4839ce3c859b5e0ff67ba18a453fddf76cd824f6
[strongswan.git] / src / libstrongswan / plugins / pkcs11 / pkcs11_library.c
1 /*
2 * Copyright (C) 2011 Tobias Brunner
3 * Hochschule fuer Technik Rapperswil
4 *
5 * Copyright (C) 2010 Martin Willi
6 * Copyright (C) 2010 revosec AG
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 #include "pkcs11_library.h"
20
21 #include <dlfcn.h>
22
23 #include <library.h>
24 #include <debug.h>
25 #include <threading/mutex.h>
26 #include <utils/linked_list.h>
27
28 typedef struct private_pkcs11_library_t private_pkcs11_library_t;
29
30
31 ENUM_BEGIN(ck_rv_names, CKR_OK, CKR_CANT_LOCK,
32 "OK",
33 "CANCEL",
34 "HOST_MEMORY",
35 "SLOT_ID_INVALID",
36 "(0x04)",
37 "GENERAL_ERROR",
38 "FUNCTION_FAILED",
39 "ARGUMENTS_BAD",
40 "NO_EVENT",
41 "NEED_TO_CREATE_THREADS",
42 "CANT_LOCK");
43 ENUM_NEXT(ck_rv_names, CKR_ATTRIBUTE_READ_ONLY, CKR_ATTRIBUTE_VALUE_INVALID,
44 CKR_CANT_LOCK,
45 "ATTRIBUTE_READ_ONLY",
46 "ATTRIBUTE_SENSITIVE",
47 "ATTRIBUTE_TYPE_INVALID",
48 "ATTRIBUTE_VALUE_INVALID");
49 ENUM_NEXT(ck_rv_names, CKR_DATA_INVALID, CKR_DATA_LEN_RANGE,
50 CKR_ATTRIBUTE_VALUE_INVALID,
51 "DATA_INVALID"
52 "DATA_LEN_RANGE");
53 ENUM_NEXT(ck_rv_names, CKR_DEVICE_ERROR, CKR_DEVICE_REMOVED,
54 CKR_DATA_LEN_RANGE,
55 "DEVICE_ERROR",
56 "DEVICE_MEMORY",
57 "DEVICE_REMOVED");
58 ENUM_NEXT(ck_rv_names, CKR_ENCRYPTED_DATA_INVALID, CKR_ENCRYPTED_DATA_LEN_RANGE,
59 CKR_DEVICE_REMOVED,
60 "ENCRYPTED_DATA_INVALID",
61 "ENCRYPTED_DATA_LEN_RANGE");
62 ENUM_NEXT(ck_rv_names, CKR_FUNCTION_CANCELED, CKR_FUNCTION_NOT_SUPPORTED,
63 CKR_ENCRYPTED_DATA_LEN_RANGE,
64 "FUNCTION_CANCELED",
65 "FUNCTION_NOT_PARALLEL",
66 "(0x52)",
67 "(0x53)",
68 "FUNCTION_NOT_SUPPORTED");
69 ENUM_NEXT(ck_rv_names, CKR_KEY_HANDLE_INVALID, CKR_KEY_UNEXTRACTABLE,
70 CKR_FUNCTION_NOT_SUPPORTED,
71 "KEY_HANDLE_INVALID",
72 "(0x61)",
73 "KEY_SIZE_RANGE",
74 "KEY_TYPE_INCONSISTENT",
75 "KEY_NOT_NEEDED",
76 "KEY_CHANGED",
77 "KEY_NEEDED",
78 "KEY_INDIGESTIBLE",
79 "KEY_FUNCTION_NOT_PERMITTED",
80 "KEY_NOT_WRAPPABLE",
81 "KEY_UNEXTRACTABLE");
82 ENUM_NEXT(ck_rv_names, CKR_MECHANISM_INVALID, CKR_MECHANISM_PARAM_INVALID,
83 CKR_KEY_UNEXTRACTABLE,
84 "MECHANISM_INVALID",
85 "MECHANISM_PARAM_INVALID");
86 ENUM_NEXT(ck_rv_names, CKR_OBJECT_HANDLE_INVALID, CKR_OBJECT_HANDLE_INVALID,
87 CKR_MECHANISM_PARAM_INVALID,
88 "OBJECT_HANDLE_INVALID");
89 ENUM_NEXT(ck_rv_names, CKR_OPERATION_ACTIVE, CKR_OPERATION_NOT_INITIALIZED,
90 CKR_OBJECT_HANDLE_INVALID,
91 "OPERATION_ACTIVE",
92 "OPERATION_NOT_INITIALIZED");
93 ENUM_NEXT(ck_rv_names, CKR_PIN_INCORRECT, CKR_PIN_LOCKED,
94 CKR_OPERATION_NOT_INITIALIZED,
95 "PIN_INCORRECT",
96 "PIN_INVALID",
97 "PIN_LEN_RANGE",
98 "PIN_EXPIRED",
99 "PIN_LOCKED");
100 ENUM_NEXT(ck_rv_names, CKR_SESSION_CLOSED, CKR_SESSION_READ_WRITE_SO_EXISTS,
101 CKR_PIN_LOCKED,
102 "SESSION_CLOSED",
103 "SESSION_COUNT",
104 "(0xb2)",
105 "SESSION_HANDLE_INVALID",
106 "SESSION_PARALLEL_NOT_SUPPORTED",
107 "SESSION_READ_ONLY",
108 "SESSION_EXISTS",
109 "SESSION_READ_ONLY_EXISTS",
110 "SESSION_READ_WRITE_SO_EXISTS");
111 ENUM_NEXT(ck_rv_names, CKR_SIGNATURE_INVALID, CKR_SIGNATURE_LEN_RANGE,
112 CKR_SESSION_READ_WRITE_SO_EXISTS,
113 "SIGNATURE_INVALID",
114 "SIGNATURE_LEN_RANGE");
115 ENUM_NEXT(ck_rv_names, CKR_TEMPLATE_INCOMPLETE, CKR_TEMPLATE_INCONSISTENT,
116 CKR_SIGNATURE_LEN_RANGE,
117 "TEMPLATE_INCOMPLETE",
118 "TEMPLATE_INCONSISTENT",
119 );
120 ENUM_NEXT(ck_rv_names, CKR_TOKEN_NOT_PRESENT, CKR_TOKEN_WRITE_PROTECTED,
121 CKR_TEMPLATE_INCONSISTENT,
122 "TOKEN_NOT_PRESENT",
123 "TOKEN_NOT_RECOGNIZED",
124 "TOKEN_WRITE_PROTECTED");
125 ENUM_NEXT(ck_rv_names, CKR_UNWRAPPING_KEY_HANDLE_INVALID, CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT,
