lib/hx509/softp11.c

   1 /*
   2  * Copyright (c) 2004 - 2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #define CRYPTOKI_EXPORTS 1
  35
  36 #include "hx_locl.h"
  37 #include "pkcs11.h"
  38
  39 #define OBJECT_ID_MASK          0xfff
  40 #define HANDLE_OBJECT_ID(h)     ((h) & OBJECT_ID_MASK)
  41 #define OBJECT_ID(obj)          HANDLE_OBJECT_ID((obj)->object_handle)
  42
  43 #ifndef HAVE_RANDOM
  44 #define random() rand()
  45 #define srandom(s) srand(s)
  46 #endif
  47
  48 #ifdef _WIN32
  49 #include <shlobj.h>
  50 #endif
  51
  52 struct st_attr {
  53     CK_ATTRIBUTE attribute;
  54     int secret;
  55 };
  56
  57 struct st_object {
  58     CK_OBJECT_HANDLE object_handle;
  59     struct st_attr *attrs;
  60     int num_attributes;
  61     hx509_cert cert;
  62 };
  63
  64 static struct soft_token {
  65     CK_VOID_PTR application;
  66     CK_NOTIFY notify;
  67     char *config_file;
  68     hx509_certs certs;
  69     struct {
  70         struct st_object **objs;
  71         int num_objs;
  72     } object;
  73     struct {
  74         int hardware_slot;
  75         int app_error_fatal;
  76         int login_done;
  77     } flags;
  78     int open_sessions;
  79     struct session_state {
  80         CK_SESSION_HANDLE session_handle;
  81
  82         struct {
  83             CK_ATTRIBUTE *attributes;
  84             CK_ULONG num_attributes;
  85             int next_object;
  86         } find;
  87
  88         int sign_object;
  89         CK_MECHANISM_PTR sign_mechanism;
  90         int verify_object;
  91         CK_MECHANISM_PTR verify_mechanism;
  92     } state[10];
  93 #define MAX_NUM_SESSION (sizeof(soft_token.state)/sizeof(soft_token.state[0]))
  94     FILE *logfile;
  95 } soft_token;
  96
  97 static hx509_context context;
  98
  99 static void
 100 application_error(const char *fmt, ...)
 101 {
 102     va_list ap;
 103     va_start(ap, fmt);
 104     vprintf(fmt, ap);
 105     va_end(ap);
 106     if (soft_token.flags.app_error_fatal)
 107         abort();
 108 }
 109
 110 static void
 111 st_logf(const char *fmt, ...)
 112 {
 113     va_list ap;
 114     if (soft_token.logfile == NULL)
 115         return;
 116     va_start(ap, fmt);
 117     vfprintf(soft_token.logfile, fmt, ap);
 118     va_end(ap);
 119     fflush(soft_token.logfile);
 120 }
 121
 122 static CK_RV
 123 init_context(void)
 124 {
 125     if (context == NULL) {
 126         int ret = hx509_context_init(&context);
 127         if (ret)
 128             return CKR_GENERAL_ERROR;
 129     }
 130     return CKR_OK;
 131 }
 132
 133 #define INIT_CONTEXT() { CK_RV icret = init_context(); if (icret) return icret; }
 134
 135 static void
 136 snprintf_fill(char *str, size_t size, char fillchar, const char *fmt, ...)
 137 {
 138     int len;
 139     va_list ap;
 140     va_start(ap, fmt);
 141     len = vsnprintf(str, size, fmt, ap);
 142     va_end(ap);
 143     if (len < 0 || (size_t)len > size)
 144         return;
 145     while ((size_t)len < size)
 146         str[len++] = fillchar;
 147 }
 148
 149 #ifndef TEST_APP
 150 #define printf error_use_st_logf
 151 #endif
 152
 153 #define VERIFY_SESSION_HANDLE(s, state)                 \
 154 {                                                       \
 155     CK_RV xret;                                         \
 156     xret = verify_session_handle(s, state);             \
 157     if (xret != CKR_OK) {                               \
 158         /* return CKR_OK */;                            \
 159     }                                                   \
 160 }
 161
 162 static CK_RV
 163 verify_session_handle(CK_SESSION_HANDLE hSession,
 164                       struct session_state **state)
 165 {
 166     size_t i;
 167
 168     for (i = 0; i < MAX_NUM_SESSION; i++){
 169         if (soft_token.state[i].session_handle == hSession)
 170             break;
 171     }
 172     if (i == MAX_NUM_SESSION) {
 173         application_error("use of invalid handle: 0x%08lx\n",
 174                           (unsigned long)hSession);
 175         return CKR_SESSION_HANDLE_INVALID;
 176     }
 177     if (state)
 178         *state = &soft_token.state[i];
 179     return CKR_OK;
 180 }
 181
 182 static CK_RV
 183 object_handle_to_object(CK_OBJECT_HANDLE handle,
 184                         struct st_object **object)
 185 {
 186     int i = HANDLE_OBJECT_ID(handle);
 187
 188     *object = NULL;
 189     if (i >= soft_token.object.num_objs)
 190         return CKR_ARGUMENTS_BAD;
 191     if (soft_token.object.objs[i] == NULL)
 192         return CKR_ARGUMENTS_BAD;
 193     if (soft_token.object.objs[i]->object_handle != handle)
 194         return CKR_ARGUMENTS_BAD;
 195     *object = soft_token.object.objs[i];
 196     return CKR_OK;
 197 }
 198
 199 static int
 200 attributes_match(const struct st_object *obj,
 201                  const CK_ATTRIBUTE *attributes,
 202                  CK_ULONG num_attributes)
 203 {
 204     CK_ULONG i;
 205     int j;
 206
 207     st_logf("attributes_match: %ld\n", (unsigned long)OBJECT_ID(obj));
 208
 209     for (i = 0; i < num_attributes; i++) {
 210         int match = 0;
 211         for (j = 0; j < obj->num_attributes; j++) {
 212             if (attributes[i].type == obj->attrs[j].attribute.type &&
 213                 attributes[i].ulValueLen == obj->attrs[j].attribute.ulValueLen &&
 214                 memcmp(attributes[i].pValue, obj->attrs[j].attribute.pValue,
 215                        attributes[i].ulValueLen) == 0) {
 216                 match = 1;
 217                 break;
 218             }
 219         }
 220         if (match == 0) {
 221             st_logf("type %d attribute have no match\n", attributes[i].type);
 222             return 0;
 223         }
 224     }
 225     st_logf("attribute matches\n");
 226     return 1;
 227 }
 228
 229 static void
 230 print_attributes(const CK_ATTRIBUTE *attributes,
 231                  CK_ULONG num_attributes)
 232 {
 233     CK_ULONG i;
 234
 235     st_logf("find objects: attrs: %lu\n", (unsigned long)num_attributes);
 236
 237     for (i = 0; i < num_attributes; i++) {
 238         st_logf("  type: ");
 239         switch (attributes[i].type) {
 240         case CKA_TOKEN: {
 241             CK_BBOOL *ck_true;
 242             if (attributes[i].ulValueLen != sizeof(CK_BBOOL)) {
 243                 application_error("token attribute wrong length\n");
 244                 break;
 245             }
 246             ck_true = attributes[i].pValue;
 247             st_logf("token: %s", *ck_true ? "TRUE" : "FALSE");
 248             break;
 249         }
 250         case CKA_CLASS: {
 251             CK_OBJECT_CLASS *class;
 252             if (attributes[i].ulValueLen != sizeof(CK_ULONG)) {
 253                 application_error("class attribute wrong length\n");
 254                 break;
 255             }
 256             class = attributes[i].pValue;
 257             st_logf("class ");
 258             switch (*class) {
 259             case CKO_CERTIFICATE:
 260                 st_logf("certificate");
 261                 break;
 262             case CKO_PUBLIC_KEY:
 263                 st_logf("public key");
 264                 break;
 265             case CKO_PRIVATE_KEY:
 266                 st_logf("private key");
 267                 break;
 268             case CKO_SECRET_KEY:
