObject);
}
- return NSC_CreateObject(hSession,pTemplate,ulCount,phObject);
+ if (sftk_audit_enabled && SFTK_IS_KEY_OBJECT(*classptr)) {
+ sftk_AuditCreateObject(hSession,pTemplate,ulCount,phObject,rv);
+ }
+ return rv;
}
@@ -699,15 +710,23 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
/* FC_CopyObject copies an object, creating a new object for the copy. */
CK_RV FC_CopyObject(CK_SESSION_HANDLE hSession,
- CK_OBJECT_HANDLE hObject, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG usCount,
+ CK_OBJECT_HANDLE hObject, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount,
CK_OBJECT_HANDLE_PTR phNewObject) {
CK_RV rv;
+ CK_OBJECT_CLASS objClass = CKO_NOT_A_KEY;
SFTK_FIPSFATALCHECK();
- rv = fips_login_if_key_object(hSession, hObject);
- if (rv != CKR_OK) {
- return rv;
+ rv = fips_get_object_class(hSession, hObject, &objClass);
+ if ((rv == CKR_OK) && SFTK_IS_SECURE_KEY_OBJECT(objClass)) {
+ rv = sftk_fipsCheck();
}
- return NSC_CopyObject(hSession,hObject,pTemplate,usCount,phNewObject);
+ if (rv == CKR_OK) {
+ rv = NSC_CopyObject(hSession,hObject,pTemplate,ulCount,phNewObject);
+ }
+ if (sftk_audit_enabled && SFTK_IS_KEY_OBJECT(objClass)) {
+ sftk_AuditCopyObject(hSession,
+ hObject,pTemplate,ulCount,phNewObject,rv);
+ }
+ return rv;
}
@@ -715,51 +734,79 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
CK_RV FC_DestroyObject(CK_SESSION_HANDLE hSession,
CK_OBJECT_HANDLE hObject) {
CK_RV rv;
+ CK_OBJECT_CLASS objClass = CKO_NOT_A_KEY;
SFTK_FIPSFATALCHECK();
- rv = fips_login_if_key_object(hSession, hObject);
- if (rv != CKR_OK) {
- return rv;
+ rv = fips_get_object_class(hSession, hObject, &objClass);
+ if ((rv == CKR_OK) && SFTK_IS_SECURE_KEY_OBJECT(objClass)) {
+ rv = sftk_fipsCheck();
}
- return NSC_DestroyObject(hSession,hObject);
+ if (rv == CKR_OK) {
+ rv = NSC_DestroyObject(hSession,hObject);
+ }
+ if (sftk_audit_enabled && SFTK_IS_KEY_OBJECT(objClass)) {
+ sftk_AuditDestroyObject(hSession,hObject,rv);
+ }
+ return rv;
}
/* FC_GetObjectSize gets the size of an object in bytes. */
CK_RV FC_GetObjectSize(CK_SESSION_HANDLE hSession,
- CK_OBJECT_HANDLE hObject, CK_ULONG_PTR pusSize) {
+ CK_OBJECT_HANDLE hObject, CK_ULONG_PTR pulSize) {
CK_RV rv;
+ CK_OBJECT_CLASS objClass = CKO_NOT_A_KEY;
SFTK_FIPSFATALCHECK();
- rv = fips_login_if_key_object(hSession, hObject);
- if (rv != CKR_OK) {
- return rv;
+ rv = fips_get_object_class(hSession, hObject, &objClass);
+ if ((rv == CKR_OK) && SFTK_IS_SECURE_KEY_OBJECT(objClass)) {
+ rv = sftk_fipsCheck();
}
- return NSC_GetObjectSize(hSession, hObject, pusSize);
+ if (rv == CKR_OK) {
+ rv = NSC_GetObjectSize(hSession, hObject, pulSize);
+ }
+ if (sftk_audit_enabled && SFTK_IS_KEY_OBJECT(objClass)) {
+ sftk_AuditGetObjectSize(hSession, hObject, pulSize, rv);
+ }
+ return rv;
}
/* FC_GetAttributeValue obtains the value of one or more object attributes. */
CK_RV FC_GetAttributeValue(CK_SESSION_HANDLE hSession,
- CK_OBJECT_HANDLE hObject,CK_ATTRIBUTE_PTR pTemplate,CK_ULONG usCount) {
