jsing@openbsd.org | 7cd3163 | 2018-02-07 02:06:50 +0000 | [diff] [blame] | 1 | /* $OpenBSD: ssh-pkcs11.c,v 1.26 2018/02/07 02:06:51 jsing Exp $ */ |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 2 | /* |
| 3 | * Copyright (c) 2010 Markus Friedl. All rights reserved. |
| 4 | * |
| 5 | * Permission to use, copy, modify, and distribute this software for any |
| 6 | * purpose with or without fee is hereby granted, provided that the above |
| 7 | * copyright notice and this permission notice appear in all copies. |
| 8 | * |
| 9 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| 10 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| 11 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
| 12 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| 13 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
| 14 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF |
| 15 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
| 16 | */ |
| 17 | |
Damien Miller | 8ad0fbd | 2010-02-12 09:49:06 +1100 | [diff] [blame] | 18 | #include "includes.h" |
| 19 | |
Damien Miller | dfa4156 | 2010-02-12 10:06:28 +1100 | [diff] [blame] | 20 | #ifdef ENABLE_PKCS11 |
| 21 | |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 22 | #include <sys/types.h> |
Damien Miller | 8ad0fbd | 2010-02-12 09:49:06 +1100 | [diff] [blame] | 23 | #ifdef HAVE_SYS_TIME_H |
| 24 | # include <sys/time.h> |
| 25 | #endif |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 26 | #include <stdarg.h> |
| 27 | #include <stdio.h> |
| 28 | |
| 29 | #include <string.h> |
| 30 | #include <dlfcn.h> |
| 31 | |
Damien Miller | 8ad0fbd | 2010-02-12 09:49:06 +1100 | [diff] [blame] | 32 | #include "openbsd-compat/sys-queue.h" |
Damien Miller | 48f54b9 | 2018-09-13 12:13:50 +1000 | [diff] [blame] | 33 | #include "openbsd-compat/openssl-compat.h" |
Damien Miller | 8ad0fbd | 2010-02-12 09:49:06 +1100 | [diff] [blame] | 34 | |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 35 | #include <openssl/x509.h> |
| 36 | |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 37 | #define CRYPTOKI_COMPAT |
| 38 | #include "pkcs11.h" |
| 39 | |
| 40 | #include "log.h" |
| 41 | #include "misc.h" |
djm@openbsd.org | 1129dcf | 2015-01-15 09:40:00 +0000 | [diff] [blame] | 42 | #include "sshkey.h" |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 43 | #include "ssh-pkcs11.h" |
| 44 | #include "xmalloc.h" |
| 45 | |
| 46 | struct pkcs11_slotinfo { |
| 47 | CK_TOKEN_INFO token; |
| 48 | CK_SESSION_HANDLE session; |
| 49 | int logged_in; |
| 50 | }; |
| 51 | |
| 52 | struct pkcs11_provider { |
| 53 | char *name; |
| 54 | void *handle; |
| 55 | CK_FUNCTION_LIST *function_list; |
| 56 | CK_INFO info; |
| 57 | CK_ULONG nslots; |
| 58 | CK_SLOT_ID *slotlist; |
| 59 | struct pkcs11_slotinfo *slotinfo; |
| 60 | int valid; |
| 61 | int refcount; |
| 62 | TAILQ_ENTRY(pkcs11_provider) next; |
| 63 | }; |
| 64 | |
| 65 | TAILQ_HEAD(, pkcs11_provider) pkcs11_providers; |
| 66 | |
| 67 | struct pkcs11_key { |
| 68 | struct pkcs11_provider *provider; |
| 69 | CK_ULONG slotidx; |
| 70 | int (*orig_finish)(RSA *rsa); |
djm@openbsd.org | 482d23b | 2018-09-13 02:08:33 +0000 | [diff] [blame] | 71 | RSA_METHOD *rsa_method; |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 72 | char *keyid; |
| 73 | int keyid_len; |
| 74 | }; |
| 75 | |
| 76 | int pkcs11_interactive = 0; |
| 77 | |
| 78 | int |
| 79 | pkcs11_init(int interactive) |
| 80 | { |
| 81 | pkcs11_interactive = interactive; |
| 82 | TAILQ_INIT(&pkcs11_providers); |
| 83 | return (0); |
| 84 | } |
| 85 | |
| 86 | /* |
| 87 | * finalize a provider shared libarary, it's no longer usable. |
| 88 | * however, there might still be keys referencing this provider, |
| 89 | * so the actuall freeing of memory is handled by pkcs11_provider_unref(). |
| 90 | * this is called when a provider gets unregistered. |
| 91 | */ |
| 92 | static void |
| 93 | pkcs11_provider_finalize(struct pkcs11_provider *p) |
| 94 | { |
| 95 | CK_RV rv; |
| 96 | CK_ULONG i; |
| 97 | |
| 98 | debug("pkcs11_provider_finalize: %p refcount %d valid %d", |
| 99 | p, p->refcount, p->valid); |
| 100 | if (!p->valid) |
| 101 | return; |
| 102 | for (i = 0; i < p->nslots; i++) { |
| 103 | if (p->slotinfo[i].session && |
| 104 | (rv = p->function_list->C_CloseSession( |
| 105 | p->slotinfo[i].session)) != CKR_OK) |
| 106 | error("C_CloseSession failed: %lu", rv); |
| 107 | } |
