lib/pkcs11.c

   1 /*
   2  * GnuTLS PKCS#11 support
   3  * Copyright (C) 2010 Free Software Foundation
   4  * Copyright (C) 2008, Joe Orton <joe@manyfish.co.uk>
   5  *
   6  * Author: Nikos Mavrogiannopoulos
   7  *
   8  * Inspired and some parts (pkcs11_login) based on neon PKCS #11 support
   9  * by Joe Orton. More ideas came from the pkcs11-helper library by
  10  * Alon Bar-Lev.
  11  *
  12  * This library is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU Library General Public
  14  * License as published by the Free Software Foundation; either
  15  * version 2 of the License, or (at your option) any later version.
  16  *
  17  * This library is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  20  * Library General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU Library General Public
  23  * License along with this library; if not, write to the Free
  24  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
  25  * MA 02111-1307, USA
  26 */
  27
  28 #include <gnutls_int.h>
  29 #include <gnutls/pkcs11.h>
  30 #include <stdio.h>
  31 #include <string.h>
  32 #include <gnutls_errors.h>
  33 #include <gnutls_datum.h>
  34 #include <pkcs11_int.h>
  35 #include <p11-kit/p11-kit.h>
  36 #include <p11-kit/pin.h>
  37 #include <errno.h>
  38
  39 #define MAX_PROVIDERS 16
  40
  41 /* XXX: try to eliminate this */
  42 #define MAX_CERT_SIZE 8*1024
  43
  44 struct gnutls_pkcs11_provider_s
  45 {
  46   struct ck_function_list *module;
  47   unsigned long nslots;
  48   ck_slot_id_t *slots;
  49   struct ck_info info;
  50   int initialized;
  51 };
  52
  53 struct flags_find_data_st
  54 {
  55   struct p11_kit_uri *info;
  56   unsigned int slot_flags;
  57 };
  58
  59 struct url_find_data_st
  60 {
  61   gnutls_pkcs11_obj_t crt;
  62 };
  63
  64 struct crt_find_data_st
  65 {
  66   gnutls_pkcs11_obj_t *p_list;
  67   unsigned int *n_list;
  68   unsigned int current;
  69   gnutls_pkcs11_obj_attr_t flags;
  70   struct p11_kit_uri *info;
  71 };
  72
  73
  74 static struct gnutls_pkcs11_provider_s providers[MAX_PROVIDERS];
  75 static int active_providers = 0;
  76 static int initialized_registered = 0;
  77
  78 static gnutls_pkcs11_pin_callback_t pin_func;
  79 static void *pin_data;
  80
  81 gnutls_pkcs11_token_callback_t token_func;
  82 void *token_data;
  83
  84 int
  85 pkcs11_rv_to_err (ck_rv_t rv)
  86 {
  87   switch (rv)
  88     {
  89     case CKR_OK:
  90       return 0;
  91     case CKR_HOST_MEMORY:
  92       return GNUTLS_E_MEMORY_ERROR;
  93     case CKR_SLOT_ID_INVALID:
  94       return GNUTLS_E_PKCS11_SLOT_ERROR;
  95     case CKR_ARGUMENTS_BAD:
  96     case CKR_MECHANISM_PARAM_INVALID:
  97       return GNUTLS_E_INVALID_REQUEST;
  98     case CKR_NEED_TO_CREATE_THREADS:
  99     case CKR_CANT_LOCK:
 100     case CKR_FUNCTION_NOT_PARALLEL:
 101     case CKR_MUTEX_BAD:
 102     case CKR_MUTEX_NOT_LOCKED:
 103       return GNUTLS_E_LOCKING_ERROR;
 104     case CKR_ATTRIBUTE_READ_ONLY:
 105     case CKR_ATTRIBUTE_SENSITIVE:
 106     case CKR_ATTRIBUTE_TYPE_INVALID:
 107     case CKR_ATTRIBUTE_VALUE_INVALID:
 108       return GNUTLS_E_PKCS11_ATTRIBUTE_ERROR;
 109     case CKR_DEVICE_ERROR:
 110     case CKR_DEVICE_MEMORY:
 111     case CKR_DEVICE_REMOVED:
 112       return GNUTLS_E_PKCS11_DEVICE_ERROR;
 113     case CKR_DATA_INVALID:
 114     case CKR_DATA_LEN_RANGE:
 115     case CKR_ENCRYPTED_DATA_INVALID:
 116     case CKR_ENCRYPTED_DATA_LEN_RANGE:
 117     case CKR_OBJECT_HANDLE_INVALID:
 118       return GNUTLS_E_PKCS11_DATA_ERROR;
 119     case CKR_FUNCTION_NOT_SUPPORTED:
 120     case CKR_MECHANISM_INVALID:
 121       return GNUTLS_E_PKCS11_UNSUPPORTED_FEATURE_ERROR;
 122     case CKR_KEY_HANDLE_INVALID:
 123     case CKR_KEY_SIZE_RANGE:
 124     case CKR_KEY_TYPE_INCONSISTENT:
 125     case CKR_KEY_NOT_NEEDED:
 126     case CKR_KEY_CHANGED:
 127     case CKR_KEY_NEEDED:
 128     case CKR_KEY_INDIGESTIBLE:
 129     case CKR_KEY_FUNCTION_NOT_PERMITTED:
 130     case CKR_KEY_NOT_WRAPPABLE:
 131     case CKR_KEY_UNEXTRACTABLE:
 132       return GNUTLS_E_PKCS11_KEY_ERROR;
 133     case CKR_PIN_INCORRECT:
 134     case CKR_PIN_INVALID:
 135     case CKR_PIN_LEN_RANGE:
 136       return GNUTLS_E_PKCS11_PIN_ERROR;
 137     case CKR_PIN_EXPIRED:
 138       return GNUTLS_E_PKCS11_PIN_EXPIRED;
 139     case CKR_PIN_LOCKED:
 140       return GNUTLS_E_PKCS11_PIN_LOCKED;
 141     case CKR_SESSION_CLOSED:
 142     case CKR_SESSION_COUNT:
 143     case CKR_SESSION_HANDLE_INVALID:
 144     case CKR_SESSION_PARALLEL_NOT_SUPPORTED:
 145     case CKR_SESSION_READ_ONLY:
 146     case CKR_SESSION_EXISTS:
 147     case CKR_SESSION_READ_ONLY_EXISTS:
 148     case CKR_SESSION_READ_WRITE_SO_EXISTS:
 149       return GNUTLS_E_PKCS11_SESSION_ERROR;
 150     case CKR_SIGNATURE_INVALID:
 151     case CKR_SIGNATURE_LEN_RANGE:
 152       return GNUTLS_E_PKCS11_SIGNATURE_ERROR;
 153     case CKR_TOKEN_NOT_PRESENT:
 154     case CKR_TOKEN_NOT_RECOGNIZED:
 155     case CKR_TOKEN_WRITE_PROTECTED:
 156       return GNUTLS_E_PKCS11_TOKEN_ERROR;
 157     case CKR_USER_ALREADY_LOGGED_IN:
 158     case CKR_USER_NOT_LOGGED_IN:
 159     case CKR_USER_PIN_NOT_INITIALIZED:
 160     case CKR_USER_TYPE_INVALID:
 161     case CKR_USER_ANOTHER_ALREADY_LOGGED_IN:
 162     case CKR_USER_TOO_MANY_TYPES:
 163       return GNUTLS_E_PKCS11_USER_ERROR;
 164     case CKR_BUFFER_TOO_SMALL:
 165       return GNUTLS_E_SHORT_MEMORY_BUFFER;
 166     default:
 167       return GNUTLS_E_PKCS11_ERROR;
 168     }
 169 }
 170
 171 /* Fake scan */
 172 void
 173 pkcs11_rescan_slots (void)
 174 {
 175   unsigned long slots;
 176
 177   pkcs11_get_slot_list (providers[active_providers - 1].module, 0,
 178                           NULL, &slots);
 179 }
 180
 181 static int
 182 pkcs11_add_module (const char *name, struct ck_function_list *module)
 183 {
 184   struct ck_info info;
 185   int i;
 186
 187   if (active_providers >= MAX_PROVIDERS)
 188     {
 189       gnutls_assert ();
 190       return GNUTLS_E_CONSTRAINT_ERROR;
 191     }
 192
 193   /* initially check if this module is a duplicate */
 194   memset(&info, 0, sizeof(info));
 195   pkcs11_get_module_info (module, &info);
 196   for (i=0;i<active_providers;i++)
 197     {
 198       /* already loaded, skip the rest */
 199       if (memcmp(&info, &providers[i].info, sizeof(info)) == 0)
 200         {
 201           _gnutls_debug_log("%s is already loaded.\n", name);
 202           return 0;
 203         }
 204     }
 205
 206   active_providers++;
 207   providers[active_providers - 1].module = module;
 208
 209   /* cache the number of slots in this module */
 210   if (pkcs11_get_slot_list
 211       (providers[active_providers - 1].module, 0, NULL,
 212        &providers[active_providers - 1].nslots) != CKR_OK)
 213     {
 214       gnutls_assert ();
 215       goto fail;
 216     }
 217
 218   providers[active_providers - 1].slots =
 219     gnutls_malloc (sizeof (*providers[active_providers - 1].slots) *
 220                    providers[active_providers - 1].nslots);
 221   if (providers[active_providers - 1].slots == NULL)
 222     {
 223       gnutls_assert ();
 224       goto fail;
 225     }
 226
 227   if (pkcs11_get_slot_list
 228       (providers[active_providers - 1].module, 0,
 229        providers[active_providers - 1].slots,
 230        &providers[active_providers - 1].nslots) != CKR_OK)
 231     {
 232       gnutls_assert ();
 233       gnutls_free (providers[active_providers - 1].slots);
 234       goto fail;
 235     }
 236
 237   memcpy (&providers[active_providers - 1].info, &info, sizeof(info));
 238
 239   _gnutls_debug_log ("p11: loaded provider '%s' with %d slots\n",
 240                      name, (int) providers[active_providers - 1].nslots);
 241
 242   return 0;
 243
 244 fail:
 245   active_providers--;
 246   return GNUTLS_E_PKCS11_LOAD_ERROR;
 247 }
 248
 249
 250 /**
 251  * gnutls_pkcs11_add_provider:
 252  * @name: The filename of the module
 253  * @params: should be NULL
 254  *
 255  * This function will load and add a PKCS 11 module to the module
 256  * list used in gnutls. After this function is called the module will
 257  * be used for PKCS 11 operations.
 258  *
 259  * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
 260  *   negative error value.
 261  **/
 262 int
 263 gnutls_pkcs11_add_provider (const char *name, const char *params)
 264 {
 265   struct ck_function_list *module;
 266   int ret;
 267
 268   active_providers++;
 269   if (p11_kit_load_initialize_module (name, &module) != CKR_OK)
 270     {
 271       gnutls_assert ();
 272       _gnutls_debug_log ("p11: Cannot load provider %s\n", name);
 273       active_providers--;
 274       return GNUTLS_E_PKCS11_LOAD_ERROR;
 275     }
 276
 277   ret = pkcs11_add_module (name, module);
 278   if (ret == 0)
 279     {
 280       /* Mark this one as having been separately initialized */
 281       providers[active_providers - 1].initialized = 1;
 282     }
 283   else
 284     {
 285       p11_kit_finalize_module (module);
 286       gnutls_assert ();
 287     }
 288
 289   return ret;
 290 }
 291
 292
 293 /**
 294  * gnutls_pkcs11_obj_get_info:
 295  * @crt: should contain a #gnutls_pkcs11_obj_t structure
 296  * @itype: Denotes the type of information requested
 297  * @output: where output will be stored
 298  * @output_size: contains the maximum size of the output and will be overwritten with actual
 299  *
 300  * This function will return information about the PKCS 11 certificatesuch
 301  * as the label, id as well as token information where the key is stored. When
 302  * output is text it returns null terminated string although %output_size contains
 303  * the size of the actual data only.
 304  *
 305  * Returns: zero on success or a negative value on error.
