plugins/qca-pkcs11/qca-pkcs11.cpp

/*
 * Copyright (C) 2004  Justin Karneges  <justin@affinix.com>
 * Copyright (C) 2006-2007  Alon Bar-Lev <alon.barlev@gmail.com>
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
 *
 */

#include <QtCrypto>
#include <qcaprovider.h>
#include <qplatformdefs.h>

#include <QHash>
#include <QMutexLocker>
#include <QtPlugin>

#include <pkcs11-helper-1.0/pkcs11h-certificate.h>
#include <pkcs11-helper-1.0/pkcs11h-token.h>

using namespace QCA;

// qPrintable is ASCII only!!!
#define myPrintable(s) (s).toUtf8().constData()

static inline QString certificateHash(const Certificate &cert)
{
    if (cert.isNull()) {
        return QString();
    } else {
        return Hash(QStringLiteral("sha1")).hashToString(cert.toDER());
    }
}

//----------------------------------------------------------------------------
// pkcs11Provider
//----------------------------------------------------------------------------
class pkcs11Provider : public Provider
{
private:
    static const int _CONFIG_MAX_PROVIDERS;

    bool        _lowLevelInitialized;
    bool        _slotEventsActive;
    bool        _slotEventsLowLevelActive;
    QStringList _providers;

public:
    bool _allowLoadRootCA;

public:
    pkcs11Provider();
    ~pkcs11Provider() override;

public:
    int qcaVersion() const override;

    void init() override;

    void deinit() override;

    QString name() const override;

    QStringList features() const override;

    Context *createContext(const QString &type) override;

    void startSlotEvents();

    void stopSlotEvents();

    QVariantMap defaultConfig() const override;

    void configChanged(const QVariantMap &config) override;

protected:
    static void __logHook(void *const global_data, const unsigned flags, const char *const format, va_list args);

    static void __slotEventHook(void *const global_data);

    static PKCS11H_BOOL __tokenPromptHook(void *const              global_data,
                                          void *const              user_data,
                                          const pkcs11h_token_id_t token,
                                          const unsigned           retry);

    static PKCS11H_BOOL __pinPromptHook(void *const              global_data,
                                        void *const              user_data,
                                        const pkcs11h_token_id_t token,
                                        const unsigned           retry,
                                        char *const              pin,
                                        const size_t             pin_max);

    void _logHook(const unsigned flags, const char *const format, va_list args);

    void _slotEventHook();

    PKCS11H_BOOL
    _tokenPromptHook(void *const user_data, const pkcs11h_token_id_t token);

    PKCS11H_BOOL
    _pinPromptHook(void *const user_data, const pkcs11h_token_id_t token, char *const pin, const size_t pin_max);
};

namespace pkcs11QCAPlugin {

class pkcs11KeyStoreEntryContext;

//----------------------------------------------------------------------------
// pkcs11KeyStoreListContext
//----------------------------------------------------------------------------
class pkcs11KeyStoreListContext : public KeyStoreListContext
{
    Q_OBJECT

private:
    struct pkcs11KeyStoreItem
    {
    protected:
        int                _id;
        pkcs11h_token_id_t _token_id;
        QList<Certificate> _certs;

    public:
        pkcs11KeyStoreItem(const int id, const pkcs11h_token_id_t token_id)
        {
            _id = id;
            ;
            pkcs11h_token_duplicateTokenId(&_token_id, token_id);
        }

        ~pkcs11KeyStoreItem()
        {
            if (_token_id != nullptr) {
                pkcs11h_token_freeTokenId(_token_id);
            }
        }

        pkcs11KeyStoreItem(const pkcs11KeyStoreItem &) = delete;
        pkcs11KeyStoreItem &operator=(const pkcs11KeyStoreItem &) = delete;

        inline int id() const
        {
            return _id;
        }

        inline pkcs11h_token_id_t tokenId() const
        {
            return _token_id;
        }

        void registerCertificates(const QList<Certificate> &certs)
        {
            foreach (Certificate i, certs) {
                if (std::find(_certs.begin(), _certs.end(), i) == _certs.end()) {
                    _certs += i;
                }
            }
        }

        QMap<QString, QString> friendlyNames()
        {
            const QStringList      names = makeFriendlyNames(_certs);
            QMap<QString, QString> friendlyNames;

            for (int i = 0; i < names.size(); i++) {
                friendlyNames.insert(certificateHash(_certs[i]), names[i]);
            }

            return friendlyNames;
        }
    };
    int                                 _last_id;
    typedef QList<pkcs11KeyStoreItem *> _stores_t;
    _stores_t                           _stores;
    QHash<int, pkcs11KeyStoreItem *>    _storesById;
    QMutex                              _mutexStores;
    bool                                _initialized;

public:
    pkcs11KeyStoreListContext(Provider *p);

    ~pkcs11KeyStoreListContext() override;

    Provider::Context *clone() const override;

public:
    void start() override;

    void setUpdatesEnabled(bool enabled) override;

    KeyStoreEntryContext *entry(int id, const QString &entryId) override;

    KeyStoreEntryContext *entryPassive(const QString &serialized) override;

    KeyStore::Type type(int id) const override;

    QString storeId(int id) const override;

    QString name(int id) const override;

    QList<KeyStoreEntry::Type> entryTypes(int id) const override;

    QList<int> keyStores() override;

    QList<KeyStoreEntryContext *> entryList(int id) override;

    bool _tokenPrompt(void *const user_data, const pkcs11h_token_id_t token_id);

    bool _pinPrompt(void *const user_data, const pkcs11h_token_id_t token_id, SecureArray &pin);

    void _emit_diagnosticText(const QString &t);

private Q_SLOTS:
    void doReady();

    void doUpdated();

private:
    pkcs11KeyStoreItem *_registerTokenId(const pkcs11h_token_id_t token_id);

    void _clearStores();

    pkcs11KeyStoreEntryContext *_keyStoreEntryByCertificateId(const pkcs11h_certificate_id_t certificate_id,
                                                              const bool                     has_private,
                                                              const CertificateChain &       chain,
                                                              const QString &                description) const;

    QString _tokenId2storeId(const pkcs11h_token_id_t token_id) const;

    QString _serializeCertificate(const pkcs11h_certificate_id_t certificate_id,
                                  const CertificateChain &       chain,
                                  const bool                     has_private) const;

    void _deserializeCertificate(const QString &                 from,
                                 pkcs11h_certificate_id_t *const p_certificate_id,
                                 bool *const                     p_has_private,
                                 CertificateChain &              chain) const;

    QString _escapeString(const QString &from) const;

    QString _unescapeString(const QString &from) const;
};

static pkcs11KeyStoreListContext *s_keyStoreList = nullptr;

//----------------------------------------------------------------------------
// pkcs11Exception
//----------------------------------------------------------------------------
class pkcs11Exception
{
private:
    CK_RV   _rv;
    QString _msg;

private:
    pkcs11Exception()
    {
    }

public:
    pkcs11Exception(const CK_RV rv, const QString &msg)
    {
        _rv  = rv;
        _msg = msg;
    }

    CK_RV
    rv() const
    {
        return _rv;
    }

    QString message() const
    {
        return _msg + QStringLiteral(" ") + QString::fromLatin1(pkcs11h_getMessage(_rv));
    }
};

//----------------------------------------------------------------------------
// pkcs11RSAContext
//----------------------------------------------------------------------------
class pkcs11RSAContext : public RSAContext
{
    Q_OBJECT

private:
    bool                     _has_privateKeyRole;
    pkcs11h_certificate_id_t _pkcs11h_certificate_id;
    pkcs11h_certificate_t    _pkcs11h_certificate;
    RSAPublicKey             _pubkey;
    QString                  _serialized;

    struct _sign_data_s
    {
        SignatureAlgorithm alg;
        Hash *             hash;
        QByteArray         raw;

        _sign_data_s()
        {
            hash = nullptr;
        }
    } _sign_data;

public:
    pkcs11RSAContext(Provider *                     p,
                     const pkcs11h_certificate_id_t pkcs11h_certificate_id,
                     const QString &                serialized,
                     const RSAPublicKey &           pubkey)
        : RSAContext(p)
    {
        CK_RV rv;

        QCA_logTextMessage(QStringLiteral("pkcs11RSAContext::pkcs11RSAContext1 - entry"), Logger::Debug);

        _has_privateKeyRole     = true;
        _pkcs11h_certificate_id = nullptr;
        _pkcs11h_certificate    = nullptr;
        _pubkey                 = pubkey;
        _serialized             = serialized;
        _clearSign();

        if ((rv = pkcs11h_certificate_duplicateCertificateId(&_pkcs11h_certificate_id, pkcs11h_certificate_id)) !=
            CKR_OK) {
            throw pkcs11Exception(rv, QStringLiteral("Memory error"));
        }

