| blob | 7c81043e431073b4f9ac5c8436067037cd6c3ac1 |
1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 * Copyright 2012 Milan Jurik. All rights reserved.
25 * Copyright (c) 2018, Joyent, Inc.
26 */
28 #include <stdlib.h>
29 #include <string.h>
30 #include <security/cryptoki.h>
31 #include <sys/crypto/common.h>
32 #include <arcfour.h>
33 #include <aes_impl.h>
34 #include <blowfish_impl.h>
35 #include <bignum.h>
36 #include <des_impl.h>
37 #include <rsa_impl.h>
46 /*
47 * This attribute table is used by the soft_lookup_attr()
48 * to validate the attributes.
49 */
50 CK_ATTRIBUTE_TYPE attr_map[] = {
51 CKA_PRIVATE,
52 CKA_LABEL,
53 CKA_APPLICATION,
54 CKA_OBJECT_ID,
55 CKA_CERTIFICATE_TYPE,
56 CKA_ISSUER,
57 CKA_SERIAL_NUMBER,
58 CKA_AC_ISSUER,
59 CKA_OWNER,
60 CKA_ATTR_TYPES,
61 CKA_SUBJECT,
62 CKA_ID,
63 CKA_SENSITIVE,
64 CKA_START_DATE,
65 CKA_END_DATE,
66 CKA_MODULUS,
67 CKA_MODULUS_BITS,
68 CKA_PUBLIC_EXPONENT,
69 CKA_PRIVATE_EXPONENT,
70 CKA_PRIME_1,
71 CKA_PRIME_2,
72 CKA_EXPONENT_1,
73 CKA_EXPONENT_2,
74 CKA_COEFFICIENT,
75 CKA_PRIME,
76 CKA_SUBPRIME,
77 CKA_BASE,
78 CKA_EXTRACTABLE,
79 CKA_LOCAL,
80 CKA_NEVER_EXTRACTABLE,
81 CKA_ALWAYS_SENSITIVE,
82 CKA_MODIFIABLE,
83 CKA_ECDSA_PARAMS,
84 CKA_EC_PARAMS,
85 CKA_EC_POINT,
86 CKA_SECONDARY_AUTH,
87 CKA_AUTH_PIN_FLAGS,
88 CKA_HW_FEATURE_TYPE,
89 CKA_RESET_ON_INIT,
90 CKA_HAS_RESET
91 };
93 /*
94 * attributes that exists only in public key objects
95 * Note: some attributes may also exist in one or two
96 * other object classes, but they are also listed
97 * because not all object have them.
98 */
99 CK_ATTRIBUTE_TYPE PUB_KEY_ATTRS[] =
100 {
101 CKA_SUBJECT,
102 CKA_ENCRYPT,
103 CKA_WRAP,
104 CKA_VERIFY,
105 CKA_VERIFY_RECOVER,
106 CKA_MODULUS,
107 CKA_MODULUS_BITS,
108 CKA_PUBLIC_EXPONENT,
109 CKA_PRIME,
110 CKA_SUBPRIME,
111 CKA_BASE,
112 CKA_TRUSTED,
113 CKA_ECDSA_PARAMS,
114 CKA_EC_PARAMS,
115 CKA_EC_POINT
116 };
118 /*
119 * attributes that exists only in private key objects
120 * Note: some attributes may also exist in one or two
121 * other object classes, but they are also listed
122 * because not all object have them.
123 */
124 CK_ATTRIBUTE_TYPE PRIV_KEY_ATTRS[] =
125 {
126 CKA_DECRYPT,
127 CKA_UNWRAP,
128 CKA_SIGN,
129 CKA_SIGN_RECOVER,
130 CKA_MODULUS,
131 CKA_PUBLIC_EXPONENT,
132 CKA_PRIVATE_EXPONENT,
133 CKA_PRIME,
134 CKA_SUBPRIME,
135 CKA_BASE,
136 CKA_PRIME_1,
137 CKA_PRIME_2,
138 CKA_EXPONENT_1,
139 CKA_EXPONENT_2,
140 CKA_COEFFICIENT,
141 CKA_VALUE_BITS,
142 CKA_SUBJECT,
143 CKA_SENSITIVE,
144 CKA_EXTRACTABLE,
145 CKA_NEVER_EXTRACTABLE,
146 CKA_ALWAYS_SENSITIVE,
147 CKA_EC_PARAMS
148 };
150 /*
151 * attributes that exists only in secret key objects
152 * Note: some attributes may also exist in one or two
153 * other object classes, but they are also listed
154 * because not all object have them.
155 */
156 CK_ATTRIBUTE_TYPE SECRET_KEY_ATTRS[] =
157 {
158 CKA_VALUE_LEN,
159 CKA_ENCRYPT,
160 CKA_DECRYPT,
161 CKA_WRAP,
162 CKA_UNWRAP,
163 CKA_SIGN,
164 CKA_VERIFY,
165 CKA_SENSITIVE,
166 CKA_EXTRACTABLE,
167 CKA_NEVER_EXTRACTABLE,
168 CKA_ALWAYS_SENSITIVE
169 };
171 /*
172 * attributes that exists only in domain parameter objects
173 * Note: some attributes may also exist in one or two
174 * other object classes, but they are also listed
175 * because not all object have them.
176 */
177 CK_ATTRIBUTE_TYPE DOMAIN_ATTRS[] =
178 {
179 CKA_PRIME,
180 CKA_SUBPRIME,
181 CKA_BASE,
182 CKA_PRIME_BITS,
183 CKA_SUBPRIME_BITS,
184 CKA_SUB_PRIME_BITS
185 };
187 /*
188 * attributes that exists only in hardware feature objects
189 *
190 */
191 CK_ATTRIBUTE_TYPE HARDWARE_ATTRS[] =
192 {
193 CKA_HW_FEATURE_TYPE,
194 CKA_RESET_ON_INIT,
195 CKA_HAS_RESET
196 };
198 /*
199 * attributes that exists only in certificate objects
200 */
201 CK_ATTRIBUTE_TYPE CERT_ATTRS[] =
202 {
203 CKA_CERTIFICATE_TYPE,
204 CKA_TRUSTED,
205 CKA_SUBJECT,
206 CKA_ID,
207 CKA_ISSUER,
208 CKA_AC_ISSUER,
209 CKA_SERIAL_NUMBER,
210 CKA_OWNER,
211 CKA_ATTR_TYPES
212 };
215 /*
216 * Validate the attribute by using binary search algorithm.
217 */
218 CK_RV
220 {
228 /* Always starts from middle. */
232 /* Adjust the lower bound to upper half. */
235 }
238 /* Found it. */
240 }
243 /* Adjust the upper bound to lower half. */
246 }
247 }
249 /* Failed to find the matching attribute from the attribute table. */
251 }
254 /*
255 * Validate the attribute by using the following search algorithm:
256 *
257 * 1) Search for the most frequently used attributes first.
258 * 2) If not found, search for the usage-purpose attributes - these
259 * attributes have dense set of values, therefore compiler will
260 * optimize it with a branch table and branch to the appropriate
261 * case.
