1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _METAGLOBAL_H 27 #define _METAGLOBAL_H 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 /* 32 * This file contains all the data structures used for the meta slot 33 */ 34 35 #ifdef __cplusplus 36 extern "C" { 37 #endif 38 39 #include <assert.h> 40 #include <pthread.h> 41 #include <synch.h> 42 #include <unistd.h> 43 #include <security/cryptoki.h> 44 #include <stdio.h> 45 #include <cryptoutil.h> 46 #include <pkcs11Session.h> 47 #include <pkcs11Slot.h> 48 #include <sys/crypto/ioctl.h> 49 50 /* 51 * In "generic_attr_t", attributes that are not CK_BBOOL and 52 * CK_ULONG, the data will be stored in generic_data. 53 * Currently, 16 bytes will be pre-allocated for this. 54 * This is just a _WILD_ guess. If actual 55 * experience shows that 16 bytes is too small for most of the 56 * data that will be stored here, and cause this 57 * memory to be reallocated all the time, this should be increased. 58 */ 59 #define INITIAL_ATTR_LEN 16 60 61 /* We provide one slot, with the following arbitrary identifier. */ 62 #define METASLOT_SLOTID 42 63 64 /* Metaslot is always the first slot in the framdwork, with slotID=0 */ 65 #define METASLOT_FRAMEWORK_ID 0 66 67 /* 68 * These are the 2 acceptable string values for ${METASLOT_ENABLE} and 69 * ${METASLOT_AUTO_KEY_MIGRATE} environment variable 70 */ 71 #define TRUE_STRING "true" 72 #define FALSE_STRING "false" 73 74 /* Magic values for different data structures */ 75 #define METASLOT_SESSION_MAGIC 0xECF00004 76 #define METASLOT_SESSION_BADMAGIC 0xBAD00004 77 #define METASLOT_OBJECT_MAGIC 0xECF0B004 78 #define METASLOT_OBJECT_BADMAGIC 0xBAD0B004 79 #define METASLOT_OPSTATE_MAGIC 0xECF09004 80 #define METASLOT_OPSTATE_BADMAGIC 0xBAD09004 81 82 #define IS_READ_ONLY_SESSION(session_flag) \ 83 (!(session_flag & CKF_RW_SESSION)) 84 85 /* 86 * Operation modes passed to meta_do_operation() 87 * MODE_UPDATE_WITHKEY is only used for C_DigestKey. 88 */ 89 #define MODE_SINGLE 0x0100 90 #define MODE_UPDATE 0x0200 91 #define MODE_UPDATE_WITHKEY 0x0400 92 #define MODE_FINAL 0x1000 93 94 95 /* CK_INFO: Information about cryptoki */ 96 #define METASLOT_CRYPTOKI_VERSION_MAJOR 2 97 #define METASLOT_CRYPTOKI_VERSION_MINOR 11 98 #define METASLOT_MANUFACTURER_ID "Sun Microsystems, Inc. " 99 #define METASLOT_LIBRARY_DESCRIPTION "Sun Metaslot " 100 #define METASLOT_LIBRARY_VERSION_MAJOR 1 101 #define METASLOT_LIBRARY_VERSION_MINOR 1 102 103 /* CK_SLOT_INFO */ 104 #define METASLOT_SLOT_DESCRIPTION "Sun Metaslot " \ 105 " " 106 #define METASLOT_HARDWARE_VERSION_MAJOR 0 107 #define METASLOT_HARDWARE_VERSION_MINOR 0 108 #define METASLOT_FIRMWARE_VERSION_MAJOR 0 109 #define METASLOT_FIRMWARE_VERSION_MINOR 0 110 111 /* CK_TOKEN_INFO: More information about token */ 112 #define METASLOT_TOKEN_LABEL "Sun Metaslot " 113 #define METASLOT_TOKEN_MODEL "1.0 " 114 #define RANDOM_DEVICE "/dev/urandom" 115 116 /* 117 * Maximum number of objects and sessions to queue up before actually 118 * freeing them using the free() system. This is necessary to workaround 119 * a problem in which applications re-uses handles that are no longer valid 120 */ 121 #define MAX_OBJ_TO_BE_FREED 300 122 #define MAX_SESSION_TO_BE_FREED 300 123 124 /* 125 * The following 2 functions deals with inserting and deleting 126 * from double linked lists. It can work with any data structure 127 * that have "prev" and "next" defined. 