Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame^] | 1 | /* $OpenBSD: ssh-pkcs11.c,v 1.9 2013/11/02 20:03:54 markus Exp $ */ |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 2 | /* |
| 3 | * Copyright (c) 2010 Markus Friedl. All rights reserved. |
| 4 | * |
| 5 | * Permission to use, copy, modify, and distribute this software for any |
| 6 | * purpose with or without fee is hereby granted, provided that the above |
| 7 | * copyright notice and this permission notice appear in all copies. |
| 8 | * |
| 9 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| 10 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| 11 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
| 12 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| 13 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
| 14 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF |
| 15 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
| 16 | */ |
| 17 | |
Damien Miller | 8ad0fbd | 2010-02-12 09:49:06 +1100 | [diff] [blame] | 18 | #include "includes.h" |
| 19 | |
Damien Miller | dfa4156 | 2010-02-12 10:06:28 +1100 | [diff] [blame] | 20 | #ifdef ENABLE_PKCS11 |
| 21 | |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 22 | #include <sys/types.h> |
Damien Miller | 8ad0fbd | 2010-02-12 09:49:06 +1100 | [diff] [blame] | 23 | #ifdef HAVE_SYS_TIME_H |
| 24 | # include <sys/time.h> |
| 25 | #endif |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 26 | #include <stdarg.h> |
| 27 | #include <stdio.h> |
| 28 | |
| 29 | #include <string.h> |
| 30 | #include <dlfcn.h> |
| 31 | |
Damien Miller | 8ad0fbd | 2010-02-12 09:49:06 +1100 | [diff] [blame] | 32 | #include "openbsd-compat/sys-queue.h" |
| 33 | |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame^] | 34 | #include <openssl/x509.h> |
| 35 | |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 36 | #define CRYPTOKI_COMPAT |
| 37 | #include "pkcs11.h" |
| 38 | |
| 39 | #include "log.h" |
| 40 | #include "misc.h" |
| 41 | #include "key.h" |
| 42 | #include "ssh-pkcs11.h" |
| 43 | #include "xmalloc.h" |
| 44 | |
| 45 | struct pkcs11_slotinfo { |
| 46 | CK_TOKEN_INFO token; |
| 47 | CK_SESSION_HANDLE session; |
| 48 | int logged_in; |
| 49 | }; |
| 50 | |
| 51 | struct pkcs11_provider { |
| 52 | char *name; |
| 53 | void *handle; |
| 54 | CK_FUNCTION_LIST *function_list; |
| 55 | CK_INFO info; |
| 56 | CK_ULONG nslots; |
| 57 | CK_SLOT_ID *slotlist; |
| 58 | struct pkcs11_slotinfo *slotinfo; |
| 59 | int valid; |
| 60 | int refcount; |
| 61 | TAILQ_ENTRY(pkcs11_provider) next; |
| 62 | }; |
| 63 | |
| 64 | TAILQ_HEAD(, pkcs11_provider) pkcs11_providers; |
| 65 | |
| 66 | struct pkcs11_key { |
| 67 | struct pkcs11_provider *provider; |
| 68 | CK_ULONG slotidx; |
| 69 | int (*orig_finish)(RSA *rsa); |
| 70 | RSA_METHOD rsa_method; |
| 71 | char *keyid; |
| 72 | int keyid_len; |
| 73 | }; |
| 74 | |
| 75 | int pkcs11_interactive = 0; |
| 76 | |
| 77 | int |
| 78 | pkcs11_init(int interactive) |
| 79 | { |
| 80 | pkcs11_interactive = interactive; |
| 81 | TAILQ_INIT(&pkcs11_providers); |
| 82 | return (0); |
| 83 | } |
| 84 | |
| 85 | /* |
| 86 | * finalize a provider shared libarary, it's no longer usable. |
| 87 | * however, there might still be keys referencing this provider, |
| 88 | * so the actuall freeing of memory is handled by pkcs11_provider_unref(). |
