1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #pragma ident "%Z%%M% %I% %E% SMI" 27 28 #include <stdlib.h> 29 #include <string.h> 30 #include <strings.h> 31 #include <cryptoutil.h> 32 #include <errno.h> 33 #include <security/cryptoki.h> 34 #include <sys/crypto/common.h> 35 #include <sys/crypto/ioctl.h> 36 #include "kernelGlobal.h" 37 #include "kernelObject.h" 38 #include "kernelSlot.h" 39 40 #define ENCODE_ATTR(type, value, len) { \ 41 cur_attr->oa_type = type; \ 42 (void) memcpy(ptr, value, len); \ 43 cur_attr->oa_value = ptr; \ 44 cur_attr->oa_value_len = len; \ 45 cur_attr++; \ 46 } 47 48 #define CRYPTO_LAST_ERROR (CRYPTO_WEAK_KEY + 1) 49 50 /* 51 * In order to fit everything on one line, the 'CRYPTO_' prefix 52 * has been dropped from the KCF #defines, e.g. 53 * CRYPTO_SUCCESS becomes SUCCESS. 54 */ 55 56 static CK_RV error_number_table[CRYPTO_LAST_ERROR] = { 57 CKR_OK, /* SUCCESS */ 58 CKR_CANCEL, /* CANCEL */ 59 CKR_HOST_MEMORY, /* HOST_MEMORY */ 60 CKR_GENERAL_ERROR, /* GENERAL_ERROR */ 61 CKR_FUNCTION_FAILED, /* FAILED */ 62 CKR_ARGUMENTS_BAD, /* ARGUMENTS_BAD */ 63 CKR_ATTRIBUTE_READ_ONLY, /* ATTRIBUTE_READ_ONLY */ 64 CKR_ATTRIBUTE_SENSITIVE, /* ATTRIBUTE_SENSITIVE */ 65 CKR_ATTRIBUTE_TYPE_INVALID, /* ATTRIBUTE_TYPE_INVALID */ 66 CKR_ATTRIBUTE_VALUE_INVALID, /* ATTRIBUTE_VALUE_INVALID */ 67 CKR_FUNCTION_FAILED, /* CANCELED */ 68 CKR_DATA_INVALID, /* DATA_INVALID */ 69 CKR_DATA_LEN_RANGE, /* DATA_LEN_RANGE */ 70 CKR_DEVICE_ERROR, /* DEVICE_ERROR */ 71 CKR_DEVICE_MEMORY, /* DEVICE_MEMORY */ 72 CKR_DEVICE_REMOVED, /* DEVICE_REMOVED */ 73 CKR_ENCRYPTED_DATA_INVALID, /* ENCRYPTED_DATA_INVALID */ 74 CKR_ENCRYPTED_DATA_LEN_RANGE, /* ENCRYPTED_DATA_LEN_RANGE */ 75 CKR_KEY_HANDLE_INVALID, /* KEY_HANDLE_INVALID */ 76 CKR_KEY_SIZE_RANGE, /* KEY_SIZE_RANGE */ 77 CKR_KEY_TYPE_INCONSISTENT, /* KEY_TYPE_INCONSISTENT */ 78 CKR_KEY_NOT_NEEDED, /* KEY_NOT_NEEDED */ 79 CKR_KEY_CHANGED, /* KEY_CHANGED */ 80 CKR_KEY_NEEDED, /* KEY_NEEDED */ 81 CKR_KEY_INDIGESTIBLE, /* KEY_INDIGESTIBLE */ 82 CKR_KEY_FUNCTION_NOT_PERMITTED, /* KEY_FUNCTION_NOT_PERMITTED */ 83 CKR_KEY_NOT_WRAPPABLE, /* KEY_NOT_WRAPPABLE */ 84 CKR_KEY_UNEXTRACTABLE, /* KEY_UNEXTRACTABLE */ 85 CKR_MECHANISM_INVALID, /* MECHANISM_INVALID */ 86 CKR_MECHANISM_PARAM_INVALID, /* MECHANISM_PARAM_INVALID */ 87 CKR_OBJECT_HANDLE_INVALID, /* OBJECT_HANDLE_INVALID */ 88 CKR_OPERATION_ACTIVE, /* OPERATION_ACTIVE */ 89 CKR_OPERATION_NOT_INITIALIZED, /* OPERATION_NOT_INITIALIZED */ 90 CKR_PIN_INCORRECT, /* PIN_INCORRECT */ 91 CKR_PIN_INVALID, /* PIN_INVALID */ 92 CKR_PIN_LEN_RANGE, /* PIN_LEN_RANGE */ 93 CKR_PIN_EXPIRED, /* PIN_EXPIRED */ 94 CKR_PIN_LOCKED, /* PIN_LOCKED */ 95 CKR_SESSION_CLOSED, /* SESSION_CLOSED */ 96 CKR_SESSION_COUNT, /* SESSION_COUNT */ 97 CKR_SESSION_HANDLE_INVALID, /* SESSION_HANDLE_INVALID */ 98 CKR_SESSION_READ_ONLY, /* SESSION_READ_ONLY */ 99 CKR_SESSION_EXISTS, /* SESSION_EXISTS */ 100 CKR_SESSION_READ_ONLY_EXISTS, /* SESSION_READ_ONLY_EXISTS */ 101 CKR_SESSION_READ_WRITE_SO_EXISTS, /* SESSION_READ_WRITE_SO_EXISTS */ 102 CKR_SIGNATURE_INVALID, /* SIGNATURE_INVALID */ 103 CKR_SIGNATURE_LEN_RANGE, /* SIGNATURE_LEN_RANGE */ 104 CKR_TEMPLATE_INCOMPLETE, /* TEMPLATE_INCOMPLETE */ 105 CKR_TEMPLATE_INCONSISTENT, /* TEMPLATE_INCONSISTENT */ 106 CKR_UNWRAPPING_KEY_HANDLE_INVALID, /* UNWRAPPING_KEY_HANDLE_INVALID */ 107 CKR_UNWRAPPING_KEY_SIZE_RANGE, /* UNWRAPPING_KEY_SIZE_RANGE */ 108 CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT, /* UNWRAPPING_KEY_TYPE_INCONSISTENT */ 109 CKR_USER_ALREADY_LOGGED_IN, /* USER_ALREADY_LOGGED_IN */ 110 CKR_USER_NOT_LOGGED_IN, /* USER_NOT_LOGGED_IN */ 111 CKR_USER_PIN_NOT_INITIALIZED, /* USER_PIN_NOT_INITIALIZED */ 112 CKR_USER_TYPE_INVALID, /* USER_TYPE_INVALID */ 113 CKR_USER_ANOTHER_ALREADY_LOGGED_IN, /* USER_ANOTHER_ALREADY_LOGGED_IN */ 114 CKR_USER_TOO_MANY_TYPES, /* USER_TOO_MANY_TYPES */ 115 CKR_WRAPPED_KEY_INVALID, /* WRAPPED_KEY_INVALID */ 116 CKR_WRAPPED_KEY_LEN_RANGE, /* WRAPPED_KEY_LEN_RANGE */ 117 CKR_WRAPPING_KEY_HANDLE_INVALID, /* WRAPPING_KEY_HANDLE_INVALID */ 118 CKR_WRAPPING_KEY_SIZE_RANGE, /* WRAPPING_KEY_SIZE_RANGE */ 119 CKR_WRAPPING_KEY_TYPE_INCONSISTENT, /* WRAPPING_KEY_TYPE_INCONSISTENT */ 120 CKR_RANDOM_SEED_NOT_SUPPORTED, /* RANDOM_SEED_NOT_SUPPORTED */ 121 CKR_RANDOM_NO_RNG, /* RANDOM_NO_RNG */ 122 CKR_DOMAIN_PARAMS_INVALID, /* DOMAIN_PARAMS_INVALID */ 123 CKR_BUFFER_TOO_SMALL, /* BUFFER_TOO_SMALL */ 124 CKR_INFORMATION_SENSITIVE, /* INFORMATION_SENSITIVE */ 125 CKR_FUNCTION_NOT_SUPPORTED, /* NOT_SUPPORTED */ 126 CKR_GENERAL_ERROR, /* QUEUED */ 127 CKR_GENERAL_ERROR, /* BUFFER_TOO_BIG */ 128 CKR_OPERATION_NOT_INITIALIZED, /* INVALID_CONTEXT */ 129 CKR_GENERAL_ERROR, /* INVALID_MAC */ 130 CKR_GENERAL_ERROR, /* MECH_NOT_SUPPORTED */ 131 CKR_GENERAL_ERROR, /* INCONSISTENT_ATTRIBUTE */ 132 CKR_GENERAL_ERROR, /* NO_PERMISSION */ 133 CKR_SLOT_ID_INVALID, /* INVALID_PROVIDER_ID */ 134 CKR_GENERAL_ERROR, /* VERSION_MISMATCH */ 135 CKR_GENERAL_ERROR, /* BUSY */ 136 CKR_GENERAL_ERROR, /* UNKNOWN_PROVIDER */ 137 CKR_GENERAL_ERROR, /* MODVERIFICATION_FAILED */ 138 CKR_GENERAL_ERROR, /* OLD_CTX_TEMPLATE */ 139 CKR_GENERAL_ERROR, /* WEAK_KEY */ 140 }; 141 142 /* 143 * Map KCF error codes into PKCS11 error codes. 