262 * 3) If still not found, use binary search for the rest of the
263 * attributes in the attr_map[] table.
264 */
265 CK_RV
268 {
270 CK_ULONG i;
274 /* First tier search */
290 /* Second tier search */
311 /* Third tier search */
316 }
318 }
319 }
321 }
323 static void
325 {
330 }
331 }
333 static CK_RV
335 {
344 /* free memory if its already allocated */
351 }
361 }
366 }
369 }
371 void
373 {
385 }
390 }
397 }
402 }
404 }
405 }
407 /*
408 * Clean up and release all the storage in the extra attribute list
409 * of an object.
410 */
411 void
413 {
415 CK_ATTRIBUTE_INFO_PTR extra_attr;
416 CK_ATTRIBUTE_INFO_PTR tmp;
422 /*
423 * All extra attributes in the extra attribute
424 * list have pValue points to the value of the
425 * attribute (with simple byte array type).
426 * Free the storage for the value of the attribute.
427 */
430 }
432 /* Free the storage for the attribute_info struct. */
435 }
438 }
441 /*
442 * Create the attribute_info struct to hold the object's attribute,
443 * and add it to the extra attribute list of an object.
444 */
445 CK_RV
447 {
449 CK_ATTRIBUTE_INFO_PTR attrp;
451 /* Allocate the storage for the attribute_info struct. */
455 }
457 /* Set up attribute_info struct. */
463 /* Allocate storage for the value of the attribute. */
468 }
474 }
476 /* Insert the new attribute in front of extra attribute list. */
483 }
486 }
488 CK_RV
490 CK_CERTIFICATE_TYPE type)
491 {
494 x509_cert_t x509;
495 x509_attr_cert_t x509_attr;
500 }
523 /* wrong certificate type */
525 }
529 }
531 /*
532 * Copy the attribute_info struct from the old object to a new attribute_info
533 * struct, and add that new struct to the extra attribute list of the new
534 * object.
535 */
536 CK_RV
538 {
539 CK_ATTRIBUTE_INFO_PTR attrp;
541 /* Allocate attribute_info struct. */
545 }
556 }
562 }
564 /* Insert the new attribute in front of extra attribute list */
571 }
574 }
577 /*
578 * Get the attribute triple from the extra attribute list in the object
579 * (if the specified attribute type is found), and copy it to a template.
580 * Note the type of the attribute to be copied is specified by the template,
581 * and the storage is pre-allocated for the atrribute value in the template
582 * for doing the copy.
583 */
584 CK_RV
586 {
588 CK_ATTRIBUTE_INFO_PTR extra_attr;
595 /* Found it. */
598 /* Does not match, try next one. */
600 }
601 }
604 /* A valid but un-initialized attribute. */
607 }
609 /*
610 * We found the attribute in the extra attribute list.
611 */
615 }
618 /*
619 * The buffer provided by the application is large
620 * enough to hold the value of the attribute.
621 */
627 /*
628 * The buffer provided by the application does
629 * not have enough space to hold the value.
630 */
633 }
634 }
637 /*
638 * Modify the attribute triple in the extra attribute list of the object
639 * if the specified attribute type is found. Otherwise, just add it to
640 * list.
641 */
642 CK_RV
645 {
647 CK_ATTRIBUTE_INFO_PTR extra_attr;
653 /* Found it. */
656 /* Does not match, try next one. */
658 }
659 }
662 /*
663 * This attribute is a new one, go ahead adding it to
664 * the extra attribute list.
665 */
667 }
669 /* We found the attribute in the extra attribute list. */
673 /* The old buffer is too small to hold the new value. */
675 /* Free storage for the old attribute value. */
678 }
680 /* Allocate storage for the new attribute value. */
684 }
685 }
687 /* Replace the attribute with new value. */
693 }
696 }
699 /*
700 * Copy the big integer attribute value from template to a biginteger_t struct.
701 */
702 CK_RV
704 {
708 /* Allocate storage for the value of the attribute. */
712 }
720 }
723 }
726 /*
727 * Copy the big integer attribute value from a biginteger_t struct in the
728 * object to a template.
729 */
730 CK_RV
732 {
737 }
742 }
745 /*
746 * The buffer provided by the application is large
747 * enough to hold the value of the attribute.
748 */
754 /*
755 * The buffer provided by the application does
756 * not have enough space to hold the value.
757 */
760 }
761 }
764 /*
765 * Copy the boolean data type attribute value from an object for the
766 * specified attribute to the template.
767 */
768 CK_RV
771 {
776 }
779 /*
780 * The buffer provided by the application is large
781 * enough to hold the value of the attribute.
782 */
787 }
792 /*
793 * The buffer provided by the application does
794 * not have enough space to hold the value.
795 */
798 }
799 }
801 /*
802 * Set the boolean data type attribute value in the object.
803 */
804 CK_RV
807 {
811 else
815 }
818 /*
819 * Copy the CK_ULONG data type attribute value from an object to the
820 * template.
821 */
822 CK_RV
824 {
829 }
832 /*
833 * The buffer provided by the application is large
834 * enough to hold the value of the attribute.
835 * It is also assumed to be correctly aligned.
836 */
841 /*
842 * The buffer provided by the application does
843 * not have enough space to hold the value.
844 */
847 }
848 }
851 /*
852 * Copy the CK_ULONG data type attribute value from a template to the
853 * object.
854 */
855 static CK_RV
857 {
866 }
869 }
871 /*
872 * Copy the big integer attribute value from source's biginteger_t to
873 * destination's biginteger_t.
874 */
875 void
877 {
881 /*
882 * To do the copy, just have dst's big_value points
883 * to src's.
884 */
888 /*
889 * After the copy, nullify the src's big_value pointer.
890 * It prevents any double freeing the value.
891 */
897 }
898 }
900 CK_RV
902 {
905 /* Allocate storage for the value of the attribute. */
909 }
919 }
923 }
925 CK_RV
927 {
929 /*
930 * If the attribute was already set, clear out the
931 * existing value and release the memory.
932 */
939 }
941 }
947 }
950 }
953 }
955 /*
956 * Copy the certificate attribute information to the template.
957 * If the template attribute is not big enough, set the ulValueLen=-1
958 * and return CKR_BUFFER_TOO_SMALL.
959 */
960 static CK_RV
962 {
967 /*
968 * The buffer provided by the application is large
969 * enough to hold the value of the attribute.
970 */
975 /*
976 * The buffer provided by the application does
977 * not have enough space to hold the value.
978 */
981 }
982 }
984 void
986 {
990 }
992 /*
993 * Release the storage allocated for object attribute with big integer
994 * value.
995 */
996 void
998 {
1006 }
1009 /*
1010 * Clean up and release all the storage allocated to hold the big integer
1011 * attributes associated with the type (i.e. class) of the object. Also,
1012 * release the storage allocated to the type of the object.