        QCA_logTextMessage(QStringLiteral("pkcs11RSAContext::pkcs11RSAContext1 - return"), Logger::Debug);
    }

    pkcs11RSAContext(const pkcs11RSAContext &from)
        : RSAContext(from.provider())
    {
        CK_RV rv;

        QCA_logTextMessage(QStringLiteral("pkcs11RSAContext::pkcs11RSAContextC - entry"), Logger::Debug);

        _has_privateKeyRole     = from._has_privateKeyRole;
        _pkcs11h_certificate_id = nullptr;
        _pkcs11h_certificate    = nullptr;
        _pubkey                 = from._pubkey;
        _serialized             = from._serialized;
        _sign_data.hash         = nullptr;
        _clearSign();

        if ((rv = pkcs11h_certificate_duplicateCertificateId(&_pkcs11h_certificate_id, from._pkcs11h_certificate_id)) !=
            CKR_OK) {
            throw pkcs11Exception(rv, QStringLiteral("Memory error"));
        }

        QCA_logTextMessage(QStringLiteral("pkcs11RSAContext::pkcs11RSAContextC - return"), Logger::Debug);
    }

    ~pkcs11RSAContext() override
    {
        QCA_logTextMessage(QStringLiteral("pkcs11RSAContext::~pkcs11RSAContext - entry"), Logger::Debug);

        _clearSign();

        if (_pkcs11h_certificate != nullptr) {
            pkcs11h_certificate_freeCertificate(_pkcs11h_certificate);
            _pkcs11h_certificate = nullptr;
        }

        if (_pkcs11h_certificate_id != nullptr) {
            pkcs11h_certificate_freeCertificateId(_pkcs11h_certificate_id);
            _pkcs11h_certificate_id = nullptr;
        }

        QCA_logTextMessage(QStringLiteral("pkcs11RSAContext::~pkcs11RSAContext - return"), Logger::Debug);
    }

    Provider::Context *clone() const override
    {
        return new pkcs11RSAContext(*this);
    }

public:
    bool isNull() const override
    {
        return _pubkey.isNull();
    }

    PKey::Type type() const override
    {
        return _pubkey.type();
    }

    bool isPrivate() const override
    {
        return _has_privateKeyRole;
    }

    bool canExport() const override
    {
        return !_has_privateKeyRole;
    }

    void convertToPublic() override
    {
        QCA_logTextMessage(QStringLiteral("pkcs11RSAContext::convertToPublic - entry"), Logger::Debug);

        if (_has_privateKeyRole) {
            if (_pkcs11h_certificate != nullptr) {
                pkcs11h_certificate_freeCertificate(_pkcs11h_certificate);
                _pkcs11h_certificate = nullptr;
            }
            _has_privateKeyRole = false;
        }

        QCA_logTextMessage(QStringLiteral("pkcs11RSAContext::convertToPublic - return"), Logger::Debug);
    }

    int bits() const override
    {
        return _pubkey.bitSize();
    }

    int maximumEncryptSize(EncryptionAlgorithm alg) const override
    {
        return _pubkey.maximumEncryptSize(alg);
    }

    SecureArray encrypt(const SecureArray &in, EncryptionAlgorithm alg) override
    {
        return _pubkey.encrypt(in, alg);
    }

    bool decrypt(const SecureArray &in, SecureArray *out, EncryptionAlgorithm alg) override
    {
        bool session_locked = false;
        bool ret            = false;

        QCA_logTextMessage(
            QString::asprintf("pkcs11RSAContext::decrypt - decrypt in.size()=%d, alg=%d", in.size(), (int)alg),
            Logger::Debug);

        try {
            CK_MECHANISM_TYPE mech;
            CK_RV             rv;
            size_t            my_size;

            switch (alg) {
            case EME_PKCS1v15:
                mech = CKM_RSA_PKCS;
                break;
            case EME_PKCS1_OAEP:
                mech = CKM_RSA_PKCS_OAEP;
                break;
            default:
                throw pkcs11Exception(CKR_FUNCTION_NOT_SUPPORTED, QStringLiteral("Invalid algorithm"));
                break;
            }

            _ensureCertificate();

            if ((rv = pkcs11h_certificate_lockSession(_pkcs11h_certificate)) != CKR_OK) {
                throw pkcs11Exception(rv, QStringLiteral("Cannot lock session"));
            }
            session_locked = true;

            if ((rv = pkcs11h_certificate_decryptAny(_pkcs11h_certificate,
                                                     mech,
                                                     (const unsigned char *)in.constData(),
                                                     in.size(),
                                                     nullptr,
                                                     &my_size)) != CKR_OK) {
                throw pkcs11Exception(rv, QStringLiteral("Decryption error"));
            }

            out->resize(my_size);

            if ((rv = pkcs11h_certificate_decryptAny(_pkcs11h_certificate,
                                                     mech,
                                                     (const unsigned char *)in.constData(),
                                                     in.size(),
                                                     (unsigned char *)out->data(),
                                                     &my_size)) != CKR_OK) {
                throw pkcs11Exception(rv, QStringLiteral("Decryption error"));
            }

            rv = out->resize(my_size);

            if ((rv = pkcs11h_certificate_releaseSession(_pkcs11h_certificate)) != CKR_OK) {
                throw pkcs11Exception(rv, QStringLiteral("Cannot release session"));
            }
            session_locked = false;

            ret = true;
        } catch (const pkcs11Exception &e) {
            if (session_locked) {
                pkcs11h_certificate_releaseSession(_pkcs11h_certificate);
                session_locked = false;
            }

            if (s_keyStoreList != nullptr) {
                s_keyStoreList->_emit_diagnosticText(
                    QString::asprintf("PKCS#11: Cannot decrypt: %lu-'%s'.\n", e.rv(), myPrintable(e.message())));
            }
        }

        QCA_logTextMessage(QString::asprintf("pkcs11RSAContext::decrypt - decrypt out->size()=%d", out->size()),
                           Logger::Debug);

        return ret;
    }

    void startSign(SignatureAlgorithm alg, SignatureFormat) override
    {
        _clearSign();

        _sign_data.alg = alg;

        switch (_sign_data.alg) {
        case EMSA3_SHA1:
            _sign_data.hash = new Hash(QStringLiteral("sha1"));
            break;
        case EMSA3_MD5:
            _sign_data.hash = new Hash(QStringLiteral("md5"));
            break;
        case EMSA3_MD2:
            _sign_data.hash = new Hash(QStringLiteral("md2"));
            break;
        case EMSA3_Raw:
            break;
        case SignatureUnknown:
        case EMSA1_SHA1:
        case EMSA3_RIPEMD160:
        default:
            QCA_logTextMessage(QString::asprintf("PKCS#11: Invalid hash algorithm %d", _sign_data.alg),
                               Logger::Warning);
            break;
        }
    }

    void startVerify(SignatureAlgorithm alg, SignatureFormat sf) override
    {
        _pubkey.startVerify(alg, sf);
    }

    void update(const MemoryRegion &in) override
    {
        if (_has_privateKeyRole) {
            if (_sign_data.hash != nullptr) {
                _sign_data.hash->update(in);
            } else {
                _sign_data.raw.append(in.toByteArray());
            }
        } else {
            _pubkey.update(in);
        }
    }

    QByteArray endSign() override
    {
        QByteArray result;
        bool       session_locked = false;

        QCA_logTextMessage(QStringLiteral("pkcs11RSAContext::endSign - entry"), Logger::Debug);

        try {
            QByteArray final;
            CK_RV      rv;

            // from some strange reason I got 2047... (for some)	<---- BUG?!?!?!
            int myrsa_size = (_pubkey.bitSize() + 7) / 8;

            if (_sign_data.hash != nullptr) {
                final = emsa3Encode(_sign_data.hash->type(), _sign_data.hash->final().toByteArray(), myrsa_size);
            } else {
                final = _sign_data.raw;
            }

            if (final.size() == 0) {
                throw pkcs11Exception(CKR_FUNCTION_FAILED, QStringLiteral("Cannot encode signature"));
            }

            _ensureCertificate();

            size_t my_size;

            if ((rv = pkcs11h_certificate_lockSession(_pkcs11h_certificate)) != CKR_OK) {
                throw pkcs11Exception(rv, QStringLiteral("Cannot lock session"));
            }
            session_locked = true;

            if ((rv = pkcs11h_certificate_signAny(_pkcs11h_certificate,
                                                  CKM_RSA_PKCS,
                                                  (const unsigned char *) final.constData(),
                                                  (size_t) final.size(),
                                                  nullptr,
                                                  &my_size)) != CKR_OK) {
                throw pkcs11Exception(rv, QStringLiteral("Signature failed"));
            }

            result.resize(my_size);

            if ((rv = pkcs11h_certificate_signAny(_pkcs11h_certificate,
                                                  CKM_RSA_PKCS,
                                                  (const unsigned char *) final.constData(),
                                                  (size_t) final.size(),
                                                  (unsigned char *)result.data(),
                                                  &my_size)) != CKR_OK) {
                throw pkcs11Exception(rv, QStringLiteral("Signature failed"));
            }

            result.resize(my_size);

            if ((rv = pkcs11h_certificate_releaseSession(_pkcs11h_certificate)) != CKR_OK) {
                throw pkcs11Exception(rv, QStringLiteral("Cannot release session"));
            }
            session_locked = false;

