1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include <fcntl.h>
30 #include <pthread.h>
31 #include <strings.h>
32 #include <unistd.h> /* for pid */
33 #include <errno.h>
34 #include <security/cryptoki.h>
35 #include "kernelGlobal.h"
36 #include "kernelSession.h"
37 #include "kernelSlot.h"
38 
39 #pragma fini(kernel_fini)
40 
41 static struct CK_FUNCTION_LIST functionList = {
42 	{ 2, 11 },	/* version */
43 	C_Initialize,
44 	C_Finalize,
45 	C_GetInfo,
46 	C_GetFunctionList,
47 	C_GetSlotList,
48 	C_GetSlotInfo,
49 	C_GetTokenInfo,
50 	C_GetMechanismList,
51 	C_GetMechanismInfo,
52 	C_InitToken,
53 	C_InitPIN,
54 	C_SetPIN,
55 	C_OpenSession,
56 	C_CloseSession,
57 	C_CloseAllSessions,
58 	C_GetSessionInfo,
59 	C_GetOperationState,
60 	C_SetOperationState,
61 	C_Login,
62 	C_Logout,
63 	C_CreateObject,
64 	C_CopyObject,
65 	C_DestroyObject,
66 	C_GetObjectSize,
67 	C_GetAttributeValue,
68 	C_SetAttributeValue,
69 	C_FindObjectsInit,
70 	C_FindObjects,
71 	C_FindObjectsFinal,
72 	C_EncryptInit,
73 	C_Encrypt,
74 	C_EncryptUpdate,
75 	C_EncryptFinal,
76 	C_DecryptInit,
77 	C_Decrypt,
78 	C_DecryptUpdate,
79 	C_DecryptFinal,
80 	C_DigestInit,
81 	C_Digest,
82 	C_DigestUpdate,
83 	C_DigestKey,
84 	C_DigestFinal,
85 	C_SignInit,
86 	C_Sign,
87 	C_SignUpdate,
88 	C_SignFinal,
89 	C_SignRecoverInit,
90 	C_SignRecover,
91 	C_VerifyInit,
92 	C_Verify,
93 	C_VerifyUpdate,
94 	C_VerifyFinal,
95 	C_VerifyRecoverInit,
96 	C_VerifyRecover,
97 	C_DigestEncryptUpdate,
98 	C_DecryptDigestUpdate,
99 	C_SignEncryptUpdate,
100 	C_DecryptVerifyUpdate,
101 	C_GenerateKey,
102 	C_GenerateKeyPair,
103 	C_WrapKey,
104 	C_UnwrapKey,
105 	C_DeriveKey,
106 	C_SeedRandom,
107 	C_GenerateRandom,
108 	C_GetFunctionStatus,
109 	C_CancelFunction,
110 	C_WaitForSlotEvent
111 };
112 
113 boolean_t kernel_initialized = B_FALSE;
114 static pid_t kernel_pid = 0;
115 
116 int kernel_fd = -1;
117 
118 
119 /* protects kernel_initialized and entrance to C_Initialize/Finalize */
120 static pthread_mutex_t globalmutex = PTHREAD_MUTEX_INITIALIZER;
121 
122 ses_to_be_freed_list_t ses_delay_freed;
123 object_to_be_freed_list_t obj_delay_freed;
124 
125 static void finalize_common();
126 static void cleanup_library();
127 static void kernel_fini();
128 
129 CK_RV
130 C_Initialize(CK_VOID_PTR pInitArgs)
131 {
132 
133 	int initialize_pid;
134 	boolean_t supplied_ok;
135 	CK_RV rv = CKR_OK;
136 
137 	/*
138 	 * Grab lock to insure that only one thread enters this
139 	 * function at a time.
140 	 */
141 	(void) pthread_mutex_lock(&globalmutex);
142 	initialize_pid = getpid();
143 
144 	if (kernel_initialized) {
145 		if (initialize_pid == kernel_pid) {
146 			/*
147 			 * This process has called C_Initialize already
148 			 */
149 			(void) pthread_mutex_unlock(&globalmutex);
150 			return (CKR_CRYPTOKI_ALREADY_INITIALIZED);
151 		} else {
152 			/*
153 			 * A fork has happened and the child is
154 			 * reinitializing.  Do a cleanup_library to close
155 			 * out any state from the parent, and then
156 			 * continue on.
157 			 */
158 			cleanup_library();
159 		}
160 	}
161 
162 	if (pInitArgs != NULL) {
163 		CK_C_INITIALIZE_ARGS *initargs1 =
164 		    (CK_C_INITIALIZE_ARGS *) pInitArgs;
165 
166 		/* pReserved must be NULL */
167 		if (initargs1->pReserved != NULL) {
168 			(void) pthread_mutex_unlock(&globalmutex);
169 			return (CKR_ARGUMENTS_BAD);
170 		}
171 
172 		/*
173 		 * ALL supplied function pointers need to have the value
174 		 * either NULL or non-NULL.