126 CKR_TOKEN_WRITE_PROTECTED,
127 "UNWRAPPING_KEY_HANDLE_INVALID",
128 "UNWRAPPING_KEY_SIZE_RANGE",
129 "UNWRAPPING_KEY_TYPE_INCONSISTENT");
130 ENUM_NEXT(ck_rv_names, CKR_USER_ALREADY_LOGGED_IN, CKR_USER_TOO_MANY_TYPES,
131 CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT,
132 "USER_ALREADY_LOGGED_IN",
133 "USER_NOT_LOGGED_IN",
134 "USER_PIN_NOT_INITIALIZED",
135 "USER_TYPE_INVALID",
136 "USER_ANOTHER_ALREADY_LOGGED_IN",
137 "USER_TOO_MANY_TYPES");
138 ENUM_NEXT(ck_rv_names, CKR_WRAPPED_KEY_INVALID, CKR_WRAPPING_KEY_TYPE_INCONSISTENT,
139 CKR_USER_TOO_MANY_TYPES,
140 "WRAPPED_KEY_INVALID",
141 "(0x111)",
142 "WRAPPED_KEY_LEN_RANGE",
143 "WRAPPING_KEY_HANDLE_INVALID",
144 "WRAPPING_KEY_SIZE_RANGE",
145 "WRAPPING_KEY_TYPE_INCONSISTENT");
146 ENUM_NEXT(ck_rv_names, CKR_RANDOM_SEED_NOT_SUPPORTED, CKR_RANDOM_NO_RNG,
147 CKR_WRAPPING_KEY_TYPE_INCONSISTENT,
148 "RANDOM_SEED_NOT_SUPPORTED",
149 "RANDOM_NO_RNG");
150 ENUM_NEXT(ck_rv_names, CKR_DOMAIN_PARAMS_INVALID, CKR_DOMAIN_PARAMS_INVALID,
151 CKR_RANDOM_NO_RNG,
152 "DOMAIN_PARAMS_INVALID");
153 ENUM_NEXT(ck_rv_names, CKR_BUFFER_TOO_SMALL, CKR_BUFFER_TOO_SMALL,
154 CKR_DOMAIN_PARAMS_INVALID,
155 "BUFFER_TOO_SMALL");
156 ENUM_NEXT(ck_rv_names, CKR_SAVED_STATE_INVALID, CKR_SAVED_STATE_INVALID,
157 CKR_BUFFER_TOO_SMALL,
158 "SAVED_STATE_INVALID");
159 ENUM_NEXT(ck_rv_names, CKR_INFORMATION_SENSITIVE, CKR_INFORMATION_SENSITIVE,
160 CKR_SAVED_STATE_INVALID,
161 "INFORMATION_SENSITIVE");
162 ENUM_NEXT(ck_rv_names, CKR_STATE_UNSAVEABLE, CKR_STATE_UNSAVEABLE,
163 CKR_INFORMATION_SENSITIVE,
164 "STATE_UNSAVEABLE");
165 ENUM_NEXT(ck_rv_names, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_CRYPTOKI_ALREADY_INITIALIZED,
166 CKR_STATE_UNSAVEABLE,
167 "CRYPTOKI_NOT_INITIALIZED",
168 "CRYPTOKI_ALREADY_INITIALIZED");
169 ENUM_NEXT(ck_rv_names, CKR_MUTEX_BAD, CKR_MUTEX_NOT_LOCKED,
170 CKR_CRYPTOKI_ALREADY_INITIALIZED,
171 "MUTEX_BAD",
172 "MUTEX_NOT_LOCKED");
173 ENUM_NEXT(ck_rv_names, CKR_FUNCTION_REJECTED, CKR_FUNCTION_REJECTED,
174 CKR_MUTEX_NOT_LOCKED,
175 "FUNCTION_REJECTED");
176 ENUM_END(ck_rv_names, CKR_FUNCTION_REJECTED);
177
178
179 ENUM_BEGIN(ck_mech_names, CKM_RSA_PKCS_KEY_PAIR_GEN, CKM_DSA_SHA1,
180 "RSA_PKCS_KEY_PAIR_GEN",
181 "RSA_PKCS",
182 "RSA_9796",
183 "RSA_X_509",
184 "MD2_RSA_PKCS",
185 "MD5_RSA_PKCS",
186 "SHA1_RSA_PKCS",
187 "RIPEMD128_RSA_PKCS",
188 "RIPEMD160_RSA_PKCS",
189 "RSA_PKCS_OAEP",
190 "RSA_X9_31_KEY_PAIR_GEN",
191 "RSA_X9_31",
192 "SHA1_RSA_X9_31",
193 "RSA_PKCS_PSS",
194 "SHA1_RSA_PKCS_PSS",
195 "(0xf)",
196 "DSA_KEY_PAIR_GEN",
197 "DSA",
198 "DSA_SHA1");
199 ENUM_NEXT(ck_mech_names, CKM_DH_PKCS_KEY_PAIR_GEN, CKM_DH_PKCS_DERIVE,
200 CKM_DSA_SHA1,
201 "DH_PKCS_KEY_PAIR_GEN",
202 "DH_PKCS_DERIVE");
203 ENUM_NEXT(ck_mech_names, CKM_X9_42_DH_KEY_PAIR_GEN, CKM_X9_42_MQV_DERIVE,
204 CKM_DH_PKCS_DERIVE,
205 "X9_42_DH_KEY_PAIR_GEN",
206 "X9_42_DH_DERIVE",
207 "X9_42_DH_HYBRID_DERIVE",
208 "X9_42_MQV_DERIVE");
209 ENUM_NEXT(ck_mech_names, CKM_SHA256_RSA_PKCS, CKM_SHA512_RSA_PKCS_PSS,
210 CKM_X9_42_MQV_DERIVE,
211 "SHA256_RSA_PKCS",
212 "SHA384_RSA_PKCS",
213 "SHA512_RSA_PKCS",
214 "SHA256_RSA_PKCS_PSS",
215 "SHA384_RSA_PKCS_PSS",
216 "SHA512_RSA_PKCS_PSS");
217 ENUM_NEXT(ck_mech_names, CKM_RC2_KEY_GEN, CKM_RC2_CBC_PAD,
218 CKM_SHA512_RSA_PKCS_PSS,
219 "RC2_KEY_GEN",
220 "RC2_ECB",
221 "RC2_CBC",
222 "RC2_MAC",
223 "RC2_MAC_GENERAL",
224 "RC2_CBC_PAD");
225 ENUM_NEXT(ck_mech_names, CKM_RC4_KEY_GEN, CKM_RC4,
226 CKM_RC2_CBC_PAD,
227 "RC4_KEY_GEN",
228 "RC4");
229 ENUM_NEXT(ck_mech_names, CKM_DES_KEY_GEN, CKM_DES_CBC_PAD,
230 CKM_RC4,
231 "DES_KEY_GEN",
232 "DES_ECB",
