usr/src/lib/pkcs11/pkcs11_softtoken/common/softSlotToken.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21
  22 /*
  23  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  24  */
  25
  26 #include <strings.h>
  27 #include <cryptoutil.h>
  28 #include <security/cryptoki.h>
  29 #include <sys/crypto/common.h>
  30 #include <arcfour.h>
  31 #include "softGlobal.h"
  32 #include "softSession.h"
  33 #include <aes_impl.h>
  34 #include <blowfish_impl.h>
  35 #include <des_impl.h>
  36 #include <ecc_impl.h>
  37 #include "softDH.h"
  38 #include "softObject.h"
  39 #include "softKeystore.h"
  40 #include "softKeystoreUtil.h"
  41
  42
  43 static CK_MECHANISM_TYPE soft_mechanisms[] = {
  44         CKM_DES_CBC,
  45         CKM_DES_CBC_PAD,
  46         CKM_DES_ECB,
  47         CKM_DES_KEY_GEN,
  48         CKM_DES_MAC_GENERAL,
  49         CKM_DES_MAC,
  50         CKM_DES3_CBC,
  51         CKM_DES3_CBC_PAD,
  52         CKM_DES3_ECB,
  53         CKM_DES2_KEY_GEN,
  54         CKM_DES3_KEY_GEN,
  55         CKM_AES_CBC,
  56         CKM_AES_CBC_PAD,
  57         CKM_AES_CTR,
  58         CKM_AES_CMAC_GENERAL,
  59         CKM_AES_CMAC,
  60         CKM_AES_ECB,
  61         CKM_AES_KEY_GEN,
  62         CKM_BLOWFISH_CBC,
  63         CKM_BLOWFISH_KEY_GEN,
  64         CKM_SHA_1,
  65         CKM_SHA_1_HMAC,
  66         CKM_SHA_1_HMAC_GENERAL,
  67         CKM_SHA256,
  68         CKM_SHA256_HMAC,
  69         CKM_SHA256_HMAC_GENERAL,
  70         CKM_SHA384,
  71         CKM_SHA384_HMAC,
  72         CKM_SHA384_HMAC_GENERAL,
  73         CKM_SHA512,
  74         CKM_SHA512_HMAC,
  75         CKM_SHA512_HMAC_GENERAL,
  76         CKM_SSL3_SHA1_MAC,
  77         CKM_MD5,
  78         CKM_MD5_HMAC,
  79         CKM_MD5_HMAC_GENERAL,
  80         CKM_SSL3_MD5_MAC,
  81         CKM_RC4,
  82         CKM_RC4_KEY_GEN,
  83         CKM_DSA,
  84         CKM_DSA_SHA1,
  85         CKM_DSA_KEY_PAIR_GEN,
  86         CKM_RSA_PKCS,
  87         CKM_RSA_PKCS_KEY_PAIR_GEN,
  88         CKM_RSA_X_509,
  89         CKM_MD5_RSA_PKCS,
  90         CKM_SHA1_RSA_PKCS,
  91         CKM_SHA256_RSA_PKCS,
  92         CKM_SHA384_RSA_PKCS,
  93         CKM_SHA512_RSA_PKCS,
  94         CKM_DH_PKCS_KEY_PAIR_GEN,
  95         CKM_DH_PKCS_DERIVE,
  96         CKM_MD5_KEY_DERIVATION,
  97         CKM_SHA1_KEY_DERIVATION,
  98         CKM_SHA256_KEY_DERIVATION,
  99         CKM_SHA384_KEY_DERIVATION,
 100         CKM_SHA512_KEY_DERIVATION,
 101         CKM_PBE_SHA1_RC4_128,
 102         CKM_PKCS5_PBKD2,
 103         CKM_SSL3_PRE_MASTER_KEY_GEN,
 104         CKM_TLS_PRE_MASTER_KEY_GEN,
 105         CKM_SSL3_MASTER_KEY_DERIVE,
 106         CKM_TLS_MASTER_KEY_DERIVE,
 107         CKM_SSL3_MASTER_KEY_DERIVE_DH,
 108         CKM_TLS_MASTER_KEY_DERIVE_DH,
 109         CKM_SSL3_KEY_AND_MAC_DERIVE,
 110         CKM_TLS_KEY_AND_MAC_DERIVE,
 111         CKM_TLS_PRF,
 112         CKM_EC_KEY_PAIR_GEN,
 113         CKM_ECDSA,
 114         CKM_ECDSA_SHA1,
 115         CKM_ECDH1_DERIVE
 116 };
 117
 118 /*
 119  * This is the table of CK_MECHANISM_INFO structs for the supported mechanisms.