128 */ 129 130 /* This always inserts into the head of the list */ 131 #define INSERT_INTO_LIST(list, item) \ 132 { \ 133 if ((list) == NULL) { \ 134 (item)->prev = NULL; \ 135 (item)->next = NULL; \ 136 (list) = (item); \ 137 } else { \ 138 (item)->next = (list); \ 139 (item)->prev = NULL; \ 140 (list)->prev = (item); \ 141 (list) = (item); \ 142 } \ 143 } 144 145 146 /* 147 * Remove item from list 148 */ 149 #define REMOVE_FROM_LIST(list, item) \ 150 { \ 151 /* item is at the beginning of the list */ \ 152 if ((list) == item) { \ 153 if ((item)->next == NULL) { \ 154 (list) = NULL; \ 155 } else { \ 156 (item)->next->prev = NULL; \ 157 (list) = (item)->next; \ 158 } \ 159 } else { \ 160 /* \ 161 * let the items which are initialized and not \ 162 * connected to the list trip over the asserts \ 163 */ \ 164 if ((item)->next) { \ 165 (item)->next->prev = item->prev; \ 166 assert((item)->prev != NULL); \ 167 (item)->prev->next = (item)->next; \ 168 } else { \ 169 assert((item)->prev != NULL); \ 170 (item)->prev->next = NULL; \ 171 } \ 172 } \ 173 } 174 175 /* 176 * OBJRELEASE 177 * 178 * Signal that a metaobject is no longer in use (but is still valid). 179 */ 180 #define OBJRELEASE(object) \ 181 if (object != NULL) { \ 182 (void) pthread_rwlock_unlock(&object->object_lock); \ 183 } 184 185 /* 186 * REFRELEASE 187 * 188 * Signal that a metasession is no longer in use (but is still valid). 189 * 190 */ 191 #define REFRELEASE(session) \ 192 if (session != NULL) { \ 193 (void) pthread_rwlock_unlock(&session->session_lock); \ 194 } 195 196 /* FreeObject/FreeToken Enumeration */ 197 typedef enum { 198 FREE_UNCHECKED = 0, /* Has not been checked */ 199 FREE_DISABLED = 1, /* No supported provider or key type */ 200 FREE_ALLOWED_KEY = 2, /* Supported key type */ 201 FREE_ENABLED = 3 /* FreeObject/Token enabled */ 202 } freeobject_state_t; 203 204 205 /* Generic attribute type, for storing and managing PKCS#11 attributes. */ 206 typedef struct _attr { 207 CK_ATTRIBUTE attribute; 208 209 boolean_t isMalloced; 210 211 /* attr is necessary for creating a clone of the object */ 212 boolean_t isCloneAttr; 213 214 /* 215 * depends on the PKCS#11 implementation, this attr might or might 216 * not have a value. It's OK for it to not have a value 217 * (ie: the default value is empty) 218 */ 219 boolean_t canBeEmptyValue; 220 221 boolean_t hasValueForClone; 222 223 CK_BBOOL generic_bbool; 224 CK_ULONG generic_ulong; 225 CK_BYTE generic_data[INITIAL_ATTR_LEN]; 226 } generic_attr_t; 227 228 /* 229 * These need to be defined here before the actual structures are defined 230 * because they are used in some of the structure definitions. 231 */ 232 typedef struct slotobject slot_object_t; 233 typedef struct metasession meta_session_t; 234 typedef struct metaobject meta_object_t; 235 typedef struct metaopstate meta_opstate_t; 236 237 /* 238 * slot_session_t 239 * 240 * Wrapper for a session on a provider. This structure is only used internally 241 * in metaslot; it is never revealed to applications. 242 */ 243 typedef struct slotsession { 244 CK_ULONG slotnum; 245 CK_SLOT_ID fw_st_id; /* used for accessing framework's slottable */ 246 CK_SESSION_HANDLE hSession; 247 248 boolean_t is_dualop_capable; 249 CK_FLAGS session_flags; /* what type of session */ 250 251 struct slotsession *next; 252 struct slotsession *prev; 253 254 pthread_rwlock_t object_list_lock; 255 slot_object_t *object_list_head; 256 } slot_session_t; 257 258 259 /* 260 * slot_object_t 261 * 262 * Wrapper for an object on a provider. This structure is only used internally 263 * in metaslot; it is never revealed to applications. 264 */ 265 struct slotobject { 266 CK_OBJECT_HANDLE hObject; 267 268 struct slotobject *next; 269 struct slotobject *prev; 270 271 slot_session_t *creator_session; 272 273 boolean_t isToken; 274 }; 275 276 277 /* 278 * mechinfo_t 279 * 280 * A mechinfo_t is created for each mechanism on a slot. 281 * 282 * This information is used for selecting which slots support the given 283 * mechanism for a crypto operation. 284 * 285 */ 286 typedef struct mechinfo { 287 CK_ULONG slotnum; 288 289 boolean_t initialized; 290 boolean_t supported; 291 CK_MECHANISM_INFO mechanism_info; 292 } mechinfo_t; 293 294 295 /* 296 * operation_info_t 297 * 298 * Part of a meta_session_t, used to track active operations. 