2120 lines
79 KiB
Python
2120 lines
79 KiB
Python
# Copyright (c) 2016 The Johns Hopkins University/Applied Physics Laboratory
|
|
# All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
import copy
|
|
import logging
|
|
import os
|
|
import six
|
|
import sqlalchemy
|
|
|
|
from sqlalchemy.orm import exc
|
|
|
|
import threading
|
|
import time
|
|
|
|
import kmip
|
|
|
|
from kmip.core import attributes
|
|
from kmip.core import enums
|
|
from kmip.core import exceptions
|
|
|
|
from kmip.core.objects import MACData, KeyWrappingData
|
|
|
|
from kmip.core.factories import attributes as attribute_factory
|
|
from kmip.core.factories import secrets
|
|
|
|
from kmip.core.messages import contents
|
|
from kmip.core.messages import messages
|
|
|
|
from kmip.core.messages.payloads import activate
|
|
from kmip.core.messages.payloads import revoke
|
|
from kmip.core.messages.payloads import create
|
|
from kmip.core.messages.payloads import create_key_pair
|
|
from kmip.core.messages.payloads import derive_key
|
|
from kmip.core.messages.payloads import destroy
|
|
from kmip.core.messages.payloads import discover_versions
|
|
from kmip.core.messages.payloads import encrypt
|
|
from kmip.core.messages.payloads import get
|
|
from kmip.core.messages.payloads import get_attributes
|
|
from kmip.core.messages.payloads import get_attribute_list
|
|
from kmip.core.messages.payloads import query
|
|
from kmip.core.messages.payloads import register
|
|
from kmip.core.messages.payloads import mac
|
|
from kmip.core.messages.payloads import locate
|
|
|
|
from kmip.core import misc
|
|
|
|
from kmip.core import policy as operation_policy
|
|
|
|
from kmip.pie import factory
|
|
from kmip.pie import objects
|
|
from kmip.pie import sqltypes
|
|
|
|
from kmip.services.server import policy
|
|
from kmip.services.server.crypto import engine
|
|
|
|
|
|
class KmipEngine(object):
|
|
"""
|
|
A KMIP request processor that acts as the core of the KmipServer.
|
|
|
|
The KmipEngine contains the core application logic for the KmipServer.
|
|
It processes all KMIP requests and maintains consistent state across
|
|
client connections.
|
|
|
|
Features that are not supported:
|
|
* KMIP versions > 1.2
|
|
* Numerous operations, objects, and attributes.
|
|
* User authentication
|
|
* Batch processing options: UNDO
|
|
* Asynchronous operations
|
|
* Operation policies
|
|
* Object archival
|
|
* Key compression
|
|
* Key wrapping
|
|
* Key format conversions
|
|
* Registration of empty managed objects (e.g., Private Keys)
|
|
* Managed object state tracking
|
|
* Managed object usage limit tracking and enforcement
|
|
* Cryptographic usage mask enforcement per object type
|
|
"""
|
|
|
|
def __init__(self, policy_path=None):
|
|
"""
|
|
Create a KmipEngine.
|
|
|
|
Args:
|
|
policy_path (string): The path to the filesystem directory
|
|
containing PyKMIP server operation policy JSON files.
|
|
Optional, defaults to None.
|
|
"""
|
|
self._logger = logging.getLogger('kmip.server.engine')
|
|
|
|
self._cryptography_engine = engine.CryptographyEngine()
|
|
|
|
self._data_store = sqlalchemy.create_engine(
|
|
'sqlite:////tmp/pykmip.database',
|
|
echo=False,
|
|
connect_args={'check_same_thread': False}
|
|
)
|
|
sqltypes.Base.metadata.create_all(self._data_store)
|
|
self._data_store_session_factory = sqlalchemy.orm.sessionmaker(
|
|
bind=self._data_store
|
|
)
|
|
|
|
self._lock = threading.RLock()
|
|
|
|
self._id_placeholder = None
|
|
|
|
self._protocol_versions = [
|
|
contents.ProtocolVersion.create(1, 2),
|
|
contents.ProtocolVersion.create(1, 1),
|
|
contents.ProtocolVersion.create(1, 0)
|
|
]
|
|
|
|
self._protocol_version = self._protocol_versions[0]
|
|
|
|
self._object_map = {
|
|
enums.ObjectType.CERTIFICATE: objects.X509Certificate,
|
|
enums.ObjectType.SYMMETRIC_KEY: objects.SymmetricKey,
|
|
enums.ObjectType.PUBLIC_KEY: objects.PublicKey,
|
|
enums.ObjectType.PRIVATE_KEY: objects.PrivateKey,
|
|
enums.ObjectType.SPLIT_KEY: None,
|
|
enums.ObjectType.TEMPLATE: None,
|
|
enums.ObjectType.SECRET_DATA: objects.SecretData,
|
|
enums.ObjectType.OPAQUE_DATA: objects.OpaqueObject
|
|
}
|
|
|
|
self._attribute_policy = policy.AttributePolicy(self._protocol_version)
|
|
self._operation_policies = copy.deepcopy(operation_policy.policies)
|
|
self._load_operation_policies(policy_path)
|
|
|
|
self._client_identity = None
|
|
|
|
def _load_operation_policies(self, policy_path):
|
|
if (policy_path is None) or (not os.path.isdir(policy_path)):
|
|
self._logger.warning(
|
|
"The specified operation policy directory{0} is not "
|
|
"valid. No user-defined policies will be loaded.".format(
|
|
" (" + policy_path + ")" if policy_path else ''
|
|
)
|
|
)
|
|
return dict()
|
|
else:
|
|
self._logger.info(
|
|
"Loading user-defined operation policy files from: {0}".format(
|
|
policy_path
|
|
)
|
|
)
|
|
|
|
for filename in os.listdir(policy_path):
|
|
file_path = os.path.join(policy_path, filename)
|
|
if os.path.isfile(file_path):
|
|
self._logger.info(
|
|
"Loading user-defined operation policies "
|
|
"from file: {0}".format(file_path)
|
|
)
|
|
|
|
try:
|
|
policies = operation_policy.read_policy_from_file(
|
|
file_path
|
|
)
|
|
except ValueError as e:
|
|
self._logger.error(
|
|
"A failure occurred while loading policies."
|
|
)
|
|
self._logger.exception(e)
|
|
continue
|
|
|
|
reserved_policies = ['default', 'public']
|
|
for policy_name in six.iterkeys(policies):
|
|
if policy_name in reserved_policies:
|
|
self._logger.warning(
|
|
"Loaded policy '{0}' overwrites a reserved "
|
|
"policy and will be thrown out.".format(
|
|
policy_name
|
|
)
|
|
)
|
|
elif policy_name in six.iterkeys(
|
|
self._operation_policies
|
|
):
|
|
self._logger.warning(
|
|
"Loaded policy '{0}' overwrites a "
|
|
"preexisting policy and will be thrown "
|
|
"out.".format(policy_name)
|
|
)
|
|
else:
|
|
self._operation_policies.update([(
|
|
policy_name,
|
|
policies.get(policy_name)
|
|
)])
|
|
|
|
def _get_enum_string(self, e):
|
|
return ''.join([x.capitalize() for x in e.name.split('_')])
|
|
|
|
def _kmip_version_supported(supported):
|
|
def decorator(function):
|
|
def wrapper(self, *args, **kwargs):
|
|
if float(str(self._protocol_version)) < float(supported):
|
|
name = function.__name__
|
|
operation = ''.join(
|
|
[x.capitalize() for x in name[9:].split('_')]
|
|
)
|
|
raise exceptions.OperationNotSupported(
|
|
"{0} is not supported by KMIP {1}".format(
|
|
operation,
|
|
self._protocol_version
|
|
)
|
|
)
|
|
else:
|
|
return function(self, *args, **kwargs)
|
|
return wrapper
|
|
return decorator
|
|
|
|
def _synchronize(function):
|
|
def decorator(self, *args, **kwargs):
|
|
with self._lock:
|
|
return function(self, *args, **kwargs)
|
|
return decorator
|
|
|
|
def _set_protocol_version(self, protocol_version):
|
|
if protocol_version in self._protocol_versions:
|
|
self._protocol_version = protocol_version
|
|
self._attribute_policy = policy.AttributePolicy(
|
|
self._protocol_version
|
|
)
|
|
else:
|
|
raise exceptions.InvalidMessage(
|
|
"KMIP {0} is not supported by the server.".format(
|
|
protocol_version
|
|
)
|
|
)
|
|
|
|
def _verify_credential(self, request_credential, connection_credential):
|
|
# TODO (peterhamilton) Improve authentication support
|
|
# 1. If present, verify user ID of connection_credential is valid user.
|
|
# 2. If present, verify request_credential is valid credential.
|
|
# 3. If both present, verify that they are compliant with each other.
|
|
# 4. If neither present, set server to only allow Query operations.
|
|
|
|
# For now, simply use the connection_credential as received. It was
|
|
# obtained from a valid client certificate, so consider it a trusted
|
|
# form of client identity.
|
|
self._client_identity = connection_credential
|
|
|
|
@_synchronize
|
|
def process_request(self, request, credential=None):
|
|
"""
|
|
Process a KMIP request message.
|
|
|
|
This routine is the main driver of the KmipEngine. It breaks apart and
|
|
processes the request header, handles any message errors that may
|
|
result, and then passes the set of request batch items on for
|
|
processing. This routine is thread-safe, allowing multiple client
|
|
connections to use the same KmipEngine.
|
|
|
|
Args:
|
|
request (RequestMessage): The request message containing the batch
|
|
items to be processed.
|
|
credential (string): Identifying information about the client
|
|
obtained from the client certificate. Optional, defaults to
|
|
None.
