1*00b67f09SDavid van Moolenbroek /* $NetBSD: pkcs11-destroy.c,v 1.7 2014/12/10 04:37:52 christos Exp $ */
2*00b67f09SDavid van Moolenbroek
3*00b67f09SDavid van Moolenbroek /*
4*00b67f09SDavid van Moolenbroek * Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC")
5*00b67f09SDavid van Moolenbroek *
6*00b67f09SDavid van Moolenbroek * Permission to use, copy, modify, and/or distribute this software for any
7*00b67f09SDavid van Moolenbroek * purpose with or without fee is hereby granted, provided that the above
8*00b67f09SDavid van Moolenbroek * copyright notice and this permission notice appear in all copies.
9*00b67f09SDavid van Moolenbroek *
10*00b67f09SDavid van Moolenbroek * THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
11*00b67f09SDavid van Moolenbroek * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
12*00b67f09SDavid van Moolenbroek * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE
13*00b67f09SDavid van Moolenbroek * FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14*00b67f09SDavid van Moolenbroek * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15*00b67f09SDavid van Moolenbroek * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
16*00b67f09SDavid van Moolenbroek * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17*00b67f09SDavid van Moolenbroek */
18*00b67f09SDavid van Moolenbroek
19*00b67f09SDavid van Moolenbroek /*
20*00b67f09SDavid van Moolenbroek * Portions copyright (c) 2008 Nominet UK. All rights reserved.
21*00b67f09SDavid van Moolenbroek *
22*00b67f09SDavid van Moolenbroek * Redistribution and use in source and binary forms, with or without
23*00b67f09SDavid van Moolenbroek * modification, are permitted provided that the following conditions
24*00b67f09SDavid van Moolenbroek * are met:
25*00b67f09SDavid van Moolenbroek * 1. Redistributions of source code must retain the above copyright
26*00b67f09SDavid van Moolenbroek * notice, this list of conditions and the following disclaimer.
27*00b67f09SDavid van Moolenbroek * 2. Redistributions in binary form must reproduce the above copyright
28*00b67f09SDavid van Moolenbroek * notice, this list of conditions and the following disclaimer in the
29*00b67f09SDavid van Moolenbroek * documentation and/or other materials provided with the distribution.
30*00b67f09SDavid van Moolenbroek *
31*00b67f09SDavid van Moolenbroek * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
32*00b67f09SDavid van Moolenbroek * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
33*00b67f09SDavid van Moolenbroek * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
34*00b67f09SDavid van Moolenbroek * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
35*00b67f09SDavid van Moolenbroek * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
36*00b67f09SDavid van Moolenbroek * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
37*00b67f09SDavid van Moolenbroek * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
38*00b67f09SDavid van Moolenbroek * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
39*00b67f09SDavid van Moolenbroek * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
40*00b67f09SDavid van Moolenbroek * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
