2 * Copyright (c) 2004 - 2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
46 #define P11_SESSION_IN_USE 2
47 #define P11_LOGIN_REQ 4
48 #define P11_LOGIN_DONE 8
49 #define P11_TOKEN_PRESENT 16
50 CK_SESSION_HANDLE session
;
57 CK_MECHANISM_TYPE_PTR list
;
59 CK_MECHANISM_INFO_PTR
*infos
;
65 CK_FUNCTION_LIST_PTR funcs
;
68 struct p11_slot
*slot
;
71 #define P11FUNC(module,f,args) (*(module)->funcs->C_##f)args
73 static int p11_get_session(hx509_context
,
78 static int p11_put_session(struct p11_module
*,
81 static void p11_release_module(struct p11_module
*);
83 static int p11_list_keys(hx509_context
,
96 struct p11_slot
*slot
;
97 CK_OBJECT_HANDLE private_key
;
98 CK_OBJECT_HANDLE public_key
;
102 p11_rsa_public_encrypt(int flen
,
103 const unsigned char *from
,
112 p11_rsa_public_decrypt(int flen
,
113 const unsigned char *from
,
123 p11_rsa_private_encrypt(int flen
,
124 const unsigned char *from
,
129 struct p11_rsa
*p11rsa
= RSA_get_app_data(rsa
);
130 CK_OBJECT_HANDLE key
= p11rsa
->private_key
;
131 CK_SESSION_HANDLE session
;
132 CK_MECHANISM mechanism
;
136 if (padding
!= RSA_PKCS1_PADDING
)
139 memset(&mechanism
, 0, sizeof(mechanism
));
140 mechanism
.mechanism
= CKM_RSA_PKCS
;
142 ck_sigsize
= RSA_size(rsa
);
144 ret
= p11_get_session(NULL
, p11rsa
->p
, p11rsa
->slot
, NULL
, &session
);
148 ret
= P11FUNC(p11rsa
->p
, SignInit
, (session
, &mechanism
, key
));
150 p11_put_session(p11rsa
->p
, p11rsa
->slot
, session
);
154 ret
= P11FUNC(p11rsa
->p
, Sign
,
155 (session
, (CK_BYTE
*)(intptr_t)from
, flen
, to
, &ck_sigsize
));
156 p11_put_session(p11rsa
->p
, p11rsa
->slot
, session
);
164 p11_rsa_private_decrypt(int flen
, const unsigned char *from
, unsigned char *to
,
165 RSA
* rsa
, int padding
)
167 struct p11_rsa
*p11rsa
= RSA_get_app_data(rsa
);
168 CK_OBJECT_HANDLE key
= p11rsa
->private_key
;
169 CK_SESSION_HANDLE session
;
170 CK_MECHANISM mechanism
;
174 if (padding
!= RSA_PKCS1_PADDING
)
177 memset(&mechanism
, 0, sizeof(mechanism
));
178 mechanism
.mechanism
= CKM_RSA_PKCS
;
180 ck_sigsize
= RSA_size(rsa
);
182 ret
= p11_get_session(NULL
, p11rsa
->p
, p11rsa
->slot
, NULL
, &session
);
186 ret
= P11FUNC(p11rsa
->p
, DecryptInit
, (session
, &mechanism
, key
));
188 p11_put_session(p11rsa
->p
, p11rsa
->slot
, session
);
192 ret
= P11FUNC(p11rsa
->p
, Decrypt
,
193 (session
, (CK_BYTE
*)(intptr_t)from
, flen
, to
, &ck_sigsize
));
194 p11_put_session(p11rsa
->p
, p11rsa
->slot
, session
);
202 p11_rsa_init(RSA
*rsa
)
208 p11_rsa_finish(RSA
*rsa
)
210 struct p11_rsa
*p11rsa
= RSA_get_app_data(rsa
);
211 p11_release_module(p11rsa
->p
);
216 static const RSA_METHOD p11_rsa_pkcs1_method