 306  **/
 307 int
 308 gnutls_pkcs11_obj_get_info (gnutls_pkcs11_obj_t crt,
 309                             gnutls_pkcs11_obj_info_t itype,
 310                             void *output, size_t * output_size)
 311 {
 312   return pkcs11_get_info (crt->info, itype, output, output_size);
 313 }
 314
 315 int
 316 pkcs11_get_info (struct p11_kit_uri *info,
 317                  gnutls_pkcs11_obj_info_t itype, void *output,
 318                  size_t * output_size)
 319 {
 320   struct ck_attribute *attr = NULL;
 321   struct ck_version *version = NULL;
 322   const char *str = NULL;
 323   size_t str_max = 0;
 324   int terminate = 0;
 325   int hexify = 0;
 326   size_t length = 0;
 327   const char *data = NULL;
 328   char buf[32];
 329
 330   /*
 331    * Either attr, str or version is valid by the time switch
 332    * finishes
 333    */
 334
 335   switch (itype)
 336     {
 337     case GNUTLS_PKCS11_OBJ_ID:
 338       attr = p11_kit_uri_get_attribute (info, CKA_ID);
 339       break;
 340     case GNUTLS_PKCS11_OBJ_ID_HEX:
 341       attr = p11_kit_uri_get_attribute (info, CKA_ID);
 342       hexify = 1;
 343       terminate = 1;
 344       break;
 345     case GNUTLS_PKCS11_OBJ_LABEL:
 346       attr = p11_kit_uri_get_attribute (info, CKA_LABEL);
 347       terminate = 1;
 348       break;
 349     case GNUTLS_PKCS11_OBJ_TOKEN_LABEL:
 350       str = p11_kit_uri_get_token_info (info)->label;
 351       str_max = 32;
 352       break;
 353     case GNUTLS_PKCS11_OBJ_TOKEN_SERIAL:
 354       str = p11_kit_uri_get_token_info (info)->serial_number;
 355       str_max = 16;
 356       break;
 357     case GNUTLS_PKCS11_OBJ_TOKEN_MANUFACTURER:
 358       str = p11_kit_uri_get_token_info (info)->manufacturer_id;
 359       str_max = 32;
 360       break;
 361     case GNUTLS_PKCS11_OBJ_TOKEN_MODEL:
 362       str = p11_kit_uri_get_token_info (info)->model;
 363       str_max = 16;
 364       break;
 365     case GNUTLS_PKCS11_OBJ_LIBRARY_DESCRIPTION:
 366       str = p11_kit_uri_get_module_info (info)->library_description;
 367       str_max = 32;
 368       break;
 369     case GNUTLS_PKCS11_OBJ_LIBRARY_VERSION:
 370       version = &p11_kit_uri_get_module_info (info)->library_version;
 371       break;
 372     case GNUTLS_PKCS11_OBJ_LIBRARY_MANUFACTURER:
 373       str = p11_kit_uri_get_module_info (info)->manufacturer_id;
 374       str_max = 32;
 375       break;
 376     default:
 377       gnutls_assert ();
 378       return GNUTLS_E_INVALID_REQUEST;
 379     }
 380
 381   if (attr != NULL)
 382     {
 383       data = attr->value;
 384       length = attr->value_len;
 385     }
 386   else if (str != NULL)
 387     {
 388       data = str;
 389       length = p11_kit_space_strlen (str, str_max);
 390       terminate = 1;
 391     }
 392   else if (version != NULL)
 393     {
 394       data = buf;
 395       length = snprintf (buf, sizeof (buf), "%d.%d", (int)version->major,
 396                          (int)version->minor);
 397       terminate = 1;
 398     }
 399   else
 400     {
 401       *output_size = 0;
 402       if (output) ((uint8_t*)output)[0] = 0;
 403       return 0;
 404     }
 405
 406   if (hexify)
 407     {
 408       /* terminate is assumed with hexify */
 409       if (*output_size < length * 3)
 410         {
 411           *output_size = length * 3;
 412           return GNUTLS_E_SHORT_MEMORY_BUFFER;
 413         }
 414       if (output)
 415         _gnutls_bin2hex (data, length, output, *output_size, ":");
 416       *output_size = length * 3;
 417       return 0;
 418     }
 419   else
 420     {
 421       if (*output_size < length + terminate)
 422         {
 423           *output_size = length + terminate;
 424           return GNUTLS_E_SHORT_MEMORY_BUFFER;
 425         }
 426       if (output)
 427         {
 428           memcpy (output, data, length);
 429           if (terminate)
 430             ((unsigned char*)output)[length] = '\0';
 431         }
 432       *output_size = length + terminate;
 433     }
 434
 435   return 0;
 436 }
 437
 438 static int init = 0;
 439
 440 static int
 441 initialize_automatic_p11_kit (void)
 442 {
 443   struct ck_function_list **modules;
 444   const char *name;
 445   ck_rv_t rv;
 446   int i, ret;
 447
 448   rv = p11_kit_initialize_registered ();
 449   if (rv != CKR_OK)
 450     {
 451       gnutls_assert ();
 452       _gnutls_debug_log ("Cannot initialize registered module: %s\n",
 453                          p11_kit_strerror (rv));
 454       return GNUTLS_E_INTERNAL_ERROR;
 455     }
 456
 457   initialized_registered = 1;
 458
 459   modules = p11_kit_registered_modules ();
 460   for (i = 0; modules[i] != NULL; i++)
 461     {
 462       name = p11_kit_registered_module_to_name (modules[i]);
 463       ret = pkcs11_add_module (name, modules[i]);
 464       if (ret != 0)
 465         {
 466           gnutls_assert ();
 467           _gnutls_debug_log ("Cannot add registered module: %s\n", name);
 468         }
 469     }
 470
 471   free (modules);
 472   return 0;
 473 }
 474
 475 static int
 476 initialize_automatic_legacy (const char *configfile)
 477 {
 478   FILE *fp;
 479   char line[512];
 480   const char *library;
 481   int ret;
 482
 483   if (configfile == NULL)
 484     configfile = "/etc/gnutls/pkcs11.conf";
 485
 486   fp = fopen (configfile, "r");
 487   if (fp == NULL)
 488     {
 489       if (errno == ENOENT)
 490         return 0;
 491       gnutls_assert ();
 492       _gnutls_debug_log ("Cannot load %s\n", configfile);
 493       return GNUTLS_E_FILE_ERROR;
 494     }
 495
 496   while (fgets (line, sizeof (line), fp) != NULL)
 497     {
 498       if (strncmp (line, "load", sizeof ("load") - 1) == 0)
 499         {
 500           char *p;
 501           p = strchr (line, '=');
 502           if (p == NULL)
 503             continue;
 504
 505           library = ++p;
 506
 507           p = strchr (line, '\n');
 508           if (p != NULL)
 509             {
 510               *p = 0;
 511             }
 512
 513           ret = gnutls_pkcs11_add_provider (library, NULL);
 514           if (ret < 0)
 515             {
 516               gnutls_assert ();
 517               _gnutls_debug_log ("Cannot load provider: %s\n", library);
 518               continue;
 519             }
 520         }
 521     }
 522
 523   fclose(fp);
 524   return 0;
 525 }
 526
 527 /**
 528  * gnutls_pkcs11_init:
 529  * @flags: %GNUTLS_PKCS11_FLAG_MANUAL or %GNUTLS_PKCS11_FLAG_AUTO
 530  * @deprecated_config_file: either NULL or the location of a deprecated
 531  *     configuration file
 532  *
 533  * This function will initialize the PKCS 11 subsystem in gnutls. It will
 534  * read configuration files if %GNUTLS_PKCS11_FLAG_AUTO is used or allow
 535  * you to independently load PKCS 11 modules using gnutls_pkcs11_add_provider()
 536  * if %GNUTLS_PKCS11_FLAG_MANUAL is specified.
 537  *
 538  * Using a custom configfile is deprecated and will not be supported in future
 539  * versions of gnutls.
 540  *
 541  * Normally you don't need to call this function since it is being called
 542  * by gnutls_global_init() using the %GNUTLS_PKCS11_FLAG_AUTO. If you need to
 543  * call this function, you must call it before gnutls_global_init().
 544  *
 545  * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
 546  *   negative error value.
 547  **/
 548 int
 549 gnutls_pkcs11_init (unsigned int flags, const char *deprecated_config_file)
 550 {
 551   int ret = 0;
 552
 553   if (init != 0)
 554     {
 555       init++;
 556       return 0;
 557     }
 558   init++;
 559
 560   if (flags == GNUTLS_PKCS11_FLAG_AUTO)
 561     {
 562       if (deprecated_config_file == NULL)
 563         ret = initialize_automatic_p11_kit ();
 564
 565       if (ret == 0)
 566         ret = initialize_automatic_legacy (deprecated_config_file);
 567     }
 568
 569   return ret;
 570 }
 571
 572 /**
 573  * gnutls_pkcs11_reinit:
 574  *
 575  * This function will reinitialize the PKCS 11 subsystem in gnutls.
 576  * This is required by PKCS 11 when an application uses fork(). The
 577  * reinitialization function must be called on the child.
 578  *
 579  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 580  *   negative error value.
 581  *
 582  * Since: 3.0.0
 583  **/
 584 int gnutls_pkcs11_reinit (void)
 585 {
 586   int rv;
 587
 588   rv = p11_kit_initialize_registered ();
 589   if (rv != CKR_OK)
 590     {
 591       gnutls_assert ();
 592       _gnutls_debug_log ("Cannot initialize registered module: %s\n",
 593                          p11_kit_strerror (rv));
 594       return GNUTLS_E_INTERNAL_ERROR;
 595     }
 596
 597   return 0;
 598 }
 599
 600 /**
 601  * gnutls_pkcs11_deinit:
 602  *
 603  * This function will deinitialize the PKCS 11 subsystem in gnutls.
 604  *
 605  **/
 606 void
 607 gnutls_pkcs11_deinit (void)
 608 {
 609   int i;
 610
 611   init--;
 612   if (init > 0)
 613     return;
 614   if (init < 0)
 615     {
 616       init = 0;
 617       return;
 618     }
 619
 620   for (i = 0; i < active_providers; i++)
 621     {
 622       if (providers[i].initialized)
 623         p11_kit_finalize_module (providers[i].module);
 624     }
 625   active_providers = 0;
 626
 627   if (initialized_registered != 0)
 628     p11_kit_finalize_registered ();
 629   initialized_registered = 0;
 630 }
 631
 632 /**
 633  * gnutls_pkcs11_set_pin_function:
 634  * @fn: The PIN callback
 635  * @userdata: data to be supplied to callback
 636  *
 637  * This function will set a callback function to be used when a PIN
 638  * is required for PKCS 11 operations.
 639  *
 640  * Callback for PKCS#11 PIN entry.  The callback provides the PIN code
 641  * to unlock the token with label 'token_label', specified by the URL
 642  * 'token_url'.
 643  *
 644  * The PIN code, as a NUL-terminated ASCII string, should be copied
 645  * into the 'pin' buffer (of maximum size pin_max), and
 646  * return 0 to indicate success. Alternatively, the callback may
 647  * return a negative gnutls error code to indicate failure and cancel
 648  * PIN entry (in which case, the contents of the 'pin' parameter are ignored).
 649  *
 650  * When a PIN is required, the callback will be invoked repeatedly
 651  * (and indefinitely) until either the returned PIN code is correct,
 652  * the callback returns failure, or the token refuses login (e.g. when
 653  * the token is locked due to too many incorrect PINs!).  For the
 654  * first such invocation, the 'attempt' counter will have value zero;
 655  * it will increase by one for each subsequent attempt.
 656  *
 657  * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
 658  *   negative error value.
 659  **/
 660 void
 661 gnutls_pkcs11_set_pin_function (gnutls_pkcs11_pin_callback_t fn,
 662                                 void *userdata)
 663 {
 664   pin_func = fn;
 665   pin_data = userdata;
 666 }
 667
 668 /**
 669  * gnutls_pkcs11_set_token_function:
 670  * @fn: The token callback
 671  * @userdata: data to be supplied to callback
 672  *
 673  * This function will set a callback function to be used when a token
 674  * needs to be inserted to continue PKCS 11 operations.
 675  *
 676  * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
 677  *   negative error value.
 678  **/
 679 void
 680 gnutls_pkcs11_set_token_function (gnutls_pkcs11_token_callback_t fn,
 681                                   void *userdata)
 682 {
 683   token_func = fn;
 684   token_data = userdata;
 685 }
 686
 687 int
 688 pkcs11_url_to_info (const char *url, struct p11_kit_uri **info)
 689 {
 690   int allocated = 0;
 691   int ret;
 692
 693   if (*info == NULL)
 694     {
 695       *info = p11_kit_uri_new ();
 696       if (*info == NULL)
 697         {
 698           gnutls_assert ();
 699           return GNUTLS_E_MEMORY_ERROR;
 700         }
 701       allocated = 1;
 702     }
 703
 704   ret = p11_kit_uri_parse (url, P11_KIT_URI_FOR_ANY, *info);
 705   if (ret < 0)
 706     {
 707       if (allocated)
 708         {
 709           p11_kit_uri_free (*info);
 710           *info = NULL;
 711         }
 712       gnutls_assert ();
 713       return ret == P11_KIT_URI_NO_MEMORY ?