144 */ 145 CK_RV 146 crypto2pkcs11_error_number(uint_t n) 147 { 148 if (n > CRYPTO_LAST_ERROR) 149 return (CKR_GENERAL_ERROR); 150 151 return (error_number_table[n]); 152 } 153 154 #define MECH_HASH(type) (((uintptr_t)type) % KMECH_HASHTABLE_SIZE) 155 /* 156 * Serialize writes to the hash table. We don't need a per bucket lock as 157 * there are only a few writes and we don't need the lock for reads. 158 */ 159 static pthread_mutex_t mechhash_mutex = PTHREAD_MUTEX_INITIALIZER; 160 161 static CK_RV 162 kmech_hash_insert(CK_MECHANISM_TYPE type, crypto_mech_type_t kmech) 163 { 164 uint_t h; 165 kmh_elem_t *elem, *cur; 166 167 elem = malloc(sizeof (kmh_elem_t)); 168 if (elem == NULL) 169 return (CKR_HOST_MEMORY); 170 171 h = MECH_HASH(type); 172 elem->type = type; 173 elem->kmech = kmech; 174 175 (void) pthread_mutex_lock(&mechhash_mutex); 176 for (cur = kernel_mechhash[h]; cur != NULL; cur = cur->knext) { 177 if (type == cur->type) { 178 /* Some other thread beat us to it. */ 179 (void) pthread_mutex_unlock(&mechhash_mutex); 180 free(elem); 181 return (CKR_OK); 182 } 183 } 184 elem->knext = kernel_mechhash[h]; 185 kernel_mechhash[h] = elem; 186 (void) pthread_mutex_unlock(&mechhash_mutex); 187 188 return (CKR_OK); 189 } 190 191 CK_RV 192 kernel_mech(CK_MECHANISM_TYPE type, crypto_mech_type_t *k_number) 193 { 194 crypto_get_mechanism_number_t get_number; 195 char *string; 196 CK_RV rv; 197 int r; 198 kmh_elem_t *elem; 199 uint_t h; 200 201 /* 202 * Search for an existing entry. No need to lock since we are 203 * just a reader and we never free the entries in the hash table. 204 */ 205 h = MECH_HASH(type); 206 for (elem = kernel_mechhash[h]; elem != NULL; elem = elem->knext) { 207 if (type == elem->type) { 208 *k_number = elem->kmech; 209 return (CKR_OK); 210 } 211 } 212 213 string = pkcs11_mech2str(type); 214 if (string == NULL) 215 return (CKR_MECHANISM_INVALID); 216 217 get_number.pn_mechanism_string = string; 218 get_number.pn_mechanism_len = strlen(string) + 1; 219 220 while ((r = ioctl(kernel_fd, CRYPTO_GET_MECHANISM_NUMBER, 221 &get_number)) < 0) { 222 if (errno != EINTR) 223 break; 224 } 225 if (r < 0) { 226 rv = CKR_MECHANISM_INVALID; 227 } else { 228 if (get_number.pn_return_value != CRYPTO_SUCCESS) { 229 rv = crypto2pkcs11_error_number( 230 get_number.pn_return_value); 231 } else { 232 rv = CKR_OK; 233 } 234 } 235 236 if (rv == CKR_OK) { 237 *k_number = get_number.pn_internal_number; 238 /* Add this to the hash table */ 239 (void) kmech_hash_insert(type, *k_number); 240 } 241 242 free(string); 243 return (rv); 244 } 245 246 247 /* 248 * Return the value of a secret key object. 249 * This routine allocates memory for the value. 250 * A null pointer is returned on error. 251 */ 252 unsigned char * 253 get_symmetric_key_value(kernel_object_t *key_p) 254 { 255 uint8_t *cipherKey; 256 257 switch (key_p->class) { 258 259 case CKO_SECRET_KEY: 260 261 cipherKey = malloc(OBJ_SEC(key_p)->sk_value_len); 262 if (cipherKey == NULL) 263 return (NULL); 264 265 (void) memcpy(cipherKey, OBJ_SEC(key_p)->sk_value, 266 OBJ_SEC(key_p)->sk_value_len); 267 268 return (cipherKey); 269 270 default: 271 return (NULL); 272 } 273 } 274 275 /* 276 * Convert a RSA private key object into a crypto_key structure. 277 * Memory is allocated for each attribute stored in the crypto_key 278 * structure. Memory for the crypto_key structure is not 279 * allocated. Attributes can be freed by free_key_attributes(). 280 */ 281 CK_RV 282 get_rsa_private_key(kernel_object_t *object_p, crypto_key_t *key) 283 { 284 biginteger_t *big; 285 crypto_object_attribute_t *attrs, *cur_attr; 286 char *ptr; 287 CK_RV rv; 288 289 (void) pthread_mutex_lock(&object_p->object_mutex); 290 if (object_p->key_type != CKK_RSA || 291 object_p->class != CKO_PRIVATE_KEY) { 292 (void) pthread_mutex_unlock(&object_p->object_mutex); 293 return (CKR_ATTRIBUTE_TYPE_INVALID); 294 } 295 296 attrs = calloc(1, 297 RSA_PRI_ATTR_COUNT * sizeof (crypto_object_attribute_t)); 298 if (attrs == NULL) { 299 (void) pthread_mutex_unlock(&object_p->object_mutex); 300 return (CKR_HOST_MEMORY); 301 } 302 303 key->ck_format = CRYPTO_KEY_ATTR_LIST; 304 key->ck_attrs = attrs; 305 cur_attr = attrs; 306 307 /* 308 * Allocate memory for each key attribute and set up the value 309 * value length. 