233 "DES_CBC",
234 "DES_MAC",
235 "DES_MAC_GENERAL",
236 "DES_CBC_PAD");
237 ENUM_NEXT(ck_mech_names, CKM_DES2_KEY_GEN, CKM_DES3_CBC_PAD,
238 CKM_DES_CBC_PAD,
239 "DES2_KEY_GEN",
240 "DES3_KEY_GEN",
241 "DES3_ECB",
242 "DES3_CBC",
243 "DES3_MAC",
244 "DES3_MAC_GENERAL",
245 "DES3_CBC_PAD");
246 ENUM_NEXT(ck_mech_names, CKM_CDMF_KEY_GEN, CKM_CDMF_CBC_PAD,
247 CKM_DES3_CBC_PAD,
248 "CDMF_KEY_GEN",
249 "CDMF_ECB",
250 "CDMF_CBC",
251 "CDMF_MAC",
252 "CDMF_MAC_GENERAL",
253 "CDMF_CBC_PAD");
254 ENUM_NEXT(ck_mech_names, CKM_MD2, CKM_MD2_HMAC_GENERAL,
255 CKM_CDMF_CBC_PAD,
256 "MD2",
257 "MD2_HMAC",
258 "MD2_HMAC_GENERAL");
259 ENUM_NEXT(ck_mech_names, CKM_MD5, CKM_MD5_HMAC_GENERAL,
260 CKM_MD2_HMAC_GENERAL,
261 "MD5",
262 "MD5_HMAC",
263 "MD5_HMAC_GENERAL");
264 ENUM_NEXT(ck_mech_names, CKM_SHA_1, CKM_SHA_1_HMAC_GENERAL,
265 CKM_MD5_HMAC_GENERAL,
266 "SHA_1",
267 "SHA_1_HMAC",
268 "SHA_1_HMAC_GENERAL");
269 ENUM_NEXT(ck_mech_names, CKM_RIPEMD128, CKM_RIPEMD128_HMAC_GENERAL,
270 CKM_SHA_1_HMAC_GENERAL,
271 "RIPEMD128",
272 "RIPEMD128_HMAC",
273 "RIPEMD128_HMAC_GENERAL");
274 ENUM_NEXT(ck_mech_names, CKM_RIPEMD160, CKM_RIPEMD160_HMAC_GENERAL,
275 CKM_RIPEMD128_HMAC_GENERAL,
276 "RIPEMD160",
277 "RIPEMD160_HMAC",
278 "RIPEMD160_HMAC_GENERAL");
279 ENUM_NEXT(ck_mech_names, CKM_SHA256, CKM_SHA256_HMAC_GENERAL,
280 CKM_RIPEMD160_HMAC_GENERAL,
281 "SHA256",
282 "SHA256_HMAC",
283 "SHA256_HMAC_GENERAL");
284 ENUM_NEXT(ck_mech_names, CKM_SHA384, CKM_SHA384_HMAC_GENERAL,
285 CKM_SHA256_HMAC_GENERAL,
286 "SHA384",
287 "SHA384_HMAC",
288 "SHA384_HMAC_GENERAL");
289 ENUM_NEXT(ck_mech_names, CKM_SHA512, CKM_SHA512_HMAC_GENERAL,
290 CKM_SHA384_HMAC_GENERAL ,
291 "SHA512",
292 "SHA512_HMAC",
293 "SHA512_HMAC_GENERAL");
294 ENUM_NEXT(ck_mech_names, CKM_CAST_KEY_GEN, CKM_CAST_CBC_PAD,
295 CKM_SHA512_HMAC_GENERAL,
296 "CAST_KEY_GEN",
297 "CAST_ECB",
298 "CAST_CBC",
299 "CAST_MAC",
300 "CAST_MAC_GENERAL",
301 "CAST_CBC_PAD");
302 ENUM_NEXT(ck_mech_names, CKM_CAST3_KEY_GEN, CKM_CAST3_CBC_PAD,
303 CKM_CAST_CBC_PAD,
304 "CAST3_KEY_GEN",
305 "CAST3_ECB",
306 "CAST3_CBC",
307 "CAST3_MAC",
308 "CAST3_MAC_GENERAL",
309 "CAST3_CBC_PAD");
310 ENUM_NEXT(ck_mech_names, CKM_CAST128_KEY_GEN, CKM_CAST128_CBC_PAD,
311 CKM_CAST3_CBC_PAD,
312 "CAST128_KEY_GEN",
313 "CAST128_ECB",
314 "CAST128_CBC",
315 "CAST128_MAC",
316 "CAST128_MAC_GENERAL",
317 "CAST128_CBC_PAD");
318 ENUM_NEXT(ck_mech_names, CKM_RC5_KEY_GEN, CKM_RC5_CBC_PAD,
319 CKM_CAST128_CBC_PAD,
320 "RC5_KEY_GEN",
321 "RC5_ECB",
322 "RC5_CBC",
323 "RC5_MAC",
324 "RC5_MAC_GENERAL",
325 "RC5_CBC_PAD");
326 ENUM_NEXT(ck_mech_names, CKM_IDEA_KEY_GEN, CKM_IDEA_CBC_PAD,
327 CKM_RC5_CBC_PAD,
328 "IDEA_KEY_GEN",
329 "IDEA_ECB",
330 "IDEA_CBC",
331 "IDEA_MAC",
332 "IDEA_MAC_GENERAL",
333 "IDEA_CBC_PAD");
334 ENUM_NEXT(ck_mech_names, CKM_GENERIC_SECRET_KEY_GEN, CKM_GENERIC_SECRET_KEY_GEN,
335 CKM_IDEA_CBC_PAD,
336 "GENERIC_SECRET_KEY_GEN");
337 ENUM_NEXT(ck_mech_names, CKM_CONCATENATE_BASE_AND_KEY, CKM_EXTRACT_KEY_FROM_KEY,
338 CKM_GENERIC_SECRET_KEY_GEN,
339 "CONCATENATE_BASE_AND_KEY",
340 "(0x361)",
341 "CONCATENATE_BASE_AND_DATA",
342 "CONCATENATE_DATA_AND_BASE",
343 "XOR_BASE_AND_DATA",
344 "EXTRACT_KEY_FROM_KEY");
345 ENUM_NEXT(ck_mech_names, CKM_SSL3_PRE_MASTER_KEY_GEN, CKM_TLS_MASTER_KEY_DERIVE_DH,
346 CKM_EXTRACT_KEY_FROM_KEY,
347 "SSL3_PRE_MASTER_KEY_GEN",
348 "SSL3_MASTER_KEY_DERIVE",
349 "SSL3_KEY_AND_MAC_DERIVE",
350 "SSL3_MASTER_KEY_DERIVE_DH",
351 "TLS_PRE_MASTER_KEY_GEN",
352 "TLS_MASTER_KEY_DERIVE",
353 "TLS_KEY_AND_MAC_DERIVE",
354 "TLS_MASTER_KEY_DERIVE_DH");
355 ENUM_NEXT(ck_mech_names, CKM_SSL3_MD5_MAC, CKM_SSL3_SHA1_MAC,
356 CKM_TLS_MASTER_KEY_DERIVE_DH,