 120  * The index for this table is the same as the one above for the same
 121  * mechanism.
 122  * The minimum and maximum sizes of the key for the mechanism can be measured
 123  * in bits or in bytes (i.e. mechanism-dependent). This table specifies the
 124  * supported range of key sizes in bytes; unless noted as in bits.
 125  */
 126 static CK_MECHANISM_INFO soft_mechanism_info[] = {
 127         {DES_MINBYTES, DES_MAXBYTES,
 128                 CKF_ENCRYPT|CKF_DECRYPT|
 129                 CKF_WRAP|CKF_UNWRAP},           /* CKM_DES_CBC */
 130         {DES_MINBYTES, DES_MAXBYTES,
 131                 CKF_ENCRYPT|CKF_DECRYPT|
 132                 CKF_WRAP|CKF_UNWRAP},           /* CKM_DES_CBC_PAD */
 133         {DES_MINBYTES, DES_MAXBYTES,
 134                 CKF_ENCRYPT|CKF_DECRYPT|
 135                 CKF_WRAP|CKF_UNWRAP},           /* CKM_DES_ECB */
 136         {DES_MINBYTES, DES_MAXBYTES,
 137                 CKF_GENERATE},                  /* CKM_DES_KEY_GEN */
 138         {DES_MINBYTES, DES_MAXBYTES,
 139                 CKF_SIGN|CKF_VERIFY},           /* CKM_DES_MAC_GENERAL */
 140         {DES_MINBYTES, DES_MAXBYTES,
 141                 CKF_SIGN|CKF_VERIFY},           /* CKM_DES_MAC */
 142         {DES3_MINBYTES, DES3_MAXBYTES,
 143                 CKF_ENCRYPT|CKF_DECRYPT|
 144                 CKF_WRAP|CKF_UNWRAP},           /* CKM_DES3_CBC */
 145         {DES3_MINBYTES, DES3_MAXBYTES,
 146                 CKF_ENCRYPT|CKF_DECRYPT|
 147                 CKF_WRAP|CKF_UNWRAP},           /* CKM_DES3_CBC_PAD */
 148         {DES3_MINBYTES, DES3_MAXBYTES,
 149                 CKF_ENCRYPT|CKF_DECRYPT|
 150                 CKF_WRAP|CKF_UNWRAP},           /* CKM_DES3_ECB */
 151         {DES2_MAXBYTES, DES2_MAXBYTES,
 152                 CKF_GENERATE},                  /* CKM_DES2_KEY_GEN */
 153         {DES3_MAXBYTES, DES3_MAXBYTES,          /* CKK_DES3 only */
 154                 CKF_GENERATE},                  /* CKM_DES3_KEY_GEN */
 155         {AES_MINBYTES, AES_MAXBYTES,
 156                 CKF_ENCRYPT|CKF_DECRYPT|
 157                 CKF_WRAP|CKF_UNWRAP},           /* CKM_AES_CBC */
 158         {AES_MINBYTES, AES_MAXBYTES,
 159                 CKF_ENCRYPT|CKF_DECRYPT|
 160                 CKF_WRAP|CKF_UNWRAP},           /* CKM_AES_CBC_PAD */
 161         {AES_MINBYTES, AES_MAXBYTES,
 162                 CKF_ENCRYPT|CKF_DECRYPT|
 163                 CKF_WRAP|CKF_UNWRAP},           /* CKM_AES_CTR */
 164         {AES_MINBYTES, AES_MAXBYTES,
 165                 CKF_SIGN|CKF_VERIFY},           /* CKM_AES_CMAC_GENERAL */
 166         {AES_MINBYTES, AES_MAXBYTES,
 167                 CKF_SIGN|CKF_VERIFY},           /* CKM_AES_CMAC */
 168         {AES_MINBYTES, AES_MAXBYTES,