        } catch (const pkcs11Exception &e) {
            result.clear();

            if (session_locked) {
                pkcs11h_certificate_releaseSession(_pkcs11h_certificate);
                session_locked = false;
            }

            if (s_keyStoreList != nullptr) {
                s_keyStoreList->_emit_diagnosticText(
                    QString::asprintf("PKCS#11: Cannot sign: %lu-'%s'.\n", e.rv(), myPrintable(e.message())));
            }
        }

        _clearSign();

        QCA_logTextMessage(
            QString::asprintf("pkcs11RSAContext::endSign - return result.size ()=%d", int(result.size())),
            Logger::Debug);

        return result;
    }

    virtual bool validSignature(const QByteArray &sig)
    {
        return _pubkey.validSignature(sig);
    }

    void createPrivate(int bits, int exp, bool block) override
    {
        Q_UNUSED(bits);
        Q_UNUSED(exp);
        Q_UNUSED(block);
    }

    void createPrivate(const BigInteger &n,
                       const BigInteger &e,
                       const BigInteger &p,
                       const BigInteger &q,
                       const BigInteger &d) override
    {
        Q_UNUSED(n);
        Q_UNUSED(e);
        Q_UNUSED(p);
        Q_UNUSED(q);
        Q_UNUSED(d);
    }

    void createPublic(const BigInteger &n, const BigInteger &e) override
    {
        Q_UNUSED(n);
        Q_UNUSED(e);
    }

    BigInteger n() const override
    {
        return _pubkey.n();
    }

    BigInteger e() const override
    {
        return _pubkey.e();
    }

    BigInteger p() const override
    {
        return BigInteger();
    }

    BigInteger q() const override
    {
        return BigInteger();
    }

    BigInteger d() const override
    {
        return BigInteger();
    }

public:
    PublicKey _publicKey() const
    {
        return _pubkey;
    }

    bool _isTokenAvailable() const
    {
        bool ret;

        QCA_logTextMessage(QStringLiteral("pkcs11RSAContext::_ensureTokenAvailable - entry"), Logger::Debug);

        ret = pkcs11h_token_ensureAccess(_pkcs11h_certificate_id->token_id, nullptr, 0) == CKR_OK;

        QCA_logTextMessage(QString::asprintf("pkcs11RSAContext::_ensureTokenAvailable - return ret=%d", ret ? 1 : 0),
                           Logger::Debug);

        return ret;
    }

    bool _ensureTokenAccess()
    {
        bool ret;

        QCA_logTextMessage(QStringLiteral("pkcs11RSAContext::_ensureTokenAccess - entry"), Logger::Debug);

        ret = pkcs11h_token_ensureAccess(_pkcs11h_certificate_id->token_id, nullptr, PKCS11H_PROMPT_MASK_ALLOW_ALL) ==
            CKR_OK;

        QCA_logTextMessage(QString::asprintf("pkcs11RSAContext::_ensureTokenAccess - return ret=%d", ret ? 1 : 0),
                           Logger::Debug);

        return ret;
    }

private:
    void _clearSign()
    {
        _sign_data.raw.clear();
        _sign_data.alg = SignatureUnknown;
        delete _sign_data.hash;
        _sign_data.hash = nullptr;
    }

    void _ensureCertificate()
    {
        CK_RV rv;

        QCA_logTextMessage(QStringLiteral("pkcs11RSAContext::_ensureCertificate - entry"), Logger::Debug);

        if (_pkcs11h_certificate == nullptr) {
            if ((rv = pkcs11h_certificate_create(_pkcs11h_certificate_id,
                                                 &_serialized,
                                                 PKCS11H_PROMPT_MASK_ALLOW_ALL,
                                                 PKCS11H_PIN_CACHE_INFINITE,
                                                 &_pkcs11h_certificate)) != CKR_OK) {
                throw pkcs11Exception(rv, QStringLiteral("Cannot create low-level certificate"));
            }
        }

        QCA_logTextMessage(QStringLiteral("pkcs11RSAContext::_ensureCertificate - return"), Logger::Debug);
    }
};

//----------------------------------------------------------------------------
// pkcs11PKeyContext
//----------------------------------------------------------------------------
class pkcs11PKeyContext : public PKeyContext
{
    Q_OBJECT

private:
    PKeyBase *_k;

public:
    pkcs11PKeyContext(Provider *p)
        : PKeyContext(p)
    {
        _k = nullptr;
    }

    ~pkcs11PKeyContext() override
    {
        delete _k;
        _k = nullptr;
    }

    Provider::Context *clone() const override
    {
        pkcs11PKeyContext *c = new pkcs11PKeyContext(*this);
        c->_k                = (PKeyBase *)_k->clone();
        return c;
    }

public:
    QList<PKey::Type> supportedTypes() const override
    {
        QList<PKey::Type> list;
        list += PKey::RSA;
        return list;
    }

    QList<PKey::Type> supportedIOTypes() const override
    {
        QList<PKey::Type> list;
        list += PKey::RSA;
        return list;
    }

    QList<PBEAlgorithm> supportedPBEAlgorithms() const override
    {
        QList<PBEAlgorithm> list;
        return list;
    }

    PKeyBase *key() override
    {
        return _k;
    }

    const PKeyBase *key() const override
    {
        return _k;
    }

    void setKey(PKeyBase *key) override
    {
        delete _k;
        _k = key;
    }

    bool importKey(const PKeyBase *key) override
    {
        Q_UNUSED(key);
        return false;
    }

    static int passphrase_cb(char *buf, int size, int rwflag, void *u)
    {
        Q_UNUSED(buf);
        Q_UNUSED(size);
        Q_UNUSED(rwflag);
        Q_UNUSED(u);
        return 0;
    }

    QByteArray publicToDER() const override
    {
        return static_cast<pkcs11RSAContext *>(_k)->_publicKey().toDER();
    }

    QString publicToPEM() const override
    {
        return static_cast<pkcs11RSAContext *>(_k)->_publicKey().toPEM();
    }

    ConvertResult publicFromDER(const QByteArray &in) override
    {
        Q_UNUSED(in);
        return ErrorDecode;
    }

    ConvertResult publicFromPEM(const QString &s) override
    {
        Q_UNUSED(s);
        return ErrorDecode;
    }

    SecureArray privateToDER(const SecureArray &passphrase, PBEAlgorithm pbe) const override
    {
        Q_UNUSED(passphrase);
        Q_UNUSED(pbe);
        return SecureArray();
    }

    QString privateToPEM(const SecureArray &passphrase, PBEAlgorithm pbe) const override
    {
        Q_UNUSED(passphrase);
        Q_UNUSED(pbe);
        return QString();
    }

    ConvertResult privateFromDER(const SecureArray &in, const SecureArray &passphrase) override
    {
        Q_UNUSED(in);
        Q_UNUSED(passphrase);
        return ErrorDecode;
    }

    ConvertResult privateFromPEM(const QString &s, const SecureArray &passphrase) override
    {
        Q_UNUSED(s);
        Q_UNUSED(passphrase);
        return ErrorDecode;
    }
};

//----------------------------------------------------------------------------
// pkcs11KeyStoreEntryContext
//----------------------------------------------------------------------------
class pkcs11KeyStoreEntryContext : public KeyStoreEntryContext
{
    Q_OBJECT
private:
    KeyStoreEntry::Type _item_type;
    KeyBundle           _key;
    Certificate         _cert;
    QString             _storeId;
    QString             _id;
    QString             _serialized;
    QString             _storeName;
    QString             _name;

public:
    pkcs11KeyStoreEntryContext(const Certificate &cert,
                               const QString &    storeId,
                               const QString &    serialized,
                               const QString &    storeName,
                               const QString &    name,
                               Provider *         p)
        : KeyStoreEntryContext(p)
    {
        _item_type  = KeyStoreEntry::TypeCertificate;
        _cert       = cert;
        _storeId    = storeId;
        _id         = certificateHash(_cert);
        _serialized = serialized;
        _storeName  = storeName;
        _name       = name;
    }

    pkcs11KeyStoreEntryContext(const KeyBundle &key,
                               const QString &  storeId,
                               const QString &  serialized,
                               const QString &  storeName,
                               const QString &  name,
                               Provider *       p)
        : KeyStoreEntryContext(p)
    {
        _item_type = KeyStoreEntry::TypeKeyBundle;
        _key       = key;
        _storeId = storeId, _id = certificateHash(key.certificateChain().primary());
        _serialized = serialized;
        _storeName  = storeName;
        _name       = name;
    }

    pkcs11KeyStoreEntryContext(const pkcs11KeyStoreEntryContext &from)
        : KeyStoreEntryContext(from)
    {
        _item_type  = from._item_type;
        _key        = from._key;
        _storeId    = from._storeId;
        _id         = from._id;
        _serialized = from._serialized;
        _storeName  = from._storeName;
        _name       = from._name;
    }