357 "SSL3_MD5_MAC",
358 "SSL3_SHA1_MAC");
359 ENUM_NEXT(ck_mech_names, CKM_MD5_KEY_DERIVATION, CKM_SHA1_KEY_DERIVATION,
360 CKM_SSL3_SHA1_MAC,
361 "MD5_KEY_DERIVATION",
362 "MD2_KEY_DERIVATION",
363 "SHA1_KEY_DERIVATION");
364 ENUM_NEXT(ck_mech_names, CKM_PBE_MD2_DES_CBC, CKM_PBE_SHA1_RC2_40_CBC,
365 CKM_SHA1_KEY_DERIVATION,
366 "PBE_MD2_DES_CBC",
367 "PBE_MD5_DES_CBC",
368 "PBE_MD5_CAST_CBC",
369 "PBE_MD5_CAST3_CBC",
370 "PBE_MD5_CAST128_CBC",
371 "PBE_SHA1_CAST128_CBC",
372 "PBE_SHA1_RC4_128",
373 "PBE_SHA1_RC4_40",
374 "PBE_SHA1_DES3_EDE_CBC",
375 "PBE_SHA1_DES2_EDE_CBC",
376 "PBE_SHA1_RC2_128_CBC",
377 "PBE_SHA1_RC2_40_CBC");
378 ENUM_NEXT(ck_mech_names, CKM_PKCS5_PBKD2, CKM_PKCS5_PBKD2,
379 CKM_PBE_SHA1_RC2_40_CBC,
380 "PKCS5_PBKD2");
381 ENUM_NEXT(ck_mech_names, CKM_PBA_SHA1_WITH_SHA1_HMAC, CKM_PBA_SHA1_WITH_SHA1_HMAC,
382 CKM_PKCS5_PBKD2,
383 "PBA_SHA1_WITH_SHA1_HMAC");
384 ENUM_NEXT(ck_mech_names, CKM_KEY_WRAP_LYNKS, CKM_KEY_WRAP_SET_OAEP,
385 CKM_PBA_SHA1_WITH_SHA1_HMAC,
386 "KEY_WRAP_LYNKS",
387 "KEY_WRAP_SET_OAEP");
388 ENUM_NEXT(ck_mech_names, CKM_SKIPJACK_KEY_GEN, CKM_SKIPJACK_RELAYX,
389 CKM_KEY_WRAP_SET_OAEP,
390 "SKIPJACK_KEY_GEN",
391 "SKIPJACK_ECB64",
392 "SKIPJACK_CBC64",
393 "SKIPJACK_OFB64",
394 "SKIPJACK_CFB64",
395 "SKIPJACK_CFB32",
396 "SKIPJACK_CFB16",
397 "SKIPJACK_CFB8",
398 "SKIPJACK_WRAP",
399 "SKIPJACK_PRIVATE_WRAP",
400 "SKIPJACK_RELAYX");
401 ENUM_NEXT(ck_mech_names, CKM_KEA_KEY_PAIR_GEN, CKM_KEA_KEY_DERIVE,
402 CKM_SKIPJACK_RELAYX,
403 "KEA_KEY_PAIR_GEN",
404 "KEA_KEY_DERIVE");
405 ENUM_NEXT(ck_mech_names, CKM_FORTEZZA_TIMESTAMP, CKM_FORTEZZA_TIMESTAMP,
406 CKM_KEA_KEY_DERIVE,
407 "FORTEZZA_TIMESTAMP");
408 ENUM_NEXT(ck_mech_names, CKM_BATON_KEY_GEN, CKM_BATON_WRAP,
409 CKM_FORTEZZA_TIMESTAMP,
410 "BATON_KEY_GEN",
411 "BATON_ECB128",
412 "BATON_ECB96",
413 "BATON_CBC128",
414 "BATON_COUNTER",
415 "BATON_SHUFFLE",
416 "BATON_WRAP");
417 ENUM_NEXT(ck_mech_names, CKM_ECDSA_KEY_PAIR_GEN, CKM_ECDSA_SHA1,
418 CKM_BATON_WRAP,
419 "ECDSA_KEY_PAIR_GEN",
420 "ECDSA",
421 "ECDSA_SHA1");
422 ENUM_NEXT(ck_mech_names, CKM_ECDH1_DERIVE, CKM_ECMQV_DERIVE,
423 CKM_ECDSA_SHA1,
424 "ECDH1_DERIVE",
425 "ECDH1_COFACTOR_DERIVE",
426 "ECMQV_DERIVE");
427 ENUM_NEXT(ck_mech_names, CKM_JUNIPER_KEY_GEN, CKM_JUNIPER_WRAP,
428 CKM_ECMQV_DERIVE,
429 "JUNIPER_KEY_GEN",
430 "JUNIPER_ECB128",
431 "JUNIPER_CBC128",
432 "JUNIPER_COUNTER",
433 "JUNIPER_SHUFFLE",
434 "JUNIPER_WRAP");
435 ENUM_NEXT(ck_mech_names, CKM_FASTHASH, CKM_FASTHASH,
436 CKM_JUNIPER_WRAP,
437 "FASTHASH");
438 ENUM_NEXT(ck_mech_names, CKM_AES_KEY_GEN, CKM_AES_CBC_PAD,
439 CKM_FASTHASH,
440 "AES_KEY_GEN",
441 "AES_ECB",
442 "AES_CBC",
443 "AES_MAC",
444 "AES_MAC_GENERAL",
445 "AES_CBC_PAD");
446 ENUM_NEXT(ck_mech_names, CKM_DSA_PARAMETER_GEN, CKM_X9_42_DH_PARAMETER_GEN,
447 CKM_AES_CBC_PAD,
448 "DSA_PARAMETER_GEN",
449 "DH_PKCS_PARAMETER_GEN",
450 "X9_42_DH_PARAMETER_GEN");
451 ENUM_END(ck_mech_names, CKM_X9_42_DH_PARAMETER_GEN);
452
453
454 ENUM_BEGIN(ck_attr_names, CKA_CLASS, CKA_LABEL,
455 "CLASS",
456 "TOKEN",
457 "PRIVATE",
458 "LABEL");
459 ENUM_NEXT(ck_attr_names, CKA_APPLICATION, CKA_OBJECT_ID, CKA_LABEL,
460 "APPLICATION",
461 "VALUE",
462 "OBJECT_ID");
463 ENUM_NEXT(ck_attr_names, CKA_CERTIFICATE_TYPE, CKA_HASH_OF_ISSUER_PUBLIC_KEY,
464 CKA_OBJECT_ID,
465 "CERTIFICATE_TYPE",
466 "ISSUER",
467 "SERIAL_NUMBER",
468 "AC_ISSUER",
469 "OWNER",
470 "ATTR_TYPES",
471 "TRUSTED",
472 "CERTIFICATE_CATEGORY",
473 "JAVA_MIDP_SECURITY_DOMAIN",
474 "URL",
475 "HASH_OF_SUBJECT_PUBLIC_KEY",
476 "HASH_OF_ISSUER_PUBLIC_KEY");
477 ENUM_NEXT(ck_attr_names, CKA_CHECK_VALUE, CKA_CHECK_VALUE,
478 CKA_HASH_OF_ISSUER_PUBLIC_KEY,