310 */ 311 key->ck_count = 0; 312 313 /* CKA_MODULUS is required. */ 314 big = OBJ_PRI_RSA_MOD(object_p); 315 if (big->big_value == NULL) { 316 rv = CKR_ATTRIBUTE_TYPE_INVALID; 317 goto fail_cleanup; 318 } else { 319 if ((ptr = malloc(big->big_value_len)) == NULL) { 320 rv = CKR_HOST_MEMORY; 321 goto fail_cleanup; 322 } 323 ENCODE_ATTR(CKA_MODULUS, big->big_value, big->big_value_len); 324 key->ck_count++; 325 } 326 327 /* CKA_PRIVATE_EXPONENT is required. */ 328 big = OBJ_PRI_RSA_PRIEXPO(object_p); 329 if (big->big_value == NULL) { 330 rv = CKR_ATTRIBUTE_TYPE_INVALID; 331 goto fail_cleanup; 332 } else { 333 if ((ptr = malloc(big->big_value_len)) == NULL) { 334 rv = CKR_HOST_MEMORY; 335 goto fail_cleanup; 336 } 337 ENCODE_ATTR(CKA_PRIVATE_EXPONENT, big->big_value, 338 big->big_value_len); 339 key->ck_count++; 340 } 341 342 /* CKA_PRIME_1 is optional. */ 343 big = OBJ_PRI_RSA_PRIME1(object_p); 344 if (big->big_value != NULL) { 345 if ((ptr = malloc(big->big_value_len)) == NULL) { 346 rv = CKR_HOST_MEMORY; 347 goto fail_cleanup; 348 } 349 ENCODE_ATTR(CKA_PRIME_1, big->big_value, big->big_value_len); 350 key->ck_count++; 351 } 352 353 /* CKA_PRIME_2 is optional. */ 354 big = OBJ_PRI_RSA_PRIME2(object_p); 355 if (big->big_value != NULL) { 356 if ((ptr = malloc(big->big_value_len)) == NULL) { 357 rv = CKR_HOST_MEMORY; 358 goto fail_cleanup; 359 } 360 ENCODE_ATTR(CKA_PRIME_2, big->big_value, big->big_value_len); 361 key->ck_count++; 362 } 363 364 /* CKA_EXPONENT_1 is optional. */ 365 big = OBJ_PRI_RSA_EXPO1(object_p); 366 if (big->big_value != NULL) { 367 if ((ptr = malloc(big->big_value_len)) == NULL) { 368 rv = CKR_HOST_MEMORY; 369 goto fail_cleanup; 370 } 371 ENCODE_ATTR(CKA_EXPONENT_1, big->big_value, 372 big->big_value_len); 373 key->ck_count++; 374 } 375 376 /* CKA_EXPONENT_2 is optional. */ 377 big = OBJ_PRI_RSA_EXPO2(object_p); 378 if (big->big_value != NULL) { 379 if ((ptr = malloc(big->big_value_len)) == NULL) { 380 rv = CKR_HOST_MEMORY; 381 goto fail_cleanup; 382 } 383 ENCODE_ATTR(CKA_EXPONENT_2, big->big_value, 384 big->big_value_len); 385 key->ck_count++; 386 } 387 388 /* CKA_COEFFICIENT is optional. */ 389 big = OBJ_PRI_RSA_COEF(object_p); 390 if (big->big_value != NULL) { 391 if ((ptr = malloc(big->big_value_len)) == NULL) { 392 rv = CKR_HOST_MEMORY; 393 goto fail_cleanup; 394 } 395 ENCODE_ATTR(CKA_COEFFICIENT, big->big_value, 396 big->big_value_len); 397 key->ck_count++; 398 } 399 400 (void) pthread_mutex_unlock(&object_p->object_mutex); 401 return (CKR_OK); 402 403 fail_cleanup: 404 (void) pthread_mutex_unlock(&object_p->object_mutex); 405 free_key_attributes(key); 406 return (rv); 407 } 408 409 /* 410 * Convert a RSA public key object into a crypto_key structure. 411 * Memory is allocated for each attribute stored in the crypto_key 412 * structure. Memory for the crypto_key structure is not 413 * allocated. Attributes can be freed by free_key_attributes(). 414 */ 415 CK_RV 416 get_rsa_public_key(kernel_object_t *object_p, crypto_key_t *key) 417 { 418 biginteger_t *big; 419 crypto_object_attribute_t *attrs, *cur_attr; 420 char *ptr; 421 422 (void) pthread_mutex_lock(&object_p->object_mutex); 423 if (object_p->key_type != CKK_RSA || 424 object_p->class != CKO_PUBLIC_KEY) { 425 (void) pthread_mutex_unlock(&object_p->object_mutex); 426 return (CKR_ATTRIBUTE_TYPE_INVALID); 427 } 428 429 attrs = calloc(1, 430 RSA_PUB_ATTR_COUNT * sizeof (crypto_object_attribute_t)); 431 if (attrs == NULL) { 432 (void) pthread_mutex_unlock(&object_p->object_mutex); 433 return (CKR_HOST_MEMORY); 434 } 435 436 key->ck_format = CRYPTO_KEY_ATTR_LIST; 437 key->ck_count = RSA_PUB_ATTR_COUNT; 438 key->ck_attrs = attrs; 439 440 cur_attr = attrs; 441 big = OBJ_PUB_RSA_PUBEXPO(object_p); 442 if ((ptr = malloc(big->big_value_len)) == NULL) 443 goto mem_failure; 444 ENCODE_ATTR(CKA_PUBLIC_EXPONENT, big->big_value, big->big_value_len); 445 446 big = OBJ_PUB_RSA_MOD(object_p); 447 if ((ptr = malloc(big->big_value_len)) == NULL) 448 goto mem_failure; 449 ENCODE_ATTR(CKA_MODULUS, big->big_value, big->big_value_len); 450 451 if ((ptr = malloc(sizeof (CK_ULONG))) == NULL) 452 goto mem_failure; 453 ENCODE_ATTR(CKA_MODULUS_BITS, &OBJ_PUB_RSA_MOD_BITS(object_p), 454 sizeof (CK_ULONG)); 455 456 (void) pthread_mutex_unlock(&object_p->object_mutex); 457 return (CKR_OK); 458 459 mem_failure: 460 (void) pthread_mutex_unlock(&object_p->object_mutex); 461 free_key_attributes(key); 462 return (CKR_HOST_MEMORY); 463 } 464 465 /* 466 * Free attribute storage in a crypto_key structure. 