+ CK_OBJECT_HANDLE hObject,CK_ATTRIBUTE_PTR pTemplate,CK_ULONG ulCount) {
CK_RV rv;
+ CK_OBJECT_CLASS objClass = CKO_NOT_A_KEY;
SFTK_FIPSFATALCHECK();
- rv = fips_login_if_key_object(hSession, hObject);
- if (rv != CKR_OK) {
- return rv;
+ rv = fips_get_object_class(hSession, hObject, &objClass);
+ if ((rv == CKR_OK) && SFTK_IS_SECURE_KEY_OBJECT(objClass)) {
+ rv = sftk_fipsCheck();
}
- return NSC_GetAttributeValue(hSession,hObject,pTemplate,usCount);
+ if (rv == CKR_OK) {
+ rv = NSC_GetAttributeValue(hSession,hObject,pTemplate,ulCount);
+ }
+ if (sftk_audit_enabled && SFTK_IS_KEY_OBJECT(objClass)) {
+ sftk_AuditGetAttributeValue(hSession,hObject,pTemplate,ulCount,rv);
+ }
+ return rv;
}
/* FC_SetAttributeValue modifies the value of one or more object attributes */
CK_RV FC_SetAttributeValue (CK_SESSION_HANDLE hSession,
- CK_OBJECT_HANDLE hObject,CK_ATTRIBUTE_PTR pTemplate,CK_ULONG usCount) {
+ CK_OBJECT_HANDLE hObject,CK_ATTRIBUTE_PTR pTemplate,CK_ULONG ulCount) {
CK_RV rv;
+ CK_OBJECT_CLASS objClass = CKO_NOT_A_KEY;
SFTK_FIPSFATALCHECK();
- rv = fips_login_if_key_object(hSession, hObject);
- if (rv != CKR_OK) {
- return rv;
+ rv = fips_get_object_class(hSession, hObject, &objClass);
+ if ((rv == CKR_OK) && SFTK_IS_SECURE_KEY_OBJECT(objClass)) {
+ rv = sftk_fipsCheck();
}
- return NSC_SetAttributeValue(hSession,hObject,pTemplate,usCount);
+ if (rv == CKR_OK) {
+ rv = NSC_SetAttributeValue(hSession,hObject,pTemplate,ulCount);
+ }
+ if (sftk_audit_enabled && SFTK_IS_KEY_OBJECT(objClass)) {
+ sftk_AuditSetAttributeValue(hSession,hObject,pTemplate,ulCount,rv);
+ }
+ return rv;
}
@@ -819,7 +866,11 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
CK_RV FC_EncryptInit(CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey) {
SFTK_FIPSCHECK();
- return NSC_EncryptInit(hSession,pMechanism,hKey);
+ rv = NSC_EncryptInit(hSession,pMechanism,hKey);
+ if (sftk_audit_enabled) {
+ sftk_AuditCryptInit("Encrypt",hSession,pMechanism,hKey,rv);
+ }
+ return rv;
}
/* FC_Encrypt encrypts single-part data. */
@@ -860,7 +911,11 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
CK_RV FC_DecryptInit( CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey) {
SFTK_FIPSCHECK();
- return NSC_DecryptInit(hSession,pMechanism,hKey);
+ rv = NSC_DecryptInit(hSession,pMechanism,hKey);
+ if (sftk_audit_enabled) {
+ sftk_AuditCryptInit("Decrypt",hSession,pMechanism,hKey,rv);
+ }
+ return rv;
}
/* FC_Decrypt decrypts encrypted data in a single part. */
@@ -938,7 +993,11 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
CK_RV FC_SignInit(CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey) {
SFTK_FIPSCHECK();
- return NSC_SignInit(hSession,pMechanism,hKey);
+ rv = NSC_SignInit(hSession,pMechanism,hKey);
+ if (sftk_audit_enabled) {
+ sftk_AuditCryptInit("Sign",hSession,pMechanism,hKey,rv);
+ }
+ return rv;
}
@@ -980,7 +1039,11 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
CK_RV FC_SignRecoverInit(CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,CK_OBJECT_HANDLE hKey) {
SFTK_FIPSCHECK();