|
|
|
|
Returns:
|
|
ResponseMessage: The response containing all of the results from
|
|
the request batch items.
|
|
"""
|
|
self._client_identity = None
|
|
header = request.request_header
|
|
|
|
# Process the protocol version
|
|
self._set_protocol_version(header.protocol_version)
|
|
|
|
# Process the maximum response size
|
|
max_response_size = None
|
|
if header.maximum_response_size:
|
|
max_response_size = header.maximum_response_size.value
|
|
|
|
# Process the time stamp
|
|
now = int(time.time())
|
|
if header.time_stamp:
|
|
then = header.time_stamp.value
|
|
|
|
if (now >= then) and ((now - then) < 60):
|
|
self._logger.info("Received request at time: {0}".format(
|
|
time.strftime(
|
|
"%Y-%m-%d %H:%M:%S",
|
|
time.gmtime(then)
|
|
)
|
|
))
|
|
else:
|
|
if now < then:
|
|
self._logger.warning(
|
|
"Received request with future timestamp. Received "
|
|
"timestamp: {0}, Current timestamp: {1}".format(
|
|
then,
|
|
now
|
|
)
|
|
)
|
|
|
|
raise exceptions.InvalidMessage(
|
|
"Future request rejected by server."
|
|
)
|
|
else:
|
|
self._logger.warning(
|
|
"Received request with old timestamp. Possible "
|
|
"replay attack. Received timestamp: {0}, Current "
|
|
"timestamp: {1}".format(then, now)
|
|
)
|
|
|
|
raise exceptions.InvalidMessage(
|
|
"Stale request rejected by server."
|
|
)
|
|
else:
|
|
self._logger.info("Received request at time: {0}".format(
|
|
time.strftime(
|
|
"%Y-%m-%d %H:%M:%S",
|
|
time.gmtime(now)
|
|
)
|
|
))
|
|
|
|
# Process the asynchronous indicator
|
|
self.is_asynchronous = False
|
|
if header.asynchronous_indicator is not None:
|
|
self.is_asynchronous = header.asynchronous_indicator.value
|
|
|
|
if self.is_asynchronous:
|
|
raise exceptions.InvalidMessage(
|
|
"Asynchronous operations are not supported."
|
|
)
|
|
|
|
# Process the authentication credentials
|
|
if header.authentication:
|
|
auth_credentials = header.authentication.credential
|
|
else:
|
|
auth_credentials = None
|
|
self._verify_credential(auth_credentials, credential)
|
|
|
|
# Process the batch error continuation option
|
|
batch_error_option = enums.BatchErrorContinuationOption.STOP
|
|
if header.batch_error_cont_option is not None:
|
|
batch_error_option = header.batch_error_cont_option.value
|
|
|
|
if batch_error_option == enums.BatchErrorContinuationOption.UNDO:
|
|
raise exceptions.InvalidMessage(
|
|
"Undo option for batch handling is not supported."
|
|
)
|
|
|
|
# Process the batch order option
|
|
batch_order_option = False
|
|
if header.batch_order_option:
|
|
batch_order_option = header.batch_order_option.value
|
|
|
|
response_batch = self._process_batch(
|
|
request.batch_items,
|
|
batch_error_option,
|
|
batch_order_option
|
|
)
|
|
response = self._build_response(
|
|
header.protocol_version,
|
|
response_batch
|
|
)
|
|
|
|
return response, max_response_size
|
|
|
|
def _build_response(self, version, batch_items):
|
|
header = messages.ResponseHeader(
|
|
protocol_version=version,
|
|
time_stamp=contents.TimeStamp(int(time.time())),
|
|
batch_count=contents.BatchCount(len(batch_items))
|
|
)
|
|
message = messages.ResponseMessage(
|
|
response_header=header,
|
|
batch_items=batch_items
|
|
)
|
|
return message
|
|
|
|
def build_error_response(self, version, reason, message):
|
|
"""
|
|
Build a simple ResponseMessage with a single error result.
|
|
|
|
Args:
|
|
version (ProtocolVersion): The protocol version the response
|
|
should be addressed with.
|
|
reason (ResultReason): An enumeration classifying the type of
|
|
error occurred.
|
|
message (str): A string providing additional information about
|
|
the error.
|
|
|
|
Returns:
|
|
ResponseMessage: The simple ResponseMessage containing a
|
|
single error result.
|
|
"""
|
|
batch_item = messages.ResponseBatchItem(
|
|
result_status=contents.ResultStatus(
|
|
enums.ResultStatus.OPERATION_FAILED
|
|
),
|
|
result_reason=contents.ResultReason(reason),
|
|
result_message=contents.ResultMessage(message)
|
|
)
|
|
return self._build_response(version, [batch_item])
|
|
|
|
def _process_batch(self, request_batch, batch_handling, batch_order):
|
|
response_batch = list()
|
|
|
|
self._data_session = self._data_store_session_factory()
|
|
|
|
for batch_item in request_batch:
|
|
error_occurred = False
|
|
|
|
response_payload = None
|
|
result_status = None
|
|
result_reason = None
|
|
result_message = None
|
|
|
|
operation = batch_item.operation
|
|
request_payload = batch_item.request_payload
|
|
|
|
# Process batch item ID.
|
|
if len(request_batch) > 1:
|
|
if not batch_item.unique_batch_item_id:
|
|
raise exceptions.InvalidMessage(
|
|
"Batch item ID is undefined."
|
|
)
|
|
|
|
# Process batch message extension.
|
|
# TODO (peterhamilton) Add support for message extension handling.
|
|
# 1. Extract the vendor identification and criticality indicator.
|
|
# 2. If the indicator is True, raise an error.
|
|
# 3. If the indicator is False, ignore the extension.
|
|
|
|
# Process batch payload.
|
|
try:
|
|
response_payload = self._process_operation(
|
|
operation.value,
|
|
request_payload
|
|
)
|
|
|
|
result_status = enums.ResultStatus.SUCCESS
|
|
except exceptions.KmipError as e:
|
|
error_occurred = True
|
|
result_status = e.status
|
|
result_reason = e.reason
|
|
result_message = str(e)
|
|
except Exception as e:
|
|
self._logger.warning(
|
|
"Error occurred while processing operation."
|
|
)
|
|
self._logger.exception(e)
|
|
|
|
error_occurred = True
|
|
result_status = enums.ResultStatus.OPERATION_FAILED
|
|
result_reason = enums.ResultReason.GENERAL_FAILURE
|
|
result_message = (
|
|
"Operation failed. See the server logs for more "
|
|
"information."
|
|
)
|
|
|
|
# Compose operation result.
|
|
result_status = contents.ResultStatus(result_status)
|
|
if result_reason:
|
|
result_reason = contents.ResultReason(result_reason)
|
|
if result_message:
|
|
result_message = contents.ResultMessage(result_message)
|
|
|
|
batch_item = messages.ResponseBatchItem(
|
|
operation=batch_item.operation,
|
|
unique_batch_item_id=batch_item.unique_batch_item_id,
|
|
result_status=result_status,
|
|
result_reason=result_reason,
|
|
result_message=result_message,
|
|
response_payload=response_payload
|
|
)
|
|
response_batch.append(batch_item)
|
|
|
|
# Handle batch error if necessary.
|
|
if error_occurred:
|
|
if batch_handling == enums.BatchErrorContinuationOption.STOP:
|
|
break
|
|
|
|
return response_batch
|
|
|
|
def _get_object_type(self, unique_identifier):
|
|
try:
|
|
object_type = self._data_session.query(
|
|
objects.ManagedObject._object_type
|
|
).filter(
|
|
objects.ManagedObject.unique_identifier == unique_identifier
|
|
).one()[0]
|
|
except exc.NoResultFound as e:
|
|
self._logger.warning(
|
|
"Could not identify object type for object: {0}".format(
|
|
unique_identifier
|
|
)
|
|
)
|
|
raise exceptions.ItemNotFound(
|
|
"Could not locate object: {0}".format(unique_identifier)
|
|
)
|
|
except exc.MultipleResultsFound as e:
|
|
self._logger.warning(
|
|
"Multiple objects found for ID: {0}".format(
|
|
unique_identifier
|
|
)
|
|
)
|
|
raise e
|
|
|
|
class_type = self._object_map.get(object_type)
|
|
if class_type is None:
|
|
name = object_type.name
|
|
raise exceptions.InvalidField(
|
|
"The {0} object type is not supported.".format(
|
|
''.join(
|
|
[x.capitalize() for x in name.split('_')]
|
|
)
|
|
)
|
|
)
|
|
|
|
return class_type
|
|
|
|
def _build_core_object(self, obj):
|
|
try:
|
|
object_type = obj._object_type
|
|
except Exception:
|
|
raise exceptions.InvalidField(
|
|
"Cannot build an unsupported object type."