299 */ 300 typedef struct opinfo { 301 CK_FLAGS type; 302 slot_session_t *session; 303 mechinfo_t *stats; 304 } operation_info_t; 305 306 typedef struct find_objs_info { 307 boolean_t op_active; /* Indicate whether FindObjects is active */ 308 meta_object_t **matched_objs; 309 int num_matched_objs; 310 int next_result_index; /* index of next object to be returned */ 311 } find_objs_info_t; 312 313 typedef struct mech_support_info { 314 CK_MECHANISM_TYPE mech; 315 /* Array of mechinfo_t allocated based on number of slots */ 316 mechinfo_t **supporting_slots; 317 unsigned long num_supporting_slots; 318 } mech_support_info_t; 319 320 typedef struct crypto_init { 321 CK_FLAGS optype; /* place holder for init parameters */ 322 struct metasession *session; /* place holder for init parameters */ 323 CK_MECHANISM *pMech; /* place holder for init parameters */ 324 struct metaobject *key; /* place holder for init parameters */ 325 CK_ULONG slotnum; /* slot where the init operation took place */ 326 boolean_t done; /* set when the real init is done */ 327 boolean_t app; /* set when C_xxxInit is called by app */ 328 } crypto_init_t; 329 330 /* 331 * meta_session_t 332 * 333 * The internal state for a meta-session is kept here. The session handles 334 * given to applications are always pointers to a structure of this type. 335 * 336 */ 337 struct metasession { 338 ulong_t magic_marker; 339 pthread_rwlock_t session_lock; 340 341 pthread_mutex_t isClosingSession_lock; 342 boolean_t isClosingSession; 343 344 struct metasession *next; 345 struct metasession *prev; 346 347 CK_FLAGS session_flags; 348 349 /* 350 * Could have just declared this as "op", but declaring it as 351 * op1 so that "op2" can be easily added when dual-op support 352 * is implemented in the future 353 */ 354 operation_info_t op1; 355 356 /* 357 * This is for keeping track of which slots support a particular 358 * mechanism. This information doesn't 359 * have to be kept on a per session bases, but having the 360 * memory pre-allocated per session would make things much simpiler, 361 * because memory doesn't need to be allocated/deallocated everytime 362 * we do an operation. 363 */ 364 mech_support_info_t mech_support_info; 365 366 367 /* Session objects created by this session. */ 368 pthread_rwlock_t object_list_lock; 369 meta_object_t *object_list_head; 370 371 /* C_FindObjects support. */ 372 find_objs_info_t find_objs_info; 373 374 /* deferred init to be used by digest, encrypt, decrypt */ 375 crypto_init_t init; 376 }; 377 378 379 /* 380 * meta_object_t 381 * 382 * The internal state for a meta-object is kept here. The object handles 383 * given to applications are always pointers to a structure of this type. 384 */ 385 struct metaobject { 386 ulong_t magic_marker; 387 pthread_rwlock_t object_lock; 388 389 pthread_mutex_t isClosingObject_lock; 390 boolean_t isClosingObject; 391 392 struct metaobject *next; 393 struct metaobject *prev; 394 395 meta_session_t *creator_session; /* Only set for session objects */ 396 397 boolean_t isToken; /* alias for CKA_TOKEN */ 398 boolean_t isPrivate; /* alias for CKA_PRIVATE */ 399 boolean_t isSensitive; /* alias for CKA_SENSITIVE */ 400 boolean_t isExtractable; /* alias for CKA_EXTRACTABLE */ 401 402 freeobject_state_t isFreeToken; 403 freeobject_state_t isFreeObject; 404 405 CK_ULONG master_clone_slotnum; /* set when object is created */ 406 slot_object_t **clones; 407 /* indicate if tried to create clone object in a slot */ 408 boolean_t *tried_create_clone; 409 410 pthread_rwlock_t attribute_lock; 411 size_t num_attributes; 412 generic_attr_t *attributes; 413 414 pthread_mutex_t clone_create_lock; 415 size_t clone_template_size; /* 0 if not yet known. */ 416 CK_ATTRIBUTE *clone_template; /* NULL if not yet known. */ 417 }; 418 419 420 /* 421 * struct metaopstate 422 * 423 * Used as the format for the operation state returned via 424 * C_GetOperationState. 425 */ 426 typedef struct opstate_data { 427 CK_FLAGS op_type; 428 CK_ULONG op_slotnum; 429 CK_ULONG op_state_len; 430 boolean_t op_init_app; 431 boolean_t op_init_done; 432 } opstate_data_t; 433 434 struct metaopstate { 435 ulong_t magic_marker; 436 /* 437 * Could have just declared this as "state", but declaring it like this 438 * so that when dual-op support is implemented in the future, the 439 * changes will be simplier. 