- return NSC_SignRecoverInit(hSession,pMechanism,hKey);
+ rv = NSC_SignRecoverInit(hSession,pMechanism,hKey);
+ if (sftk_audit_enabled) {
+ sftk_AuditCryptInit("SignRecover",hSession,pMechanism,hKey,rv);
+ }
+ return rv;
}
@@ -1003,7 +1066,11 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
CK_RV FC_VerifyInit(CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,CK_OBJECT_HANDLE hKey) {
SFTK_FIPSCHECK();
- return NSC_VerifyInit(hSession,pMechanism,hKey);
+ rv = NSC_VerifyInit(hSession,pMechanism,hKey);
+ if (sftk_audit_enabled) {
+ sftk_AuditCryptInit("Verify",hSession,pMechanism,hKey,rv);
+ }
+ return rv;
}
@@ -1046,7 +1113,11 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
CK_RV FC_VerifyRecoverInit(CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,CK_OBJECT_HANDLE hKey) {
SFTK_FIPSCHECK();
- return NSC_VerifyRecoverInit(hSession,pMechanism,hKey);
+ rv = NSC_VerifyRecoverInit(hSession,pMechanism,hKey);
+ if (sftk_audit_enabled) {
+ sftk_AuditCryptInit("VerifyRecover",hSession,pMechanism,hKey,rv);
+ }
+ return rv;
}
@@ -1082,7 +1153,11 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
}
}
- return NSC_GenerateKey(hSession,pMechanism,pTemplate,ulCount,phKey);
+ rv = NSC_GenerateKey(hSession,pMechanism,pTemplate,ulCount,phKey);
+ if (sftk_audit_enabled) {
+ sftk_AuditGenerateKey(hSession,pMechanism,pTemplate,ulCount,phKey,rv);
+ }
+ return rv;
}
@@ -1114,6 +1189,11 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
/* pairwise consistency check failed. */
sftk_fatalError = PR_TRUE;
}
+ if (sftk_audit_enabled) {
+ sftk_AuditGenerateKeyPair(hSession,pMechanism,pPublicKeyTemplate,
+ usPublicKeyAttributeCount,pPrivateKeyTemplate,
+ usPrivateKeyAttributeCount,phPublicKey,phPrivateKey,crv);
+ }
return crv;
}
@@ -1122,18 +1202,23 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
CK_RV FC_WrapKey(CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hWrappingKey,
CK_OBJECT_HANDLE hKey, CK_BYTE_PTR pWrappedKey,
- CK_ULONG_PTR pusWrappedKeyLen) {
+ CK_ULONG_PTR pulWrappedKeyLen) {
SFTK_FIPSCHECK();
- return NSC_WrapKey(hSession,pMechanism,hWrappingKey,hKey,pWrappedKey,
- pusWrappedKeyLen);
+ rv = NSC_WrapKey(hSession,pMechanism,hWrappingKey,hKey,pWrappedKey,
+ pulWrappedKeyLen);
+ if (sftk_audit_enabled) {
+ sftk_AuditWrapKey(hSession,pMechanism,hWrappingKey,hKey,pWrappedKey,
+ pulWrappedKeyLen,rv);
+ }
+ return rv;
}
/* FC_UnwrapKey unwraps (decrypts) a wrapped key, creating a new key object. */
CK_RV FC_UnwrapKey(CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hUnwrappingKey,
- CK_BYTE_PTR pWrappedKey, CK_ULONG usWrappedKeyLen,
- CK_ATTRIBUTE_PTR pTemplate, CK_ULONG usAttributeCount,
+ CK_BYTE_PTR pWrappedKey, CK_ULONG ulWrappedKeyLen,
+ CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulAttributeCount,
CK_OBJECT_HANDLE_PTR phKey) {
CK_BBOOL *boolptr;
@@ -1142,21 +1227,26 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
/* all secret keys must be sensitive, if the upper level code tries to say
* otherwise, reject it. */
boolptr = (CK_BBOOL *) fc_getAttribute(pTemplate,