 714           GNUTLS_E_MEMORY_ERROR : GNUTLS_E_PARSING_ERROR;
 715     }
 716
 717   return 0;
 718 }
 719
 720 int
 721 pkcs11_info_to_url (struct p11_kit_uri *info,
 722                     gnutls_pkcs11_url_type_t detailed, char **url)
 723 {
 724   p11_kit_uri_type_t type = 0;
 725   int ret;
 726
 727   switch (detailed)
 728     {
 729       case GNUTLS_PKCS11_URL_GENERIC:
 730         type = P11_KIT_URI_FOR_OBJECT_ON_TOKEN;
 731         break;
 732       case GNUTLS_PKCS11_URL_LIB:
 733         type = P11_KIT_URI_FOR_OBJECT_ON_TOKEN_AND_MODULE;
 734         break;
 735       case GNUTLS_PKCS11_URL_LIB_VERSION:
 736         type = P11_KIT_URI_FOR_OBJECT_ON_TOKEN_AND_MODULE | P11_KIT_URI_FOR_MODULE_WITH_VERSION;
 737         break;
 738     }
 739
 740   ret = p11_kit_uri_format (info, type, url);
 741   if (ret < 0)
 742     {
 743       gnutls_assert ();
 744       return ret == P11_KIT_URI_NO_MEMORY ?
 745           GNUTLS_E_MEMORY_ERROR : GNUTLS_E_INTERNAL_ERROR;
 746     }
 747
 748   return 0;
 749 }
 750
 751 /**
 752  * gnutls_pkcs11_obj_init:
 753  * @obj: The structure to be initialized
 754  *
 755  * This function will initialize a pkcs11 certificate structure.
 756  *
 757  * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
 758  *   negative error value.
 759  **/
 760 int
 761 gnutls_pkcs11_obj_init (gnutls_pkcs11_obj_t * obj)
 762 {
 763   *obj = gnutls_calloc (1, sizeof (struct gnutls_pkcs11_obj_st));
 764   if (*obj == NULL)
 765     {
 766       gnutls_assert ();
 767       return GNUTLS_E_MEMORY_ERROR;
 768     }
 769
 770   (*obj)->info = p11_kit_uri_new ();
 771   if ((*obj)->info == NULL)
 772     {
 773       free (*obj);
 774       gnutls_assert ();
 775       return GNUTLS_E_MEMORY_ERROR;
 776     }
 777
 778   return 0;
 779 }
 780
 781 /**
 782  * gnutls_pkcs11_obj_deinit:
 783  * @obj: The structure to be initialized
 784  *
 785  * This function will deinitialize a certificate structure.
 786  **/
 787 void
 788 gnutls_pkcs11_obj_deinit (gnutls_pkcs11_obj_t obj)
 789 {
 790   _gnutls_free_datum (&obj->raw);
 791   p11_kit_uri_free (obj->info);
 792   free (obj);
 793 }
 794
 795 /**
 796  * gnutls_pkcs11_obj_export:
 797  * @obj: Holds the object
 798  * @output_data: will contain a certificate PEM or DER encoded
 799  * @output_data_size: holds the size of output_data (and will be
 800  *   replaced by the actual size of parameters)
 801  *
 802  * This function will export the pkcs11 object data. It is normal
 803  * for PKCS #11 data to be inaccesible and in that case %GNUTLS_E_INVALID_REQUEST
 804  * will be returned.
 805  *
 806  * If the buffer provided is not long enough to hold the output, then
 807  * *output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
 808  * be returned.
 809  *
 810  * If the structure is PEM encoded, it will have a header
 811  * of "BEGIN CERTIFICATE".
 812  *
 813  * Return value: In case of failure a negative value will be
 814  *   returned, and 0 on success.
 815  **/
 816 int
 817 gnutls_pkcs11_obj_export (gnutls_pkcs11_obj_t obj,
 818                           void *output_data, size_t * output_data_size)
 819 {
 820   if (obj == NULL || obj->raw.data == NULL)
 821     {
 822       gnutls_assert ();
 823       return GNUTLS_E_INVALID_REQUEST;
 824     }
 825
 826   if (output_data == NULL || *output_data_size < obj->raw.size)
 827     {
 828       *output_data_size = obj->raw.size;
 829       gnutls_assert ();
 830       return GNUTLS_E_SHORT_MEMORY_BUFFER;
 831     }
 832   *output_data_size = obj->raw.size;
 833
 834   memcpy (output_data, obj->raw.data, obj->raw.size);
 835   return 0;
 836 }
 837
 838 int
 839 pkcs11_find_object (struct ck_function_list ** _module,
 840                     ck_session_handle_t * _pks,
 841                     ck_object_handle_t * _obj,
 842                     struct p11_kit_uri *info, unsigned int flags)
 843 {
 844   int ret;
 845   struct ck_function_list *module;
 846   ck_session_handle_t pks;
 847   ck_object_handle_t obj;
 848   struct ck_attribute *attrs;
 849   unsigned long attr_count;
 850   unsigned long count;
 851   ck_rv_t rv;
 852
 853   ret = pkcs11_open_session (&module, &pks, info, flags & SESSION_LOGIN);
 854   if (ret < 0)
 855     {
 856       gnutls_assert ();
 857       return ret;
 858     }
 859
 860   attrs = p11_kit_uri_get_attributes (info, &attr_count);
 861   rv = pkcs11_find_objects_init (module, pks, attrs, attr_count);
 862   if (rv != CKR_OK)
 863     {
 864       gnutls_assert ();
 865       _gnutls_debug_log ("pk11: FindObjectsInit failed.\n");
 866       ret = pkcs11_rv_to_err (rv);
 867       goto fail;
 868     }
 869
 870   if (pkcs11_find_objects (module, pks, &obj, 1, &count) == CKR_OK && count == 1)
 871     {
 872       *_obj = obj;
 873       *_pks = pks;
 874       *_module = module;
 875       pkcs11_find_objects_final (module, pks);
 876       return 0;
 877     }
 878
 879   ret = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
 880   pkcs11_find_objects_final (module, pks);
 881 fail:
 882   pkcs11_close_session (module, pks);
 883
 884   return ret;
 885 }
 886
 887 int
 888 pkcs11_find_slot (struct ck_function_list ** module, ck_slot_id_t * slot,
 889                   struct p11_kit_uri *info, struct token_info *_tinfo)
 890 {
 891   int x, z;
 892
 893   for (x = 0; x < active_providers; x++)
 894     {
 895       for (z = 0; z < providers[x].nslots; z++)
 896         {
 897           struct token_info tinfo;
 898
 899           if (pkcs11_get_token_info
 900               (providers[x].module, providers[x].slots[z],
 901                &tinfo.tinfo) != CKR_OK)
 902             {
 903               continue;
 904             }
 905           tinfo.sid = providers[x].slots[z];
 906           tinfo.prov = &providers[x];
 907
 908           if (pkcs11_get_slot_info
 909               (providers[x].module, providers[x].slots[z],
 910                &tinfo.sinfo) != CKR_OK)
 911             {
 912               continue;
 913             }
 914
 915           if (!p11_kit_uri_match_token_info (info, &tinfo.tinfo) ||
 916               !p11_kit_uri_match_module_info (info, &providers[x].info))
 917             {
 918               continue;
 919             }
 920
 921           /* ok found */
 922           *module = providers[x].module;
 923           *slot = providers[x].slots[z];
 924
 925           if (_tinfo != NULL)
 926             memcpy (_tinfo, &tinfo, sizeof (tinfo));
 927
 928           return 0;
 929         }
 930     }
 931
 932   gnutls_assert ();
 933   return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
 934 }
 935
 936 int
 937 pkcs11_open_session (struct ck_function_list ** _module, ck_session_handle_t * _pks,
 938                      struct p11_kit_uri *info, unsigned int flags)
 939 {
 940   ck_rv_t rv;
 941   int ret;
 942   ck_session_handle_t pks = 0;
 943   struct ck_function_list *module;
 944   ck_slot_id_t slot;
 945   struct token_info tinfo;
 946
 947   ret = pkcs11_find_slot (&module, &slot, info, &tinfo);
 948   if (ret < 0)
 949     {
 950       gnutls_assert ();
 951       return ret;
 952     }
 953
 954   rv = (module)->C_OpenSession (slot,
 955                               ((flags & SESSION_WRITE)
 956                                ? CKF_RW_SESSION : 0) |
 957                               CKF_SERIAL_SESSION, NULL, NULL, &pks);
 958   if (rv != CKR_OK)
 959     {
 960       gnutls_assert ();
 961       return pkcs11_rv_to_err (rv);
 962     }
 963
 964   if (flags & SESSION_LOGIN)
 965     {
 966       ret = pkcs11_login (module, pks, &tinfo, info, (flags & SESSION_SO) ? 1 : 0);
 967       if (ret < 0)
 968         {
 969           gnutls_assert ();
 970           pkcs11_close_session (module, pks);
 971           return ret;
 972         }
 973     }
 974
 975   /* ok found */
 976   *_pks = pks;
 977   *_module = module;
 978   return 0;
 979 }
 980
 981
 982 int
 983 _pkcs11_traverse_tokens (find_func_t find_func, void *input,
 984                          struct p11_kit_uri *info, unsigned int flags)
 985 {
 986   ck_rv_t rv;
 987   int found = 0, x, z, ret;
 988   ck_session_handle_t pks = 0;
 989   struct ck_function_list *module = NULL;
 990
 991   for (x = 0; x < active_providers; x++)
 992     {
 993       module = providers[x].module;
 994       for (z = 0; z < providers[x].nslots; z++)
 995         {
 996           struct token_info tinfo;
 997
 998           ret = GNUTLS_E_PKCS11_ERROR;
 999
1000           if (pkcs11_get_token_info (module, providers[x].slots[z],
1001                &tinfo.tinfo) != CKR_OK)
1002             {
1003               continue;
1004             }
1005           tinfo.sid = providers[x].slots[z];
1006           tinfo.prov = &providers[x];
1007
1008           if (pkcs11_get_slot_info (module, providers[x].slots[z],
1009                &tinfo.sinfo) != CKR_OK)
1010             {
1011               continue;
1012             }
1013
1014           rv = (module)->C_OpenSession (providers[x].slots[z],
1015                                         ((flags & SESSION_WRITE)
1016                                           ? CKF_RW_SESSION : 0) |
1017                                         CKF_SERIAL_SESSION, NULL, NULL, &pks);
1018           if (rv != CKR_OK)
1019             {
1020               continue;
1021             }
1022
1023           if (flags & SESSION_LOGIN)
1024             {
1025               ret = pkcs11_login (module, pks, &tinfo, info, (flags & SESSION_SO) ? 1 : 0);
1026               if (ret < 0)
1027                 {
1028                   gnutls_assert ();
1029                   return ret;
1030                 }
1031             }
1032
1033           ret = find_func (module, pks, &tinfo, &providers[x].info, input);
1034
1035           if (ret == 0)
1036             {
1037               found = 1;
1038               goto finish;
1039             }
1040           else
1041             {
1042               pkcs11_close_session (module, pks);
1043               pks = 0;
1044             }
1045         }
1046     }
1047
1048 finish:
1049   /* final call */
1050
1051   if (found == 0)
1052     {
1053       if (module)
1054         ret = find_func (module, pks, NULL, NULL, input);
1055       else
1056         ret = gnutls_assert_val(GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE);
1057     }
1058   else
1059     {
1060       ret = 0;
1061     }
1062
1063   if (pks != 0 && module != NULL)
1064     {
1065       pkcs11_close_session (module, pks);
1066     }
1067
1068   return ret;
1069 }
1070
1071 /* imports a raw certificate from a token to a pkcs11_obj_t structure.
