Annotation of src/usr.bin/ssh/ssh-pkcs11.c, Revision 1.50
1.50 ! djm 1: /* $OpenBSD: ssh-pkcs11.c,v 1.49 2020/03/13 04:16:27 djm Exp $ */
1.1 markus 2: /*
3: * Copyright (c) 2010 Markus Friedl. All rights reserved.
1.28 djm 4: * Copyright (c) 2014 Pedro Martelletto. All rights reserved.
1.1 markus 5: *
6: * Permission to use, copy, modify, and distribute this software for any
7: * purpose with or without fee is hereby granted, provided that the above
8: * copyright notice and this permission notice appear in all copies.
9: *
10: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17: */
18:
19: #include <sys/types.h>
20: #include <sys/queue.h>
21: #include <stdarg.h>
22: #include <stdio.h>
23:
1.28 djm 24: #include <ctype.h>
1.1 markus 25: #include <string.h>
26: #include <dlfcn.h>
27:
1.28 djm 28: #include <openssl/ecdsa.h>
1.9 markus 29: #include <openssl/x509.h>
1.28 djm 30: #include <openssl/err.h>
1.9 markus 31:
1.1 markus 32: #define CRYPTOKI_COMPAT
33: #include "pkcs11.h"
34:
35: #include "log.h"
36: #include "misc.h"
1.15 djm 37: #include "sshkey.h"
1.1 markus 38: #include "ssh-pkcs11.h"
39: #include "xmalloc.h"
40:
41: struct pkcs11_slotinfo {
42: CK_TOKEN_INFO token;
43: CK_SESSION_HANDLE session;
44: int logged_in;
45: };
46:
47: struct pkcs11_provider {
48: char *name;
49: void *handle;
50: CK_FUNCTION_LIST *function_list;
51: CK_INFO info;
52: CK_ULONG nslots;
53: CK_SLOT_ID *slotlist;
54: struct pkcs11_slotinfo *slotinfo;
55: int valid;
56: int refcount;
57: TAILQ_ENTRY(pkcs11_provider) next;
58: };
59:
60: TAILQ_HEAD(, pkcs11_provider) pkcs11_providers;
61:
62: struct pkcs11_key {
63: struct pkcs11_provider *provider;
64: CK_ULONG slotidx;
65: char *keyid;
66: int keyid_len;
67: };
68:
69: int pkcs11_interactive = 0;
70:
1.28 djm 71: #ifdef HAVE_DLOPEN
72: static void
73: ossl_error(const char *msg)
74: {
1.35 djm 75: unsigned long e;
1.28 djm 76:
1.39 djm 77: error("%s: %s", __func__, msg);
1.35 djm 78: while ((e = ERR_get_error()) != 0)
1.39 djm 79: error("%s: libcrypto error: %.100s", __func__,
1.35 djm 80: ERR_error_string(e, NULL));
1.28 djm 81: }
82: #endif
83:
1.1 markus 84: int
85: pkcs11_init(int interactive)
86: {
87: pkcs11_interactive = interactive;
88: TAILQ_INIT(&pkcs11_providers);
89: return (0);
90: }
91:
92: /*
1.28 djm 93: * finalize a provider shared library, it's no longer usable.
1.1 markus 94: * however, there might still be keys referencing this provider,
1.28 djm 95: * so the actual freeing of memory is handled by pkcs11_provider_unref().
1.1 markus 96: * this is called when a provider gets unregistered.
97: */
98: static void
99: pkcs11_provider_finalize(struct pkcs11_provider *p)
100: {
101: CK_RV rv;
102: CK_ULONG i;
103:
104: debug("pkcs11_provider_finalize: %p refcount %d valid %d",
105: p, p->refcount, p->valid);
106: if (!p->valid)
107: return;
108: for (i = 0; i < p->nslots; i++) {
109: if (p->slotinfo[i].session &&
110: (rv = p->function_list->C_CloseSession(
111: p->slotinfo[i].session)) != CKR_OK)
112: error("C_CloseSession failed: %lu", rv);
113: }
114: if ((rv = p->function_list->C_Finalize(NULL)) != CKR_OK)
115: error("C_Finalize failed: %lu", rv);
116: p->valid = 0;
117: p->function_list = NULL;
1.3 deraadt 118: #ifdef HAVE_DLOPEN
1.1 markus 119: dlclose(p->handle);
1.3 deraadt 120: #endif
1.1 markus 121: }
122:
123: /*
124: * remove a reference to the provider.
