2 * Copyright (c) 2004 - 2006 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
47 #define P11_SESSION_IN_USE 2
48 #define P11_LOGIN_REQ 4
49 #define P11_LOGIN_DONE 8
50 #define P11_TOKEN_PRESENT 16
51 CK_SESSION_HANDLE session
;
58 CK_MECHANISM_TYPE_PTR list
;
60 CK_MECHANISM_INFO_PTR
*infos
;
66 CK_FUNCTION_LIST_PTR funcs
;
69 struct p11_slot
*slot
;
72 #define P11FUNC(module,f,args) (*(module)->funcs->C_##f)args
74 static int p11_get_session(hx509_context
,
79 static int p11_put_session(struct p11_module
*,
82 static void p11_release_module(struct p11_module
*);
84 static int p11_list_keys(hx509_context
,
97 struct p11_slot
*slot
;
98 CK_OBJECT_HANDLE private_key
;
99 CK_OBJECT_HANDLE public_key
;
103 p11_rsa_public_encrypt(int flen
,
104 const unsigned char *from
,
113 p11_rsa_public_decrypt(int flen
,
114 const unsigned char *from
,
124 p11_rsa_private_encrypt(int flen
,
125 const unsigned char *from
,
130 struct p11_rsa
*p11rsa
= RSA_get_app_data(rsa
);
131 CK_OBJECT_HANDLE key
= p11rsa
->private_key
;
132 CK_SESSION_HANDLE session
;
133 CK_MECHANISM mechanism
;
137 if (padding
!= RSA_PKCS1_PADDING
)
140 memset(&mechanism
, 0, sizeof(mechanism
));
141 mechanism
.mechanism
= CKM_RSA_PKCS
;
143 ck_sigsize
= RSA_size(rsa
);
145 ret
= p11_get_session(NULL
, p11rsa
->p
, p11rsa
->slot
, NULL
, &session
);
149 ret
= P11FUNC(p11rsa
->p
, SignInit
, (session
, &mechanism
, key
));
151 p11_put_session(p11rsa
->p
, p11rsa
->slot
, session
);
155 ret
= P11FUNC(p11rsa
->p
, Sign
,
156 (session
, (CK_BYTE
*)from
, flen
, to
, &ck_sigsize
));
157 p11_put_session(p11rsa
->p
, p11rsa
->slot
, session
);
165 p11_rsa_private_decrypt(int flen
, const unsigned char *from
, unsigned char *to
,
166 RSA
* rsa
, int padding
)
168 struct p11_rsa
*p11rsa
= RSA_get_app_data(rsa
);
169 CK_OBJECT_HANDLE key
= p11rsa
->private_key
;
170 CK_SESSION_HANDLE session
;
171 CK_MECHANISM mechanism
;
175 if (padding
!= RSA_PKCS1_PADDING
)
178 memset(&mechanism
, 0, sizeof(mechanism
));
179 mechanism
.mechanism
= CKM_RSA_PKCS
;
181 ck_sigsize
= RSA_size(rsa
);
183 ret
= p11_get_session(NULL
, p11rsa
->p
, p11rsa
->slot
, NULL
, &session
);
187 ret
= P11FUNC(p11rsa
->p
, DecryptInit
, (session
, &mechanism
, key
));
189 p11_put_session(p11rsa
->p
, p11rsa
->slot
, session
);
193 ret
= P11FUNC(p11rsa
->p
, Decrypt
,
194 (session
, (CK_BYTE
*)from
, flen
, to
, &ck_sigsize
));
195 p11_put_session(p11rsa
->p
, p11rsa
->slot
, session
);
203 p11_rsa_init(RSA
*rsa
)
209 p11_rsa_finish(RSA
*rsa
)
211 struct p11_rsa
*p11rsa
= RSA_get_app_data(rsa
);
212 p11_release_module(p11rsa
->p
);
217 static const RSA_METHOD p11_rsa_pkcs1_method
= {
218 "hx509 PKCS11 PKCS#1 RSA",
219 p11_rsa_public_encrypt
,
220 p11_rsa_public_decrypt
,
221 p11_rsa_private_encrypt
,
222 p11_rsa_private_decrypt
,
238 p11_mech_info(hx509_context context
,
239 struct p11_module
*p
,
240 struct p11_slot
*slot
,
246 ret
= P11FUNC(p
, GetMechanismList
, (slot
->id
, NULL_PTR
, &i
));
248 hx509_set_error_string(context
, 0, HX509_PKCS11_NO_MECH
,
249 "Failed to get mech list count for slot %d",
251 return HX509_PKCS11_NO_MECH
;
254 hx509_set_error_string(context