| 108 | if ((rv = p->function_list->C_Finalize(NULL)) != CKR_OK) |
| 109 | error("C_Finalize failed: %lu", rv); |
| 110 | p->valid = 0; |
| 111 | p->function_list = NULL; |
| 112 | dlclose(p->handle); |
| 113 | } |
| 114 | |
| 115 | /* |
| 116 | * remove a reference to the provider. |
| 117 | * called when a key gets destroyed or when the provider is unregistered. |
| 118 | */ |
| 119 | static void |
| 120 | pkcs11_provider_unref(struct pkcs11_provider *p) |
| 121 | { |
| 122 | debug("pkcs11_provider_unref: %p refcount %d", p, p->refcount); |
| 123 | if (--p->refcount <= 0) { |
| 124 | if (p->valid) |
| 125 | error("pkcs11_provider_unref: %p still valid", p); |
Darren Tucker | a627d42 | 2013-06-02 07:31:17 +1000 | [diff] [blame] | 126 | free(p->slotlist); |
| 127 | free(p->slotinfo); |
| 128 | free(p); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 129 | } |
| 130 | } |
| 131 | |
| 132 | /* unregister all providers, keys might still point to the providers */ |
| 133 | void |
| 134 | pkcs11_terminate(void) |
| 135 | { |
| 136 | struct pkcs11_provider *p; |
| 137 | |
| 138 | while ((p = TAILQ_FIRST(&pkcs11_providers)) != NULL) { |
| 139 | TAILQ_REMOVE(&pkcs11_providers, p, next); |
| 140 | pkcs11_provider_finalize(p); |
| 141 | pkcs11_provider_unref(p); |
| 142 | } |
| 143 | } |
| 144 | |
| 145 | /* lookup provider by name */ |
| 146 | static struct pkcs11_provider * |
| 147 | pkcs11_provider_lookup(char *provider_id) |
| 148 | { |
| 149 | struct pkcs11_provider *p; |
| 150 | |
| 151 | TAILQ_FOREACH(p, &pkcs11_providers, next) { |
| 152 | debug("check %p %s", p, p->name); |
| 153 | if (!strcmp(provider_id, p->name)) |
| 154 | return (p); |
| 155 | } |
| 156 | return (NULL); |
| 157 | } |
| 158 | |
| 159 | /* unregister provider by name */ |
| 160 | int |
| 161 | pkcs11_del_provider(char *provider_id) |
| 162 | { |
| 163 | struct pkcs11_provider *p; |
| 164 | |
| 165 | if ((p = pkcs11_provider_lookup(provider_id)) != NULL) { |
| 166 | TAILQ_REMOVE(&pkcs11_providers, p, next); |
| 167 | pkcs11_provider_finalize(p); |
| 168 | pkcs11_provider_unref(p); |
| 169 | return (0); |
| 170 | } |
| 171 | return (-1); |
| 172 | } |
| 173 | |
| 174 | /* openssl callback for freeing an RSA key */ |
| 175 | static int |
| 176 | pkcs11_rsa_finish(RSA *rsa) |
| 177 | { |
| 178 | struct pkcs11_key *k11; |
| 179 | int rv = -1; |
| 180 | |
| 181 | if ((k11 = RSA_get_app_data(rsa)) != NULL) { |
| 182 | if (k11->orig_finish) |
| 183 | rv = k11->orig_finish(rsa); |
| 184 | if (k11->provider) |
| 185 | pkcs11_provider_unref(k11->provider); |
djm@openbsd.org | 482d23b | 2018-09-13 02:08:33 +0000 | [diff] [blame] | 186 | RSA_meth_free(k11->rsa_method); |
Darren Tucker | a627d42 | 2013-06-02 07:31:17 +1000 | [diff] [blame] | 187 | free(k11->keyid); |
| 188 | free(k11); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 189 | } |
| 190 | return (rv); |
| 191 | } |
| 192 | |
Damien Miller | 031c910 | 2010-04-16 15:54:44 +1000 | [diff] [blame] | 193 | /* find a single 'obj' for given attributes */ |
| 194 | static int |
| 195 | pkcs11_find(struct pkcs11_provider *p, CK_ULONG slotidx, CK_ATTRIBUTE *attr, |
| 196 | CK_ULONG nattr, CK_OBJECT_HANDLE *obj) |
| 197 | { |
| 198 | CK_FUNCTION_LIST *f; |
| 199 | CK_SESSION_HANDLE session; |
| 200 | CK_ULONG nfound = 0; |
| 201 | CK_RV rv; |
| 202 | int ret = -1; |
| 203 | |
| 204 | f = p->function_list; |
| 205 | session = p->slotinfo[slotidx].session; |
| 206 | if ((rv = f->C_FindObjectsInit(session, attr, nattr)) != CKR_OK) { |
| 207 | error("C_FindObjectsInit failed (nattr %lu): %lu", nattr, rv); |
| 208 | return (-1); |
| 209 | } |
| 210 | if ((rv = f->C_FindObjects(session, obj, 1, &nfound)) != CKR_OK || |
| 211 | nfound != 1) { |
| 212 | debug("C_FindObjects failed (nfound %lu nattr %lu): %lu", |
| 213 | nfound, nattr, rv); |
| 214 | } else |
| 215 | ret = 0; |
| 216 | if ((rv = f->C_FindObjectsFinal(session)) != CKR_OK) |
| 217 | error("C_FindObjectsFinal failed: %lu", rv); |
| 218 | return (ret); |
| 219 | } |
| 220 | |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 221 | /* openssl callback doing the actual signing operation */ |
| 222 | static int |
| 223 | pkcs11_rsa_private_encrypt(int flen, const u_char *from, u_char *to, RSA *rsa, |
| 224 | int padding) |
| 225 | { |
| 226 | struct pkcs11_key *k11; |
| 227 | struct pkcs11_slotinfo *si; |
| 228 | CK_FUNCTION_LIST *f; |
| 229 | CK_OBJECT_HANDLE obj; |