41*00b67f09SDavid van Moolenbroek */
42*00b67f09SDavid van Moolenbroek
43*00b67f09SDavid van Moolenbroek /* Id: pkcs11-destroy.c,v 1.8 2010/01/13 21:19:52 fdupont Exp */
44*00b67f09SDavid van Moolenbroek
45*00b67f09SDavid van Moolenbroek /*
46*00b67f09SDavid van Moolenbroek * pkcs11-destroy [-m module] [-s $slot] [-i $id | -l $label]
47*00b67f09SDavid van Moolenbroek * [-p $pin] [ -w $wait ]
48*00b67f09SDavid van Moolenbroek */
49*00b67f09SDavid van Moolenbroek
50*00b67f09SDavid van Moolenbroek /*! \file */
51*00b67f09SDavid van Moolenbroek
52*00b67f09SDavid van Moolenbroek #include <config.h>
53*00b67f09SDavid van Moolenbroek
54*00b67f09SDavid van Moolenbroek #include <stdio.h>
55*00b67f09SDavid van Moolenbroek #include <stdlib.h>
56*00b67f09SDavid van Moolenbroek #include <fcntl.h>
57*00b67f09SDavid van Moolenbroek #include <errno.h>
58*00b67f09SDavid van Moolenbroek #include <string.h>
59*00b67f09SDavid van Moolenbroek #include <sys/types.h>
60*00b67f09SDavid van Moolenbroek
61*00b67f09SDavid van Moolenbroek #include <isc/commandline.h>
62*00b67f09SDavid van Moolenbroek #include <isc/result.h>
63*00b67f09SDavid van Moolenbroek #include <isc/types.h>
64*00b67f09SDavid van Moolenbroek
65*00b67f09SDavid van Moolenbroek #include <pk11/pk11.h>
66*00b67f09SDavid van Moolenbroek #include <pk11/result.h>
67*00b67f09SDavid van Moolenbroek
68*00b67f09SDavid van Moolenbroek #ifdef WIN32
69*00b67f09SDavid van Moolenbroek #define sleep(x) Sleep(x)
70*00b67f09SDavid van Moolenbroek #endif
71*00b67f09SDavid van Moolenbroek
72*00b67f09SDavid van Moolenbroek #if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
73*00b67f09SDavid van Moolenbroek #define getpassphrase(x) getpass(x)
74*00b67f09SDavid van Moolenbroek #endif
75*00b67f09SDavid van Moolenbroek
76*00b67f09SDavid van Moolenbroek int
main(int argc,char * argv[])77*00b67f09SDavid van Moolenbroek main(int argc, char *argv[]) {
78*00b67f09SDavid van Moolenbroek isc_result_t result;
79*00b67f09SDavid van Moolenbroek CK_RV rv;
80*00b67f09SDavid van Moolenbroek CK_SLOT_ID slot = 0;
81*00b67f09SDavid van Moolenbroek CK_SESSION_HANDLE hSession;
82*00b67f09SDavid van Moolenbroek CK_BYTE attr_id[2];
83*00b67f09SDavid van Moolenbroek CK_OBJECT_HANDLE akey[50];
84*00b67f09SDavid van Moolenbroek pk11_context_t pctx;
85*00b67f09SDavid van Moolenbroek char *lib_name = NULL;
86*00b67f09SDavid van Moolenbroek char *label = NULL;
87*00b67f09SDavid van Moolenbroek char *pin = NULL;
88*00b67f09SDavid van Moolenbroek int error = 0;
89*00b67f09SDavid van Moolenbroek unsigned int id = 0, i = 0, wait = 5;
90*00b67f09SDavid van Moolenbroek int c, errflg = 0;
91*00b67f09SDavid van Moolenbroek CK_ULONG ulObjectCount;
92*00b67f09SDavid van Moolenbroek CK_ATTRIBUTE search_template[] = {
93*00b67f09SDavid van Moolenbroek {CKA_ID, &attr_id, sizeof(attr_id)}
94*00b67f09SDavid van Moolenbroek };
95*00b67f09SDavid van Moolenbroek unsigned int j, len;
96*00b67f09SDavid van Moolenbroek
97*00b67f09SDavid van Moolenbroek while ((c = isc_commandline_parse(argc, argv, ":m:s:i:l:p:w:")) != -1) {
98*00b67f09SDavid van Moolenbroek switch (c) {
99*00b67f09SDavid van Moolenbroek case 'm':
100*00b67f09SDavid van Moolenbroek lib_name = isc_commandline_argument;