1072  */
1073 static int
1074 pkcs11_obj_import (ck_object_class_t class, gnutls_pkcs11_obj_t obj,
1075                    const gnutls_datum_t * data,
1076                    const gnutls_datum_t * id,
1077                    const gnutls_datum_t * label,
1078                    struct ck_token_info *tinfo, struct ck_info *lib_info)
1079 {
1080   struct ck_attribute attr;
1081   int ret;
1082
1083   switch (class)
1084     {
1085     case CKO_CERTIFICATE:
1086       obj->type = GNUTLS_PKCS11_OBJ_X509_CRT;
1087       break;
1088     case CKO_PUBLIC_KEY:
1089       obj->type = GNUTLS_PKCS11_OBJ_PUBKEY;
1090       break;
1091     case CKO_PRIVATE_KEY:
1092       obj->type = GNUTLS_PKCS11_OBJ_PRIVKEY;
1093       break;
1094     case CKO_SECRET_KEY:
1095       obj->type = GNUTLS_PKCS11_OBJ_SECRET_KEY;
1096       break;
1097     case CKO_DATA:
1098       obj->type = GNUTLS_PKCS11_OBJ_DATA;
1099       break;
1100     default:
1101       obj->type = GNUTLS_PKCS11_OBJ_UNKNOWN;
1102       break;
1103     }
1104
1105   attr.type = CKA_CLASS;
1106   attr.value = &class;
1107   attr.value_len = sizeof (class);
1108   ret = p11_kit_uri_set_attribute (obj->info, &attr);
1109   if (ret < 0)
1110     {
1111       gnutls_assert ();
1112       return GNUTLS_E_MEMORY_ERROR;
1113     }
1114
1115   if (data && data->data)
1116     {
1117       ret = _gnutls_set_datum (&obj->raw, data->data, data->size);
1118       if (ret < 0)
1119         {
1120           gnutls_assert ();
1121           return ret;
1122         }
1123     }
1124
1125   /* copy the token and library info into the uri */
1126   memcpy (p11_kit_uri_get_token_info (obj->info), tinfo, sizeof (struct ck_token_info));
1127   memcpy (p11_kit_uri_get_module_info (obj->info), lib_info, sizeof (struct ck_info));
1128
1129   if (label && label->data)
1130     {
1131       attr.type = CKA_LABEL;
1132       attr.value = label->data;
1133       attr.value_len = label->size;
1134       ret = p11_kit_uri_set_attribute (obj->info, &attr);
1135       if (ret < 0)
1136         {
1137           gnutls_assert ();
1138           return GNUTLS_E_MEMORY_ERROR;
1139         }
1140     }
1141
1142   if (id && id->data)
1143     {
1144       attr.type = CKA_ID;
1145       attr.value = id->data;
1146       attr.value_len = id->size;
1147       ret = p11_kit_uri_set_attribute (obj->info, &attr);
1148       if (ret < 0)
1149         {
1150           gnutls_assert ();
1151           return GNUTLS_E_MEMORY_ERROR;
1152         }
1153     }
1154
1155   return 0;
1156 }
1157
1158 static int
1159 pkcs11_obj_import_pubkey (struct ck_function_list *module,
1160                           ck_session_handle_t pks,
1161                           ck_object_handle_t obj,
1162                           gnutls_pkcs11_obj_t crt,
1163                           const gnutls_datum_t * id,
1164                           const gnutls_datum_t * label,
1165                           struct ck_token_info *tinfo,
1166                           struct ck_info *lib_info)
1167 {
1168
1169   struct ck_attribute a[4];
1170   ck_key_type_t key_type;
1171   opaque tmp1[2048];
1172   opaque tmp2[2048];
1173   int ret;
1174   ck_bool_t tval;
1175
1176   a[0].type = CKA_KEY_TYPE;
1177   a[0].value = &key_type;
1178   a[0].value_len = sizeof (key_type);
1179
1180   if (pkcs11_get_attribute_value (module, pks, obj, a, 1) == CKR_OK)
1181     {
1182       switch (key_type)
1183         {
1184         case CKK_RSA:
1185           a[0].type = CKA_MODULUS;
1186           a[0].value = tmp1;
1187           a[0].value_len = sizeof (tmp1);
1188           a[1].type = CKA_PUBLIC_EXPONENT;
1189           a[1].value = tmp2;
1190           a[1].value_len = sizeof (tmp2);
1191
1192           if (pkcs11_get_attribute_value (module, pks, obj, a, 2) == CKR_OK)
1193             {
1194
1195               ret =
1196                 _gnutls_set_datum (&crt->pubkey[0],
1197                                    a[0].value, a[0].value_len);
1198
1199               if (ret >= 0)
1200                 ret =
1201                   _gnutls_set_datum (&crt->pubkey
1202                                      [1], a[1].value, a[1].value_len);
1203
1204               if (ret < 0)
1205                 {
1206                   gnutls_assert ();
1207                   _gnutls_free_datum (&crt->pubkey[1]);
1208                   _gnutls_free_datum (&crt->pubkey[0]);
1209                   return GNUTLS_E_MEMORY_ERROR;
1210                 }
1211             }
1212           else
1213             {
1214               gnutls_assert ();
1215               return GNUTLS_E_PKCS11_ERROR;
1216             }
1217           crt->pk_algorithm = GNUTLS_PK_RSA;
1218           break;
1219         case CKK_DSA:
1220           a[0].type = CKA_PRIME;
1221           a[0].value = tmp1;
1222           a[0].value_len = sizeof (tmp1);
1223           a[1].type = CKA_SUBPRIME;
1224           a[1].value = tmp2;
1225           a[1].value_len = sizeof (tmp2);
1226
1227           if (pkcs11_get_attribute_value (module, pks, obj, a, 2) == CKR_OK)
1228             {
1229               ret =
1230                 _gnutls_set_datum (&crt->pubkey[0],
1231                                    a[0].value, a[0].value_len);
1232
1233               if (ret >= 0)
1234                 ret =
1235                   _gnutls_set_datum (&crt->pubkey
1236                                      [1], a[1].value, a[1].value_len);
1237
1238               if (ret < 0)
1239                 {
1240                   gnutls_assert ();
1241                   _gnutls_free_datum (&crt->pubkey[1]);
1242                   _gnutls_free_datum (&crt->pubkey[0]);
1243                   return GNUTLS_E_MEMORY_ERROR;
1244                 }
1245             }
1246           else
1247             {
1248               gnutls_assert ();
1249               return GNUTLS_E_PKCS11_ERROR;
1250             }
1251
1252           a[0].type = CKA_BASE;
1253           a[0].value = tmp1;
1254           a[0].value_len = sizeof (tmp1);
1255           a[1].type = CKA_VALUE;
1256           a[1].value = tmp2;
1257           a[1].value_len = sizeof (tmp2);
1258
1259           if (pkcs11_get_attribute_value (module, pks, obj, a, 2) == CKR_OK)
1260             {
1261               ret =
1262                 _gnutls_set_datum (&crt->pubkey[2],
1263                                    a[0].value, a[0].value_len);
1264
1265               if (ret >= 0)
1266                 ret =
1267                   _gnutls_set_datum (&crt->pubkey
1268                                      [3], a[1].value, a[1].value_len);
1269
1270               if (ret < 0)
1271                 {
1272                   gnutls_assert ();
1273                   _gnutls_free_datum (&crt->pubkey[0]);
1274                   _gnutls_free_datum (&crt->pubkey[1]);
1275                   _gnutls_free_datum (&crt->pubkey[2]);
1276                   _gnutls_free_datum (&crt->pubkey[3]);
1277                   return GNUTLS_E_MEMORY_ERROR;
1278                 }
1279             }
1280           else
1281             {
1282               gnutls_assert ();
1283               return GNUTLS_E_PKCS11_ERROR;
1284             }
1285           crt->pk_algorithm = GNUTLS_PK_RSA;
1286           break;
1287         default:
1288           gnutls_assert ();
1289           return GNUTLS_E_UNIMPLEMENTED_FEATURE;
1290         }
1291     }
1292
1293   /* read key usage flags */
1294   a[0].type = CKA_ENCRYPT;
1295   a[0].value = &tval;
1296   a[0].value_len = sizeof (tval);
1297
1298   if (pkcs11_get_attribute_value (module, pks, obj, a, 1) == CKR_OK)
1299     {
1300       if (tval != 0)
1301         {
1302           crt->key_usage |= GNUTLS_KEY_DATA_ENCIPHERMENT;
1303         }
1304     }
1305
1306   a[0].type = CKA_VERIFY;
1307   a[0].value = &tval;
1308   a[0].value_len = sizeof (tval);
1309
1310   if (pkcs11_get_attribute_value (module, pks, obj, a, 1) == CKR_OK)
1311     {
1312       if (tval != 0)
1313         {
1314           crt->key_usage |= GNUTLS_KEY_DIGITAL_SIGNATURE |
1315             GNUTLS_KEY_KEY_CERT_SIGN | GNUTLS_KEY_CRL_SIGN
1316             | GNUTLS_KEY_NON_REPUDIATION;
1317         }
1318     }
1319
1320   a[0].type = CKA_VERIFY_RECOVER;
1321   a[0].value = &tval;
1322   a[0].value_len = sizeof (tval);
1323
1324   if (pkcs11_get_attribute_value (module, pks, obj, a, 1) == CKR_OK)
1325     {
1326       if (tval != 0)
1327         {
1328           crt->key_usage |= GNUTLS_KEY_DIGITAL_SIGNATURE |
1329             GNUTLS_KEY_KEY_CERT_SIGN | GNUTLS_KEY_CRL_SIGN
1330             | GNUTLS_KEY_NON_REPUDIATION;
1331         }
1332     }
1333
1334   a[0].type = CKA_DERIVE;
1335   a[0].value = &tval;
1336   a[0].value_len = sizeof (tval);
1337
1338   if (pkcs11_get_attribute_value (module, pks, obj, a, 1) == CKR_OK)
1339     {
1340       if (tval != 0)
1341         {
1342           crt->key_usage |= GNUTLS_KEY_KEY_AGREEMENT;
1343         }
1344     }
1345
1346   a[0].type = CKA_WRAP;
1347   a[0].value = &tval;
1348   a[0].value_len = sizeof (tval);
1349
1350   if (pkcs11_get_attribute_value (module, pks, obj, a, 1) == CKR_OK)
1351     {
1352       if (tval != 0)
1353         {
1354           crt->key_usage |= GNUTLS_KEY_KEY_ENCIPHERMENT;
1355         }
1356     }
1357
1358   return pkcs11_obj_import (CKO_PUBLIC_KEY, crt, NULL, id, label,
1359                             tinfo, lib_info);
1360 }
1361
1362 static int
1363 find_obj_url (struct ck_function_list *module, ck_session_handle_t pks,
1364               struct token_info *info, struct ck_info *lib_info, void *input)
1365 {
1366   struct url_find_data_st *find_data = input;
1367   struct ck_attribute a[4];
1368   struct ck_attribute *attr;
1369   ck_object_class_t class = -1;
1370   ck_certificate_type_t type = -1;
1371   ck_rv_t rv;
1372   ck_object_handle_t obj;
1373   unsigned long count, a_vals;
1374   int found = 0, ret;
1375   opaque *cert_data = NULL;
1376   char label_tmp[PKCS11_LABEL_SIZE];
1377
1378   if (info == NULL)
1379     {                           /* we don't support multiple calls */
1380       gnutls_assert ();
1381       return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
1382     }
1383
1384   /* do not bother reading the token if basic fields do not match
1385    */
1386   if (!p11_kit_uri_match_token_info (find_data->crt->info, &info->tinfo) ||
1387       !p11_kit_uri_match_module_info (find_data->crt->info, lib_info))
1388     {
1389       gnutls_assert ();
1390       return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
1391     }
1392
1393   attr = p11_kit_uri_get_attribute (find_data->crt->info, CKA_ID);
1394   if (attr == NULL)
1395     {
1396       gnutls_assert ();
1397       return GNUTLS_E_INVALID_REQUEST;
1398     }
1399
1400   /* search the token for the id */
1401
1402   cert_data = gnutls_malloc (MAX_CERT_SIZE);
1403   if (cert_data == NULL)
1404     {
1405       gnutls_assert ();
1406       return GNUTLS_E_MEMORY_ERROR;
1407     }
1408
1409   /* Find objects with given class and type */
1410   memcpy (a, attr, sizeof (struct ck_attribute));
1411   a_vals = 1;
1412
1413   attr = p11_kit_uri_get_attribute (find_data->crt->info, CKA_CLASS);
1414   if (attr)
1415     {
1416       if(attr->value && attr->value_len == sizeof (ck_object_class_t))
1417         class = *((ck_object_class_t*)attr->value);
1418       if (class == CKO_CERTIFICATE)
1419         type = CKC_X_509;
1420       memcpy (a + a_vals, attr, sizeof (struct ck_attribute));
1421       a_vals++;
1422     }
1423
1424   if (type != -1)
1425     {
1426       a[a_vals].type = CKA_CERTIFICATE_TYPE;
1427       a[a_vals].value = &type;
1428       a[a_vals].value_len = sizeof type;
1429       a_vals++;
1430     }
1431
1432   rv = pkcs11_find_objects_init (module, pks, a, a_vals);
1433   if (rv != CKR_OK)
1434     {
1435       gnutls_assert ();
1436       _gnutls_debug_log ("pk11: FindObjectsInit failed.\n");
1437       ret = pkcs11_rv_to_err (rv);
1438       goto cleanup;
1439     }
1440
1441   while (pkcs11_find_objects (module, pks, &obj, 1, &count) == CKR_OK && count == 1)
1442     {
1443
1444       a[0].type = CKA_VALUE;
1445       a[0].value = cert_data;
1446       a[0].value_len = MAX_CERT_SIZE;
1447       a[1].type = CKA_LABEL;
1448       a[1].value = label_tmp;
1449       a[1].value_len = sizeof (label_tmp);
1450
1451       if (pkcs11_get_attribute_value (module, pks, obj, a, 2) == CKR_OK)
1452         {
1453           gnutls_datum_t id;
1454           gnutls_datum_t data = { a[0].value, a[0].value_len };
1455           gnutls_datum_t label = { a[1].value, a[1].value_len };
1456
1457           attr = p11_kit_uri_get_attribute (find_data->crt->info, CKA_ID);
1458           id.data = attr->value;
1459           id.size = attr->value_len;
1460
1461           if (class == CKO_PUBLIC_KEY)
1462             {
1463               ret =
1464                 pkcs11_obj_import_pubkey (module, pks, obj,
1465                                           find_data->crt,
1466                                           &id, &label,
1467                                           &info->tinfo, lib_info);
1468             }
1469           else
1470             {
1471               ret =
1472                 pkcs11_obj_import (class,
1473                                    find_data->crt,
1474                                    &data, &id, &label,
1475                                    &info->tinfo, lib_info);
1476             }
1477           if (ret < 0)
1478             {
1479               gnutls_assert ();
1480               goto cleanup;
1481             }
1482
1483           found = 1;
1484           break;
1485         }
1486       else
1487         {
1488           _gnutls_debug_log ("pk11: Skipped cert, missing attrs.\n");
1489         }
1490     }
1491
1492   if (found == 0)
1493     {
1494       gnutls_assert ();
1495       ret = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
1496     }
1497   else
1498     {
1499       ret = 0;
1500     }
1501
1502 cleanup:
1503   gnutls_free (cert_data);
1504   pkcs11_find_objects_final (module, pks);
1505
1506   return ret;
1507 }
1508
1509 unsigned int
1510 pkcs11_obj_flags_to_int (unsigned int flags)
1511 {
1512   unsigned int ret_flags = 0;
1513
1514   if (flags & GNUTLS_PKCS11_OBJ_FLAG_LOGIN)
1515     ret_flags |= SESSION_LOGIN;
1516   if (flags & GNUTLS_PKCS11_OBJ_FLAG_LOGIN_SO)
1517     ret_flags |= SESSION_LOGIN|SESSION_SO;
1518
1519   return ret_flags;
1520 }
1521
1522 /**
1523  * gnutls_pkcs11_privkey_import_url:
1524  * @cert: The structure to store the parsed certificate
1525  * @url: a PKCS 11 url identifying the key
1526  * @flags: One of GNUTLS_PKCS11_OBJ_* flags
1527  *
1528  * This function will "import" a PKCS 11 URL identifying a certificate
1529  * key to the #gnutls_pkcs11_obj_t structure. This does not involve any
1530  * parsing (such as X.509 or OpenPGP) since the #gnutls_pkcs11_obj_t is
1531  * format agnostic. Only data are transferred.