| 89 | * this is called when a provider gets unregistered. |
| 90 | */ |
| 91 | static void |
| 92 | pkcs11_provider_finalize(struct pkcs11_provider *p) |
| 93 | { |
| 94 | CK_RV rv; |
| 95 | CK_ULONG i; |
| 96 | |
| 97 | debug("pkcs11_provider_finalize: %p refcount %d valid %d", |
| 98 | p, p->refcount, p->valid); |
| 99 | if (!p->valid) |
| 100 | return; |
| 101 | for (i = 0; i < p->nslots; i++) { |
| 102 | if (p->slotinfo[i].session && |
| 103 | (rv = p->function_list->C_CloseSession( |
| 104 | p->slotinfo[i].session)) != CKR_OK) |
| 105 | error("C_CloseSession failed: %lu", rv); |
| 106 | } |
| 107 | if ((rv = p->function_list->C_Finalize(NULL)) != CKR_OK) |
| 108 | error("C_Finalize failed: %lu", rv); |
| 109 | p->valid = 0; |
| 110 | p->function_list = NULL; |
| 111 | dlclose(p->handle); |
| 112 | } |
| 113 | |
| 114 | /* |
| 115 | * remove a reference to the provider. |
| 116 | * called when a key gets destroyed or when the provider is unregistered. |
| 117 | */ |
| 118 | static void |
| 119 | pkcs11_provider_unref(struct pkcs11_provider *p) |
| 120 | { |
| 121 | debug("pkcs11_provider_unref: %p refcount %d", p, p->refcount); |
| 122 | if (--p->refcount <= 0) { |
| 123 | if (p->valid) |
| 124 | error("pkcs11_provider_unref: %p still valid", p); |
Darren Tucker | a627d42 | 2013-06-02 07:31:17 +1000 | [diff] [blame] | 125 | free(p->slotlist); |
| 126 | free(p->slotinfo); |
| 127 | free(p); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 128 | } |
| 129 | } |
| 130 | |
| 131 | /* unregister all providers, keys might still point to the providers */ |
| 132 | void |
| 133 | pkcs11_terminate(void) |
| 134 | { |
| 135 | struct pkcs11_provider *p; |
| 136 | |
| 137 | while ((p = TAILQ_FIRST(&pkcs11_providers)) != NULL) { |
| 138 | TAILQ_REMOVE(&pkcs11_providers, p, next); |
| 139 | pkcs11_provider_finalize(p); |
| 140 | pkcs11_provider_unref(p); |
| 141 | } |
| 142 | } |
| 143 | |
| 144 | /* lookup provider by name */ |
| 145 | static struct pkcs11_provider * |
| 146 | pkcs11_provider_lookup(char *provider_id) |
| 147 | { |
| 148 | struct pkcs11_provider *p; |
| 149 | |
| 150 | TAILQ_FOREACH(p, &pkcs11_providers, next) { |
| 151 | debug("check %p %s", p, p->name); |
| 152 | if (!strcmp(provider_id, p->name)) |
| 153 | return (p); |
| 154 | } |
| 155 | return (NULL); |
| 156 | } |
| 157 | |
| 158 | /* unregister provider by name */ |
| 159 | int |
| 160 | pkcs11_del_provider(char *provider_id) |
| 161 | { |
| 162 | struct pkcs11_provider *p; |
| 163 | |
| 164 | if ((p = pkcs11_provider_lookup(provider_id)) != NULL) { |
| 165 | TAILQ_REMOVE(&pkcs11_providers, p, next); |
| 166 | pkcs11_provider_finalize(p); |
| 167 | pkcs11_provider_unref(p); |
| 168 | return (0); |
| 169 | } |
| 170 | return (-1); |
| 171 | } |
| 172 | |
| 173 | /* openssl callback for freeing an RSA key */ |
| 174 | static int |
| 175 | pkcs11_rsa_finish(RSA *rsa) |
| 176 | { |
| 177 | struct pkcs11_key *k11; |
| 178 | int rv = -1; |
| 179 | |
| 180 | if ((k11 = RSA_get_app_data(rsa)) != NULL) { |
| 181 | if (k11->orig_finish) |
| 182 | rv = k11->orig_finish(rsa); |
| 183 | if (k11->provider) |
| 184 | pkcs11_provider_unref(k11->provider); |
Darren Tucker | a627d42 | 2013-06-02 07:31:17 +1000 | [diff] [blame] | 185 | free(k11->keyid); |
| 186 | free(k11); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 187 | } |
| 188 | return (rv); |
| 189 | } |
| 190 | |