|
|
)
|
|
|
|
value = {}
|
|
|
|
if object_type == enums.ObjectType.CERTIFICATE:
|
|
value = {
|
|
'certificate_type': obj.certificate_type,
|
|
'certificate_value': obj.value
|
|
}
|
|
elif object_type == enums.ObjectType.SYMMETRIC_KEY:
|
|
value = {
|
|
'cryptographic_algorithm': obj.cryptographic_algorithm,
|
|
'cryptographic_length': obj.cryptographic_length,
|
|
'key_format_type': obj.key_format_type,
|
|
'key_value': obj.value
|
|
}
|
|
elif object_type == enums.ObjectType.PUBLIC_KEY:
|
|
value = {
|
|
'cryptographic_algorithm': obj.cryptographic_algorithm,
|
|
'cryptographic_length': obj.cryptographic_length,
|
|
'key_format_type': obj.key_format_type,
|
|
'key_value': obj.value
|
|
}
|
|
elif object_type == enums.ObjectType.PRIVATE_KEY:
|
|
value = {
|
|
'cryptographic_algorithm': obj.cryptographic_algorithm,
|
|
'cryptographic_length': obj.cryptographic_length,
|
|
'key_format_type': obj.key_format_type,
|
|
'key_value': obj.value
|
|
}
|
|
elif object_type == enums.ObjectType.SECRET_DATA:
|
|
value = {
|
|
'key_format_type': enums.KeyFormatType.OPAQUE,
|
|
'key_value': obj.value,
|
|
'secret_data_type': obj.data_type
|
|
}
|
|
elif object_type == enums.ObjectType.OPAQUE_DATA:
|
|
value = {
|
|
'opaque_data_type': obj.opaque_type,
|
|
'opaque_data_value': obj.value
|
|
}
|
|
else:
|
|
name = object_type.name
|
|
raise exceptions.InvalidField(
|
|
"The {0} object type is not supported.".format(
|
|
''.join(
|
|
[x.capitalize() for x in name.split('_')]
|
|
)
|
|
)
|
|
)
|
|
|
|
secret_factory = secrets.SecretFactory()
|
|
return secret_factory.create(object_type, value)
|
|
|
|
def _process_template_attribute(self, template_attribute):
|
|
"""
|
|
Given a kmip.core TemplateAttribute object, extract the attribute
|
|
value data into a usable dictionary format.
|
|
"""
|
|
attributes = {}
|
|
|
|
if len(template_attribute.names) > 0:
|
|
raise exceptions.ItemNotFound(
|
|
"Attribute templates are not supported."
|
|
)
|
|
|
|
for attribute in template_attribute.attributes:
|
|
name = attribute.attribute_name.value
|
|
|
|
if not self._attribute_policy.is_attribute_supported(name):
|
|
raise exceptions.InvalidField(
|
|
"The {0} attribute is unsupported.".format(name)
|
|
)
|
|
|
|
if self._attribute_policy.is_attribute_multivalued(name):
|
|
values = attributes.get(name, list())
|
|
if (not attribute.attribute_index) and len(values) > 0:
|
|
raise exceptions.InvalidField(
|
|
"Attribute index missing from multivalued attribute."
|
|
)
|
|
|
|
values.append(attribute.attribute_value)
|
|
attributes.update([(name, values)])
|
|
else:
|
|
if attribute.attribute_index:
|
|
if attribute.attribute_index.value != 0:
|
|
raise exceptions.InvalidField(
|
|
"Non-zero attribute index found for "
|
|
"single-valued attribute."
|
|
)
|
|
value = attributes.get(name, None)
|
|
if value:
|
|
raise exceptions.IndexOutOfBounds(
|
|
"Cannot set multiple instances of the "
|
|
"{0} attribute.".format(name)
|
|
)
|
|
else:
|
|
attributes.update([(name, attribute.attribute_value)])
|
|
|
|
return attributes
|
|
|
|
def _get_attributes_from_managed_object(self, managed_object, attr_names):
|
|
"""
|
|
Given a kmip.pie object and a list of attribute names, attempt to get
|
|
all of the existing attribute values from the object.
|
|
"""
|
|
attr_factory = attribute_factory.AttributeFactory()
|
|
retrieved_attributes = list()
|
|
|
|
if not attr_names:
|
|
attr_names = self._attribute_policy.get_all_attribute_names()
|
|
|
|
for attribute_name in attr_names:
|
|
object_type = managed_object._object_type
|
|
|
|
if not self._attribute_policy.is_attribute_supported(
|
|
attribute_name
|
|
):
|
|
continue
|
|
|
|
if self._attribute_policy.is_attribute_applicable_to_object_type(
|
|
attribute_name,
|
|
object_type
|
|
):
|
|
try:
|
|
attribute_value = self._get_attribute_from_managed_object(
|
|
managed_object,
|
|
attribute_name
|
|
)
|
|
except Exception:
|
|
attribute_value = None
|
|
|
|
if attribute_value is not None:
|
|
if self._attribute_policy.is_attribute_multivalued(
|
|
attribute_name
|
|
):
|
|
for count, value in enumerate(attribute_value):
|
|
attribute = attr_factory.create_attribute(
|
|
enums.AttributeType(attribute_name),
|
|
value,
|
|
count
|
|
)
|
|
retrieved_attributes.append(attribute)
|
|
else:
|
|
attribute = attr_factory.create_attribute(
|
|
enums.AttributeType(attribute_name),
|
|
attribute_value
|
|
)
|
|
retrieved_attributes.append(attribute)
|
|
|
|
return retrieved_attributes
|
|
|
|
def _get_attribute_from_managed_object(self, managed_object, attr_name):
|
|
"""
|
|
Get the attribute value from the kmip.pie managed object.
|
|
"""
|
|
if attr_name == 'Unique Identifier':
|
|
return str(managed_object.unique_identifier)
|
|
elif attr_name == 'Name':
|
|
names = list()
|
|
for name in managed_object.names:
|
|
name = attributes.Name(
|
|
attributes.Name.NameValue(name),
|
|
attributes.Name.NameType(
|
|
enums.NameType.UNINTERPRETED_TEXT_STRING
|
|
)
|
|
)
|
|
names.append(name)
|
|
return names
|
|
elif attr_name == 'Object Type':
|
|
return managed_object._object_type
|
|
elif attr_name == 'Cryptographic Algorithm':
|
|
return managed_object.cryptographic_algorithm
|
|
elif attr_name == 'Cryptographic Length':
|
|
return managed_object.cryptographic_length
|
|
elif attr_name == 'Cryptographic Parameters':
|
|
return None
|
|
elif attr_name == 'Cryptographic Domain Parameters':
|
|
return None
|
|
elif attr_name == 'Certificate Type':
|
|
return managed_object.certificate_type
|
|
elif attr_name == 'Certificate Length':
|
|
return None
|
|
elif attr_name == 'X.509 Certificate Identifier':
|
|
return None
|
|
elif attr_name == 'X.509 Certificate Subject':
|
|
return None
|
|
elif attr_name == 'X.509 Certificate Issuer':
|
|
return None
|
|
elif attr_name == 'Certificate Identifier':
|
|
return None
|
|
elif attr_name == 'Certificate Subject':
|
|
return None
|
|
elif attr_name == 'Certificate Issuer':
|
|
return None
|
|
elif attr_name == 'Digital Signature Algorithm':
|
|
return None
|
|
elif attr_name == 'Digest':
|
|
return None
|
|
elif attr_name == 'Operation Policy Name':
|
|
return managed_object.operation_policy_name
|
|
elif attr_name == 'Cryptographic Usage Mask':
|
|
return managed_object.cryptographic_usage_masks
|
|
elif attr_name == 'Lease Time':
|
|
return None
|
|
elif attr_name == 'Usage Limits':
|
|
return None
|
|
elif attr_name == 'State':
|
|
return managed_object.state
|
|
elif attr_name == 'Initial Date':
|
|
return managed_object.initial_date
|
|
elif attr_name == 'Activation Date':
|
|
return None
|
|
elif attr_name == 'Process Start Date':
|
|
return None
|
|
elif attr_name == 'Protect Stop Date':
|
|
return None
|
|
elif attr_name == 'Deactivation Date':
|
|
return None
|
|
elif attr_name == 'Destroy Date':
|
|
return None
|
|
elif attr_name == 'Compromise Occurrence Date':
|
|
return None
|
|
elif attr_name == 'Compromise Date':
|
|
return None
|
|
elif attr_name == 'Revocation Reason':
|
|
return None
|
|
elif attr_name == 'Archive Date':
|
|
return None
|
|
elif attr_name == 'Object Group':
|
|
return None
|
|
elif attr_name == 'Fresh':
|
|
return None
|
|
elif attr_name == 'Link':
|
|
return None
|
|
elif attr_name == 'Application Specific Information':
|
|
return None
|
|
elif attr_name == 'Contact Information':
|
|
return None
|
|
elif attr_name == 'Last Change Date':
|
|
return None
|
|
else:
|
|
# Since custom attribute names are possible, just return None
|
|
# for unrecognized attributes. This satisfies the spec.
|
|
return None
|
|
|
|
def _set_attributes_on_managed_object(self, managed_object, attributes):
|
|
"""
|
|
Given a kmip.pie object and a dictionary of attributes, attempt to set
|
|
the attribute values on the object.
|
|
"""
|
|
for attribute_name, attribute_value in six.iteritems(attributes):
|
|
object_type = managed_object._object_type
|
|
if self._attribute_policy.is_attribute_applicable_to_object_type(
|
|
attribute_name,
|
|
object_type):
|
|
self._set_attribute_on_managed_object(
|
|
managed_object,
|
|
(attribute_name, attribute_value)
|
|
)
|
|
else:
|
|
name = object_type.name
|
|
raise exceptions.InvalidField(
|
|
"Cannot set {0} attribute on {1} object.".format(
|
|
attribute_name,
|
|
''.join([x.capitalize() for x in name.split('_')])
|
|
)
|
|
)
|
|
|
|
def _set_attribute_on_managed_object(self, managed_object, attribute):
|
|
"""
|
|
Set the attribute value on the kmip.pie managed object.
|
|
"""
|
|
attribute_name = attribute[0]
|
|
attribute_value = attribute[1]
|
|
|
|
if self._attribute_policy.is_attribute_multivalued(attribute_name):
|
|
if attribute_name == 'Name':
|
|
managed_object.names.extend(
|
|
[x.name_value.value for x in attribute_value]
|
|
)
|
|
for name in managed_object.names:
|
|
if managed_object.names.count(name) > 1:
|
|
raise exceptions.InvalidField(
|
|
"Cannot set duplicate name values."