 269                 st_logf("secret key");
 270                 break;
 271             case CKO_DOMAIN_PARAMETERS:
 272                 st_logf("domain parameters");
 273                 break;
 274             default:
 275                 st_logf("[class %lx]", (long unsigned)*class);
 276                 break;
 277             }
 278             break;
 279         }
 280         case CKA_PRIVATE:
 281             st_logf("private");
 282             break;
 283         case CKA_LABEL:
 284             st_logf("label");
 285             break;
 286         case CKA_APPLICATION:
 287             st_logf("application");
 288             break;
 289         case CKA_VALUE:
 290             st_logf("value");
 291             break;
 292         case CKA_ID:
 293             st_logf("id");
 294             break;
 295         default:
 296             st_logf("[unknown 0x%08lx]", (unsigned long)attributes[i].type);
 297             break;
 298         }
 299         st_logf("\n");
 300     }
 301 }
 302
 303 static struct st_object *
 304 add_st_object(void)
 305 {
 306     struct st_object *o, **objs;
 307     int i;
 308
 309     o = calloc(1, sizeof(*o));
 310     if (o == NULL)
 311         return NULL;
 312
 313     for (i = 0; i < soft_token.object.num_objs; i++) {
 314         if (soft_token.object.objs == NULL) {
 315             soft_token.object.objs[i] = o;
 316             break;
 317         }
 318     }
 319     if (i == soft_token.object.num_objs) {
 320         objs = realloc(soft_token.object.objs,
 321                        (soft_token.object.num_objs + 1) * sizeof(soft_token.object.objs[0]));
 322         if (objs == NULL) {
 323             free(o);
 324             return NULL;
 325         }
 326         soft_token.object.objs = objs;
 327         soft_token.object.objs[soft_token.object.num_objs++] = o;
 328     }
 329     soft_token.object.objs[i]->object_handle =
 330         (random() & (~OBJECT_ID_MASK)) | i;
 331
 332     return o;
 333 }
 334
 335 static CK_RV
 336 add_object_attribute(struct st_object *o,
 337                      int secret,
 338                      CK_ATTRIBUTE_TYPE type,
 339                      CK_VOID_PTR pValue,
 340                      CK_ULONG ulValueLen)
 341 {
 342     struct st_attr *a;
 343     int i;
 344
 345     i = o->num_attributes;
 346     a = realloc(o->attrs, (i + 1) * sizeof(o->attrs[0]));
 347     if (a == NULL)
 348         return CKR_DEVICE_MEMORY;
 349     o->attrs = a;
 350     o->attrs[i].secret = secret;
 351     o->attrs[i].attribute.type = type;
 352     o->attrs[i].attribute.pValue = malloc(ulValueLen);
 353     if (o->attrs[i].attribute.pValue == NULL && ulValueLen != 0)
 354         return CKR_DEVICE_MEMORY;
 355     memcpy(o->attrs[i].attribute.pValue, pValue, ulValueLen);
 356     o->attrs[i].attribute.ulValueLen = ulValueLen;
 357     o->num_attributes++;
 358
 359     return CKR_OK;
 360 }
 361
 362 static CK_RV
 363 add_pubkey_info(hx509_context hxctx, struct st_object *o,
 364                 CK_KEY_TYPE key_type, hx509_cert cert)
 365 {
 366     BIGNUM *num;
 367     CK_BYTE *modulus = NULL;
 368     size_t modulus_len = 0;
 369     CK_ULONG modulus_bits = 0;
 370     CK_BYTE *exponent = NULL;
 371     size_t exponent_len = 0;
 372
 373     if (key_type != CKK_RSA)
 374         return CKR_OK;
 375     if (_hx509_cert_private_key(cert) == NULL)
 376         return CKR_OK;
 377
 378     num = _hx509_private_key_get_internal(context,
 379                                           _hx509_cert_private_key(cert),
 380                                           "rsa-modulus");
 381     if (num == NULL)
 382         return CKR_GENERAL_ERROR;
 383     modulus_bits = BN_num_bits(num);
 384
 385     modulus_len = BN_num_bytes(num);
 386     modulus = malloc(modulus_len);
 387     BN_bn2bin(num, modulus);
 388     BN_free(num);
 389
 390     add_object_attribute(o, 0, CKA_MODULUS, modulus, modulus_len);
 391     add_object_attribute(o, 0, CKA_MODULUS_BITS,
 392                          &modulus_bits, sizeof(modulus_bits));
 393
 394     free(modulus);
 395
 396     num = _hx509_private_key_get_internal(context,
 397                                           _hx509_cert_private_key(cert),
 398                                           "rsa-exponent");
 399     if (num == NULL)
 400         return CKR_GENERAL_ERROR;
 401
 402     exponent_len = BN_num_bytes(num);
 403     exponent = malloc(exponent_len);
 404     BN_bn2bin(num, exponent);
 405     BN_free(num);
 406
 407     add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT,
 408                          exponent, exponent_len);
 409
 410     free(exponent);
 411
 412     return CKR_OK;
 413 }
 414
 415
 416 struct foo {
 417     char *label;
 418     char *id;
 419 };
 420
 421 static int
 422 add_cert(hx509_context hxctx, void *ctx, hx509_cert cert)
 423 {
 424     static char empty[] = "";
 425     struct foo *foo = (struct foo *)ctx;
 426     struct st_object *o = NULL;
 427     CK_OBJECT_CLASS type;
 428     CK_BBOOL bool_true = CK_TRUE;
 429     CK_BBOOL bool_false = CK_FALSE;
 430     CK_CERTIFICATE_TYPE cert_type = CKC_X_509;
 431     CK_KEY_TYPE key_type;
 432     CK_MECHANISM_TYPE mech_type;
 433     CK_RV ret = CKR_GENERAL_ERROR;
 434     int hret;
 435     heim_octet_string cert_data, subject_data, issuer_data, serial_data;
 436
 437     st_logf("adding certificate\n");
 438
 439     serial_data.data = NULL;
 440     serial_data.length = 0;
 441     cert_data = subject_data = issuer_data = serial_data;
 442
 443     hret = hx509_cert_binary(hxctx, cert, &cert_data);
 444     if (hret)
 445         goto out;
 446
 447     {
 448             hx509_name name;
 449
 450             hret = hx509_cert_get_issuer(cert, &name);
 451             if (hret)
 452                 goto out;
 453             hret = hx509_name_binary(name, &issuer_data);
 454             hx509_name_free(&name);
 455             if (hret)
 456                 goto out;
 457
 458             hret = hx509_cert_get_subject(cert, &name);
 459             if (hret)
 460                 goto out;
 461             hret = hx509_name_binary(name, &subject_data);
 462             hx509_name_free(&name);
 463             if (hret)
 464                 goto out;
 465     }
 466
 467     {
 468         AlgorithmIdentifier alg;
 469
 470         hret = hx509_cert_get_SPKI_AlgorithmIdentifier(context, cert, &alg);
 471         if (hret) {
 472             ret = CKR_DEVICE_MEMORY;
 473             goto out;
 474         }
 475
 476         key_type = CKK_RSA; /* XXX */
 477
 478         free_AlgorithmIdentifier(&alg);
 479     }
 480
 481
 482     type = CKO_CERTIFICATE;
 483     o = add_st_object();
 484     if (o == NULL) {
 485         ret = CKR_DEVICE_MEMORY;
 486         goto out;
 487     }
 488
 489     o->cert = hx509_cert_ref(cert);
 490
 491     add_object_attribute(o, 0, CKA_CLASS, &type, sizeof(type));
 492     add_object_attribute(o, 0, CKA_TOKEN, &bool_true, sizeof(bool_true));
 493     add_object_attribute(o, 0, CKA_PRIVATE, &bool_false, sizeof(bool_false));
 494     add_object_attribute(o, 0, CKA_MODIFIABLE, &bool_false, sizeof(bool_false));
 495     add_object_attribute(o, 0, CKA_LABEL, foo->label, strlen(foo->label));
 496
 497     add_object_attribute(o, 0, CKA_CERTIFICATE_TYPE, &cert_type, sizeof(cert_type));