    Provider::Context *clone() const override
    {
        return new pkcs11KeyStoreEntryContext(*this);
    }

public:
    KeyStoreEntry::Type type() const override
    {
        return _item_type;
    }

    QString name() const override
    {
        return _name;
    }

    QString id() const override
    {
        return _id;
    }

    KeyBundle keyBundle() const override
    {
        return _key;
    }

    Certificate certificate() const override
    {
        return _cert;
    }

    QString storeId() const override
    {
        return _storeId;
    }

    QString storeName() const override
    {
        return _storeName;
    }

    bool isAvailable() const override
    {
        return static_cast<pkcs11RSAContext *>(static_cast<PKeyContext *>(_key.privateKey().context())->key())
            ->_isTokenAvailable();
    }

    bool ensureAccess() override
    {
        return static_cast<pkcs11RSAContext *>(static_cast<PKeyContext *>(_key.privateKey().context())->key())
            ->_ensureTokenAccess();
    }

    QString serialize() const override
    {
        return _serialized;
    }
};

//----------------------------------------------------------------------------
// pkcs11QCACrypto
//----------------------------------------------------------------------------
class pkcs11QCACrypto
{
private:
    static int _pkcs11h_crypto_qca_initialize(void *const global_data)
    {
        Q_UNUSED(global_data);

        return TRUE; // krazy:exclude=captruefalse
    }

    static int _pkcs11h_crypto_qca_uninitialize(void *const global_data)
    {
        Q_UNUSED(global_data);

        return TRUE; // krazy:exclude=captruefalse
    }

    static int _pkcs11h_crypto_qca_certificate_get_expiration(void *const                global_data,
                                                              const unsigned char *const blob,
                                                              const size_t               blob_size,
                                                              time_t *const              expiration)
    {
        Q_UNUSED(global_data);

        Certificate cert = Certificate::fromDER(QByteArray((char *)blob, blob_size));

        *expiration = cert.notValidAfter().toSecsSinceEpoch();

        return TRUE; // krazy:exclude=captruefalse
    }

    static int _pkcs11h_crypto_qca_certificate_get_dn(void *const                global_data,
                                                      const unsigned char *const blob,
                                                      const size_t               blob_size,
                                                      char *const                dn,
                                                      const size_t               dn_max)
    {
        Q_UNUSED(global_data);

        Certificate cert = Certificate::fromDER(QByteArray((char *)blob, blob_size));
        QString     qdn  = cert.subjectInfoOrdered().toString();

        if ((size_t)qdn.length() > dn_max - 1) {
            return FALSE; // krazy:exclude=captruefalse
        } else {
            qstrcpy(dn, myPrintable(qdn));
            return TRUE; // krazy:exclude=captruefalse
        }
    }

    static int _pkcs11h_crypto_qca_certificate_is_issuer(void *const                global_data,
                                                         const unsigned char *const signer_blob,
                                                         const size_t               signer_blob_size,
                                                         const unsigned char *const cert_blob,
                                                         const size_t               cert_blob_size)
    {
        Q_UNUSED(global_data);

        Certificate signer = Certificate::fromDER(QByteArray((char *)signer_blob, signer_blob_size));

        Certificate cert = Certificate::fromDER(QByteArray((char *)cert_blob, cert_blob_size));

        return signer.isIssuerOf(cert);
    }

public:
    static pkcs11h_engine_crypto_t crypto;
};

pkcs11h_engine_crypto_t pkcs11QCACrypto::crypto = {nullptr,
                                                   _pkcs11h_crypto_qca_initialize,
                                                   _pkcs11h_crypto_qca_uninitialize,
                                                   _pkcs11h_crypto_qca_certificate_get_expiration,
                                                   _pkcs11h_crypto_qca_certificate_get_dn,
                                                   _pkcs11h_crypto_qca_certificate_is_issuer};

//----------------------------------------------------------------------------
// pkcs11KeyStoreListContext
//----------------------------------------------------------------------------
pkcs11KeyStoreListContext::pkcs11KeyStoreListContext(Provider *p)
    : KeyStoreListContext(p)
{
    QCA_logTextMessage(
        QString::asprintf("pkcs11KeyStoreListContext::pkcs11KeyStoreListContext - entry Provider=%p", (void *)p),
        Logger::Debug);

    _last_id     = 0;
    _initialized = false;

    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::pkcs11KeyStoreListContext - return"), Logger::Debug);
}

pkcs11KeyStoreListContext::~pkcs11KeyStoreListContext()
{
    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::~pkcs11KeyStoreListContext - entry"), Logger::Debug);

    s_keyStoreList = nullptr;
    _clearStores();

    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::~pkcs11KeyStoreListContext - return"), Logger::Debug);
}

Provider::Context *pkcs11KeyStoreListContext::clone() const
{
    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::clone - entry/return"), Logger::Debug);
    return nullptr;
}

void pkcs11KeyStoreListContext::start()
{
    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::start - entry"), Logger::Debug);

    QMetaObject::invokeMethod(this, "doReady", Qt::QueuedConnection);

    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::start - return"), Logger::Debug);
}

void pkcs11KeyStoreListContext::setUpdatesEnabled(bool enabled)
{
    QCA_logTextMessage(
        QString::asprintf("pkcs11KeyStoreListContext::setUpdatesEnabled - entry enabled=%d", enabled ? 1 : 0),
        Logger::Debug);

    try {
        pkcs11Provider *p = static_cast<pkcs11Provider *>(provider());
        if (enabled) {
            p->startSlotEvents();
        } else {
            p->stopSlotEvents();
        }
    } catch (const pkcs11Exception &e) {
        s_keyStoreList->_emit_diagnosticText(
            QString::asprintf("PKCS#11: Start event failed %lu-'%s'.\n", e.rv(), myPrintable(e.message())));
    }

    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::setUpdatesEnabled - return"), Logger::Debug);
}

KeyStoreEntryContext *pkcs11KeyStoreListContext::entry(int id, const QString &entryId)
{
    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::entry - entry/return id=%d entryId='%s'",
                                         id,
                                         myPrintable(entryId)),
                       Logger::Debug);

    Q_UNUSED(id);
    Q_UNUSED(entryId);
    return nullptr;
}

KeyStoreEntryContext *pkcs11KeyStoreListContext::entryPassive(const QString &serialized)
{
    KeyStoreEntryContext *   entry          = nullptr;
    pkcs11h_certificate_id_t certificate_id = nullptr;

    QCA_logTextMessage(
        QString::asprintf("pkcs11KeyStoreListContext::entryPassive - entry serialized='%s'", myPrintable(serialized)),
        Logger::Debug);

    try {
        if (serialized.startsWith(QLatin1String("qca-pkcs11/"))) {
            CertificateChain chain;
            bool             has_private;

            _deserializeCertificate(serialized, &certificate_id, &has_private, chain);
            pkcs11KeyStoreItem *sentry = _registerTokenId(certificate_id->token_id);
            sentry->registerCertificates(chain);
            QMap<QString, QString> friendlyNames = sentry->friendlyNames();

            entry = _keyStoreEntryByCertificateId(
                certificate_id, has_private, chain, friendlyNames[certificateHash(chain.primary())]);
        }
    } catch (const pkcs11Exception &e) {
        s_keyStoreList->_emit_diagnosticText(
            QString::asprintf("PKCS#11: Add key store entry %lu-'%s'.\n", e.rv(), myPrintable(e.message())));
    }

    if (certificate_id != nullptr) {
        pkcs11h_certificate_freeCertificateId(certificate_id);
        certificate_id = nullptr;
    }

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::entryPassive - return entry=%p", (void *)entry),
                       Logger::Debug);

    return entry;
}

KeyStore::Type pkcs11KeyStoreListContext::type(int id) const
{
    Q_UNUSED(id);

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::type - entry/return id=%d", id), Logger::Debug);

    return KeyStore::SmartCard;
}

QString pkcs11KeyStoreListContext::storeId(int id) const
{
    QString ret;

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::storeId - entry id=%d", id), Logger::Debug);

    if (_storesById.contains(id)) {
        ret = _tokenId2storeId(_storesById[id]->tokenId());
    }

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::storeId - return ret=%s", myPrintable(ret)),
                       Logger::Debug);

    return ret;
}

QString pkcs11KeyStoreListContext::name(int id) const
{
    QString ret;

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::name - entry id=%d", id), Logger::Debug);

    if (_storesById.contains(id)) {
        ret = QString::fromLatin1(_storesById[id]->tokenId()->label);
    }

