src/pkcs11.c

   1 /*
   2  * Copyright (C) 2010-2012 Free Software Foundation, Inc.
   3  * Author: Nikos Mavrogiannopoulos
   4  *
   5  * This file is part of GnuTLS.
   6  *
   7  * GnuTLS is free software: you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation, either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * GnuTLS is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19  */
  20 #include <config.h>
  21
  22 #include <getpass.h>
  23
  24 #include <gnutls/gnutls.h>
  25 #include <gnutls/pkcs11.h>
  26 #include <gnutls/abstract.h>
  27 #include <stdio.h>
  28 #include <stdlib.h>
  29 #include "p11tool.h"
  30 #include "certtool-cfg.h"
  31 #include "certtool-common.h"
  32 #include <unistd.h>
  33 #include <string.h>
  34 #include <common.h>
  35
  36 void
  37 pkcs11_delete (FILE * outfile, const char *url, int batch, unsigned int login,
  38                common_info_st * info)
  39 {
  40   int ret;
  41   unsigned int obj_flags = 0;
  42
  43   if (login)
  44     obj_flags = GNUTLS_PKCS11_OBJ_FLAG_LOGIN;
  45
  46   if (!batch)
  47     {
  48       pkcs11_list (outfile, url, PKCS11_TYPE_ALL, login,
  49                    GNUTLS_PKCS11_URL_LIB, info);
  50       ret =
  51         read_yesno ("Are you sure you want to delete those objects? (y/N): ");
  52       if (ret == 0)
  53         {
  54           exit (1);
  55         }
  56     }
  57
  58   ret = gnutls_pkcs11_delete_url (url, obj_flags);
  59   if (ret < 0)
  60     {
  61       fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
  62                gnutls_strerror (ret));
  63       exit (1);
  64     }
  65
  66   fprintf (outfile, "\n%d objects deleted\n", ret);
  67
  68   return;
  69 }
  70
  71 /* lists certificates from a token
  72  */
  73 void
  74 pkcs11_list (FILE * outfile, const char *url, int type, unsigned int login,
  75              unsigned int detailed, common_info_st * info)
  76 {
  77   gnutls_pkcs11_obj_t *crt_list;
  78   gnutls_x509_crt_t xcrt;
  79   unsigned int crt_list_size = 0, i;
  80   int ret;
  81   char *output;
  82   int attrs;
  83   unsigned int obj_flags = 0;
  84
  85   if (login)
  86     obj_flags = GNUTLS_PKCS11_OBJ_FLAG_LOGIN;
  87
  88   pkcs11_common ();
  89
  90   if (url == NULL)
  91     url = "pkcs11:";
  92
  93   if (type == PKCS11_TYPE_TRUSTED)
  94     {
  95       attrs = GNUTLS_PKCS11_OBJ_ATTR_CRT_TRUSTED;
  96     }
  97   else if (type == PKCS11_TYPE_PK)
  98     {
  99       attrs = GNUTLS_PKCS11_OBJ_ATTR_CRT_WITH_PRIVKEY;
 100     }
 101   else if (type == PKCS11_TYPE_CRT_ALL)
 102     {
 103       attrs = GNUTLS_PKCS11_OBJ_ATTR_CRT_ALL;
 104     }
 105   else if (type == PKCS11_TYPE_PRIVKEY)
 106     {
 107       attrs = GNUTLS_PKCS11_OBJ_ATTR_PRIVKEY;
 108     }
 109   else
 110     {
 111       attrs = GNUTLS_PKCS11_OBJ_ATTR_ALL;
 112     }
 113
 114   /* give some initial value to avoid asking for the pkcs11 pin twice.