1532  *
1533  * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
1534  *   negative error value.
1535  **/
1536 int
1537 gnutls_pkcs11_obj_import_url (gnutls_pkcs11_obj_t cert, const char *url,
1538                               unsigned int flags)
1539 {
1540   int ret;
1541   struct url_find_data_st find_data;
1542
1543   /* fill in the find data structure */
1544   find_data.crt = cert;
1545
1546   ret = pkcs11_url_to_info (url, &cert->info);
1547   if (ret < 0)
1548     {
1549       gnutls_assert ();
1550       return ret;
1551     }
1552
1553   ret =
1554     _pkcs11_traverse_tokens (find_obj_url, &find_data, cert->info,
1555                              pkcs11_obj_flags_to_int (flags));
1556
1557   if (ret < 0)
1558     {
1559       gnutls_assert ();
1560       return ret;
1561     }
1562
1563   return 0;
1564 }
1565
1566 struct token_num
1567 {
1568   struct p11_kit_uri *info;
1569   unsigned int seq;             /* which one we are looking for */
1570   unsigned int current;         /* which one are we now */
1571 };
1572
1573 static int
1574 find_token_num (struct ck_function_list *module,
1575                 ck_session_handle_t pks,
1576                 struct token_info *tinfo,
1577                 struct ck_info *lib_info, void *input)
1578 {
1579   struct token_num *find_data = input;
1580
1581   if (tinfo == NULL)
1582     {                           /* we don't support multiple calls */
1583       gnutls_assert ();
1584       return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
1585     }
1586
1587   if (find_data->current == find_data->seq)
1588     {
1589       memcpy (p11_kit_uri_get_token_info (find_data->info), &tinfo->tinfo, sizeof (struct ck_token_info));
1590       memcpy (p11_kit_uri_get_module_info (find_data->info), lib_info, sizeof (struct ck_info));
1591       return 0;
1592     }
1593
1594   find_data->current++;
1595   /* search the token for the id */
1596
1597
1598   return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE; /* non zero is enough */
1599 }
1600
1601 /**
1602  * gnutls_pkcs11_token_get_url:
1603  * @seq: sequence number starting from 0
1604  * @detailed: non zero if a detailed URL is required
1605  * @url: will contain an allocated url
1606  *
1607  * This function will return the URL for each token available
1608  * in system. The url has to be released using gnutls_free()
1609  *
1610  * Returns: On success, %GNUTLS_E_SUCCESS is returned, %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
1611  * if the sequence number exceeds the available tokens, otherwise a negative error value.
1612  **/
1613
1614 int
1615 gnutls_pkcs11_token_get_url (unsigned int seq,
1616                              gnutls_pkcs11_url_type_t detailed, char **url)
1617 {
1618   int ret;
1619   struct token_num tn;
1620
1621   memset (&tn, 0, sizeof (tn));
1622   tn.seq = seq;
1623   tn.info = p11_kit_uri_new ();
1624
1625   ret = _pkcs11_traverse_tokens (find_token_num, &tn, NULL, 0);
1626   if (ret < 0)
1627     {
1628       p11_kit_uri_free (tn.info);
1629       gnutls_assert ();
1630       return ret;
1631     }
1632
1633   ret = pkcs11_info_to_url (tn.info, detailed, url);
1634   p11_kit_uri_free (tn.info);
1635
1636   if (ret < 0)
1637     {
1638       gnutls_assert ();
1639       return ret;
1640     }
1641
1642   return 0;
1643
1644 }
1645
1646 /**
1647  * gnutls_pkcs11_token_get_info:
1648  * @url: should contain a PKCS 11 URL
1649  * @ttype: Denotes the type of information requested
1650  * @output: where output will be stored
1651  * @output_size: contains the maximum size of the output and will be overwritten with actual
1652  *
1653  * This function will return information about the PKCS 11 token such
1654  * as the label, id as well as token information where the key is stored.
1655  *
1656  * Returns: zero on success or a negative value on error.
1657  **/
1658 int
1659 gnutls_pkcs11_token_get_info (const char *url,
1660                               gnutls_pkcs11_token_info_t ttype,
1661                               void *output, size_t * output_size)
1662 {
1663   struct p11_kit_uri *info = NULL;
1664   const char *str;
1665   size_t str_max;
1666   size_t len;
1667   int ret;
1668
1669   ret = pkcs11_url_to_info (url, &info);
1670   if (ret < 0)
1671     {
1672       gnutls_assert ();
1673       return ret;
1674     }
1675
1676   switch (ttype)
1677     {
1678     case GNUTLS_PKCS11_TOKEN_LABEL:
1679       str = p11_kit_uri_get_token_info (info)->label;
1680       str_max = 32;
1681       break;
1682     case GNUTLS_PKCS11_TOKEN_SERIAL:
1683       str = p11_kit_uri_get_token_info (info)->serial_number;
1684       str_max = 16;
1685       break;
1686     case GNUTLS_PKCS11_TOKEN_MANUFACTURER:
1687       str = p11_kit_uri_get_token_info (info)->manufacturer_id;
1688       str_max = 32;
1689       break;
1690     case GNUTLS_PKCS11_TOKEN_MODEL:
1691       str = p11_kit_uri_get_token_info (info)->model;
1692       str_max = 16;
1693       break;
1694     default:
1695       p11_kit_uri_free (info);
1696       gnutls_assert ();
1697       return GNUTLS_E_INVALID_REQUEST;
1698     }
1699
1700   len = p11_kit_space_strlen (str, str_max);
1701
1702   if (len + 1 > *output_size)
1703     {
1704       *output_size = len + 1;
1705       return GNUTLS_E_SHORT_MEMORY_BUFFER;
1706     }
1707
1708   memcpy (output, str, len);
1709   ((char*)output)[len] = '\0';
1710
1711   *output_size = len;
1712
1713   p11_kit_uri_free (info);
1714   return 0;
1715 }
1716
1717 /**
1718  * gnutls_pkcs11_obj_export_url:
1719  * @obj: Holds the PKCS 11 certificate
1720  * @detailed: non zero if a detailed URL is required
1721  * @url: will contain an allocated url
1722  *
1723  * This function will export a URL identifying the given certificate.
1724  *
1725  * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
1726  *   negative error value.
1727  **/
1728 int
1729 gnutls_pkcs11_obj_export_url (gnutls_pkcs11_obj_t obj,
1730                               gnutls_pkcs11_url_type_t detailed, char **url)
1731 {
1732   int ret;
1733
1734   ret = pkcs11_info_to_url (obj->info, detailed, url);
1735   if (ret < 0)
1736     {
1737       gnutls_assert ();
1738       return ret;
1739     }
1740
1741   return 0;
1742 }
1743
1744 /**
1745  * gnutls_pkcs11_obj_get_type:
1746  * @certificate: Holds the PKCS 11 certificate
1747  *
1748  * This function will return the type of the certificate being
1749  * stored in the structure.
1750  *
1751  * Returns: The type of the certificate.