175 		 */
176 		supplied_ok = (initargs1->CreateMutex == NULL &&
177 		    initargs1->DestroyMutex == NULL &&
178 		    initargs1->LockMutex == NULL &&
179 		    initargs1->UnlockMutex == NULL) ||
180 		    (initargs1->CreateMutex != NULL &&
181 		    initargs1->DestroyMutex != NULL &&
182 		    initargs1->LockMutex != NULL &&
183 		    initargs1->UnlockMutex != NULL);
184 
185 		if (!supplied_ok) {
186 			(void) pthread_mutex_unlock(&globalmutex);
187 			return (CKR_ARGUMENTS_BAD);
188 		}
189 
190 		/*
191 		 * When the CKF_OS_LOCKING_OK flag isn't set and mutex
192 		 * function pointers are supplied by an application,
193 		 * return an error.  We must be able to use our own locks.
194 		 */
195 		if (!(initargs1->flags & CKF_OS_LOCKING_OK) &&
196 		    (initargs1->CreateMutex != NULL)) {
197 			(void) pthread_mutex_unlock(&globalmutex);
198 			return (CKR_CANT_LOCK);
199 		}
200 	}
201 
202 	while ((kernel_fd = open(CRYPTO_DEVICE, O_RDWR)) < 0) {
203 		if (errno != EINTR)
204 			break;
205 	}
206 	if (kernel_fd < 0) {
207 		(void) pthread_mutex_unlock(&globalmutex);
208 		return (CKR_FUNCTION_FAILED);
209 	}
210 
211 	/* Mark kernel_fd "close on exec" */
212 	(void) fcntl(kernel_fd, F_SETFD, FD_CLOEXEC);
213 
214 	/* Initialize the slot table */
215 	rv = kernel_slottable_init();
216 	if (rv != CKR_OK) {
217 		(void) close(kernel_fd);
218 		(void) pthread_mutex_unlock(&globalmutex);
219 		return (rv);
220 	}
221 
222 	/* Initialize the object_to_be_freed list */
223 	(void) pthread_mutex_init(&obj_delay_freed.obj_to_be_free_mutex, NULL);
224 	obj_delay_freed.count = 0;
225 	obj_delay_freed.first = NULL;
226 	obj_delay_freed.last = NULL;
227 
228 	/* Initialize the session_to_be_freed list */
229 	(void) pthread_mutex_init(&ses_delay_freed.ses_to_be_free_mutex, NULL);
230 	ses_delay_freed.count = 0;
231 	ses_delay_freed.first = NULL;
232 	ses_delay_freed.last = NULL;
233 
234 	kernel_initialized = B_TRUE;
235 	kernel_pid = initialize_pid;
236 
237 	(void) pthread_mutex_unlock(&globalmutex);
238 
239 	return (CKR_OK);
240 
241 }
242 
243 
244 /*
245  * C_Finalize is a wrapper around finalize_common. The
246  * globalmutex should be locked by C_Finalize().
247  */
248 CK_RV
249 C_Finalize(CK_VOID_PTR pReserved)
250 {
251 	int i;
252 
253 	(void) pthread_mutex_lock(&globalmutex);
254 
255 	if (!kernel_initialized) {
256 		return (CKR_CRYPTOKI_NOT_INITIALIZED);
257 	}
258 
259 	/* Check to see if pReseved is NULL */
260 	if (pReserved != NULL) {
261 		return (CKR_ARGUMENTS_BAD);
262 	}
263 
264 	/*
265 	 * Delete all the sessions for each slot and release the allocated
266 	 * resources
267 	 */
268 	for (i = 0; i < slot_count; i++) {
269 		kernel_delete_all_sessions(i, B_FALSE);
270 	}
271 
272 	finalize_common();
273 
274 	(void) pthread_mutex_unlock(&globalmutex);
275 
276 	return (CKR_OK);
277 }
278 
279 /*
280  * finalize_common() does the work for C_Finalize.  globalmutex
281  * must be held before calling this function.
282  */
283 static void
284 finalize_common() {
285 
286 	int i;
287 	kernel_object_t *delay_free_obj, *tmpo;
288 	kernel_session_t *delay_free_ses, *tmps;
289 
290 	/*
291 	 * Free the resources allocated for the slot table and reset
292 	 * slot_count to 0.