 498     add_object_attribute(o, 0, CKA_ID, foo->id, strlen(foo->id));
 499
 500     add_object_attribute(o, 0, CKA_SUBJECT, subject_data.data, subject_data.length);
 501     add_object_attribute(o, 0, CKA_ISSUER, issuer_data.data, issuer_data.length);
 502     add_object_attribute(o, 0, CKA_SERIAL_NUMBER, serial_data.data, serial_data.length);
 503     add_object_attribute(o, 0, CKA_VALUE, cert_data.data, cert_data.length);
 504     add_object_attribute(o, 0, CKA_TRUSTED, &bool_false, sizeof(bool_false));
 505
 506     st_logf("add cert ok: %lx\n", (unsigned long)OBJECT_ID(o));
 507
 508     type = CKO_PUBLIC_KEY;
 509     o = add_st_object();
 510     if (o == NULL) {
 511         ret = CKR_DEVICE_MEMORY;
 512         goto out;
 513     }
 514     o->cert = hx509_cert_ref(cert);
 515
 516     add_object_attribute(o, 0, CKA_CLASS, &type, sizeof(type));
 517     add_object_attribute(o, 0, CKA_TOKEN, &bool_true, sizeof(bool_true));
 518     add_object_attribute(o, 0, CKA_PRIVATE, &bool_false, sizeof(bool_false));
 519     add_object_attribute(o, 0, CKA_MODIFIABLE, &bool_false, sizeof(bool_false));
 520     add_object_attribute(o, 0, CKA_LABEL, foo->label, strlen(foo->label));
 521
 522     add_object_attribute(o, 0, CKA_KEY_TYPE, &key_type, sizeof(key_type));
 523     add_object_attribute(o, 0, CKA_ID, foo->id, strlen(foo->id));
 524     add_object_attribute(o, 0, CKA_START_DATE, empty, 1); /* XXX */
 525     add_object_attribute(o, 0, CKA_END_DATE, empty, 1); /* XXX */
 526     add_object_attribute(o, 0, CKA_DERIVE, &bool_false, sizeof(bool_false));
 527     add_object_attribute(o, 0, CKA_LOCAL, &bool_false, sizeof(bool_false));
 528     mech_type = CKM_RSA_X_509;
 529     add_object_attribute(o, 0, CKA_KEY_GEN_MECHANISM, &mech_type, sizeof(mech_type));
 530
 531     add_object_attribute(o, 0, CKA_SUBJECT, subject_data.data, subject_data.length);
 532     add_object_attribute(o, 0, CKA_ENCRYPT, &bool_true, sizeof(bool_true));
 533     add_object_attribute(o, 0, CKA_VERIFY, &bool_true, sizeof(bool_true));
 534     add_object_attribute(o, 0, CKA_VERIFY_RECOVER, &bool_false, sizeof(bool_false));
 535     add_object_attribute(o, 0, CKA_WRAP, &bool_true, sizeof(bool_true));
 536     add_object_attribute(o, 0, CKA_TRUSTED, &bool_true, sizeof(bool_true));
 537
 538     add_pubkey_info(hxctx, o, key_type, cert);
 539
 540     st_logf("add key ok: %lx\n", (unsigned long)OBJECT_ID(o));
 541
 542     if (hx509_cert_have_private_key(cert)) {
 543         CK_FLAGS flags;
 544
 545         type = CKO_PRIVATE_KEY;
 546         o = add_st_object();
 547         if (o == NULL) {
 548             ret = CKR_DEVICE_MEMORY;
 549             goto out;
 550         }
 551         o->cert = hx509_cert_ref(cert);
 552
 553         add_object_attribute(o, 0, CKA_CLASS, &type, sizeof(type));
 554         add_object_attribute(o, 0, CKA_TOKEN, &bool_true, sizeof(bool_true));
 555         add_object_attribute(o, 0, CKA_PRIVATE, &bool_true, sizeof(bool_false));
 556         add_object_attribute(o, 0, CKA_MODIFIABLE, &bool_false, sizeof(bool_false));
 557         add_object_attribute(o, 0, CKA_LABEL, foo->label, strlen(foo->label));
 558
 559         add_object_attribute(o, 0, CKA_KEY_TYPE, &key_type, sizeof(key_type));
 560         add_object_attribute(o, 0, CKA_ID, foo->id, strlen(foo->id));
 561         add_object_attribute(o, 0, CKA_START_DATE, empty, 1); /* XXX */
 562         add_object_attribute(o, 0, CKA_END_DATE, empty, 1); /* XXX */
 563         add_object_attribute(o, 0, CKA_DERIVE, &bool_false, sizeof(bool_false));
 564         add_object_attribute(o, 0, CKA_LOCAL, &bool_false, sizeof(bool_false));
 565         mech_type = CKM_RSA_X_509;
 566         add_object_attribute(o, 0, CKA_KEY_GEN_MECHANISM, &mech_type, sizeof(mech_type));
 567
 568         add_object_attribute(o, 0, CKA_SUBJECT, subject_data.data, subject_data.length);
 569         add_object_attribute(o, 0, CKA_SENSITIVE, &bool_true, sizeof(bool_true));
 570         add_object_attribute(o, 0, CKA_SECONDARY_AUTH, &bool_false, sizeof(bool_true));
 571         flags = 0;
 572         add_object_attribute(o, 0, CKA_AUTH_PIN_FLAGS, &flags, sizeof(flags));
 573
 574         add_object_attribute(o, 0, CKA_DECRYPT, &bool_true, sizeof(bool_true));
 575         add_object_attribute(o, 0, CKA_SIGN, &bool_true, sizeof(bool_true));
 576         add_object_attribute(o, 0, CKA_SIGN_RECOVER, &bool_false, sizeof(bool_false));
 577         add_object_attribute(o, 0, CKA_UNWRAP, &bool_true, sizeof(bool_true));
 578         add_object_attribute(o, 0, CKA_EXTRACTABLE, &bool_true, sizeof(bool_true));
 579         add_object_attribute(o, 0, CKA_NEVER_EXTRACTABLE, &bool_false, sizeof(bool_false));
 580
 581         add_pubkey_info(hxctx, o, key_type, cert);
 582     }
 583
 584     ret = CKR_OK;
 585  out:
 586     if (ret != CKR_OK) {
 587         st_logf("something went wrong when adding cert!\n");
 588
 589         /* XXX wack o */;
 590     }
 591     hx509_xfree(cert_data.data);
 592     hx509_xfree(serial_data.data);
 593     hx509_xfree(issuer_data.data);
 594     hx509_xfree(subject_data.data);
 595
 596     return 0;
 597 }
 598
 599 static CK_RV
 600 add_certificate(const char *cert_file,
 601                 const char *pin,
 602                 char *id,
 603                 char *label)
 604 {
 605     hx509_certs certs;
 606     hx509_lock lock = NULL;
 607     int ret, flags = 0;
 608
 609     struct foo foo;
 610     foo.id = id;
 611     foo.label = label;
 612
 613     if (pin == NULL)
 614         flags |= HX509_CERTS_UNPROTECT_ALL;
 615
 616     if (pin) {
 617         char *str;
 618         ret = asprintf(&str, "PASS:%s", pin);
 619         if (ret == -1 || !str) {
 620             st_logf("failed to allocate memory\n");
 621             return CKR_GENERAL_ERROR;
 622         }
 623
 624         hx509_lock_init(context, &lock);
 625         hx509_lock_command_string(lock, str);
 626
 627         memset(str, 0, strlen(str));
 628         free(str);
 629     }
 630
 631     ret = hx509_certs_init(context, cert_file, flags, lock, &certs);
 632     if (ret) {
 633         st_logf("failed to open file %s\n", cert_file);
 634         return CKR_GENERAL_ERROR;
 635     }
 636
 637     ret = hx509_certs_iter_f(context, certs, add_cert, &foo);
 638     hx509_certs_free(&certs);
 639     if (ret) {
 640         st_logf("failed adding certs from file %s\n", cert_file);
 641         return CKR_GENERAL_ERROR;
 642     }
 643
 644     return CKR_OK;
 645 }
 646
 647 static void
 648 find_object_final(struct session_state *state)
 649 {
 650     if (state->find.attributes) {
 651         CK_ULONG i;
 652
 653         for (i = 0; i < state->find.num_attributes; i++) {
 654             if (state->find.attributes[i].pValue)
 655                 free(state->find.attributes[i].pValue);
 656         }
 657         free(state->find.attributes);
 658         state->find.attributes = NULL;
 659         state->find.num_attributes = 0;
 660         state->find.next_object = -1;
 661     }
 662 }
 663
 664 static void
 665 reset_crypto_state(struct session_state *state)
 666 {
 667     state->sign_object = -1;
 668     if (state->sign_mechanism)
 669         free(state->sign_mechanism);
 670     state->sign_mechanism = NULL_PTR;
 671     state->verify_object = -1;
 672     if (state->verify_mechanism)
 673         free(state->verify_mechanism);
 674     state->verify_mechanism = NULL_PTR;