Damien Miller | 031c910 | 2010-04-16 15:54:44 +1000 | [diff] [blame] | 191 | /* find a single 'obj' for given attributes */ |
| 192 | static int |
| 193 | pkcs11_find(struct pkcs11_provider *p, CK_ULONG slotidx, CK_ATTRIBUTE *attr, |
| 194 | CK_ULONG nattr, CK_OBJECT_HANDLE *obj) |
| 195 | { |
| 196 | CK_FUNCTION_LIST *f; |
| 197 | CK_SESSION_HANDLE session; |
| 198 | CK_ULONG nfound = 0; |
| 199 | CK_RV rv; |
| 200 | int ret = -1; |
| 201 | |
| 202 | f = p->function_list; |
| 203 | session = p->slotinfo[slotidx].session; |
| 204 | if ((rv = f->C_FindObjectsInit(session, attr, nattr)) != CKR_OK) { |
| 205 | error("C_FindObjectsInit failed (nattr %lu): %lu", nattr, rv); |
| 206 | return (-1); |
| 207 | } |
| 208 | if ((rv = f->C_FindObjects(session, obj, 1, &nfound)) != CKR_OK || |
| 209 | nfound != 1) { |
| 210 | debug("C_FindObjects failed (nfound %lu nattr %lu): %lu", |
| 211 | nfound, nattr, rv); |
| 212 | } else |
| 213 | ret = 0; |
| 214 | if ((rv = f->C_FindObjectsFinal(session)) != CKR_OK) |
| 215 | error("C_FindObjectsFinal failed: %lu", rv); |
| 216 | return (ret); |
| 217 | } |
| 218 | |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 219 | /* openssl callback doing the actual signing operation */ |
| 220 | static int |
| 221 | pkcs11_rsa_private_encrypt(int flen, const u_char *from, u_char *to, RSA *rsa, |
| 222 | int padding) |
| 223 | { |
| 224 | struct pkcs11_key *k11; |
| 225 | struct pkcs11_slotinfo *si; |
| 226 | CK_FUNCTION_LIST *f; |
| 227 | CK_OBJECT_HANDLE obj; |
Damien Miller | 031c910 | 2010-04-16 15:54:44 +1000 | [diff] [blame] | 228 | CK_ULONG tlen = 0; |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 229 | CK_RV rv; |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame^] | 230 | CK_OBJECT_CLASS private_key_class = CKO_PRIVATE_KEY; |
Damien Miller | 8ad0fbd | 2010-02-12 09:49:06 +1100 | [diff] [blame] | 231 | CK_BBOOL true_val = CK_TRUE; |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 232 | CK_MECHANISM mech = { |
| 233 | CKM_RSA_PKCS, NULL_PTR, 0 |
| 234 | }; |
| 235 | CK_ATTRIBUTE key_filter[] = { |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame^] | 236 | {CKA_CLASS, &private_key_class, sizeof(private_key_class) }, |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 237 | {CKA_ID, NULL, 0}, |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame^] | 238 | {CKA_SIGN, &true_val, sizeof(true_val) } |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 239 | }; |
| 240 | char *pin, prompt[1024]; |
| 241 | int rval = -1; |
| 242 | |
| 243 | if ((k11 = RSA_get_app_data(rsa)) == NULL) { |
| 244 | error("RSA_get_app_data failed for rsa %p", rsa); |
| 245 | return (-1); |
| 246 | } |
| 247 | if (!k11->provider || !k11->provider->valid) { |
| 248 | error("no pkcs11 (valid) provider for rsa %p", rsa); |
| 249 | return (-1); |
| 250 | } |
| 251 | f = k11->provider->function_list; |
| 252 | si = &k11->provider->slotinfo[k11->slotidx]; |
| 253 | if ((si->token.flags & CKF_LOGIN_REQUIRED) && !si->logged_in) { |
| 254 | if (!pkcs11_interactive) { |
| 255 | error("need pin"); |
| 256 | return (-1); |
| 257 | } |
| 258 | snprintf(prompt, sizeof(prompt), "Enter PIN for '%s': ", |
| 259 | si->token.label); |
| 260 | pin = read_passphrase(prompt, RP_ALLOW_EOF); |
| 261 | if (pin == NULL) |
| 262 | return (-1); /* bail out */ |