 169                 CKF_ENCRYPT|CKF_DECRYPT|
 170                 CKF_WRAP|CKF_UNWRAP},           /* CKM_AES_ECB */
 171         {AES_MINBYTES, AES_MAXBYTES,
 172                 CKF_GENERATE},                  /* CKM_AES_KEY_GEN */
 173         {BLOWFISH_MINBYTES, BLOWFISH_MAXBYTES,
 174                 CKF_ENCRYPT|CKF_DECRYPT|
 175                 CKF_WRAP|CKF_UNWRAP},           /* CKM_BLOWFISH_ECB */
 176         {BLOWFISH_MINBYTES, BLOWFISH_MAXBYTES,
 177                 CKF_GENERATE},                  /* CKM_BLOWFISH_KEY_GEN */
 178         {0, 0, CKF_DIGEST},                     /* CKM_SHA_1 */
 179         {1, 64, CKF_SIGN|CKF_VERIFY},           /* CKM_SHA_1_HMAC */
 180         {1, 64, CKF_SIGN|CKF_VERIFY},           /* CKM_SHA_1_HMAC_GENERAL */
 181         {0, 0, CKF_DIGEST},                     /* CKM_SHA256 */
 182         {1, 64, CKF_SIGN|CKF_VERIFY},           /* CKM_SHA256_HMAC */
 183         {1, 64, CKF_SIGN|CKF_VERIFY},           /* CKM_SHA256_HMAC_GENERAL */
 184         {0, 0, CKF_DIGEST},                     /* CKM_SHA384 */
 185         {1, 128, CKF_SIGN|CKF_VERIFY},          /* CKM_SHA384_HMAC */
 186         {1, 128, CKF_SIGN|CKF_VERIFY},          /* CKM_SHA384_HMAC_GENERAL */
 187         {0, 0, CKF_DIGEST},                     /* CKM_SHA512 */
 188         {1, 128, CKF_SIGN|CKF_VERIFY},          /* CKM_SHA512_HMAC */
 189         {1, 128, CKF_SIGN|CKF_VERIFY},          /* CKM_SHA512_HMAC_GENERAL */
 190         {1, 512, CKF_SIGN|CKF_VERIFY},          /* CKM_SSL3_SHA1_MAC */
 191         {0, 0, CKF_DIGEST},                     /* CKM_MD5 */
 192         {1, 64, CKF_SIGN|CKF_VERIFY},           /* CKM_MD5_HMAC */
 193         {1, 64, CKF_SIGN|CKF_VERIFY},           /* CKM_MD5_HMAC_GENERAL */
 194         {1, 512, CKF_SIGN|CKF_VERIFY},          /* CKM_SSL3_MD5_MAC */
 195         {8, ARCFOUR_MAX_KEY_BITS, CKF_ENCRYPT|CKF_DECRYPT}, /* CKM_RC4; */
 196                                                             /* in bits  */
 197         {8, ARCFOUR_MAX_KEY_BITS, CKF_GENERATE }, /* CKM_RC4_KEY_GEN; in bits */
 198         {512, 1024, CKF_SIGN|CKF_VERIFY},       /* CKM_DSA; in bits */
 199         {512, 1024, CKF_SIGN|CKF_VERIFY},       /* CKM_DSA_SHA1; in bits */
 200         {512, 1024, CKF_GENERATE_KEY_PAIR},     /* CKM_DSA_KEY_PAIR_GEN; */
 201                                                 /* in bits */
 202         {256, 4096, CKF_ENCRYPT|CKF_DECRYPT|
 203                 CKF_SIGN|CKF_SIGN_RECOVER|
 204                 CKF_WRAP|CKF_UNWRAP|
 205                 CKF_VERIFY|CKF_VERIFY_RECOVER}, /* CKM_RSA_PKCS; in bits */
 206         {256, 4096, CKF_GENERATE_KEY_PAIR},     /* CKM_RSA_PKCS_KEY_PAIR_GEN; */
 207                                                 /* in bits */