479 "CHECK_VALUE");
480 ENUM_NEXT(ck_attr_names, CKA_KEY_TYPE, CKA_DERIVE, CKA_CHECK_VALUE,
481 "KEY_TYPE",
482 "SUBJECT",
483 "ID",
484 "SENSITIVE",
485 "ENCRYPT",
486 "DECRYPT",
487 "WRAP",
488 "UNWRAP",
489 "SIGN",
490 "SIGN_RECOVER",
491 "VERIFY",
492 "VERIFY_RECOVER",
493 "DERIVE");
494 ENUM_NEXT(ck_attr_names, CKA_START_DATE, CKA_END_DATE, CKA_DERIVE,
495 "START_DATE",
496 "END_DATE");
497 ENUM_NEXT(ck_attr_names, CKA_MODULUS, CKA_COEFFICIENT, CKA_END_DATE,
498 "MODULUS",
499 "MODULUS_BITS",
500 "PUBLIC_EXPONENT",
501 "PRIVATE_EXPONENT",
502 "PRIME_1",
503 "PRIME_2",
504 "EXPONENT_1",
505 "EXPONENT_2",
506 "COEFFICIENT");
507 ENUM_NEXT(ck_attr_names, CKA_PRIME, CKA_SUB_PRIME_BITS, CKA_COEFFICIENT,
508 "PRIME",
509 "SUBPRIME",
510 "BASE",
511 "PRIME_BITS",
512 "SUB_PRIME_BITS");
513 ENUM_NEXT(ck_attr_names, CKA_VALUE_BITS, CKA_KEY_GEN_MECHANISM,
514 CKA_SUB_PRIME_BITS,
515 "VALUE_BITS",
516 "VALUE_LEN",
517 "EXTRACTABLE",
518 "LOCAL",
519 "NEVER_EXTRACTABLE",
520 "ALWAYS_SENSITIVE",
521 "KEY_GEN_MECHANISM");
522 ENUM_NEXT(ck_attr_names, CKA_MODIFIABLE, CKA_MODIFIABLE, CKA_KEY_GEN_MECHANISM,
523 "MODIFIABLE");
524 ENUM_NEXT(ck_attr_names, CKA_EC_PARAMS, CKA_EC_POINT, CKA_MODIFIABLE,
525 "EC_PARAMS",
526 "EC_POINT");
527 ENUM_NEXT(ck_attr_names, CKA_SECONDARY_AUTH, CKA_ALWAYS_AUTHENTICATE,
528 CKA_EC_POINT,
529 "SECONDARY_AUTH",
530 "AUTH_PIN_FLAGS",
531 "ALWAYS_AUTHENTICATE");
532 ENUM_NEXT(ck_attr_names, CKA_WRAP_WITH_TRUSTED, CKA_WRAP_WITH_TRUSTED,
533 CKA_ALWAYS_AUTHENTICATE,
534 "WRAP_WITH_TRUSTED");
535 ENUM_NEXT(ck_attr_names, CKA_HW_FEATURE_TYPE, CKA_HAS_RESET,
536 CKA_WRAP_WITH_TRUSTED,
537 "HW_FEATURE_TYPE",
538 "RESET_ON_INIT",
539 "HAS_RESET");
540 ENUM_NEXT(ck_attr_names, CKA_PIXEL_X, CKA_BITS_PER_PIXEL, CKA_HAS_RESET,
541 "PIXEL_X",
542 "RESOLUTION",
543 "CHAR_ROWS",
544 "CHAR_COLUMNS",
545 "COLOR",
546 "BITS_PER_PIXEL");
547 ENUM_NEXT(ck_attr_names, CKA_CHAR_SETS, CKA_MIME_TYPES, CKA_BITS_PER_PIXEL,
548 "CHAR_SETS",
549 "ENCODING_METHODS",
550 "MIME_TYPES");
551 ENUM_NEXT(ck_attr_names, CKA_MECHANISM_TYPE, CKA_SUPPORTED_CMS_ATTRIBUTES,
552 CKA_MIME_TYPES,
553 "MECHANISM_TYPE",
554 "REQUIRED_CMS_ATTRIBUTES",
555 "DEFAULT_CMS_ATTRIBUTES",
556 "SUPPORTED_CMS_ATTRIBUTES");
557 ENUM_NEXT(ck_attr_names, CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE,
558 CKA_SUPPORTED_CMS_ATTRIBUTES,
559 "WRAP_TEMPLATE",
560 "UNWRAP_TEMPLATE");
561 ENUM_NEXT(ck_attr_names, CKA_ALLOWED_MECHANISMS, CKA_ALLOWED_MECHANISMS,
562 CKA_UNWRAP_TEMPLATE,
563 "ALLOWED_MECHANISMS");
564 ENUM_END(ck_attr_names, CKA_ALLOWED_MECHANISMS);
565 /* the values in an enum_name_t are stored as int, thus CKA_VENDOR_DEFINED
566 * will overflow and is thus not defined here */
567
568
569
570 /**
571 * Private data of an pkcs11_library_t object.
572 */
573 struct private_pkcs11_library_t {
574
575 /**
576 * Public pkcs11_library_t interface.
577 */
578 pkcs11_library_t public;
579
580 /**
581 * dlopen() handle
582 */
583 void *handle;
584
585 /**
586 * Name as passed to the constructor
587 */
588 char *name;
589
590 /**
591 * Supported feature set
592 */
593 pkcs11_feature_t features;
594 };
595
596 METHOD(pkcs11_library_t, get_name, char*,
597 private_pkcs11_library_t *this)
598 {
599 return this->name;
600 }
601
602 METHOD(pkcs11_library_t, get_features, pkcs11_feature_t,
603 private_pkcs11_library_t *this)
604 {
605 return this->features;
606 }
607
608 /**
609 * Object enumerator
610 */
611 typedef struct {
612 /* implements enumerator_t */
613 enumerator_t public;
614 /* session */
615 CK_SESSION_HANDLE session;
616 /* pkcs11 library */
617 pkcs11_library_t *lib;
618 /* attributes to retrieve */