 115    */
 116   crt_list_size = 128;
 117   crt_list = malloc (sizeof (*crt_list) * crt_list_size);
 118   if (crt_list == NULL)
 119     {
 120       fprintf (stderr, "Memory error\n");
 121       exit (1);
 122     }
 123
 124   ret = gnutls_pkcs11_obj_list_import_url (crt_list, &crt_list_size, url,
 125                                            attrs, obj_flags);
 126   if (ret < 0 && ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
 127     {
 128       fprintf (stderr, "Error in crt_list_import (1): %s\n",
 129                gnutls_strerror (ret));
 130       exit (1);
 131     }
 132
 133   if (crt_list_size == 0)
 134     {
 135       fprintf (stderr, "No matching objects found\n");
 136       exit (0);
 137     }
 138
 139   if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER)
 140     {
 141       crt_list = realloc (crt_list, sizeof (*crt_list) * crt_list_size);
 142       if (crt_list == NULL)
 143         {
 144           fprintf (stderr, "Memory error\n");
 145           exit (1);
 146         }
 147
 148       ret =
 149         gnutls_pkcs11_obj_list_import_url (crt_list, &crt_list_size, url,
 150                                            attrs, obj_flags);
 151       if (ret < 0)
 152         {
 153           fprintf (stderr, "Error in crt_list_import: %s\n",
 154                    gnutls_strerror (ret));
 155           exit (1);
 156         }
 157     }
 158
 159   for (i = 0; i < crt_list_size; i++)
 160     {
 161       char buf[128];
 162       size_t size;
 163
 164       ret = gnutls_pkcs11_obj_export_url (crt_list[i], detailed, &output);
 165       if (ret < 0)
 166         {
 167           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 168                    gnutls_strerror (ret));
 169           exit (1);
 170         }
 171
 172       fprintf (outfile, "Object %d:\n\tURL: %s\n", i, output);
 173
 174       fprintf (outfile, "\tType: %s\n",
 175                gnutls_pkcs11_type_get_name (gnutls_pkcs11_obj_get_type
 176                                             (crt_list[i])));
 177
 178       size = sizeof (buf);
 179       ret =
 180         gnutls_pkcs11_obj_get_info (crt_list[i], GNUTLS_PKCS11_OBJ_LABEL, buf,
 181                                     &size);
 182       if (ret < 0)
 183         {
 184           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 185                    gnutls_strerror (ret));
 186           exit (1);
 187         }
 188       fprintf (outfile, "\tLabel: %s\n", buf);
 189
 190       size = sizeof (buf);
 191       ret =
 192         gnutls_pkcs11_obj_get_info (crt_list[i], GNUTLS_PKCS11_OBJ_ID_HEX,
 193                                     buf, &size);
 194       if (ret < 0)
 195         {
 196           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 197                    gnutls_strerror (ret));
 198           exit (1);
 199         }
 200       fprintf (outfile, "\tID: %s\n\n", buf);
 201
 202
 203
 204       if (attrs == GNUTLS_PKCS11_OBJ_ATTR_ALL
 205           || attrs == GNUTLS_PKCS11_OBJ_ATTR_PRIVKEY)
 206         continue;
 207
 208       ret = gnutls_x509_crt_init (&xcrt);
 209       if (ret < 0)
 210         {
 211           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 212                    gnutls_strerror (ret));
 213           exit (1);
 214         }
 215
 216       ret = gnutls_x509_crt_import_pkcs11 (xcrt, crt_list[i]);
 217       if (ret < 0)
 218         {