Damien Miller | 031c910 | 2010-04-16 15:54:44 +1000 | [diff] [blame] | 230 | CK_ULONG tlen = 0; |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 231 | CK_RV rv; |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 232 | CK_OBJECT_CLASS private_key_class = CKO_PRIVATE_KEY; |
Damien Miller | 8ad0fbd | 2010-02-12 09:49:06 +1100 | [diff] [blame] | 233 | CK_BBOOL true_val = CK_TRUE; |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 234 | CK_MECHANISM mech = { |
| 235 | CKM_RSA_PKCS, NULL_PTR, 0 |
| 236 | }; |
| 237 | CK_ATTRIBUTE key_filter[] = { |
Damien Miller | 61c5c23 | 2013-11-07 11:34:14 +1100 | [diff] [blame] | 238 | {CKA_CLASS, NULL, sizeof(private_key_class) }, |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 239 | {CKA_ID, NULL, 0}, |
Damien Miller | 61c5c23 | 2013-11-07 11:34:14 +1100 | [diff] [blame] | 240 | {CKA_SIGN, NULL, sizeof(true_val) } |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 241 | }; |
djm@openbsd.org | a71ba58 | 2015-05-27 05:15:02 +0000 | [diff] [blame] | 242 | char *pin = NULL, prompt[1024]; |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 243 | int rval = -1; |
| 244 | |
Damien Miller | 61c5c23 | 2013-11-07 11:34:14 +1100 | [diff] [blame] | 245 | key_filter[0].pValue = &private_key_class; |
| 246 | key_filter[2].pValue = &true_val; |
| 247 | |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 248 | if ((k11 = RSA_get_app_data(rsa)) == NULL) { |
| 249 | error("RSA_get_app_data failed for rsa %p", rsa); |
| 250 | return (-1); |
| 251 | } |
| 252 | if (!k11->provider || !k11->provider->valid) { |
| 253 | error("no pkcs11 (valid) provider for rsa %p", rsa); |
| 254 | return (-1); |
| 255 | } |
| 256 | f = k11->provider->function_list; |
| 257 | si = &k11->provider->slotinfo[k11->slotidx]; |
| 258 | if ((si->token.flags & CKF_LOGIN_REQUIRED) && !si->logged_in) { |
| 259 | if (!pkcs11_interactive) { |
djm@openbsd.org | a71ba58 | 2015-05-27 05:15:02 +0000 | [diff] [blame] | 260 | error("need pin entry%s", (si->token.flags & |
| 261 | CKF_PROTECTED_AUTHENTICATION_PATH) ? |
| 262 | " on reader keypad" : ""); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 263 | return (-1); |
| 264 | } |
djm@openbsd.org | a71ba58 | 2015-05-27 05:15:02 +0000 | [diff] [blame] | 265 | if (si->token.flags & CKF_PROTECTED_AUTHENTICATION_PATH) |
| 266 | verbose("Deferring PIN entry to reader keypad."); |
| 267 | else { |
| 268 | snprintf(prompt, sizeof(prompt), |
| 269 | "Enter PIN for '%s': ", si->token.label); |
| 270 | pin = read_passphrase(prompt, RP_ALLOW_EOF); |
| 271 | if (pin == NULL) |
| 272 | return (-1); /* bail out */ |
| 273 | } |
| 274 | rv = f->C_Login(si->session, CKU_USER, (u_char *)pin, |
| 275 | (pin != NULL) ? strlen(pin) : 0); |
| 276 | if (pin != NULL) { |
| 277 | explicit_bzero(pin, strlen(pin)); |
Darren Tucker | a627d42 | 2013-06-02 07:31:17 +1000 | [diff] [blame] | 278 | free(pin); |
djm@openbsd.org | a71ba58 | 2015-05-27 05:15:02 +0000 | [diff] [blame] | 279 | } |
| 280 | if (rv != CKR_OK && rv != CKR_USER_ALREADY_LOGGED_IN) { |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 281 | error("C_Login failed: %lu", rv); |
| 282 | return (-1); |
| 283 | } |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 284 | si->logged_in = 1; |
| 285 | } |
| 286 | key_filter[1].pValue = k11->keyid; |
| 287 | key_filter[1].ulValueLen = k11->keyid_len; |
Damien Miller | 031c910 | 2010-04-16 15:54:44 +1000 | [diff] [blame] | 288 | /* try to find object w/CKA_SIGN first, retry w/o */ |
| 289 | if (pkcs11_find(k11->provider, k11->slotidx, key_filter, 3, &obj) < 0 && |
| 290 | pkcs11_find(k11->provider, k11->slotidx, key_filter, 2, &obj) < 0) { |
| 291 | error("cannot find private key"); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 292 | } else if ((rv = f->C_SignInit(si->session, &mech, obj)) != CKR_OK) { |
| 293 | error("C_SignInit failed: %lu", rv); |
| 294 | } else { |
| 295 | /* XXX handle CKR_BUFFER_TOO_SMALL */ |
| 296 | tlen = RSA_size(rsa); |
| 297 | rv = f->C_Sign(si->session, (CK_BYTE *)from, flen, to, &tlen); |
| 298 | if (rv == CKR_OK) |
| 299 | rval = tlen; |
| 300 | else |
| 301 | error("C_Sign failed: %lu", rv); |
| 302 | } |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 303 | return (rval); |
| 304 | } |
| 305 | |
| 306 | static int |
| 307 | pkcs11_rsa_private_decrypt(int flen, const u_char *from, u_char *to, RSA *rsa, |
| 308 | int padding) |