= {
217 "hx509 PKCS11 PKCS#1 RSA",
218 p11_rsa_public_encrypt
,
219 p11_rsa_public_decrypt
,
220 p11_rsa_private_encrypt
,
221 p11_rsa_private_decrypt
,
238 p11_mech_info(hx509_context context
,
239 struct p11_module
*p
,
240 struct p11_slot
*slot
,
246 ret
= P11FUNC(p
, GetMechanismList
, (slot
->id
, NULL_PTR
, &i
));
248 hx509_set_error_string(context
, 0, HX509_PKCS11_NO_MECH
,
249 "Failed to get mech list count for slot %d",
251 return HX509_PKCS11_NO_MECH
;
254 hx509_set_error_string(context
, 0, HX509_PKCS11_NO_MECH
,
255 "no mech supported for slot %d", num
);
256 return HX509_PKCS11_NO_MECH
;
258 slot
->mechs
.list
= calloc(i
, sizeof(slot
->mechs
.list
[0]));
259 if (slot
->mechs
.list
== NULL
) {
260 hx509_set_error_string(context
, 0, ENOMEM
,
265 ret
= P11FUNC(p
, GetMechanismList
, (slot
->id
, slot
->mechs
.list
, &i
));
267 hx509_set_error_string(context
, 0, HX509_PKCS11_NO_MECH
,
268 "Failed to get mech list for slot %d",
270 return HX509_PKCS11_NO_MECH
;
272 assert(i
== slot
->mechs
.num
);
274 slot
->mechs
.infos
= calloc(i
, sizeof(*slot
->mechs
.infos
));
275 if (slot
->mechs
.list
== NULL
) {
276 hx509_set_error_string(context
, 0, ENOMEM
,
281 for (i
= 0; i
< slot
->mechs
.num
; i
++) {
282 slot
->mechs
.infos
[i
] = calloc(1, sizeof(*(slot
->mechs
.infos
[0])));
283 if (slot
->mechs
.infos
[i
] == NULL
) {
284 hx509_set_error_string(context
, 0, ENOMEM
,
288 ret
= P11FUNC(p
, GetMechanismInfo
, (slot
->id
, slot
->mechs
.list
[i
],
289 slot
->mechs
.infos
[i
]));
291 hx509_set_error_string(context
, 0, HX509_PKCS11_NO_MECH
,
292 "Failed to get mech info for slot %d",
294 return HX509_PKCS11_NO_MECH
;
302 p11_init_slot(hx509_context context
,
303 struct p11_module
*p
,
307 struct p11_slot
*slot
)
309 CK_SESSION_HANDLE session
;
310 CK_SLOT_INFO slot_info
;
311 CK_TOKEN_INFO token_info
;
318 ret
= P11FUNC(p
, GetSlotInfo
, (slot
->id
, &slot_info
));
320 hx509_set_error_string(context
, 0, HX509_PKCS11_TOKEN_CONFUSED
,
321 "Failed to init PKCS11 slot %d",
323 return HX509_PKCS11_TOKEN_CONFUSED
;
326 for (i
= sizeof(slot_info
.slotDescription
) - 1; i
> 0; i
--) {
327 char c
= slot_info
.slotDescription
[i
];
328 if (c
== ' ' || c
== '\t' || c
== '\n' || c
== '\r' || c
== '\0')
334 ret
= asprintf(&slot
->name
, "%.*s", (int)i
,
335 slot_info
.slotDescription
);
339 if ((slot_info
.flags
& CKF_TOKEN_PRESENT
) == 0)
342 ret
= P11FUNC(p
, GetTokenInfo
, (slot
->id
, &token_info
));
344 hx509_set_error_string(context
, 0, HX509_PKCS11_NO_TOKEN
,
345 "Failed to init PKCS11 slot %d "
348 return HX509_PKCS11_NO_TOKEN
;
350 slot
->flags
|= P11_TOKEN_PRESENT
;
352 if (token_info
.flags