|
|
)
|
|
else:
|
|
# TODO (peterhamilton) Remove when all attributes are supported
|
|
raise exceptions.InvalidField(
|
|
"The {0} attribute is unsupported.".format(attribute_name)
|
|
)
|
|
else:
|
|
field = None
|
|
value = attribute_value.value
|
|
|
|
if attribute_name == 'Cryptographic Algorithm':
|
|
field = 'cryptographic_algorithm'
|
|
elif attribute_name == 'Cryptographic Length':
|
|
field = 'cryptographic_length'
|
|
elif attribute_name == 'Cryptographic Usage Mask':
|
|
field = 'cryptographic_usage_masks'
|
|
value = list()
|
|
for e in enums.CryptographicUsageMask:
|
|
if e.value & attribute_value.value:
|
|
value.append(e)
|
|
elif attribute_name == 'Operation Policy Name':
|
|
field = 'operation_policy_name'
|
|
|
|
if field:
|
|
existing_value = getattr(managed_object, field)
|
|
if existing_value:
|
|
if existing_value != value:
|
|
raise exceptions.InvalidField(
|
|
"Cannot overwrite the {0} attribute.".format(
|
|
attribute_name
|
|
)
|
|
)
|
|
else:
|
|
setattr(managed_object, field, value)
|
|
else:
|
|
# TODO (peterhamilton) Remove when all attributes are supported
|
|
raise exceptions.InvalidField(
|
|
"The {0} attribute is unsupported.".format(attribute_name)
|
|
)
|
|
|
|
def _is_allowed_by_operation_policy(
|
|
self,
|
|
operation_policy,
|
|
session_identity,
|
|
object_owner,
|
|
object_type,
|
|
operation
|
|
):
|
|
policy_set = self._operation_policies.get(operation_policy)
|
|
if not policy_set:
|
|
self._logger.warning(
|
|
"The '{0}' policy does not exist.".format(operation_policy)
|
|
)
|
|
return False
|
|
|
|
object_policy = policy_set.get(object_type)
|
|
if not object_policy:
|
|
self._logger.warning(
|
|
"The '{0}' policy does not apply to {1} objects.".format(
|
|
operation_policy,
|
|
self._get_enum_string(object_type)
|
|
)
|
|
)
|
|
return False
|
|
|
|
operation_object_policy = object_policy.get(operation)
|
|
if not operation_object_policy:
|
|
self._logger.warning(
|
|
"The '{0}' policy does not apply to {1} operations on {2} "
|
|
"objects.".format(
|
|
operation_policy,
|
|
self._get_enum_string(operation),
|
|
self._get_enum_string(object_type)
|
|
)
|
|
)
|
|
return False
|
|
|
|
if operation_object_policy == enums.Policy.ALLOW_ALL:
|
|
return True
|
|
elif operation_object_policy == enums.Policy.ALLOW_OWNER:
|
|
if session_identity == object_owner:
|
|
return True
|
|
else:
|
|
return False
|
|
elif operation_object_policy == enums.Policy.DISALLOW_ALL:
|
|
return False
|
|
else:
|
|
return False
|
|
|
|
def _get_object_with_access_controls(
|
|
self,
|
|
uid,
|
|
operation
|
|
):
|
|
object_type = self._get_object_type(uid)
|
|
|
|
managed_object = self._data_session.query(object_type).filter(
|
|
object_type.unique_identifier == uid
|
|
).one()
|
|
|
|
# Determine if the request should be carried out under the object's
|
|
# operation policy. If not, feign ignorance of the object.
|
|
is_allowed = self._is_allowed_by_operation_policy(
|
|
managed_object.operation_policy_name,
|
|
self._client_identity,
|
|
managed_object._owner,
|
|
managed_object.object_type,
|
|
operation
|
|
)
|
|
if not is_allowed:
|
|
raise exceptions.ItemNotFound(
|
|
"Could not locate object: {0}".format(uid)
|
|
)
|
|
|
|
return managed_object
|
|
|
|
def _list_objects_with_access_controls(
|
|
self,
|
|
operation
|
|
):
|
|
managed_objects = None
|
|
managed_objects_allowed = list()
|
|
|
|
managed_objects = self._data_session.query(objects.ManagedObject).all()
|
|
|
|
for managed_object in managed_objects:
|
|
is_allowed = self._is_allowed_by_operation_policy(
|
|
managed_object.operation_policy_name,
|
|
self._client_identity,
|
|
managed_object._owner,
|
|
managed_object.object_type,
|
|
operation
|
|
)
|
|
if is_allowed is True:
|
|
managed_objects_allowed.append(managed_object)
|
|
|
|
return managed_objects_allowed
|
|
|
|
def _process_operation(self, operation, payload):
|
|
if operation == enums.Operation.CREATE:
|
|
return self._process_create(payload)
|
|
elif operation == enums.Operation.CREATE_KEY_PAIR:
|
|
return self._process_create_key_pair(payload)
|
|
elif operation == enums.Operation.REGISTER:
|
|
return self._process_register(payload)
|
|
elif operation == enums.Operation.DERIVE_KEY:
|
|
return self._process_derive_key(payload)
|
|
elif operation == enums.Operation.LOCATE:
|
|
return self._process_locate(payload)
|
|
elif operation == enums.Operation.GET:
|
|
return self._process_get(payload)
|
|
elif operation == enums.Operation.GET_ATTRIBUTES:
|
|
return self._process_get_attributes(payload)
|
|
elif operation == enums.Operation.GET_ATTRIBUTE_LIST:
|
|
return self._process_get_attribute_list(payload)
|
|
elif operation == enums.Operation.ACTIVATE:
|
|
return self._process_activate(payload)
|
|
elif operation == enums.Operation.REVOKE:
|
|
return self._process_revoke(payload)
|
|
elif operation == enums.Operation.DESTROY:
|
|
return self._process_destroy(payload)
|
|
elif operation == enums.Operation.QUERY:
|
|
return self._process_query(payload)
|
|
elif operation == enums.Operation.DISCOVER_VERSIONS:
|
|
return self._process_discover_versions(payload)
|
|
elif operation == enums.Operation.ENCRYPT:
|
|
return self._process_encrypt(payload)
|
|
elif operation == enums.Operation.MAC:
|
|
return self._process_mac(payload)
|
|
else:
|
|
raise exceptions.OperationNotSupported(
|
|
"{0} operation is not supported by the server.".format(
|
|
operation.name.title()
|
|
)
|
|
)
|
|
|
|
@_kmip_version_supported('1.0')
|
|
def _process_create(self, payload):
|
|
self._logger.info("Processing operation: Create")
|
|
|
|
object_type = payload.object_type.value
|
|
template_attribute = payload.template_attribute
|
|
|
|
if object_type != enums.ObjectType.SYMMETRIC_KEY:
|
|
name = object_type.name
|
|
raise exceptions.InvalidField(
|
|
"Cannot create a {0} object with the Create operation.".format(
|
|
''.join([x.capitalize() for x in name.split('_')])
|
|
)
|
|
)
|
|
|
|
object_attributes = {}
|
|
if template_attribute:
|
|
object_attributes = self._process_template_attribute(
|
|
template_attribute
|
|
)
|
|
|
|
algorithm = object_attributes.get('Cryptographic Algorithm')
|
|
if algorithm:
|
|
algorithm = algorithm.value
|
|
else:
|
|
raise exceptions.InvalidField(
|
|
"The cryptographic algorithm must be specified as an "
|
|
"attribute."
|
|
)
|
|
|
|
length = object_attributes.get('Cryptographic Length')
|
|
if length:
|
|
length = length.value
|
|
else:
|
|
# TODO (peterhamilton) The cryptographic length is technically not
|
|
# required per the spec. Update the CryptographyEngine to accept a
|
|
# None length, allowing it to pick the length dynamically. Default
|
|
# to the strongest key size allowed for the algorithm type.
|
|
raise exceptions.InvalidField(
|
|
"The cryptographic length must be specified as an attribute."
|
|
)
|
|
|
|
usage_mask = object_attributes.get('Cryptographic Usage Mask')
|
|
if usage_mask is None:
|
|
raise exceptions.InvalidField(
|
|
"The cryptographic usage mask must be specified as an "
|
|
"attribute."
|
|
)
|
|
|
|
result = self._cryptography_engine.create_symmetric_key(
|
|
algorithm,
|
|
length
|
|
)
|
|
|
|
managed_object = objects.SymmetricKey(
|
|
algorithm,
|
|
length,
|
|
result.get('value')
|
|
)
|
|
managed_object.names = []
|
|
|
|
self._set_attributes_on_managed_object(
|
|
managed_object,
|
|
object_attributes
|
|
)
|
|
|
|
# TODO (peterhamilton) Set additional server-only attributes.
|
|
managed_object._owner = self._client_identity
|
|
managed_object.initial_date = int(time.time())
|
|
|
|
self._data_session.add(managed_object)
