Properly handle same alias case

If the same alias is given during asymmetric key creation, a database
constraint gets violated. State it clearly that aliases must be
different and return proper error.

Also move the parameter check to the beginning of the request handling
method.

Change-Id: I51b43dae4022588de46f33ec238f0b65c80874fe

diff --git a/src/include/ckmc/ckmc-extended.h b/src/include/ckmc/ckmc-extended.h
index 3b73bbc8ea2bcdcdd841b8eeb42d23f21c494e33..7c017143b0ce86e93f3da14a32b050662f5bbfaa 100644 (file)
--- a/src/include/ckmc/ckmc-extended.h
+++ b/src/include/ckmc/ckmc-extended.h
@@ -209,6 +209,7 @@ int ckmc_unwrap_concatenated_data(const ckmc_param_list_h params,
  * @remarks If password in @a policy_private_key or @a policy_public_key is provided, the stored key
  *          is additionally encrypted with it.
  * @remarks Currently supported KEM types are: #CKMC_ML_KEM_768, #CKMC_ML_KEM_1024.
+ * @remarks The @a private_key_alias must be different than @a public_key_alias.
  *
  * @param[in] kem_type The type of KEM key to be created
  * @param[in] private_key_alias The name of private key to be stored

diff --git a/src/include/ckmc/ckmc-manager.h b/src/include/ckmc/ckmc-manager.h
index 860975b8f79f49c207aa89b336fb93dea0ba301e..0070dd0b0465f4db964fdf5b39734c25bb0ba19d 100644 (file)
--- a/src/include/ckmc/ckmc-manager.h
+++ b/src/include/ckmc/ckmc-manager.h
@@ -833,6 +833,7 @@ int ckmc_get_data_alias_info_list(ckmc_alias_info_list_s **ppalias_list);
  * @remarks The supported sizes are: @c 1024, @c 2048, @c 3072 and @c 4096 bits.
  * @remarks If password in the policy is provided, the key is additionally encrypted with the
  *          password in the policy.
+ * @remarks The @a private_key_alias must be different than @a public_key_alias.
  *
  * @param[in] size The size of key strength to be created
  * @param[in] private_key_alias The name of private key to be stored
@@ -872,6 +873,7 @@ int ckmc_create_key_pair_rsa(const size_t size,
  * @remarks The supported sizes are: @c 1024, @c 2048, @c 3072 and (Since 7.0) @c 4096 bits.
  * @remarks If password in the policy is provided, the key is additionally encrypted with the
  *          password in the policy.
+ * @remarks The @a private_key_alias must be different than @a public_key_alias.
  *
  * @param[in] size The size of key strength to be created
  * @param[in] private_key_alias The name of private key to be stored
@@ -912,6 +914,7 @@ int ckmc_create_key_pair_dsa(const size_t size,
  *          password in the policy.
  * @remarks Currently supported elliptic curves of ECDSA are: #CKMC_EC_PRIME192V1, #CKMC_EC_PRIME256V1,
  *          #CKMC_EC_SECP384R1
+ * @remarks The @a private_key_alias must be different than @a public_key_alias.
  *
  * @param[in] type The type of elliptic curve of ECDSA
  * @param[in] private_key_alias The name of private key to be stored

diff --git a/src/manager/service/ckm-logic.cpp b/src/manager/service/ckm-logic.cpp
index 412f1e9b98b6aaa34c6db0027fb5eed57a5a27cc..16ce0dc723455169581dcdf1bda729f092afb9eb 100644 (file)
--- a/src/manager/service/ckm-logic.cpp
+++ b/src/manager/service/ckm-logic.cpp
@@ -1633,18 +1633,13 @@ RawBuffer CKMLogic::createKeyPair(
        const PolicySerializable &policyPub)
 {
        return SerializeMessage(msgId, tryRet([&] {
-               auto [dbOpPrv, digestPrv, retCodePrv] = beginSaveAndGetHash(cred, namePrv, ownerPrv);
-               if (retCodePrv != CKM_API_SUCCESS)
-                       return retCodePrv;
-
-               auto [dbOpPub, digestPub, retCodePub] = beginSaveAndGetHash(cred, namePub, ownerPub);
-               if (retCodePub != CKM_API_SUCCESS)
-                       return retCodePub;
+               if (namePrv == namePub && ownerPrv == ownerPub)
+                       ThrowErr(Exc::InputParam, "Private and public key must have different aliases.");
 
                if (policyPrv.backend != policyPub.backend)
                        ThrowErr(Exc::InputParam, "Error, key pair must be supported with the same backend.");
 
-               const std::unordered_map<AlgoType, DataType::Type> algoTypeToDataTypeConverter = {
+               static const std::unordered_map<AlgoType, DataType::Type> algoTypeToDataTypeConverter = {
                        { AlgoType::RSA_GEN,    DataType::Type::KEY_RSA_PRIVATE },
                        { AlgoType::DSA_GEN,    DataType::Type::KEY_DSA_PRIVATE },
                        { AlgoType::ECDSA_GEN,  DataType::Type::KEY_ECDSA_PRIVATE },
@@ -1655,12 +1650,18 @@ RawBuffer CKMLogic::createKeyPair(
                        CKM::Crypto::unpack<AlgoType>(keyGenParams, ParamName::ALGO_TYPE));
 
                if (dataTypeIt == algoTypeToDataTypeConverter.cend())
-               {
                        ThrowErr(Exc::InputParam, "Error, key pair must be RSA or DSA or ECDSA or KEM.");
-               }
 
                Crypto::validateParams<Crypto::IsAsymGeneration>(keyGenParams, g_validators);
 
+               auto [dbOpPrv, digestPrv, retCodePrv] = beginSaveAndGetHash(cred, namePrv, ownerPrv);
+               if (retCodePrv != CKM_API_SUCCESS)
+                       return retCodePrv;
+
+               auto [dbOpPub, digestPub, retCodePub] = beginSaveAndGetHash(cred, namePub, ownerPub);
+               if (retCodePub != CKM_API_SUCCESS)
+                       return retCodePub;
+
                TokenPair keys = m_decider.getStore(
                        dataTypeIt->second, policyPrv, policyPub, false).generateAKey(
                                keyGenParams,