1752  **/
1753 gnutls_pkcs11_obj_type_t
1754 gnutls_pkcs11_obj_get_type (gnutls_pkcs11_obj_t obj)
1755 {
1756   return obj->type;
1757 }
1758
1759 struct pkey_list
1760 {
1761   gnutls_buffer_st *key_ids;
1762   size_t key_ids_size;
1763 };
1764
1765
1766 static int
1767 retrieve_pin_for_pinfile (const char *pinfile, struct ck_token_info *token_info,
1768                           int attempts, ck_user_type_t user_type, struct p11_kit_pin **pin)
1769 {
1770   unsigned int flags = 0;
1771   struct p11_kit_uri *token_uri;
1772   struct p11_kit_pin *result;
1773   char *label;
1774
1775   label = p11_kit_space_strdup (token_info->label, sizeof (token_info->label));
1776   if (label == NULL)
1777     {
1778       gnutls_assert ();
1779       return GNUTLS_E_MEMORY_ERROR;
1780     }
1781
1782   token_uri = p11_kit_uri_new ();
1783   if (token_uri == NULL)
1784     {
1785       free (label);
1786       gnutls_assert ();
1787       return GNUTLS_E_MEMORY_ERROR;
1788     }
1789
1790   memcpy (p11_kit_uri_get_token_info (token_uri), token_info,
1791           sizeof (struct ck_token_info));
1792
1793   if (attempts)
1794     flags |= P11_KIT_PIN_FLAGS_RETRY;
1795   if (user_type == CKU_USER)
1796     {
1797       flags |= P11_KIT_PIN_FLAGS_USER_LOGIN;
1798       if (token_info->flags & CKF_USER_PIN_COUNT_LOW)
1799         flags |= P11_KIT_PIN_FLAGS_MANY_TRIES;
1800       if (token_info->flags & CKF_USER_PIN_FINAL_TRY)
1801         flags |= P11_KIT_PIN_FLAGS_FINAL_TRY;
1802     }
1803   else if (user_type == CKU_SO)
1804     {
1805       flags |= P11_KIT_PIN_FLAGS_SO_LOGIN;
1806       if (token_info->flags & CKF_SO_PIN_COUNT_LOW)
1807         flags |= P11_KIT_PIN_FLAGS_MANY_TRIES;
1808       if (token_info->flags & CKF_SO_PIN_FINAL_TRY)
1809         flags |= P11_KIT_PIN_FLAGS_FINAL_TRY;
1810     }
1811   else if (user_type == CKU_CONTEXT_SPECIFIC)
1812     {
1813       flags |= P11_KIT_PIN_FLAGS_CONTEXT_LOGIN;
1814     }
1815
1816   result = p11_kit_pin_request (pinfile, token_uri, label, flags);
1817   p11_kit_uri_free (token_uri);
1818   free (label);
1819
1820   if (result == NULL)
1821     {
1822       gnutls_assert ();
1823       return GNUTLS_E_PKCS11_PIN_ERROR;
1824     }
1825
1826   *pin = result;
1827   return 0;
1828 }
1829
1830 static int
1831 retrieve_pin_for_callback (struct ck_token_info *token_info, int attempts,
1832                            ck_user_type_t user_type, struct p11_kit_pin **pin)
1833 {
1834   char pin_value[GNUTLS_PKCS11_MAX_PIN_LEN];
1835   unsigned int flags = 0;
1836   char *token_str;
1837   char *label;
1838   struct p11_kit_uri *token_uri;
1839   int ret = 0;
1840
1841   label = p11_kit_space_strdup (token_info->label, sizeof (token_info->label));
1842   if (label == NULL)
1843     {
1844       gnutls_assert ();
1845       return GNUTLS_E_MEMORY_ERROR;
1846     }
1847
1848   token_uri = p11_kit_uri_new ();
1849   if (token_uri == NULL)
1850     {
1851       free (label);
1852       gnutls_assert ();
1853       return GNUTLS_E_MEMORY_ERROR;
1854     }
1855
1856   memcpy (p11_kit_uri_get_token_info (token_uri), token_info,
1857           sizeof (struct ck_token_info));
1858   ret = pkcs11_info_to_url (token_uri, 1, &token_str);
1859   p11_kit_uri_free (token_uri);
1860
1861   if (ret < 0)
1862     {
1863       free (label);
1864       gnutls_assert ();
1865       return GNUTLS_E_MEMORY_ERROR;
1866     }
1867
1868   if (user_type == CKU_USER)
1869     {
1870       flags |= GNUTLS_PKCS11_PIN_USER;
1871       if (token_info->flags & CKF_USER_PIN_COUNT_LOW)
1872         flags |= GNUTLS_PKCS11_PIN_COUNT_LOW;
1873       if (token_info->flags & CKF_USER_PIN_FINAL_TRY)
1874         flags |= GNUTLS_PKCS11_PIN_FINAL_TRY;
1875     }
1876   else if (user_type == CKU_SO)
1877     {
1878       flags |= GNUTLS_PKCS11_PIN_SO;
1879       if (token_info->flags & CKF_SO_PIN_COUNT_LOW)
1880         flags |= GNUTLS_PKCS11_PIN_COUNT_LOW;
1881       if (token_info->flags & CKF_SO_PIN_FINAL_TRY)
1882         flags |= GNUTLS_PKCS11_PIN_FINAL_TRY;
1883     }
1884
1885   if (attempts > 0)
1886     flags |= GNUTLS_PKCS11_PIN_WRONG;
1887
1888   ret = pin_func (pin_data, attempts, (char*)token_str, label,
1889                   flags, pin_value, GNUTLS_PKCS11_MAX_PIN_LEN);
1890   free (token_str);
1891   free (label);
1892
1893   if (ret < 0)
1894     return gnutls_assert_val(GNUTLS_E_PKCS11_PIN_ERROR);
1895
1896   *pin = p11_kit_pin_new_for_string (pin_value);
1897
1898   if (*pin == NULL)
1899     return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
1900
1901   return 0;
1902 }
1903
1904 static int
1905 retrieve_pin (struct p11_kit_uri *info, struct ck_token_info *token_info,
1906               int attempts, ck_user_type_t user_type, struct p11_kit_pin **pin)
1907 {
1908   const char *pinfile;
1909
1910   *pin = NULL;
1911
1912   /* Check if a pinfile is specified, and use that if possible */
1913   pinfile = p11_kit_uri_get_pinfile (info);
1914   if (pinfile != NULL)
1915     {
1916       _gnutls_debug_log("pk11: Using pinfile to retrieve PIN\n");
1917       return retrieve_pin_for_pinfile (pinfile, token_info, attempts, user_type, pin);
1918     }
1919
1920   /* The global gnutls pin callback */
1921   else if (pin_func)
1922     return retrieve_pin_for_callback (token_info, attempts, user_type, pin);
1923
1924   /* Otherwise, PIN entry is necessary for login, so fail if there's
1925    * no callback. */
1926   else
1927     {
1928       gnutls_assert ();
1929       _gnutls_debug_log ("pk11: No pin callback but login required.\n");
1930       return GNUTLS_E_PKCS11_ERROR;
1931     }
1932 }
1933
1934 int
1935 pkcs11_login (struct ck_function_list * module, ck_session_handle_t pks,
1936               const struct token_info *tokinfo, struct p11_kit_uri *info, int so)
1937 {
1938   struct ck_session_info session_info;
1939   int attempt = 0, ret;
1940   ck_user_type_t user_type;
1941   ck_rv_t rv;
1942
1943   user_type = (so == 0) ? CKU_USER : CKU_SO;
1944   if (so == 0 && (tokinfo->tinfo.flags & CKF_LOGIN_REQUIRED) == 0)
1945     {
1946       gnutls_assert ();
1947       _gnutls_debug_log ("pk11: No login required.\n");
1948       return 0;
1949     }
1950
1951   /* For a token with a "protected" (out-of-band) authentication
1952    * path, calling login with a NULL username is all that is
1953    * required. */
1954   if (tokinfo->tinfo.flags & CKF_PROTECTED_AUTHENTICATION_PATH)
1955     {
1956       rv = (module)->C_Login (pks, (so == 0) ? CKU_USER : CKU_SO, NULL, 0);
1957       if (rv == CKR_OK || rv == CKR_USER_ALREADY_LOGGED_IN)
1958         {
1959           return 0;
1960         }
1961       else
1962         {
1963           gnutls_assert ();
1964           _gnutls_debug_log ("pk11: Protected login failed.\n");
1965           ret = GNUTLS_E_PKCS11_ERROR;
1966           goto cleanup;
1967         }
1968     }
1969
1970   do
1971     {
1972       struct p11_kit_pin *pin;
1973       struct ck_token_info tinfo;
1974
1975       memcpy (&tinfo, &tokinfo->tinfo, sizeof(tinfo));
1976
1977       /* Check whether the session is already logged in, and if so, just skip */
1978       rv = (module)->C_GetSessionInfo (pks, &session_info);
1979       if (rv == CKR_OK && (session_info.state == CKS_RO_USER_FUNCTIONS ||
1980                            session_info.state == CKS_RW_USER_FUNCTIONS))
1981         {
1982           ret = 0;
1983           goto cleanup;
1984         }
1985
1986       /* If login has been attempted once already, check the token
1987        * status again, the flags might change. */
1988       if (attempt)
1989         {
1990           if (pkcs11_get_token_info
1991               (tokinfo->prov->module, tokinfo->sid, &tinfo) != CKR_OK)
1992             {
1993               gnutls_assert ();
1994               _gnutls_debug_log ("pk11: GetTokenInfo failed\n");
1995               ret = GNUTLS_E_PKCS11_ERROR;
1996               goto cleanup;
1997             }
1998         }
1999
2000       ret = retrieve_pin (info, &tinfo, attempt++, user_type, &pin);
2001       if (ret < 0)
2002         {
2003           gnutls_assert ();
2004           goto cleanup;
2005         }
2006
2007       rv = (module)->C_Login (pks, user_type,
2008                               (unsigned char *)p11_kit_pin_get_value (pin, NULL),
2009                               p11_kit_pin_get_length (pin));
2010
2011       p11_kit_pin_unref (pin);
2012     }
2013   while (rv == CKR_PIN_INCORRECT);
2014
2015   _gnutls_debug_log ("pk11: Login result = %lu\n", rv);
2016
2017
2018   ret = (rv == CKR_OK
2019          || rv == CKR_USER_ALREADY_LOGGED_IN) ? 0 : pkcs11_rv_to_err (rv);
2020
2021 cleanup:
2022   return ret;
2023 }
2024
2025 int
2026 pkcs11_call_token_func (struct p11_kit_uri *info, const unsigned retry)
2027 {
2028   struct ck_token_info *tinfo;
2029   char *label;
2030   int ret = 0;
2031
2032   tinfo = p11_kit_uri_get_token_info (info);
2033   label = p11_kit_space_strdup (tinfo->label, sizeof (tinfo->label));
2034   ret = (token_func) (token_data, label, retry);
2035   free (label);
2036
2037   return ret;
2038 }
2039
2040
2041 static int
2042 find_privkeys (struct ck_function_list *module, ck_session_handle_t pks,
2043                struct token_info *info, struct pkey_list *list)
2044 {
2045   struct ck_attribute a[3];
2046   ck_object_class_t class;
2047   ck_rv_t rv;
2048   ck_object_handle_t obj;
2049   unsigned long count, current;
2050   char certid_tmp[PKCS11_ID_SIZE];
2051
2052   class = CKO_PRIVATE_KEY;
2053
2054   /* Find an object with private key class and a certificate ID
2055    * which matches the certificate. */
2056   /* FIXME: also match the cert subject. */
2057   a[0].type = CKA_CLASS;
2058   a[0].value = &class;
2059   a[0].value_len = sizeof class;
2060
2061   rv = pkcs11_find_objects_init (module, pks, a, 1);
2062   if (rv != CKR_OK)
2063     {
2064       gnutls_assert ();
2065       return pkcs11_rv_to_err (rv);
2066     }
2067
2068   list->key_ids_size = 0;
2069   while (pkcs11_find_objects (module, pks, &obj, 1, &count) == CKR_OK && count == 1)
2070     {
2071       list->key_ids_size++;
2072     }
2073
2074   pkcs11_find_objects_final (module, pks);
2075
2076   if (list->key_ids_size == 0)
2077     {
2078       gnutls_assert ();
2079       return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
2080     }
2081
2082   list->key_ids =
2083     gnutls_malloc (sizeof (gnutls_buffer_st) * list->key_ids_size);
2084   if (list->key_ids == NULL)
2085     {
2086       gnutls_assert ();
2087       return GNUTLS_E_MEMORY_ERROR;
2088     }
2089
2090   /* actual search */
2091   a[0].type = CKA_CLASS;
2092   a[0].value = &class;
2093   a[0].value_len = sizeof class;
2094
2095   rv = pkcs11_find_objects_init (module, pks, a, 1);
2096   if (rv != CKR_OK)
2097     {
2098       gnutls_assert ();
2099       return pkcs11_rv_to_err (rv);
2100     }
2101
2102   current = 0;
2103   while (pkcs11_find_objects (module, pks, &obj, 1, &count) == CKR_OK && count == 1)
2104     {
2105
2106       a[0].type = CKA_ID;
2107       a[0].value = certid_tmp;
2108       a[0].value_len = sizeof (certid_tmp);
2109
2110       _gnutls_buffer_init (&list->key_ids[current]);
2111
2112       if (pkcs11_get_attribute_value (module, pks, obj, a, 1) == CKR_OK)
2113         {
2114           _gnutls_buffer_append_data (&list->key_ids[current],
2115                                       a[0].value, a[0].value_len);
2116           current++;
2117         }
2118
2119       if (current > list->key_ids_size)
2120         break;
2121     }
2122
2123   pkcs11_find_objects_final (module, pks);
2124
2125   list->key_ids_size = current - 1;
2126
2127   return 0;
2128 }
2129
2130 /* Recover certificate list from tokens */
2131
2132
2133 static int
2134 find_objs (struct ck_function_list * module, ck_session_handle_t pks,
2135            struct token_info *info, struct ck_info *lib_info, void *input)
2136 {
2137   struct crt_find_data_st *find_data = input;
2138   struct ck_attribute a[4];
2139   struct ck_attribute *attr;
2140   ck_object_class_t class = -1;
2141   ck_certificate_type_t type = -1;
2142   unsigned int trusted;
2143   ck_rv_t rv;
2144   ck_object_handle_t obj;
2145   unsigned long count;
2146   opaque *cert_data;
2147   char certid_tmp[PKCS11_ID_SIZE];
2148   char label_tmp[PKCS11_LABEL_SIZE];