 675 }
 676
 677 static void
 678 close_session(struct session_state *state)
 679 {
 680     if (state->find.attributes) {
 681         application_error("application didn't do C_FindObjectsFinal\n");
 682         find_object_final(state);
 683     }
 684
 685     state->session_handle = CK_INVALID_HANDLE;
 686     soft_token.application = NULL_PTR;
 687     soft_token.notify = NULL_PTR;
 688     reset_crypto_state(state);
 689 }
 690
 691 static const char *
 692 has_session(void)
 693 {
 694     return soft_token.open_sessions > 0 ? "yes" : "no";
 695 }
 696
 697 static CK_RV
 698 read_conf_file(const char *fn, CK_USER_TYPE userType, const char *pin)
 699 {
 700     char buf[1024], *type, *s, *p;
 701     FILE *f;
 702     CK_RV ret = CKR_OK;
 703     CK_RV failed = CKR_OK;
 704
 705     if (fn == NULL) {
 706         st_logf("Can't open configuration file.  No file specified\n");
 707         return CKR_GENERAL_ERROR;
 708     }
 709
 710     f = fopen(fn, "r");
 711     if (f == NULL) {
 712         st_logf("can't open configuration file %s\n", fn);
 713         return CKR_GENERAL_ERROR;
 714     }
 715     rk_cloexec_file(f);
 716
 717     while(fgets(buf, sizeof(buf), f) != NULL) {
 718         buf[strcspn(buf, "\n")] = '\0';
 719
 720         st_logf("line: %s\n", buf);
 721
 722         p = buf;
 723         while (isspace((unsigned char)*p))
 724             p++;
 725         if (*p == '#')
 726             continue;
 727         while (isspace((unsigned char)*p))
 728             p++;
 729
 730         s = NULL;
 731         type = strtok_r(p, "\t", &s);
 732         if (type == NULL)
 733             continue;
 734
 735         if (strcasecmp("certificate", type) == 0) {
 736             char *cert, *id, *label;
 737
 738             id = strtok_r(NULL, "\t", &s);
 739             if (id == NULL) {
 740                 st_logf("no id\n");
 741                 continue;
 742             }
 743             st_logf("id: %s\n", id);
 744             label = strtok_r(NULL, "\t", &s);
 745             if (label == NULL) {
 746                 st_logf("no label\n");
 747                 continue;
 748             }
 749             cert = strtok_r(NULL, "\t", &s);
 750             if (cert == NULL) {
 751                 st_logf("no certfiicate store\n");
 752                 continue;
 753             }
 754
 755             st_logf("adding: %s: %s in file %s\n", id, label, cert);
 756
 757             ret = add_certificate(cert, pin, id, label);
 758             if (ret)
 759                 failed = ret;
 760         } else if (strcasecmp("debug", type) == 0) {
 761             char *name;
 762
 763             name = strtok_r(NULL, "\t", &s);
 764             if (name == NULL) {
 765                 st_logf("no filename\n");
 766                 continue;
 767             }
 768
 769             if (soft_token.logfile)
 770                 fclose(soft_token.logfile);
 771
 772             if (strcasecmp(name, "stdout") == 0)
 773                 soft_token.logfile = stdout;
 774             else {
 775                 soft_token.logfile = fopen(name, "a");
 776                 if (soft_token.logfile)
 777                     rk_cloexec_file(soft_token.logfile);
 778             }
 779             if (soft_token.logfile == NULL)
 780                 st_logf("failed to open file: %s\n", name);
 781
 782         } else if (strcasecmp("app-fatal", type) == 0) {
 783             char *name;
 784
 785             name = strtok_r(NULL, "\t", &s);
 786             if (name == NULL) {
 787                 st_logf("argument to app-fatal\n");
 788                 continue;
 789             }
 790
 791             if (strcmp(name, "true") == 0 || strcmp(name, "on") == 0)
 792                 soft_token.flags.app_error_fatal = 1;
 793             else if (strcmp(name, "false") == 0 || strcmp(name, "off") == 0)
 794                 soft_token.flags.app_error_fatal = 0;
 795             else
 796                 st_logf("unknown app-fatal: %s\n", name);
 797
 798         } else {
 799             st_logf("unknown type: %s\n", type);
 800         }
 801     }
 802
 803     fclose(f);
 804
 805     return failed;
 806 }
 807
 808 static CK_RV
 809 func_not_supported(void)
 810 {
 811     st_logf("function not supported\n");
 812     return CKR_FUNCTION_NOT_SUPPORTED;
 813 }
 814
 815 static char *
 816 get_config_file_for_user(void)
 817 {
 818     char *fn = NULL;
 819
 820 #ifndef _WIN32
 821     char *home = NULL;
 822     int ret;
 823
 824     if (!issuid()) {
 825         fn = getenv("SOFTPKCS11RC");
 826         if (fn)
 827             fn = strdup(fn);
 828         home = getenv("HOME");
 829     }
 830     if (fn == NULL && home == NULL) {
 831         struct passwd *pw = getpwuid(getuid());
 832         if(pw != NULL)
 833             home = pw->pw_dir;
 834     }
 835     if (fn == NULL) {
 836         if (home) {
 837             ret = asprintf(&fn, "%s/.soft-token.rc", home);
 838             if (ret == -1)
 839                 fn = NULL;
 840         } else
 841             fn = strdup("/etc/soft-token.rc");
 842     }
 843 #else  /* Windows */
 844
 845     char appdatafolder[MAX_PATH];
 846
 847     fn = getenv("SOFTPKCS11RC");
 848
 849     /* Retrieve the roaming AppData folder for the current user.  The
 850        current user is the user account represented by the current
 851        thread token. */
 852
 853     if (fn == NULL &&
 854         SUCCEEDED(SHGetFolderPath(NULL, CSIDL_APPDATA, NULL, SHGFP_TYPE_CURRENT, appdatafolder))) {
 855
 856         asprintf(&fn, "%s\\.soft-token.rc", appdatafolder);
 857     }
 858
 859 #endif  /* _WIN32 */
 860
 861     return fn;
 862 }
 863
 864
 865 CK_RV CK_SPEC
 866 C_Initialize(CK_VOID_PTR a)
 867 {
 868     CK_C_INITIALIZE_ARGS_PTR args = a;
 869     CK_RV ret;
 870     size_t i;
 871
 872     st_logf("Initialize\n");
 873
 874     INIT_CONTEXT();
 875
 876     OpenSSL_add_all_algorithms();
 877
 878     srandom(getpid() ^ (int) time(NULL));
 879
 880     for (i = 0; i < MAX_NUM_SESSION; i++) {
 881         soft_token.state[i].session_handle = CK_INVALID_HANDLE;
 882         soft_token.state[i].find.attributes = NULL;
 883         soft_token.state[i].find.num_attributes = 0;
 884         soft_token.state[i].find.next_object = -1;
 885         reset_crypto_state(&soft_token.state[i]);
 886     }
 887
 888     soft_token.flags.hardware_slot = 1;
 889     soft_token.flags.app_error_fatal = 0;
 890     soft_token.flags.login_done = 0;
 891
 892     soft_token.object.objs = NULL;
 893     soft_token.object.num_objs = 0;
 894
 895     soft_token.logfile = NULL;
 896 #if 0
 897     soft_token.logfile = stdout;
 898 #endif
 899 #if 0
 900     soft_token.logfile = fopen("/tmp/log-pkcs11.txt", "a");
 901 #endif
 902
 903     if (a != NULL_PTR) {
 904         st_logf("\tCreateMutex:\t%p\n", args->CreateMutex);
 905         st_logf("\tDestroyMutext\t%p\n", args->DestroyMutex);
 906         st_logf("\tLockMutext\t%p\n", args->LockMutex);
 907         st_logf("\tUnlockMutext\t%p\n", args->UnlockMutex);
 908         st_logf("\tFlags\t%04x\n", (unsigned int)args->flags);
 909     }
 910
 911     soft_token.config_file = get_config_file_for_user();
 912
 913     /*
 914      * This operations doesn't return CKR_OK if any of the
 915      * certificates failes to be unparsed (ie password protected).