101*00b67f09SDavid van Moolenbroek break;
102*00b67f09SDavid van Moolenbroek case 's':
103*00b67f09SDavid van Moolenbroek slot = atoi(isc_commandline_argument);
104*00b67f09SDavid van Moolenbroek break;
105*00b67f09SDavid van Moolenbroek case 'i':
106*00b67f09SDavid van Moolenbroek id = atoi(isc_commandline_argument);
107*00b67f09SDavid van Moolenbroek id &= 0xffff;
108*00b67f09SDavid van Moolenbroek break;
109*00b67f09SDavid van Moolenbroek case 'l':
110*00b67f09SDavid van Moolenbroek label = isc_commandline_argument;
111*00b67f09SDavid van Moolenbroek break;
112*00b67f09SDavid van Moolenbroek case 'p':
113*00b67f09SDavid van Moolenbroek pin = isc_commandline_argument;
114*00b67f09SDavid van Moolenbroek break;
115*00b67f09SDavid van Moolenbroek case 'w':
116*00b67f09SDavid van Moolenbroek wait = atoi(isc_commandline_argument);
117*00b67f09SDavid van Moolenbroek break;
118*00b67f09SDavid van Moolenbroek case ':':
119*00b67f09SDavid van Moolenbroek fprintf(stderr,
120*00b67f09SDavid van Moolenbroek "Option -%c requires an operand\n",
121*00b67f09SDavid van Moolenbroek isc_commandline_option);
122*00b67f09SDavid van Moolenbroek errflg++;
123*00b67f09SDavid van Moolenbroek break;
124*00b67f09SDavid van Moolenbroek case '?':
125*00b67f09SDavid van Moolenbroek default:
126*00b67f09SDavid van Moolenbroek fprintf(stderr, "Unrecognised option: -%c\n",
127*00b67f09SDavid van Moolenbroek isc_commandline_option);
128*00b67f09SDavid van Moolenbroek errflg++;
129*00b67f09SDavid van Moolenbroek }
130*00b67f09SDavid van Moolenbroek }
131*00b67f09SDavid van Moolenbroek
132*00b67f09SDavid van Moolenbroek if (errflg || (id && (label != NULL))) {
133*00b67f09SDavid van Moolenbroek fprintf(stderr, "Usage:\n");
134*00b67f09SDavid van Moolenbroek fprintf(stderr, "\tpkcs11-destroy [-m module] [-s slot] "
135*00b67f09SDavid van Moolenbroek "[-i id | -l label] [-p pin] [-w waittime]\n");
136*00b67f09SDavid van Moolenbroek exit(1);
137*00b67f09SDavid van Moolenbroek }
138*00b67f09SDavid van Moolenbroek
139*00b67f09SDavid van Moolenbroek if (id) {
140*00b67f09SDavid van Moolenbroek attr_id[0] = (id >> 8) & 0xff;
141*00b67f09SDavid van Moolenbroek attr_id[1] = id & 0xff;
142*00b67f09SDavid van Moolenbroek } else if (label) {
143*00b67f09SDavid van Moolenbroek search_template[0].type = CKA_LABEL;
144*00b67f09SDavid van Moolenbroek search_template[0].pValue = label;
145*00b67f09SDavid van Moolenbroek search_template[0].ulValueLen = strlen(label);
146*00b67f09SDavid van Moolenbroek }
147*00b67f09SDavid van Moolenbroek
148*00b67f09SDavid van Moolenbroek pk11_result_register();
149*00b67f09SDavid van Moolenbroek
150*00b67f09SDavid van Moolenbroek /* Initialize the CRYPTOKI library */
151*00b67f09SDavid van Moolenbroek if (lib_name != NULL)
152*00b67f09SDavid van Moolenbroek pk11_set_lib_name(lib_name);
153*00b67f09SDavid van Moolenbroek
154*00b67f09SDavid van Moolenbroek if (pin == NULL)
155*00b67f09SDavid van Moolenbroek pin = getpassphrase("Enter Pin: ");
156*00b67f09SDavid van Moolenbroek
157*00b67f09SDavid van Moolenbroek result = pk11_get_session(&pctx, OP_ANY, ISC_FALSE, ISC_TRUE,
158*00b67f09SDavid van Moolenbroek ISC_TRUE, (const char *) pin, slot);