, 0, HX509_PKCS11_NO_MECH
,
255 "no mech supported for slot %d", num
);
256 return HX509_PKCS11_NO_MECH
;
258 slot
->mechs
.list
= calloc(i
, sizeof(slot
->mechs
.list
[0]));
259 if (slot
->mechs
.list
== NULL
) {
260 hx509_set_error_string(context
, 0, ENOMEM
,
265 ret
= P11FUNC(p
, GetMechanismList
, (slot
->id
, slot
->mechs
.list
, &i
));
267 hx509_set_error_string(context
, 0, HX509_PKCS11_NO_MECH
,
268 "Failed to get mech list for slot %d",
270 return HX509_PKCS11_NO_MECH
;
272 assert(i
== slot
->mechs
.num
);
274 slot
->mechs
.infos
= calloc(i
, sizeof(*slot
->mechs
.infos
));
275 if (slot
->mechs
.list
== NULL
) {
276 hx509_set_error_string(context
, 0, ENOMEM
,
281 for (i
= 0; i
< slot
->mechs
.num
; i
++) {
282 slot
->mechs
.infos
[i
] = calloc(1, sizeof(*(slot
->mechs
.infos
[0])));
283 if (slot
->mechs
.infos
[i
] == NULL
) {
284 hx509_set_error_string(context
, 0, ENOMEM
,
288 ret
= P11FUNC(p
, GetMechanismInfo
, (slot
->id
, slot
->mechs
.list
[i
],
289 slot
->mechs
.infos
[i
]));
291 hx509_set_error_string(context
, 0, HX509_PKCS11_NO_MECH
,
292 "Failed to get mech info for slot %d",
294 return HX509_PKCS11_NO_MECH
;
302 p11_init_slot(hx509_context context
,
303 struct p11_module
*p
,
307 struct p11_slot
*slot
)
309 CK_SESSION_HANDLE session
;
310 CK_SLOT_INFO slot_info
;
311 CK_TOKEN_INFO token_info
;
318 ret
= P11FUNC(p
, GetSlotInfo
, (slot
->id
, &slot_info
));
320 hx509_set_error_string(context
, 0, HX509_PKCS11_TOKEN_CONFUSED
,
321 "Failed to init PKCS11 slot %d",
323 return HX509_PKCS11_TOKEN_CONFUSED
;
326 for (i
= sizeof(slot_info
.slotDescription
) - 1; i
> 0; i
--) {
327 char c
= slot_info
.slotDescription
[i
];
328 if (c
== ' ' || c
== '\t' || c
== '\n' || c
== '\r' || c
== '\0')
334 asprintf(&slot
->name
, "%.*s",
335 i
, slot_info
.slotDescription
);
337 if ((slot_info
.flags
& CKF_TOKEN_PRESENT
) == 0)
340 ret
= P11FUNC(p
, GetTokenInfo
, (slot
->id
, &token_info
));
342 hx509_set_error_string(context
, 0, HX509_PKCS11_NO_TOKEN
,
343 "Failed to init PKCS11 slot %d "
346 return HX509_PKCS11_NO_TOKEN
;
348 slot
->flags
|= P11_TOKEN_PRESENT
;
350 if (token_info
.flags
& CKF_LOGIN_REQUIRED
)
351 slot
->flags
|= P11_LOGIN_REQ
;
353 ret
= p11_get_session(context
, p
, slot
, lock
, &session
);
357 ret
= p11_mech_info(context
, p
, slot
, num
);
361 ret
= p11_list_keys(context
, p
, slot
, session
, lock
, &slot
->certs
);
363 p11_put_session(p
, slot
, session
);
369 p11_get_session(hx509_context context
,
370 struct p11_module
*p
,
371 struct p11_slot
*slot
,
373 CK_SESSION_HANDLE
*psession
)
377 if (slot
->flags
& P11_SESSION_IN_USE
)
378 _hx509_abort("slot already in session");
380 if (slot
->flags
& P11_SESSION
) {
381 slot
->flags
|= P11_SESSION_IN_USE
;
382 *psession
= slot
->session
;
386 ret
= P11FUNC(p
, OpenSession
, (slot
->id
,
393 hx509_set_error_string(context
, 0, HX509_PKCS11_OPEN_SESSION
,
394 "Failed to OpenSession for slot id %d "
395 "with error: 0x%08x",
397 return HX509_PKCS11_OPEN_SESSION
;
400 slot
->flags
|= P11_SESSION
;
403 * If we have have to login, and haven't tried before and have a
404 * prompter or known to work pin code.