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::name - return ret=%s", myPrintable(ret)),
                       Logger::Debug);

    return ret;
}

QList<KeyStoreEntry::Type> pkcs11KeyStoreListContext::entryTypes(int id) const
{
    Q_UNUSED(id);

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::entryTypes - entry/return id=%d", id),
                       Logger::Debug);

    QList<KeyStoreEntry::Type> list;
    list += KeyStoreEntry::TypeKeyBundle;
    list += KeyStoreEntry::TypeCertificate;
    return list;
}

QList<int> pkcs11KeyStoreListContext::keyStores()
{
    pkcs11h_token_id_list_t tokens = nullptr;
    QList<int>              out;

    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::keyStores - entry"), Logger::Debug);

    try {
        CK_RV rv;

        /*
         * Get available tokens
         */
        if ((rv = pkcs11h_token_enumTokenIds(PKCS11H_ENUM_METHOD_CACHE_EXIST, &tokens)) != CKR_OK) {
            throw pkcs11Exception(rv, QStringLiteral("Enumerating tokens"));
        }

        /*
         * Register all tokens, unmark
         * them from remove list
         */
        QList<int> to_remove = _storesById.keys();
        for (pkcs11h_token_id_list_t entry = tokens; entry != nullptr; entry = entry->next) {
            pkcs11KeyStoreItem *item = _registerTokenId(entry->token_id);
            out += item->id();
            to_remove.removeAll(item->id());
        }

        /*
         * Remove all items
         * that were not discovered
         */
        {
            QMutexLocker l(&_mutexStores);

            foreach (int i, to_remove) {
                pkcs11KeyStoreItem *item = _storesById[i];

                _storesById.remove(item->id());
                _stores.removeAll(item);

                delete item;
                item = nullptr;
            }
        }
    } catch (const pkcs11Exception &e) {
        s_keyStoreList->_emit_diagnosticText(
            QString::asprintf("PKCS#11: Cannot get key stores: %lu-'%s'.\n", e.rv(), myPrintable(e.message())));
    }

    if (tokens != nullptr) {
        pkcs11h_token_freeTokenIdList(tokens);
    }

    QCA_logTextMessage(
        QString::asprintf("pkcs11KeyStoreListContext::keyStores - return out.size()=%d", int(out.size())),
        Logger::Debug);

    return out;
}

QList<KeyStoreEntryContext *> pkcs11KeyStoreListContext::entryList(int id)
{
    pkcs11h_certificate_id_list_t certs = nullptr;
    QList<KeyStoreEntryContext *> out;

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::entryList - entry id=%d", id), Logger::Debug);

    try {
        CK_RV rv;

        if (_storesById.contains(id)) {
            pkcs11KeyStoreItem *entry = _storesById[id];

            pkcs11h_certificate_id_list_t issuers = nullptr;
            pkcs11h_certificate_id_list_t current = nullptr;
            QList<Certificate>            listCerts;
            QList<Certificate>            listIssuers;
            int                           i = 0;

            if ((rv = pkcs11h_certificate_enumTokenCertificateIds(entry->tokenId(),
                                                                  PKCS11H_ENUM_METHOD_CACHE,
                                                                  nullptr,
                                                                  PKCS11H_PROMPT_MASK_ALLOW_ALL,
                                                                  &issuers,
                                                                  &certs)) != CKR_OK) {
                throw pkcs11Exception(rv, QStringLiteral("Enumerate certificates"));
            }

            for (current = certs; current != nullptr; current = current->next) {
                if (current->certificate_id->certificate_blob_size > 0) {
                    listCerts += Certificate::fromDER(QByteArray((char *)current->certificate_id->certificate_blob,
                                                                 current->certificate_id->certificate_blob_size));
                }
            }

            for (current = issuers; current != nullptr; current = current->next) {
                if (current->certificate_id->certificate_blob_size > 0) {
                    listIssuers += Certificate::fromDER(QByteArray((char *)current->certificate_id->certificate_blob,
                                                                   current->certificate_id->certificate_blob_size));
                }
            }

            entry->registerCertificates(listIssuers + listCerts);
            QMap<QString, QString> friendlyNames = entry->friendlyNames();

            QList<Certificate> listIssuersForComplete;
            if (dynamic_cast<pkcs11Provider *>(provider())->_allowLoadRootCA) {
                listIssuersForComplete = listIssuers;
            } else {
                foreach (Certificate c, listIssuers) {
                    if (!c.isSelfSigned()) {
                        listIssuersForComplete += c;
                    }
                }
            }

            for (i = 0, current = issuers; current != nullptr; i++, current = current->next) {
                try {
                    if (listIssuers[i].isNull()) {
                        throw pkcs11Exception(CKR_ARGUMENTS_BAD, QStringLiteral("Invalid certificate"));
                    }

                    if (listIssuers[i].isSelfSigned() && dynamic_cast<pkcs11Provider *>(provider())->_allowLoadRootCA) {
                        CertificateChain chain = CertificateChain(listIssuers[i]).complete(listIssuersForComplete);
                        out += _keyStoreEntryByCertificateId(
                            current->certificate_id, false, chain, friendlyNames[certificateHash(chain.primary())]);
                    }
                } catch (const pkcs11Exception &e) {
                    s_keyStoreList->_emit_diagnosticText(QString::asprintf(
                        "PKCS#11: Add key store entry %lu-'%s'.\n", e.rv(), myPrintable(e.message())));
                }
            }

            for (i = 0, current = certs; current != nullptr; i++, current = current->next) {
                try {
                    if (listCerts[i].isNull()) {
                        throw pkcs11Exception(CKR_ARGUMENTS_BAD, QStringLiteral("Invalid certificate"));
                    }

                    CertificateChain chain = CertificateChain(listCerts[i]).complete(listIssuersForComplete);
                    out += _keyStoreEntryByCertificateId(
                        current->certificate_id, true, chain, friendlyNames[certificateHash(chain.primary())]);
                } catch (const pkcs11Exception &e) {
                    s_keyStoreList->_emit_diagnosticText(QString::asprintf(
                        "PKCS#11: Add key store entry %lu-'%s'.\n", e.rv(), myPrintable(e.message())));
                }
            }
        }
    } catch (const pkcs11Exception &e) {
        s_keyStoreList->_emit_diagnosticText(
            QString::asprintf("PKCS#11: Enumerating store failed %lu-'%s'.\n", e.rv(), myPrintable(e.message())));
    }

    if (certs != nullptr) {
        pkcs11h_certificate_freeCertificateIdList(certs);
    }

    QCA_logTextMessage(
        QString::asprintf("pkcs11KeyStoreListContext::entryList - return out.size()=%d", int(out.size())),
        Logger::Debug);

    return out;
}

bool pkcs11KeyStoreListContext::_tokenPrompt(void *const user_data, const pkcs11h_token_id_t token_id)
{
    KeyStoreEntry         entry;
    KeyStoreEntryContext *context = nullptr;
    QString               storeId, storeName;
    bool                  ret = false;

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::_tokenPrompt - entry user_data=%p, token_id=%p",
                                         user_data,
                                         (void *)token_id),
                       Logger::Debug);

    if (user_data != nullptr) {
        QString *serialized = (QString *)user_data;
        context             = entryPassive(*serialized);
        storeId             = context->storeId();
        storeName           = context->storeName();
        entry.change(context);
    } else {
        _registerTokenId(token_id);
        storeId   = _tokenId2storeId(token_id);
        storeName = QString::fromLatin1(token_id->label);
    }

    TokenAsker asker;
    asker.ask(KeyStoreInfo(KeyStore::SmartCard, storeId, storeName), entry, context);
    asker.waitForResponse();
    if (asker.accepted()) {
        ret = true;
    }

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::_tokenPrompt - return ret=%d", ret ? 1 : 0),
                       Logger::Debug);

    return ret;
}

bool pkcs11KeyStoreListContext::_pinPrompt(void *const user_data, const pkcs11h_token_id_t token_id, SecureArray &pin)
{
    KeyStoreEntry         entry;
    KeyStoreEntryContext *context = nullptr;
    QString               storeId, storeName;
    bool                  ret = false;

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::_pinPrompt - entry user_data=%p, token_id=%p",
                                         user_data,
                                         (void *)token_id),
                       Logger::Debug);

    pin = SecureArray();

    if (user_data != nullptr) {
        QString *serialized = (QString *)user_data;
        context             = entryPassive(*serialized);
        storeId             = context->storeId();
        storeName           = context->storeName();
        entry.change(context);
    } else {
        _registerTokenId(token_id);
        storeId   = _tokenId2storeId(token_id);
        storeName = QString::fromLatin1(token_id->label);
    }

    PasswordAsker asker;
    asker.ask(Event::StylePIN, KeyStoreInfo(KeyStore::SmartCard, storeId, storeName), entry, context);
    asker.waitForResponse();
    if (asker.accepted()) {
        ret = true;
        pin = asker.password();
    }