 219           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 220                    gnutls_strerror (ret));
 221           exit (1);
 222         }
 223
 224 #if 0
 225       size = buffer_size;
 226       ret = gnutls_x509_crt_export (xcrt, GNUTLS_X509_FMT_PEM, buffer, &size);
 227       if (ret < 0)
 228         {
 229           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 230                    gnutls_strerror (ret));
 231           exit (1);
 232         }
 233
 234       fwrite (buffer, 1, size, outfile);
 235       fputs ("\n\n", outfile);
 236 #endif
 237
 238       gnutls_x509_crt_deinit (xcrt);
 239
 240
 241     }
 242
 243   return;
 244 }
 245
 246 void
 247 pkcs11_export (FILE * outfile, const char *url, unsigned int login,
 248                common_info_st * info)
 249 {
 250   gnutls_pkcs11_obj_t crt;
 251   gnutls_x509_crt_t xcrt;
 252   gnutls_pubkey_t pubkey;
 253   int ret;
 254   size_t size;
 255   unsigned int obj_flags = 0;
 256
 257   if (login)
 258     obj_flags = GNUTLS_PKCS11_OBJ_FLAG_LOGIN;
 259
 260   pkcs11_common ();
 261
 262   if (url == NULL)
 263     url = "pkcs11:";
 264
 265   ret = gnutls_pkcs11_obj_init (&crt);
 266   if (ret < 0)
 267     {
 268       fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 269                gnutls_strerror (ret));
 270       exit (1);
 271     }
 272
 273   ret = gnutls_pkcs11_obj_import_url (crt, url, obj_flags);
 274   if (ret < 0)
 275     {
 276       fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 277                gnutls_strerror (ret));
 278       exit (1);
 279     }
 280
 281   switch (gnutls_pkcs11_obj_get_type (crt))
 282     {
 283     case GNUTLS_PKCS11_OBJ_X509_CRT:
 284       ret = gnutls_x509_crt_init (&xcrt);
 285       if (ret < 0)
 286         {
 287           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 288                    gnutls_strerror (ret));
 289           exit (1);
 290         }
 291
 292       ret = gnutls_x509_crt_import_pkcs11 (xcrt, crt);
 293       if (ret < 0)
 294         {
 295           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 296                    gnutls_strerror (ret));
 297           exit (1);
 298         }
 299
 300       size = buffer_size;
 301       ret = gnutls_x509_crt_export (xcrt, GNUTLS_X509_FMT_PEM, buffer, &size);
 302       if (ret < 0)
 303         {
 304           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 305                    gnutls_strerror (ret));
 306           exit (1);
 307         }
 308       fwrite (buffer, 1, size, outfile);
 309
 310       gnutls_x509_crt_deinit (xcrt);
 311       break;
 312     case GNUTLS_PKCS11_OBJ_PUBKEY:
 313       ret = gnutls_pubkey_init (&pubkey);
 314       if (ret < 0)
 315         {
 316           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 317                    gnutls_strerror (ret));
 318           exit (1);
 319         }
 320
 321       ret = gnutls_pubkey_import_pkcs11 (pubkey, crt, 0);
 322       if (ret < 0)
 323         {
 324           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 325                    gnutls_strerror (ret));
 326           exit (1);
 327         }
 328
 329       size = buffer_size;
 330       ret = gnutls_pubkey_export (pubkey, GNUTLS_X509_FMT_PEM, buffer, &size);
 331       if (ret < 0)
 332         {
 333           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 334                    gnutls_strerror (ret));
 335           exit (1);
 336         }