| 309 | { |
| 310 | return (-1); |
| 311 | } |
| 312 | |
| 313 | /* redirect private key operations for rsa key to pkcs11 token */ |
| 314 | static int |
| 315 | pkcs11_rsa_wrap(struct pkcs11_provider *provider, CK_ULONG slotidx, |
| 316 | CK_ATTRIBUTE *keyid_attrib, RSA *rsa) |
| 317 | { |
| 318 | struct pkcs11_key *k11; |
| 319 | const RSA_METHOD *def = RSA_get_default_method(); |
| 320 | |
| 321 | k11 = xcalloc(1, sizeof(*k11)); |
| 322 | k11->provider = provider; |
| 323 | provider->refcount++; /* provider referenced by RSA key */ |
| 324 | k11->slotidx = slotidx; |
| 325 | /* identify key object on smartcard */ |
| 326 | k11->keyid_len = keyid_attrib->ulValueLen; |
djm@openbsd.org | d2d772f | 2016-02-12 00:20:30 +0000 | [diff] [blame] | 327 | if (k11->keyid_len > 0) { |
| 328 | k11->keyid = xmalloc(k11->keyid_len); |
| 329 | memcpy(k11->keyid, keyid_attrib->pValue, k11->keyid_len); |
| 330 | } |
djm@openbsd.org | 482d23b | 2018-09-13 02:08:33 +0000 | [diff] [blame] | 331 | k11->rsa_method = RSA_meth_dup(def); |
| 332 | if (k11->rsa_method == NULL) |
| 333 | fatal("%s: RSA_meth_dup failed", __func__); |
| 334 | k11->orig_finish = RSA_meth_get_finish(def); |
| 335 | if (!RSA_meth_set1_name(k11->rsa_method, "pkcs11") || |
| 336 | !RSA_meth_set_priv_enc(k11->rsa_method, |
| 337 | pkcs11_rsa_private_encrypt) || |
| 338 | !RSA_meth_set_priv_dec(k11->rsa_method, |
| 339 | pkcs11_rsa_private_decrypt) || |
| 340 | !RSA_meth_set_finish(k11->rsa_method, pkcs11_rsa_finish)) |
| 341 | fatal("%s: setup pkcs11 method failed", __func__); |
| 342 | RSA_set_method(rsa, k11->rsa_method); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 343 | RSA_set_app_data(rsa, k11); |
| 344 | return (0); |
| 345 | } |
| 346 | |
| 347 | /* remove trailing spaces */ |
| 348 | static void |
Damien Miller | 746d1a6 | 2013-07-18 16:13:02 +1000 | [diff] [blame] | 349 | rmspace(u_char *buf, size_t len) |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 350 | { |
| 351 | size_t i; |
| 352 | |
| 353 | if (!len) |
| 354 | return; |
| 355 | for (i = len - 1; i > 0; i--) |
| 356 | if (i == len - 1 || buf[i] == ' ') |
| 357 | buf[i] = '\0'; |
| 358 | else |
| 359 | break; |
| 360 | } |
| 361 | |
| 362 | /* |
| 363 | * open a pkcs11 session and login if required. |
| 364 | * if pin == NULL we delay login until key use |
| 365 | */ |
| 366 | static int |
| 367 | pkcs11_open_session(struct pkcs11_provider *p, CK_ULONG slotidx, char *pin) |
| 368 | { |
| 369 | CK_RV rv; |
| 370 | CK_FUNCTION_LIST *f; |
| 371 | CK_SESSION_HANDLE session; |
| 372 | int login_required; |
| 373 | |
| 374 | f = p->function_list; |
| 375 | login_required = p->slotinfo[slotidx].token.flags & CKF_LOGIN_REQUIRED; |
| 376 | if (pin && login_required && !strlen(pin)) { |
| 377 | error("pin required"); |
| 378 | return (-1); |
| 379 | } |
| 380 | if ((rv = f->C_OpenSession(p->slotlist[slotidx], CKF_RW_SESSION| |
| 381 | CKF_SERIAL_SESSION, NULL, NULL, &session)) |
| 382 | != CKR_OK) { |
| 383 | error("C_OpenSession failed: %lu", rv); |
| 384 | return (-1); |
| 385 | } |
| 386 | if (login_required && pin) { |
djm@openbsd.org | cb3bde3 | 2015-02-02 22:48:53 +0000 | [diff] [blame] | 387 | rv = f->C_Login(session, CKU_USER, |
deraadt@openbsd.org | ce4f59b | 2015-02-03 08:07:20 +0000 | [diff] [blame] | 388 | (u_char *)pin, strlen(pin)); |
djm@openbsd.org | cb3bde3 | 2015-02-02 22:48:53 +0000 | [diff] [blame] | 389 | if (rv != CKR_OK && rv != CKR_USER_ALREADY_LOGGED_IN) { |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 390 | error("C_Login failed: %lu", rv); |
| 391 | if ((rv = f->C_CloseSession(session)) != CKR_OK) |
| 392 | error("C_CloseSession failed: %lu", rv); |
| 393 | return (-1); |
| 394 | } |
| 395 | p->slotinfo[slotidx].logged_in = 1; |
| 396 | } |
| 397 | p->slotinfo[slotidx].session = session; |
| 398 | return (0); |
| 399 | } |
| 400 | |
| 401 | /* |
| 402 | * lookup public keys for token in slot identified by slotidx, |
| 403 | * add 'wrapped' public keys to the 'keysp' array and increment nkeys. |
| 404 | * keysp points to an (possibly empty) array with *nkeys keys. |
| 405 | */ |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 406 | static int pkcs11_fetch_keys_filter(struct pkcs11_provider *, CK_ULONG, |
djm@openbsd.org | 1129dcf | 2015-01-15 09:40:00 +0000 | [diff] [blame] | 407 | CK_ATTRIBUTE [], CK_ATTRIBUTE [3], struct sshkey ***, int *) |