406 * This code is very conversative and only uses the prompter in
407 * the hx509_lock, the reason is that it's bad to try many
408 * passwords on a pkcs11 token, it might lock up and have to be
409 * unlocked by a administrator.
411 * XXX try harder to not use pin several times on the same card.
414 if ( (slot
->flags
& P11_LOGIN_REQ
)
415 && (slot
->flags
& P11_LOGIN_DONE
) == 0
416 && (lock
|| slot
->pin
))
422 slot
->flags
|= P11_LOGIN_DONE
;
424 if (slot
->pin
== NULL
) {
426 memset(&prompt
, 0, sizeof(prompt
));
428 asprintf(&str
, "PIN code for %s: ", slot
->name
);
430 prompt
.type
= HX509_PROMPT_TYPE_PASSWORD
;
431 prompt
.reply
.data
= pin
;
432 prompt
.reply
.length
= sizeof(pin
);
434 ret
= hx509_lock_prompt(lock
, &prompt
);
438 hx509_set_error_string(context
, 0, ret
,
439 "Failed to get pin code for slot "
440 "id %d with error: %d",
446 strlcpy(pin
, slot
->pin
, sizeof(pin
));
449 ret
= P11FUNC(p
, Login
, (slot
->session
, CKU_USER
,
450 (unsigned char*)pin
, strlen(pin
)));
453 hx509_set_error_string(context
, 0, HX509_PKCS11_LOGIN
,
454 "Failed to login on slot id %d "
455 "with error: 0x%08x",
457 p11_put_session(p
, slot
, slot
->session
);
458 return HX509_PKCS11_LOGIN
;
460 if (slot
->pin
== NULL
) {
461 slot
->pin
= strdup(pin
);
462 if (slot
->pin
== NULL
) {
464 hx509_set_error_string(context
, 0, ENOMEM
,
466 p11_put_session(p
, slot
, slot
->session
);
471 slot
->flags
|= P11_LOGIN_DONE
;
473 slot
->flags
|= P11_SESSION_IN_USE
;
475 *psession
= slot
->session
;
481 p11_put_session(struct p11_module
*p
,
482 struct p11_slot
*slot
,
483 CK_SESSION_HANDLE session
)
485 if ((slot
->flags
& P11_SESSION_IN_USE
) == 0)
486 _hx509_abort("slot not in session");
487 slot
->flags
&= ~P11_SESSION_IN_USE
;
493 iterate_entries(hx509_context context
,
494 struct p11_module
*p
, struct p11_slot
*slot
,
495 CK_SESSION_HANDLE session
,
496 CK_ATTRIBUTE
*search_data
, int num_search_data
,
497 CK_ATTRIBUTE
*query
, int num_query
,
498 int (*func
)(hx509_context
,
499 struct p11_module
*, struct p11_slot
*,
500 CK_SESSION_HANDLE session
,
501 CK_OBJECT_HANDLE object
,
502 void *, CK_ATTRIBUTE
*, int), void *ptr
)
504 CK_OBJECT_HANDLE object
;
505 CK_ULONG object_count
;
508 ret
= P11FUNC(p
, FindObjectsInit
, (session
, search_data
, num_search_data
));
513 ret
= P11FUNC(p
, FindObjects
, (session
, &object
, 1, &object_count
));
517 if (object_count
== 0)
520 for (i
= 0; i
< num_query
; i
++)
521 query
[i
].pValue
= NULL
;
523 ret
= P11FUNC(p
, GetAttributeValue
,
524 (session
, object
, query
, num_query
));
528 for (i
= 0; i
< num_query
; i
++) {
529 query
[i
].pValue
= malloc(query
[i
].ulValueLen
);
530 if (query
[i
].pValue
== NULL
) {
535 ret
= P11FUNC(p
, GetAttributeValue
,
536 (session
, object
, query
, num_query
));
542 ret
= (*func
)(context
, p
, slot
, session
, object
, ptr
, query
, num_query
);
546 for (i
= 0; i
< num_query
; i
++) {
548 free(query
[i
].pValue
);
549 query
[i