467 */ 468 void 469 free_key_attributes(crypto_key_t *key) 470 { 471 int i; 472 473 if (key->ck_format == CRYPTO_KEY_ATTR_LIST && 474 (key->ck_count > 0) && key->ck_attrs != NULL) { 475 for (i = 0; i < key->ck_count; i++) { 476 if (key->ck_attrs[i].oa_value != NULL) { 477 bzero(key->ck_attrs[i].oa_value, 478 key->ck_attrs[i].oa_value_len); 479 free(key->ck_attrs[i].oa_value); 480 } 481 } 482 free(key->ck_attrs); 483 } 484 } 485 486 487 /* 488 * Convert a DSA private key object into a crypto_key structure. 489 * Memory is allocated for each attribute stored in the crypto_key 490 * structure. Memory for the crypto_key structure is not 491 * allocated. Attributes can be freed by free_dsa_key_attributes(). 492 */ 493 CK_RV 494 get_dsa_private_key(kernel_object_t *object_p, crypto_key_t *key) 495 { 496 biginteger_t *big; 497 crypto_object_attribute_t *attrs, *cur_attr; 498 char *ptr; 499 500 (void) pthread_mutex_lock(&object_p->object_mutex); 501 if (object_p->key_type != CKK_DSA || 502 object_p->class != CKO_PRIVATE_KEY) { 503 (void) pthread_mutex_unlock(&object_p->object_mutex); 504 return (CKR_ATTRIBUTE_TYPE_INVALID); 505 } 506 507 attrs = calloc(1, 508 DSA_ATTR_COUNT * sizeof (crypto_object_attribute_t)); 509 if (attrs == NULL) { 510 (void) pthread_mutex_unlock(&object_p->object_mutex); 511 return (CKR_HOST_MEMORY); 512 } 513 514 key->ck_format = CRYPTO_KEY_ATTR_LIST; 515 key->ck_count = DSA_ATTR_COUNT; 516 key->ck_attrs = attrs; 517 518 cur_attr = attrs; 519 big = OBJ_PRI_DSA_PRIME(object_p); 520 if ((ptr = malloc(big->big_value_len)) == NULL) 521 goto mem_failure; 522 ENCODE_ATTR(CKA_PRIME, big->big_value, big->big_value_len); 523 524 big = OBJ_PRI_DSA_SUBPRIME(object_p); 525 if ((ptr = malloc(big->big_value_len)) == NULL) 526 goto mem_failure; 527 ENCODE_ATTR(CKA_SUBPRIME, big->big_value, big->big_value_len); 528 529 big = OBJ_PRI_DSA_BASE(object_p); 530 if ((ptr = malloc(big->big_value_len)) == NULL) 531 goto mem_failure; 532 ENCODE_ATTR(CKA_BASE, big->big_value, big->big_value_len); 533 534 big = OBJ_PRI_DSA_VALUE(object_p); 535 if ((ptr = malloc(big->big_value_len)) == NULL) 536 goto mem_failure; 537 ENCODE_ATTR(CKA_VALUE, big->big_value, big->big_value_len); 538 539 (void) pthread_mutex_unlock(&object_p->object_mutex); 540 return (CKR_OK); 541 542 mem_failure: 543 (void) pthread_mutex_unlock(&object_p->object_mutex); 544 free_key_attributes(key); 545 return (CKR_HOST_MEMORY); 546 } 547 548 549 /* 550 * Convert a DSA public key object into a crypto_key structure. 551 * Memory is allocated for each attribute stored in the crypto_key 552 * structure. Memory for the crypto_key structure is not 553 * allocated. Attributes can be freed by free_dsa_key_attributes(). 554 */ 555 CK_RV 556 get_dsa_public_key(kernel_object_t *object_p, crypto_key_t *key) 557 { 558 biginteger_t *big; 559 crypto_object_attribute_t *attrs, *cur_attr; 560 char *ptr; 561 562 (void) pthread_mutex_lock(&object_p->object_mutex); 563 if (object_p->key_type != CKK_DSA || 564 object_p->class != CKO_PUBLIC_KEY) { 565 (void) pthread_mutex_unlock(&object_p->object_mutex); 566 return (CKR_ATTRIBUTE_TYPE_INVALID); 567 } 568 569 attrs = calloc(1, 570 DSA_ATTR_COUNT * sizeof (crypto_object_attribute_t)); 571 if (attrs == NULL) { 572 (void) pthread_mutex_unlock(&object_p->object_mutex); 573 return (CKR_HOST_MEMORY); 574 } 575 576 key->ck_format = CRYPTO_KEY_ATTR_LIST; 577 key->ck_count = DSA_ATTR_COUNT; 578 key->ck_attrs = attrs; 579 580 cur_attr = attrs; 581 big = OBJ_PUB_DSA_PRIME(object_p); 582 if ((ptr = malloc(big->big_value_len)) == NULL) 583 goto mem_failure; 584 ENCODE_ATTR(CKA_PRIME, big->big_value, big->big_value_len); 585 586 big = OBJ_PUB_DSA_SUBPRIME(object_p); 587 if ((ptr = malloc(big->big_value_len)) == NULL) 588 goto mem_failure; 589 ENCODE_ATTR(CKA_SUBPRIME, big->big_value, big->big_value_len); 590 591 big = OBJ_PUB_DSA_BASE(object_p); 592 if ((ptr = malloc(big->big_value_len)) == NULL) 593 goto mem_failure; 594 ENCODE_ATTR(CKA_BASE, big->big_value, big->big_value_len); 595 596 big = OBJ_PUB_DSA_VALUE(object_p); 597 if ((ptr = malloc(big->big_value_len)) == NULL) 598 goto mem_failure; 599 ENCODE_ATTR(CKA_VALUE, big->big_value, big->big_value_len); 600 601 (void) pthread_mutex_unlock(&object_p->object_mutex); 602 return (CKR_OK); 603 604 mem_failure: 605 (void) pthread_mutex_unlock(&object_p->object_mutex); 606 free_key_attributes(key); 607 return (CKR_HOST_MEMORY); 608 } 609 610 611 /* 612 * Convert a EC private key object into a crypto_key structure. 613 * Memory is allocated for each attribute stored in the crypto_key 614 * structure. Memory for the crypto_key structure is not 615 * allocated. Attributes can be freed by free_ec_key_attributes(). 