 916      */
 917     ret = read_conf_file(soft_token.config_file, CKU_USER, NULL);
 918     if (ret == CKR_OK)
 919         soft_token.flags.login_done = 1;
 920
 921     return CKR_OK;
 922 }
 923
 924 CK_RV
 925 C_Finalize(CK_VOID_PTR args)
 926 {
 927     size_t i;
 928
 929     INIT_CONTEXT();
 930
 931     st_logf("Finalize\n");
 932
 933     for (i = 0; i < MAX_NUM_SESSION; i++) {
 934         if (soft_token.state[i].session_handle != CK_INVALID_HANDLE) {
 935             application_error("application finalized without "
 936                               "closing session\n");
 937             close_session(&soft_token.state[i]);
 938         }
 939     }
 940
 941     return CKR_OK;
 942 }
 943
 944 CK_RV
 945 C_GetInfo(CK_INFO_PTR args)
 946 {
 947     INIT_CONTEXT();
 948
 949     st_logf("GetInfo\n");
 950
 951     memset(args, 17, sizeof(*args));
 952     args->cryptokiVersion.major = 2;
 953     args->cryptokiVersion.minor = 10;
 954     snprintf_fill((char *)args->manufacturerID,
 955                   sizeof(args->manufacturerID),
 956                   ' ',
 957                   "Heimdal hx509 SoftToken");
 958     snprintf_fill((char *)args->libraryDescription,
 959                   sizeof(args->libraryDescription), ' ',
 960                   "Heimdal hx509 SoftToken");
 961     args->libraryVersion.major = 2;
 962     args->libraryVersion.minor = 0;
 963
 964     return CKR_OK;
 965 }
 966
 967 extern CK_FUNCTION_LIST funcs;
 968
 969 CK_RV
 970 C_GetFunctionList(CK_FUNCTION_LIST_PTR_PTR ppFunctionList)
 971 {
 972     INIT_CONTEXT();
 973
 974     *ppFunctionList = &funcs;
 975     return CKR_OK;
 976 }
 977
 978 CK_RV
 979 C_GetSlotList(CK_BBOOL tokenPresent,
 980               CK_SLOT_ID_PTR pSlotList,
 981               CK_ULONG_PTR   pulCount)
 982 {
 983     INIT_CONTEXT();
 984     st_logf("GetSlotList: %s\n",
 985             tokenPresent ? "tokenPresent" : "token not Present");
 986     if (pSlotList)
 987         pSlotList[0] = 1;
 988     *pulCount = 1;
 989     return CKR_OK;
 990 }
 991
 992 CK_RV
 993 C_GetSlotInfo(CK_SLOT_ID slotID,
 994               CK_SLOT_INFO_PTR pInfo)
 995 {
 996     INIT_CONTEXT();
 997     st_logf("GetSlotInfo: slot: %d : %s\n", (int)slotID, has_session());
 998
 999     memset(pInfo, 18, sizeof(*pInfo));
1000
1001     if (slotID != 1)
1002         return CKR_ARGUMENTS_BAD;
1003
1004     snprintf_fill((char *)pInfo->slotDescription,
1005                   sizeof(pInfo->slotDescription),
1006                   ' ',
1007                   "Heimdal hx509 SoftToken (slot)");
1008     snprintf_fill((char *)pInfo->manufacturerID,
1009                   sizeof(pInfo->manufacturerID),
1010                   ' ',
1011                   "Heimdal hx509 SoftToken (slot)");
1012     pInfo->flags = CKF_TOKEN_PRESENT;
1013     if (soft_token.flags.hardware_slot)
1014         pInfo->flags |= CKF_HW_SLOT;
1015     pInfo->hardwareVersion.major = 1;
1016     pInfo->hardwareVersion.minor = 0;
1017     pInfo->firmwareVersion.major = 1;
1018     pInfo->firmwareVersion.minor = 0;
1019
1020     return CKR_OK;
1021 }
1022
1023 CK_RV
1024 C_GetTokenInfo(CK_SLOT_ID slotID,
1025                CK_TOKEN_INFO_PTR pInfo)
1026 {
1027     INIT_CONTEXT();
1028     st_logf("GetTokenInfo: %s\n", has_session());
1029
1030     memset(pInfo, 19, sizeof(*pInfo));
1031
1032     snprintf_fill((char *)pInfo->label,
1033                   sizeof(pInfo->label),
1034                   ' ',
1035                   "Heimdal hx509 SoftToken (token)");
1036     snprintf_fill((char *)pInfo->manufacturerID,
1037                   sizeof(pInfo->manufacturerID),
1038                   ' ',
1039                   "Heimdal hx509 SoftToken (token)");
1040     snprintf_fill((char *)pInfo->model,
1041                   sizeof(pInfo->model),
1042                   ' ',
1043                   "Heimdal hx509 SoftToken (token)");
1044     snprintf_fill((char *)pInfo->serialNumber,
1045                   sizeof(pInfo->serialNumber),
1046                   ' ',
1047                   "4711");
1048     pInfo->flags =
1049         CKF_TOKEN_INITIALIZED |
1050         CKF_USER_PIN_INITIALIZED;
1051
1052     if (soft_token.flags.login_done == 0)
1053         pInfo->flags |= CKF_LOGIN_REQUIRED;
1054
1055     /* CFK_RNG |
1056        CKF_RESTORE_KEY_NOT_NEEDED |
1057     */
1058     pInfo->ulMaxSessionCount = MAX_NUM_SESSION;
1059     pInfo->ulSessionCount = soft_token.open_sessions;
1060     pInfo->ulMaxRwSessionCount = MAX_NUM_SESSION;
1061     pInfo->ulRwSessionCount = soft_token.open_sessions;
1062     pInfo->ulMaxPinLen = 1024;
1063     pInfo->ulMinPinLen = 0;
1064     pInfo->ulTotalPublicMemory = 4711;
1065     pInfo->ulFreePublicMemory = 4712;
1066     pInfo->ulTotalPrivateMemory = 4713;
1067     pInfo->ulFreePrivateMemory = 4714;
1068     pInfo->hardwareVersion.major = 2;
1069     pInfo->hardwareVersion.minor = 0;
1070     pInfo->firmwareVersion.major = 2;
1071     pInfo->firmwareVersion.minor = 0;
1072
1073     return CKR_OK;
1074 }
1075
1076 CK_RV
1077 C_GetMechanismList(CK_SLOT_ID slotID,
1078                    CK_MECHANISM_TYPE_PTR pMechanismList,
1079                    CK_ULONG_PTR pulCount)
1080 {
1081     INIT_CONTEXT();
1082     st_logf("GetMechanismList\n");
1083
1084     *pulCount = 1;
1085     if (pMechanismList == NULL_PTR)
1086         return CKR_OK;
1087     pMechanismList[1] = CKM_RSA_PKCS;
1088
1089     return CKR_OK;
1090 }
1091
1092 CK_RV
1093 C_GetMechanismInfo(CK_SLOT_ID slotID,
1094                    CK_MECHANISM_TYPE type,
1095                    CK_MECHANISM_INFO_PTR pInfo)
1096 {
1097     INIT_CONTEXT();
1098     st_logf("GetMechanismInfo: slot %d type: %d\n",
1099             (int)slotID, (int)type);
1100     memset(pInfo, 0, sizeof(*pInfo));
1101
1102     return CKR_OK;
1103 }
1104
1105 CK_RV
1106 C_InitToken(CK_SLOT_ID slotID,
1107             CK_UTF8CHAR_PTR pPin,
1108             CK_ULONG ulPinLen,
1109             CK_UTF8CHAR_PTR pLabel)
1110 {
1111     INIT_CONTEXT();
1112     st_logf("InitToken: slot %d\n", (int)slotID);
1113     return CKR_FUNCTION_NOT_SUPPORTED;
1114 }
1115
1116 CK_RV
1117 C_OpenSession(CK_SLOT_ID slotID,
1118               CK_FLAGS flags,
1119               CK_VOID_PTR pApplication,
1120               CK_NOTIFY Notify,
1121               CK_SESSION_HANDLE_PTR phSession)
1122 {
1123     size_t i;
1124     INIT_CONTEXT();
1125     st_logf("OpenSession: slot: %d\n", (int)slotID);
1126
1127     if (soft_token.open_sessions == MAX_NUM_SESSION)
1128         return CKR_SESSION_COUNT;
1129
1130     soft_token.application = pApplication;
1131     soft_token.notify = Notify;
1132
1133     for (i = 0; i < MAX_NUM_SESSION; i++)
1134         if (soft_token.state[i].session_handle == CK_INVALID_HANDLE)
1135             break;
1136     if (i == MAX_NUM_SESSION)