Damien Miller | 686c7d9 | 2014-05-15 14:37:03 +1000 | [diff] [blame] | 408 | __attribute__((__bounded__(__minbytes__,4, 3 * sizeof(CK_ATTRIBUTE)))); |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 409 | |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 410 | static int |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 411 | pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx, |
djm@openbsd.org | 1129dcf | 2015-01-15 09:40:00 +0000 | [diff] [blame] | 412 | struct sshkey ***keysp, int *nkeys) |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 413 | { |
| 414 | CK_OBJECT_CLASS pubkey_class = CKO_PUBLIC_KEY; |
| 415 | CK_OBJECT_CLASS cert_class = CKO_CERTIFICATE; |
| 416 | CK_ATTRIBUTE pubkey_filter[] = { |
Damien Miller | 61c5c23 | 2013-11-07 11:34:14 +1100 | [diff] [blame] | 417 | { CKA_CLASS, NULL, sizeof(pubkey_class) } |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 418 | }; |
| 419 | CK_ATTRIBUTE cert_filter[] = { |
Damien Miller | 61c5c23 | 2013-11-07 11:34:14 +1100 | [diff] [blame] | 420 | { CKA_CLASS, NULL, sizeof(cert_class) } |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 421 | }; |
| 422 | CK_ATTRIBUTE pubkey_attribs[] = { |
| 423 | { CKA_ID, NULL, 0 }, |
| 424 | { CKA_MODULUS, NULL, 0 }, |
| 425 | { CKA_PUBLIC_EXPONENT, NULL, 0 } |
| 426 | }; |
| 427 | CK_ATTRIBUTE cert_attribs[] = { |
| 428 | { CKA_ID, NULL, 0 }, |
| 429 | { CKA_SUBJECT, NULL, 0 }, |
| 430 | { CKA_VALUE, NULL, 0 } |
| 431 | }; |
Damien Miller | 61c5c23 | 2013-11-07 11:34:14 +1100 | [diff] [blame] | 432 | pubkey_filter[0].pValue = &pubkey_class; |
| 433 | cert_filter[0].pValue = &cert_class; |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 434 | |
| 435 | if (pkcs11_fetch_keys_filter(p, slotidx, pubkey_filter, pubkey_attribs, |
| 436 | keysp, nkeys) < 0 || |
| 437 | pkcs11_fetch_keys_filter(p, slotidx, cert_filter, cert_attribs, |
| 438 | keysp, nkeys) < 0) |
| 439 | return (-1); |
| 440 | return (0); |
| 441 | } |
| 442 | |
| 443 | static int |
djm@openbsd.org | 1129dcf | 2015-01-15 09:40:00 +0000 | [diff] [blame] | 444 | pkcs11_key_included(struct sshkey ***keysp, int *nkeys, struct sshkey *key) |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 445 | { |
| 446 | int i; |
| 447 | |
| 448 | for (i = 0; i < *nkeys; i++) |
djm@openbsd.org | 1129dcf | 2015-01-15 09:40:00 +0000 | [diff] [blame] | 449 | if (sshkey_equal(key, (*keysp)[i])) |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 450 | return (1); |
| 451 | return (0); |
| 452 | } |
| 453 | |
| 454 | static int |
djm@openbsd.org | 482d23b | 2018-09-13 02:08:33 +0000 | [diff] [blame] | 455 | have_rsa_key(const RSA *rsa) |
| 456 | { |
| 457 | const BIGNUM *rsa_n, *rsa_e; |
| 458 | |
| 459 | RSA_get0_key(rsa, &rsa_n, &rsa_e, NULL); |
| 460 | return rsa_n != NULL && rsa_e != NULL; |
| 461 | } |
| 462 | |
| 463 | static int |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 464 | pkcs11_fetch_keys_filter(struct pkcs11_provider *p, CK_ULONG slotidx, |
| 465 | CK_ATTRIBUTE filter[], CK_ATTRIBUTE attribs[3], |
djm@openbsd.org | 1129dcf | 2015-01-15 09:40:00 +0000 | [diff] [blame] | 466 | struct sshkey ***keysp, int *nkeys) |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 467 | { |
djm@openbsd.org | 1129dcf | 2015-01-15 09:40:00 +0000 | [diff] [blame] | 468 | struct sshkey *key; |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 469 | RSA *rsa; |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 470 | X509 *x509; |
| 471 | EVP_PKEY *evp; |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 472 | int i; |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 473 | const u_char *cp; |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 474 | CK_RV rv; |
| 475 | CK_OBJECT_HANDLE obj; |
| 476 | CK_ULONG nfound; |
| 477 | CK_SESSION_HANDLE session; |
| 478 | CK_FUNCTION_LIST *f; |
Tim Rice | 179eee0 | 2010-03-04 12:48:05 -0800 | [diff] [blame] | 479 | |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 480 | f = p->function_list; |
| 481 | session = p->slotinfo[slotidx].session; |
| 482 | /* setup a filter the looks for public keys */ |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 483 | if ((rv = f->C_FindObjectsInit(session, filter, 1)) != CKR_OK) { |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 484 | error("C_FindObjectsInit failed: %lu", rv); |
| 485 | return (-1); |
| 486 | } |
| 487 | while (1) { |
| 488 | /* XXX 3 attributes in attribs[] */ |