].pValue
= NULL
;
554 for (i
= 0; i
< num_query
; i
++) {
556 free(query
[i
].pValue
);
557 query
[i
].pValue
= NULL
;
560 ret
= P11FUNC(p
, FindObjectsFinal
, (session
));
570 getattr_bn(struct p11_module
*p
,
571 struct p11_slot
*slot
,
572 CK_SESSION_HANDLE session
,
573 CK_OBJECT_HANDLE object
,
582 query
.ulValueLen
= 0;
584 ret
= P11FUNC(p
, GetAttributeValue
,
585 (session
, object
, &query
, 1));
589 query
.pValue
= malloc(query
.ulValueLen
);
591 ret
= P11FUNC(p
, GetAttributeValue
,
592 (session
, object
, &query
, 1));
597 bn
= BN_bin2bn(query
.pValue
, query
.ulValueLen
, NULL
);
604 collect_private_key(hx509_context context
,
605 struct p11_module
*p
, struct p11_slot
*slot
,
606 CK_SESSION_HANDLE session
,
607 CK_OBJECT_HANDLE object
,
608 void *ptr
, CK_ATTRIBUTE
*query
, int num_query
)
610 struct hx509_collector
*collector
= ptr
;
611 hx509_private_key key
;
612 heim_octet_string localKeyId
;
615 struct p11_rsa
*p11rsa
;
617 localKeyId
.data
= query
[0].pValue
;
618 localKeyId
.length
= query
[0].ulValueLen
;
620 ret
= _hx509_private_key_init(&key
, NULL
, NULL
);
626 _hx509_abort("out of memory");
629 * The exponent and modulus should always be present according to
630 * the pkcs11 specification, but some smartcards leaves it out,
631 * let ignore any failure to fetch it.
633 rsa
->n
= getattr_bn(p
, slot
, session
, object
, CKA_MODULUS
);
634 rsa
->e
= getattr_bn(p
, slot
, session
, object
, CKA_PUBLIC_EXPONENT
);
636 p11rsa
= calloc(1, sizeof(*p11rsa
));
638 _hx509_abort("out of memory");
642 p11rsa
->private_key
= object
;
645 _hx509_abort("pkcs11 ref == 0 on alloc");
647 if (p
->ref
== UINT_MAX
)
648 _hx509_abort("pkcs11 ref == UINT_MAX on alloc");
650 RSA_set_method(rsa
, &p11_rsa_pkcs1_method
);
651 ret
= RSA_set_app_data(rsa
, p11rsa
);
653 _hx509_abort("RSA_set_app_data");
655 _hx509_private_key_assign_rsa(key
, rsa
);
657 ret
= _hx509_collector_private_key_add(context
,
659 hx509_signature_rsa(),
665 _hx509_private_key_free(&key
);
672 p11_cert_release(hx509_cert cert
, void *ctx
)
674 struct p11_module
*p
= ctx
;
675 p11_release_module(p
);
680 collect_cert(hx509_context context
,
681 struct p11_module
*p
, struct p11_slot
*slot
,
682 CK_SESSION_HANDLE session
,
683 CK_OBJECT_HANDLE object
,
684 void *ptr
, CK_ATTRIBUTE
*query
, int num_query
)
686 struct hx509_collector
*collector
= ptr
;
690 if ((CK_LONG
)query
[0].ulValueLen
== -1 ||
691 (CK_LONG
)query
[1].ulValueLen
== -1)
696 ret
= hx509_cert_init_data(context
, query
[1].pValue
,
697 query
[1].ulValueLen
, &cert
);
702 _hx509_abort("pkcs11 ref == 0 on alloc");
704 if (p
->ref
== UINT_MAX
)
705 _hx509_abort("pkcs11 ref to high");
707 _hx509_cert_set_release(cert
, p11_cert_release
, p
);
710 heim_octet_string data
;
712 data
.data
= query
[0].pValue
;
713 data
.length
= query
[0].ulValueLen
;
715 _hx509_set_cert_attribute(context
,
717 oid_id_pkcs_9_at_localKeyId(),
721 if ((CK_LONG
)query
[2].ulValueLen
!= -1) {
724 asprintf(&str