Damien Miller | 746d1a6 | 2013-07-18 16:13:02 +1000 | [diff] [blame] | 263 | if ((rv = f->C_Login(si->session, CKU_USER, |
| 264 | (u_char *)pin, strlen(pin))) != CKR_OK) { |
Darren Tucker | a627d42 | 2013-06-02 07:31:17 +1000 | [diff] [blame] | 265 | free(pin); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 266 | error("C_Login failed: %lu", rv); |
| 267 | return (-1); |
| 268 | } |
Darren Tucker | a627d42 | 2013-06-02 07:31:17 +1000 | [diff] [blame] | 269 | free(pin); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 270 | si->logged_in = 1; |
| 271 | } |
| 272 | key_filter[1].pValue = k11->keyid; |
| 273 | key_filter[1].ulValueLen = k11->keyid_len; |
Damien Miller | 031c910 | 2010-04-16 15:54:44 +1000 | [diff] [blame] | 274 | /* try to find object w/CKA_SIGN first, retry w/o */ |
| 275 | if (pkcs11_find(k11->provider, k11->slotidx, key_filter, 3, &obj) < 0 && |
| 276 | pkcs11_find(k11->provider, k11->slotidx, key_filter, 2, &obj) < 0) { |
| 277 | error("cannot find private key"); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 278 | } else if ((rv = f->C_SignInit(si->session, &mech, obj)) != CKR_OK) { |
| 279 | error("C_SignInit failed: %lu", rv); |
| 280 | } else { |
| 281 | /* XXX handle CKR_BUFFER_TOO_SMALL */ |
| 282 | tlen = RSA_size(rsa); |
| 283 | rv = f->C_Sign(si->session, (CK_BYTE *)from, flen, to, &tlen); |
| 284 | if (rv == CKR_OK) |
| 285 | rval = tlen; |
| 286 | else |
| 287 | error("C_Sign failed: %lu", rv); |
| 288 | } |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 289 | return (rval); |
| 290 | } |
| 291 | |
| 292 | static int |
| 293 | pkcs11_rsa_private_decrypt(int flen, const u_char *from, u_char *to, RSA *rsa, |
| 294 | int padding) |
| 295 | { |
| 296 | return (-1); |
| 297 | } |
| 298 | |
| 299 | /* redirect private key operations for rsa key to pkcs11 token */ |
| 300 | static int |
| 301 | pkcs11_rsa_wrap(struct pkcs11_provider *provider, CK_ULONG slotidx, |
| 302 | CK_ATTRIBUTE *keyid_attrib, RSA *rsa) |
| 303 | { |
| 304 | struct pkcs11_key *k11; |
| 305 | const RSA_METHOD *def = RSA_get_default_method(); |
| 306 | |
| 307 | k11 = xcalloc(1, sizeof(*k11)); |
| 308 | k11->provider = provider; |
| 309 | provider->refcount++; /* provider referenced by RSA key */ |
| 310 | k11->slotidx = slotidx; |
| 311 | /* identify key object on smartcard */ |
| 312 | k11->keyid_len = keyid_attrib->ulValueLen; |
| 313 | k11->keyid = xmalloc(k11->keyid_len); |
| 314 | memcpy(k11->keyid, keyid_attrib->pValue, k11->keyid_len); |
| 315 | k11->orig_finish = def->finish; |
| 316 | memcpy(&k11->rsa_method, def, sizeof(k11->rsa_method)); |
| 317 | k11->rsa_method.name = "pkcs11"; |
| 318 | k11->rsa_method.rsa_priv_enc = pkcs11_rsa_private_encrypt; |
| 319 | k11->rsa_method.rsa_priv_dec = pkcs11_rsa_private_decrypt; |
| 320 | k11->rsa_method.finish = pkcs11_rsa_finish; |
| 321 | RSA_set_method(rsa, &k11->rsa_method); |
| 322 | RSA_set_app_data(rsa, k11); |
| 323 | return (0); |
| 324 | } |
| 325 | |
| 326 | /* remove trailing spaces */ |
| 327 | static void |
Damien Miller | 746d1a6 | 2013-07-18 16:13:02 +1000 | [diff] [blame] | 328 | rmspace(u_char *buf, size_t len) |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 329 | { |
| 330 | size_t i; |
| 331 | |
| 332 | if (!len) |
| 333 | return; |
| 334 | for (i = len - 1; i > 0; i--) |
| 335 | if (i == len - 1 || buf[i] == ' ') |
| 336 | buf[i] = '\0'; |
| 337 | else |
| 338 | break; |
| 339 | } |