& CKF_LOGIN_REQUIRED
)
353 slot
->flags
|= P11_LOGIN_REQ
;
355 ret
= p11_get_session(context
, p
, slot
, lock
, &session
);
359 ret
= p11_mech_info(context
, p
, slot
, num
);
363 ret
= p11_list_keys(context
, p
, slot
, session
, lock
, &slot
->certs
);
365 p11_put_session(p
, slot
, session
);
371 p11_get_session(hx509_context context
,
372 struct p11_module
*p
,
373 struct p11_slot
*slot
,
375 CK_SESSION_HANDLE
*psession
)
379 if (slot
->flags
& P11_SESSION_IN_USE
)
380 _hx509_abort("slot already in session");
382 if (slot
->flags
& P11_SESSION
) {
383 slot
->flags
|= P11_SESSION_IN_USE
;
384 *psession
= slot
->session
;
388 ret
= P11FUNC(p
, OpenSession
, (slot
->id
,
395 hx509_set_error_string(context
, 0, HX509_PKCS11_OPEN_SESSION
,
396 "Failed to OpenSession for slot id %d "
397 "with error: 0x%08x",
399 return HX509_PKCS11_OPEN_SESSION
;
402 slot
->flags
|= P11_SESSION
;
405 * If we have have to login, and haven't tried before and have a
406 * prompter or known to work pin code.
408 * This code is very conversative and only uses the prompter in
409 * the hx509_lock, the reason is that it's bad to try many
410 * passwords on a pkcs11 token, it might lock up and have to be
411 * unlocked by a administrator.
413 * XXX try harder to not use pin several times on the same card.
416 if ( (slot
->flags
& P11_LOGIN_REQ
)
417 && (slot
->flags
& P11_LOGIN_DONE
) == 0
418 && (lock
|| slot
->pin
))
424 if (slot
->pin
== NULL
) {
426 memset(&prompt
, 0, sizeof(prompt
));
428 ret
= asprintf(&str
, "PIN code for %s: ", slot
->name
);
429 if (ret
== -1 || str
== NULL
) {
431 hx509_set_error_string(context
, 0, ENOMEM
, "out of memory");
435 prompt
.type
= HX509_PROMPT_TYPE_PASSWORD
;
436 prompt
.reply
.data
= pin
;
437 prompt
.reply
.length
= sizeof(pin
);
439 ret
= hx509_lock_prompt(lock
, &prompt
);
443 hx509_set_error_string(context
, 0, ret
,
444 "Failed to get pin code for slot "
445 "id %d with error: %d",
451 strlcpy(pin
, slot
->pin
, sizeof(pin
));
454 ret
= P11FUNC(p
, Login
, (slot
->session
, CKU_USER
,
455 (unsigned char*)pin
, strlen(pin
)));
458 hx509_set_error_string(context
, 0, HX509_PKCS11_LOGIN
,
459 "Failed to login on slot id %d "
460 "with error: 0x%08x",
462 return HX509_PKCS11_LOGIN
;
464 slot
->flags
|= P11_LOGIN_DONE
;
466 if (slot
->pin
== NULL
) {
467 slot
->pin
= strdup(pin
);
468 if (slot
->pin
== NULL
) {
470 hx509_set_error_string(context
, 0, ENOMEM
,
476 slot
->flags
|= P11_LOGIN_DONE
;
478 slot
->flags
|= P11_SESSION_IN_USE
;
480 *psession
= slot
->session
;
486 p11_put_session(struct p11_module
*p
,
487 struct p11_slot
*slot
,
488 CK_SESSION_HANDLE session
)
490 if ((slot
->flags