440 */ 441 struct opstate_data state[1]; 442 }; 443 444 445 /* 446 * session_pool_t 447 * 448 * Used to cache open sessions in a slot. 449 */ 450 typedef struct sessionpool { 451 pthread_mutex_t list_lock; 452 453 /* list of sessions that's currently in use */ 454 slot_session_t *active_list_head; 455 456 /* 457 * list of sessions that are not in use, but can't be deleted because 458 * either session/token objects are created using these sessions 459 * or we need to have one session left with the provider to maintain 460 * the logged in state. Any of these sessions could be re-used if 461 * a session is needed to be established with a provider. 462 */ 463 slot_session_t *persist_list_head; 464 465 /* 466 * List of sessions that are not in use at the moment. We keep 467 * a list of sessions with a particular provider instead of 468 * creating a new session everytime for efficiency 469 */ 470 slot_session_t *idle_list_head; 471 boolean_t keep_one_alive; 472 int num_idle_sessions; /* number of sessions in "idle_list_head" */ 473 } session_pool_t; 474 475 476 /* 477 * slot_data_t 478 * 479 * Each slot has a session pool, a collection of persistant sessions to 480 * allow for more efficient operation. Specifically, to allow reuse of 481 * previously session objects (which need the creating session to stick 482 * around), as well as being frugal with creating/closing sessions. 483 */ 484 typedef struct slotdata { 485 CK_SLOT_ID fw_st_id; /* framework slot table ID */ 486 487 session_pool_t session_pool; 488 489 pthread_rwlock_t tokenobject_list_lock; 490 slot_object_t *tokenobject_list_head; 491 } slot_data_t; 492 493 494 typedef enum { 495 ALL_TOKEN = 0, 496 PUBLIC_TOKEN = 1, 497 PRIVATE_TOKEN = 2 498 } token_obj_type_t; 499 500 /* 501 * metaslot_config_t 502 * 503 * This holds the configuration information for meta slot. 504 * It will first be filled with values that users defined 505 * in environment variables. Any value not defined by the user 506 * will be filled with values from the system wide configuration file. 507 */ 508 typedef struct _metaslot_config { 509 /* token to be used as the keystore for metaslot */ 510 boolean_t keystore_token_specified; 511 CK_UTF8CHAR keystore_token[TOKEN_LABEL_SIZE + 1]; 512 513 /* slot to be used as the keystore for metaslot */ 514 boolean_t keystore_slot_specified; 515 CK_UTF8CHAR keystore_slot[SLOT_DESCRIPTION_SIZE + 1]; 516 517 /* should meta slot be enabled or not */ 518 boolean_t enabled_specified; 519 boolean_t enabled; 520 521 /* should auto migration of sensitive token objects be enabled or not */ 522 boolean_t auto_key_migrate_specified; 523 boolean_t auto_key_migrate; 524 } metaslot_config_t; 525 526 /* 527 * The following 2 structures are used to link the to-be-freed 528 * meta sessions and meta objects into linked lists. 529 * The items on these linked list have not yet been freed via free(); instead 530 * they are added to this list. The actual free will take place when 531 * the number of objects queued reaches MAX_OBJ_TO_BE_FREED or 532 * MAX_SESSION_TO_BE_FREED, at which time the first object in the 533 * list will be freed. 534 */ 535 typedef struct obj_to_be_freed_list { 536 meta_object_t *first; /* points to first obj in the list */ 537 meta_object_t *last; /* points to last obj in the list */ 538 uint32_t count; /* current total objs in the list */ 539 pthread_mutex_t obj_to_be_free_mutex; 540 } object_to_be_freed_list_t; 541 542 typedef struct ses_to_be_freed_list { 543 meta_session_t *first; /* points to first session in the list */ 544 meta_session_t *last; /* points to last session in the list */ 545 uint32_t count; /* current total session in the list */ 546 pthread_mutex_t ses_to_be_free_mutex; 547 } ses_to_be_freed_list_t; 548 549 typedef struct cipher_mechs_threshold { 550 int mech_type; 551 uint32_t mech_threshold; 552 } cipher_mechs_threshold_t; 553 554 /* Global variables */ 555 extern metaslot_config_t metaslot_config; 556 extern boolean_t metaslot_enabled; 557 extern CK_SLOT_ID metaslot_keystore_slotid; 558 extern boolean_t metaslot_auto_key_migrate; 559 extern struct CK_FUNCTION_LIST metaslot_functionList; 560 extern int meta_urandom_seed_fd; 561 extern pthread_mutex_t initmutex; 562 563 extern ses_to_be_freed_list_t ses_delay_freed; 564 extern object_to_be_freed_list_t obj_delay_freed; 565 extern void (*Tmp_GetThreshold)(void *); 566 567 extern CK_BBOOL falsevalue; 568 extern CK_BBOOL truevalue; 569 570 /* --- Prototypes --- */ 571 572 CK_RV meta_slotManager_initialize(); 573 void meta_slotManager_finalize(); 574 void meta_slotManager_find_object_token(); 575 CK_RV meta_get_slot_session(CK_ULONG slotnum, slot_session_t **session, 576 CK_FLAGS flags); 577 void meta_release_slot_session(slot_session_t *session); 578 579 CK_RV meta_mechManager_initialize(); 580 void meta_mechManager_finalize(); 581 CK_RV meta_mechManager_get_mechs(CK_MECHANISM_TYPE *list, CK_ULONG *listsize); 582 CK_RV meta_mechManager_get_slots(mech_support_info_t *mech_support_info, 583 boolean_t force_update, CK_MECHANISM_INFO *mech_info); 584 CK_RV meta_mechManager_slot_supports_mech(CK_MECHANISM_TYPE mechanism, 585 CK_ULONG slotnum, boolean_t *supports, mechinfo_t **slot_info, 586 boolean_t force_update, CK_MECHANISM_INFO *mech_info); 587 588 CK_RV meta_operation_init(CK_FLAGS optype, meta_session_t *session, 589 CK_MECHANISM *pMechanism, meta_object_t *key); 590 CK_RV meta_operation_init_defer(CK_FLAGS optype, meta_session_t *session, 591 CK_MECHANISM *pMechanism, meta_object_t *key); 592 CK_RV meta_do_operation(CK_FLAGS optype, int mode, 593 meta_session_t *session, meta_object_t *object, 594 CK_BYTE *in, CK_ULONG inLen, CK_BYTE *out, CK_ULONG *outLen); 595 596 void meta_operation_cleanup(meta_session_t *session, CK_FLAGS optype, 597 boolean_t finished_normally); 598 599 CK_RV meta_generate_keys(meta_session_t *session, CK_MECHANISM *pMechanism, 600 CK_ATTRIBUTE *k1Template, CK_ULONG k1AttrCount, meta_object_t *key1, 601 CK_ATTRIBUTE *k2Template, CK_ULONG k2AttrCount, meta_object_t *key2); 602 603 CK_RV meta_wrap_key(meta_session_t *session, 604 CK_MECHANISM *pMechanism, meta_object_t *wrappingkey, 605 meta_object_t *inputkey, 606 CK_BYTE *wrapped_key, CK_ULONG *wrapped_key_len); 607 608 CK_RV meta_unwrap_key(meta_session_t *session, 609 CK_MECHANISM *pMechanism, meta_object_t *unwrapping_key, 610 CK_BYTE *wrapped_key, CK_ULONG wrapped_key_len, 611 CK_ATTRIBUTE *template, CK_ULONG template_size, 612 meta_object_t *unwrapped_key); 613 614 CK_RV meta_derive_key(meta_session_t *session, CK_MECHANISM *pMech, 615 meta_object_t *basekey1, meta_object_t *basekey2, 616 CK_OBJECT_HANDLE *phBaseKey2, 617 CK_ATTRIBUTE *pTemplate, CK_ULONG ulAttributeCount, 618 meta_object_t *newKey1, meta_object_t *newKey2, 619 meta_object_t *newKey3, meta_object_t *newKey4); 620 621 void get_user_metaslot_config(); 622 623 CK_RV meta_sessionManager_initialize(); 624 void meta_sessionManager_finalize(); 625 CK_RV meta_handle2session(CK_SESSION_HANDLE hSession, 626 meta_session_t **session_p); 627 CK_RV meta_session_alloc(meta_session_t **newSession); 628 CK_RV meta_session_activate(meta_session_t *session); 629 CK_RV meta_session_deactivate(meta_session_t *session, 630 boolean_t have_sessionlist_lock); 631 void meta_session_dealloc(meta_session_t *session); 632 void meta_session_delay_free(meta_session_t *sp); 633 634 CK_RV meta_objectManager_initialize(); 635 void meta_objectManager_finalize(); 636 CK_RV meta_handle2object(CK_OBJECT_HANDLE hObject, meta_object_t **object); 637 CK_RV meta_object_alloc(meta_session_t *session, meta_object_t **object); 638 CK_RV meta_object_get_attr(slot_session_t *slot_session, 639 CK_OBJECT_HANDLE hObject, meta_object_t *object); 640 void meta_object_activate(meta_object_t *object); 641 CK_RV meta_object_deactivate(meta_object_t *object, boolean_t have_list_lock, 642 boolean_t have_object_lock); 643 CK_RV meta_object_dealloc(meta_object_t *object, boolean_t nukeSourceObj); 644 CK_RV meta_slot_object_alloc(slot_object_t **object); 645 void meta_slot_object_activate(slot_object_t *object, slot_session_t *session, 646 boolean_t isToken); 647 void meta_slot_object_deactivate(slot_object_t *object); 648 void meta_slot_object_dealloc(slot_object_t *object); 649 CK_RV meta_object_copyin(meta_object_t *object); 650 CK_RV meta_object_get_clone(meta_object_t *object, 651 CK_ULONG slot_num, slot_session_t *slot_session, 652 slot_object_t **clone); 653 meta_object_t *meta_object_find_by_handle(CK_OBJECT_HANDLE hObject, 654 CK_ULONG slotnum, boolean_t token_only); 655 CK_RV meta_token_object_deactivate(token_obj_type_t token_type); 656 void meta_object_delay_free(meta_object_t *objp); 657 boolean_t meta_freeobject_set(meta_object_t *object, CK_ATTRIBUTE *tmpl, 658 CK_ULONG tmpl_len, boolean_t create); 659 CK_RV meta_freetoken_set(CK_ULONG slot_num, CK_BBOOL *current_value, 660 CK_ATTRIBUTE *tmpl, CK_ULONG tmpl_len); 661 boolean_t meta_freeobject_check(meta_session_t *session, meta_object_t *obj, 662 CK_MECHANISM *pMech, CK_ATTRIBUTE *tmpl, CK_ULONG tmpl_len, 663 CK_KEY_TYPE keytype); 664 boolean_t meta_freeobject_clone(meta_session_t *session, meta_object_t *object); 665 666 CK_RV get_master_attributes_by_object(slot_session_t *session, 667 slot_object_t *slot_object, generic_attr_t **attributes, 668 size_t *num_attributes); 669 CK_RV get_master_attributes_by_template( 670 CK_ATTRIBUTE *template, CK_ULONG template_size, 671 generic_attr_t **attributes, size_t *num_attributes); 672 CK_RV get_master_template_by_type(CK_OBJECT_CLASS class, CK_ULONG subtype, 673 generic_attr_t **attributes, size_t *num_attributes); 674 CK_RV get_master_attributes_by_type(CK_OBJECT_CLASS class, CK_ULONG subtype, 675 generic_attr_t **attributes, size_t *num_attributes); 676 CK_RV get_master_attributes_by_duplication( 677 generic_attr_t *src_attrs, size_t num_src_attrs, 678 generic_attr_t **dst_attrs, size_t *num_dst_attrs); 679 void dealloc_attributes(generic_attr_t *attributes, size_t num_attributes); 680 CK_RV attribute_set_value(CK_ATTRIBUTE *new_attr, 681 generic_attr_t *attributes, size_t num_attributes); 682 boolean_t get_template_ulong(CK_ATTRIBUTE_TYPE type, CK_ATTRIBUTE *attributes, 683 CK_ULONG num_attributes, CK_ULONG *result); 684 boolean_t get_template_boolean(CK_ATTRIBUTE_TYPE type, 685 CK_ATTRIBUTE *attributes, CK_ULONG num_attributes, boolean_t *result); 686 int set_template_boolean(CK_ATTRIBUTE_TYPE type, 687 CK_ATTRIBUTE *attributes, CK_ULONG num_attributes, boolean_t local, 688 CK_BBOOL *value); 689 CK_ULONG get_keystore_slotnum(void); 690 CK_ULONG get_softtoken_slotnum(void); 691 CK_SLOT_ID meta_slotManager_get_framework_table_id(CK_ULONG slotnum); 692 CK_ULONG meta_slotManager_get_slotcount(void); 693 boolean_t meta_slotManager_token_write_protected(void); 694 boolean_t metaslot_logged_in(); 695 void metaslot_set_logged_in_flag(boolean_t value); 696 697 int looping_read(int, void *, int); 698 int looping_write(int, void *, int); 699 700 /* 701 * Prototypes for the various meta_Foo implementations of C_Foo. 702 * 703 */ 704 CK_RV meta_GetFunctionList(CK_FUNCTION_LIST_PTR_PTR ppFunctionList); 705 CK_RV meta_Initialize(CK_VOID_PTR pInitArgs); 706 CK_RV meta_Finalize(CK_VOID_PTR pReserved); 707 CK_RV meta_GetInfo(CK_INFO_PTR pInfo); 708 CK_RV meta_GetSlotList(CK_BBOOL tokenPresent, CK_SLOT_ID_PTR pSlotList, 709 CK_ULONG_PTR pulCount); 710 CK_RV meta_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo); 711 CK_RV meta_GetTokenInfo(CK_SLOT_ID slotID, CK_TOKEN_INFO_PTR pInfo); 712 CK_RV meta_GetMechanismList(CK_SLOT_ID slotID, 713 CK_MECHANISM_TYPE_PTR pMechanismList, CK_ULONG_PTR pulCount); 714 CK_RV meta_GetMechanismInfo(CK_SLOT_ID slotID, CK_MECHANISM_TYPE type, 715 CK_MECHANISM_INFO_PTR