| 489 | for (i = 0; i < 3; i++) { |
| 490 | attribs[i].pValue = NULL; |
| 491 | attribs[i].ulValueLen = 0; |
| 492 | } |
| 493 | if ((rv = f->C_FindObjects(session, &obj, 1, &nfound)) != CKR_OK |
| 494 | || nfound == 0) |
| 495 | break; |
| 496 | /* found a key, so figure out size of the attributes */ |
| 497 | if ((rv = f->C_GetAttributeValue(session, obj, attribs, 3)) |
| 498 | != CKR_OK) { |
| 499 | error("C_GetAttributeValue failed: %lu", rv); |
| 500 | continue; |
| 501 | } |
djm@openbsd.org | 63ebcd0 | 2015-07-18 08:02:17 +0000 | [diff] [blame] | 502 | /* |
| 503 | * Allow CKA_ID (always first attribute) to be empty, but |
| 504 | * ensure that none of the others are zero length. |
| 505 | * XXX assumes CKA_ID is always first. |
| 506 | */ |
| 507 | if (attribs[1].ulValueLen == 0 || |
Damien Miller | 4fe686d | 2010-06-26 09:36:10 +1000 | [diff] [blame] | 508 | attribs[2].ulValueLen == 0) { |
| 509 | continue; |
| 510 | } |
| 511 | /* allocate buffers for attributes */ |
djm@openbsd.org | 63ebcd0 | 2015-07-18 08:02:17 +0000 | [diff] [blame] | 512 | for (i = 0; i < 3; i++) { |
| 513 | if (attribs[i].ulValueLen > 0) { |
| 514 | attribs[i].pValue = xmalloc( |
| 515 | attribs[i].ulValueLen); |
| 516 | } |
| 517 | } |
| 518 | |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 519 | /* |
| 520 | * retrieve ID, modulus and public exponent of RSA key, |
| 521 | * or ID, subject and value for certificates. |
| 522 | */ |
| 523 | rsa = NULL; |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 524 | if ((rv = f->C_GetAttributeValue(session, obj, attribs, 3)) |
| 525 | != CKR_OK) { |
| 526 | error("C_GetAttributeValue failed: %lu", rv); |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 527 | } else if (attribs[1].type == CKA_MODULUS ) { |
| 528 | if ((rsa = RSA_new()) == NULL) { |
| 529 | error("RSA_new failed"); |
| 530 | } else { |
djm@openbsd.org | 482d23b | 2018-09-13 02:08:33 +0000 | [diff] [blame] | 531 | BIGNUM *rsa_n, *rsa_e; |
| 532 | |
| 533 | rsa_n = BN_bin2bn(attribs[1].pValue, |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 534 | attribs[1].ulValueLen, NULL); |
djm@openbsd.org | 482d23b | 2018-09-13 02:08:33 +0000 | [diff] [blame] | 535 | rsa_e = BN_bin2bn(attribs[2].pValue, |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 536 | attribs[2].ulValueLen, NULL); |
djm@openbsd.org | 482d23b | 2018-09-13 02:08:33 +0000 | [diff] [blame] | 537 | if (rsa_n != NULL && rsa_e != NULL) { |
| 538 | if (!RSA_set0_key(rsa, |
| 539 | rsa_n, rsa_e, NULL)) |
| 540 | fatal("%s: set key", __func__); |
| 541 | rsa_n = rsa_e = NULL; /* transferred */ |
| 542 | } |
| 543 | BN_free(rsa_n); |
| 544 | BN_free(rsa_e); |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 545 | } |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 546 | } else { |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 547 | cp = attribs[2].pValue; |
| 548 | if ((x509 = X509_new()) == NULL) { |
| 549 | error("X509_new failed"); |
| 550 | } else if (d2i_X509(&x509, &cp, attribs[2].ulValueLen) |
| 551 | == NULL) { |
| 552 | error("d2i_X509 failed"); |
| 553 | } else if ((evp = X509_get_pubkey(x509)) == NULL || |
djm@openbsd.org | 482d23b | 2018-09-13 02:08:33 +0000 | [diff] [blame] | 554 | EVP_PKEY_base_id(evp) != EVP_PKEY_RSA || |
| 555 | EVP_PKEY_get0_RSA(evp) == NULL) { |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 556 | debug("X509_get_pubkey failed or no rsa"); |
djm@openbsd.org | 482d23b | 2018-09-13 02:08:33 +0000 | [diff] [blame] | 557 | } else if ((rsa = RSAPublicKey_dup( |
| 558 | EVP_PKEY_get0_RSA(evp))) == NULL) { |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 559 | error("RSAPublicKey_dup"); |
| 560 | } |
jsing@openbsd.org | 7cd3163 | 2018-02-07 02:06:50 +0000 | [diff] [blame] | 561 | X509_free(x509); |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 562 | } |
djm@openbsd.org | 482d23b | 2018-09-13 02:08:33 +0000 | [diff] [blame] | 563 | if (rsa && have_rsa_key(rsa) && |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 564 | pkcs11_rsa_wrap(p, slotidx, &attribs[0], rsa) == 0) { |
markus@openbsd.org | ff7371a | 2017-05-30 14:15:17 +0000 | [diff] [blame] | 565 | if ((key = sshkey_new(KEY_UNSPEC)) == NULL) |
| 566 | fatal("sshkey_new failed"); |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 567 | key->rsa = rsa; |
| 568 | key->type = KEY_RSA; |