 337       fwrite (buffer, 1, size, outfile);
 338
 339       gnutls_pubkey_deinit (pubkey);
 340       break;
 341     default:
 342       {
 343         gnutls_datum_t data, enc;
 344
 345         size = buffer_size;
 346         ret = gnutls_pkcs11_obj_export (crt, buffer, &size);
 347         if (ret < 0)
 348           {
 349             break;
 350           }
 351
 352         data.data = buffer;
 353         data.size = size;
 354
 355         ret = gnutls_pem_base64_encode_alloc ("DATA", &data, &enc);
 356         if (ret < 0)
 357           {
 358             fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 359                      gnutls_strerror (ret));
 360             exit (1);
 361           }
 362
 363         fwrite (enc.data, 1, enc.size, outfile);
 364
 365         gnutls_free (enc.data);
 366         break;
 367       }
 368     }
 369   fputs ("\n\n", outfile);
 370
 371
 372   gnutls_pkcs11_obj_deinit (crt);
 373
 374   return;
 375
 376 }
 377
 378 void
 379 pkcs11_token_list (FILE * outfile, unsigned int detailed,
 380                    common_info_st * info)
 381 {
 382   int ret;
 383   int i;
 384   char *url;
 385   char buf[128];
 386   size_t size;
 387
 388   pkcs11_common ();
 389
 390   for (i = 0;; i++)
 391     {
 392       ret = gnutls_pkcs11_token_get_url (i, detailed, &url);
 393       if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
 394         break;
 395
 396       if (ret < 0)
 397         {
 398           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 399                    gnutls_strerror (ret));
 400           exit (1);
 401         }
 402
 403       fprintf (outfile, "Token %d:\n\tURL: %s\n", i, url);
 404
 405       size = sizeof (buf);
 406       ret =
 407         gnutls_pkcs11_token_get_info (url, GNUTLS_PKCS11_TOKEN_LABEL, buf,
 408                                       &size);
 409       if (ret < 0)
 410         {
 411           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 412                    gnutls_strerror (ret));
 413           exit (1);
 414         }
 415
 416       fprintf (outfile, "\tLabel: %s\n", buf);
 417
 418       size = sizeof (buf);
 419       ret =
 420         gnutls_pkcs11_token_get_info (url, GNUTLS_PKCS11_TOKEN_MANUFACTURER,
 421                                       buf, &size);
 422       if (ret < 0)
 423         {
 424           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 425                    gnutls_strerror (ret));
 426           exit (1);
 427         }
 428
 429       fprintf (outfile, "\tManufacturer: %s\n", buf);
 430
 431       size = sizeof (buf);
 432       ret =
 433         gnutls_pkcs11_token_get_info (url, GNUTLS_PKCS11_TOKEN_MODEL, buf,
 434                                       &size);
 435       if (ret < 0)
 436         {
 437           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 438                    gnutls_strerror (ret));
 439           exit (1);
 440         }
 441
 442       fprintf (outfile, "\tModel: %s\n", buf);
 443
 444       size = sizeof (buf);
 445       ret =
 446         gnutls_pkcs11_token_get_info (url, GNUTLS_PKCS11_TOKEN_SERIAL, buf,
 447                                       &size);
 448       if (ret < 0)
 449         {
 450           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 451                    gnutls_strerror (ret));
 452           exit (1);
 453         }
 454
 455       fprintf (outfile, "\tSerial: %s\n", buf);
 456       fprintf (outfile, "\n\n");
 457