& P11_SESSION_IN_USE
) == 0)
491 _hx509_abort("slot not in session");
492 slot
->flags
&= ~P11_SESSION_IN_USE
;
498 iterate_entries(hx509_context context
,
499 struct p11_module
*p
, struct p11_slot
*slot
,
500 CK_SESSION_HANDLE session
,
501 CK_ATTRIBUTE
*search_data
, int num_search_data
,
502 CK_ATTRIBUTE
*query
, int num_query
,
503 int (*func
)(hx509_context
,
504 struct p11_module
*, struct p11_slot
*,
505 CK_SESSION_HANDLE session
,
506 CK_OBJECT_HANDLE object
,
507 void *, CK_ATTRIBUTE
*, int), void *ptr
)
509 CK_OBJECT_HANDLE object
;
510 CK_ULONG object_count
;
513 ret
= P11FUNC(p
, FindObjectsInit
, (session
, search_data
, num_search_data
));
518 ret
= P11FUNC(p
, FindObjects
, (session
, &object
, 1, &object_count
));
522 if (object_count
== 0)
525 for (i
= 0; i
< num_query
; i
++)
526 query
[i
].pValue
= NULL
;
528 ret
= P11FUNC(p
, GetAttributeValue
,
529 (session
, object
, query
, num_query
));
533 for (i
= 0; i
< num_query
; i
++) {
534 query
[i
].pValue
= malloc(query
[i
].ulValueLen
);
535 if (query
[i
].pValue
== NULL
) {
540 ret
= P11FUNC(p
, GetAttributeValue
,
541 (session
, object
, query
, num_query
));
547 ret
= (*func
)(context
, p
, slot
, session
, object
, ptr
, query
, num_query
);
551 for (i
= 0; i
< num_query
; i
++) {
553 free(query
[i
].pValue
);
554 query
[i
].pValue
= NULL
;
559 for (i
= 0; i
< num_query
; i
++) {
561 free(query
[i
].pValue
);
562 query
[i
].pValue
= NULL
;
565 ret2
= P11FUNC(p
, FindObjectsFinal
, (session
));
566 if (ret2
!= CKR_OK
) {
574 getattr_bn(struct p11_module
*p
,
575 struct p11_slot
*slot
,
576 CK_SESSION_HANDLE session
,
577 CK_OBJECT_HANDLE object
,
586 query
.ulValueLen
= 0;
588 ret
= P11FUNC(p
, GetAttributeValue
,
589 (session
, object
, &query
, 1));
593 query
.pValue
= malloc(query
.ulValueLen
);
595 ret
= P11FUNC(p
, GetAttributeValue
,
596 (session
, object
, &query
, 1));
601 bn
= BN_bin2bn(query
.pValue
, query
.ulValueLen
, NULL
);
608 collect_private_key(hx509_context context
,
609 struct p11_module
*p
, struct p11_slot
*slot
,
610 CK_SESSION_HANDLE session
,
611 CK_OBJECT_HANDLE object
,
612 void *ptr
, CK_ATTRIBUTE
*query
, int num_query
)
614 struct hx509_collector
*collector
= ptr
;
615 hx509_private_key key
;
616 heim_octet_string localKeyId
;
619 struct p11_rsa
*p11rsa
;
621 localKeyId
.data
= query
[0].pValue
;
622 localKeyId
.length
= query
[0].ulValueLen
;
624 ret
= hx509_private_key_init(&key
, NULL
, NULL
);
630 _hx509_abort("out of memory");
633 * The exponent and modulus should always be present according to
634 * the pkcs11 specification, but some smartcards leaves it out,
635 * let ignore any failure to fetch it.