616 */ 617 CK_RV 618 get_ec_private_key(kernel_object_t *object_p, crypto_key_t *key) 619 { 620 biginteger_t *big; 621 crypto_object_attribute_t *attrs, *cur_attr; 622 CK_ATTRIBUTE tmp; 623 char *ptr; 624 int rv; 625 626 (void) pthread_mutex_lock(&object_p->object_mutex); 627 if (object_p->key_type != CKK_EC || 628 object_p->class != CKO_PRIVATE_KEY) { 629 (void) pthread_mutex_unlock(&object_p->object_mutex); 630 return (CKR_ATTRIBUTE_TYPE_INVALID); 631 } 632 633 attrs = calloc(EC_ATTR_COUNT, sizeof (crypto_object_attribute_t)); 634 if (attrs == NULL) { 635 (void) pthread_mutex_unlock(&object_p->object_mutex); 636 return (CKR_HOST_MEMORY); 637 } 638 639 key->ck_format = CRYPTO_KEY_ATTR_LIST; 640 key->ck_count = EC_ATTR_COUNT; 641 key->ck_attrs = attrs; 642 643 cur_attr = attrs; 644 big = OBJ_PRI_EC_VALUE(object_p); 645 if ((ptr = malloc(big->big_value_len)) == NULL) { 646 rv = CKR_HOST_MEMORY; 647 goto fail; 648 } 649 ENCODE_ATTR(CKA_VALUE, big->big_value, big->big_value_len); 650 651 tmp.type = CKA_EC_PARAMS; 652 tmp.pValue = NULL; 653 rv = kernel_get_attribute(object_p, &tmp); 654 if (rv != CKR_OK) { 655 goto fail; 656 } 657 658 tmp.pValue = malloc(tmp.ulValueLen); 659 if (tmp.pValue == NULL) { 660 rv = CKR_HOST_MEMORY; 661 goto fail; 662 } 663 664 rv = kernel_get_attribute(object_p, &tmp); 665 if (rv != CKR_OK) { 666 free(tmp.pValue); 667 goto fail; 668 } 669 670 cur_attr->oa_type = tmp.type; 671 cur_attr->oa_value = tmp.pValue; 672 cur_attr->oa_value_len = tmp.ulValueLen; 673 674 (void) pthread_mutex_unlock(&object_p->object_mutex); 675 return (CKR_OK); 676 677 fail: 678 (void) pthread_mutex_unlock(&object_p->object_mutex); 679 free_key_attributes(key); 680 return (rv); 681 } 682 683 /* 684 * Convert an EC public key object into a crypto_key structure. 685 * Memory is allocated for each attribute stored in the crypto_key 686 * structure. Memory for the crypto_key structure is not 687 * allocated. Attributes can be freed by free_ec_key_attributes(). 688 */ 689 CK_RV 690 get_ec_public_key(kernel_object_t *object_p, crypto_key_t *key) 691 { 692 biginteger_t *big; 693 crypto_object_attribute_t *attrs, *cur_attr; 694 CK_ATTRIBUTE tmp; 695 char *ptr; 696 int rv; 697 698 (void) pthread_mutex_lock(&object_p->object_mutex); 699 if (object_p->key_type != CKK_EC || 700 object_p->class != CKO_PUBLIC_KEY) { 701 (void) pthread_mutex_unlock(&object_p->object_mutex); 702 return (CKR_ATTRIBUTE_TYPE_INVALID); 703 } 704 705 attrs = calloc(EC_ATTR_COUNT, sizeof (crypto_object_attribute_t)); 706 if (attrs == NULL) { 707 (void) pthread_mutex_unlock(&object_p->object_mutex); 708 return (CKR_HOST_MEMORY); 709 } 710 711 key->ck_format = CRYPTO_KEY_ATTR_LIST; 712 key->ck_count = EC_ATTR_COUNT; 713 key->ck_attrs = attrs; 714 715 cur_attr = attrs; 716 big = OBJ_PUB_EC_POINT(object_p); 717 if ((ptr = malloc(big->big_value_len)) == NULL) { 718 rv = CKR_HOST_MEMORY; 719 goto fail; 720 } 721 ENCODE_ATTR(CKA_EC_POINT, big->big_value, big->big_value_len); 722 723 tmp.type = CKA_EC_PARAMS; 724 tmp.pValue = NULL; 725 rv = kernel_get_attribute(object_p, &tmp); 726 if (rv != CKR_OK) { 727 goto fail; 728 } 729 730 tmp.pValue = malloc(tmp.ulValueLen); 731 if (tmp.pValue == NULL) { 732 rv = CKR_HOST_MEMORY; 733 goto fail; 734 } 735 736 rv = kernel_get_attribute(object_p, &tmp); 737 if (rv != CKR_OK) { 738 free(tmp.pValue); 739 goto fail; 740 } 741 742 cur_attr->oa_type = tmp.type; 743 cur_attr->oa_value = tmp.pValue; 744 cur_attr->oa_value_len = tmp.ulValueLen; 745 746 (void) pthread_mutex_unlock(&object_p->object_mutex); 747 return (CKR_OK); 748 749 fail: 750 (void) pthread_mutex_unlock(&object_p->object_mutex); 751 free_key_attributes(key); 752 return (rv); 753 } 754 755 /* 756 * Convert an attribute template into an obj_attrs array. 757 * Memory is allocated for each attribute stored in the obj_attrs. 758 * The memory can be freed by free_object_attributes(). 759 * 760 * If the boolean pointer is_token_obj is not NULL, the caller wants to 761 * retrieve the value of the CKA_TOKEN attribute if it is specified in the 762 * template. 763 * - When this routine is called thru C_CreateObject(), C_CopyObject(), or 764 * any key management function, is_token_obj should NOT be NULL. 765 * - When this routine is called thru C_GetAttributeValue() or 766 * C_SetAttributeValue(), "is_token_obj" should be NULL. 767 */ 768 CK_RV 769 process_object_attributes(CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, 770 caddr_t *obj_attrs, CK_BBOOL *is_token_obj) 771 { 772 crypto_object_attribute_t *attrs, *cur_attr; 773 int i, cur_i; 774 char *ptr; 775 CK_RV rv; 776 ssize_t value_len; 777 778 if (ulCount == 0) { 779 obj_attrs = NULL; 780 return (CKR_OK); 781 } 782 783 attrs = calloc(1, ulCount * sizeof (crypto_object_attribute_t)); 784 if (attrs == NULL) { 785 return (CKR_HOST_MEMORY); 786 } 787 788 cur_attr = attrs; 789 for (i = 0; i < ulCount; i++) { 790 /* 791 * The length of long attributes must be set correctly 792 * so providers can determine whether they came from 32 793 * or 64-bit applications. 