|
|
|
|
# NOTE (peterhamilton) SQLAlchemy will *not* assign an ID until
|
|
# commit is called. This makes future support for UNDO problematic.
|
|
self._data_session.commit()
|
|
|
|
self._logger.info(
|
|
"Created a SymmetricKey with ID: {0}".format(
|
|
managed_object.unique_identifier
|
|
)
|
|
)
|
|
|
|
response_payload = create.CreateResponsePayload(
|
|
object_type=payload.object_type,
|
|
unique_identifier=attributes.UniqueIdentifier(
|
|
str(managed_object.unique_identifier)
|
|
),
|
|
template_attribute=None
|
|
)
|
|
|
|
self._id_placeholder = str(managed_object.unique_identifier)
|
|
|
|
return response_payload
|
|
|
|
@_kmip_version_supported('1.0')
|
|
def _process_create_key_pair(self, payload):
|
|
self._logger.info("Processing operation: CreateKeyPair")
|
|
|
|
algorithm = None
|
|
length = None
|
|
|
|
# Process attribute sets
|
|
public_key_attributes = {}
|
|
private_key_attributes = {}
|
|
common_attributes = {}
|
|
if payload.public_key_template_attribute:
|
|
public_key_attributes = self._process_template_attribute(
|
|
payload.public_key_template_attribute
|
|
)
|
|
if payload.private_key_template_attribute:
|
|
private_key_attributes = self._process_template_attribute(
|
|
payload.private_key_template_attribute
|
|
)
|
|
if payload.common_template_attribute:
|
|
common_attributes = self._process_template_attribute(
|
|
payload.common_template_attribute
|
|
)
|
|
|
|
# Propagate common attributes if not overridden by the public/private
|
|
# attribute sets
|
|
for key, value in six.iteritems(common_attributes):
|
|
if key not in public_key_attributes.keys():
|
|
public_key_attributes.update([(key, value)])
|
|
if key not in private_key_attributes.keys():
|
|
private_key_attributes.update([(key, value)])
|
|
|
|
# Error check for required attributes.
|
|
public_algorithm = public_key_attributes.get('Cryptographic Algorithm')
|
|
if public_algorithm:
|
|
public_algorithm = public_algorithm.value
|
|
else:
|
|
raise exceptions.InvalidField(
|
|
"The cryptographic algorithm must be specified as an "
|
|
"attribute for the public key."
|
|
)
|
|
|
|
public_length = public_key_attributes.get('Cryptographic Length')
|
|
if public_length:
|
|
public_length = public_length.value
|
|
else:
|
|
# TODO (peterhamilton) The cryptographic length is technically not
|
|
# required per the spec. Update the CryptographyEngine to accept a
|
|
# None length, allowing it to pick the length dynamically. Default
|
|
# to the strongest key size allowed for the algorithm type.
|
|
raise exceptions.InvalidField(
|
|
"The cryptographic length must be specified as an attribute "
|
|
"for the public key."
|
|
)
|
|
|
|
public_usage_mask = public_key_attributes.get(
|
|
'Cryptographic Usage Mask'
|
|
)
|
|
if public_usage_mask is None:
|
|
raise exceptions.InvalidField(
|
|
"The cryptographic usage mask must be specified as an "
|
|
"attribute for the public key."
|
|
)
|
|
|
|
private_algorithm = private_key_attributes.get(
|
|
'Cryptographic Algorithm'
|
|
)
|
|
if private_algorithm:
|
|
private_algorithm = private_algorithm.value
|
|
else:
|
|
raise exceptions.InvalidField(
|
|
"The cryptographic algorithm must be specified as an "
|
|
"attribute for the private key."
|
|
)
|
|
|
|
private_length = private_key_attributes.get('Cryptographic Length')
|
|
if private_length:
|
|
private_length = private_length.value
|
|
else:
|
|
# TODO (peterhamilton) The cryptographic length is technically not
|
|
# required per the spec. Update the CryptographyEngine to accept a
|
|
# None length, allowing it to pick the length dynamically. Default
|
|
# to the strongest key size allowed for the algorithm type.
|
|
raise exceptions.InvalidField(
|
|
"The cryptographic length must be specified as an attribute "
|
|
"for the private key."
|
|
)
|
|
|
|
private_usage_mask = private_key_attributes.get(
|
|
'Cryptographic Usage Mask'
|
|
)
|
|
if private_usage_mask is None:
|
|
raise exceptions.InvalidField(
|
|
"The cryptographic usage mask must be specified as an "
|
|
"attribute for the private key."
|
|
)
|
|
|
|
if public_algorithm == private_algorithm:
|
|
algorithm = public_algorithm
|
|
else:
|
|
raise exceptions.InvalidField(
|
|
"The public and private key algorithms must be the same."
|
|
)
|
|
|
|
if public_length == private_length:
|
|
length = public_length
|
|
else:
|
|
raise exceptions.InvalidField(
|
|
"The public and private key lengths must be the same."
|
|
)
|
|
|
|
public, private = self._cryptography_engine.create_asymmetric_key_pair(
|
|
algorithm,
|
|
length
|
|
)
|
|
|
|
public_key = objects.PublicKey(
|
|
algorithm,
|
|
length,
|
|
public.get('value'),
|
|
public.get('format')
|
|
)
|
|
private_key = objects.PrivateKey(
|
|
algorithm,
|
|
length,
|
|
private.get('value'),
|
|
private.get('format')
|
|
)
|
|
public_key.names = []
|
|
private_key.names = []
|
|
|
|
self._set_attributes_on_managed_object(
|
|
public_key,
|
|
public_key_attributes
|
|
)
|
|
self._set_attributes_on_managed_object(
|
|
private_key,
|
|
private_key_attributes
|
|
)
|
|
|
|
# TODO (peterhamilton) Set additional server-only attributes.
|
|
public_key._owner = self._client_identity
|
|
public_key.initial_date = int(time.time())
|
|
private_key._owner = self._client_identity
|
|
private_key.initial_date = public_key.initial_date
|
|
|
|
self._data_session.add(public_key)
|
|
self._data_session.add(private_key)
|
|
|
|
# NOTE (peterhamilton) SQLAlchemy will *not* assign an ID until
|
|
# commit is called. This makes future support for UNDO problematic.
|
|
self._data_session.commit()
|
|
|
|
self._logger.info(
|
|
"Created a PublicKey with ID: {0}".format(
|
|
public_key.unique_identifier
|
|
)
|
|
)
|
|
self._logger.info(
|
|
"Created a PrivateKey with ID: {0}".format(
|
|
private_key.unique_identifier
|
|
)
|
|
)
|
|
|
|
response_payload = create_key_pair.CreateKeyPairResponsePayload(
|
|
private_key_uuid=attributes.PrivateKeyUniqueIdentifier(
|
|
str(private_key.unique_identifier)
|
|
),
|
|
public_key_uuid=attributes.PublicKeyUniqueIdentifier(
|
|
str(public_key.unique_identifier)
|
|
)
|
|
)
|
|
|
|
self._id_placeholder = str(private_key.unique_identifier)
|
|
return response_payload
|
|
|
|
@_kmip_version_supported('1.0')
|
|
def _process_register(self, payload):
|
|
self._logger.info("Processing operation: Register")
|
|
|
|
object_type = payload.object_type.value
|
|
template_attribute = payload.template_attribute
|
|
|
|
if self._object_map.get(object_type) is None:
|
|
name = object_type.name
|
|
raise exceptions.InvalidField(
|
|
"The {0} object type is not supported.".format(
|
|
''.join(
|
|
[x.capitalize() for x in name.split('_')]
|
|
)
|
|
)
|
|
)
|
|
|
|
if payload.secret:
|
|
secret = payload.secret
|
|
else:
|
|
# TODO (peterhamilton) It is possible to register 'empty' secrets
|
|
# like Private Keys. For now, that feature is not supported.
|
|
raise exceptions.InvalidField(
|
|
"Cannot register a secret in absentia."
|
|
)
|
|
|
|
object_attributes = {}
|
|
if template_attribute:
|
|
object_attributes = self._process_template_attribute(
|
|
template_attribute
|
|
)
|
|
|
|
managed_object_factory = factory.ObjectFactory()
|
|
managed_object = managed_object_factory.convert(secret)
|
|
managed_object.names = []
|
|
|
|
self._set_attributes_on_managed_object(
|
|
managed_object,
|
|
object_attributes
|
|
)
|
|
|
|
# TODO (peterhamilton) Set additional server-only attributes.
|
|
managed_object._owner = self._client_identity
|
|
managed_object.initial_date = int(time.time())
|
|
|
|
self._data_session.add(managed_object)
|
|
|
|
# NOTE (peterhamilton) SQLAlchemy will *not* assign an ID until
|
|
# commit is called. This makes future support for UNDO problematic.
|
|
self._data_session.commit()
|
|
|
|
self._logger.info(
|
|
"Registered a {0} with ID: {1}".format(
|
|
''.join([x.capitalize() for x in object_type.name.split('_')]),
|
|
managed_object.unique_identifier
|
|
)
|
|
)
|
|
|
|
response_payload = register.RegisterResponsePayload(
|
|
unique_identifier=attributes.UniqueIdentifier(
|
|
str(managed_object.unique_identifier)
|
|
)
|
|
)
|
|
|
|
self._id_placeholder = str(managed_object.unique_identifier)
|
|
|
|
return response_payload
|
|
|
|
@_kmip_version_supported('1.0')
|
|
def _process_derive_key(self, payload):
|
|
self._logger.info("Processing operation: DeriveKey")
|
|
|
|
object_attributes = {}
|
|
if payload.template_attribute:
|
|
object_attributes = self._process_template_attribute(
|
|
payload.template_attribute
|
|
)
|
|
|
|
if payload.object_type not in [
|
|
enums.ObjectType.SYMMETRIC_KEY,
|
|
enums.ObjectType.SECRET_DATA
|
|
]:
|
|
raise exceptions.InvalidField(
|
|
"Key derivation can only generate a SymmetricKey or "
|
|
"SecretData object."