1013 */
1014 void
1016 {
1028 object_p));
1030 object_p));
1035 object_p));
1037 object_p));
1039 object_p));
1041 object_p));
1046 object_p));
1048 object_p));
1050 object_p));
1055 object_p));
1057 object_p));
1059 object_p));
1061 object_p));
1065 object_p));
1067 }
1069 /* Release Public Key Object struct */
1072 }
1080 object_p));
1082 object_p));
1084 object_p));
1086 object_p));
1088 object_p));
1090 object_p));
1092 object_p));
1094 object_p));
1099 object_p));
1101 object_p));
1103 object_p));
1105 object_p));
1110 object_p));
1112 object_p));
1114 object_p));
1119 object_p));
1121 object_p));
1123 object_p));
1125 object_p));
1130 object_p));
1132 }
1134 /* Release Private Key Object struct. */
1137 }
1142 /* cleanup key data area */
1147 }
1148 /* cleanup key schedule data area */
1153 }
1155 /* Release Secret Key Object struct. */
1158 }
1166 object_p));
1168 object_p));
1170 object_p));
1175 object_p));
1177 object_p));
1182 object_p));
1184 object_p));
1186 object_p));
1188 }
1190 /* Release Domain Parameters Object struct. */
1193 }
1195 }
1196 }
1199 /*
1200 * Parse the common attributes. Return to caller with appropriate return
1201 * value to indicate if the supplied template specifies a valid attribute
1202 * with a valid value.
1203 */
1204 CK_RV
1206 {
1214 /* default boolean attributes */
1220 }
1227 /*
1228 * Check if this is the special case when
1229 * the PIN is never initialized in the keystore.
1230 * If true, we will let it pass here and let
1231 * it fail with CKR_PIN_EXPIRED later on.
1232 */
1237 }
1238 }
1241 }
1249 }
1252 }
1255 /*
1256 * Build a Public Key Object.
1257 *
1258 * - Parse the object's template, and when an error is detected such as
1259 * invalid attribute type, invalid attribute value, etc., return
1260 * with appropriate return value.
1261 * - Set up attribute mask field in the object for the supplied common
1262 * attributes that have boolean type.
1263 * - Build the attribute_info struct to hold the value of each supplied
1264 * attribute that has byte array type. Link attribute_info structs
1265 * together to form the extra attribute list of the object.
1266 * - Allocate storage for the Public Key object.
1267 * - Build the Public Key object according to the key type. Allocate
1268 * storage to hold the big integer value for the supplied attributes
1269 * that are required for a certain key type.
1270 *
1271 */
1272 CK_RV
1275 {
1277 ulong_t i;
1282 /* Must set flags */
1291 /* Must not set flags */
1295 biginteger_t modulus;
1296 biginteger_t pubexpo;
1297 biginteger_t prime;
1298 biginteger_t subprime;
1299 biginteger_t base;
1300 biginteger_t value;
1301 biginteger_t point;
1302 CK_ATTRIBUTE string_tmp;
1303 CK_ATTRIBUTE param_tmp;
1311 BIGNUM n;
1313 /* prevent bigint_attr_cleanup from freeing invalid attr value */
1326 /* Public Key Object Attributes */
1329 /* common key attributes */
1338 /* common public key attribute */
1340 /*
1341 * Allocate storage to hold the attribute
1342 * value with byte array type, and add it to
1343 * the extra attribute list of the object.
1344 */
1346 new_object);
1349 }
1352 /*
1353 * The following key related attribute types must
1354 * not be specified by C_CreateObject, C_GenerateKey(Pair).
1355 */
1361 /* Key related boolean attributes */
1370 else
1377 else
1384 else
1391 else
1405 /*
1406 * The following key related attribute types must
1407 * be specified according to the key type by
1408 * C_CreateObject.
1409 */
1413 /*
1414 * Copyin big integer attribute from template
1415 * to a local variable.
1416 */
1422 /*
1423 * Modulus length needs to be between min key length and
1424 * max key length.
1425 */
1427 MIN_RSA_KEYLENGTH_IN_BYTES) ||
1429 MAX_RSA_KEYLENGTH_IN_BYTES)) {
1432 }
1474 }
1475 }
1520 }
1523 /* Allocate storage for Public Key Object. */
1528 }
1536 }
1540 }
1543 /*
1544 * The key type specified in the template does not
1545 * match the implied key type based on the mechanism.
1546 */
1549 }
1553 /* Supported key types of the Public Key Object */
1562 }
1565 /*
1566 * Derive modulus_bits attribute from modulus.
1567 * Save modulus_bits integer value to the
1568 * designated place in the public key object.
1569 */
1571 #ifdef __sparcv9
1581 }
1589 /*
1590 * After modulus_bits has been computed,
1591 * it is safe to move modulus and pubexpo
1592 * big integer attribute value to the
1593 * designated place in the public key object.
1594 */
1603 }
1605 /* mode is SOFT_GEN_KEY */
1611 }
1615 /*
1616 * Copy big integer attribute value to the
1617 * designated place in the public key object.
1618 */
1623 }
1625 /*
1626 * Use PKCS#11 default 0x010001 for public exponent
1627 * if not not specified in attribute template.
1628 */
1635 }
1636 /*
1637 * Copy big integer attribute value to the
1638 * designated place in the public key object.
1639 */
1641 }
1650 }
1658 }
1661 isValue) {
1664 }
1669 }
1670 }
1683 isSubprime) {
1686 }
1694 }
1700 }
1705 }
1706 }
1719 }
1727 }
1730 isValue) {
1733 }
1738 }
1739 }
1759 }
1769 }
1770 }
1774 }
1784 }
1786 /* Set up object. */
1794 }
1798 fail_cleanup:
1799 /*
1800 * cleanup the storage allocated to the local variables.
1801 */
1812 /*
1813 * cleanup the storage allocated inside the object itself.
1814 */
1818 }
1821 /*
1822 * Build a Private Key Object.
1823 *
1824 * - Parse the object's template, and when an error is detected such as
1825 * invalid attribute type, invalid attribute value, etc., return
1826 * with appropriate return value.
1827 * - Set up attribute mask field in the object for the supplied common
1828 * attributes that have boolean type.
1829 * - Build the attribute_info struct to hold the value of each supplied
1830 * attribute that has byte array type. Link attribute_info structs
1831 * together to form the extra attribute list of the object.
1832 * - Allocate storage for the Private Key object.
1833 * - Build the Private Key object according to the key type. Allocate
1834 * storage to hold the big integer value for the supplied attributes
1835 * that are required for a certain key type.
1836 *
1837 */
1838 CK_RV
1841 {
1842 ulong_t i;
1848 /* Must set flags unless mode == SOFT_UNWRAP_KEY */
1854 /* Must set flags if mode == SOFT_GEN_KEY */
1856 /* Must not set flags */
1860 /* Private Key RSA optional */
1868 biginteger_t modulus;
1869 biginteger_t priexpo;
1870 biginteger_t prime;
1871 biginteger_t subprime;
1872 biginteger_t base;
1873 biginteger_t value;
1875 biginteger_t pubexpo;
1876 biginteger_t prime1;
1877 biginteger_t prime2;
1878 biginteger_t expo1;
1879 biginteger_t expo2;
1880 biginteger_t coef;
1881 CK_ATTRIBUTE string_tmp;
1882 CK_ATTRIBUTE param_tmp;
1888 /* prevent bigint_attr_cleanup from freeing invalid attr value */
1908 /* Private Key Object Attributes */
1910 /* common key attributes */
1919 /* common private key attribute */
1921 /*
1922 * Allocate storage to hold the attribute
1923 * value with byte array type, and add it to
1924 * the extra attribute list of the object.