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::_pinPrompt - return ret=%d", ret ? 1 : 0),
                       Logger::Debug);

    return ret;
}

void pkcs11KeyStoreListContext::_emit_diagnosticText(const QString &t)
{
    QCA_logTextMessage(
        QString::asprintf("pkcs11KeyStoreListContext::_emit_diagnosticText - entry t='%s'", myPrintable(t)),
        Logger::Debug);

    QCA_logTextMessage(t, Logger::Warning);

    emit diagnosticText(t);

    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::_emit_diagnosticText - return"), Logger::Debug);
}

void pkcs11KeyStoreListContext::doReady()
{
    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::doReady - entry"), Logger::Debug);

    emit busyEnd();

    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::doReady - return"), Logger::Debug);
}

void pkcs11KeyStoreListContext::doUpdated()
{
    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::doUpdated - entry"), Logger::Debug);

    emit updated();

    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::doUpdated - return"), Logger::Debug);
}

pkcs11KeyStoreListContext::pkcs11KeyStoreItem *
pkcs11KeyStoreListContext::_registerTokenId(const pkcs11h_token_id_t token_id)
{
    QCA_logTextMessage(
        QString::asprintf("pkcs11KeyStoreListContext::_registerTokenId - entry token_id=%p", (void *)token_id),
        Logger::Debug);

    QMutexLocker l(&_mutexStores);

    _stores_t::iterator i = _stores.begin();

    while (i != _stores.end() && !pkcs11h_token_sameTokenId(token_id, (*i)->tokenId())) {
        i++;
    }

    pkcs11KeyStoreItem *entry = nullptr;

    if (i == _stores.end()) {
        /*
         * Deal with last_id overlap
         */
        while (_storesById.find(++_last_id) != _storesById.end())
            ;

        entry = new pkcs11KeyStoreItem(_last_id, token_id);

        _stores += entry;
        _storesById.insert(entry->id(), entry);
    } else {
        entry = (*i);
    }

    QCA_logTextMessage(
        QString::asprintf("pkcs11KeyStoreListContext::_registerTokenId - return entry=%p", (void *)token_id),
        Logger::Debug);

    return entry;
}

void pkcs11KeyStoreListContext::_clearStores()
{
    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::_clearStores - entry"), Logger::Debug);

    QMutexLocker l(&_mutexStores);

    _storesById.clear();
    foreach (pkcs11KeyStoreItem *i, _stores) {
        delete i;
    }

    _stores.clear();

    QCA_logTextMessage(QStringLiteral("pkcs11KeyStoreListContext::_clearStores - return"), Logger::Debug);
}

pkcs11KeyStoreEntryContext *
pkcs11KeyStoreListContext::_keyStoreEntryByCertificateId(const pkcs11h_certificate_id_t certificate_id,
                                                         const bool                     has_private,
                                                         const CertificateChain &       chain,
                                                         const QString &                _description) const
{
    pkcs11KeyStoreEntryContext *entry = nullptr;

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::_keyStoreEntryByCertificateId - entry "
                                         "certificate_id=%p, has_private=%d, chain.size()=%d",
                                         (void *)certificate_id,
                                         has_private ? 1 : 0,
                                         int(chain.size())),
                       Logger::Debug);

    if (certificate_id == nullptr) {
        throw pkcs11Exception(CKR_ARGUMENTS_BAD, QStringLiteral("Missing certificate object"));
    }

    QString serialized = _serializeCertificate(certificate_id, chain, has_private);

    QString            description = _description;
    const Certificate &cert        = chain.primary();
    if (description.isEmpty()) {
        description = cert.subjectInfoOrdered().toString() + QStringLiteral(" by ") +
            cert.issuerInfo().value(CommonName, QStringLiteral("Unknown"));
    }

    if (has_private) {
        pkcs11RSAContext *rsakey =
            new pkcs11RSAContext(provider(), certificate_id, serialized, cert.subjectPublicKey().toRSA());

        pkcs11PKeyContext *pkc = new pkcs11PKeyContext(provider());
        pkc->setKey(rsakey);
        PrivateKey privkey;
        privkey.change(pkc);
        KeyBundle key;
        key.setCertificateChainAndKey(chain, privkey);

        entry = new pkcs11KeyStoreEntryContext(key,
                                               _tokenId2storeId(certificate_id->token_id),
                                               serialized,
                                               QString::fromLatin1(certificate_id->token_id->label),
                                               description,
                                               provider());
    } else {
        entry = new pkcs11KeyStoreEntryContext(cert,
                                               _tokenId2storeId(certificate_id->token_id),
                                               serialized,
                                               QString::fromLatin1(certificate_id->token_id->label),
                                               description,
                                               provider());
    }

    QCA_logTextMessage(
        QString::asprintf("pkcs11KeyStoreListContext::_keyStoreEntryByCertificateId - return entry=%p", (void *)entry),
        Logger::Debug);

    return entry;
}

QString pkcs11KeyStoreListContext::_tokenId2storeId(const pkcs11h_token_id_t token_id) const
{
    QString storeId;
    size_t  len;

    QCA_logTextMessage(
        QString::asprintf("pkcs11KeyStoreListContext::_tokenId2storeId - entry token_id=%p", (void *)token_id),
        Logger::Debug);

    if (pkcs11h_token_serializeTokenId(nullptr, &len, token_id) != CKR_OK) {
        throw pkcs11Exception(CKR_FUNCTION_FAILED, QStringLiteral("Cannot serialize token id"));
    }

    QByteArray buf;
    buf.resize((int)len);

    if (pkcs11h_token_serializeTokenId(buf.data(), &len, token_id) != CKR_OK) {
        throw pkcs11Exception(CKR_FUNCTION_FAILED, QStringLiteral("Cannot serialize token id"));
    }

    buf.resize((int)len);

    storeId = QStringLiteral("qca-pkcs11/") + _escapeString(QString::fromUtf8(buf));

    QCA_logTextMessage(
        QString::asprintf("pkcs11KeyStoreListContext::_tokenId2storeId - return storeId='%s'", myPrintable(storeId)),
        Logger::Debug);

    return storeId;
}

QString pkcs11KeyStoreListContext::_serializeCertificate(const pkcs11h_certificate_id_t certificate_id,
                                                         const CertificateChain &       chain,
                                                         const bool                     has_private) const
{
    QString serialized;
    size_t  len;

    QCA_logTextMessage(
        QString::asprintf(
            "pkcs11KeyStoreListContext::_serializeCertificate - entry certificate_id=%p, xx, has_private=%d",
            (void *)certificate_id,
            has_private ? 1 : 0),
        Logger::Debug);

    if (pkcs11h_certificate_serializeCertificateId(nullptr, &len, certificate_id) != CKR_OK) {
        throw pkcs11Exception(CKR_FUNCTION_FAILED, QStringLiteral("Cannot serialize certificate id"));
    }

    QByteArray buf;
    buf.resize((int)len);

    if (pkcs11h_certificate_serializeCertificateId(buf.data(), &len, certificate_id) != CKR_OK) {
        throw pkcs11Exception(CKR_FUNCTION_FAILED, QStringLiteral("Cannot serialize certificate id"));
    }

    buf.resize((int)len);

    serialized = QString::asprintf(
        "qca-pkcs11/0/%s/%d/", myPrintable(_escapeString(QString::fromUtf8(buf))), has_private ? 1 : 0);

    QStringList list;
    foreach (Certificate i, chain) {
        list += _escapeString(Base64().arrayToString(i.toDER()));
    }

    serialized.append(list.join(QStringLiteral("/")));

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::_serializeCertificate - return serialized='%s'",
                                         myPrintable(serialized)),
                       Logger::Debug);

    return serialized;
}

void pkcs11KeyStoreListContext::_deserializeCertificate(const QString &                 from,
                                                        pkcs11h_certificate_id_t *const p_certificate_id,
                                                        bool *const                     p_has_private,
                                                        CertificateChain &              chain) const
{
    pkcs11h_certificate_id_t certificate_id = nullptr;
    chain.clear();

    QCA_logTextMessage(QString::asprintf("pkcs11KeyStoreListContext::_deserializeCertificate - entry from='%s', "
                                         "p_certificate_id=%p, p_has_private=%p",
                                         myPrintable(from),
                                         (void *)p_certificate_id,
                                         (void *)p_has_private),
                       Logger::Debug);

    try {
        int   n = 0;
        CK_RV rv;