 208         {256, 4096, CKF_ENCRYPT|CKF_DECRYPT|
 209                 CKF_SIGN|CKF_SIGN_RECOVER|
 210                 CKF_WRAP|CKF_UNWRAP|
 211                 CKF_VERIFY|CKF_VERIFY_RECOVER}, /* CKM_RSA_X_509 in bits */
 212         {256, 4096, CKF_SIGN|CKF_VERIFY},       /* CKM_MD5_RSA_PKCS in bits */
 213         {256, 4096, CKF_SIGN|CKF_VERIFY},       /* CKM_SHA1_RSA_PKCS in bits */
 214         {256, 4096, CKF_SIGN|CKF_VERIFY}, /* CKM_SHA256_RSA_PKCS in bits */
 215         {256, 4096, CKF_SIGN|CKF_VERIFY}, /* CKM_SHA384_RSA_PKCS in bits */
 216         {256, 4096, CKF_SIGN|CKF_VERIFY}, /* CKM_SHA512_RSA_PKCS in bits */
 217         {DH_MIN_KEY_LEN, DH_MAX_KEY_LEN, CKF_GENERATE_KEY_PAIR},
 218                                                 /* CKM_DH_PKCS_KEY_PAIR_GEN */
 219                                                 /* in bits */
 220         {DH_MIN_KEY_LEN, DH_MAX_KEY_LEN, CKF_DERIVE},
 221                                                 /* CKM_DH_PKCS_DERIVE; */
 222                                                 /* in bits */
 223         {1, 16, CKF_DERIVE},                    /* CKM_MD5_KEY_DERIVATION */
 224         {1, 20, CKF_DERIVE},                    /* CKM_SHA1_KEY_DERIVATION */
 225         {1, 32, CKF_DERIVE},                    /* CKM_SHA256_KEY_DERIVATION */
 226         {1, 48, CKF_DERIVE},                    /* CKM_SHA384_KEY_DERIVATION */
 227         {1, 64, CKF_DERIVE},                    /* CKM_SHA512_KEY_DERIVATION */
 228         {0, 0, CKF_GENERATE},                   /* CKM_PBE_SHA1_RC4_128 */
 229         {0, 0, CKF_GENERATE},                   /* CKM_PKCS5_PBKD2 */
 230         {48, 48, CKF_GENERATE},         /* CKM_SSL3_PRE_MASTER_KEY_GEN */
 231         {48, 48, CKF_GENERATE},         /* CKM_TLS_PRE_MASTER_KEY_GEN */
 232         {48, 48, CKF_DERIVE},           /* CKM_SSL3_MASTER_KEY_DERIVE */
 233         {48, 48, CKF_DERIVE},           /* CKM_TLS_MASTER_KEY_DERIVE */
 234         {48, 48, CKF_DERIVE},           /* CKM_SSL3_MASTER_KEY_DERIVE_DH */
 235         {48, 48, CKF_DERIVE},           /* CKM_TLS_MASTER_KEY_DERIVE_DH */
 236         {0, 0, CKF_DERIVE},             /* CKM_SSL3_KEY_AND_MAC_DERIVE */
 237         {0, 0, CKF_DERIVE},             /* CKM_TLS_KEY_AND_MAC_DERIVE */
 238         {0, 0, CKF_DERIVE},             /* CKM_TLS_PRF */
 239         {EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CKF_GENERATE_KEY_PAIR},
 240         {EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CKF_SIGN|CKF_VERIFY},
 241         {EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CKF_SIGN|CKF_VERIFY},
 242         {EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CKF_DERIVE}
 243 };
 244
 245 /*
 246  * Slot ID for softtoken is always 1. tokenPresent is ignored.