1925 */
1927 new_object);
1930 }
1933 /*
1934 * The following key related attribute types must
1935 * not be specified by C_CreateObject or C_GenerateKey(Pair).
1936 */
1945 /* Key related boolean attributes */
1960 }
1966 else
1973 else
1980 else
1987 else
1994 else
2003 /*
2004 * The following key related attribute types must
2005 * be specified according to the key type by
2006 * C_CreateObject.
2007 */
2011 /*
2012 * Copyin big integer attribute from template
2013 * to a local variable.
2014 */
2020 /*
2021 * Modulus length needs to be between min key length and
2022 * max key length.
2023 */
2025 MIN_RSA_KEYLENGTH_IN_BYTES) ||
2027 MAX_RSA_KEYLENGTH_IN_BYTES)) {
2030 }
2122 }
2123 }
2162 }
2165 /* Allocate storage for Private Key Object. */
2170 }
2178 }
2181 /*
2182 * The key type is not specified in the application's
2183 * template, so we use the implied key type based on
2184 * the mechanism.
2185 */
2188 }
2190 /* If still unspecified, template is incomplete */
2194 }
2196 /*
2197 * The key type specified in the template does not
2198 * match the implied key type based on the mechanism.
2199 */
2203 }
2204 }
2207 /*
2208 * Note that, for mode SOFT_UNWRAP_KEY, key type is not
2209 * implied by the mechanism (key_type), so if it is not
2210 * specified from the attribute template (keytype), it is
2211 * incomplete.
2212 */
2216 }
2217 }
2221 /* Supported key types of the Private Key Object */
2225 isValueBits) {
2228 }
2237 }
2240 /*
2241 * Copy big integer attribute value to the
2242 * designated place in the Private Key object.
2243 */
2250 }
2252 /* The following attributes are optional. */
2255 }
2259 }
2263 }
2267 }
2271 }
2275 }
2281 isValueBits) {
2284 }
2292 }
2295 /*
2296 * The private value x must be less than subprime q.
2297 * Size for big_init is in BIG_CHUNK_TYPE words.
2298 */
2299 #ifdef __sparcv9
2310 }
2311 #ifdef __sparcv9
2322 }
2331 }
2343 }
2349 isSubprime) {
2352 }
2354 /* CKA_VALUE_BITS is for key gen but not unwrap */
2362 }
2363 }
2371 }
2376 }
2387 }
2393 isValueBits) {
2396 }
2404 }
2418 }
2433 }
2436 }
2442 }
2444 /* Set up object. */
2452 }
2458 fail_cleanup:
2459 /*
2460 * cleanup the storage allocated to the local variables.
2461 */
2479 /*
2480 * cleanup the storage allocated inside the object itself.
2481 */
2485 }
2488 /*
2489 * Build a Secret Key Object.
2490 *
2491 * - Parse the object's template, and when an error is detected such as
2492 * invalid attribute type, invalid attribute value, etc., return
2493 * with appropriate return value.
2494 * - Set up attribute mask field in the object for the supplied common
2495 * attributes that have boolean type.
2496 * - Build the attribute_info struct to hold the value of each supplied
2497 * attribute that has byte array type. Link attribute_info structs
2498 * together to form the extra attribute list of the object.
2499 * - Allocate storage for the Secret Key object.
2500 * - Build the Secret Key object. Allocate storage to hold the big integer
2501 * value for the attribute CKA_VALUE that is required for all the key
2502 * types supported by secret key object.
2503 * This function is called internally with mode = SOFT_CREATE_OBJ_INT.
2504 *
2505 */
2506 CK_RV
2509 CK_KEY_TYPE key_type)
2510 {
2512 ulong_t i;
2517 /* Must set flags if mode != SOFT_UNWRAP_KEY, else must not set */
2519 /* Must not set flags if mode != SOFT_UNWRAP_KEY, else optional */
2522 CK_ATTRIBUTE string_tmp;
2529 /* Allocate storage for Secret Key Object. */
2534 }
2541 /* Secret Key Object Attributes */
2544 /* common key attributes */
2552 /*
2553 * Allocate storage to hold the attribute
2554 * value with byte array type, and add it to
2555 * the extra attribute list of the object.
2556 */
2558 new_object);
2561 }
2564 /*
2565 * The following key related attribute types must
2566 * not be specified by C_CreateObject and C_GenerateKey.
2567 */
2575 /* Key related boolean attributes */
2589 else
2596 else
2603 else
2610 else
2617 else
2624 else
2631 else
2647 }
2648 }
2650 /*
2651 * Copyin attribute from template
2652 * to a local variable.
2653 */
2683 }
2690 /*
2691 * The key type must be specified in the application's
2692 * template. Otherwise, returns error.
2693 */
2697 }
2702 /*
2703 * The key type is not specified in the application's
2704 * template, so we use the implied key type based on
2705 * the mechanism.
2706 */
2710 /*
2711 * The key type specified in the template
2712 * does not match the implied key type based
2713 * on the mechanism.
2714 */
2717 }
2718 }
2720 /*
2721 * If a key_len is passed as a parameter, it has to
2722 * match the one found in the template.
2723 */
2728 }
2731 }
2735 /*
2736 * Note that, for mode SOFT_UNWRAP_KEY, key type is not
2737 * implied by the mechanism (key_type), so if it is not
2738 * specified from the attribute template (keytype), it is
2739 * incomplete.
2740 */
2744 }
2748 /*
2749 * For CKM_MD5_KEY_DERIVATION & CKM_SHA1_KEY_DERIVATION, the
2750 * key type is optional.
2751 */
2754 }
2756 }
2766 }
2771 }
2778 }
2785 }
2791 }
2798 }
2803 }
2811 }
2815 }
2822 }
2826 }
2833 }
2837 }
2843 }
2846 /*
2847 * Templates for internal object creation come from
2848 * applications calls to C_DeriveKey(), for which it
2849 * is OKey to pass a CKA_VALUE_LEN attribute, as
2850 * long as it does not conflict with the length of the
2851 * CKA_VALUE attribute.
2852 */
2857 }
2858 }
2862 /* CKA_VALUE must not be specified */
2866 }
2869 /*
2870 * CKA_VALUE_LEN must be specified by C_GenerateKey
2871 * if mech is CKK_RC4, CKK_AES, CKK_GENERIC_SECRET.