 458       gnutls_free (url);
 459
 460     }
 461
 462   return;
 463 }
 464
 465 void
 466 pkcs11_write (FILE * outfile, const char *url, const char *label,
 467               int trusted, int private,
 468               unsigned int login, common_info_st * info)
 469 {
 470   gnutls_x509_crt_t xcrt;
 471   gnutls_x509_privkey_t xkey;
 472   int ret;
 473   unsigned int flags = 0;
 474   unsigned int key_usage = 0;
 475   gnutls_datum_t *secret_key;
 476
 477   if (login)
 478     flags = GNUTLS_PKCS11_OBJ_FLAG_LOGIN;
 479
 480   pkcs11_common ();
 481
 482   if (url == NULL)
 483     url = "pkcs11:";
 484
 485   secret_key = load_secret_key (0, info);
 486   if (secret_key != NULL)
 487     {
 488       ret =
 489         gnutls_pkcs11_copy_secret_key (url, secret_key, label, key_usage,
 490                                        flags |
 491                                        GNUTLS_PKCS11_OBJ_FLAG_MARK_SENSITIVE);
 492       if (ret < 0)
 493         {
 494           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 495                    gnutls_strerror (ret));
 496           exit (1);
 497         }
 498     }
 499
 500   if (private == 1)
 501     flags |= GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE;
 502   else if (private == 0)
 503     flags |= GNUTLS_PKCS11_OBJ_FLAG_MARK_NOT_PRIVATE;
 504
 505   xcrt = load_cert (0, info);
 506   if (xcrt != NULL)
 507     {
 508       if (trusted)
 509         flags |= GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED|GNUTLS_PKCS11_OBJ_FLAG_LOGIN_SO;
 510
 511       ret = gnutls_pkcs11_copy_x509_crt (url, xcrt, label, flags);
 512       if (ret < 0)
 513         {
 514           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 515                    gnutls_strerror (ret));
 516           exit (1);
 517         }
 518
 519       gnutls_x509_crt_get_key_usage (xcrt, &key_usage, NULL);
 520     }
 521
 522   xkey = load_x509_private_key (0, info);
 523   if (xkey != NULL)
 524     {
 525       ret =
 526         gnutls_pkcs11_copy_x509_privkey (url, xkey, label, key_usage,
 527                                          flags |
 528                                          GNUTLS_PKCS11_OBJ_FLAG_MARK_SENSITIVE);
 529       if (ret < 0)
 530         {
 531           fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 532                    gnutls_strerror (ret));
 533           exit (1);
 534         }
 535     }
 536
 537   if (xkey == NULL && xcrt == NULL && secret_key == NULL)
 538     {
 539       fprintf (stderr,
 540                "You must use --load-privkey, --load-certificate or --secret-key to load the file to be copied\n");
 541       exit (1);
 542     }
 543
 544   return;
 545 }
 546
 547 void
 548 pkcs11_generate (FILE * outfile, const char *url, gnutls_pk_algorithm_t pk,
 549               unsigned int bits,
 550               const char *label, int private, int detailed,
 551               unsigned int login, common_info_st * info)
 552 {
 553   int ret;
 554   unsigned int flags = 0;
 555
 556   if (login)
 557     flags = GNUTLS_PKCS11_OBJ_FLAG_LOGIN;
 558
 559   pkcs11_common ();
 560
 561   if (url == NULL)
 562     url = "pkcs11:";
 563
 564   if (private == 1)
 565     flags |= GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE;
 566   else if (private == 0)
 567     flags |= GNUTLS_PKCS11_OBJ_FLAG_MARK_NOT_PRIVATE;
 568
 569   ret = gnutls_pkcs11_privkey_generate(url, pk, bits, label, flags);
 570   if (ret < 0)