| 340 | |
| 341 | /* |
| 342 | * open a pkcs11 session and login if required. |
| 343 | * if pin == NULL we delay login until key use |
| 344 | */ |
| 345 | static int |
| 346 | pkcs11_open_session(struct pkcs11_provider *p, CK_ULONG slotidx, char *pin) |
| 347 | { |
| 348 | CK_RV rv; |
| 349 | CK_FUNCTION_LIST *f; |
| 350 | CK_SESSION_HANDLE session; |
| 351 | int login_required; |
| 352 | |
| 353 | f = p->function_list; |
| 354 | login_required = p->slotinfo[slotidx].token.flags & CKF_LOGIN_REQUIRED; |
| 355 | if (pin && login_required && !strlen(pin)) { |
| 356 | error("pin required"); |
| 357 | return (-1); |
| 358 | } |
| 359 | if ((rv = f->C_OpenSession(p->slotlist[slotidx], CKF_RW_SESSION| |
| 360 | CKF_SERIAL_SESSION, NULL, NULL, &session)) |
| 361 | != CKR_OK) { |
| 362 | error("C_OpenSession failed: %lu", rv); |
| 363 | return (-1); |
| 364 | } |
| 365 | if (login_required && pin) { |
Damien Miller | 746d1a6 | 2013-07-18 16:13:02 +1000 | [diff] [blame] | 366 | if ((rv = f->C_Login(session, CKU_USER, |
| 367 | (u_char *)pin, strlen(pin))) != CKR_OK) { |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 368 | error("C_Login failed: %lu", rv); |
| 369 | if ((rv = f->C_CloseSession(session)) != CKR_OK) |
| 370 | error("C_CloseSession failed: %lu", rv); |
| 371 | return (-1); |
| 372 | } |
| 373 | p->slotinfo[slotidx].logged_in = 1; |
| 374 | } |
| 375 | p->slotinfo[slotidx].session = session; |
| 376 | return (0); |
| 377 | } |
| 378 | |
| 379 | /* |
| 380 | * lookup public keys for token in slot identified by slotidx, |
| 381 | * add 'wrapped' public keys to the 'keysp' array and increment nkeys. |
| 382 | * keysp points to an (possibly empty) array with *nkeys keys. |
| 383 | */ |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame^] | 384 | static int pkcs11_fetch_keys_filter(struct pkcs11_provider *, CK_ULONG, |
| 385 | CK_ATTRIBUTE [], CK_ATTRIBUTE [3], Key ***, int *) |
| 386 | __attribute__((__bounded__(__minbytes__,4, 3 * sizeof(CK_ATTRIBUTE)))); |
| 387 | |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 388 | static int |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame^] | 389 | pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx, |
| 390 | Key ***keysp, int *nkeys) |
| 391 | { |
| 392 | CK_OBJECT_CLASS pubkey_class = CKO_PUBLIC_KEY; |
| 393 | CK_OBJECT_CLASS cert_class = CKO_CERTIFICATE; |
| 394 | CK_ATTRIBUTE pubkey_filter[] = { |
| 395 | { CKA_CLASS, &pubkey_class, sizeof(pubkey_class) } |
| 396 | }; |
| 397 | CK_ATTRIBUTE cert_filter[] = { |
| 398 | { CKA_CLASS, &cert_class, sizeof(cert_class) } |
| 399 | }; |
| 400 | CK_ATTRIBUTE pubkey_attribs[] = { |
| 401 | { CKA_ID, NULL, 0 }, |
| 402 | { CKA_MODULUS, NULL, 0 }, |
| 403 | { CKA_PUBLIC_EXPONENT, NULL, 0 } |
| 404 | }; |
| 405 | CK_ATTRIBUTE cert_attribs[] = { |
| 406 | { CKA_ID, NULL, 0 }, |
| 407 | { CKA_SUBJECT, NULL, 0 }, |
| 408 | { CKA_VALUE, NULL, 0 } |
| 409 | }; |
| 410 | |
| 411 | if (pkcs11_fetch_keys_filter(p, slotidx, pubkey_filter, pubkey_attribs, |
| 412 | keysp, nkeys) < 0 || |
| 413 | pkcs11_fetch_keys_filter(p, slotidx, cert_filter, cert_attribs, |
| 414 | keysp, nkeys) < 0) |
| 415 | return (-1); |
| 416 | return (0); |
| 417 | } |
| 418 | |
| 419 | static int |
| 420 | pkcs11_key_included(Key ***keysp, int *nkeys, Key *key) |
| 421 | { |
| 422 | int i; |
| 423 | |
| 424 | for (i = 0; i < *nkeys; i++) |