2872 */
2877 }
2878 ;
2883 }
2887 /* arbitrary key length - no length checking */
2891 }
2898 }
2905 }
2913 }
2918 }
2925 /* CKA_VALUE_LEN attribute does not apply to DES<n> */
2929 }
2935 }
2939 /*
2940 * According to v2.11 of PKCS#11 spec, neither CKA_VALUE nor
2941 * CKA_VALUE_LEN can be be specified; however v2.20 has this
2942 * restriction removed, perhaps because it makes it hard to
2943 * determine variable-length key sizes. This case statement
2944 * complied with v2.20.
2945 */
2949 }
2952 /*
2953 * CKA_VALUE_LEN is optional
2954 * if key is CKK_RC4, CKK_AES, CKK_GENERIC_SECRET
2955 * and the unwrapping mech is *_CBC_PAD.
2956 *
2957 * CKA_VALUE_LEN is required
2958 * if key is CKK_RC4, CKK_AES, CKK_GENERIC_SECRET
2959 * and the unwrapping mech is *_ECB or *_CBC.
2960 *
2961 * since mech is not known at this point, CKA_VALUE_LEN is
2962 * treated as optional and the caller needs to enforce it.
2963 */
2967 ARCFOUR_MIN_KEY_BYTES) ||
2969 ARCFOUR_MAX_KEY_BYTES)) {
2972 }
2973 }
2977 /* arbitrary key length - no length checking */
2987 }
2988 }
2997 }
3003 /* CKA_VALUE_LEN attribute does not apply to DES<n> */
3007 }
3013 }
3017 /* CKA_VALUE must not be specified */
3021 }
3024 /*
3025 * CKA_VALUE_LEN is optional
3026 * if mech is CKK_RC4, CKK_AES, CKK_GENERIC_SECRET.
3027 */
3031 ARCFOUR_MIN_KEY_BYTES) ||
3033 ARCFOUR_MAX_KEY_BYTES)) {
3036 }
3037 }
3041 /* arbitrary key length - no length checking */
3051 }
3052 }
3062 }
3068 /* CKA_VALUE_LEN attribute does not apply to DES<n> */
3072 }
3078 }
3082 /* CKA_VALUE must not be specified */
3086 }
3089 /*
3090 * CKA_VALUE_LEN is an optional attribute for
3091 * CKM_SHA1_KEY_DERIVATION and CKM_MD5_KEY_DERIVATION
3092 * if mech is CKK_RC4, CKK_AES, CKK_GENERIC_SECRET.
3093 */
3098 /*
3099 * No need to check key length value here, it will be
3100 * validated later in soft_key_derive_check_length().
3101 */
3107 /* CKA_VALUE_LEN attribute does not apply to DES<n> */
3111 }
3117 }
3119 }
3121 /* Set up object. */
3130 }
3133 fail_cleanup:
3134 /*
3135 * cleanup the storage allocated to the local variables.
3136 */
3140 /*
3141 * cleanup the storage allocated inside the object itself.
3142 */
3146 }
3149 /*
3150 * Build a Domain Parameter Object.
3151 *
3152 * - Parse the object's template, and when an error is detected such as
3153 * invalid attribute type, invalid attribute value, etc., return
3154 * with appropriate return value.
3155 * - Allocate storage for the Domain Parameter object.
3156 * - Build the Domain Parameter object according to the key type. Allocate
3157 * storage to hold the big integer value for the supplied attributes
3158 * that are required for a certain key type.
3159 *
3160 */
3161 CK_RV
3164 {
3166 ulong_t i;
3170 /* Must set flags */
3174 /* Must not set flags */
3178 biginteger_t prime;
3179 biginteger_t subprime;
3180 biginteger_t base;
3181 CK_ATTRIBUTE string_tmp;
3186 /* prevent bigint_attr_cleanup from freeing invalid attr value */
3194 /* Domain Parameters Object Attributes */
3197 /* common domain parameter attribute */
3202 /*
3203 * The following common domain parameter attribute
3204 * must not be specified by C_CreateObject.
3205 */
3210 /*
3211 * The following domain parameter attributes must be
3212 * specified according to the key type by
3213 * C_CreateObject.
3214 */
3217 /*
3218 * Copyin big integer attribute from template
3219 * to a local variable.
3220 */
3266 }
3269 /* Allocate storage for Domain Parameters Object. */
3274 }
3282 }
3286 /* Supported key types of the Domain Parameters Object */
3292 }
3295 /*
3296 * Copy big integer attribute value to the
3297 * designated place in the domain parameter
3298 * object.
3299 */
3308 }
3315 }
3324 }
3331 }
3343 }
3349 }
3358 }
3362 fail_cleanup:
3363 /*
3364 * cleanup the storage allocated to the local variables.
3365 */
3371 /*
3372 * cleanup the storage allocated inside the object itself.
3373 */
3377 }
3379 /*
3380 * Build a Certificate Object
3381 *
3382 * - Parse the object's template, and when an error is detected such as
3383 * invalid attribute type, invalid attribute value, etc., return
3384 * with appropriate return value.
3385 * - Allocate storage for the Certificate object
3386 */
3387 static CK_RV
3390 CK_CERTIFICATE_TYPE cert_type)
3391 {
3394 CK_ULONG i;
3399 /* certificate type defaults to the value given as a parameter */
3401 CK_ATTRIBUTE string_tmp;
3405 /*
3406 * Look for the certificate type attribute and do some
3407 * sanity checking before creating the structures.
3408 */
3410 /* Certificate Object Attributes */
3413 certtype =
3425 }
3426 }
3428 /* The certificate type MUST be specified */
3432 /*
3433 * For X.509 certs, the CKA_SUBJECT and CKA_VALUE
3434 * must be present at creation time.
3435 */
3440 /*
3441 * For X.509 Attribute certs, the CKA_OWNER and CKA_VALUE
3442 * must be present at creation time.
3443 */
3452 }
3456 /* Certificate Object Attributes */
3482 new_object);
3486 B_FALSE)
3487 attr_mask |=
3488 NOT_MODIFIABLE_BOOL_ON;
3497 }
3522 new_object);
3527 B_FALSE)
3528 attr_mask |=
3529 NOT_MODIFIABLE_BOOL_ON;
3539 }
3544 }
3545 }
3558 }
3559 }
3561 fail_cleanup:
3564 }
3566 }
3569 /*
3570 * Validate the attribute types in the object's template. Then,
3571 * call the appropriate build function according to the class of
3572 * the object specified in the template.
3573 *
3574 * Note: The following classes of objects are supported:
3575 * - CKO_PUBLIC_KEY
3576 * - CKO_PRIVATE_KEY
3577 * - CKO_SECRET_KEY
3578 * - CKO_DOMAIN_PARAMETERS
3579 * - CKO_CERTIFICATE
3580 *
3581 */
3582 CK_RV
3585 {
3592 }
3594 /* Validate the attribute type in the template. */
3598 /*
3599 * CKA_CLASS is a mandatory attribute for C_CreateObject
3600 */
3604 /*
3605 * Call the appropriate function based on the supported class
3606 * of the object.
3607 */
3626 new_object);
3639 }
3642 }
3644 /*
3645 * Validate the attribute types in the object's template. Then,
3646 * call the appropriate build function according to the class of
3647 * the object specified in the template.