619 CK_ATTRIBUTE_PTR attr;
620 /* number of attributes */
621 CK_ULONG count;
622 /* currently allocated attributes, to free */
623 linked_list_t *freelist;
624 } object_enumerator_t;
625
626 /**
627 * Free contents of attributes in a list
628 */
629 static void free_attrs(object_enumerator_t *this)
630 {
631 CK_ATTRIBUTE_PTR attr;
632
633 while (this->freelist->remove_last(this->freelist, (void**)&attr) == SUCCESS)
634 {
635 free(attr->pValue);
636 attr->pValue = NULL;
637 attr->ulValueLen = 0;
638 }
639 }
640
641 /**
642 * Get attributes for a given object during enumeration
643 */
644 static bool get_attributes(object_enumerator_t *this, CK_OBJECT_HANDLE object)
645 {
646 CK_RV rv;
647 int i;
648
649 free_attrs(this);
650
651 /* get length of objects first */
652 rv = this->lib->f->C_GetAttributeValue(this->session, object,
653 this->attr, this->count);
654 if (rv != CKR_OK)
655 {
656 DBG1(DBG_CFG, "C_GetAttributeValue(NULL) error: %N", ck_rv_names, rv);
657 return FALSE;
658 }
659 /* allocate required chunks */
660 for (i = 0; i < this->count; i++)
661 {
662 if (this->attr[i].pValue == NULL &&
663 this->attr[i].ulValueLen != 0 && this->attr[i].ulValueLen != -1)
664 {
665 this->attr[i].pValue = malloc(this->attr[i].ulValueLen);
666 this->freelist->insert_last(this->freelist, &this->attr[i]);
667 }
668 }
669 /* get the data */
670 rv = this->lib->f->C_GetAttributeValue(this->session, object,
671 this->attr, this->count);
672 if (rv != CKR_OK)
673 {
674 free_attrs(this);
675 DBG1(DBG_CFG, "C_GetAttributeValue() error: %N", ck_rv_names, rv);
676 return FALSE;
677 }
678 return TRUE;
679 }
680
681 METHOD(enumerator_t, object_enumerate, bool,
682 object_enumerator_t *this, CK_OBJECT_HANDLE *out)
683 {
684 CK_OBJECT_HANDLE object;
685 CK_ULONG found;
686 CK_RV rv;
687
688 rv = this->lib->f->C_FindObjects(this->session, &object, 1, &found);
689 if (rv != CKR_OK)
690 {
691 DBG1(DBG_CFG, "C_FindObjects() failed: %N", ck_rv_names, rv);
692 return FALSE;
693 }
694 if (found)
695 {
696 if (this->attr)
697 {
698 if (!get_attributes(this, object))
699 {
700 return FALSE;
701 }
702 }
703 *out = object;
704 return TRUE;
705 }
706 return FALSE;
707 }
708
709 METHOD(enumerator_t, object_destroy, void,
710 object_enumerator_t *this)
711 {
712 this->lib->f->C_FindObjectsFinal(this->session);
713 free_attrs(this);
714 this->freelist->destroy(this->freelist);
715 free(this);
716 }
717
718 METHOD(pkcs11_library_t, create_object_enumerator, enumerator_t*,
719 private_pkcs11_library_t *this, CK_SESSION_HANDLE session,
720 CK_ATTRIBUTE_PTR tmpl, CK_ULONG tcount,
721 CK_ATTRIBUTE_PTR attr, CK_ULONG acount)
722 {
723 object_enumerator_t *enumerator;
724 CK_RV rv;
725
726 rv = this->public.f->C_FindObjectsInit(session, tmpl, tcount);
727 if (rv != CKR_OK)
728 {
729 DBG1(DBG_CFG, "C_FindObjectsInit() failed: %N", ck_rv_names, rv);
730 return enumerator_create_empty();
731 }
732
733 INIT(enumerator,
734 .public = {
735 .enumerate = (void*)_object_enumerate,
736 .destroy = _object_destroy,
737 },
738 .session = session,
739 .lib = &this->public,
740 .attr = attr,
741 .count = acount,
742 .freelist = linked_list_create(),
743 );
744 return &enumerator->public;
745 }
746
747 /**
748 * Enumerator over mechanisms
749 */
750 typedef struct {
751 /* implements enumerator_t */
752 enumerator_t public;
753 /* PKCS#11 library */
754 pkcs11_library_t *lib;
755 /* slot of token */
756 CK_SLOT_ID slot;
757 /* mechanism type list */
758 CK_MECHANISM_TYPE_PTR mechs;
759 /* number of mechanism types */
760 CK_ULONG count;
761 /* current mechanism */
762 CK_ULONG current;
763 } mechanism_enumerator_t;
764