125: * called when a key gets destroyed or when the provider is unregistered.
126: */
127: static void
128: pkcs11_provider_unref(struct pkcs11_provider *p)
129: {
130: debug("pkcs11_provider_unref: %p refcount %d", p, p->refcount);
131: if (--p->refcount <= 0) {
132: if (p->valid)
133: error("pkcs11_provider_unref: %p still valid", p);
1.28 djm 134: free(p->name);
1.7 djm 135: free(p->slotlist);
136: free(p->slotinfo);
137: free(p);
1.1 markus 138: }
139: }
140:
141: /* unregister all providers, keys might still point to the providers */
142: void
143: pkcs11_terminate(void)
144: {
145: struct pkcs11_provider *p;
146:
147: while ((p = TAILQ_FIRST(&pkcs11_providers)) != NULL) {
148: TAILQ_REMOVE(&pkcs11_providers, p, next);
149: pkcs11_provider_finalize(p);
150: pkcs11_provider_unref(p);
151: }
152: }
153:
154: /* lookup provider by name */
155: static struct pkcs11_provider *
156: pkcs11_provider_lookup(char *provider_id)
157: {
158: struct pkcs11_provider *p;
159:
160: TAILQ_FOREACH(p, &pkcs11_providers, next) {
161: debug("check %p %s", p, p->name);
162: if (!strcmp(provider_id, p->name))
163: return (p);
164: }
165: return (NULL);
166: }
167:
168: /* unregister provider by name */
169: int
170: pkcs11_del_provider(char *provider_id)
171: {
172: struct pkcs11_provider *p;
173:
174: if ((p = pkcs11_provider_lookup(provider_id)) != NULL) {
175: TAILQ_REMOVE(&pkcs11_providers, p, next);
176: pkcs11_provider_finalize(p);
177: pkcs11_provider_unref(p);
178: return (0);
179: }
180: return (-1);
181: }
182:
1.28 djm 183: #ifdef HAVE_DLOPEN
1.38 djm 184: static RSA_METHOD *rsa_method;
185: static int rsa_idx = 0;
186: static EC_KEY_METHOD *ec_key_method;
187: static int ec_key_idx = 0;
188:
1.34 djm 189: /* release a wrapped object */
190: static void
191: pkcs11_k11_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad, int idx,
192: long argl, void *argp)
1.1 markus 193: {
1.34 djm 194: struct pkcs11_key *k11 = ptr;
1.1 markus 195:
1.34 djm 196: debug("%s: parent %p ptr %p idx %d", __func__, parent, ptr, idx);
197: if (k11 == NULL)
198: return;
199: if (k11->provider)
200: pkcs11_provider_unref(k11->provider);
201: free(k11->keyid);
202: free(k11);
1.1 markus 203: }
204:
1.5 markus 205: /* find a single 'obj' for given attributes */
206: static int
207: pkcs11_find(struct pkcs11_provider *p, CK_ULONG slotidx, CK_ATTRIBUTE *attr,
208: CK_ULONG nattr, CK_OBJECT_HANDLE *obj)
209: {
210: CK_FUNCTION_LIST *f;
211: CK_SESSION_HANDLE session;
212: CK_ULONG nfound = 0;
213: CK_RV rv;
214: int ret = -1;
215:
216: f = p->function_list;
217: session = p->slotinfo[slotidx].session;
218: if ((rv = f->C_FindObjectsInit(session, attr, nattr)) != CKR_OK) {
219: error("C_FindObjectsInit failed (nattr %lu): %lu", nattr, rv);
220: return (-1);
221: }
222: if ((rv = f->C_FindObjects(session, obj, 1, &nfound)) != CKR_OK ||
223: nfound != 1) {
224: debug("C_FindObjects failed (nfound %lu nattr %lu): %lu",
225: nfound, nattr, rv);
226: } else
227: ret = 0;
228: if ((rv = f->C_FindObjectsFinal(session)) != CKR_OK)
229: error("C_FindObjectsFinal failed: %lu", rv);
230: return (ret);
231: }
232:
1.1 markus 233: static int
1.45 djm 234: pkcs11_login_slot(struct pkcs11_provider *provider, struct pkcs11_slotinfo *si,
235: CK_USER_TYPE type)
1.40 djm 236: {
237: char *pin = NULL, prompt[1024];
238: CK_RV rv;
239:
1.45 djm 240: if (provider == NULL || si == NULL || !provider->valid) {
1.40 djm 241: error("no pkcs11 (valid) provider found");
242: return (-1);
243: }
244:
245: if (!pkcs11_interactive) {
246: error("need pin entry%s",
247: (si->token.flags & CKF_PROTECTED_AUTHENTICATION_PATH) ?