, "%.*s",
725 (int)query
[2].ulValueLen
, (char *)query
[2].pValue
);
727 hx509_cert_set_friendly_name(cert
, str
);
732 ret
= _hx509_collector_certs_add(context
, collector
, cert
);
733 hx509_cert_free(cert
);
740 p11_list_keys(hx509_context context
,
741 struct p11_module
*p
,
742 struct p11_slot
*slot
,
743 CK_SESSION_HANDLE session
,
747 struct hx509_collector
*collector
;
748 CK_OBJECT_CLASS key_class
;
749 CK_ATTRIBUTE search_data
[] = {
750 {CKA_CLASS
, NULL
, 0},
752 CK_ATTRIBUTE query_data
[3] = {
754 {CKA_VALUE
, NULL
, 0},
759 search_data
[0].pValue
= &key_class
;
760 search_data
[0].ulValueLen
= sizeof(key_class
);
763 lock
= _hx509_empty_lock
;
765 ret
= _hx509_collector_alloc(context
, lock
, &collector
);
769 key_class
= CKO_PRIVATE_KEY
;
770 ret
= iterate_entries(context
, p
, slot
, session
,
773 collect_private_key
, collector
);
777 key_class
= CKO_CERTIFICATE
;
778 ret
= iterate_entries(context
, p
, slot
, session
,
781 collect_cert
, collector
);
785 ret
= _hx509_collector_collect_certs(context
, collector
, &slot
->certs
);
788 _hx509_collector_free(collector
);
795 p11_init(hx509_context context
,
796 hx509_certs certs
, void **data
, int flags
,
797 const char *residue
, hx509_lock lock
)
799 CK_C_GetFunctionList getFuncs
;
800 struct p11_module
*p
;
806 list
= strdup(residue
);
810 p
= calloc(1, sizeof(*p
));
818 str
= strchr(list
, ',');
823 strnext
= strchr(str
, ',');
827 if (strncasecmp(str
, "slot=", 5) == 0)
828 p
->selected_slot
= atoi(str
+ 5);
833 p
->dl_handle
= dlopen(list
, RTLD_NOW
);
835 if (p
->dl_handle
== NULL
) {
836 ret
= HX509_PKCS11_LOAD
;
837 hx509_set_error_string(context
, 0, ret
,
838 "Failed to open %s: %s", list
, dlerror());
842 getFuncs
= dlsym(p
->dl_handle
, "C_GetFunctionList");
843 if (getFuncs
== NULL
) {
844 ret
= HX509_PKCS11_LOAD
;
845 hx509_set_error_string(context
, 0, ret
,
846 "C_GetFunctionList missing in %s: %s",
851 ret
= (*getFuncs
)(&p
->funcs
);
853 ret
= HX509_PKCS11_LOAD
;
854 hx509_set_error_string(context
, 0, ret
,
855 "C_GetFunctionList failed in %s", list
);
859 ret
= P11FUNC(p
, Initialize
, (NULL_PTR
));
861 ret
= HX509_PKCS11_TOKEN_CONFUSED
;
862 hx509_set_error_string(context
, 0, ret
,
863 "Failed initialize the PKCS11 module");
867 ret
= P11FUNC(p
, GetSlotList
, (FALSE
, NULL
, &p
->num_slots
));
869 ret
= HX509_PKCS11_TOKEN_CONFUSED
;
870 hx509_set_error_string(context
, 0, ret
,
871 "Failed to get number of PKCS11 slots");
875 if (p
->num_slots
== 0) {
876 ret
= HX509_PKCS11_NO_SLOT
;
877 hx509_set_error_string(context
, 0, ret
,
878 "Selected PKCS11 module have no slots");
884 CK_SLOT_ID_PTR slot_ids
;
885 int i
, num_tokens
= 0;
887 slot_ids
= malloc(p
->num_slots
* sizeof(*slot_ids
));
888 if (slot_ids
== NULL
) {
889 hx509_clear_error_string(context
);
894 ret
= P11FUNC(p
, GetSlotList
, (FALSE
, slot_ids
, &p
->num_slots
));
897 hx509_set_error_string(context
, 0, HX509_PKCS11_TOKEN_CONFUSED
,