3648 *
3649 */
3650 CK_RV
3654 {
3659 /* Validate the attribute type in the template. */
3664 }
3666 /*
3667 * If either the class from the parameter list ("class") or
3668 * the class from the template ("temp_class") is not specified,
3669 * try to use the other one.
3670 */
3675 }
3677 /* If object class is still not specified, template is incomplete. */
3681 /* Class should match if specified in both parameters and template. */
3685 /*
3686 * Call the appropriate function based on the supported class
3687 * of the object.
3688 */
3692 /* Unwrapping public keys is not supported. */
3696 }
3716 /* Unwrapping domain parameters is not supported. */
3720 }
3723 new_object);
3732 }
3735 }
3738 /*
3739 * Get the value of a requested attribute that is common to all supported
3740 * classes (i.e. public key, private key, secret key, domain parameters,
3741 * and certificate classes).
3742 */
3743 CK_RV
3745 uchar_t object_type)
3746 {
3756 /* default boolean attributes */
3761 }
3764 else
3773 }
3776 else
3784 }
3787 else
3796 /*
3797 * The specified attribute for the object is invalid.
3798 * (the object does not possess such an attribute.)
3799 */
3802 }
3805 }
3807 /*
3808 * Get the value of a requested attribute that is common to all key objects
3809 * (i.e. public key, private key and secret key).
3810 */
3811 CK_RV
3813 {
3824 /*
3825 * The above extra attributes have byte array type.
3826 */
3830 /* Key related boolean attributes */
3845 }
3846 }
3848 /*
3849 * Get the value of a requested attribute of a Public Key Object.
3850 *
3851 * Rule: All the attributes in the public key object can be revealed.
3852 */
3853 CK_RV
3856 {
3865 /*
3866 * The above extra attributes have byte array type.
3867 */
3871 /* Key related boolean attributes */
3893 /*
3894 * This attribute is valid only for RSA public key
3895 * object.
3896 */
3903 }
3912 }
3921 }
3940 }
3955 }
3974 }
3997 }
4000 /*
4001 * First, get the value of the request attribute defined
4002 * in the list of common key attributes. If the request
4003 * attribute is not found in that list, then get the
4004 * attribute from the list of common attributes.
4005 */
4010 }
4012 }
4015 }
4018 /*
4019 * Get the value of a requested attribute of a Private Key Object.
4020 *
4021 * Rule: All the attributes in the private key object can be revealed
4022 * except those marked with footnote number "7" when the object
4023 * has its CKA_SENSITIVE attribute set to TRUE or its
4024 * CKA_EXTRACTABLE attribute set to FALSE (p.88 in PKCS11 spec.).
4025 */
4026 CK_RV
4029 {
4035 /*
4036 * If the following specified attributes for the private key
4037 * object cannot be revealed because the object is sensitive
4038 * or unextractable, then the ulValueLen is set to -1.
4039 */
4053 }
4054 }
4060 /*
4061 * The above extra attributes have byte array type.
4062 */
4066 /* Key related boolean attributes */
4111 }
4121 }
4131 }
4141 }
4151 }
4161 }
4171 }
4181 }
4191 }
4210 }
4225 }
4244 }
4267 }
4270 /*
4271 * First, get the value of the request attribute defined
4272 * in the list of common key attributes. If the request
4273 * attribute is not found in that list, then get the
4274 * attribute from the list of common attributes.
4275 */
4280 }
4282 }
4285 }
4288 /*
4289 * Get the value of a requested attribute of a Secret Key Object.
4290 *
4291 * Rule: All the attributes in the secret key object can be revealed
4292 * except those marked with footnote number "7" when the object
4293 * has its CKA_SENSITIVE attribute set to TRUE or its
4294 * CKA_EXTRACTABLE attribute set to FALSE (p.88 in PKCS11 spec.).
4295 */
4296 CK_RV
4299 {
4306 /* Key related boolean attributes */
4349 /*
4350 * If the specified attribute for the secret key object
4351 * cannot be revealed because the object is sensitive
4352 * or unextractable, then the ulValueLen is set to -1.
4353 */
4358 }
4378 }
4383 }
4387 /*
4388 * First, get the value of the request attribute defined
4389 * in the list of common key attributes. If the request
4390 * attribute is not found in that list, then get the
4391 * attribute from the list of common attributes.
4392 */
4397 }
4399 }
4402 }
4405 /*
4406 * Get the value of a requested attribute of a Domain Parameters Object.
4407 *
4408 * Rule: All the attributes in the domain parameters object can be revealed.
4409 */
4410 CK_RV
4413 {
4445 }
4460 }
4479 }
4498 }
4509 }
4512 /*
4513 * Get the value of a common attribute.
4514 */
4518 }
4521 }
4523 /*
4524 * Get certificate attributes from an object.
4525 * return CKR_ATTRIBUTE_TYPE_INVALID if the requested type
4526 * does not exist in the certificate.
4527 */
4528 CK_RV
4531 {
4533 cert_attr_t src;
4540 }
4549 }
4555 }
4574 }
4576 /*
4577 * If we got this far, then the combination of certificate type
4578 * and requested attribute is invalid.
4579 */
4581 }
4583 CK_RV
4586 {
4592 /* SUBJECT attr cannot be modified. */
4594 }
4598 /* OWNER attr cannot be modified. */
4600 }
4603 /* VALUE attr cannot be modified. */
4610 }
4617 }
4626 }
4628 /*
4629 * If we got this far, then the combination of certificate type
4630 * and requested attribute is invalid.
4631 */
4633 }
4635 /*
4636 * Call the appropriate get attribute function according to the class
4637 * of object.
4638 *
4639 * The caller of this function holds the lock on the object.
4640 */
4641 CK_RV
4643 {
4670 /*
4671 * If the specified attribute for the object is invalid
4672 * (the object does not possess such as attribute), then
4673 * the ulValueLen is modified to hold the value -1.
4674 */
4677 }
4681 }
4683 CK_RV
4686 {
4698 }
4701 }
4710 /*
4711 * Check if this is the special case
4712 * when the PIN is never initialized
4713 * in the keystore. If true, we will
4714 * let it pass here and let it fail
4715 * with CKR_PIN_EXPIRED later on.
4716 */
4721 }
4722 }
4725 }
4728 }
4736 else
4738 NOT_MODIFIABLE_BOOL_ON;
4741 }
4750 }
4753 }
4755 /*
4756 * Set the value of an attribute that is common to all key objects
4757 * (i.e. public key, private key and secret key).
4758 */
4759 CK_RV
4762 {
4767 /*
4768 * Only the LABEL can be modified in the common storage
4769 * object attributes after the object is created.
4770 */
4799 }
4801 }
4804 /*
4805 * Set the value of an attribute of a Public Key Object.
4806 *
4807 * Rule: The attributes marked with footnote number "8" in the PKCS11
4808 * spec may be modified (p.88 in PKCS11 spec.).
4809 */
4810 CK_RV
4813 {
4861 /*
4862 * Set the value of a common key attribute.