637 rsa
->n
= getattr_bn(p
, slot
, session
, object
, CKA_MODULUS
);
638 rsa
->e
= getattr_bn(p
, slot
, session
, object
, CKA_PUBLIC_EXPONENT
);
640 p11rsa
= calloc(1, sizeof(*p11rsa
));
642 _hx509_abort("out of memory");
646 p11rsa
->private_key
= object
;
649 _hx509_abort("pkcs11 ref == 0 on alloc");
651 if (p
->ref
== UINT_MAX
)
652 _hx509_abort("pkcs11 ref == UINT_MAX on alloc");
654 RSA_set_method(rsa
, &p11_rsa_pkcs1_method
);
655 ret
= RSA_set_app_data(rsa
, p11rsa
);
657 _hx509_abort("RSA_set_app_data");
659 hx509_private_key_assign_rsa(key
, rsa
);
661 ret
= _hx509_collector_private_key_add(context
,
663 hx509_signature_rsa(),
669 hx509_private_key_free(&key
);
676 p11_cert_release(hx509_cert cert
, void *ctx
)
678 struct p11_module
*p
= ctx
;
679 p11_release_module(p
);
684 collect_cert(hx509_context context
,
685 struct p11_module
*p
, struct p11_slot
*slot
,
686 CK_SESSION_HANDLE session
,
687 CK_OBJECT_HANDLE object
,
688 void *ptr
, CK_ATTRIBUTE
*query
, int num_query
)
690 struct hx509_collector
*collector
= ptr
;
691 heim_error_t error
= NULL
;
695 if ((CK_LONG
)query
[0].ulValueLen
== -1 ||
696 (CK_LONG
)query
[1].ulValueLen
== -1)
701 cert
= hx509_cert_init_data(context
, query
[1].pValue
,
702 query
[1].ulValueLen
, &error
);
704 ret
= heim_error_get_code(error
);
710 _hx509_abort("pkcs11 ref == 0 on alloc");
712 if (p
->ref
== UINT_MAX
)
713 _hx509_abort("pkcs11 ref to high");
715 _hx509_cert_set_release(cert
, p11_cert_release
, p
);
718 heim_octet_string data
;
720 data
.data
= query
[0].pValue
;
721 data
.length
= query
[0].ulValueLen
;
723 _hx509_set_cert_attribute(context
,
725 &asn1_oid_id_pkcs_9_at_localKeyId
,
729 if ((CK_LONG
)query
[2].ulValueLen
!= -1) {
732 ret
= asprintf(&str
, "%.*s",
733 (int)query
[2].ulValueLen
, (char *)query
[2].pValue
);
734 if (ret
!= -1 && str
) {
735 hx509_cert_set_friendly_name(cert
, str
);
740 ret
= _hx509_collector_certs_add(context
, collector
, cert
);
741 hx509_cert_free(cert
);
748 p11_list_keys(hx509_context context
,
749 struct p11_module
*p
,
750 struct p11_slot
*slot
,
751 CK_SESSION_HANDLE session
,
755 struct hx509_collector
*collector
;
756 CK_OBJECT_CLASS key_class
;
757 CK_ATTRIBUTE search_data
[] = {
758 {CKA_CLASS
, NULL
, 0},
760 CK_ATTRIBUTE query_data
[3] = {
762 {CKA_VALUE
, NULL
, 0},
767 search_data
[0].pValue
= &key_class
;
768 search_data
[0].ulValueLen
= sizeof(key_class
);
771 lock
= _hx509_empty_lock
;
773 ret
= _hx509_collector_alloc(context
, lock
, &collector
);
777 key_class
= CKO_PRIVATE_KEY
;
778 ret
= iterate_entries(context
, p
, slot
, session
,
781 collect_private_key
, collector
);
785 key_class