 571     {
 572       fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 573                gnutls_strerror (ret));
 574       exit(1);
 575     }
 576
 577   return;
 578 }
 579
 580 void
 581 pkcs11_init (FILE * outfile, const char *url, const char *label,
 582              common_info_st * info)
 583 {
 584   int ret;
 585   char *pin;
 586   char so_pin[32];
 587
 588   pkcs11_common ();
 589
 590   if (url == NULL)
 591     {
 592       fprintf (stderr, "No token URL given to initialize!\n");
 593       exit (1);
 594     }
 595
 596   pin = getpass ("Enter Security Officer's PIN: ");
 597   if (pin == NULL)
 598     exit (1);
 599
 600   if (strlen(pin) >= sizeof(so_pin))
 601     exit (1);
 602
 603   strcpy (so_pin, pin);
 604
 605   pin = getpass ("Enter new User's PIN: ");
 606   if (pin == NULL)
 607     exit (1);
 608
 609   ret = gnutls_pkcs11_token_init (url, so_pin, label);
 610   if (ret < 0)
 611     {
 612       fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 613                gnutls_strerror (ret));
 614       exit (1);
 615     }
 616
 617   ret = gnutls_pkcs11_token_set_pin (url, NULL, pin, GNUTLS_PIN_USER);
 618   if (ret < 0)
 619     {
 620       fprintf (stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
 621                gnutls_strerror (ret));
 622       exit (1);
 623     }
 624
 625   return;
 626 }
 627
 628 const char *mech_list[] = {
 629   [0] = "CKM_RSA_PKCS_KEY_PAIR_GEN",
 630   [1] = "CKM_RSA_PKCS",
 631   [2] = "CKM_RSA_9796",
 632   [3] = "CKM_RSA_X_509",
 633   [4] = "CKM_MD2_RSA_PKCS",
 634   [5] = "CKM_MD5_RSA_PKCS",
 635   [6] = "CKM_SHA1_RSA_PKCS",
 636   [7] = "CKM_RIPEMD128_RSA_PKCS",
 637   [8] = "CKM_RIPEMD160_RSA_PKCS",
 638   [9] = "CKM_RSA_PKCS_OAEP",
 639   [0xa] = "CKM_RSA_X9_31_KEY_PAIR_GEN",
 640   [0xb] = "CKM_RSA_X9_31",
 641   [0xc] = "CKM_SHA1_RSA_X9_31",
 642   [0xd] = "CKM_RSA_PKCS_PSS",
 643   [0xe] = "CKM_SHA1_RSA_PKCS_PSS",
 644   [0x10] = "CKM_DSA_KEY_PAIR_GEN",
 645   [0x11] = "CKM_DSA",
 646   [0x12] = "CKM_DSA_SHA1",
 647   [0x20] = "CKM_DH_PKCS_KEY_PAIR_GEN",
 648   [0x21] = "CKM_DH_PKCS_DERIVE",
 649   [0x30] = "CKM_X9_42_DH_KEY_PAIR_GEN",
 650   [0x31] = "CKM_X9_42_DH_DERIVE",
 651   [0x32] = "CKM_X9_42_DH_HYBRID_DERIVE",
 652   [0x33] = "CKM_X9_42_MQV_DERIVE",
 653   [0x40] = "CKM_SHA256_RSA_PKCS",
 654   [0x41] = "CKM_SHA384_RSA_PKCS",
 655   [0x42] = "CKM_SHA512_RSA_PKCS",
 656   [0x43] = "CKM_SHA256_RSA_PKCS_PSS",
 657   [0x44] = "CKM_SHA384_RSA_PKCS_PSS",
 658   [0x45] = "CKM_SHA512_RSA_PKCS_PSS",
 659   [0x100] = "CKM_RC2_KEY_GEN",
 660   [0x101] = "CKM_RC2_ECB",
 661   [0x102] = "CKM_RC2_CBC",
 662   [0x103] = "CKM_RC2_MAC",
 663   [0x104] = "CKM_RC2_MAC_GENERAL",
 664   [0x105] = "CKM_RC2_CBC_PAD",
 665   [0x110] = "CKM_RC4_KEY_GEN",
 666   [0x111] = "CKM_RC4",
 667   [0x120] = "CKM_DES_KEY_GEN",
 668   [0x121] = "CKM_DES_ECB",
 669   [0x122] = "CKM_DES_CBC",
 670   [0x123] = "CKM_DES_MAC",
 671   [0x124] = "CKM_DES_MAC_GENERAL",
 672   [0x125] = "CKM_DES_CBC_PAD",
 673   [0x130] = "CKM_DES2_KEY_GEN",
 674   [0x131] = "CKM_DES3_KEY_GEN",
 675   [0x132] = "CKM_DES3_ECB",
 676   [0x133] = "CKM_DES3_CBC",
 677   [0x134] = "CKM_DES3_MAC",
 678   [0x135] = "CKM_DES3_MAC_GENERAL",
 679   [0x136] = "CKM_DES3_CBC_PAD",
 680   [0x140] = "CKM_CDMF_KEY_GEN",
 681   [0x141] = "CKM_CDMF_ECB",
 682   [0x142] = "CKM_CDMF_CBC",
 683   [0x143] = "CKM_CDMF_MAC",
 684   [0x144] = "CKM_CDMF_MAC_GENERAL",
 685   [0x145] = "CKM_CDMF_CBC_PAD",