 247  * Also, only one slot is used.
 248  */
 249 /*ARGSUSED*/
 250 CK_RV
 251 C_GetSlotList(CK_BBOOL tokenPresent, CK_SLOT_ID_PTR pSlotList,
 252     CK_ULONG_PTR pulCount)
 253 {
 254
 255         CK_RV rv;
 256
 257         if (!softtoken_initialized)
 258                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 259
 260         if (pulCount == NULL) {
 261                 return (CKR_ARGUMENTS_BAD);
 262         }
 263
 264         if (pSlotList == NULL) {
 265                 /*
 266                  * Application only wants to know the number of slots.
 267                  */
 268                 *pulCount = 1;
 269                 return (CKR_OK);
 270         }
 271
 272         if ((*pulCount < 1) && (pSlotList != NULL)) {
 273                 rv = CKR_BUFFER_TOO_SMALL;
 274         } else {
 275                 pSlotList[0] = SOFTTOKEN_SLOTID;
 276                 rv = CKR_OK;
 277         }
 278
 279         *pulCount = 1;
 280         return (rv);
 281 }
 282
 283
 284 CK_RV
 285 C_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo)
 286 {
 287
 288         if (!softtoken_initialized)
 289                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 290
 291         if (pInfo == NULL)
 292                 return (CKR_ARGUMENTS_BAD);
 293
 294         /* Make sure the slot ID is valid */
 295         if (slotID != SOFTTOKEN_SLOTID)
 296                 return (CKR_SLOT_ID_INVALID);
 297
 298         /* Provide information about the slot in the provided buffer */
 299         (void) strncpy((char *)pInfo->slotDescription, SOFT_SLOT_DESCRIPTION,
 300             64);
 301         (void) strncpy((char *)pInfo->manufacturerID, SOFT_MANUFACTURER_ID, 32);
 302         pInfo->flags = CKF_TOKEN_PRESENT;
 303         pInfo->hardwareVersion.major = HARDWARE_VERSION_MAJOR;
 304         pInfo->hardwareVersion.minor = HARDWARE_VERSION_MINOR;
 305         pInfo->firmwareVersion.major = FIRMWARE_VERSION_MAJOR;
 306         pInfo->firmwareVersion.minor = FIRMWARE_VERSION_MINOR;
 307
 308         return (CKR_OK);
 309 }
 310
 311 CK_RV
 312 C_GetTokenInfo(CK_SLOT_ID slotID, CK_TOKEN_INFO_PTR pInfo)
 313 {
 314         boolean_t pin_initialized = B_FALSE;
 315         char    *ks_cryptpin = NULL;
 316
 317         if (!softtoken_initialized)
 318                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 319
 320         /* Make sure the slot ID is valid */
 321         if (slotID != SOFTTOKEN_SLOTID)
 322                 return (CKR_SLOT_ID_INVALID);
 323
 324         if (pInfo == NULL)
 325                 return (CKR_ARGUMENTS_BAD);
 326
 327         /*
 328          * It is intentional that we don't forward the error code
 329          * returned from soft_keystore_pin_initialized() to the caller
 330          */
 331         pInfo->flags = SOFT_TOKEN_FLAGS;
 332         if (soft_slot.keystore_load_status == KEYSTORE_UNAVAILABLE) {
 333                 pInfo->flags |= CKF_WRITE_PROTECTED;
 334         } else {
 335                 if ((soft_keystore_pin_initialized(&pin_initialized,