765 METHOD(enumerator_t, enumerate_mech, bool,
766 mechanism_enumerator_t *this, CK_MECHANISM_TYPE* type,
767 CK_MECHANISM_INFO *info)
768 {
769 CK_RV rv;
770
771 if (this->current >= this->count)
772 {
773 return FALSE;
774 }
775 if (info)
776 {
777 rv = this->lib->f->C_GetMechanismInfo(this->slot,
778 this->mechs[this->current], info);
779 if (rv != CKR_OK)
780 {
781 DBG1(DBG_CFG, "C_GetMechanismInfo() failed: %N", ck_rv_names, rv);
782 return FALSE;
783 }
784 }
785 *type = this->mechs[this->current++];
786 return TRUE;
787 }
788
789 METHOD(enumerator_t, destroy_mech, void,
790 mechanism_enumerator_t *this)
791 {
792 free(this->mechs);
793 free(this);
794 }
795
796 METHOD(pkcs11_library_t, create_mechanism_enumerator, enumerator_t*,
797 private_pkcs11_library_t *this, CK_SLOT_ID slot)
798 {
799 mechanism_enumerator_t *enumerator;
800 CK_RV rv;
801
802 INIT(enumerator,
803 .public = {
804 .enumerate = (void*)_enumerate_mech,
805 .destroy = _destroy_mech,
806 },
807 .lib = &this->public,
808 .slot = slot,
809 );
810
811 rv = enumerator->lib->f->C_GetMechanismList(slot, NULL, &enumerator->count);
812 if (rv != CKR_OK)
813 {
814 DBG1(DBG_CFG, "C_GetMechanismList() failed: %N", ck_rv_names, rv);
815 free(enumerator);
816 return enumerator_create_empty();
817 }
818 enumerator->mechs = malloc(sizeof(CK_MECHANISM_TYPE) * enumerator->count);
819 enumerator->lib->f->C_GetMechanismList(slot, enumerator->mechs,
820 &enumerator->count);
821 if (rv != CKR_OK)
822 {
823 DBG1(DBG_CFG, "C_GetMechanismList() failed: %N", ck_rv_names, rv);
824 destroy_mech(enumerator);
825 return enumerator_create_empty();
826 }
827 return &enumerator->public;
828 }
829
830 METHOD(pkcs11_library_t, get_ck_attribute, bool,
831 private_pkcs11_library_t *this, CK_SESSION_HANDLE session,
832 CK_OBJECT_HANDLE obj, CK_ATTRIBUTE_TYPE type, chunk_t *data)
833 {
834 CK_ATTRIBUTE attr = { type, NULL, 0 };
835 CK_RV rv;
836 rv = this->public.f->C_GetAttributeValue(session, obj, &attr, 1);
837 if (rv != CKR_OK)
838 {
839 DBG1(DBG_CFG, "C_GetAttributeValue(%N) error: %N", ck_attr_names, type,
840 ck_rv_names, rv);
841 return FALSE;
842 }
843 *data = chunk_alloc(attr.ulValueLen);
844 attr.pValue = data->ptr;
845 rv = this->public.f->C_GetAttributeValue(session, obj, &attr, 1);
846 if (rv != CKR_OK)
847 {
848 DBG1(DBG_CFG, "C_GetAttributeValue(%N) error: %N", ck_attr_names, type,
849 ck_rv_names, rv);
850 chunk_free(data);
851 return FALSE;
852 }
853 return TRUE;
854 }
855
856 METHOD(pkcs11_library_t, destroy, void,
857 private_pkcs11_library_t *this)
858 {
859 this->public.f->C_Finalize(NULL);
860 dlclose(this->handle);
861 free(this);
862 }
863
864 /**
865 * See header
866 */
867 void pkcs11_library_trim(char *str, int len)
868 {
869 int i;
870
871 str[len - 1] = '\0';
872 for (i = len - 2; i > 0; i--)
873 {
874 if (str[i] == ' ')
875 {
876 str[i] = '\0';
877 continue;
878 }
879 break;
880 }
881 }
882
883 /**
884 * Mutex creation callback
885 */
886 static CK_RV CreateMutex(CK_VOID_PTR_PTR data)
887 {
888 *data = mutex_create(MUTEX_TYPE_RECURSIVE);
889 return CKR_OK;
890 }
891
892 /**
893 * Mutex destruction callback
894 */
895 static CK_RV DestroyMutex(CK_VOID_PTR data)
896 {
897 mutex_t *mutex = (mutex_t*)data;
898
899 mutex->destroy(mutex);
900 return CKR_OK;
901 }
902
903 /**
904 * Mutex lock callback
905 */
906 static CK_RV LockMutex(CK_VOID_PTR data)
907 {
908 mutex_t *mutex = (mutex_t*)data;
909
910 mutex->lock(mutex);
911 return CKR_OK;
912 }
913
914 /**
915 * Mutex unlock callback
916 */
917 static CK_RV UnlockMutex(CK_VOID_PTR data)
918 {
919 mutex_t *mutex = (mutex_t*)data;
920
921 mutex->unlock(mutex);
922 return CKR_OK;
923 }
924