| 425 | if (key_equal(key, *keysp[i])) |
| 426 | return (1); |
| 427 | return (0); |
| 428 | } |
| 429 | |
| 430 | static int |
| 431 | pkcs11_fetch_keys_filter(struct pkcs11_provider *p, CK_ULONG slotidx, |
| 432 | CK_ATTRIBUTE filter[], CK_ATTRIBUTE attribs[3], |
| 433 | Key ***keysp, int *nkeys) |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 434 | { |
| 435 | Key *key; |
| 436 | RSA *rsa; |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame^] | 437 | X509 *x509; |
| 438 | EVP_PKEY *evp; |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 439 | int i; |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame^] | 440 | const u_char *cp; |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 441 | CK_RV rv; |
| 442 | CK_OBJECT_HANDLE obj; |
| 443 | CK_ULONG nfound; |
| 444 | CK_SESSION_HANDLE session; |
| 445 | CK_FUNCTION_LIST *f; |
Tim Rice | 179eee0 | 2010-03-04 12:48:05 -0800 | [diff] [blame] | 446 | |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 447 | f = p->function_list; |
| 448 | session = p->slotinfo[slotidx].session; |
| 449 | /* setup a filter the looks for public keys */ |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame^] | 450 | if ((rv = f->C_FindObjectsInit(session, filter, 1)) != CKR_OK) { |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 451 | error("C_FindObjectsInit failed: %lu", rv); |
| 452 | return (-1); |
| 453 | } |
| 454 | while (1) { |
| 455 | /* XXX 3 attributes in attribs[] */ |
| 456 | for (i = 0; i < 3; i++) { |
| 457 | attribs[i].pValue = NULL; |
| 458 | attribs[i].ulValueLen = 0; |
| 459 | } |
| 460 | if ((rv = f->C_FindObjects(session, &obj, 1, &nfound)) != CKR_OK |
| 461 | || nfound == 0) |
| 462 | break; |
| 463 | /* found a key, so figure out size of the attributes */ |
| 464 | if ((rv = f->C_GetAttributeValue(session, obj, attribs, 3)) |
| 465 | != CKR_OK) { |
| 466 | error("C_GetAttributeValue failed: %lu", rv); |
| 467 | continue; |
| 468 | } |
Damien Miller | 4fe686d | 2010-06-26 09:36:10 +1000 | [diff] [blame] | 469 | /* check that none of the attributes are zero length */ |
| 470 | if (attribs[0].ulValueLen == 0 || |
| 471 | attribs[1].ulValueLen == 0 || |
| 472 | attribs[2].ulValueLen == 0) { |
| 473 | continue; |
| 474 | } |
| 475 | /* allocate buffers for attributes */ |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 476 | for (i = 0; i < 3; i++) |
| 477 | attribs[i].pValue = xmalloc(attribs[i].ulValueLen); |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame^] | 478 | /* |
| 479 | * retrieve ID, modulus and public exponent of RSA key, |
| 480 | * or ID, subject and value for certificates. |
| 481 | */ |
| 482 | rsa = NULL; |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 483 | if ((rv = f->C_GetAttributeValue(session, obj, attribs, 3)) |
| 484 | != CKR_OK) { |
| 485 | error("C_GetAttributeValue failed: %lu", rv); |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame^] | 486 | } else if (attribs[1].type == CKA_MODULUS ) { |
| 487 | if ((rsa = RSA_new()) == NULL) { |
| 488 | error("RSA_new failed"); |
| 489 | } else { |
| 490 | rsa->n = BN_bin2bn(attribs[1].pValue, |
| 491 | attribs[1].ulValueLen, NULL); |
| 492 | rsa->e = BN_bin2bn(attribs[2].pValue, |
| 493 | attribs[2].ulValueLen, NULL); |
| 494 | } |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 495 | } else { |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame^] | 496 | cp = attribs[2].pValue; |