pInfo); 716 CK_RV meta_InitToken(CK_SLOT_ID slotID, CK_UTF8CHAR_PTR pPin, 717 CK_ULONG ulPinLen, CK_UTF8CHAR_PTR pLabel); 718 CK_RV meta_InitPIN(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pPin, 719 CK_ULONG ulPinLen); 720 CK_RV meta_SetPIN(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pOldPin, 721 CK_ULONG ulOldPinLen, CK_UTF8CHAR_PTR pNewPin, CK_ULONG ulNewPinLen); 722 CK_RV meta_OpenSession(CK_SLOT_ID slotID, CK_FLAGS flags, 723 CK_VOID_PTR pApplication, CK_NOTIFY Notify, 724 CK_SESSION_HANDLE_PTR phSession); 725 CK_RV meta_CloseSession(CK_SESSION_HANDLE hSession); 726 CK_RV meta_CloseAllSessions(CK_SLOT_ID slotID); 727 CK_RV meta_GetSessionInfo(CK_SESSION_HANDLE hSession, 728 CK_SESSION_INFO_PTR pInfo); 729 CK_RV meta_GetOperationState(CK_SESSION_HANDLE hSession, 730 CK_BYTE_PTR pOperationState, CK_ULONG_PTR pulOperationStateLen); 731 CK_RV meta_SetOperationState(CK_SESSION_HANDLE hSession, 732 CK_BYTE_PTR pOperationState, CK_ULONG ulOperationStateLen, 733 CK_OBJECT_HANDLE hEncryptionKey, CK_OBJECT_HANDLE hAuthenticationKey); 734 CK_RV meta_Login(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType, 735 CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen); 736 CK_RV meta_Logout(CK_SESSION_HANDLE hSession); 737 CK_RV meta_CreateObject(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate, 738 CK_ULONG ulCount, CK_OBJECT_HANDLE_PTR phObject); 739 CK_RV meta_CopyObject(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject, 740 CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, 741 CK_OBJECT_HANDLE_PTR phNewObject); 742 CK_RV meta_DestroyObject(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject); 743 CK_RV meta_GetObjectSize(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject, 744 CK_ULONG_PTR pulSize); 745 CK_RV meta_GetAttributeValue(CK_SESSION_HANDLE hSession, 746 CK_OBJECT_HANDLE hObject, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount); 747 CK_RV meta_SetAttributeValue(CK_SESSION_HANDLE hSession, 748 CK_OBJECT_HANDLE hObject, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount); 749 CK_RV meta_FindObjectsInit(CK_SESSION_HANDLE hSession, 750 CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount); 751 CK_RV meta_FindObjects(CK_SESSION_HANDLE hSession, 752 CK_OBJECT_HANDLE_PTR phObject, CK_ULONG ulMaxObjectCount, 753 CK_ULONG_PTR pulObjectCount); 754 CK_RV meta_FindObjectsFinal(CK_SESSION_HANDLE hSession); 755 CK_RV meta_EncryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, 756 CK_OBJECT_HANDLE hKey); 757 CK_RV meta_Encrypt(CK_SESSION_HANDLE hSession, 758 CK_BYTE_PTR pData, CK_ULONG ulDataLen, 759 CK_BYTE_PTR pEncryptedData, CK_ULONG_PTR pulEncryptedDataLen); 760 CK_RV meta_EncryptUpdate(CK_SESSION_HANDLE hSession, 761 CK_BYTE_PTR pPart, CK_ULONG ulPartLen, 762 CK_BYTE_PTR pEncryptedPart, CK_ULONG_PTR pulEncryptedPartLen); 763 CK_RV meta_EncryptFinal(CK_SESSION_HANDLE hSession, 764 CK_BYTE_PTR pLastEncryptedPart, CK_ULONG_PTR pulLastEncryptedPartLen); 765 CK_RV meta_DecryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, 766 CK_OBJECT_HANDLE hKey); 767 CK_RV meta_Decrypt(CK_SESSION_HANDLE hSession, 768 CK_BYTE_PTR pEncryptedData, CK_ULONG ulEncryptedDataLen, 769 CK_BYTE_PTR pData, CK_ULONG_PTR pulDataLen); 770 CK_RV meta_DecryptUpdate(CK_SESSION_HANDLE hSession, 771 CK_BYTE_PTR pEncryptedPart, CK_ULONG ulEncryptedPartLen, 772 CK_BYTE_PTR pPart, CK_ULONG_PTR pulPartLen); 773 CK_RV meta_DecryptFinal(CK_SESSION_HANDLE hSession, 774 CK_BYTE_PTR pLastPart, CK_ULONG_PTR pulLastPartLen); 775 CK_RV meta_DigestInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism); 776 CK_RV meta_Digest(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, 777 CK_ULONG ulDataLen, CK_BYTE_PTR pDigest, CK_ULONG_PTR pulDigestLen); 778 CK_RV meta_DigestUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart, 779 CK_ULONG ulPartLen); 780 CK_RV meta_DigestKey(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hKey); 781 CK_RV