= CKO_CERTIFICATE
;
786 ret
= iterate_entries(context
, p
, slot
, session
,
789 collect_cert
, collector
);
793 ret
= _hx509_collector_collect_certs(context
, collector
, &slot
->certs
);
796 _hx509_collector_free(collector
);
803 p11_init(hx509_context context
,
804 hx509_certs certs
, void **data
, int flags
,
805 const char *residue
, hx509_lock lock
)
807 CK_C_GetFunctionList getFuncs
;
808 struct p11_module
*p
;
814 list
= strdup(residue
);
818 p
= calloc(1, sizeof(*p
));
826 str
= strchr(list
, ',');
831 strnext
= strchr(str
, ',');
835 if (strncasecmp(str
, "slot=", 5) == 0)
836 p
->selected_slot
= atoi(str
+ 5);
841 p
->dl_handle
= dlopen(list
, RTLD_NOW
);
843 if (p
->dl_handle
== NULL
) {
844 ret
= HX509_PKCS11_LOAD
;
845 hx509_set_error_string(context
, 0, ret
,
846 "Failed to open %s: %s", list
, dlerror());
850 getFuncs
= (CK_C_GetFunctionList
) dlsym(p
->dl_handle
, "C_GetFunctionList");
851 if (getFuncs
== NULL
) {
852 ret
= HX509_PKCS11_LOAD
;
853 hx509_set_error_string(context
, 0, ret
,
854 "C_GetFunctionList missing in %s: %s",
859 ret
= (*getFuncs
)(&p
->funcs
);
861 ret
= HX509_PKCS11_LOAD
;
862 hx509_set_error_string(context
, 0, ret
,
863 "C_GetFunctionList failed in %s", list
);
867 ret
= P11FUNC(p
, Initialize
, (NULL_PTR
));
869 ret
= HX509_PKCS11_TOKEN_CONFUSED
;
870 hx509_set_error_string(context
, 0, ret
,
871 "Failed initialize the PKCS11 module");
875 ret
= P11FUNC(p
, GetSlotList
, (FALSE
, NULL
, &p
->num_slots
));
877 ret
= HX509_PKCS11_TOKEN_CONFUSED
;
878 hx509_set_error_string(context
, 0, ret
,
879 "Failed to get number of PKCS11 slots");
883 if (p
->num_slots
== 0) {
884 ret
= HX509_PKCS11_NO_SLOT
;
885 hx509_set_error_string(context
, 0, ret
,
886 "Selected PKCS11 module have no slots");
892 CK_SLOT_ID_PTR slot_ids
;
896 slot_ids
= malloc(p
->num_slots
* sizeof(*slot_ids
));
897 if (slot_ids
== NULL
) {
898 hx509_clear_error_string(context
);
903 ret
= P11FUNC(p
, GetSlotList
, (FALSE
, slot_ids
, &p
->num_slots
));
906 hx509_set_error_string(context
, 0, HX509_PKCS11_TOKEN_CONFUSED
,
907 "Failed getting slot-list from "
909 ret
= HX509_PKCS11_TOKEN_CONFUSED
;
913 p
->slot
= calloc(p
->num_slots
, sizeof(p
->slot
[0]));
914 if (p
->slot
== NULL
) {
916 hx509_set_error_string(context
, 0, ENOMEM
,
917 "Failed to get memory for slot-list");
922 for (i
= 0; i
< p
->num_slots
; i
++) {
923 ret
= p11_init_slot(context
, p
, lock
, slot_ids
[i
], i
, &p
->slot
[i
]);
926 if (p
->slot
[i
].flags
& P11_TOKEN_PRESENT
)
932 if (num_tokens
== 0) {
933 ret
= HX509_PKCS11_NO_TOKEN
;
942 p11_release_module(p
);
947 p11_release_module(struct p11_module
*p
)
952 _hx509_abort("pkcs11 ref to low");