- usAttributeCount, CKA_SENSITIVE);
+ ulAttributeCount, CKA_SENSITIVE);
if (boolptr != NULL) {
if (!(*boolptr)) {
return CKR_ATTRIBUTE_VALUE_INVALID;
}
}
- return NSC_UnwrapKey(hSession,pMechanism,hUnwrappingKey,pWrappedKey,
- usWrappedKeyLen,pTemplate,usAttributeCount,phKey);
+ rv = NSC_UnwrapKey(hSession,pMechanism,hUnwrappingKey,pWrappedKey,
+ ulWrappedKeyLen,pTemplate,ulAttributeCount,phKey);
+ if (sftk_audit_enabled) {
+ sftk_AuditUnwrapKey(hSession,pMechanism,hUnwrappingKey,pWrappedKey,
+ ulWrappedKeyLen,pTemplate,ulAttributeCount,phKey,rv);
+ }
+ return rv;
}
/* FC_DeriveKey derives a key from a base key, creating a new key object. */
CK_RV FC_DeriveKey( CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hBaseKey,
- CK_ATTRIBUTE_PTR pTemplate, CK_ULONG usAttributeCount,
+ CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulAttributeCount,
CK_OBJECT_HANDLE_PTR phKey) {
CK_BBOOL *boolptr;
@@ -1165,14 +1255,19 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
/* all secret keys must be sensitive, if the upper level code tries to say
* otherwise, reject it. */
boolptr = (CK_BBOOL *) fc_getAttribute(pTemplate,
- usAttributeCount, CKA_SENSITIVE);
+ ulAttributeCount, CKA_SENSITIVE);
if (boolptr != NULL) {
if (!(*boolptr)) {
return CKR_ATTRIBUTE_VALUE_INVALID;
}
}
- return NSC_DeriveKey(hSession,pMechanism,hBaseKey,pTemplate,
- usAttributeCount, phKey);
+ rv = NSC_DeriveKey(hSession,pMechanism,hBaseKey,pTemplate,
+ ulAttributeCount, phKey);
+ if (sftk_audit_enabled) {
+ sftk_AuditDeriveKey(hSession,pMechanism,hBaseKey,pTemplate,
+ ulAttributeCount,phKey,rv);
+ }
+ return rv;
}
/*
@@ -1206,7 +1301,7 @@ CK_RV FC_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo) {
if (sftk_audit_enabled) {
char msg[128];
PR_snprintf(msg,sizeof msg,
- "C_GenerateRandom(hSession=%lu, pRandomData=%p, "
+ "C_GenerateRandom(hSession=0x%08lX, pRandomData=%p, "
"ulRandomLen=%lu)=0x%08lX "
"self-test: continuous RNG test failed",
(PRUint32)hSession,pRandomData,
@@ -1315,7 +1410,11 @@ CK_RV FC_DecryptVerifyUpdate(CK_SESSION_HANDLE hSession,
*/
CK_RV FC_DigestKey(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hKey) {
SFTK_FIPSCHECK();
- return NSC_DigestKey(hSession,hKey);
+ rv = NSC_DigestKey(hSession,hKey);
+ if (sftk_audit_enabled) {
+ sftk_AuditDigestKey(hSession,hKey,rv);
+ }
+ return rv;
}
diff --git a/security/nss/lib/softoken/manifest.mn b/security/nss/lib/softoken/manifest.mn
index 294bd0b49..983d66887 100644
--- a/security/nss/lib/softoken/manifest.mn
+++ b/security/nss/lib/softoken/manifest.mn
@@ -70,6 +70,7 @@ CSRCS = \
dbinit.c \
dbmshim.c \
ecdecode.c \
+ fipsaudt.c \
fipstest.c \
fipstokn.c \
keydb.c \
diff --git a/security/nss/lib/softoken/pkcs11c.c b/security/nss/lib/softoken/pkcs11c.c
index dc1dc67f4..b722d3d4c 100644
--- a/security/nss/lib/softoken/pkcs11c.c
+++ b/security/nss/lib/softoken/pkcs11c.c
@@ -3813,7 +3813,7 @@ ecgn_done:
if (sftk_audit_enabled) {
char msg[128];
PR_snprintf(msg,sizeof msg,
- "C_GenerateKeyPair(hSession=%lu, "