|
|
)
|
|
|
|
# Retrieve existing managed objects to be used in the key derivation
|
|
# process. If any are unaccessible or not suitable for key derivation,
|
|
# raise an error.
|
|
existing_objects = []
|
|
for unique_identifier in payload.unique_identifiers:
|
|
managed_object = self._get_object_with_access_controls(
|
|
unique_identifier,
|
|
enums.Operation.GET
|
|
)
|
|
if managed_object._object_type not in [
|
|
enums.ObjectType.SECRET_DATA,
|
|
enums.ObjectType.SYMMETRIC_KEY,
|
|
enums.ObjectType.PUBLIC_KEY,
|
|
enums.ObjectType.PRIVATE_KEY
|
|
]:
|
|
raise exceptions.InvalidField(
|
|
"Object {0} is not a suitable type for key "
|
|
"derivation. Please specify a key or secret data.".format(
|
|
unique_identifier
|
|
)
|
|
)
|
|
elif enums.CryptographicUsageMask.DERIVE_KEY not in \
|
|
managed_object.cryptographic_usage_masks:
|
|
raise exceptions.InvalidField(
|
|
"The DeriveKey bit must be set in the cryptographic usage "
|
|
"mask for object {0} for it to be used in key "
|
|
"derivation.".format(unique_identifier)
|
|
)
|
|
else:
|
|
existing_objects.append(managed_object)
|
|
|
|
if len(existing_objects) > 1:
|
|
self._logger.info(
|
|
"{0} derivation objects specified with the DeriveKey "
|
|
"request.".format(len(existing_objects))
|
|
)
|
|
|
|
# Select the derivation object to use as the keying material
|
|
keying_object = existing_objects[0]
|
|
self._logger.info(
|
|
"Object {0} will be used as the keying material for the "
|
|
"derivation process.".format(keying_object.unique_identifier)
|
|
)
|
|
|
|
derivation_parameters = payload.derivation_parameters
|
|
|
|
derivation_data = None
|
|
if derivation_parameters.derivation_data is None:
|
|
if len(existing_objects) > 1:
|
|
for alternate in existing_objects[1:]:
|
|
if alternate._object_type == enums.ObjectType.SECRET_DATA:
|
|
self._logger.info(
|
|
"Object {0} will be used as the derivation data "
|
|
"for the derivation process.".format(
|
|
alternate.unique_identifier
|
|
)
|
|
)
|
|
derivation_data = alternate.value
|
|
break
|
|
else:
|
|
derivation_data = derivation_parameters.derivation_data
|
|
|
|
iv = b''
|
|
if derivation_parameters.initialization_vector is not None:
|
|
iv = derivation_parameters.initialization_vector
|
|
|
|
# Get the derivation length from the template attribute. It is
|
|
# required so if it cannot be found, raise an error.
|
|
derivation_length = None
|
|
attribute = object_attributes.get('Cryptographic Length')
|
|
if attribute:
|
|
derivation_length = attribute.value
|
|
if (derivation_length % 8) == 0:
|
|
derivation_length //= 8
|
|
else:
|
|
raise exceptions.InvalidField(
|
|
"The cryptographic length must correspond to a valid "
|
|
"number of bytes (i.e., it must be a multiple of 8)."
|
|
)
|
|
else:
|
|
raise exceptions.InvalidField(
|
|
"The cryptographic length must be provided in the template "
|
|
"attribute."
|
|
)
|
|
|
|
cryptographic_algorithm = None
|
|
if payload.object_type == enums.ObjectType.SYMMETRIC_KEY:
|
|
attribute = object_attributes.get('Cryptographic Algorithm')
|
|
if attribute:
|
|
cryptographic_algorithm = attribute.value
|
|
else:
|
|
raise exceptions.InvalidField(
|
|
"The cryptographic algorithm must be provided in the "
|
|
"template attribute when deriving a symmetric key."
|
|
)
|
|
|
|
# TODO (peterhamilton): Pull cryptographic parameters from the keying
|
|
# object if none are provided with the payload
|
|
crypto_parameters = derivation_parameters.cryptographic_parameters
|
|
derived_data = self._cryptography_engine.derive_key(
|
|
derivation_method=payload.derivation_method,
|
|
derivation_length=derivation_length,
|
|
derivation_data=derivation_data,
|
|
key_material=keying_object.value,
|
|
hash_algorithm=crypto_parameters.hashing_algorithm,
|
|
salt=derivation_parameters.salt,
|
|
iteration_count=derivation_parameters.iteration_count,
|
|
encryption_algorithm=crypto_parameters.cryptographic_algorithm,
|
|
cipher_mode=crypto_parameters.block_cipher_mode,
|
|
padding_method=crypto_parameters.padding_method,
|
|
iv_nonce=iv
|
|
)
|
|
|
|
if derivation_length > len(derived_data):
|
|
raise exceptions.CryptographicFailure(
|
|
"The specified length exceeds the output of the derivation "
|
|
"method."
|
|
)
|
|
|
|
if payload.object_type == enums.ObjectType.SYMMETRIC_KEY:
|
|
managed_object = objects.SymmetricKey(
|
|
algorithm=cryptographic_algorithm,
|
|
length=(derivation_length * 8),
|
|
value=derived_data,
|
|
)
|
|
else:
|
|
managed_object = objects.SecretData(
|
|
value=derived_data,
|
|
data_type=enums.SecretDataType.SEED,
|
|
)
|
|
|
|
managed_object.names = []
|
|
|
|
if payload.object_type == enums.ObjectType.SECRET_DATA:
|
|
del object_attributes['Cryptographic Length']
|
|
self._set_attributes_on_managed_object(
|
|
managed_object,
|
|
object_attributes
|
|
)
|
|
|
|
# TODO (peterhamilton) Set additional server-only attributes.
|
|
managed_object._owner = self._client_identity
|
|
managed_object.initial_date = int(time.time())
|
|
|
|
self._data_session.add(managed_object)
|
|
self._data_session.commit()
|
|
|
|
self._logger.info(
|
|
"Created a {0} with ID: {1}".format(
|
|
''.join(
|
|
[x.capitalize() for x in
|
|
payload.object_type.name.split('_')]
|
|
),
|
|
managed_object.unique_identifier
|
|
)
|
|
)
|
|
self._id_placeholder = str(managed_object.unique_identifier)
|
|
|
|
response_payload = derive_key.DeriveKeyResponsePayload(
|
|
unique_identifier=str(managed_object.unique_identifier)
|
|
)
|
|
return response_payload
|
|
|
|
@_kmip_version_supported('1.0')
|
|
def _process_locate(self, payload):
|
|
# TODO: Need to complete the filtering logic based on all given
|
|
# objects in payload.
|
|
self._logger.info("Processing operation: Locate")
|
|
|
|
managed_objects = self._list_objects_with_access_controls(
|
|
enums.Operation.LOCATE)
|
|
|
|
if payload.attributes:
|
|
|
|
managed_objects_filtered = []
|
|
|
|
# Filter the objects based on given attributes.
|
|
# TODO: Currently will only filter for 'Name'.
|
|
# Needs to add other attributes.
|
|
for managed_object in managed_objects:
|
|
for attribute in payload.attributes:
|
|
attribute_name = attribute.attribute_name.value
|
|
attribute_value = attribute.attribute_value
|
|
attr = self._get_attribute_from_managed_object(
|
|
managed_object, attribute_name)
|
|
if attribute_name == 'Name':
|
|
names = attr
|
|
if attribute_value not in names:
|
|
break
|
|
# TODO: filtering on other attributes
|
|
else:
|
|
managed_objects_filtered.append(managed_object)
|
|
|
|
managed_objects = managed_objects_filtered
|
|
|
|
unique_identifiers = [attributes.UniqueIdentifier(
|
|
str(managed_object.unique_identifier))
|
|
for managed_object in managed_objects]
|
|
|
|
response_payload = locate.LocateResponsePayload(
|
|
unique_identifiers=unique_identifiers
|
|
)
|
|
|
|
return response_payload
|
|
|
|
@_kmip_version_supported('1.0')
|
|
def _process_get(self, payload):
|
|
self._logger.info("Processing operation: Get")
|
|
|
|
unique_identifier = self._id_placeholder
|
|
if payload.unique_identifier:
|
|
unique_identifier = payload.unique_identifier
|
|
|
|
key_format_type = None
|
|
if payload.key_format_type:
|
|
key_format_type = payload.key_format_type
|
|
|
|
if payload.key_compression_type:
|
|
raise exceptions.KeyCompressionTypeNotSupported(
|
|
"Key compression is not supported."
|
|
)
|
|
|
|
managed_object = self._get_object_with_access_controls(
|
|
unique_identifier,
|
|
enums.Operation.GET
|
|
)
|
|
|
|
if key_format_type:
|
|
if not hasattr(managed_object, 'key_format_type'):
|
|
raise exceptions.KeyFormatTypeNotSupported(
|
|
"Key format is not applicable to the specified object."
|
|
)
|
|
|
|
# TODO (peterhamilton) Convert key to desired format if possible
|
|
if key_format_type != managed_object.key_format_type:
|
|
raise exceptions.KeyFormatTypeNotSupported(
|
|
"Key format conversion from {0} to {1} is "
|
|
"unsupported.".format(
|
|
managed_object.key_format_type.name,
|
|
key_format_type.name
|
|
)
|
|
)
|
|
|
|
object_type = managed_object.object_type.name
|
|
self._logger.info(
|
|
"Getting a {0} with ID: {1}".format(
|
|
''.join([x.capitalize() for x in object_type.split('_')]),
|
|
managed_object.unique_identifier
|
|
)
|
|
)
|
|
|
|
if payload.key_wrapping_specification:
|
|
key_wrapping_spec = payload.key_wrapping_specification
|
|
wrapping_method = key_wrapping_spec.wrapping_method
|
|
|
|
if wrapping_method != enums.WrappingMethod.ENCRYPT:
|
|
raise exceptions.OperationNotSupported(
|
|
"Wrapping method '{0}' is not supported.".format(
|
|
wrapping_method
|
|
)
|
|
)
|
|
|
|
if key_wrapping_spec.encryption_key_information:
|
|
key_info = key_wrapping_spec.encryption_key_information
|
|
encryption_key_uuid = key_info.unique_identifier
|
|
encryption_key_params = key_info.cryptographic_parameters
|
|
|
|
try:
|
|
key = self._get_object_with_access_controls(
|
|
encryption_key_uuid,
|
|
enums.Operation.GET
|
|
)
|
|
except Exception:
|
|
raise exceptions.ItemNotFound(
|
|
"Wrapping key does not exist."