794 */ 795 switch (pTemplate[i].type) { 796 case CKA_CLASS: 797 case CKA_CERTIFICATE_TYPE: 798 case CKA_KEY_TYPE: 799 case CKA_MODULUS_BITS: 800 case CKA_HW_FEATURE_TYPE: 801 value_len = sizeof (ulong_t); 802 if (pTemplate[i].pValue != NULL && 803 (pTemplate[i].ulValueLen < value_len)) { 804 rv = CKR_BUFFER_TOO_SMALL; 805 cur_i = i; 806 goto fail_cleanup; 807 } 808 break; 809 default: 810 value_len = pTemplate[i].ulValueLen; 811 } 812 813 cur_attr->oa_type = pTemplate[i].type; 814 cur_attr->oa_value_len = value_len; 815 cur_attr->oa_value = NULL; 816 817 if ((pTemplate[i].pValue != NULL) && 818 (pTemplate[i].ulValueLen > 0)) { 819 ptr = malloc(pTemplate[i].ulValueLen); 820 if (ptr == NULL) { 821 rv = CKR_HOST_MEMORY; 822 cur_i = i; 823 goto fail_cleanup; 824 } else { 825 (void) memcpy(ptr, pTemplate[i].pValue, 826 pTemplate[i].ulValueLen); 827 cur_attr->oa_value = ptr; 828 } 829 } 830 831 if ((is_token_obj != NULL) && 832 (pTemplate[i].type == CKA_TOKEN)) { 833 /* Get the CKA_TOKEN attribute value. */ 834 if (pTemplate[i].pValue == NULL) { 835 rv = CKR_ATTRIBUTE_VALUE_INVALID; 836 cur_i = i; 837 goto fail_cleanup; 838 } else { 839 *is_token_obj = 840 *(CK_BBOOL *)pTemplate[i].pValue; 841 } 842 } 843 844 cur_attr++; 845 } 846 847 *obj_attrs = (char *)attrs; 848 return (CKR_OK); 849 850 fail_cleanup: 851 cur_attr = attrs; 852 for (i = 0; i < cur_i; i++) { 853 if (cur_attr->oa_value != NULL) { 854 (void) free(cur_attr->oa_value); 855 } 856 cur_attr++; 857 } 858 859 (void) free(attrs); 860 return (rv); 861 } 862 863 864 /* 865 * Copy the attribute values from obj_attrs to pTemplate. 866 * The obj_attrs is an image of the Template and is expected to have the 867 * same attributes in the same order and each one of the attribute pValue 868 * in obj_attr has enough space allocated for the corresponding valueLen 869 * in pTemplate. 870 */ 871 CK_RV 872 get_object_attributes(CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, 873 caddr_t obj_attrs) 874 { 875 crypto_object_attribute_t *cur_attr; 876 CK_RV rv = CKR_OK; 877 int i; 878 879 /* LINTED */ 880 cur_attr = (crypto_object_attribute_t *)obj_attrs; 881 for (i = 0; i < ulCount; i++) { 882 if (pTemplate[i].type != cur_attr->oa_type) { 883 /* The attribute type doesn't match, this is bad. */ 884 rv = CKR_FUNCTION_FAILED; 885 return (rv); 886 } 887 888 pTemplate[i].ulValueLen = cur_attr->oa_value_len; 889 890 if ((pTemplate[i].pValue != NULL) && 891 ((CK_LONG)pTemplate[i].ulValueLen != -1)) { 892 (void) memcpy(pTemplate[i].pValue, cur_attr->oa_value, 893 pTemplate[i].ulValueLen); 894 } 895 cur_attr++; 896 } 897 898 return (rv); 899 } 900 901 /* 902 * Free the attribute storage in a crypto_object_attribute_t structure. 903 */ 904 void 905 free_object_attributes(caddr_t obj_attrs, CK_ULONG ulCount) 906 { 907 crypto_object_attribute_t *cur_attr; 908 int i; 909 910 if ((ulCount == 0) || (obj_attrs == NULL)) { 911 return; 912 } 913 914 /* LINTED */ 915 cur_attr = (crypto_object_attribute_t *)obj_attrs; 916 for (i = 0; i < ulCount; i++) { 917 /* XXX check that oa_value > 0 */ 918 if (cur_attr->oa_value != NULL) { 919 free(cur_attr->oa_value); 920 } 921 cur_attr++; 922 } 923 924 free(obj_attrs); 925 } 926 927 /* 928 * This function is called by process_found_objects(). It will check the 929 * CKA_PRIVATE and CKA_TOKEN attributes for the kernel object "oid", then 930 * initialize all the necessary fields in the object wrapper "objp". 931 */ 932 static CK_RV 933 create_new_tobj_in_lib(kernel_slot_t *pslot, kernel_session_t *sp, 934 kernel_object_t *objp, crypto_object_id_t oid) 935 { 936 CK_RV rv = CKR_OK; 937 crypto_object_get_attribute_value_t obj_ga; 938 boolean_t is_pri_obj; 939 boolean_t is_token_obj; 940 CK_BBOOL pri_value, token_value; 941 CK_ATTRIBUTE pTemplate[2]; 942 int r; 943 944 /* 945 * Make a CRYPTO_OBJECT_GET_ATTRIBUTE_VALUE ioctl call to get this 946 * kernel object's attribute values for CKA_PRIVATE and CKA_TOKEN. 947 */ 948 obj_ga.og_session = sp->k_session; 949 obj_ga.og_handle = oid; 950 obj_ga.og_count = 2; 951 952 pTemplate[0].type = CKA_PRIVATE; 953 pTemplate[0].pValue = &pri_value; 954 pTemplate[0].ulValueLen = sizeof (pri_value); 955 pTemplate[1].type = CKA_TOKEN; 956 pTemplate[1].pValue = &token_value; 957 pTemplate[1].ulValueLen = sizeof (token_value); 958 rv = process_object_attributes(pTemplate, 2, &obj_ga.og_attributes, 959 NULL); 960 if (rv != CKR_OK) { 961 return (rv); 962 } 963 964 while ((r = ioctl(kernel_fd, CRYPTO_OBJECT_GET_ATTRIBUTE_VALUE, 965 &obj_ga)) < 0) { 966 if (errno != EINTR) 967 break; 968 } 969 if (r < 0) { 970 rv = CKR_FUNCTION_FAILED; 971 } else { 972 rv = crypto2pkcs11_error_number(obj_ga.og_return_value); 