        *p_certificate_id = nullptr;
        *p_has_private    = false;

        const QStringList list = from.split(QStringLiteral("/"));

        if (list.size() < 5) {
            throw pkcs11Exception(CKR_FUNCTION_FAILED, QStringLiteral("Invalid serialization"));
        }

        if (list[n++] != QLatin1String("qca-pkcs11")) {
            throw pkcs11Exception(CKR_FUNCTION_FAILED, QStringLiteral("Invalid serialization"));
        }

        if (list[n++].toInt() != 0) {
            throw pkcs11Exception(CKR_FUNCTION_FAILED, QStringLiteral("Invalid serialization version"));
        }

        if ((rv = pkcs11h_certificate_deserializeCertificateId(&certificate_id,
                                                               myPrintable(_unescapeString(list[n++])))) != CKR_OK) {
            throw pkcs11Exception(rv, QStringLiteral("Invalid serialization"));
        }

        *p_has_private = list[n++].toInt() != 0;

        const QByteArray endCertificateBytes = Base64().stringToArray(_unescapeString(list[n++])).toByteArray();
        Certificate      endCertificate      = Certificate::fromDER(endCertificateBytes);

        if (endCertificate.isNull()) {
            throw pkcs11Exception(rv, QStringLiteral("Invalid certificate"));
        }

        if ((rv = pkcs11h_certificate_setCertificateIdCertificateBlob(certificate_id,
                                                                      (const unsigned char *)endCertificateBytes.data(),
                                                                      (size_t)endCertificateBytes.size())) != CKR_OK) {
            throw pkcs11Exception(rv, QStringLiteral("Invalid serialization"));
        }

        chain = endCertificate;
        while (n < list.size()) {
            Certificate cert = Certificate::fromDER(Base64().stringToArray(_unescapeString(list[n++])).toByteArray());
            if (cert.isNull()) {
                throw pkcs11Exception(rv, QStringLiteral("Invalid certificate"));
            }
            chain += cert;
        }

        *p_certificate_id = certificate_id;
        certificate_id    = nullptr;
    } catch (...) {
        if (certificate_id != nullptr) {
            pkcs11h_certificate_freeCertificateId(certificate_id);
            certificate_id = nullptr;
        }
        throw;
    }

    QCA_logTextMessage(
        QString::asprintf(
            "pkcs11KeyStoreListContext::_deserializeCertificate - return *p_certificate_id=%p, chain.size()=%d",
            (void *)*p_certificate_id,
            int(chain.size())),
        Logger::Debug);
}

QString pkcs11KeyStoreListContext::_escapeString(const QString &from) const
{
    QString to;

    foreach (QChar c, from) {
        if (c == QLatin1Char('/') || c == QLatin1Char('\\')) {
            to += QString::asprintf("\\x%04x", c.unicode());
        } else {
            to += c;
        }
    }

    return to;
}

QString pkcs11KeyStoreListContext::_unescapeString(const QString &from) const
{
    QString to;

    for (int i = 0; i < from.size(); i++) {
        QChar c = from[i];

        if (c == QLatin1Char('\\')) {
#if QT_VERSION >= QT_VERSION_CHECK(5, 15, 2)
            to += QChar((ushort)QStringView(from).mid(i + 2, 4).toInt(nullptr, 16));
#else
            to += QChar((ushort)from.midRef(i + 2, 4).toInt(nullptr, 16));
#endif
            i += 5;
        } else {
            to += c;
        }
    }

    return to;
}

}

using namespace pkcs11QCAPlugin;

const int pkcs11Provider::_CONFIG_MAX_PROVIDERS = 10;

//----------------------------------------------------------------------------
// pkcs11Provider
//----------------------------------------------------------------------------
pkcs11Provider::pkcs11Provider()
{
    QCA_logTextMessage(QStringLiteral("pkcs11Provider::pkcs11Provider - entry"), Logger::Debug);

    _lowLevelInitialized      = false;
    _slotEventsActive         = false;
    _slotEventsLowLevelActive = false;
    _allowLoadRootCA          = false;

    QCA_logTextMessage(QStringLiteral("pkcs11Provider::pkcs11Provider - return"), Logger::Debug);
}

pkcs11Provider::~pkcs11Provider()
{
    QCA_logTextMessage(QStringLiteral("pkcs11Provider::~pkcs11Provider - entry/return"), Logger::Debug);
}

int pkcs11Provider::qcaVersion() const
{
    QCA_logTextMessage(QStringLiteral("pkcs11Provider::qcaVersion - entry/return"), Logger::Debug);

    return QCA_VERSION;
}

void pkcs11Provider::init()
{
    QCA_logTextMessage(QStringLiteral("pkcs11Provider::init - entry"), Logger::Debug);

    try {
        CK_RV rv;

        if ((rv = pkcs11h_engine_setCrypto(&pkcs11QCACrypto::crypto)) != CKR_OK) {
            throw pkcs11Exception(rv, QStringLiteral("Cannot set crypto"));
        }

        if ((rv = pkcs11h_initialize()) != CKR_OK) {
            throw pkcs11Exception(rv, QStringLiteral("Cannot initialize"));
        }

        if ((rv = pkcs11h_setLogHook(__logHook, this)) != CKR_OK) {
            throw pkcs11Exception(rv, QStringLiteral("Cannot set hook"));
        }

        pkcs11h_setLogLevel(0);

        if ((rv = pkcs11h_setTokenPromptHook(__tokenPromptHook, this)) != CKR_OK) {
            throw pkcs11Exception(rv, QStringLiteral("Cannot set hook"));
        }

        if ((rv = pkcs11h_setPINPromptHook(__pinPromptHook, this)) != CKR_OK) {
            throw pkcs11Exception(rv, QStringLiteral("Cannot set hook"));
        }

        _lowLevelInitialized = true;
    } catch (const pkcs11Exception &e) {
        QCA_logTextMessage(e.message(), Logger::Error);
        appendPluginDiagnosticText(
            QString::asprintf("An error %s during initialization of qca-pkcs11 plugin\n", myPrintable(e.message())));
    } catch (...) {
        QCA_logTextMessage(QStringLiteral("PKCS#11: Unknown error during provider initialization"), Logger::Error);
        appendPluginDiagnosticText(QStringLiteral("Unknown error during initialization of qca-pkcs11 plugin\n"));
    }

    QCA_logTextMessage(QStringLiteral("pkcs11Provider::init - return"), Logger::Debug);
}

void pkcs11Provider::deinit()
{
    QCA_logTextMessage(QStringLiteral("pkcs11Provider::deinit - entry"), Logger::Debug);

    delete s_keyStoreList;
    s_keyStoreList = nullptr;

    pkcs11h_terminate();

    QCA_logTextMessage(QStringLiteral("pkcs11Provider::deinit - return"), Logger::Debug);
}

QString pkcs11Provider::name() const
{
    QCA_logTextMessage(QStringLiteral("pkcs11Provider::name - entry/return"), Logger::Debug);

    return QStringLiteral("qca-pkcs11");
}

QStringList pkcs11Provider::features() const
{
    QCA_logTextMessage(QStringLiteral("pkcs11Provider::features - entry/return"), Logger::Debug);

    QStringList list;
    list += QStringLiteral("smartcard"); // indicator, not algorithm
    list += QStringLiteral("pkey");
    list += QStringLiteral("keystorelist");
    return list;
}

Provider::Context *pkcs11Provider::createContext(const QString &type)
{
    Provider::Context *context = nullptr;

    QCA_logTextMessage(QString::asprintf("pkcs11Provider::createContext - entry type='%s'", myPrintable(type)),
                       Logger::Debug);

    if (_lowLevelInitialized) {
        if (type == QLatin1String("keystorelist")) {
            if (s_keyStoreList == nullptr) {
                s_keyStoreList = new pkcs11KeyStoreListContext(this);
            }
            context = s_keyStoreList;
        }
    }

    QCA_logTextMessage(QString::asprintf("pkcs11Provider::createContext - return context=%p", (void *)context),
                       Logger::Debug);

    return context;
}

void pkcs11Provider::startSlotEvents()
{
    CK_RV rv;

    QCA_logTextMessage(QStringLiteral("pkcs11Provider::startSlotEvents - entry"), Logger::Debug);

    if (_lowLevelInitialized) {
        if (!_slotEventsLowLevelActive) {
            if ((rv = pkcs11h_setSlotEventHook(__slotEventHook, this)) != CKR_OK) {
                throw pkcs11Exception(rv, QStringLiteral("Cannot start slot events"));
            }

            _slotEventsLowLevelActive = true;
        }

        _slotEventsActive = true;
    }

    QCA_logTextMessage(QStringLiteral("pkcs11Provider::startSlotEvents - return"), Logger::Debug);
}

void pkcs11Provider::stopSlotEvents()
{
    QCA_logTextMessage(QStringLiteral("pkcs11Provider::stopSlotEvents - entry/return"), Logger::Debug);

    _slotEventsActive = false;
}

QVariantMap pkcs11Provider::defaultConfig() const
{
    QVariantMap mytemplate;