293 	 */
294 	if (slot_count > 0) {
295 		for (i = 0; i < slot_count; i++) {
296 			(void) pthread_mutex_destroy(&slot_table[i]->sl_mutex);
297 			(void) free(slot_table[i]);
298 		}
299 		(void) free(slot_table);
300 		slot_count = 0;
301 	}
302 
303 	/* Close CRYPTO_DEVICE */
304 	if (kernel_fd >= 0) {
305 		(void) close(kernel_fd);
306 	}
307 
308 	kernel_fd = -1;
309 	kernel_initialized = B_FALSE;
310 	kernel_pid = 0;
311 
312 	/*
313 	 * free all entries in the delay_freed list
314 	 */
315 	delay_free_obj = obj_delay_freed.first;
316 	while (delay_free_obj != NULL) {
317 		tmpo = delay_free_obj->next;
318 		free(delay_free_obj);
319 		delay_free_obj = tmpo;
320 	}
321 	(void) pthread_mutex_destroy(&obj_delay_freed.obj_to_be_free_mutex);
322 
323 	delay_free_ses = ses_delay_freed.first;
324 	while (delay_free_ses != NULL) {
325 		tmps = delay_free_ses->next;
326 		free(delay_free_ses);
327 		delay_free_ses = tmps;
328 	}
329 	(void) pthread_mutex_destroy(&ses_delay_freed.ses_to_be_free_mutex);
330 }
331 
332 /*
333  * This function cleans up all the resources in the library (user space only)
334  */
335 static void
336 cleanup_library()
337 {
338 	int i;
339 
340 	/*
341 	 * Delete all the sessions for each slot and release the allocated
342 	 * resources from the library.  The boolean argument TRUE indicates
343 	 * that we only wants to clean up the resource in the library only.
344 	 * We don't want to clean up the corresponding kernel part of
345 	 * resources, because they are used by the parent process still.
346 	 */
347 
348 	for (i = 0; i < slot_count; i++) {
349 		kernel_delete_all_sessions(i, B_TRUE);
350 	}
351 
352 	finalize_common();
353 }
354 
355 /*
356  * kernel_fini() function required to make sure complete cleanup
357  * is done if pkcs11_kernel is ever unloaded without
358  * a C_Finalize() call.
359  */
360 static void
361 kernel_fini()
362 {
363 
364 	(void) pthread_mutex_lock(&globalmutex);
365 
366 	/* if we're not initilized, do not attempt to finalize */
367 	if (!kernel_initialized) {
368 		(void) pthread_mutex_unlock(&globalmutex);
369 		return;
370 	}
371 
372 	cleanup_library();
373 
374 	(void) pthread_mutex_unlock(&globalmutex);
375 }
376 
377 CK_RV
378 C_GetInfo(CK_INFO_PTR pInfo)
379 {
380 	if (!kernel_initialized)
381 		return (CKR_CRYPTOKI_NOT_INITIALIZED);
382 
383 	if (pInfo == NULL) {
384 		return (CKR_ARGUMENTS_BAD);
385 	}
386 
387 	/* Check if the cryptoki was initialized */
388 
389 	pInfo->cryptokiVersion.major = CRYPTOKI_VERSION_MAJOR;
390 	pInfo->cryptokiVersion.minor = CRYPTOKI_VERSION_MINOR;
391 	(void) strncpy((char *)pInfo->manufacturerID,
392 	    MANUFACTURER_ID, 32);
393 	pInfo->flags = 0;
394 	(void) strncpy((char *)pInfo->libraryDescription,
395 	    LIBRARY_DESCRIPTION, 32);
396 	pInfo->libraryVersion.major = LIBRARY_VERSION_MAJOR;
397 	pInfo->libraryVersion.minor = LIBRARY_VERSION_MINOR;
398 
399 	return (CKR_OK);
400 }
401 
402 CK_RV
403 C_GetFunctionList(CK_FUNCTION_LIST_PTR_PTR ppFunctionList)
404 {
405 	if (ppFunctionList == NULL) {
406 		return (CKR_ARGUMENTS_BAD);
407 	}
408 
409 	*ppFunctionList = &functionList;
410 
411 	return (CKR_OK);
412 }
413 
414 /*
415  * PKCS#11 states that C_GetFunctionStatus should always return
416  * CKR_FUNCTION_NOT_PARALLEL
417  */
418 /*ARGSUSED*/
419 CK_RV
420 C_GetFunctionStatus(CK_SESSION_HANDLE hSession)
421 {
422 	return (CKR_FUNCTION_NOT_PARALLEL);
423 }
424 
425 /*
426  * PKCS#11 states that C_CancelFunction should always return
427  * CKR_FUNCTION_NOT_PARALLEL
428  */
429 /*ARGSUSED*/
430 CK_RV
431 C_CancelFunction(CK_SESSION_HANDLE hSession)
432 {
433 	return (CKR_FUNCTION_NOT_PARALLEL);
434 }
435