925 /**
926 * Check if the library has at least a given cryptoki version
927 */
928 static bool has_version(CK_INFO *info, int major, int minor)
929 {
930 return info->cryptokiVersion.major > major ||
931 (info->cryptokiVersion.major == major &&
932 info->cryptokiVersion.minor >= minor);
933 }
934
935 /**
936 * Check for optional PKCS#11 library functionality
937 */
938 static void check_features(private_pkcs11_library_t *this, CK_INFO *info)
939 {
940 if (has_version(info, 2, 20))
941 {
942 this->features |= PKCS11_TRUSTED_CERTS;
943 this->features |= PKCS11_ALWAYS_AUTH_KEYS;
944 }
945 }
946
947 /**
948 * Initialize a PKCS#11 library
949 */
950 static bool initialize(private_pkcs11_library_t *this, char *name, char *file,
951 bool os_locking)
952 {
953 CK_C_GetFunctionList pC_GetFunctionList;
954 CK_INFO info;
955 CK_RV rv;
956 static CK_C_INITIALIZE_ARGS args = {
957 .CreateMutex = CreateMutex,
958 .DestroyMutex = DestroyMutex,
959 .LockMutex = LockMutex,
960 .UnlockMutex = UnlockMutex,
961 };
962 static CK_C_INITIALIZE_ARGS args_os = {
963 .flags = CKF_OS_LOCKING_OK,
964 };
965
966 pC_GetFunctionList = dlsym(this->handle, "C_GetFunctionList");
967 if (!pC_GetFunctionList)
968 {
969 DBG1(DBG_CFG, "C_GetFunctionList not found for '%s': %s", name, dlerror());
970 return FALSE;
971 }
972 rv = pC_GetFunctionList(&this->public.f);
973 if (rv != CKR_OK)
974 {
975 DBG1(DBG_CFG, "C_GetFunctionList() error for '%s': %N",
976 name, ck_rv_names, rv);
977 return FALSE;
978 }
979 if (os_locking)
980 {
981 rv = CKR_CANT_LOCK;
982 }
983 else
984 {
985 rv = this->public.f->C_Initialize(&args);
986 }
987 if (rv == CKR_CANT_LOCK)
988 { /* fallback to OS locking */
989 os_locking = TRUE;
990 rv = this->public.f->C_Initialize(&args_os);
991 }
992 if (rv != CKR_OK)
993 {
994 DBG1(DBG_CFG, "C_Initialize() error for '%s': %N",
995 name, ck_rv_names, rv);
996 return FALSE;
997 }
998 rv = this->public.f->C_GetInfo(&info);
999 if (rv != CKR_OK)
1000 {
1001 DBG1(DBG_CFG, "C_GetInfo() error for '%s': %N",
1002 name, ck_rv_names, rv);
1003 this->public.f->C_Finalize(NULL);
1004 return FALSE;
1005 }
1006
1007 pkcs11_library_trim(info.manufacturerID,
1008 strnlen(info.manufacturerID, sizeof(info.manufacturerID)));
1009 pkcs11_library_trim(info.libraryDescription,
1010 strnlen(info.libraryDescription, sizeof(info.libraryDescription)));
1011
1012 DBG1(DBG_CFG, "loaded PKCS#11 v%d.%d library '%s' (%s)",
1013 info.cryptokiVersion.major, info.cryptokiVersion.minor, name, file);
1014 DBG1(DBG_CFG, " %s: %s v%d.%d",
1015 info.manufacturerID, info.libraryDescription,
1016 info.libraryVersion.major, info.libraryVersion.minor);
1017 if (os_locking)
1018 {
1019 DBG1(DBG_CFG, " uses OS locking functions");
1020 }
1021
1022 check_features(this, &info);
1023 return TRUE;
1024 }
1025
1026 /**
1027 * See header
1028 */
1029 pkcs11_library_t *pkcs11_library_create(char *name, char *file, bool os_locking)
1030 {
1031 private_pkcs11_library_t *this;
1032
1033 INIT(this,
1034 .public = {
1035 .get_name = _get_name,
1036 .get_features = _get_features,
1037 .create_object_enumerator = _create_object_enumerator,
1038 .create_mechanism_enumerator = _create_mechanism_enumerator,
1039 .get_ck_attribute = _get_ck_attribute,
1040 .destroy = _destroy,
1041 },
1042 .name = name,
1043 .handle = dlopen(file, RTLD_LAZY),
1044 );
1045
1046 if (!this->handle)
1047 {
1048 DBG1(DBG_CFG, "opening PKCS#11 library failed: %s", dlerror());
1049 free(this);
1050 return NULL;
1051 }
1052
1053 if (!initialize(this, name, file, os_locking))
1054 {
1055 dlclose(this->handle);
1056 free(this);
1057 return NULL;
1058 }
1059
1060 return &this->public;
1061 }