956 for (i
= 0; i
< p
->num_slots
; i
++) {
957 if (p
->slot
[i
].flags
& P11_SESSION_IN_USE
)
958 _hx509_abort("pkcs11 module release while session in use");
959 if (p
->slot
[i
].flags
& P11_SESSION
) {
960 P11FUNC(p
, CloseSession
, (p
->slot
[i
].session
));
964 free(p
->slot
[i
].name
);
965 if (p
->slot
[i
].pin
) {
966 memset(p
->slot
[i
].pin
, 0, strlen(p
->slot
[i
].pin
));
967 free(p
->slot
[i
].pin
);
969 if (p
->slot
[i
].mechs
.num
) {
970 free(p
->slot
[i
].mechs
.list
);
972 if (p
->slot
[i
].mechs
.infos
) {
975 for (j
= 0 ; j
< p
->slot
[i
].mechs
.num
; j
++)
976 free(p
->slot
[i
].mechs
.infos
[j
]);
977 free(p
->slot
[i
].mechs
.infos
);
984 P11FUNC(p
, Finalize
, (NULL
));
987 dlclose(p
->dl_handle
);
989 memset(p
, 0, sizeof(*p
));
994 p11_free(hx509_certs certs
, void *data
)
996 struct p11_module
*p
= data
;
999 for (i
= 0; i
< p
->num_slots
; i
++) {
1000 if (p
->slot
[i
].certs
)
1001 hx509_certs_free(&p
->slot
[i
].certs
);
1003 p11_release_module(p
);
1013 p11_iter_start(hx509_context context
,
1014 hx509_certs certs
, void *data
, void **cursor
)
1016 struct p11_module
*p
= data
;
1017 struct p11_cursor
*c
;
1021 c
= malloc(sizeof(*c
));
1023 hx509_clear_error_string(context
);
1026 ret
= hx509_certs_init(context
, "MEMORY:pkcs11-iter", 0, NULL
, &c
->certs
);
1032 for (i
= 0 ; i
< p
->num_slots
; i
++) {
1033 if (p
->slot
[i
].certs
== NULL
)
1035 ret
= hx509_certs_merge(context
, c
->certs
, p
->slot
[i
].certs
);
1037 hx509_certs_free(&c
->certs
);
1043 ret
= hx509_certs_start_seq(context
, c
->certs
, &c
->cursor
);
1045 hx509_certs_free(&c
->certs
);
1055 p11_iter(hx509_context context
,
1056 hx509_certs certs
, void *data
, void *cursor
, hx509_cert
*cert
)
1058 struct p11_cursor
*c
= cursor
;
1059 return hx509_certs_next_cert(context
, c
->certs
, c
->cursor
, cert
);
1063 p11_iter_end(hx509_context context
,
1064 hx509_certs certs
, void *data
, void *cursor
)
1066 struct p11_cursor
*c
= cursor
;
1068 ret
= hx509_certs_end_seq(context
, c
->certs
, c
->cursor
);
1069 hx509_certs_free(&c
->certs
);
1074 #define MECHFLAG(x) { "unknown-flag-" #x, x }
1075 static struct units mechflags
[] = {
1076 MECHFLAG(0x80000000),
1077 MECHFLAG(0x40000000),
1078 MECHFLAG(0x20000000),
1079 MECHFLAG(0x10000000),
1080 MECHFLAG(0x08000000),
1081 MECHFLAG(0x04000000),
1082 {"ec-compress", 0x2000000 },
1083 {"ec-uncompress", 0x1000000 },
1084 {"ec-namedcurve", 0x0800000 },
1085 {"ec-ecparameters", 0x0400000 },
1086 {"ec-f-2m", 0x0200000 },
1087 {"ec-f-p", 0x0100000 },
1088 {"derive", 0x0080000 },
1089 {"unwrap", 0x0040000 },
1090 {"wrap", 0x0020000 },
1091 {"genereate-key-pair", 0x0010000 },