2149   int ret, i;
2150   struct pkey_list plist;       /* private key holder */
2151   int tot_values = 0;
2152
2153   if (info == NULL)
2154     {                           /* final call */
2155       if (find_data->current <= *find_data->n_list)
2156         ret = 0;
2157       else
2158         ret = GNUTLS_E_SHORT_MEMORY_BUFFER;
2159
2160       *find_data->n_list = find_data->current;
2161
2162       return ret;
2163     }
2164
2165   /* do not bother reading the token if basic fields do not match
2166    */
2167   if (!p11_kit_uri_match_token_info (find_data->info, &info->tinfo) ||
2168       !p11_kit_uri_match_module_info (find_data->info, lib_info))
2169     {
2170       gnutls_assert ();
2171       return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
2172     }
2173
2174   memset (&plist, 0, sizeof (plist));
2175
2176   if (find_data->flags == GNUTLS_PKCS11_OBJ_ATTR_CRT_WITH_PRIVKEY)
2177     {
2178       ret = find_privkeys (module, pks, info, &plist);
2179       if (ret < 0)
2180         {
2181           gnutls_assert ();
2182           return ret;
2183         }
2184
2185       if (plist.key_ids_size == 0)
2186         {
2187           gnutls_assert ();
2188           return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
2189         }
2190     }
2191
2192   cert_data = gnutls_malloc (MAX_CERT_SIZE);
2193   if (cert_data == NULL)
2194     {
2195       gnutls_assert ();
2196       return GNUTLS_E_MEMORY_ERROR;
2197     }
2198
2199   /* Find objects with cert class and X.509 cert type. */
2200
2201   tot_values = 0;
2202
2203   if (find_data->flags == GNUTLS_PKCS11_OBJ_ATTR_CRT_ALL
2204       || find_data->flags == GNUTLS_PKCS11_OBJ_ATTR_CRT_WITH_PRIVKEY)
2205     {
2206       class = CKO_CERTIFICATE;
2207       type = CKC_X_509;
2208       trusted = 1;
2209
2210       a[tot_values].type = CKA_CLASS;
2211       a[tot_values].value = &class;
2212       a[tot_values].value_len = sizeof class;
2213       tot_values++;
2214
2215       a[tot_values].type = CKA_CERTIFICATE_TYPE;
2216       a[tot_values].value = &type;
2217       a[tot_values].value_len = sizeof type;
2218       tot_values++;
2219
2220     }
2221   else if (find_data->flags == GNUTLS_PKCS11_OBJ_ATTR_CRT_TRUSTED)
2222     {
2223       class = CKO_CERTIFICATE;
2224       type = CKC_X_509;
2225       trusted = 1;
2226
2227       a[tot_values].type = CKA_CLASS;
2228       a[tot_values].value = &class;
2229       a[tot_values].value_len = sizeof class;
2230       tot_values++;
2231
2232       a[tot_values].type = CKA_TRUSTED;
2233       a[tot_values].value = &trusted;
2234       a[tot_values].value_len = sizeof trusted;
2235       tot_values++;
2236
2237     }
2238   else if (find_data->flags == GNUTLS_PKCS11_OBJ_ATTR_PUBKEY)
2239     {
2240       class = CKO_PUBLIC_KEY;
2241
2242       a[tot_values].type = CKA_CLASS;
2243       a[tot_values].value = &class;
2244       a[tot_values].value_len = sizeof class;
2245       tot_values++;
2246     }
2247   else if (find_data->flags == GNUTLS_PKCS11_OBJ_ATTR_PRIVKEY)
2248     {
2249       class = CKO_PRIVATE_KEY;
2250
2251       a[tot_values].type = CKA_CLASS;
2252       a[tot_values].value = &class;
2253       a[tot_values].value_len = sizeof class;
2254       tot_values++;
2255     }
2256   else if (find_data->flags == GNUTLS_PKCS11_OBJ_ATTR_ALL)
2257     {
2258       if (class != -1)
2259         {
2260           a[tot_values].type = CKA_CLASS;
2261           a[tot_values].value = &class;
2262           a[tot_values].value_len = sizeof class;
2263           tot_values++;
2264         }
2265       if (type != -1)
2266         {
2267           a[tot_values].type = CKA_CERTIFICATE_TYPE;
2268           a[tot_values].value = &type;
2269           a[tot_values].value_len = sizeof type;
2270           tot_values++;
2271         }
2272     }
2273   else
2274     {
2275       gnutls_assert ();
2276       ret = GNUTLS_E_INVALID_REQUEST;
2277       goto fail;
2278     }
2279
2280   attr = p11_kit_uri_get_attribute (find_data->info, CKA_ID);
2281   if (attr != NULL)
2282     {
2283       memcpy (a + tot_values, attr, sizeof (struct ck_attribute));
2284       tot_values++;
2285     }
2286
2287   rv = pkcs11_find_objects_init (module, pks, a, tot_values);
2288   if (rv != CKR_OK)
2289     {
2290       gnutls_assert ();
2291       _gnutls_debug_log ("pk11: FindObjectsInit failed.\n");
2292       return pkcs11_rv_to_err (rv);
2293     }
2294
2295   while (pkcs11_find_objects (module, pks, &obj, 1, &count) == CKR_OK && count == 1)
2296     {
2297       gnutls_datum_t label, id, value;
2298
2299       a[0].type = CKA_LABEL;
2300       a[0].value = label_tmp;
2301       a[0].value_len = sizeof label_tmp;
2302
2303       if (pkcs11_get_attribute_value (module, pks, obj, a, 1) == CKR_OK)
2304         {
2305           label.data = a[0].value;
2306           label.size = a[0].value_len;
2307         }
2308       else
2309         {
2310           label.data = NULL;
2311           label.size = 0;
2312         }
2313
2314       a[0].type = CKA_ID;
2315       a[0].value = certid_tmp;
2316       a[0].value_len = sizeof certid_tmp;
2317
2318       if (pkcs11_get_attribute_value (module, pks, obj, a, 1) == CKR_OK)
2319         {
2320           id.data = a[0].value;
2321           id.size = a[0].value_len;
2322         }
2323       else
2324         {
2325           id.data = NULL;
2326           id.size = 0;
2327         }
2328
2329       a[0].type = CKA_VALUE;
2330       a[0].value = cert_data;
2331       a[0].value_len = MAX_CERT_SIZE;
2332       if (pkcs11_get_attribute_value (module, pks, obj, a, 1) == CKR_OK)
2333         {
2334           value.data = a[0].value;
2335           value.size = a[0].value_len;
2336         }
2337       else
2338         {
2339           value.data = NULL;
2340           value.size = 0;
2341         }
2342
2343       if (find_data->flags == GNUTLS_PKCS11_OBJ_ATTR_ALL)
2344         {
2345           a[0].type = CKA_CLASS;
2346           a[0].value = &class;
2347           a[0].value_len = sizeof class;
2348
2349           pkcs11_get_attribute_value (module, pks, obj, a, 1);
2350         }
2351
2352       if (find_data->flags == GNUTLS_PKCS11_OBJ_ATTR_CRT_WITH_PRIVKEY)
2353         {
2354           for (i = 0; i < plist.key_ids_size; i++)
2355             {
2356               if (plist.key_ids[i].length !=
2357                   a[1].value_len
2358                   || memcmp (plist.key_ids[i].data,
2359                              a[1].value, a[1].value_len) != 0)
2360                 {
2361                   /* not found */
2362                   continue;
2363                 }
2364             }
2365         }
2366
2367       if (find_data->current < *find_data->n_list)
2368         {
2369           ret =
2370             gnutls_pkcs11_obj_init (&find_data->p_list[find_data->current]);
2371           if (ret < 0)
2372             {
2373               gnutls_assert ();
2374               goto fail;
2375             }
2376
2377           if (class == CKO_PUBLIC_KEY)
2378             {
2379               ret =
2380                 pkcs11_obj_import_pubkey (module, pks, obj,
2381                                           find_data->p_list
2382                                           [find_data->current],
2383                                           &id, &label,
2384                                           &info->tinfo, lib_info);
2385             }
2386           else
2387             {
2388               ret =
2389                 pkcs11_obj_import (class,
2390                                    find_data->p_list
2391                                    [find_data->current],
2392                                    &value, &id, &label,
2393                                    &info->tinfo, lib_info);
2394             }
2395           if (ret < 0)
2396             {
2397               gnutls_assert ();
2398               goto fail;
2399             }
2400         }
2401
2402       find_data->current++;
2403
2404     }
2405
2406   gnutls_free (cert_data);
2407   pkcs11_find_objects_final (module, pks);
2408
2409   return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE; /* continue until all tokens have been checked */
2410
2411 fail:
2412   gnutls_free (cert_data);
2413   pkcs11_find_objects_final (module, pks);
2414   if (plist.key_ids != NULL)
2415     {
2416       for (i = 0; i < plist.key_ids_size; i++)
2417         {
2418           _gnutls_buffer_clear (&plist.key_ids[i]);
2419         }
2420       gnutls_free (plist.key_ids);
2421     }
2422   for (i = 0; i < find_data->current; i++)
2423     {
2424       gnutls_pkcs11_obj_deinit (find_data->p_list[i]);
2425     }
2426   find_data->current = 0;
2427
2428   return ret;
2429 }
2430
2431 /**
2432  * gnutls_pkcs11_obj_list_import_url:
2433  * @p_list: An uninitialized object list (may be NULL)
2434  * @n_list: initially should hold the maximum size of the list. Will contain the actual size.
2435  * @url: A PKCS 11 url identifying a set of objects
2436  * @attrs: Attributes of type #gnutls_pkcs11_obj_attr_t that can be used to limit output
2437  * @flags: One of GNUTLS_PKCS11_OBJ_* flags
2438  *
2439  * This function will initialize and set values to an object list
2440  * by using all objects identified by a PKCS 11 URL.
2441  *
2442  * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
2443  *   negative error value.
2444  **/
2445 int
2446 gnutls_pkcs11_obj_list_import_url (gnutls_pkcs11_obj_t * p_list,
2447                                    unsigned int *n_list,
2448                                    const char *url,
2449                                    gnutls_pkcs11_obj_attr_t attrs,
2450                                    unsigned int flags)
2451 {
2452   int ret;
2453   struct crt_find_data_st find_data;
2454
2455   memset (&find_data, 0, sizeof (find_data));
2456
2457   /* fill in the find data structure */
2458   find_data.p_list = p_list;
2459   find_data.n_list = n_list;
2460   find_data.flags = attrs;
2461   find_data.current = 0;
2462
2463   if (url == NULL || url[0] == 0)
2464     {
2465       url = "pkcs11:";
2466     }
2467
2468   ret = pkcs11_url_to_info (url, &find_data.info);
2469   if (ret < 0)
2470     {
2471       gnutls_assert ();
2472       return ret;
2473     }
2474
2475   ret =
2476     _pkcs11_traverse_tokens (find_objs, &find_data, find_data.info,
2477                              pkcs11_obj_flags_to_int (flags));
2478   p11_kit_uri_free (find_data.info);
2479
2480   if (ret < 0)
2481     {
2482       gnutls_assert ();
2483       return ret;
2484     }
2485
2486   return 0;
2487 }
2488
2489 /**
2490  * gnutls_x509_crt_import_pkcs11_url:
2491  * @crt: A certificate of type #gnutls_x509_crt_t
2492  * @url: A PKCS 11 url
2493  * @flags: One of GNUTLS_PKCS11_OBJ_* flags
2494  *
2495  * This function will import a PKCS 11 certificate directly from a token
2496  * without involving the #gnutls_pkcs11_obj_t structure. This function will
2497  * fail if the certificate stored is not of X.509 type.
2498  *
2499  * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
2500  *   negative error value.
2501  **/
2502 int
2503 gnutls_x509_crt_import_pkcs11_url (gnutls_x509_crt_t crt,
2504                                    const char *url, unsigned int flags)
2505 {
2506   gnutls_pkcs11_obj_t pcrt;
2507   int ret;
2508
2509   ret = gnutls_pkcs11_obj_init (&pcrt);
2510   if (ret < 0)
2511     {
2512       gnutls_assert ();
2513       return ret;
2514     }
2515
2516   ret = gnutls_pkcs11_obj_import_url (pcrt, url, flags);
2517   if (ret < 0)
2518     {
2519       gnutls_assert ();
2520       goto cleanup;
2521     }
2522
2523   ret = gnutls_x509_crt_import (crt, &pcrt->raw, GNUTLS_X509_FMT_DER);
2524   if (ret < 0)
2525     {
2526       gnutls_assert ();
2527       goto cleanup;
2528     }
2529
2530   ret = 0;
2531 cleanup:
2532
2533   gnutls_pkcs11_obj_deinit (pcrt);
2534
2535   return ret;
2536 }
2537
2538
2539 /**
2540  * gnutls_x509_crt_import_pkcs11:
2541  * @crt: A certificate of type #gnutls_x509_crt_t
2542  * @pkcs11_crt: A PKCS 11 object that contains a certificate
2543  *
2544  * This function will import a PKCS 11 certificate to a #gnutls_x509_crt_t
2545  * structure.
2546  *
2547  * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
2548  *   negative error value.