159*00b67f09SDavid van Moolenbroek if (result == PK11_R_NORANDOMSERVICE ||
160*00b67f09SDavid van Moolenbroek result == PK11_R_NODIGESTSERVICE ||
161*00b67f09SDavid van Moolenbroek result == PK11_R_NOAESSERVICE) {
162*00b67f09SDavid van Moolenbroek fprintf(stderr, "Warning: %s\n", isc_result_totext(result));
163*00b67f09SDavid van Moolenbroek fprintf(stderr, "This HSM will not work with BIND 9 "
164*00b67f09SDavid van Moolenbroek "using native PKCS#11.\n");
165*00b67f09SDavid van Moolenbroek } else if (result != ISC_R_SUCCESS) {
166*00b67f09SDavid van Moolenbroek fprintf(stderr, "Unrecoverable error initializing "
167*00b67f09SDavid van Moolenbroek "PKCS#11: %s\n", isc_result_totext(result));
168*00b67f09SDavid van Moolenbroek exit(1);
169*00b67f09SDavid van Moolenbroek }
170*00b67f09SDavid van Moolenbroek
171*00b67f09SDavid van Moolenbroek memset(pin, 0, strlen(pin));
172*00b67f09SDavid van Moolenbroek
173*00b67f09SDavid van Moolenbroek hSession = pctx.session;
174*00b67f09SDavid van Moolenbroek
175*00b67f09SDavid van Moolenbroek rv = pkcs_C_FindObjectsInit(hSession, search_template,
176*00b67f09SDavid van Moolenbroek ((id != 0) || (label != NULL)) ? 1 : 0);
177*00b67f09SDavid van Moolenbroek
178*00b67f09SDavid van Moolenbroek if (rv != CKR_OK) {
179*00b67f09SDavid van Moolenbroek fprintf(stderr, "C_FindObjectsInit: Error = 0x%.8lX\n", rv);
180*00b67f09SDavid van Moolenbroek error = 1;
181*00b67f09SDavid van Moolenbroek goto exit_session;
182*00b67f09SDavid van Moolenbroek }
183*00b67f09SDavid van Moolenbroek
184*00b67f09SDavid van Moolenbroek rv = pkcs_C_FindObjects(hSession, akey, 50, &ulObjectCount);
185*00b67f09SDavid van Moolenbroek if (rv != CKR_OK) {
186*00b67f09SDavid van Moolenbroek fprintf(stderr, "C_FindObjects: Error = 0x%.8lX\n", rv);
187*00b67f09SDavid van Moolenbroek error = 1;
188*00b67f09SDavid van Moolenbroek goto exit_search;
189*00b67f09SDavid van Moolenbroek }
190*00b67f09SDavid van Moolenbroek
191*00b67f09SDavid van Moolenbroek if (ulObjectCount == 0) {
192*00b67f09SDavid van Moolenbroek printf("No matching key objects found.\n");
193*00b67f09SDavid van Moolenbroek goto exit_search;
194*00b67f09SDavid van Moolenbroek } else
195*00b67f09SDavid van Moolenbroek printf("Key object%s found:\n", ulObjectCount > 1 ? "s" : "");
196*00b67f09SDavid van Moolenbroek
197*00b67f09SDavid van Moolenbroek for (i = 0; i < ulObjectCount; i++) {
198*00b67f09SDavid van Moolenbroek CK_OBJECT_CLASS oclass = 0;
199*00b67f09SDavid van Moolenbroek CK_BYTE labelbuf[64 + 1];
200*00b67f09SDavid van Moolenbroek CK_BYTE idbuf[64];
201*00b67f09SDavid van Moolenbroek CK_ATTRIBUTE attr_template[] = {
202*00b67f09SDavid van Moolenbroek {CKA_CLASS, &oclass, sizeof(oclass)},
203*00b67f09SDavid van Moolenbroek {CKA_LABEL, labelbuf, sizeof(labelbuf) - 1},
204*00b67f09SDavid van Moolenbroek {CKA_ID, idbuf, sizeof(idbuf)}
205*00b67f09SDavid van Moolenbroek };
206*00b67f09SDavid van Moolenbroek
207*00b67f09SDavid van Moolenbroek memset(labelbuf, 0, sizeof(labelbuf));
208*00b67f09SDavid van Moolenbroek memset(idbuf, 0, sizeof(idbuf));
209*00b67f09SDavid van Moolenbroek
210*00b67f09SDavid van Moolenbroek rv = pkcs_C_GetAttributeValue(hSession, akey[i],