Damien Miller | 8668706 | 2014-07-02 15:28:02 +1000 | [diff] [blame] | 569 | key->flags |= SSHKEY_FLAG_EXT; |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 570 | if (pkcs11_key_included(keysp, nkeys, key)) { |
djm@openbsd.org | 1129dcf | 2015-01-15 09:40:00 +0000 | [diff] [blame] | 571 | sshkey_free(key); |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 572 | } else { |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 573 | /* expand key array and add key */ |
deraadt@openbsd.org | 9e509d4 | 2017-05-31 09:15:42 +0000 | [diff] [blame] | 574 | *keysp = xrecallocarray(*keysp, *nkeys, |
| 575 | *nkeys + 1, sizeof(struct sshkey *)); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 576 | (*keysp)[*nkeys] = key; |
| 577 | *nkeys = *nkeys + 1; |
| 578 | debug("have %d keys", *nkeys); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 579 | } |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame] | 580 | } else if (rsa) { |
| 581 | RSA_free(rsa); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 582 | } |
| 583 | for (i = 0; i < 3; i++) |
Darren Tucker | a627d42 | 2013-06-02 07:31:17 +1000 | [diff] [blame] | 584 | free(attribs[i].pValue); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 585 | } |
| 586 | if ((rv = f->C_FindObjectsFinal(session)) != CKR_OK) |
| 587 | error("C_FindObjectsFinal failed: %lu", rv); |
| 588 | return (0); |
| 589 | } |
| 590 | |
| 591 | /* register a new provider, fails if provider already exists */ |
| 592 | int |
djm@openbsd.org | 1129dcf | 2015-01-15 09:40:00 +0000 | [diff] [blame] | 593 | pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp) |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 594 | { |
| 595 | int nkeys, need_finalize = 0; |
| 596 | struct pkcs11_provider *p = NULL; |
| 597 | void *handle = NULL; |
| 598 | CK_RV (*getfunctionlist)(CK_FUNCTION_LIST **); |
| 599 | CK_RV rv; |
| 600 | CK_FUNCTION_LIST *f = NULL; |
| 601 | CK_TOKEN_INFO *token; |
| 602 | CK_ULONG i; |
| 603 | |
| 604 | *keyp = NULL; |
| 605 | if (pkcs11_provider_lookup(provider_id) != NULL) { |
djm@openbsd.org | efb494e | 2016-10-28 03:33:52 +0000 | [diff] [blame] | 606 | debug("%s: provider already registered: %s", |
| 607 | __func__, provider_id); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 608 | goto fail; |
| 609 | } |
| 610 | /* open shared pkcs11-libarary */ |
| 611 | if ((handle = dlopen(provider_id, RTLD_NOW)) == NULL) { |
| 612 | error("dlopen %s failed: %s", provider_id, dlerror()); |
| 613 | goto fail; |
| 614 | } |
| 615 | if ((getfunctionlist = dlsym(handle, "C_GetFunctionList")) == NULL) { |
| 616 | error("dlsym(C_GetFunctionList) failed: %s", dlerror()); |
| 617 | goto fail; |
| 618 | } |
| 619 | p = xcalloc(1, sizeof(*p)); |
| 620 | p->name = xstrdup(provider_id); |
| 621 | p->handle = handle; |
| 622 | /* setup the pkcs11 callbacks */ |
| 623 | if ((rv = (*getfunctionlist)(&f)) != CKR_OK) { |
djm@openbsd.org | efb494e | 2016-10-28 03:33:52 +0000 | [diff] [blame] | 624 | error("C_GetFunctionList for provider %s failed: %lu", |
| 625 | provider_id, rv); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 626 | goto fail; |
| 627 | } |
| 628 | p->function_list = f; |
| 629 | if ((rv = f->C_Initialize(NULL)) != CKR_OK) { |
djm@openbsd.org | efb494e | 2016-10-28 03:33:52 +0000 | [diff] [blame] | 630 | error("C_Initialize for provider %s failed: %lu", |
| 631 | provider_id, rv); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 632 | goto fail; |
| 633 | } |
| 634 | need_finalize = 1; |
| 635 | if ((rv = f->C_GetInfo(&p->info)) != CKR_OK) { |
djm@openbsd.org | efb494e | 2016-10-28 03:33:52 +0000 | [diff] [blame] | 636 | error("C_GetInfo for provider %s failed: %lu", |
| 637 | provider_id, rv); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 638 | goto fail; |
| 639 | } |
| 640 | rmspace(p->info.manufacturerID, sizeof(p->info.manufacturerID)); |
| 641 | rmspace(p->info.libraryDescription, sizeof(p->info.libraryDescription)); |
djm@openbsd.org | efb494e | 2016-10-28 03:33:52 +0000 | [diff] [blame] | 642 | debug("provider %s: manufacturerID <%s> cryptokiVersion %d.%d" |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 643 | " libraryDescription <%s> libraryVersion %d.%d", |
djm@openbsd.org | efb494e | 2016-10-28 03:33:52 +0000 | [diff] [blame] | 644 | provider_id, |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 645 | p->info.manufacturerID, |
| 646 | p->info.cryptokiVersion.major, |