898 "Failed getting slot-list from "
900 ret
= HX509_PKCS11_TOKEN_CONFUSED
;
904 p
->slot
= calloc(p
->num_slots
, sizeof(p
->slot
[0]));
905 if (p
->slot
== NULL
) {
907 hx509_set_error_string(context
, 0, ENOMEM
,
908 "Failed to get memory for slot-list");
913 for (i
= 0; i
< p
->num_slots
; i
++) {
914 ret
= p11_init_slot(context
, p
, lock
, slot_ids
[i
], i
, &p
->slot
[i
]);
917 if (p
->slot
[i
].flags
& P11_TOKEN_PRESENT
)
923 if (num_tokens
== 0) {
924 ret
= HX509_PKCS11_NO_TOKEN
;
933 p11_release_module(p
);
938 p11_release_module(struct p11_module
*p
)
943 _hx509_abort("pkcs11 ref to low");
947 for (i
= 0; i
< p
->num_slots
; i
++) {
948 if (p
->slot
[i
].flags
& P11_SESSION_IN_USE
)
949 _hx509_abort("pkcs11 module release while session in use");
950 if (p
->slot
[i
].flags
& P11_SESSION
) {
953 ret
= P11FUNC(p
, CloseSession
, (p
->slot
[i
].session
));
959 free(p
->slot
[i
].name
);
960 if (p
->slot
[i
].pin
) {
961 memset(p
->slot
[i
].pin
, 0, strlen(p
->slot
[i
].pin
));
962 free(p
->slot
[i
].pin
);
964 if (p
->slot
[i
].mechs
.num
) {
965 free(p
->slot
[i
].mechs
.list
);
967 if (p
->slot
[i
].mechs
.infos
) {
970 for (j
= 0 ; j
< p
->slot
[i
].mechs
.num
; j
++)
971 free(p
->slot
[i
].mechs
.infos
[j
]);
972 free(p
->slot
[i
].mechs
.infos
);
979 P11FUNC(p
, Finalize
, (NULL
));
982 dlclose(p
->dl_handle
);
984 memset(p
, 0, sizeof(*p
));
989 p11_free(hx509_certs certs
, void *data
)
991 struct p11_module
*p
= data
;
994 for (i
= 0; i
< p
->num_slots
; i
++) {
995 if (p
->slot
[i
].certs
)
996 hx509_certs_free(&p
->slot
[i
].certs
);
998 p11_release_module(p
);
1008 p11_iter_start(hx509_context context
,
1009 hx509_certs certs
, void *data
, void **cursor
)
1011 struct p11_module
*p
= data
;
1012 struct p11_cursor
*c
;
1015 c
= malloc(sizeof(*c
));
1017 hx509_clear_error_string(context
);
1020 ret
= hx509_certs_init(context
, "MEMORY:pkcs11-iter", 0, NULL
, &c
->certs
);
1026 for (i
= 0 ; i
< p
->num_slots
; i
++) {
1027 if (p
->slot
[i
].certs
== NULL
)
1029 ret
= hx509_certs_merge(context
, c
->certs
, p
->slot
[i
].certs
);
1031 hx509_certs_free(&c
->certs
);
1037 ret
= hx509_certs_start_seq(context
, c
->certs
, &c
->cursor
);
1039 hx509_certs_free(&c
->certs
);
1049 p11_iter(hx509_context context
,
1050 hx509_certs certs
, void *data
, void *cursor
, hx509_cert
*cert
)
1052 struct p11_cursor
*c
= cursor
;
1053 return hx509_certs_next_cert(context
, c
->certs
, c
->cursor
, cert
);
1057 p11_iter_end(hx509_context context
,
1058 hx509_certs certs
, void *data
, void *cursor
)
1060 struct p11_cursor
*c
= cursor
;
1062 ret
= hx509_certs_end_seq(context
, c
->certs
, c
->cursor
);
1063 hx509_certs_free(&c
->certs
);
1068 #define MECHFLAG(x) { "unknown-flag-" #x, x }
1069 static struct units mechflags
[] = {
1070 MECHFLAG(0x80000000),
1071 MECHFLAG(0x40000000),
1072 MECHFLAG(0x20000000),
1073 MECHFLAG(0x10000000),
1074 MECHFLAG(0x08000000),
1075 MECHFLAG(0x04000000),
1076 {"ec-compress", 0x2000000 },