| 497 | if ((x509 = X509_new()) == NULL) { |
| 498 | error("X509_new failed"); |
| 499 | } else if (d2i_X509(&x509, &cp, attribs[2].ulValueLen) |
| 500 | == NULL) { |
| 501 | error("d2i_X509 failed"); |
| 502 | } else if ((evp = X509_get_pubkey(x509)) == NULL || |
| 503 | evp->type != EVP_PKEY_RSA || |
| 504 | evp->pkey.rsa == NULL) { |
| 505 | debug("X509_get_pubkey failed or no rsa"); |
| 506 | } else if ((rsa = RSAPublicKey_dup(evp->pkey.rsa)) |
| 507 | == NULL) { |
| 508 | error("RSAPublicKey_dup"); |
| 509 | } |
| 510 | if (x509) |
| 511 | X509_free(x509); |
| 512 | } |
| 513 | if (rsa && rsa->n && rsa->e && |
| 514 | pkcs11_rsa_wrap(p, slotidx, &attribs[0], rsa) == 0) { |
| 515 | key = key_new(KEY_UNSPEC); |
| 516 | key->rsa = rsa; |
| 517 | key->type = KEY_RSA; |
| 518 | key->flags |= KEY_FLAG_EXT; |
| 519 | if (pkcs11_key_included(keysp, nkeys, key)) { |
| 520 | key_free(key); |
| 521 | } else { |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 522 | /* expand key array and add key */ |
| 523 | *keysp = xrealloc(*keysp, *nkeys + 1, |
| 524 | sizeof(Key *)); |
| 525 | (*keysp)[*nkeys] = key; |
| 526 | *nkeys = *nkeys + 1; |
| 527 | debug("have %d keys", *nkeys); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 528 | } |
Damien Miller | d2252c7 | 2013-11-04 07:41:48 +1100 | [diff] [blame^] | 529 | } else if (rsa) { |
| 530 | RSA_free(rsa); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 531 | } |
| 532 | for (i = 0; i < 3; i++) |
Darren Tucker | a627d42 | 2013-06-02 07:31:17 +1000 | [diff] [blame] | 533 | free(attribs[i].pValue); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 534 | } |
| 535 | if ((rv = f->C_FindObjectsFinal(session)) != CKR_OK) |
| 536 | error("C_FindObjectsFinal failed: %lu", rv); |
| 537 | return (0); |
| 538 | } |
| 539 | |
| 540 | /* register a new provider, fails if provider already exists */ |
| 541 | int |
| 542 | pkcs11_add_provider(char *provider_id, char *pin, Key ***keyp) |
| 543 | { |
| 544 | int nkeys, need_finalize = 0; |
| 545 | struct pkcs11_provider *p = NULL; |
| 546 | void *handle = NULL; |
| 547 | CK_RV (*getfunctionlist)(CK_FUNCTION_LIST **); |
| 548 | CK_RV rv; |
| 549 | CK_FUNCTION_LIST *f = NULL; |
| 550 | CK_TOKEN_INFO *token; |
| 551 | CK_ULONG i; |
| 552 | |
| 553 | *keyp = NULL; |
| 554 | if (pkcs11_provider_lookup(provider_id) != NULL) { |
| 555 | error("provider already registered: %s", provider_id); |
| 556 | goto fail; |
| 557 | } |
| 558 | /* open shared pkcs11-libarary */ |
| 559 | if ((handle = dlopen(provider_id, RTLD_NOW)) == NULL) { |
| 560 | error("dlopen %s failed: %s", provider_id, dlerror()); |
| 561 | goto fail; |
| 562 | } |
| 563 | if ((getfunctionlist = dlsym(handle, "C_GetFunctionList")) == NULL) { |
| 564 | error("dlsym(C_GetFunctionList) failed: %s", dlerror()); |
| 565 | goto fail; |
| 566 | } |
| 567 | p = xcalloc(1, sizeof(*p)); |
| 568 | p->name = xstrdup(provider_id); |
| 569 | p->handle = handle; |
| 570 | /* setup the pkcs11 callbacks */ |
| 571 | if ((rv = (*getfunctionlist)(&f)) != CKR_OK) { |
| 572 | error("C_GetFunctionList failed: %lu", rv); |
| 573 | goto fail; |
| 574 | } |
| 575 | p->function_list = f; |
| 576 | if ((rv = f->C_Initialize(NULL)) != CKR_OK) { |
| 577 | error("C_Initialize failed: %lu", rv); |
| 578 | goto fail; |
| 579 | } |
| 580 | need_finalize = 1; |