| 647 | p->info.cryptokiVersion.minor, |
| 648 | p->info.libraryDescription, |
| 649 | p->info.libraryVersion.major, |
| 650 | p->info.libraryVersion.minor); |
| 651 | if ((rv = f->C_GetSlotList(CK_TRUE, NULL, &p->nslots)) != CKR_OK) { |
| 652 | error("C_GetSlotList failed: %lu", rv); |
| 653 | goto fail; |
| 654 | } |
| 655 | if (p->nslots == 0) { |
djm@openbsd.org | efb494e | 2016-10-28 03:33:52 +0000 | [diff] [blame] | 656 | debug("%s: provider %s returned no slots", __func__, |
| 657 | provider_id); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 658 | goto fail; |
| 659 | } |
| 660 | p->slotlist = xcalloc(p->nslots, sizeof(CK_SLOT_ID)); |
| 661 | if ((rv = f->C_GetSlotList(CK_TRUE, p->slotlist, &p->nslots)) |
| 662 | != CKR_OK) { |
djm@openbsd.org | efb494e | 2016-10-28 03:33:52 +0000 | [diff] [blame] | 663 | error("C_GetSlotList for provider %s failed: %lu", |
| 664 | provider_id, rv); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 665 | goto fail; |
| 666 | } |
| 667 | p->slotinfo = xcalloc(p->nslots, sizeof(struct pkcs11_slotinfo)); |
| 668 | p->valid = 1; |
| 669 | nkeys = 0; |
| 670 | for (i = 0; i < p->nslots; i++) { |
| 671 | token = &p->slotinfo[i].token; |
| 672 | if ((rv = f->C_GetTokenInfo(p->slotlist[i], token)) |
| 673 | != CKR_OK) { |
djm@openbsd.org | efb494e | 2016-10-28 03:33:52 +0000 | [diff] [blame] | 674 | error("C_GetTokenInfo for provider %s slot %lu " |
| 675 | "failed: %lu", provider_id, (unsigned long)i, rv); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 676 | continue; |
| 677 | } |
djm@openbsd.org | b15fd98 | 2015-07-18 08:00:21 +0000 | [diff] [blame] | 678 | if ((token->flags & CKF_TOKEN_INITIALIZED) == 0) { |
djm@openbsd.org | efb494e | 2016-10-28 03:33:52 +0000 | [diff] [blame] | 679 | debug2("%s: ignoring uninitialised token in " |
| 680 | "provider %s slot %lu", __func__, |
| 681 | provider_id, (unsigned long)i); |
djm@openbsd.org | b15fd98 | 2015-07-18 08:00:21 +0000 | [diff] [blame] | 682 | continue; |
| 683 | } |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 684 | rmspace(token->label, sizeof(token->label)); |
| 685 | rmspace(token->manufacturerID, sizeof(token->manufacturerID)); |
| 686 | rmspace(token->model, sizeof(token->model)); |
| 687 | rmspace(token->serialNumber, sizeof(token->serialNumber)); |
djm@openbsd.org | efb494e | 2016-10-28 03:33:52 +0000 | [diff] [blame] | 688 | debug("provider %s slot %lu: label <%s> manufacturerID <%s> " |
| 689 | "model <%s> serial <%s> flags 0x%lx", |
| 690 | provider_id, (unsigned long)i, |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 691 | token->label, token->manufacturerID, token->model, |
| 692 | token->serialNumber, token->flags); |
| 693 | /* open session, login with pin and retrieve public keys */ |
| 694 | if (pkcs11_open_session(p, i, pin) == 0) |
| 695 | pkcs11_fetch_keys(p, i, keyp, &nkeys); |
| 696 | } |
| 697 | if (nkeys > 0) { |
| 698 | TAILQ_INSERT_TAIL(&pkcs11_providers, p, next); |
| 699 | p->refcount++; /* add to provider list */ |
| 700 | return (nkeys); |
| 701 | } |
djm@openbsd.org | efb494e | 2016-10-28 03:33:52 +0000 | [diff] [blame] | 702 | debug("%s: provider %s returned no keys", __func__, provider_id); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 703 | /* don't add the provider, since it does not have any keys */ |
| 704 | fail: |
| 705 | if (need_finalize && (rv = f->C_Finalize(NULL)) != CKR_OK) |
djm@openbsd.org | efb494e | 2016-10-28 03:33:52 +0000 | [diff] [blame] | 706 | error("C_Finalize for provider %s failed: %lu", |
| 707 | provider_id, rv); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 708 | if (p) { |
Darren Tucker | a627d42 | 2013-06-02 07:31:17 +1000 | [diff] [blame] | 709 | free(p->slotlist); |
| 710 | free(p->slotinfo); |
| 711 | free(p); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 712 | } |
| 713 | if (handle) |
| 714 | dlclose(handle); |
| 715 | return (-1); |
| 716 | } |
Damien Miller | dfa4156 | 2010-02-12 10:06:28 +1100 | [diff] [blame] | 717 | |
Darren Tucker | 0dd24e0 | 2011-09-04 19:59:26 +1000 | [diff] [blame] | 718 | #else |
| 719 | |
| 720 | int |
| 721 | pkcs11_init(int interactive) |
| 722 | { |
| 723 | return (0); |
| 724 | } |
| 725 | |
| 726 | void |
| 727 | pkcs11_terminate(void) |
| 728 | { |
| 729 | return; |
| 730 | } |
| 731 | |
Damien Miller | dfa4156 | 2010-02-12 10:06:28 +1100 | [diff] [blame] | 732 | #endif /* ENABLE_PKCS11 */ |