    QCA_logTextMessage(QStringLiteral("pkcs11Provider::defaultConfig - entry/return"), Logger::Debug);

    mytemplate[QStringLiteral("formtype")]          = QStringLiteral("http://affinix.com/qca/forms/qca-pkcs11#1.0");
    mytemplate[QStringLiteral("allow_load_rootca")] = false;
    mytemplate[QStringLiteral("allow_protected_authentication")] = true;
    mytemplate[QStringLiteral("pin_cache")]                      = PKCS11H_PIN_CACHE_INFINITE;
    mytemplate[QStringLiteral("log_level")]                      = 0;
    for (int i = 0; i < _CONFIG_MAX_PROVIDERS; i++) {
        mytemplate[QString::asprintf("provider_%02d_enabled", i)]                        = false;
        mytemplate[QString::asprintf("provider_%02d_name", i)]                           = QLatin1String("");
        mytemplate[QString::asprintf("provider_%02d_library", i)]                        = QLatin1String("");
        mytemplate[QString::asprintf("provider_%02d_allow_protected_authentication", i)] = true;
        mytemplate[QString::asprintf("provider_%02d_cert_private", i)]                   = false;
        mytemplate[QString::asprintf("provider_%02d_private_mask", i)]      = PKCS11H_PRIVATEMODE_MASK_AUTO;
        mytemplate[QString::asprintf("provider_%02d_slotevent_method", i)]  = QStringLiteral("auto");
        mytemplate[QString::asprintf("provider_%02d_slotevent_timeout", i)] = 0;
    }

    return mytemplate;
}

void pkcs11Provider::configChanged(const QVariantMap &config)
{
    CK_RV rv = CKR_OK;

    QCA_logTextMessage(QStringLiteral("pkcs11Provider::configChanged - entry"), Logger::Debug);

    if (!_lowLevelInitialized) {
        QCA_logTextMessage(QStringLiteral("PKCS#11: Not initialized"), Logger::Error);
        return;
    }

    _allowLoadRootCA = config[QStringLiteral("allow_load_rootca")].toBool();

    pkcs11h_setLogLevel(config[QStringLiteral("log_level")].toInt());
    pkcs11h_setProtectedAuthentication(config[QStringLiteral("allow_protected_authentication")].toBool() != false
                                           ? TRUE
                                           : FALSE // krazy:exclude=captruefalse
    );
    pkcs11h_setPINCachePeriod(config[QStringLiteral("pin_cache")].toInt());

    /*
     * Remove current providers
     */
    foreach (QString i, _providers) {
        pkcs11h_removeProvider(myPrintable(i));
    }
    _providers.clear();

    /*
     * Add new providers
     */
    for (int i = 0; i < _CONFIG_MAX_PROVIDERS; i++) {
        bool     enabled    = config[QString::asprintf("provider_%02d_enabled", i)].toBool();
        QString  provider   = config[QString::asprintf("provider_%02d_library", i)].toString();
        QString  name       = config[QString::asprintf("provider_%02d_name", i)].toString();
        QString  qslotevent = config[QString::asprintf("provider_%02d_slotevent_method", i)].toString();
        unsigned slotevent  = PKCS11H_SLOTEVENT_METHOD_AUTO;
        if (qslotevent == QLatin1String("trigger")) {
            slotevent = PKCS11H_SLOTEVENT_METHOD_TRIGGER;
        } else if (qslotevent == QLatin1String("poll")) {
            slotevent = PKCS11H_SLOTEVENT_METHOD_POLL;
        }

        if (name.isEmpty()) {
            name = provider;
        }

        if (enabled && !provider.isEmpty()) {
            QCA_logTextMessage(
                QString::asprintf("Loading PKCS#11 provider '%s' (%s)", myPrintable(name), myPrintable(provider)),
                Logger::Information);

            if ((rv = pkcs11h_addProvider(
                     myPrintable(name),
                     myPrintable(provider),
                     config[QString::asprintf("provider_%02d_allow_protected_authentication", i)].toBool() != false
                         ? TRUE
                         : FALSE, // krazy:exclude=captruefalse
                     (unsigned)config[QString::asprintf("provider_%02d_private_mask", i)].toInt(),
                     slotevent,
                     (unsigned)config[QString::asprintf("provider_%02d_slotevent_timeout", i)].toInt(),
                     config[QString::asprintf("provider_%02d_cert_private", i)].toBool() != false
                         ? TRUE
                         : FALSE // krazy:exclude=captruefalse
                     )) != CKR_OK) {
                QCA_logTextMessage(QString::asprintf("PKCS#11: Cannot log provider '%s'-'%s' %lu-'%s'.\n",
                                                     myPrintable(name),
                                                     myPrintable(provider),
                                                     rv,
                                                     pkcs11h_getMessage(rv)),
                                   Logger::Error);
                appendPluginDiagnosticText(QString::asprintf("Cannot load PKCS#11 provider '%s'\n", myPrintable(name)));
            } else {
                _providers += provider;
            }
        }
    }

    QCA_logTextMessage(QStringLiteral("pkcs11Provider::configChanged - return"), Logger::Debug);
}

void pkcs11Provider::__logHook(void *const global_data, const unsigned flags, const char *const format, va_list args)
{
    pkcs11Provider *me = (pkcs11Provider *)global_data;
    me->_logHook(flags, format, args);
}

void pkcs11Provider::__slotEventHook(void *const global_data)
{
    pkcs11Provider *me = (pkcs11Provider *)global_data;
    me->_slotEventHook();
}

PKCS11H_BOOL
pkcs11Provider::__tokenPromptHook(void *const              global_data,
                                  void *const              user_data,
                                  const pkcs11h_token_id_t token,
                                  const unsigned           retry)
{
    Q_UNUSED(retry);

    pkcs11Provider *me = (pkcs11Provider *)global_data;
    return me->_tokenPromptHook(user_data, token);
}

PKCS11H_BOOL
pkcs11Provider::__pinPromptHook(void *const              global_data,
                                void *const              user_data,
                                const pkcs11h_token_id_t token,
                                const unsigned           retry,
                                char *const              pin,
                                const size_t             pin_max)
{
    Q_UNUSED(retry);

    pkcs11Provider *me = (pkcs11Provider *)global_data;
    return me->_pinPromptHook(user_data, token, pin, pin_max);
}

void pkcs11Provider::_logHook(const unsigned flags, const char *const format, va_list args)
{
    Logger::Severity severity;

    switch (flags) {
    case PKCS11H_LOG_DEBUG2:
    case PKCS11H_LOG_DEBUG1:
        severity = Logger::Debug;
        break;
    case PKCS11H_LOG_INFO:
        severity = Logger::Information;
        break;
    case PKCS11H_LOG_WARN:
        severity = Logger::Warning;
        break;
    case PKCS11H_LOG_ERROR:
        severity = Logger::Error;
        break;
    default:
        severity = Logger::Debug;
        break;
    }

    //@BEGIN-WORKAROUND
    // Qt vsprintf cannot can NULL for %s as vsprintf does.
    //	QCA_logTextMessage (QString ().vsprintf (format, args), severity);
    char buffer[2048];
    qvsnprintf(buffer, sizeof(buffer) - 1, format, args);
    buffer[sizeof(buffer) - 1] = '\x0';
    QCA_logTextMessage(QString::fromLatin1(buffer), severity);
    //@END-WORKAROUND
}

void pkcs11Provider::_slotEventHook()
{
    /*
     * This is called from a separate
     * thread.
     */
    if (s_keyStoreList != nullptr && _slotEventsActive) {
        QMetaObject::invokeMethod(s_keyStoreList, "doUpdated", Qt::QueuedConnection);
    }
}

PKCS11H_BOOL
pkcs11Provider::_tokenPromptHook(void *const user_data, const pkcs11h_token_id_t token)
{
    if (s_keyStoreList != nullptr) {
        return s_keyStoreList->_tokenPrompt(user_data, token) ? TRUE : FALSE; // krazy:exclude=captruefalse
    }

    return FALSE; // krazy:exclude=captruefalse
}

PKCS11H_BOOL
pkcs11Provider::_pinPromptHook(void *const              user_data,
                               const pkcs11h_token_id_t token,
                               char *const              pin,
                               const size_t             pin_max)
{
    PKCS11H_BOOL ret = FALSE; // krazy:exclude=captruefalse

    if (s_keyStoreList != nullptr) {
        SecureArray qpin;

        if (s_keyStoreList->_pinPrompt(user_data, token, qpin)) {
            if ((size_t)qpin.size() < pin_max - 1) {
                memmove(pin, qpin.constData(), qpin.size());
                pin[qpin.size()] = '\0';
                ret              = TRUE; // krazy:exclude=captruefalse
            }
        }
    }

    return ret; // krazy:exclude=captruefalse
}

class pkcs11Plugin : public QObject, public QCAPlugin
{
    Q_OBJECT
    Q_PLUGIN_METADATA(IID "com.affinix.qca.Plugin/1.0")
    Q_INTERFACES(QCAPlugin)

public:
    Provider *createProvider() override
    {
        return new pkcs11Provider;
    }
};

#include "qca-pkcs11.moc"