1092 {"generate", 0x0008000 },
1093 {"verify-recover", 0x0004000 },
1094 {"verify", 0x0002000 },
1095 {"sign-recover", 0x0001000 },
1096 {"sign", 0x0000800 },
1097 {"digest", 0x0000400 },
1098 {"decrypt", 0x0000200 },
1099 {"encrypt", 0x0000100 },
1113 p11_printinfo(hx509_context context
,
1116 int (*func
)(void *, const char *),
1119 struct p11_module
*p
= data
;
1122 _hx509_pi_printf(func
, ctx
, "pkcs11 driver with %d slot%s",
1123 p
->num_slots
, p
->num_slots
> 1 ? "s" : "");
1125 for (i
= 0; i
< p
->num_slots
; i
++) {
1126 struct p11_slot
*s
= &p
->slot
[i
];
1128 _hx509_pi_printf(func
, ctx
, "slot %d: id: %d name: %s flags: %08x",
1129 i
, (int)s
->id
, s
->name
, s
->flags
);
1131 _hx509_pi_printf(func
, ctx
, "number of supported mechanisms: %lu",
1132 (unsigned long)s
->mechs
.num
);
1133 for (j
= 0; j
< s
->mechs
.num
; j
++) {
1134 const char *mechname
= "unknown";
1135 char flags
[256], unknownname
[40];
1136 #define MECHNAME(s,n) case s: mechname = n; break
1137 switch(s
->mechs
.list
[j
]) {
1138 MECHNAME(CKM_RSA_PKCS_KEY_PAIR_GEN
, "rsa-pkcs-key-pair-gen");
1139 MECHNAME(CKM_RSA_PKCS
, "rsa-pkcs");
1140 MECHNAME(CKM_RSA_X_509
, "rsa-x-509");
1141 MECHNAME(CKM_MD5_RSA_PKCS
, "md5-rsa-pkcs");
1142 MECHNAME(CKM_SHA1_RSA_PKCS
, "sha1-rsa-pkcs");
1143 MECHNAME(CKM_SHA256_RSA_PKCS
, "sha256-rsa-pkcs");
1144 MECHNAME(CKM_SHA384_RSA_PKCS
, "sha384-rsa-pkcs");
1145 MECHNAME(CKM_SHA512_RSA_PKCS
, "sha512-rsa-pkcs");
1146 MECHNAME(CKM_RIPEMD160_RSA_PKCS
, "ripemd160-rsa-pkcs");
1147 MECHNAME(CKM_RSA_PKCS_OAEP
, "rsa-pkcs-oaep");
1148 MECHNAME(CKM_SHA512_HMAC
, "sha512-hmac");
1149 MECHNAME(CKM_SHA512
, "sha512");
1150 MECHNAME(CKM_SHA384_HMAC
, "sha384-hmac");
1151 MECHNAME(CKM_SHA384
, "sha384");
1152 MECHNAME(CKM_SHA256_HMAC
, "sha256-hmac");
1153 MECHNAME(CKM_SHA256
, "sha256");
1154 MECHNAME(CKM_SHA_1
, "sha1");
1155 MECHNAME(CKM_MD5
, "md5");
1156 MECHNAME(CKM_RIPEMD160
, "ripemd-160");
1157 MECHNAME(CKM_DES_ECB
, "des-ecb");
1158 MECHNAME(CKM_DES_CBC
, "des-cbc");
1159 MECHNAME(CKM_AES_ECB
, "aes-ecb");
1160 MECHNAME(CKM_AES_CBC
, "aes-cbc");
1161 MECHNAME(CKM_DH_PKCS_PARAMETER_GEN
, "dh-pkcs-parameter-gen");
1163 snprintf(unknownname
, sizeof(unknownname
),
1165 (unsigned long)s
->mechs
.list
[j
]);
1166 mechname
= unknownname
;
1170 unparse_flags(s
->mechs
.infos
[j
]->flags
, mechflags
,
1171 flags
, sizeof(flags
));
1173 _hx509_pi_printf(func
, ctx
, " %s: %s", mechname
, flags
);
1180 static struct hx509_keyset_ops keyset_pkcs11
= {
1196 #endif /* HAVE_DLOPEN */
1199 _hx509_ks_pkcs11_register(hx509_context context
)
1202 _hx509_ks_register(context
, &keyset_pkcs11
);