meta_DigestFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pDigest, 782 CK_ULONG_PTR pulDigestLen); 783 CK_RV meta_SignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, 784 CK_OBJECT_HANDLE hKey); 785 CK_RV meta_Sign(CK_SESSION_HANDLE hSession, 786 CK_BYTE_PTR pData, CK_ULONG ulDataLen, 787 CK_BYTE_PTR pSignature, CK_ULONG_PTR pulSignatureLen); 788 CK_RV meta_SignUpdate(CK_SESSION_HANDLE hSession, 789 CK_BYTE_PTR pPart, CK_ULONG ulPartLen); 790 CK_RV meta_SignFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature, 791 CK_ULONG_PTR pulSignatureLen); 792 CK_RV meta_SignRecoverInit(CK_SESSION_HANDLE hSession, 793 CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey); 794 CK_RV meta_SignRecover(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, 795 CK_ULONG ulDataLen, CK_BYTE_PTR pSignature, CK_ULONG_PTR pulSignatureLen); 796 CK_RV meta_VerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, 797 CK_OBJECT_HANDLE hKey); 798 CK_RV meta_Verify(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, 799 CK_ULONG ulDataLen, CK_BYTE_PTR pSignature, CK_ULONG ulSignatureLen); 800 CK_RV meta_VerifyUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart, 801 CK_ULONG ulPartLen); 802 CK_RV meta_VerifyFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature, 803 CK_ULONG ulSignatureLen); 804 CK_RV meta_VerifyRecoverInit(CK_SESSION_HANDLE hSession, 805 CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey); 806 CK_RV meta_VerifyRecover(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature, 807 CK_ULONG ulSignatureLen, CK_BYTE_PTR pData, CK_ULONG_PTR pulDataLen); 808 CK_RV meta_DigestEncryptUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart, 809 CK_ULONG ulPartLen, CK_BYTE_PTR pEncryptedPart, 810 CK_ULONG_PTR pulEncryptedPartLen); 811 CK_RV meta_DecryptDigestUpdate(CK_SESSION_HANDLE hSession, 812 CK_BYTE_PTR pEncryptedPart, CK_ULONG ulEncryptedPartLen, 813 CK_BYTE_PTR pPart, CK_ULONG_PTR pulPartLen); 814 CK_RV meta_SignEncryptUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart, 815 CK_ULONG ulPartLen, CK_BYTE_PTR pEncryptedPart, 816 CK_ULONG_PTR pulEncryptedPartLen); 817 CK_RV meta_DecryptVerifyUpdate(CK_SESSION_HANDLE hSession, 818 CK_BYTE_PTR pEncryptedPart, CK_ULONG ulEncryptedPartLen, 819 CK_BYTE_PTR pPart, CK_ULONG_PTR pulPartLen); 820 CK_RV meta_GenerateKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, 821 CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, CK_OBJECT_HANDLE_PTR phKey); 822 CK_RV meta_GenerateKeyPair(CK_SESSION_HANDLE hSession, 823 CK_MECHANISM_PTR pMechanism, CK_ATTRIBUTE_PTR pPublicKeyTemplate, 824 CK_ULONG ulPublicKeyAttributeCount, CK_ATTRIBUTE_PTR pPrivateKeyTemplate, 825 CK_ULONG ulPrivateKeyAttributeCount, CK_OBJECT_HANDLE_PTR phPublicKey, 826 CK_OBJECT_HANDLE_PTR phPrivateKey); 827 CK_RV meta_WrapKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, 828 CK_OBJECT_HANDLE hWrappingKey, CK_OBJECT_HANDLE hKey, 829 CK_BYTE_PTR pWrappedKey, CK_ULONG_PTR pulWrappedKeyLen); 830 CK_RV meta_UnwrapKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, 831 CK_OBJECT_HANDLE hUnwrappingKey, CK_BYTE_PTR pWrappedKey, 832 CK_ULONG ulWrappedKeyLen, CK_ATTRIBUTE_PTR pTemplate, 833 CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey); 834 CK_RV meta_DeriveKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, 835 CK_OBJECT_HANDLE hBaseKey, CK_ATTRIBUTE_PTR pTemplate, 836 CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey); 837 CK_RV meta_SeedRandom(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSeed, 838 CK_ULONG ulSeedLen); 839 CK_RV meta_GenerateRandom(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pRandomData, 840 CK_ULONG ulRandomLen); 841 CK_RV meta_GetFunctionStatus(CK_SESSION_HANDLE hSession); 842 CK_RV meta_CancelFunction(CK_SESSION_HANDLE hSession); 843 CK_RV meta_WaitForSlotEvent(CK_FLAGS flags, CK_SLOT_ID_PTR pSlot, 844 CK_VOID_PTR pReserved); 845 846 #ifdef __cplusplus 847 } 848 #endif 849 850 #endif /* _METAGLOBAL_H */ 851