|
|
)
|
|
|
|
if key._object_type != enums.ObjectType.SYMMETRIC_KEY:
|
|
raise exceptions.IllegalOperation(
|
|
"The wrapping encryption key specified by the "
|
|
"encryption key information is not a key."
|
|
)
|
|
|
|
if key.state != enums.State.ACTIVE:
|
|
raise exceptions.PermissionDenied(
|
|
"Encryption key {0} must be activated to be used for "
|
|
"key wrapping.".format(encryption_key_uuid)
|
|
)
|
|
|
|
mask = enums.CryptographicUsageMask.WRAP_KEY
|
|
if mask not in key.cryptographic_usage_masks:
|
|
raise exceptions.PermissionDenied(
|
|
"The WrapKey bit must be set in the cryptographic "
|
|
"usage mask of encryption key {0} for it to be used "
|
|
"for key wrapping.".format(encryption_key_uuid)
|
|
)
|
|
|
|
if key_wrapping_spec.attribute_names:
|
|
raise exceptions.IllegalOperation(
|
|
"Wrapping object attributes is not supported."
|
|
)
|
|
|
|
encoding_option = key_wrapping_spec.encoding_option
|
|
if encoding_option != enums.EncodingOption.NO_ENCODING:
|
|
raise exceptions.EncodingOptionError(
|
|
"Encoding option '{0}' is not supported.".format(
|
|
encoding_option
|
|
)
|
|
)
|
|
|
|
self._logger.info("Wrapping {0} {1} with {2} {3}.".format(
|
|
''.join([x.capitalize() for x in object_type.split('_')]),
|
|
managed_object.unique_identifier,
|
|
''.join(
|
|
[x.capitalize() for x in key._object_type.name.split(
|
|
'_'
|
|
)]
|
|
),
|
|
encryption_key_uuid
|
|
))
|
|
|
|
result = self._cryptography_engine.wrap_key(
|
|
key_material=managed_object.value,
|
|
wrapping_method=key_wrapping_spec.wrapping_method,
|
|
key_wrap_algorithm=encryption_key_params.block_cipher_mode,
|
|
encryption_key=key.value
|
|
)
|
|
|
|
wrapped_object = copy.deepcopy(managed_object)
|
|
wrapped_object.value = result
|
|
|
|
core_secret = self._build_core_object(wrapped_object)
|
|
key_wrapping_data = KeyWrappingData(
|
|
wrapping_method=wrapping_method,
|
|
encryption_key_information=key_info,
|
|
encoding_option=encoding_option
|
|
)
|
|
core_secret.key_block.key_wrapping_data = key_wrapping_data
|
|
|
|
elif key_wrapping_spec.mac_signature_key_information:
|
|
raise exceptions.PermissionDenied(
|
|
"Key wrapping with MAC/signing key information is not "
|
|
"supported."
|
|
)
|
|
else:
|
|
raise exceptions.PermissionDenied(
|
|
"Either the encryption key information or the "
|
|
"MAC/signature key information must be specified for key "
|
|
"wrapping to be performed."
|
|
)
|
|
else:
|
|
core_secret = self._build_core_object(managed_object)
|
|
|
|
response_payload = get.GetResponsePayload(
|
|
object_type=managed_object._object_type,
|
|
unique_identifier=unique_identifier,
|
|
secret=core_secret
|
|
)
|
|
|
|
return response_payload
|
|
|
|
@_kmip_version_supported('1.0')
|
|
def _process_get_attributes(self, payload):
|
|
self._logger.info("Processing operation: GetAttributes")
|
|
|
|
if payload.unique_identifier:
|
|
unique_identifier = payload.unique_identifier
|
|
else:
|
|
unique_identifier = self._id_placeholder
|
|
|
|
managed_object = self._get_object_with_access_controls(
|
|
unique_identifier,
|
|
enums.Operation.GET_ATTRIBUTES
|
|
)
|
|
attrs = self._get_attributes_from_managed_object(
|
|
managed_object,
|
|
payload.attribute_names
|
|
)
|
|
|
|
response_payload = get_attributes.GetAttributesResponsePayload(
|
|
unique_identifier=unique_identifier,
|
|
attributes=attrs
|
|
)
|
|
|
|
return response_payload
|
|
|
|
@_kmip_version_supported('1.0')
|
|
def _process_get_attribute_list(self, payload):
|
|
self._logger.info("Processing operation: GetAttributeList")
|
|
|
|
if payload.unique_identifier:
|
|
unique_identifier = payload.unique_identifier
|
|
else:
|
|
unique_identifier = self._id_placeholder
|
|
|
|
managed_object = self._get_object_with_access_controls(
|
|
unique_identifier,
|
|
enums.Operation.GET_ATTRIBUTE_LIST
|
|
)
|
|
object_attributes = self._get_attributes_from_managed_object(
|
|
managed_object,
|
|
list()
|
|
)
|
|
attribute_names = list()
|
|
|
|
for object_attribute in object_attributes:
|
|
attribute_names.append(object_attribute.attribute_name.value)
|
|
|
|
response_payload = get_attribute_list.GetAttributeListResponsePayload(
|
|
unique_identifier=unique_identifier,
|
|
attribute_names=attribute_names
|
|
)
|
|
|
|
return response_payload
|
|
|
|
@_kmip_version_supported('1.0')
|
|
def _process_activate(self, payload):
|
|
self._logger.info("Processing operation: Activate")
|
|
|
|
if payload.unique_identifier:
|
|
unique_identifier = payload.unique_identifier.value
|
|
else:
|
|
unique_identifier = self._id_placeholder
|
|
|
|
managed_object = self._get_object_with_access_controls(
|
|
unique_identifier,
|
|
enums.Operation.ACTIVATE
|
|
)
|
|
object_type = managed_object._object_type
|
|
if not hasattr(managed_object, 'state'):
|
|
raise exceptions.IllegalOperation(
|
|
"An {0} object has no state and cannot be activated.".format(
|
|
''.join(
|
|
[x.capitalize() for x in object_type.name.split('_')]
|
|
)
|
|
)
|
|
)
|
|
|
|
if managed_object.state != enums.State.PRE_ACTIVE:
|
|
raise exceptions.PermissionDenied(
|
|
"The object state is not pre-active and cannot be activated."
|
|
)
|
|
|
|
managed_object.state = enums.State.ACTIVE
|
|
self._data_session.commit()
|
|
|
|
response_payload = activate.ActivateResponsePayload(
|
|
unique_identifier=attributes.UniqueIdentifier(unique_identifier)
|
|
)
|
|
|
|
return response_payload
|
|
|
|
@_kmip_version_supported('1.0')
|
|
def _process_revoke(self, payload):
|
|
self._logger.info("Processing operation: Revoke")
|
|
|
|
revocation_code = None
|
|
if payload.revocation_reason and \
|
|
payload.revocation_reason.revocation_code:
|
|
revocation_code = payload.revocation_reason.revocation_code
|
|
else:
|
|
raise exceptions.InvalidField(
|
|
"revocation reason code must be specified"
|
|
)
|
|
|
|
if payload.unique_identifier:
|
|
unique_identifier = payload.unique_identifier.value
|
|
else:
|
|
unique_identifier = self._id_placeholder
|
|
|
|
managed_object = self._get_object_with_access_controls(
|
|
unique_identifier,
|
|
enums.Operation.REVOKE
|
|
)
|
|
object_type = managed_object._object_type
|
|
if not hasattr(managed_object, 'state'):
|
|
raise exceptions.IllegalOperation(
|
|
"An {0} object has no state and cannot be revoked.".format(
|
|
''.join(
|
|
[x.capitalize() for x in object_type.name.split('_')]
|
|
)
|
|
)
|
|
)
|
|
|
|
# TODO: need to set Compromise Date attribute or Deactivation Date
|
|
# attribute
|
|
if revocation_code.value is enums.RevocationReasonCode.KEY_COMPROMISE:
|
|
if managed_object.state == enums.State.DESTROYED:
|
|
managed_object.state = enums.State.DESTROYED_COMPROMISED
|
|
else:
|
|
managed_object.state = enums.State.COMPROMISED
|
|
else:
|
|
if managed_object.state != enums.State.ACTIVE:
|
|
raise exceptions.IllegalOperation(
|
|
"The object is not active and cannot be revoked with "
|
|
"reason other than KEY_COMPROMISE"
|
|
)
|
|
else:
|
|
managed_object.state = enums.State.DEACTIVATED
|
|
self._data_session.commit()
|
|
|
|
response_payload = revoke.RevokeResponsePayload(
|
|
unique_identifier=attributes.UniqueIdentifier(unique_identifier)
|
|
)
|
|
|
|
return response_payload
|
|
|
|
@_kmip_version_supported('1.0')
|
|
def _process_destroy(self, payload):
|
|
self._logger.info("Processing operation: Destroy")
|
|
|
|
if payload.unique_identifier:
|
|
unique_identifier = payload.unique_identifier.value
|
|
else:
|
|
unique_identifier = self._id_placeholder
|
|
|
|
managed_object = self._get_object_with_access_controls(
|
|
unique_identifier,
|
|
enums.Operation.DESTROY
|
|
)
|
|
|
|
# TODO If in "ACTIVE" state, we need to check its "Deactivation date"
|
|
# to see whether it can be destroyed or not
|
|
if hasattr(managed_object, 'state'):
|
|
if managed_object.state == enums.State.ACTIVE:
|
|
raise exceptions.PermissionDenied(
|
|
"Object is active and cannot be destroyed."