 686   [0x200] = "CKM_MD2",
 687   [0x201] = "CKM_MD2_HMAC",
 688   [0x202] = "CKM_MD2_HMAC_GENERAL",
 689   [0x210] = "CKM_MD5",
 690   [0x211] = "CKM_MD5_HMAC",
 691   [0x212] = "CKM_MD5_HMAC_GENERAL",
 692   [0x220] = "CKM_SHA_1",
 693   [0x221] = "CKM_SHA_1_HMAC",
 694   [0x222] = "CKM_SHA_1_HMAC_GENERAL",
 695   [0x230] = "CKM_RIPEMD128",
 696   [0x231] = "CKM_RIPEMD128_HMAC",
 697   [0x232] = "CKM_RIPEMD128_HMAC_GENERAL",
 698   [0x240] = "CKM_RIPEMD160",
 699   [0x241] = "CKM_RIPEMD160_HMAC",
 700   [0x242] = "CKM_RIPEMD160_HMAC_GENERAL",
 701   [0x250] = "CKM_SHA256",
 702   [0x251] = "CKM_SHA256_HMAC",
 703   [0x252] = "CKM_SHA256_HMAC_GENERAL",
 704   [0x260] = "CKM_SHA384",
 705   [0x261] = "CKM_SHA384_HMAC",
 706   [0x262] = "CKM_SHA384_HMAC_GENERAL",
 707   [0x270] = "CKM_SHA512",
 708   [0x271] = "CKM_SHA512_HMAC",
 709   [0x272] = "CKM_SHA512_HMAC_GENERAL",
 710   [0x300] = "CKM_CAST_KEY_GEN",
 711   [0x301] = "CKM_CAST_ECB",
 712   [0x302] = "CKM_CAST_CBC",
 713   [0x303] = "CKM_CAST_MAC",
 714   [0x304] = "CKM_CAST_MAC_GENERAL",
 715   [0x305] = "CKM_CAST_CBC_PAD",
 716   [0x310] = "CKM_CAST3_KEY_GEN",
 717   [0x311] = "CKM_CAST3_ECB",
 718   [0x312] = "CKM_CAST3_CBC",
 719   [0x313] = "CKM_CAST3_MAC",
 720   [0x314] = "CKM_CAST3_MAC_GENERAL",
 721   [0x315] = "CKM_CAST3_CBC_PAD",
 722   [0x320] = "CKM_CAST128_KEY_GEN",
 723   [0x321] = "CKM_CAST128_ECB",
 724   [0x322] = "CKM_CAST128_CBC",
 725   [0x323] = "CKM_CAST128_MAC",
 726   [0x324] = "CKM_CAST128_MAC_GENERAL",
 727   [0x325] = "CKM_CAST128_CBC_PAD",
 728   [0x330] = "CKM_RC5_KEY_GEN",
 729   [0x331] = "CKM_RC5_ECB",
 730   [0x332] = "CKM_RC5_CBC",
 731   [0x333] = "CKM_RC5_MAC",
 732   [0x334] = "CKM_RC5_MAC_GENERAL",
 733   [0x335] = "CKM_RC5_CBC_PAD",
 734   [0x340] = "CKM_IDEA_KEY_GEN",
 735   [0x341] = "CKM_IDEA_ECB",
 736   [0x342] = "CKM_IDEA_CBC",
 737   [0x343] = "CKM_IDEA_MAC",
 738   [0x344] = "CKM_IDEA_MAC_GENERAL",
 739   [0x345] = "CKM_IDEA_CBC_PAD",
 740   [0x350] = "CKM_GENERIC_SECRET_KEY_GEN",
 741   [0x360] = "CKM_CONCATENATE_BASE_AND_KEY",
 742   [0x362] = "CKM_CONCATENATE_BASE_AND_DATA",
 743   [0x363] = "CKM_CONCATENATE_DATA_AND_BASE",
 744   [0x364] = "CKM_XOR_BASE_AND_DATA",
 745   [0x365] = "CKM_EXTRACT_KEY_FROM_KEY",
 746   [0x370] = "CKM_SSL3_PRE_MASTER_KEY_GEN",
 747   [0x371] = "CKM_SSL3_MASTER_KEY_DERIVE",
 748   [0x372] = "CKM_SSL3_KEY_AND_MAC_DERIVE",
 749   [0x373] = "CKM_SSL3_MASTER_KEY_DERIVE_DH",
 750   [0x374] = "CKM_TLS_PRE_MASTER_KEY_GEN",
 751   [0x375] = "CKM_TLS_MASTER_KEY_DERIVE",
 752   [0x376] = "CKM_TLS_KEY_AND_MAC_DERIVE",
 753   [0x377] = "CKM_TLS_MASTER_KEY_DERIVE_DH",
 754   [0x380] = "CKM_SSL3_MD5_MAC",
 755   [0x381] = "CKM_SSL3_SHA1_MAC",
 756   [0x390] = "CKM_MD5_KEY_DERIVATION",
 757   [0x391] = "CKM_MD2_KEY_DERIVATION",
 758   [0x392] = "CKM_SHA1_KEY_DERIVATION",
 759   [0x3a0] = "CKM_PBE_MD2_DES_CBC",
 760   [0x3a1] = "CKM_PBE_MD5_DES_CBC",
 761   [0x3a2] = "CKM_PBE_MD5_CAST_CBC",
 762   [0x3a3] = "CKM_PBE_MD5_CAST3_CBC",
 763   [0x3a4] = "CKM_PBE_MD5_CAST128_CBC",
 764   [0x3a5] = "CKM_PBE_SHA1_CAST128_CBC",
 765   [0x3a6] = "CKM_PBE_SHA1_RC4_128",
 766   [0x3a7] = "CKM_PBE_SHA1_RC4_40",
 767   [0x3a8] = "CKM_PBE_SHA1_DES3_EDE_CBC",
 768   [0x3a9] = "CKM_PBE_SHA1_DES2_EDE_CBC",
 769   [0x3aa] = "CKM_PBE_SHA1_RC2_128_CBC",
 770   [0x3ab] = "CKM_PBE_SHA1_RC2_40_CBC",
 771   [0x3b0] = "CKM_PKCS5_PBKD2",
 772   [0x3c0] = "CKM_PBA_SHA1_WITH_SHA1_HMAC",
 773   [0x400] = "CKM_KEY_WRAP_LYNKS",
