Whack attribute code with a club until it works with PKCS #11.

PKCS #11 supports zero-length attributes (eg, CKA_LABEL) so hack of
using zero length attribute as NIL value won't work, instead we use a
slightly more portable version of the hack PKCS #11 uses (PKCS #11
stuffs -1 into a CK_ULONG, we stuff 0xFFFFFFFF into a uint32_t).

ks_attribute.c code was trying too hard and tripping over its own
socks.  Instead of trying to maintain attributes[] in place during
modification, we now perform the minimum necessary change then re-scan
the block.  This is (very slightly) slower but more robust, both
because the scan code has better error checking and because it's the
scan code that we want to be sure is happy before committing a change.

Rename hal_rpc_pkey_attribute_t to hal_pkey_attribute_t.

1 files changed, 7 insertions, 6 deletions

diff --git a/libhal.py b/libhal.py
index dc8d07d..369e5e1 100644
--- a/libhal.py
+++ b/libhal.py
@@ -231,6 +231,8 @@ HAL_KEY_FLAG_USAGE_DATAENCIPHERMENT     = (1 << 2)
 HAL_KEY_FLAG_TOKEN                      = (1 << 3)
 HAL_KEY_FLAG_PUBLIC                     = (1 << 4)
 
+HAL_PKEY_ATTRIBUTE_NIL                  = (0xFFFFFFFF)
+
 
 class UUID(uuid.UUID):
 
@@ -383,11 +385,10 @@ class PKey(Handle):
         self.hsm.pkey_set_attributes(self, attributes)
 
     def get_attributes(self, attributes):
-        lengths = self.hsm.pkey_get_attributes(self, attributes, 0)
-        attributes = (k for k, v in lengths.iteritems() if v > 0)
-        buffer_length = sum(lengths.itervalues())
-        result = dict((a, None) for a in lengths)
-        result.update(self.hsm.pkey_get_attributes(self, attributes, buffer_length))
+        attrs = self.hsm.pkey_get_attributes(self, attributes, 0)
+        attrs = dict((k, v) for k, v in attrs.iteritems() if v != HAL_PKEY_ATTRIBUTE_NIL)
+        result = dict((a, None) for a in attributes)
+        result.update(self.hsm.pkey_get_attributes(self, attrs.iterkeys(), sum(attrs.itervalues())))
         return result
 
 
@@ -498,7 +499,7 @@ class HSM(object):
         packer.pack_uint(len(arg))
         for name, value in arg.iteritems():
             self._pack_arg(packer, name)
-            self._pack_arg(packer, value)
+            self._pack_arg(packer, HAL_PKEY_ATTRIBUTE_NIL if value is None else value)
 
     @contextlib.contextmanager
     def rpc(self, code, *args, **kwargs):