1137         abort();
1138
1139     soft_token.open_sessions++;
1140
1141     soft_token.state[i].session_handle =
1142         (CK_SESSION_HANDLE)(random() & 0xfffff);
1143     *phSession = soft_token.state[i].session_handle;
1144
1145     return CKR_OK;
1146 }
1147
1148 CK_RV
1149 C_CloseSession(CK_SESSION_HANDLE hSession)
1150 {
1151     struct session_state *state;
1152     INIT_CONTEXT();
1153     st_logf("CloseSession\n");
1154
1155     if (verify_session_handle(hSession, &state) != CKR_OK)
1156         application_error("closed session not open");
1157     else
1158         close_session(state);
1159
1160     return CKR_OK;
1161 }
1162
1163 CK_RV
1164 C_CloseAllSessions(CK_SLOT_ID slotID)
1165 {
1166     size_t i;
1167     INIT_CONTEXT();
1168
1169     st_logf("CloseAllSessions\n");
1170
1171     for (i = 0; i < MAX_NUM_SESSION; i++)
1172         if (soft_token.state[i].session_handle != CK_INVALID_HANDLE)
1173             close_session(&soft_token.state[i]);
1174
1175     return CKR_OK;
1176 }
1177
1178 CK_RV
1179 C_GetSessionInfo(CK_SESSION_HANDLE hSession,
1180                  CK_SESSION_INFO_PTR pInfo)
1181 {
1182     st_logf("GetSessionInfo\n");
1183     INIT_CONTEXT();
1184
1185     VERIFY_SESSION_HANDLE(hSession, NULL);
1186
1187     memset(pInfo, 20, sizeof(*pInfo));
1188
1189     pInfo->slotID = 1;
1190     if (soft_token.flags.login_done)
1191         pInfo->state = CKS_RO_USER_FUNCTIONS;
1192     else
1193         pInfo->state = CKS_RO_PUBLIC_SESSION;
1194     pInfo->flags = CKF_SERIAL_SESSION;
1195     pInfo->ulDeviceError = 0;
1196
1197     return CKR_OK;
1198 }
1199
1200 CK_RV
1201 C_Login(CK_SESSION_HANDLE hSession,
1202         CK_USER_TYPE userType,
1203         CK_UTF8CHAR_PTR pPin,
1204         CK_ULONG ulPinLen)
1205 {
1206     char *pin = NULL;
1207     CK_RV ret;
1208     INIT_CONTEXT();
1209
1210     st_logf("Login\n");
1211
1212     VERIFY_SESSION_HANDLE(hSession, NULL);
1213
1214     if (pPin != NULL_PTR) {
1215         int aret;
1216
1217         aret = asprintf(&pin, "%.*s", (int)ulPinLen, pPin);
1218         if (aret != -1 && pin)
1219                 st_logf("type: %d password: %s\n", (int)userType, pin);
1220         else
1221                 st_logf("memory error: asprintf failed\n");
1222     }
1223
1224     /*
1225      * Login
1226      */
1227
1228     ret = read_conf_file(soft_token.config_file, userType, pin);
1229     if (ret == CKR_OK)
1230         soft_token.flags.login_done = 1;
1231
1232     free(pin);
1233
1234     return soft_token.flags.login_done ? CKR_OK : CKR_PIN_INCORRECT;
1235 }
1236
1237 CK_RV
1238 C_Logout(CK_SESSION_HANDLE hSession)
1239 {
1240     st_logf("Logout\n");
1241     INIT_CONTEXT();
1242
1243     VERIFY_SESSION_HANDLE(hSession, NULL);
1244     return CKR_FUNCTION_NOT_SUPPORTED;
1245 }
1246
1247 CK_RV
1248 C_GetObjectSize(CK_SESSION_HANDLE hSession,
1249                 CK_OBJECT_HANDLE hObject,
1250                 CK_ULONG_PTR pulSize)
1251 {
1252     st_logf("GetObjectSize\n");
1253     INIT_CONTEXT();
1254
1255     VERIFY_SESSION_HANDLE(hSession, NULL);
1256     return CKR_FUNCTION_NOT_SUPPORTED;
1257 }
1258
1259 CK_RV
1260 C_GetAttributeValue(CK_SESSION_HANDLE hSession,
1261                     CK_OBJECT_HANDLE hObject,
1262                     CK_ATTRIBUTE_PTR pTemplate,
1263                     CK_ULONG ulCount)
1264 {
1265     struct session_state *state;
1266     struct st_object *obj;
1267     CK_ULONG i;
1268     CK_RV ret;
1269     int j;
1270
1271     INIT_CONTEXT();
1272
1273     st_logf("GetAttributeValue: %lx\n",
1274             (unsigned long)HANDLE_OBJECT_ID(hObject));
1275     VERIFY_SESSION_HANDLE(hSession, &state);
1276
1277     if ((ret = object_handle_to_object(hObject, &obj)) != CKR_OK) {
1278         st_logf("object not found: %lx\n",
1279                 (unsigned long)HANDLE_OBJECT_ID(hObject));
1280         return ret;
1281     }
1282
1283     for (i = 0; i < ulCount; i++) {
1284         st_logf("       getting 0x%08lx\n", (unsigned long)pTemplate[i].type);
1285         for (j = 0; j < obj->num_attributes; j++) {
1286             if (obj->attrs[j].secret) {
1287                 pTemplate[i].ulValueLen = (CK_ULONG)-1;
1288                 break;
1289             }
1290             if (pTemplate[i].type == obj->attrs[j].attribute.type) {
1291                 if (pTemplate[i].pValue != NULL_PTR && obj->attrs[j].secret == 0) {
1292                     if (pTemplate[i].ulValueLen >= obj->attrs[j].attribute.ulValueLen)
1293                         memcpy(pTemplate[i].pValue, obj->attrs[j].attribute.pValue,
1294                                obj->attrs[j].attribute.ulValueLen);
1295                 }
1296                 pTemplate[i].ulValueLen = obj->attrs[j].attribute.ulValueLen;
1297                 break;
1298             }
1299         }
1300         if (j == obj->num_attributes) {
1301             st_logf("key type: 0x%08lx not found\n", (unsigned long)pTemplate[i].type);
1302             pTemplate[i].ulValueLen = (CK_ULONG)-1;
1303         }
1304
1305     }
1306     return CKR_OK;
1307 }
1308
1309 CK_RV
1310 C_FindObjectsInit(CK_SESSION_HANDLE hSession,
1311                   CK_ATTRIBUTE_PTR pTemplate,
1312                   CK_ULONG ulCount)
1313 {
1314     struct session_state *state;
1315
1316     st_logf("FindObjectsInit\n");
1317
1318     INIT_CONTEXT();
1319
1320     VERIFY_SESSION_HANDLE(hSession, &state);
1321
1322     if (state->find.next_object != -1) {
1323         application_error("application didn't do C_FindObjectsFinal\n");
1324         find_object_final(state);
1325     }
1326     if (ulCount) {
1327         CK_ULONG i;
1328
1329         print_attributes(pTemplate, ulCount);
1330
1331         state->find.attributes =
1332             calloc(1, ulCount * sizeof(state->find.attributes[0]));
1333         if (state->find.attributes == NULL)
1334             return CKR_DEVICE_MEMORY;
1335         for (i = 0; i < ulCount; i++) {
1336             state->find.attributes[i].pValue =
1337                 malloc(pTemplate[i].ulValueLen);
1338             if (state->find.attributes[i].pValue == NULL) {
1339                 find_object_final(state);
1340                 return CKR_DEVICE_MEMORY;
1341             }
1342             memcpy(state->find.attributes[i].pValue,
1343                    pTemplate[i].pValue, pTemplate[i].ulValueLen);
1344             state->find.attributes[i].type = pTemplate[i].type;
1345             state->find.attributes[i].ulValueLen = pTemplate[i].ulValueLen;
1346         }
1347         state->find.num_attributes = ulCount;
1348         state->find.next_object = 0;
1349     } else {
1350         st_logf("find all objects\n");
1351         state->find.attributes = NULL;
1352         state->find.num_attributes = 0;
1353         state->find.next_object = 0;