4863 */
4867 }
4868 /*
4869 * If we got this far, then the combination of key type
4870 * and requested attribute is invalid.
4871 */
4873 }
4876 /*
4877 * Set the value of an attribute of a Private Key Object.
4878 *
4879 * Rule: The attributes marked with footnote number "8" in the PKCS11
4880 * spec may be modified (p.88 in PKCS11 spec.).
4881 */
4882 CK_RV
4885 {
4895 /*
4896 * Cannot set SENSITIVE to FALSE if it is already ON.
4897 */
4901 }
4924 /*
4925 * Cannot set EXTRACTABLE to TRUE if it is already OFF.
4926 */
4930 }
4946 }
4970 /*
4971 * Set the value of a common key attribute.
4972 */
4975 }
4977 /*
4978 * If we got this far, then the combination of key type
4979 * and requested attribute is invalid.
4980 */
4982 }
4984 /*
4985 * Set the value of an attribute of a Secret Key Object.
4986 *
4987 * Rule: The attributes marked with footnote number "8" in the PKCS11
4988 * spec may be modified (p.88 in PKCS11 spec.).
4989 */
4990 CK_RV
4993 {
4999 /*
5000 * Cannot set SENSITIVE to FALSE if it is already ON.
5001 */
5005 }
5036 /*
5037 * Cannot set EXTRACTABLE to TRUE if it is already OFF.
5038 */
5042 }
5060 /*
5061 * Set the value of a common key attribute.
5062 */
5066 }
5067 /*
5068 * If we got this far, then the combination of key type
5069 * and requested attribute is invalid.
5070 */
5072 }
5075 /*
5076 * Call the appropriate set attribute function according to the class
5077 * of object.
5078 *
5079 * The caller of this function does not hold the lock on the original
5080 * object, since this function is setting the attribute on the new object
5081 * that is being modified.
5082 *
5083 * Argument copy: TRUE when called by C_CopyObject,
5084 * FALSE when called by C_SetAttributeValue.
5085 */
5086 CK_RV
5088 boolean_t copy)
5089 {
5111 /*
5112 * Only the LABEL can be modified in the common
5113 * storage object attributes after the object is
5114 * created.
5115 */
5120 }
5126 /*
5127 * If the template specifies a value of an attribute
5128 * which is incompatible with other existing attributes
5129 * of the object, then fails with return code
5130 * CKR_TEMPLATE_INCONSISTENT.
5131 */
5134 }
5137 }
5139 CK_RV
5142 {
5146 /* The following attributes belong to RSA */
5148 #ifdef __sparcv9
5149 len =
5150 /* LINTED */
5154 len =
5158 /* This attribute MUST BE set */
5161 }
5171 #ifdef __sparcv9
5172 len =
5173 /* LINTED */
5177 len =
5181 /* This attribute MUST BE set */
5184 }
5193 /* The following attributes belong to DSA and DH */
5197 #ifdef __sparcv9
5198 len =
5199 /* LINTED */
5202 big_value_len;
5204 len =
5206 big_value_len;
5208 else
5209 #ifdef __sparcv9
5210 len =
5211 /* LINTED */
5214 big_value_len;
5216 len =
5218 big_value_len;
5221 /* This attribute MUST BE set */
5224 }
5231 else
5239 #ifdef __sparcv9
5240 len =
5241 /* LINTED */
5245 len =
5249 /* This attribute MUST BE set */
5252 }
5264 #ifdef __sparcv9
5265 len =
5266 /* LINTED */
5269 big_value_len;
5271 len =
5273 big_value_len;
5275 else
5276 #ifdef __sparcv9
5277 len =
5278 /* LINTED */
5281 big_value_len;
5283 len =
5285 big_value_len;
5288 /* This attribute MUST BE set */
5291 }
5298 else
5307 #ifdef __sparcv9
5308 len =
5309 /* LINTED */
5312 big_value_len;
5314 len =
5316 big_value_len;
5318 else
5319 #ifdef __sparcv9
5320 len =
5321 /* LINTED */
5324 big_value_len;
5326 len =
5328 big_value_len;
5331 /* This attribute MUST BE set */
5334 }
5341 else
5347 }
5350 }
5353 CK_RV
5356 {
5362 /* The following attributes belong to RSA */
5364 #ifdef __sparcv9
5365 len =
5366 /* LINTED */
5370 len =
5374 /* This attribute MUST BE set */
5377 }
5387 #ifdef __sparcv9
5388 len =
5389 /* LINTED */
5393 len =
5397 /* This attribute MUST BE set */
5400 }
5410 #ifdef __sparcv9
5411 len =
5412 /* LINTED */
5416 len =
5422 }
5427 }
5436 #ifdef __sparcv9
5437 len =
5438 /* LINTED */
5442 len =
5448 }
5453 }
5462 #ifdef __sparcv9
5463 len =
5464 /* LINTED */
5468 len =
5474 }
5479 }
5488 #ifdef __sparcv9
5489 len =
5490 /* LINTED */
5494 len =
5500 }
5505 }
5514 #ifdef __sparcv9
5515 len =
5516 /* LINTED */
5520 len =
5526 }
5531 }
5539 /* The following attributes belong to DSA and DH */
5543 #ifdef __sparcv9
5544 len =
5545 /* LINTED */
5548 big_value_len;
5550 len =
5552 big_value_len;
5554 else
5555 #ifdef __sparcv9
5556 len =
5557 /* LINTED */
5560 big_value_len;
5562 len =
5564 big_value_len;
5567 /* This attribute MUST BE set */
5570 }
5577 else
5585 #ifdef __sparcv9
5586 len =
5587 /* LINTED */
5591 len =
5595 /* This attribute MUST BE set */
5598 }
5610 #ifdef __sparcv9
5611 len =
5612 /* LINTED */
5615 big_value_len;
5617 len =
5619 big_value_len;
5621 else
5622 #ifdef __sparcv9
5623 len =
5624 /* LINTED */
5627 big_value_len;
5629 len =
5631 big_value_len;
5634 /* This attribute MUST BE set */
5637 }
5644 else
5653 #ifdef __sparcv9
5654 len =
5655 /* LINTED */
5658 big_value_len;
5660 len =
5662 big_value_len;
5665 #ifdef __sparcv9
5666 len =
5667 /* LINTED */
5670 big_value_len;
5672 len =
5674 big_value_len;
5677 #ifdef __sparcv9
5678 len =
5679 /* LINTED */
5682 big_value_len;
5684 len =
5686 big_value_len;
5688 }
5690 /* This attribute MUST BE set */
5693 }
5708 }
5711 }
5715 }
5717 static CK_RV
5719 {
5725 }
5731 }
5733 static void
5735 {
5738 }
5767 }
5769 }
5771 CK_RV
5774 {
5782 }
5789 /* copy modulus */
5795 }
5796 /* copy public exponent */
5802 }
5809 /* copy prime */
5815 }
5817 /* copy subprime */
5823 }
5825 /* copy base */
5831 }
5833 /* copy value */
5839 }
5846 /* copy prime */
5852 }
5854 /* copy base */
5860 }
5862 /* copy value */
5868 }
5875 /* copy point */
5881 }
5888 /* copy prime */
5894 }
5896 /* copy subprime */
5902 }
5904 /* copy base */
5910 }
5912 /* copy value */
5918 }
5922 }
5925 }
5927 static void
5929 {
5932 }
5967 }
5969 }
5971 CK_RV
5974 {
5981 }
5988 /* copy modulus */
5994 }
5995 /* copy public exponent */
6001 }
6002 /* copy private exponent */
6008 }
6009 /* copy prime_1 */
6015 }
6016 /* copy prime_2 */
6022 }
6023 /* copy exponent_1 */
6029 }
6030 /* copy exponent_2 */
6036 }
6037 /* copy coefficient */
6043 }
6050 /* copy prime */
6056 }
6058 /* copy subprime */
6064 }
6066 /* copy base */
6072 }
6074 /* copy value */
6080 }
6087 /* copy prime */
6093 }
6095 /* copy base */
6101 }
6103 /* copy value */
6109 }
6116 /* copy value */
6122 }
6129 /* copy prime */
6135 }
6137 /* copy subprime */
6143 }
6145 /* copy base */
6151 }
6153 /* copy value */
6159 }
6163 }
6166 }
6168 static void
6170 {
6173 }
6192 }
6194 }
6196 CK_RV
6199 {
6206 }
6214 /* copy prime */
6220 }
6222 /* copy subprime */
6228 }
6230 /* copy base */
6236 }
6244 /* copy prime */
6250 }
6252 /* copy base */
6258 }
6266 /* copy prime */
6272 }
6274 /* copy subprime */
6280 }
6282 /* copy base */
6288 }
6293 }
6296 }
6298 CK_RV
6301 {
6307 }
6310 /* copy the secret key value */
6315 }
6319 /*
6320 * Copy the pre-expanded key schedule.