973 } 974 975 if (rv == CKR_OK) { 976 rv = get_object_attributes(pTemplate, 2, obj_ga.og_attributes); 977 if (rv == CKR_OK) { 978 is_pri_obj = *(CK_BBOOL *)pTemplate[0].pValue; 979 is_token_obj = *(CK_BBOOL *)pTemplate[1].pValue; 980 } 981 } 982 983 free_object_attributes(obj_ga.og_attributes, 2); 984 if (rv != CKR_OK) { 985 return (rv); 986 } 987 988 /* Make sure it is a token object. */ 989 if (!is_token_obj) { 990 rv = CKR_ATTRIBUTE_VALUE_INVALID; 991 return (rv); 992 } 993 994 /* If it is a private object, make sure the user has logged in. */ 995 if (is_pri_obj && (pslot->sl_state != CKU_USER)) { 996 rv = CKR_ATTRIBUTE_VALUE_INVALID; 997 return (rv); 998 } 999 1000 objp->is_lib_obj = B_FALSE; 1001 objp->k_handle = oid; 1002 objp->bool_attr_mask |= TOKEN_BOOL_ON; 1003 if (is_pri_obj) { 1004 objp->bool_attr_mask |= PRIVATE_BOOL_ON; 1005 } else { 1006 objp->bool_attr_mask &= ~PRIVATE_BOOL_ON; 1007 } 1008 1009 (void) pthread_mutex_init(&objp->object_mutex, NULL); 1010 objp->magic_marker = KERNELTOKEN_OBJECT_MAGIC; 1011 objp->session_handle = (CK_SESSION_HANDLE) sp; 1012 1013 return (CKR_OK); 1014 } 1015 1016 /* 1017 * This function processes the kernel object handles returned from the 1018 * CRYPTO_OBJECT_FIND_UPDATE ioctl and returns an object handle list 1019 * and the number of object handles to the caller - C_FindObjects(). 1020 * The caller acquires the slot lock and the session lock. 1021 */ 1022 CK_RV 1023 process_found_objects(kernel_session_t *cur_sp, CK_OBJECT_HANDLE *obj_found, 1024 CK_ULONG *found_obj_count, crypto_object_find_update_t obj_fu) 1025 { 1026 CK_RV rv = CKR_OK; 1027 crypto_object_id_t *oid_p; 1028 kernel_slot_t *pslot; 1029 kernel_object_t *objp; 1030 kernel_object_t *objp1; 1031 kernel_object_t *new_tobj_list = NULL; 1032 kernel_session_t *sp; 1033 CK_ULONG num_obj_found = 0; 1034 boolean_t is_in_lib; 1035 int i; 1036 1037 if (obj_fu.fu_count == 0) { 1038 *found_obj_count = 0; 1039 return (CKR_OK); 1040 } 1041 1042 pslot = slot_table[cur_sp->ses_slotid]; 1043 1044 /* LINTED */ 1045 oid_p = (crypto_object_id_t *)obj_fu.fu_handles; 1046 for (i = 0; i < obj_fu.fu_count; i++) { 1047 is_in_lib = B_FALSE; 1048 /* 1049 * Check if this oid has an object wrapper in the library 1050 * already. First, search the slot's token object list. 1051 */ 1052 objp = pslot->sl_tobj_list; 1053 while (!is_in_lib && objp) { 1054 if (objp->k_handle == *oid_p) { 1055 is_in_lib = B_TRUE; 1056 } else { 1057 objp = objp->next; 1058 } 1059 } 1060 1061 /* 1062 * If it is not in the slot's token object list, 1063 * search it in all the sessions. 1064 */ 1065 if (!is_in_lib) { 1066 sp = pslot->sl_sess_list; 1067 while (!is_in_lib && sp) { 1068 objp = sp->object_list; 1069 while (!is_in_lib && objp) { 1070 if (objp->k_handle == *oid_p) { 1071 is_in_lib = B_TRUE; 1072 } else { 1073 objp = objp->next; 1074 } 1075 } 1076 sp = sp->next; 1077 } 1078 } 1079 1080 /* 1081 * If this object is in the library already, add its object 1082 * wrapper to the returned find object list. 1083 */ 1084 if (is_in_lib) { 1085 obj_found[num_obj_found++] = (CK_OBJECT_HANDLE)objp; 1086 } 1087 1088 /* 1089 * If we still do not find it in the library. This object 1090 * must be a token object pre-existed in the HW provider. 1091 * We need to create an object wrapper for it in the library. 1092 */ 1093 if (!is_in_lib) { 1094 objp1 = calloc(1, sizeof (kernel_object_t)); 1095 if (objp1 == NULL) { 1096 rv = CKR_HOST_MEMORY; 1097 goto failed_exit; 1098 } 1099 rv = create_new_tobj_in_lib(pslot, cur_sp, objp1, 1100 *oid_p); 1101 1102 if (rv == CKR_OK) { 1103 /* Save the new object to the new_tobj_list. */ 1104 if (new_tobj_list == NULL) { 1105 new_tobj_list = objp1; 1106 objp1->next = NULL; 1107 objp1->prev = NULL; 1108 } else { 1109 new_tobj_list->prev = objp1; 1110 objp1->next = new_tobj_list; 1111 objp1->prev = NULL; 1112 new_tobj_list = objp1; 1113 } 1114 } else { 1115 /* 1116 * If create_new_tobj_in_lib() doesn't fail 1117 * with CKR_HOST_MEMORY, the failure should be 1118 * caused by the attributes' checking. We will 1119 * just ignore this object and continue on. 1120 */ 1121 free(objp1); 1122 if (rv == CKR_HOST_MEMORY) { 1123 goto failed_exit; 1124 } 1125 } 1126 } 1127 1128 /* Process next one */ 1129 oid_p++; 1130 } 1131 1132 /* 1133 * Add the newly created token object wrappers to the found object 1134 * list and to the slot's token object list. 1135 */ 1136 if (new_tobj_list != NULL) { 1137 /* Add to the obj_found array. */ 1138 objp = new_tobj_list; 1139 while (objp) { 1140 obj_found[num_obj_found++] = (CK_OBJECT_HANDLE)objp; 1141 if (objp->next == NULL) { 1142 break; 1143 } 1144 objp = objp->next; 1145 } 1146 1147 /* Add to the beginning of the slot's token object list. */ 