2549  **/
2550 int
2551 gnutls_x509_crt_import_pkcs11 (gnutls_x509_crt_t crt,
2552                                gnutls_pkcs11_obj_t pkcs11_crt)
2553 {
2554   return gnutls_x509_crt_import (crt, &pkcs11_crt->raw, GNUTLS_X509_FMT_DER);
2555 }
2556
2557 /**
2558  * gnutls_x509_crt_list_import_pkcs11:
2559  * @certs: A list of certificates of type #gnutls_x509_crt_t
2560  * @cert_max: The maximum size of the list
2561  * @objs: A list of PKCS 11 objects
2562  * @flags: 0 for now
2563  *
2564  * This function will import a PKCS 11 certificate list to a list of
2565  * #gnutls_x509_crt_t structure. These must not be initialized.
2566  *
2567  * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
2568  *   negative error value.
2569  **/
2570 int
2571 gnutls_x509_crt_list_import_pkcs11 (gnutls_x509_crt_t * certs,
2572                                     unsigned int cert_max,
2573                                     gnutls_pkcs11_obj_t * const objs,
2574                                     unsigned int flags)
2575 {
2576   int i, j;
2577   int ret;
2578
2579   for (i = 0; i < cert_max; i++)
2580     {
2581       ret = gnutls_x509_crt_init (&certs[i]);
2582       if (ret < 0)
2583         {
2584           gnutls_assert ();
2585           goto cleanup;
2586         }
2587
2588       ret = gnutls_x509_crt_import_pkcs11 (certs[i], objs[i]);
2589       if (ret < 0)
2590         {
2591           gnutls_assert ();
2592           goto cleanup;
2593         }
2594     }
2595
2596   return 0;
2597
2598 cleanup:
2599   for (j = 0; j < i; j++)
2600     {
2601       gnutls_x509_crt_deinit (certs[j]);
2602     }
2603
2604   return ret;
2605 }
2606
2607 static int
2608 find_flags (struct ck_function_list * module, ck_session_handle_t pks,
2609             struct token_info *info, struct ck_info *lib_info, void *input)
2610 {
2611   struct flags_find_data_st *find_data = input;
2612
2613   if (info == NULL)
2614     {                           /* we don't support multiple calls */
2615       gnutls_assert ();
2616       return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
2617     }
2618
2619   /* do not bother reading the token if basic fields do not match
2620    */
2621   if (!p11_kit_uri_match_token_info (find_data->info, &info->tinfo) ||
2622       !p11_kit_uri_match_module_info (find_data->info, lib_info))
2623     {
2624       gnutls_assert ();
2625       return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
2626     }
2627
2628   /* found token! */
2629
2630   find_data->slot_flags = info->sinfo.flags;
2631
2632   return 0;
2633 }
2634
2635 /**
2636  * gnutls_pkcs11_token_get_flags:
2637  * @url: should contain a PKCS 11 URL
2638  * @flags: The output flags (GNUTLS_PKCS11_TOKEN_*)
2639  *
2640  * This function will return information about the PKCS 11 token flags.
2641  *
2642  * Returns: zero on success or a negative value on error.
2643  **/
2644 int
2645 gnutls_pkcs11_token_get_flags (const char *url, unsigned int *flags)
2646 {
2647   struct flags_find_data_st find_data;
2648   int ret;
2649
2650   memset (&find_data, 0, sizeof (find_data));
2651   ret = pkcs11_url_to_info (url, &find_data.info);
2652   if (ret < 0)
2653     {
2654       gnutls_assert ();
2655       return ret;
2656     }
2657
2658   ret = _pkcs11_traverse_tokens (find_flags, &find_data, find_data.info, 0);
2659   p11_kit_uri_free (find_data.info);
2660
2661   if (ret < 0)
2662     {
2663       gnutls_assert ();
2664       return ret;
2665     }
2666
2667   *flags = 0;
2668   if (find_data.slot_flags & CKF_HW_SLOT)
2669     *flags |= GNUTLS_PKCS11_TOKEN_HW;
2670
2671   return 0;
2672
2673 }
2674
2675
2676 /**
2677  * gnutls_pkcs11_token_get_mechanism:
2678  * @url: should contain a PKCS 11 URL
2679  * @idx: The index of the mechanism
2680  * @mechanism: The PKCS #11 mechanism ID
2681  *
2682  * This function will return the names of the supported mechanisms
2683  * by the token. It should be called with an increasing index until
2684  * it return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE.
2685  *
2686  * Returns: zero on success or a negative value on error.
2687  **/
2688 int
2689 gnutls_pkcs11_token_get_mechanism (const char *url, int idx,
2690                                    unsigned long *mechanism)
2691 {
2692   int ret;
2693   ck_rv_t rv;
2694   struct ck_function_list *module;
2695   ck_slot_id_t slot;
2696   struct token_info tinfo;
2697   struct p11_kit_uri *info = NULL;
2698   unsigned long count;
2699   ck_mechanism_type_t mlist[400];
2700
2701   ret = pkcs11_url_to_info (url, &info);
2702   if (ret < 0)
2703     {
2704       gnutls_assert ();
2705       return ret;
2706     }
2707
2708
2709   ret = pkcs11_find_slot (&module, &slot, info, &tinfo);
2710   p11_kit_uri_free (info);
2711
2712   if (ret < 0)
2713     {
2714       gnutls_assert ();
2715       return ret;
2716     }
2717
2718   count = sizeof (mlist) / sizeof (mlist[0]);
2719   rv = pkcs11_get_mechanism_list (module, slot, mlist, &count);
2720   if (rv != CKR_OK)
2721     {
2722       gnutls_assert ();
2723       return pkcs11_rv_to_err (rv);
2724     }
2725
2726   if (idx >= count)
2727     {
2728       gnutls_assert ();
2729       return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
2730     }
2731
2732   *mechanism = mlist[idx];
2733
2734   return 0;
2735
2736 }
2737
2738
2739 const char *
2740 gnutls_pkcs11_type_get_name (gnutls_pkcs11_obj_type_t type)
2741 {
2742   switch (type)
2743     {
2744     case GNUTLS_PKCS11_OBJ_X509_CRT:
2745       return "X.509 Certificate";
2746     case GNUTLS_PKCS11_OBJ_PUBKEY:
2747       return "Public key";
2748     case GNUTLS_PKCS11_OBJ_PRIVKEY:
2749       return "Private key";
2750     case GNUTLS_PKCS11_OBJ_SECRET_KEY:
2751       return "Secret key";
2752     case GNUTLS_PKCS11_OBJ_DATA:
2753       return "Data";
2754     case GNUTLS_PKCS11_OBJ_UNKNOWN:
2755     default:
2756       return "Unknown";
2757     }
2758 }
2759
2760 ck_rv_t
2761 pkcs11_get_slot_list (struct ck_function_list * module, unsigned char token_present,
2762                       ck_slot_id_t *slot_list, unsigned long *count)
2763 {
2764         return (module)->C_GetSlotList (token_present, slot_list, count);
2765 }
2766
2767 ck_rv_t
2768 pkcs11_get_module_info (struct ck_function_list * module,
2769                         struct ck_info * info)
2770 {
2771         return (module)->C_GetInfo (info);
2772 }
2773
2774 ck_rv_t
2775 pkcs11_get_slot_info(struct ck_function_list * module,
2776                      ck_slot_id_t slot_id,
2777                      struct ck_slot_info *info)
2778 {
2779         return (module)->C_GetSlotInfo (slot_id, info);
2780 }
2781
2782 ck_rv_t
2783 pkcs11_get_token_info (struct ck_function_list * module,
2784                        ck_slot_id_t slot_id,
2785                        struct ck_token_info *info)
2786 {
2787         return (module)->C_GetTokenInfo (slot_id, info);
2788 }
2789
2790 ck_rv_t
2791 pkcs11_find_objects_init (struct ck_function_list *module,
2792                           ck_session_handle_t sess,
2793                           struct ck_attribute *templ,
2794                           unsigned long count)
2795 {
2796         return (module)->C_FindObjectsInit (sess, templ, count);
2797 }
2798
2799 ck_rv_t
2800 pkcs11_find_objects (struct ck_function_list *module,
2801                        ck_session_handle_t sess,
2802                        ck_object_handle_t *objects,
2803                        unsigned long max_object_count,
2804                        unsigned long *object_count)
2805 {
2806         return (module)->C_FindObjects (sess, objects, max_object_count, object_count);
2807 }
2808
2809 ck_rv_t
2810 pkcs11_find_objects_final (struct ck_function_list *module,
2811                            ck_session_handle_t sess)
2812 {
2813         return (module)->C_FindObjectsFinal (sess);
2814 }
2815
2816 ck_rv_t
2817 pkcs11_close_session (struct ck_function_list *module,
2818                       ck_session_handle_t sess)
2819 {
2820         return (module)->C_CloseSession (sess);
2821 }
2822
2823 ck_rv_t
2824 pkcs11_get_attribute_value(struct ck_function_list *module,
2825                            ck_session_handle_t sess,
2826                            ck_object_handle_t object,
2827                            struct ck_attribute *templ,
2828                            unsigned long count)
2829 {
2830         return (module)->C_GetAttributeValue (sess, object, templ, count);
2831 }
2832
2833 ck_rv_t
2834 pkcs11_get_mechanism_list (struct ck_function_list *module,
2835                            ck_slot_id_t slot_id,
2836                            ck_mechanism_type_t *mechanism_list,
2837                            unsigned long *count)
2838 {
2839         return (module)->C_GetMechanismList (slot_id, mechanism_list, count);
2840 }
2841
2842 ck_rv_t
2843 pkcs11_sign_init (struct ck_function_list *module,
2844                   ck_session_handle_t sess,
2845                   struct ck_mechanism *mechanism,
2846                   ck_object_handle_t key)
2847 {
2848         return (module)->C_SignInit (sess, mechanism, key);
2849 }
2850
2851 ck_rv_t
2852 pkcs11_sign (struct ck_function_list *module,
2853              ck_session_handle_t sess,
2854              unsigned char *data,
2855              unsigned long data_len,
2856              unsigned char *signature,
2857              unsigned long *signature_len)
2858 {
2859         return (module)->C_Sign (sess, data, data_len, signature, signature_len);
2860 }
2861
2862 ck_rv_t
2863 pkcs11_decrypt_init (struct ck_function_list *module,
2864                      ck_session_handle_t sess,
2865                      struct ck_mechanism *mechanism,
2866                      ck_object_handle_t key)
2867 {
2868         return (module)->C_DecryptInit (sess, mechanism, key);
2869 }
2870
2871 ck_rv_t
2872 pkcs11_decrypt (struct ck_function_list *module,
2873                 ck_session_handle_t sess,
2874                 unsigned char *encrypted_data,
2875                 unsigned long encrypted_data_len,
2876                 unsigned char *data, unsigned long *data_len)
2877 {
2878         return (module)->C_Decrypt (sess, encrypted_data, encrypted_data_len,
2879                                     data, data_len);
2880 }
2881
2882 ck_rv_t
2883 pkcs11_create_object (struct ck_function_list *module,
2884                       ck_session_handle_t sess,
2885                       struct ck_attribute *templ,
2886                       unsigned long count,
2887                       ck_object_handle_t *object)
2888 {
2889         return (module)->C_CreateObject (sess, templ, count, object);
2890 }
2891
2892 ck_rv_t
2893 pkcs11_destroy_object (struct ck_function_list *module,
2894                        ck_session_handle_t sess,
2895                        ck_object_handle_t object)
2896 {
2897         return (module)->C_DestroyObject (sess, object);
2898 }
2899
2900 ck_rv_t
2901 pkcs11_init_token (struct ck_function_list *module,
2902                    ck_slot_id_t slot_id, unsigned char *pin,
2903                    unsigned long pin_len, unsigned char *label)
2904 {
2905         return (module)->C_InitToken (slot_id, pin, pin_len, label);
2906 }
2907
2908 ck_rv_t
2909 pkcs11_init_pin (struct ck_function_list *module,
2910                  ck_session_handle_t sess,
2911                  unsigned char *pin,
2912                  unsigned long pin_len)
2913 {
2914         return (module)->C_InitPIN (sess, pin, pin_len);
2915 }
2916
2917 ck_rv_t
2918 pkcs11_set_pin (struct ck_function_list *module,
2919                 ck_session_handle_t sess,
2920                 unsigned char *old_pin,
2921                 unsigned long old_len,
2922                 unsigned char *new_pin,
2923                 unsigned long new_len)
2924 {
2925         return (module)->C_SetPIN (sess, old_pin, old_len, new_pin, new_len);
2926 }
2927
2928 const char *
2929 pkcs11_strerror (ck_rv_t rv)
2930 {
2931         return p11_kit_strerror (rv);
2932 }