 774   [0x401] = "CKM_KEY_WRAP_SET_OAEP",
 775   [0x1000] = "CKM_SKIPJACK_KEY_GEN",
 776   [0x1001] = "CKM_SKIPJACK_ECB64",
 777   [0x1002] = "CKM_SKIPJACK_CBC64",
 778   [0x1003] = "CKM_SKIPJACK_OFB64",
 779   [0x1004] = "CKM_SKIPJACK_CFB64",
 780   [0x1005] = "CKM_SKIPJACK_CFB32",
 781   [0x1006] = "CKM_SKIPJACK_CFB16",
 782   [0x1007] = "CKM_SKIPJACK_CFB8",
 783   [0x1008] = "CKM_SKIPJACK_WRAP",
 784   [0x1009] = "CKM_SKIPJACK_PRIVATE_WRAP",
 785   [0x100a] = "CKM_SKIPJACK_RELAYX",
 786   [0x1010] = "CKM_KEA_KEY_PAIR_GEN",
 787   [0x1011] = "CKM_KEA_KEY_DERIVE",
 788   [0x1020] = "CKM_FORTEZZA_TIMESTAMP",
 789   [0x1030] = "CKM_BATON_KEY_GEN",
 790   [0x1031] = "CKM_BATON_ECB128",
 791   [0x1032] = "CKM_BATON_ECB96",
 792   [0x1033] = "CKM_BATON_CBC128",
 793   [0x1034] = "CKM_BATON_COUNTER",
 794   [0x1035] = "CKM_BATON_SHUFFLE",
 795   [0x1036] = "CKM_BATON_WRAP",
 796   [0x1040] = "CKM_ECDSA_KEY_PAIR_GEN",
 797   [0x1041] = "CKM_ECDSA",
 798   [0x1042] = "CKM_ECDSA_SHA1",
 799   [0x1050] = "CKM_ECDH1_DERIVE",
 800   [0x1051] = "CKM_ECDH1_COFACTOR_DERIVE",
 801   [0x1052] = "CKM_ECMQV_DERIVE",
 802   [0x1060] = "CKM_JUNIPER_KEY_GEN",
 803   [0x1061] = "CKM_JUNIPER_ECB128",
 804   [0x1062] = "CKM_JUNIPER_CBC128",
 805   [0x1063] = "CKM_JUNIPER_COUNTER",
 806   [0x1064] = "CKM_JUNIPER_SHUFFLE",
 807   [0x1065] = "CKM_JUNIPER_WRAP",
 808   [0x1070] = "CKM_FASTHASH",
 809   [0x1080] = "CKM_AES_KEY_GEN",
 810   [0x1081] = "CKM_AES_ECB",
 811   [0x1082] = "CKM_AES_CBC",
 812   [0x1083] = "CKM_AES_MAC",
 813   [0x1084] = "CKM_AES_MAC_GENERAL",
 814   [0x1085] = "CKM_AES_CBC_PAD",
 815   [0x2000] = "CKM_DSA_PARAMETER_GEN",
 816   [0x2001] = "CKM_DH_PKCS_PARAMETER_GEN",
 817   [0x2002] = "CKM_X9_42_DH_PARAMETER_GEN",
 818   [0x1200] = "CKM_GOSTR3410_KEY_PAIR_GEN",
 819   [0x1201] = "CKM_GOSTR3410",
 820   [0x1202] = "CKM_GOSTR3410_WITH_GOSTR3411",
 821   [0x1203] = "CKM_GOSTR3410_KEY_WRAP",
 822   [0x1204] = "CKM_GOSTR3410_DERIVE",
 823   [0x1210] = "CKM_GOSTR3411",
 824   [0x1211] = "CKM_GOSTR3411_HMAC",
 825   [0x255] = "CKM_SHA224",
 826   [0x256] = "CKM_SHA224_HMAC",
 827   [0x257] = "CKM_SHA224_HMAC_GENERAL",
 828   [0x46] = "CKM_SHA224_RSA_PKCS",
 829   [0x47] = "CKM_SHA224_RSA_PKCS_PSS",
 830   [0x396] = "CKM_SHA224_KEY_DERIVATION",
 831   [0x550] = "CKM_CAMELLIA_KEY_GEN",
 832   [0x551] = "CKM_CAMELLIA_ECB",
 833   [0x552] = "CKM_CAMELLIA_CBC",
 834   [0x553] = "CKM_CAMELLIA_MAC",
 835   [0x554] = "CKM_CAMELLIA_MAC_GENERAL",
 836   [0x555] = "CKM_CAMELLIA_CBC_PAD",
 837   [0x556] = "CKM_CAMELLIA_ECB_ENCRYPT_DATA",
 838   [0x557] = "CKM_CAMELLIA_CBC_ENCRYPT_DATA"
 839 };
 840
 841 void
 842 pkcs11_mechanism_list (FILE * outfile, const char *url, unsigned int login,
 843                        common_info_st * info)
 844 {
 845   int ret;
 846   int idx;
 847   unsigned long mechanism;
 848   const char *str;
 849
 850   pkcs11_common ();
 851
 852   if (url == NULL)
 853     url = "pkcs11:";
 854
 855   idx = 0;
 856   do
 857     {
 858       ret = gnutls_pkcs11_token_get_mechanism (url, idx++, &mechanism);
 859       if (ret >= 0)
 860         {
 861           str = NULL;
 862           if (mechanism <= sizeof (mech_list) / sizeof (mech_list[0]))
 863             str = mech_list[mechanism];
 864           if (str == NULL)
 865             str = "UNKNOWN";
 866
 867           fprintf (outfile, "[0x%.4lx] %s\n", mechanism, str);
 868         }
 869     }
 870   while (ret >= 0);
 871
 872
 873   return;
 874 }