1354     }
1355
1356     return CKR_OK;
1357 }
1358
1359 CK_RV
1360 C_FindObjects(CK_SESSION_HANDLE hSession,
1361               CK_OBJECT_HANDLE_PTR phObject,
1362               CK_ULONG ulMaxObjectCount,
1363               CK_ULONG_PTR pulObjectCount)
1364 {
1365     struct session_state *state;
1366     int i;
1367
1368     INIT_CONTEXT();
1369
1370     st_logf("FindObjects\n");
1371
1372     VERIFY_SESSION_HANDLE(hSession, &state);
1373
1374     if (state->find.next_object == -1) {
1375         application_error("application didn't do C_FindObjectsInit\n");
1376         return CKR_ARGUMENTS_BAD;
1377     }
1378     if (ulMaxObjectCount == 0) {
1379         application_error("application asked for 0 objects\n");
1380         return CKR_ARGUMENTS_BAD;
1381     }
1382     *pulObjectCount = 0;
1383     for (i = state->find.next_object; i < soft_token.object.num_objs; i++) {
1384         st_logf("FindObjects: %d\n", i);
1385         state->find.next_object = i + 1;
1386         if (attributes_match(soft_token.object.objs[i],
1387                              state->find.attributes,
1388                              state->find.num_attributes)) {
1389             *phObject++ = soft_token.object.objs[i]->object_handle;
1390             ulMaxObjectCount--;
1391             (*pulObjectCount)++;
1392             if (ulMaxObjectCount == 0)
1393                 break;
1394         }
1395     }
1396     return CKR_OK;
1397 }
1398
1399 CK_RV
1400 C_FindObjectsFinal(CK_SESSION_HANDLE hSession)
1401 {
1402     struct session_state *state;
1403
1404     INIT_CONTEXT();
1405
1406     st_logf("FindObjectsFinal\n");
1407     VERIFY_SESSION_HANDLE(hSession, &state);
1408     find_object_final(state);
1409     return CKR_OK;
1410 }
1411
1412 static CK_RV
1413 commonInit(CK_ATTRIBUTE *attr_match, int attr_match_len,
1414            const CK_MECHANISM_TYPE *mechs, int mechs_len,
1415            const CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey,
1416            struct st_object **o)
1417 {
1418     CK_RV ret;
1419     int i;
1420
1421     *o = NULL;
1422     if ((ret = object_handle_to_object(hKey, o)) != CKR_OK)
1423         return ret;
1424
1425     ret = attributes_match(*o, attr_match, attr_match_len);
1426     if (!ret) {
1427         application_error("called commonInit on key that doesn't "
1428                           "support required attr");
1429         return CKR_ARGUMENTS_BAD;
1430     }
1431
1432     for (i = 0; i < mechs_len; i++)
1433         if (mechs[i] == pMechanism->mechanism)
1434             break;
1435     if (i == mechs_len) {
1436         application_error("called mech (%08lx) not supported\n",
1437                           pMechanism->mechanism);
1438         return CKR_ARGUMENTS_BAD;
1439     }
1440     return CKR_OK;
1441 }
1442
1443
1444 static CK_RV
1445 dup_mechanism(CK_MECHANISM_PTR *dp, const CK_MECHANISM_PTR pMechanism)
1446 {
1447     CK_MECHANISM_PTR p;
1448
1449     p = malloc(sizeof(*p));
1450     if (p == NULL)
1451         return CKR_DEVICE_MEMORY;
1452
1453     if (*dp)
1454         free(*dp);
1455     *dp = p;
1456     memcpy(p, pMechanism, sizeof(*p));
1457
1458     return CKR_OK;
1459 }
1460
1461 CK_RV
1462 C_DigestInit(CK_SESSION_HANDLE hSession,
1463              CK_MECHANISM_PTR pMechanism)
1464 {
1465     st_logf("DigestInit\n");
1466     INIT_CONTEXT();
1467     VERIFY_SESSION_HANDLE(hSession, NULL);
1468     return CKR_FUNCTION_NOT_SUPPORTED;
1469 }
1470
1471 CK_RV
1472 C_SignInit(CK_SESSION_HANDLE hSession,
1473            CK_MECHANISM_PTR pMechanism,
1474            CK_OBJECT_HANDLE hKey)
1475 {
1476     struct session_state *state;
1477     CK_MECHANISM_TYPE mechs[] = { CKM_RSA_PKCS };
1478     CK_BBOOL bool_true = CK_TRUE;
1479     CK_ATTRIBUTE attr[] = {
1480         { CKA_SIGN, &bool_true, sizeof(bool_true) }
1481     };
1482     struct st_object *o;
1483     CK_RV ret;
1484
1485     INIT_CONTEXT();
1486     st_logf("SignInit\n");
1487     VERIFY_SESSION_HANDLE(hSession, &state);
1488
1489     ret = commonInit(attr, sizeof(attr)/sizeof(attr[0]),
1490                      mechs, sizeof(mechs)/sizeof(mechs[0]),
1491                      pMechanism, hKey, &o);
1492     if (ret)
1493         return ret;
1494
1495     ret = dup_mechanism(&state->sign_mechanism, pMechanism);
1496     if (ret == CKR_OK)
1497         state->sign_object = OBJECT_ID(o);
1498
1499     return CKR_OK;
1500 }
1501
1502 CK_RV
1503 C_Sign(CK_SESSION_HANDLE hSession,
1504        CK_BYTE_PTR pData,
1505        CK_ULONG ulDataLen,
1506        CK_BYTE_PTR pSignature,
1507        CK_ULONG_PTR pulSignatureLen)
1508 {
1509     struct session_state *state;
1510     struct st_object *o;
1511     CK_RV ret;
1512     int hret;
1513     const AlgorithmIdentifier *alg;
1514     heim_octet_string sig, data;
1515
1516     INIT_CONTEXT();
1517     st_logf("Sign\n");
1518     VERIFY_SESSION_HANDLE(hSession, &state);
1519
1520     sig.data = NULL;
1521     sig.length = 0;
1522
1523     if (state->sign_object == -1)
1524         return CKR_ARGUMENTS_BAD;
1525
1526     if (pulSignatureLen == NULL) {
1527         st_logf("signature len NULL\n");
1528         ret = CKR_ARGUMENTS_BAD;
1529         goto out;
1530     }
1531
1532     if (pData == NULL_PTR) {
1533         st_logf("data NULL\n");
1534         ret = CKR_ARGUMENTS_BAD;
1535         goto out;
1536     }
1537
1538     o = soft_token.object.objs[state->sign_object];
1539
1540     if (hx509_cert_have_private_key(o->cert) == 0) {
1541         st_logf("private key NULL\n");
1542         return CKR_ARGUMENTS_BAD;
1543     }
1544
1545     switch(state->sign_mechanism->mechanism) {
1546     case CKM_RSA_PKCS:
1547         alg = hx509_signature_rsa_pkcs1_x509();
1548         break;
1549     default:
1550         ret = CKR_FUNCTION_NOT_SUPPORTED;
1551         goto out;
1552     }
1553
1554     data.data = pData;
1555     data.length = ulDataLen;
1556
1557     hret = _hx509_create_signature(context,
1558                                    _hx509_cert_private_key(o->cert),
1559                                    alg,
1560                                    &data,
1561                                    NULL,
1562                                    &sig);
1563     if (hret) {
1564         ret = CKR_DEVICE_ERROR;
1565         goto out;
1566     }
1567     *pulSignatureLen = sig.length;
1568
1569     if (pSignature != NULL_PTR)
1570         memcpy(pSignature, sig.data, sig.length);
1571
1572     ret = CKR_OK;
1573  out:
1574     if (sig.data) {
1575         memset(sig.data, 0, sig.length);
1576         der_free_octet_string(&sig);
1577     }
1578     return ret;
1579 }
1580
1581 CK_RV
1582 C_SignUpdate(CK_SESSION_HANDLE hSession,
1583              CK_BYTE_PTR pPart,
1584              CK_ULONG ulPartLen)
1585 {
1586     INIT_CONTEXT();
1587     st_logf("SignUpdate\n");