 336                     &ks_cryptpin, B_FALSE) == CKR_OK) && !pin_initialized)
 337                         pInfo->flags |= CKF_USER_PIN_TO_BE_CHANGED;
 338         }
 339
 340         if (ks_cryptpin)
 341                 free(ks_cryptpin);
 342
 343         /* Provide information about a token in the provided buffer */
 344         (void) strncpy((char *)pInfo->label, SOFT_TOKEN_LABEL, 32);
 345         (void) strncpy((char *)pInfo->manufacturerID, SOFT_MANUFACTURER_ID, 32);
 346         (void) strncpy((char *)pInfo->model, TOKEN_MODEL, 16);
 347         (void) strncpy((char *)pInfo->serialNumber, SOFT_TOKEN_SERIAL, 16);
 348
 349         pInfo->ulMaxSessionCount = CK_EFFECTIVELY_INFINITE;
 350         pInfo->ulSessionCount = soft_session_cnt;
 351         pInfo->ulMaxRwSessionCount = CK_EFFECTIVELY_INFINITE;
 352         pInfo->ulRwSessionCount = soft_session_rw_cnt;
 353         pInfo->ulMaxPinLen = MAX_PIN_LEN;
 354         pInfo->ulMinPinLen = MIN_PIN_LEN;
 355         pInfo->ulTotalPublicMemory = CK_UNAVAILABLE_INFORMATION;
 356         pInfo->ulFreePublicMemory = CK_UNAVAILABLE_INFORMATION;
 357         pInfo->ulTotalPrivateMemory = CK_UNAVAILABLE_INFORMATION;
 358         pInfo->ulFreePrivateMemory = CK_UNAVAILABLE_INFORMATION;
 359         pInfo->hardwareVersion.major = HARDWARE_VERSION_MAJOR;
 360         pInfo->hardwareVersion.minor = HARDWARE_VERSION_MINOR;
 361         pInfo->firmwareVersion.major = FIRMWARE_VERSION_MAJOR;
 362         pInfo->firmwareVersion.minor = FIRMWARE_VERSION_MINOR;
 363         (void) memset(pInfo->utcTime, ' ', 16);
 364
 365         return (CKR_OK);
 366 }
 367
 368 /*ARGSUSED*/
 369 CK_RV
 370 C_WaitForSlotEvent(CK_FLAGS flags, CK_SLOT_ID_PTR pSlot, CK_VOID_PTR pReserved)
 371 {
 372         if (!softtoken_initialized)
 373                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 374
 375         /*
 376          * This is currently not implemented, however we could cause this
 377          * to wait for the token files to appear if soft_token_present is
 378          * false.
 379          * However there is currently no polite and portable way to do that
 380          * because we might not even be able to get to an fd to the
 381          * parent directory, so instead we don't support any slot events.
 382          */
 383         return (CKR_FUNCTION_NOT_SUPPORTED);
 384 }
 385
 386
 387 CK_RV
 388 C_GetMechanismList(CK_SLOT_ID slotID, CK_MECHANISM_TYPE_PTR pMechanismList,
 389     CK_ULONG_PTR pulCount)
 390 {
 391
 392         ulong_t i;
 393         ulong_t mechnum;
 394
 395         if (!softtoken_initialized)
 396                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 397
 398         if (slotID != SOFTTOKEN_SLOTID)
 399                 return (CKR_SLOT_ID_INVALID);
 400
 401         mechnum = sizeof (soft_mechanisms) / sizeof (CK_MECHANISM_TYPE);
 402
 403         if (pMechanismList == NULL) {
 404                 /*
 405                  * Application only wants to know the number of
 406                  * supported mechanism types.
