Repository navigation
Map the remaining PKCS#11 return codes to exceptions - #251
Open
afchine1337 wants to merge 1 commit into
Open
afchine1337 wants to merge 1 commit into
afchine1337 wants to merge 1 commit into
Conversation
27 return codes defined in extern/pkcs11t.h had no exception, so they
surfaced as a bare PKCS11Error("Unmapped error code 0x..."). Several
come from PKCS#11 v3.0 and v3.2 and are returned by current tokens:
CKR_KEY_FUNCTION_NOT_PERMITTED (a key used for something its
attributes do not allow), CKR_CURVE_NOT_SUPPORTED,
CKR_ACTION_PROHIBITED, CKR_AEAD_DECRYPT_FAILED and
CKR_PARAMETER_SET_NOT_SUPPORTED.
Each code gets a PKCS11Error subclass named after it, as the existing
ones are, and a branch in map_rv_to_error. The 11 codes not yet
declared in the CK_RV enum are added there. Code that catches
PKCS11Error is unaffected.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
27 return codes defined in
extern/pkcs11t.hhad no exception class. A token returning one of them surfaced as a barePKCS11Error("Unmapped error code 0x..."), which callers can only tell apart by parsing the message.Several of these codes come from PKCS#11 v3.0 and v3.2, and current tokens return them:
CKR_KEY_FUNCTION_NOT_PERMITTED: the key's attributes do not allow the operation;CKR_CURVE_NOT_SUPPORTED;CKR_ACTION_PROHIBITED;CKR_AEAD_DECRYPT_FAILED;CKR_PARAMETER_SET_NOT_SUPPORTED.Changes
pkcs11/exceptions.py: onePKCS11Errorsubclass per code, named after the code like the existing classes (CurveNotSupported,KeyFunctionNotPermitted,AEADDecryptFailed,ParameterSetNotSupported, ...).pkcs11/_pkcs11.pxd: the 11 codes missing from theCK_RVenum are declared, andmap_rv_to_errorgets a branch for each of the 27 codes.Code that catches
PKCS11Errorkeeps working, since every new class derives from it. Code that matched on the "Unmapped error code" message will see the specific class instead.Testing
ruff formatandruff checkare clean. I ran the test suite against FreeHSM (all-mechanisms build, permissive mode): 121 passed, 43 skipped, and 1 failed,test_seed_random. That token refuses external seeding by design, and the test fails the same way onmaster. No new tests were added, because none of the existing tests triggers these codes on purpose.Related to #249.