+ "C_GenerateKeyPair(hSession=0x%08lX, "
"pMechanism->mechanism=0x%08lX)=0x%08lX "
"self-test: pair-wise consistency test failed",
(PRUint32)hSession,(PRUint32)pMechanism->mechanism,
diff --git a/security/nss/lib/softoken/softoken.h b/security/nss/lib/softoken/softoken.h
index 27b25e892..ed9108dcc 100644
--- a/security/nss/lib/softoken/softoken.h
+++ b/security/nss/lib/softoken/softoken.h
@@ -184,6 +184,71 @@ extern PRBool sftk_audit_enabled;
extern void sftk_LogAuditMessage(NSSAuditSeverity severity, const char *msg);
+extern void sftk_AuditCreateObject(CK_SESSION_HANDLE hSession,
+ CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount,
+ CK_OBJECT_HANDLE_PTR phObject, CK_RV rv);
+
+extern void sftk_AuditCopyObject(CK_SESSION_HANDLE hSession,
+ CK_OBJECT_HANDLE hObject,
+ CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount,
+ CK_OBJECT_HANDLE_PTR phNewObject, CK_RV rv);
+
+extern void sftk_AuditDestroyObject(CK_SESSION_HANDLE hSession,
+ CK_OBJECT_HANDLE hObject, CK_RV rv);
+
+extern void sftk_AuditGetObjectSize(CK_SESSION_HANDLE hSession,
+ CK_OBJECT_HANDLE hObject, CK_ULONG_PTR pulSize,
+ CK_RV rv);
+
+extern void sftk_AuditGetAttributeValue(CK_SESSION_HANDLE hSession,
+ CK_OBJECT_HANDLE hObject, CK_ATTRIBUTE_PTR pTemplate,
+ CK_ULONG ulCount, CK_RV rv);
+
+extern void sftk_AuditSetAttributeValue(CK_SESSION_HANDLE hSession,
+ CK_OBJECT_HANDLE hObject, CK_ATTRIBUTE_PTR pTemplate,
+ CK_ULONG ulCount, CK_RV rv);
+
+extern void sftk_AuditCryptInit(const char *opName,
+ CK_SESSION_HANDLE hSession,
+ CK_MECHANISM_PTR pMechanism,
+ CK_OBJECT_HANDLE hKey, CK_RV rv);
+
+extern void sftk_AuditGenerateKey(CK_SESSION_HANDLE hSession,
+ CK_MECHANISM_PTR pMechanism,
+ CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount,
+ CK_OBJECT_HANDLE_PTR phKey, CK_RV rv);
+
+extern void sftk_AuditGenerateKeyPair(CK_SESSION_HANDLE hSession,
+ CK_MECHANISM_PTR pMechanism,
+ CK_ATTRIBUTE_PTR pPublicKeyTemplate,
+ CK_ULONG ulPublicKeyAttributeCount,
+ CK_ATTRIBUTE_PTR pPrivateKeyTemplate,
+ CK_ULONG ulPrivateKeyAttributeCount,
+ CK_OBJECT_HANDLE_PTR phPublicKey,
+ CK_OBJECT_HANDLE_PTR phPrivateKey, CK_RV rv);
+
+extern void sftk_AuditWrapKey(CK_SESSION_HANDLE hSession,
+ CK_MECHANISM_PTR pMechanism,
+ CK_OBJECT_HANDLE hWrappingKey, CK_OBJECT_HANDLE hKey,
+ CK_BYTE_PTR pWrappedKey,
+ CK_ULONG_PTR pulWrappedKeyLen, CK_RV rv);
+
+extern void sftk_AuditUnwrapKey(CK_SESSION_HANDLE hSession,
+ CK_MECHANISM_PTR pMechanism,
+ CK_OBJECT_HANDLE hUnwrappingKey,
+ CK_BYTE_PTR pWrappedKey, CK_ULONG ulWrappedKeyLen,
+ CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulAttributeCount,
+ CK_OBJECT_HANDLE_PTR phKey, CK_RV rv);
+
+extern void sftk_AuditDeriveKey(CK_SESSION_HANDLE hSession,
+ CK_MECHANISM_PTR pMechanism,
+ CK_OBJECT_HANDLE hBaseKey,
+ CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulAttributeCount,
+ CK_OBJECT_HANDLE_PTR phKey, CK_RV rv);
+
+extern void sftk_AuditDigestKey(CK_SESSION_HANDLE hSession,
+ CK_OBJECT_HANDLE hKey, CK_RV rv);
+
/*
** FIPS 140-2 Error state
*/