6321 */
6329 }
6333 }
6338 }
6340 /*
6341 * If CKA_CLASS not given, guess CKA_CLASS using
6342 * attributes on template .
6343 *
6344 * Some attributes are specific to an object class. If one or more
6345 * of these attributes are in the template, make a list of classes
6346 * that can have these attributes. This would speed up the search later,
6347 * because we can immediately skip an object if the class of that
6348 * object can not possibly contain one of the attributes.
6349 *
6350 */
6351 void
6354 CK_ULONG ulCount)
6355 {
6356 ulong_t i;
6371 /*
6372 * don't need to guess the class, it is specified.
6373 * Just record the class, and return.
6374 */
6379 }
6380 }
6382 num_pub_key_attrs =
6384 num_priv_key_attrs =
6386 num_secret_key_attrs =
6388 num_domain_attrs =
6390 num_hardware_attrs =
6392 num_cert_attrs =
6395 /*
6396 * Get the list of objects class that might contain
6397 * some attributes.
6398 */
6400 /*
6401 * only check if this attribute can belong to public key object
6402 * class if public key object isn't already in the list
6403 */
6409 CKO_PUBLIC_KEY;
6411 }
6412 }
6413 }
6420 CKO_PRIVATE_KEY;
6422 }
6423 }
6424 }
6431 CKO_SECRET_KEY;
6433 }
6434 }
6435 }
6442 CKO_DOMAIN_PARAMETERS;
6444 }
6445 }
6446 }
6453 CKO_HW_FEATURE;
6455 }
6456 }
6457 }
6464 CKO_CERTIFICATE;
6466 }
6467 }
6468 }
6469 }
6471 }
6473 boolean_t
6476 {
6477 ulong_t i;
6485 /*
6486 * Check if the class of this object match with any
6487 * of object classes that can possibly contain the
6488 * requested attributes.
6489 */
6494 }
6495 }
6497 /*
6498 * this object can't possibly contain one or
6499 * more attributes, don't need to check this object
6500 */
6502 }
6503 }
6505 /* need to examine everything */
6514 /* First, check the most common attributes */
6519 }
6525 }
6549 SIGN_RECOVER_BOOL_ON;
6558 VERIFY_RECOVER_BOOL_ON;
6575 SECONDARY_AUTH_BOOL_ON;
6584 EXTRACTABLE_BOOL_ON;
6589 ALWAYS_SENSITIVE_BOOL_ON;
6594 NEVER_EXTRACTABLE_BOOL_ON;
6606 {
6607 CK_BBOOL bval;
6609 NOT_MODIFIABLE_BOOL_ON;
6615 }
6618 }
6620 }
6622 /*
6623 * For X.509 attribute certificate object, get its
6624 * CKA_OWNER attribute from the x509_attr_cert_t struct.
6625 */
6630 }
6633 /*
6634 * For X.509 certificate object, get its CKA_SUBJECT
6635 * attribute from the x509_cert_t struct (not from
6636 * the extra_attrlistp).
6637 */
6643 }
6644 /*FALLTHRU*/
6654 /* find these attributes from extra_attrlistp */
6662 /* only secret key has this attribute */
6667 }
6670 }
6675 /*
6676 * secret_key_obj_t is the same as
6677 * biginteger_t
6678 */
6691 }
6703 }
6710 CKC_X_509_ATTR_CERT) {
6712 }
6717 }
6720 /* only RSA public and private key have this attr */
6728 }
6732 }
6735 /* only RSA public key has this attribute */
6742 }
6745 }
6748 /* only RSA public and private key have this attr */
6756 }
6760 }
6763 /* only RSA private key has this attribute */
6770 }
6773 /* only RSA private key has this attribute */
6780 }
6783 /* only RSA private key has this attribute */
6790 }
6793 /* only RSA private key has this attribute */
6800 }
6803 /* only RSA private key has this attribute */
6810 }
6813 /* only RSA private key has this attribute */
6820 }
6823 /* only Diffie-Hellman private key has this attr */
6830 }
6833 }
6849 }
6863 }
6877 }
6880 }
6894 }
6905 }
6916 }
6919 }
6936 }
6950 }
6964 }
6967 }
6972 CK_ULONG prime_bits;
6974 prime_bits =
6977 prime_bits =
6980 prime_bits =
6984 }
6988 }
6991 }
6996 CK_ULONG subprime_bits =
7001 }
7004 }
7007 /*
7008 * any other attributes are currently not supported.
7009 * so, it's not possible for them to be in the
7010 * object
7011 */
7013 }
7015 CK_BBOOL bval;
7021 }
7024 }
7028 }
7031 }
7035 }
7038 /*
7039 * The attribute type is valid, and its value
7040 * has not been initialized in the object. In
7041 * this case, it only matches the template's
7042 * attribute if the template's value length
7043 * is 0.
7044 */
7051 }
7055 }
7056 }
7059 /* specific attribute not found */
7061 }
7064 }
7068 }
7073 }
7074 }
7075 }
7077 }
7079 CK_ATTRIBUTE_PTR
7081 {
7082 CK_ATTRIBUTE_INFO_PTR tmp;
7088 }
7090 }
7091 /* if get there, the specified attribute is not found */
7093 }