|
|
)
|
|
|
|
# 'OpaqueObject' object has no attribute 'state'
|
|
if hasattr(managed_object, 'state') and \
|
|
managed_object.state == enums.State.COMPROMISED:
|
|
managed_object.state = enums.State.DESTROYED_COMPROMISED
|
|
|
|
self._logger.info(
|
|
"Destroying an object with ID: {0}".format(unique_identifier)
|
|
)
|
|
self._data_session.query(objects.ManagedObject).filter(
|
|
objects.ManagedObject.unique_identifier == unique_identifier
|
|
).delete()
|
|
|
|
response_payload = destroy.DestroyResponsePayload(
|
|
unique_identifier=attributes.UniqueIdentifier(unique_identifier)
|
|
)
|
|
|
|
self._data_session.commit()
|
|
|
|
return response_payload
|
|
|
|
@_kmip_version_supported('1.0')
|
|
def _process_query(self, payload):
|
|
self._logger.info("Processing operation: Query")
|
|
|
|
queries = [x.value for x in payload.query_functions]
|
|
|
|
operations = list()
|
|
objects = list()
|
|
vendor_identification = None
|
|
server_information = None
|
|
namespaces = list()
|
|
extensions = list()
|
|
|
|
if enums.QueryFunction.QUERY_OPERATIONS in queries:
|
|
operations = list([
|
|
contents.Operation(enums.Operation.CREATE),
|
|
contents.Operation(enums.Operation.CREATE_KEY_PAIR),
|
|
contents.Operation(enums.Operation.REGISTER),
|
|
contents.Operation(enums.Operation.DERIVE_KEY),
|
|
contents.Operation(enums.Operation.LOCATE),
|
|
contents.Operation(enums.Operation.GET),
|
|
contents.Operation(enums.Operation.GET_ATTRIBUTES),
|
|
contents.Operation(enums.Operation.GET_ATTRIBUTE_LIST),
|
|
contents.Operation(enums.Operation.ACTIVATE),
|
|
contents.Operation(enums.Operation.DESTROY),
|
|
contents.Operation(enums.Operation.QUERY)
|
|
])
|
|
|
|
if self._protocol_version >= contents.ProtocolVersion.create(1, 1):
|
|
operations.extend([
|
|
contents.Operation(enums.Operation.DISCOVER_VERSIONS)
|
|
])
|
|
if self._protocol_version >= contents.ProtocolVersion.create(1, 2):
|
|
operations.extend([
|
|
contents.Operation(enums.Operation.ENCRYPT),
|
|
contents.Operation(enums.Operation.MAC)
|
|
])
|
|
|
|
if enums.QueryFunction.QUERY_OBJECTS in queries:
|
|
objects = list()
|
|
if enums.QueryFunction.QUERY_SERVER_INFORMATION in queries:
|
|
vendor_identification = misc.VendorIdentification(
|
|
"PyKMIP {0} Software Server".format(kmip.__version__)
|
|
)
|
|
server_information = None
|
|
if enums.QueryFunction.QUERY_APPLICATION_NAMESPACES in queries:
|
|
namespaces = list()
|
|
if enums.QueryFunction.QUERY_EXTENSION_LIST in queries:
|
|
extensions = list()
|
|
if enums.QueryFunction.QUERY_EXTENSION_MAP in queries:
|
|
extensions = list()
|
|
|
|
response_payload = query.QueryResponsePayload(
|
|
operations=operations,
|
|
object_types=objects,
|
|
vendor_identification=vendor_identification,
|
|
server_information=server_information,
|
|
application_namespaces=namespaces,
|
|
extension_information=extensions
|
|
)
|
|
|
|
return response_payload
|
|
|
|
@_kmip_version_supported('1.1')
|
|
def _process_discover_versions(self, payload):
|
|
self._logger.info("Processing operation: DiscoverVersions")
|
|
supported_versions = list()
|
|
|
|
if len(payload.protocol_versions) > 0:
|
|
for version in payload.protocol_versions:
|
|
if version in self._protocol_versions:
|
|
supported_versions.append(version)
|
|
else:
|
|
supported_versions = self._protocol_versions
|
|
|
|
response_payload = discover_versions.DiscoverVersionsResponsePayload(
|
|
protocol_versions=supported_versions
|
|
)
|
|
|
|
return response_payload
|
|
|
|
@_kmip_version_supported('1.2')
|
|
def _process_encrypt(self, payload):
|
|
self._logger.info("Processing operation: Encrypt")
|
|
|
|
unique_identifier = self._id_placeholder
|
|
if payload.unique_identifier:
|
|
unique_identifier = payload.unique_identifier
|
|
|
|
# The KMIP spec does not indicate that the Encrypt operation should
|
|
# have it's own operation policy entry. Rather, the cryptographic
|
|
# usage mask should be used to determine if the object can be used
|
|
# to encrypt data (see below).
|
|
managed_object = self._get_object_with_access_controls(
|
|
unique_identifier,
|
|
enums.Operation.GET
|
|
)
|
|
|
|
cryptographic_parameters = payload.cryptographic_parameters
|
|
if cryptographic_parameters is None:
|
|
# TODO (peter-hamilton): Pull the cryptographic parameters from
|
|
# the attributes associated with the encryption key.
|
|
raise exceptions.InvalidField(
|
|
"The cryptographic parameters must be specified."
|
|
)
|
|
|
|
# TODO (peter-hamilton): Check the usage limitations for the key to
|
|
# confirm that it can be used for this operation.
|
|
|
|
if managed_object._object_type != enums.ObjectType.SYMMETRIC_KEY:
|
|
raise exceptions.PermissionDenied(
|
|
"The requested encryption key is not a symmetric key. "
|
|
"Only symmetric encryption is currently supported."
|
|
)
|
|
|
|
if managed_object.state != enums.State.ACTIVE:
|
|
raise exceptions.PermissionDenied(
|
|
"The encryption key must be in the Active state to be used "
|
|
"for encryption."
|
|
)
|
|
|
|
if enums.CryptographicUsageMask.ENCRYPT not in \
|
|
managed_object.cryptographic_usage_masks:
|
|
raise exceptions.PermissionDenied(
|
|
"The Encrypt bit must be set in the encryption key's "
|
|
"cryptographic usage mask."
|
|
)
|
|
|
|
result = self._cryptography_engine.encrypt(
|
|
cryptographic_parameters.cryptographic_algorithm,
|
|
managed_object.value,
|
|
payload.data,
|
|
cipher_mode=cryptographic_parameters.block_cipher_mode,
|
|
padding_method=cryptographic_parameters.padding_method,
|
|
iv_nonce=payload.iv_counter_nonce
|
|
)
|
|
|
|
response_payload = encrypt.EncryptResponsePayload(
|
|
unique_identifier,
|
|
result.get('cipher_text'),
|
|
result.get('iv_nonce')
|
|
)
|
|
return response_payload
|
|
|
|
@_kmip_version_supported('1.2')
|
|
def _process_mac(self, payload):
|
|
self._logger.info("Processing operation: MAC")
|
|
|
|
unique_identifier = self._id_placeholder
|
|
if payload.unique_identifier:
|
|
unique_identifier = payload.unique_identifier.value
|
|
|
|
# TODO: Currently use the GET operation policy here to ensure only a
|
|
# user with read access to the secret can use it to compute a MAC
|
|
# value. However, the MAC operation's access should be controlled by
|
|
# cryptographic usage mask instead of operation policy.
|
|
managed_object = self._get_object_with_access_controls(
|
|
unique_identifier,
|
|
enums.Operation.GET
|
|
)
|
|
|
|
algorithm = None
|
|
if (payload.cryptographic_parameters and
|
|
payload.cryptographic_parameters.cryptographic_algorithm):
|
|
algorithm = \
|
|
payload.cryptographic_parameters.cryptographic_algorithm
|
|
elif (isinstance(managed_object, objects.Key) and
|
|
managed_object.cryptographic_algorithm):
|
|
algorithm = managed_object.cryptographic_algorithm
|
|
else:
|
|
raise exceptions.PermissionDenied(
|
|
"The cryptographic algorithm must be specified "
|
|
"for the MAC operation"
|
|
)
|
|
|
|
key = None
|
|
if managed_object.value:
|
|
key = managed_object.value
|
|
else:
|
|
raise exceptions.PermissionDenied(
|
|
"A secret key value must be specified "
|
|
"for the MAC operation"
|
|
)
|
|
|
|
data = None
|
|
if payload.data:
|
|
data = payload.data.value
|
|
else:
|
|
raise exceptions.PermissionDenied(
|
|
"No data to be MACed"
|
|
)
|
|
|
|
if managed_object.state != enums.State.ACTIVE:
|
|
raise exceptions.PermissionDenied(
|
|
"Object is not in a state that can be used for MACing."
|
|
)
|
|
|
|
if enums.CryptographicUsageMask.MAC_GENERATE not in \
|
|
managed_object.cryptographic_usage_masks:
|
|
raise exceptions.PermissionDenied(
|
|
"MAC Generate must be set in the object's cryptographic "
|
|
"usage mask"
|
|
)
|
|
|
|
result = self._cryptography_engine.mac(
|
|
algorithm,
|
|
key,
|
|
data
|
|
)
|
|
|
|
response_payload = mac.MACResponsePayload(
|
|
unique_identifier=attributes.UniqueIdentifier(unique_identifier),
|
|
mac_data=MACData(result)
|
|
)
|
|
|
|
return response_payload
|