1148 if (pslot->sl_tobj_list != NULL) { 1149 objp->next = pslot->sl_tobj_list; 1150 pslot->sl_tobj_list->prev = objp; 1151 } 1152 pslot->sl_tobj_list = new_tobj_list; 1153 } 1154 1155 *found_obj_count = num_obj_found; 1156 return (CKR_OK); 1157 1158 failed_exit: 1159 1160 /* Free the newly created token object wrappers. */ 1161 objp = new_tobj_list; 1162 while (objp) { 1163 objp1 = objp->next; 1164 (void) pthread_mutex_destroy(&objp->object_mutex); 1165 free(objp); 1166 objp = objp1; 1167 } 1168 1169 return (rv); 1170 } 1171 1172 1173 /* 1174 * Get the value of the CKA_PRIVATE attribute for the object just returned 1175 * from the HW provider. This function will be called by any function 1176 * that creates a new object, because the CKA_PRIVATE value of an object is 1177 * token sepecific. The CKA_PRIVATE attribute value of the new object will be 1178 * stored in the object structure in the library, which will be used later at 1179 * C_Logout to clean up all private objects. 1180 */ 1181 CK_RV 1182 get_cka_private_value(kernel_session_t *sp, crypto_object_id_t oid, 1183 CK_BBOOL *is_pri_obj) 1184 { 1185 CK_RV rv = CKR_OK; 1186 crypto_object_get_attribute_value_t obj_ga; 1187 crypto_object_attribute_t obj_attr; 1188 CK_BBOOL pri_value; 1189 int r; 1190 1191 obj_ga.og_session = sp->k_session; 1192 obj_ga.og_handle = oid; 1193 obj_ga.og_count = 1; 1194 1195 obj_attr.oa_type = CKA_PRIVATE; 1196 obj_attr.oa_value = (char *)&pri_value; 1197 obj_attr.oa_value_len = sizeof (CK_BBOOL); 1198 obj_ga.og_attributes = (char *)&obj_attr; 1199 1200 while ((r = ioctl(kernel_fd, CRYPTO_OBJECT_GET_ATTRIBUTE_VALUE, 1201 &obj_ga)) < 0) { 1202 if (errno != EINTR) 1203 break; 1204 } 1205 if (r < 0) { 1206 rv = CKR_FUNCTION_FAILED; 1207 } else { 1208 rv = crypto2pkcs11_error_number(obj_ga.og_return_value); 1209 } 1210 1211 if (rv == CKR_OK) { 1212 *is_pri_obj = *(CK_BBOOL *)obj_attr.oa_value; 1213 } 1214 1215 return (rv); 1216 } 1217 1218 1219 CK_RV 1220 get_mechanism_info(kernel_slot_t *pslot, CK_MECHANISM_TYPE type, 1221 CK_MECHANISM_INFO_PTR pInfo, uint32_t *k_mi_flags) 1222 { 1223 crypto_get_provider_mechanism_info_t mechanism_info; 1224 char *string; 1225 CK_FLAGS flags, mi_flags; 1226 CK_RV rv; 1227 int r; 1228 1229 string = pkcs11_mech2str(type); 1230 if (string == NULL) 1231 return (CKR_MECHANISM_INVALID); 1232 1233 (void) strcpy(mechanism_info.mi_mechanism_name, string); 1234 mechanism_info.mi_provider_id = pslot->sl_provider_id; 1235 1236 while ((r = ioctl(kernel_fd, CRYPTO_GET_PROVIDER_MECHANISM_INFO, 1237 &mechanism_info)) < 0) { 1238 if (errno != EINTR) 1239 break; 1240 } 1241 if (r < 0) { 1242 rv = CKR_FUNCTION_FAILED; 1243 } else { 1244 rv = crypto2pkcs11_error_number( 1245 mechanism_info.mi_return_value); 1246 } 1247 1248 if (rv != CKR_OK) { 1249 goto out; 1250 } 1251 1252 /* 1253 * Atomic flags are not part of PKCS#11 so we filter 1254 * them out here. 1255 */ 1256 mi_flags = mechanism_info.mi_flags; 1257 mi_flags &= ~(CRYPTO_FG_DIGEST_ATOMIC | CRYPTO_FG_ENCRYPT_ATOMIC | 1258 CRYPTO_FG_DECRYPT_ATOMIC | CRYPTO_FG_MAC_ATOMIC | 1259 CRYPTO_FG_SIGN_ATOMIC | CRYPTO_FG_VERIFY_ATOMIC | 1260 CRYPTO_FG_SIGN_RECOVER_ATOMIC | 1261 CRYPTO_FG_VERIFY_RECOVER_ATOMIC | 1262 CRYPTO_FG_ENCRYPT_MAC_ATOMIC | 1263 CRYPTO_FG_MAC_DECRYPT_ATOMIC); 1264 1265 if (mi_flags == 0) { 1266 rv = CKR_MECHANISM_INVALID; 1267 goto out; 1268 } 1269 1270 if (rv == CKR_OK) { 1271 /* set the value of k_mi_flags first */ 1272 *k_mi_flags = mi_flags; 1273 1274 /* convert KEF flags into pkcs11 flags */ 1275 flags = CKF_HW; 1276 if (mi_flags & CRYPTO_FG_ENCRYPT) 1277 flags |= CKF_ENCRYPT; 1278 if (mi_flags & CRYPTO_FG_DECRYPT) { 1279 flags |= CKF_DECRYPT; 1280 /* 1281 * Since we'll be emulating C_UnwrapKey() for some 1282 * cases, we can go ahead and claim CKF_UNWRAP 1283 */ 1284 flags |= CKF_UNWRAP; 1285 } 1286 if (mi_flags & CRYPTO_FG_DIGEST) 1287 flags |= CKF_DIGEST; 1288 if (mi_flags & CRYPTO_FG_SIGN) 1289 flags |= CKF_SIGN; 1290 if (mi_flags & CRYPTO_FG_SIGN_RECOVER) 1291 flags |= CKF_SIGN_RECOVER; 1292 if (mi_flags & CRYPTO_FG_VERIFY) 1293 flags |= CKF_VERIFY; 1294 if (mi_flags & CRYPTO_FG_VERIFY_RECOVER) 1295 flags |= CKF_VERIFY_RECOVER; 1296 if (mi_flags & CRYPTO_FG_GENERATE) 1297 flags |= CKF_GENERATE; 1298 if (mi_flags & CRYPTO_FG_GENERATE_KEY_PAIR) 1299 flags |= CKF_GENERATE_KEY_PAIR; 1300 if (mi_flags & CRYPTO_FG_WRAP) 1301 flags |= CKF_WRAP; 1302 if (mi_flags & CRYPTO_FG_UNWRAP) 1303 flags |= CKF_UNWRAP; 1304 if (mi_flags & CRYPTO_FG_DERIVE) 1305 flags |= CKF_DERIVE; 1306 1307 pInfo->ulMinKeySize = mechanism_info.mi_min_key_size; 1308 pInfo->ulMaxKeySize = mechanism_info.mi_max_key_size; 1309 pInfo->flags = flags; 1310 1311 } 1312 1313 out: 1314 free(string); 1315 return (rv); 1316 } 1317