1077 {"ec-uncompress", 0x1000000 },
1078 {"ec-namedcurve", 0x0800000 },
1079 {"ec-ecparameters", 0x0400000 },
1080 {"ec-f-2m", 0x0200000 },
1081 {"ec-f-p", 0x0100000 },
1082 {"derive", 0x0080000 },
1083 {"unwrap", 0x0040000 },
1084 {"wrap", 0x0020000 },
1085 {"genereate-key-pair", 0x0010000 },
1086 {"generate", 0x0008000 },
1087 {"verify-recover", 0x0004000 },
1088 {"verify", 0x0002000 },
1089 {"sign-recover", 0x0001000 },
1090 {"sign", 0x0000800 },
1091 {"digest", 0x0000400 },
1092 {"decrypt", 0x0000200 },
1093 {"encrypt", 0x0000100 },
1107 p11_printinfo(hx509_context context
,
1110 int (*func
)(void *, const char *),
1113 struct p11_module
*p
= data
;
1116 _hx509_pi_printf(func
, ctx
, "pkcs11 driver with %d slot%s",
1117 p
->num_slots
, p
->num_slots
> 1 ? "s" : "");
1119 for (i
= 0; i
< p
->num_slots
; i
++) {
1120 struct p11_slot
*s
= &p
->slot
[i
];
1122 _hx509_pi_printf(func
, ctx
, "slot %d: id: %d name: %s flags: %08x",
1123 i
, (int)s
->id
, s
->name
, s
->flags
);
1125 _hx509_pi_printf(func
, ctx
, "number of supported mechanisms: %lu",
1126 (unsigned long)s
->mechs
.num
);
1127 for (j
= 0; j
< s
->mechs
.num
; j
++) {
1128 const char *mechname
= "unknown";
1129 char flags
[256], unknownname
[40];
1130 #define MECHNAME(s,n) case s: mechname = n; break
1131 switch(s
->mechs
.list
[j
]) {
1132 MECHNAME(CKM_RSA_PKCS_KEY_PAIR_GEN
, "rsa-pkcs-key-pair-gen");
1133 MECHNAME(CKM_RSA_PKCS
, "rsa-pkcs");
1134 MECHNAME(CKM_RSA_X_509
, "rsa-x-509");
1135 MECHNAME(CKM_MD5_RSA_PKCS
, "md5-rsa-pkcs");
1136 MECHNAME(CKM_SHA1_RSA_PKCS
, "sha1-rsa-pkcs");
1137 MECHNAME(CKM_SHA256_RSA_PKCS
, "sha256-rsa-pkcs");
1138 MECHNAME(CKM_SHA384_RSA_PKCS
, "sha384-rsa-pkcs");
1139 MECHNAME(CKM_SHA512_RSA_PKCS
, "sha512-rsa-pkcs");
1140 MECHNAME(CKM_RIPEMD160_RSA_PKCS
, "ripemd160-rsa-pkcs");
1141 MECHNAME(CKM_RSA_PKCS_OAEP
, "rsa-pkcs-oaep");
1142 MECHNAME(CKM_SHA512_HMAC
, "sha512-hmac");
1143 MECHNAME(CKM_SHA512
, "sha512");
1144 MECHNAME(CKM_SHA384_HMAC
, "sha384-hmac");
1145 MECHNAME(CKM_SHA384
, "sha384");
1146 MECHNAME(CKM_SHA256_HMAC
, "sha256-hmac");
1147 MECHNAME(CKM_SHA256
, "sha256");
1148 MECHNAME(CKM_SHA_1
, "sha1");
1149 MECHNAME(CKM_MD5
, "md5");
1150 MECHNAME(CKM_MD2
, "md2");
1151 MECHNAME(CKM_RIPEMD160
, "ripemd-160");
1152 MECHNAME(CKM_DES_ECB
, "des-ecb");
1153 MECHNAME(CKM_DES_CBC
, "des-cbc");
1154 MECHNAME(CKM_AES_ECB
, "aes-ecb");
1155 MECHNAME(CKM_AES_CBC
, "aes-cbc");
1156 MECHNAME(CKM_DH_PKCS_PARAMETER_GEN
, "dh-pkcs-parameter-gen");
1158 snprintf(unknownname
, sizeof(unknownname
),
1160 (unsigned long)s
->mechs
.list
[j
]);
1161 mechname
= unknownname
;
1165 unparse_flags(s
->mechs
.infos
[j
]->flags
, mechflags
,
1166 flags
, sizeof(flags
));
1168 _hx509_pi_printf(func
, ctx
, " %s: %s", mechname
, flags
);
1175 static struct hx509_keyset_ops keyset_pkcs11
= {
1189 #endif /* HAVE_DLOPEN */
1192 _hx509_ks_pkcs11_register(hx509_context context
)
1195 _hx509_ks_register(context
, &keyset_pkcs11
);