211*00b67f09SDavid van Moolenbroek attr_template, 3);
212*00b67f09SDavid van Moolenbroek if (rv != CKR_OK) {
213*00b67f09SDavid van Moolenbroek fprintf(stderr,
214*00b67f09SDavid van Moolenbroek "C_GetAttributeValue[%u]: rv = 0x%.8lX\n",
215*00b67f09SDavid van Moolenbroek i, rv);
216*00b67f09SDavid van Moolenbroek error = 1;
217*00b67f09SDavid van Moolenbroek goto exit_search;
218*00b67f09SDavid van Moolenbroek }
219*00b67f09SDavid van Moolenbroek len = attr_template[2].ulValueLen;
220*00b67f09SDavid van Moolenbroek printf(" object[%u]: class %lu, label '%s', id[%lu] ",
221*00b67f09SDavid van Moolenbroek i, oclass, labelbuf, attr_template[2].ulValueLen);
222*00b67f09SDavid van Moolenbroek if (len > 4)
223*00b67f09SDavid van Moolenbroek len = 4;
224*00b67f09SDavid van Moolenbroek if (len > 0)
225*00b67f09SDavid van Moolenbroek printf("0x");
226*00b67f09SDavid van Moolenbroek for (j = 0; j < len; j++)
227*00b67f09SDavid van Moolenbroek printf("%02x", idbuf[j]);
228*00b67f09SDavid van Moolenbroek if (attr_template[2].ulValueLen > len)
229*00b67f09SDavid van Moolenbroek printf("...\n");
230*00b67f09SDavid van Moolenbroek else
231*00b67f09SDavid van Moolenbroek printf("\n");
232*00b67f09SDavid van Moolenbroek }
233*00b67f09SDavid van Moolenbroek
234*00b67f09SDavid van Moolenbroek if (wait != 0) {
235*00b67f09SDavid van Moolenbroek printf("WARNING: This action is irreversible! "
236*00b67f09SDavid van Moolenbroek "Destroying key objects in %d seconds\n ", wait);
237*00b67f09SDavid van Moolenbroek for (i = 0; i < wait; i++) {
238*00b67f09SDavid van Moolenbroek printf(".");
239*00b67f09SDavid van Moolenbroek fflush(stdout);
240*00b67f09SDavid van Moolenbroek sleep(1);
241*00b67f09SDavid van Moolenbroek }
242*00b67f09SDavid van Moolenbroek printf("\n");
243*00b67f09SDavid van Moolenbroek }
244*00b67f09SDavid van Moolenbroek
245*00b67f09SDavid van Moolenbroek for (i = 0; i < ulObjectCount; i++) {
246*00b67f09SDavid van Moolenbroek rv = pkcs_C_DestroyObject(hSession, akey[i]);
247*00b67f09SDavid van Moolenbroek if (rv != CKR_OK) {
248*00b67f09SDavid van Moolenbroek fprintf(stderr,
249*00b67f09SDavid van Moolenbroek "C_DestroyObject[%u] failed: rv = 0x%.8lX\n",
250*00b67f09SDavid van Moolenbroek i, rv);
251*00b67f09SDavid van Moolenbroek error = 1;
252*00b67f09SDavid van Moolenbroek }
253*00b67f09SDavid van Moolenbroek }
254*00b67f09SDavid van Moolenbroek
255*00b67f09SDavid van Moolenbroek if (error == 0)
256*00b67f09SDavid van Moolenbroek printf("Destruction complete.\n");
257*00b67f09SDavid van Moolenbroek
258*00b67f09SDavid van Moolenbroek exit_search:
259*00b67f09SDavid van Moolenbroek rv = pkcs_C_FindObjectsFinal(hSession);
260*00b67f09SDavid van Moolenbroek if (rv != CKR_OK) {
261*00b67f09SDavid van Moolenbroek fprintf(stderr, "C_FindObjectsFinal: Error = 0x%.8lX\n", rv);
262*00b67f09SDavid van Moolenbroek error = 1;
263*00b67f09SDavid van Moolenbroek }
264*00b67f09SDavid van Moolenbroek
265*00b67f09SDavid van Moolenbroek exit_session:
266*00b67f09SDavid van Moolenbroek pk11_return_session(&pctx);
267*00b67f09SDavid van Moolenbroek (void) pk11_finalize();
268*00b67f09SDavid van Moolenbroek
269*00b67f09SDavid van Moolenbroek exit(error);
270*00b67f09SDavid van Moolenbroek }
271