 407                  */
 408                 *pulCount = mechnum;
 409                 return (CKR_OK);
 410         }
 411
 412         if (*pulCount < mechnum) {
 413                 *pulCount = mechnum;
 414                 return (CKR_BUFFER_TOO_SMALL);
 415         }
 416
 417         for (i = 0; i < mechnum; i++) {
 418                 pMechanismList[i] = soft_mechanisms[i];
 419         }
 420
 421         *pulCount = mechnum;
 422
 423         return (CKR_OK);
 424 }
 425
 426
 427 CK_RV
 428 C_GetMechanismInfo(CK_SLOT_ID slotID, CK_MECHANISM_TYPE type,
 429     CK_MECHANISM_INFO_PTR pInfo)
 430 {
 431
 432         ulong_t i;
 433         ulong_t mechnum;
 434
 435         if (!softtoken_initialized)
 436                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 437
 438         if (slotID != SOFTTOKEN_SLOTID)
 439                 return (CKR_SLOT_ID_INVALID);
 440
 441         if (pInfo == NULL) {
 442                 return (CKR_ARGUMENTS_BAD);
 443         }
 444
 445         mechnum = sizeof (soft_mechanisms) / sizeof (CK_MECHANISM_TYPE);
 446         for (i = 0; i < mechnum; i++) {
 447                 if (soft_mechanisms[i] == type)
 448                         break;
 449         }
 450
 451         if (i == mechnum)
 452                 /* unsupported mechanism */
 453                 return (CKR_MECHANISM_INVALID);
 454
 455         pInfo->ulMinKeySize = soft_mechanism_info[i].ulMinKeySize;
 456         pInfo->ulMaxKeySize = soft_mechanism_info[i].ulMaxKeySize;
 457         pInfo->flags = soft_mechanism_info[i].flags;
 458
 459         return (CKR_OK);
 460 }
 461
 462
 463 /*ARGSUSED*/
 464 CK_RV
 465 C_InitToken(CK_SLOT_ID slotID, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen,
 466     CK_UTF8CHAR_PTR pLabel)
 467 {
 468         if (!softtoken_initialized)
 469                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 470
 471         if (create_keystore() != 0)
 472                 return (CKR_FUNCTION_FAILED);
 473
 474         return (CKR_OK);
 475 }
 476
 477 /*ARGSUSED*/
 478 CK_RV
 479 C_InitPIN(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen)
 480 {
 481         if (!softtoken_initialized)
 482                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 483
 484         return (CKR_FUNCTION_NOT_SUPPORTED);
 485 }
 486
 487
 488 CK_RV
 489 C_SetPIN(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pOldPin,
 490     CK_ULONG ulOldPinLen, CK_UTF8CHAR_PTR pNewPin, CK_ULONG ulNewPinLen)
 491 {
 492
 493         soft_session_t *session_p;
 494         CK_RV rv;
 495         boolean_t lock_held = B_FALSE;
 496
 497         if (!softtoken_initialized)
 498                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 499
 500         /*
 501          * Obtain the session pointer. Also, increment the session
 502          * reference count.
 503          */
 504         rv = handle2session(hSession, &session_p);
 505         if (rv != CKR_OK)
 506                 return (rv);
 507
 508         if (!soft_keystore_status(KEYSTORE_LOAD)) {
 509                 SES_REFRELE(session_p, lock_held);
 510                 return (CKR_DEVICE_REMOVED);
 511         }
 512
 513         if ((ulOldPinLen < MIN_PIN_LEN) || (ulOldPinLen > MAX_PIN_LEN) ||
 514             (ulNewPinLen < MIN_PIN_LEN) ||(ulNewPinLen > MAX_PIN_LEN)) {
 515                 SES_REFRELE(session_p, lock_held);
 516                 return (CKR_PIN_LEN_RANGE);
 517         }
 518
 519         if ((pOldPin == NULL_PTR) || (pNewPin == NULL_PTR)) {
 520                 /*
 521                  * We don't support CKF_PROTECTED_AUTHENTICATION_PATH
 522                  */
 523                 SES_REFRELE(session_p, lock_held);
 524                 return (CKR_ARGUMENTS_BAD);
 525         }
 526
 527         /* check the state of the session */
 528         if ((session_p->state != CKS_RW_PUBLIC_SESSION) &&
 529             (session_p->state != CKS_RW_USER_FUNCTIONS)) {
 530                 SES_REFRELE(session_p, lock_held);
 531                 return (CKR_SESSION_READ_ONLY);
 532         }
 533
 534         rv = soft_setpin(pOldPin, ulOldPinLen, pNewPin, ulNewPinLen);
 535
 536         SES_REFRELE(session_p, lock_held);
 537         return (rv);
 538 }