1588     VERIFY_SESSION_HANDLE(hSession, NULL);
1589     return CKR_FUNCTION_NOT_SUPPORTED;
1590 }
1591
1592
1593 CK_RV
1594 C_SignFinal(CK_SESSION_HANDLE hSession,
1595             CK_BYTE_PTR pSignature,
1596             CK_ULONG_PTR pulSignatureLen)
1597 {
1598     INIT_CONTEXT();
1599     st_logf("SignUpdate\n");
1600     VERIFY_SESSION_HANDLE(hSession, NULL);
1601     return CKR_FUNCTION_NOT_SUPPORTED;
1602 }
1603
1604 CK_RV
1605 C_VerifyInit(CK_SESSION_HANDLE hSession,
1606              CK_MECHANISM_PTR pMechanism,
1607              CK_OBJECT_HANDLE hKey)
1608 {
1609     struct session_state *state;
1610     CK_MECHANISM_TYPE mechs[] = { CKM_RSA_PKCS };
1611     CK_BBOOL bool_true = CK_TRUE;
1612     CK_ATTRIBUTE attr[] = {
1613         { CKA_VERIFY, &bool_true, sizeof(bool_true) }
1614     };
1615     struct st_object *o;
1616     CK_RV ret;
1617
1618     INIT_CONTEXT();
1619     st_logf("VerifyInit\n");
1620     VERIFY_SESSION_HANDLE(hSession, &state);
1621
1622     ret = commonInit(attr, sizeof(attr)/sizeof(attr[0]),
1623                      mechs, sizeof(mechs)/sizeof(mechs[0]),
1624                      pMechanism, hKey, &o);
1625     if (ret)
1626         return ret;
1627
1628     ret = dup_mechanism(&state->verify_mechanism, pMechanism);
1629     if (ret == CKR_OK)
1630         state->verify_object = OBJECT_ID(o);
1631
1632     return ret;
1633 }
1634
1635 CK_RV
1636 C_Verify(CK_SESSION_HANDLE hSession,
1637          CK_BYTE_PTR pData,
1638          CK_ULONG ulDataLen,
1639          CK_BYTE_PTR pSignature,
1640          CK_ULONG ulSignatureLen)
1641 {
1642     struct session_state *state;
1643     struct st_object *o;
1644     const AlgorithmIdentifier *alg;
1645     CK_RV ret;
1646     int hret;
1647     heim_octet_string data, sig;
1648
1649     INIT_CONTEXT();
1650     st_logf("Verify\n");
1651     VERIFY_SESSION_HANDLE(hSession, &state);
1652
1653     if (state->verify_object == -1)
1654         return CKR_ARGUMENTS_BAD;
1655
1656     o = soft_token.object.objs[state->verify_object];
1657
1658     switch(state->verify_mechanism->mechanism) {
1659     case CKM_RSA_PKCS:
1660         alg = hx509_signature_rsa_pkcs1_x509();
1661         break;
1662     default:
1663         ret = CKR_FUNCTION_NOT_SUPPORTED;
1664         goto out;
1665     }
1666
1667     sig.data = pData;
1668     sig.length = ulDataLen;
1669     data.data = pSignature;
1670     data.length = ulSignatureLen;
1671
1672     hret = _hx509_verify_signature(context,
1673                                    o->cert,
1674                                    alg,
1675                                    &data,
1676                                    &sig);
1677     if (hret) {
1678         ret = CKR_GENERAL_ERROR;
1679         goto out;
1680     }
1681     ret = CKR_OK;
1682
1683  out:
1684     return ret;
1685 }
1686
1687
1688 CK_RV
1689 C_VerifyUpdate(CK_SESSION_HANDLE hSession,
1690                CK_BYTE_PTR pPart,
1691                CK_ULONG ulPartLen)
1692 {
1693     INIT_CONTEXT();
1694     st_logf("VerifyUpdate\n");
1695     VERIFY_SESSION_HANDLE(hSession, NULL);
1696     return CKR_FUNCTION_NOT_SUPPORTED;
1697 }
1698
1699 CK_RV
1700 C_VerifyFinal(CK_SESSION_HANDLE hSession,
1701               CK_BYTE_PTR pSignature,
1702               CK_ULONG ulSignatureLen)
1703 {
1704     INIT_CONTEXT();
1705     st_logf("VerifyFinal\n");
1706     VERIFY_SESSION_HANDLE(hSession, NULL);
1707     return CKR_FUNCTION_NOT_SUPPORTED;
1708 }
1709
1710 CK_RV
1711 C_GenerateRandom(CK_SESSION_HANDLE hSession,
1712                  CK_BYTE_PTR RandomData,
1713                  CK_ULONG ulRandomLen)
1714 {
1715     INIT_CONTEXT();
1716     st_logf("GenerateRandom\n");
1717     VERIFY_SESSION_HANDLE(hSession, NULL);
1718     return CKR_FUNCTION_NOT_SUPPORTED;
1719 }
1720
1721
1722 CK_FUNCTION_LIST funcs = {
1723     { 2, 11 },
1724     C_Initialize,
1725     C_Finalize,
1726     C_GetInfo,
1727     C_GetFunctionList,
1728     C_GetSlotList,
1729     C_GetSlotInfo,
1730     C_GetTokenInfo,
1731     C_GetMechanismList,
1732     C_GetMechanismInfo,
1733     C_InitToken,
1734     (void *)func_not_supported, /* C_InitPIN */
1735     (void *)func_not_supported, /* C_SetPIN */
1736     C_OpenSession,
1737     C_CloseSession,
1738     C_CloseAllSessions,
1739     C_GetSessionInfo,
1740     (void *)func_not_supported, /* C_GetOperationState */
1741     (void *)func_not_supported, /* C_SetOperationState */
1742     C_Login,
1743     C_Logout,
1744     (void *)func_not_supported, /* C_CreateObject */
1745     (void *)func_not_supported, /* C_CopyObject */
1746     (void *)func_not_supported, /* C_DestroyObject */
1747     (void *)func_not_supported, /* C_GetObjectSize */
1748     C_GetAttributeValue,
1749     (void *)func_not_supported, /* C_SetAttributeValue */
1750     C_FindObjectsInit,
1751     C_FindObjects,
1752     C_FindObjectsFinal,
1753     (void *)func_not_supported, /* C_EncryptInit, */
1754     (void *)func_not_supported, /* C_Encrypt, */
1755     (void *)func_not_supported, /* C_EncryptUpdate, */
1756     (void *)func_not_supported, /* C_EncryptFinal, */
1757     (void *)func_not_supported, /* C_DecryptInit, */
1758     (void *)func_not_supported, /* C_Decrypt, */
1759     (void *)func_not_supported, /* C_DecryptUpdate, */
1760     (void *)func_not_supported, /* C_DecryptFinal, */
1761     C_DigestInit,
1762     (void *)func_not_supported, /* C_Digest */
1763     (void *)func_not_supported, /* C_DigestUpdate */
1764     (void *)func_not_supported, /* C_DigestKey */
1765     (void *)func_not_supported, /* C_DigestFinal */
1766     C_SignInit,
1767     C_Sign,
1768     C_SignUpdate,
1769     C_SignFinal,
1770     (void *)func_not_supported, /* C_SignRecoverInit */
1771     (void *)func_not_supported, /* C_SignRecover */
1772     C_VerifyInit,
1773     C_Verify,
1774     C_VerifyUpdate,
1775     C_VerifyFinal,
1776     (void *)func_not_supported, /* C_VerifyRecoverInit */
1777     (void *)func_not_supported, /* C_VerifyRecover */
1778     (void *)func_not_supported, /* C_DigestEncryptUpdate */
1779     (void *)func_not_supported, /* C_DecryptDigestUpdate */
1780     (void *)func_not_supported, /* C_SignEncryptUpdate */
1781     (void *)func_not_supported, /* C_DecryptVerifyUpdate */
1782     (void *)func_not_supported, /* C_GenerateKey */
1783     (void *)func_not_supported, /* C_GenerateKeyPair */
1784     (void *)func_not_supported, /* C_WrapKey */
1785     (void *)func_not_supported, /* C_UnwrapKey */
1786     (void *)func_not_supported, /* C_DeriveKey */
1787     (void *)func_not_supported, /* C_SeedRandom */
1788     C_GenerateRandom,
1789     (void *)func_not_supported, /* C_GetFunctionStatus */
1790     (void *)func_not_supported, /* C_CancelFunction */
1791     (void *)func_not_supported  /* C_WaitForSlotEvent */
1792 };