| 581 | if ((rv = f->C_GetInfo(&p->info)) != CKR_OK) { |
| 582 | error("C_GetInfo failed: %lu", rv); |
| 583 | goto fail; |
| 584 | } |
| 585 | rmspace(p->info.manufacturerID, sizeof(p->info.manufacturerID)); |
| 586 | rmspace(p->info.libraryDescription, sizeof(p->info.libraryDescription)); |
| 587 | debug("manufacturerID <%s> cryptokiVersion %d.%d" |
| 588 | " libraryDescription <%s> libraryVersion %d.%d", |
| 589 | p->info.manufacturerID, |
| 590 | p->info.cryptokiVersion.major, |
| 591 | p->info.cryptokiVersion.minor, |
| 592 | p->info.libraryDescription, |
| 593 | p->info.libraryVersion.major, |
| 594 | p->info.libraryVersion.minor); |
| 595 | if ((rv = f->C_GetSlotList(CK_TRUE, NULL, &p->nslots)) != CKR_OK) { |
| 596 | error("C_GetSlotList failed: %lu", rv); |
| 597 | goto fail; |
| 598 | } |
| 599 | if (p->nslots == 0) { |
| 600 | error("no slots"); |
| 601 | goto fail; |
| 602 | } |
| 603 | p->slotlist = xcalloc(p->nslots, sizeof(CK_SLOT_ID)); |
| 604 | if ((rv = f->C_GetSlotList(CK_TRUE, p->slotlist, &p->nslots)) |
| 605 | != CKR_OK) { |
| 606 | error("C_GetSlotList failed: %lu", rv); |
| 607 | goto fail; |
| 608 | } |
| 609 | p->slotinfo = xcalloc(p->nslots, sizeof(struct pkcs11_slotinfo)); |
| 610 | p->valid = 1; |
| 611 | nkeys = 0; |
| 612 | for (i = 0; i < p->nslots; i++) { |
| 613 | token = &p->slotinfo[i].token; |
| 614 | if ((rv = f->C_GetTokenInfo(p->slotlist[i], token)) |
| 615 | != CKR_OK) { |
| 616 | error("C_GetTokenInfo failed: %lu", rv); |
| 617 | continue; |
| 618 | } |
| 619 | rmspace(token->label, sizeof(token->label)); |
| 620 | rmspace(token->manufacturerID, sizeof(token->manufacturerID)); |
| 621 | rmspace(token->model, sizeof(token->model)); |
| 622 | rmspace(token->serialNumber, sizeof(token->serialNumber)); |
| 623 | debug("label <%s> manufacturerID <%s> model <%s> serial <%s>" |
| 624 | " flags 0x%lx", |
| 625 | token->label, token->manufacturerID, token->model, |
| 626 | token->serialNumber, token->flags); |
| 627 | /* open session, login with pin and retrieve public keys */ |
| 628 | if (pkcs11_open_session(p, i, pin) == 0) |
| 629 | pkcs11_fetch_keys(p, i, keyp, &nkeys); |
| 630 | } |
| 631 | if (nkeys > 0) { |
| 632 | TAILQ_INSERT_TAIL(&pkcs11_providers, p, next); |
| 633 | p->refcount++; /* add to provider list */ |
| 634 | return (nkeys); |
| 635 | } |
| 636 | error("no keys"); |
| 637 | /* don't add the provider, since it does not have any keys */ |
| 638 | fail: |
| 639 | if (need_finalize && (rv = f->C_Finalize(NULL)) != CKR_OK) |
| 640 | error("C_Finalize failed: %lu", rv); |
| 641 | if (p) { |
Darren Tucker | a627d42 | 2013-06-02 07:31:17 +1000 | [diff] [blame] | 642 | free(p->slotlist); |
| 643 | free(p->slotinfo); |
| 644 | free(p); |
Damien Miller | 7ea845e | 2010-02-12 09:21:02 +1100 | [diff] [blame] | 645 | } |
| 646 | if (handle) |
| 647 | dlclose(handle); |
| 648 | return (-1); |
| 649 | } |
Damien Miller | dfa4156 | 2010-02-12 10:06:28 +1100 | [diff] [blame] | 650 | |
Darren Tucker | 0dd24e0 | 2011-09-04 19:59:26 +1000 | [diff] [blame] | 651 | #else |
| 652 | |
| 653 | int |
| 654 | pkcs11_init(int interactive) |
| 655 | { |
| 656 | return (0); |
| 657 | } |
| 658 | |
| 659 | void |
| 660 | pkcs11_terminate(void) |
| 661 | { |
| 662 | return; |
| 663 | } |
| 664 | |
Damien Miller | dfa4156 | 2010-02-12 10:06:28 +1100 | [diff] [blame] | 665 | #endif /* ENABLE_PKCS11 */ |