248: " on reader keypad" : "");
249: return (-1);
250: }
251: if (si->token.flags & CKF_PROTECTED_AUTHENTICATION_PATH)
252: verbose("Deferring PIN entry to reader keypad.");
253: else {
254: snprintf(prompt, sizeof(prompt), "Enter PIN for '%s': ",
255: si->token.label);
256: if ((pin = read_passphrase(prompt, RP_ALLOW_EOF)) == NULL) {
257: debug("%s: no pin specified", __func__);
258: return (-1); /* bail out */
259: }
260: }
1.45 djm 261: rv = provider->function_list->C_Login(si->session, type, (u_char *)pin,
1.40 djm 262: (pin != NULL) ? strlen(pin) : 0);
263: if (pin != NULL)
264: freezero(pin, strlen(pin));
1.49 djm 265:
266: switch (rv) {
267: case CKR_OK:
268: case CKR_USER_ALREADY_LOGGED_IN:
269: /* success */
270: break;
271: case CKR_PIN_LEN_RANGE:
272: error("PKCS#11 login failed: PIN length out of range");
273: return -1;
274: case CKR_PIN_INCORRECT:
275: error("PKCS#11 login failed: PIN incorrect");
276: return -1;
277: case CKR_PIN_LOCKED:
278: error("PKCS#11 login failed: PIN locked");
279: return -1;
280: default:
281: error("PKCS#11 login failed: error %lu", rv);
282: return -1;
1.40 djm 283: }
284: si->logged_in = 1;
285: return (0);
286: }
287:
288: static int
1.45 djm 289: pkcs11_login(struct pkcs11_key *k11, CK_USER_TYPE type)
290: {
291: if (k11 == NULL || k11->provider == NULL || !k11->provider->valid) {
292: error("no pkcs11 (valid) provider found");
293: return (-1);
294: }
295:
296: return pkcs11_login_slot(k11->provider,
297: &k11->provider->slotinfo[k11->slotidx], type);
298: }
299:
300:
301: static int
1.40 djm 302: pkcs11_check_obj_bool_attrib(struct pkcs11_key *k11, CK_OBJECT_HANDLE obj,
303: CK_ATTRIBUTE_TYPE type, int *val)
304: {
305: struct pkcs11_slotinfo *si;
306: CK_FUNCTION_LIST *f;
307: CK_BBOOL flag = 0;
308: CK_ATTRIBUTE attr;
309: CK_RV rv;
310:
311: *val = 0;
312:
313: if (!k11->provider || !k11->provider->valid) {
314: error("no pkcs11 (valid) provider found");
315: return (-1);
316: }
317:
318: f = k11->provider->function_list;
319: si = &k11->provider->slotinfo[k11->slotidx];
320:
321: attr.type = type;
322: attr.pValue = &flag;
323: attr.ulValueLen = sizeof(flag);
324:
325: rv = f->C_GetAttributeValue(si->session, obj, &attr, 1);
326: if (rv != CKR_OK) {
327: error("C_GetAttributeValue failed: %lu", rv);
328: return (-1);
329: }
330: *val = flag != 0;
331: debug("%s: provider %p slot %lu object %lu: attrib %lu = %d",
332: __func__, k11->provider, k11->slotidx, obj, type, *val);
333: return (0);
334: }
335:
336: static int
1.28 djm 337: pkcs11_get_key(struct pkcs11_key *k11, CK_MECHANISM_TYPE mech_type)
1.1 markus 338: {
339: struct pkcs11_slotinfo *si;
340: CK_FUNCTION_LIST *f;
1.28 djm 341: CK_OBJECT_HANDLE obj;
342: CK_RV rv;
343: CK_OBJECT_CLASS private_key_class;
344: CK_BBOOL true_val;
345: CK_MECHANISM mech;
346: CK_ATTRIBUTE key_filter[3];
1.40 djm 347: int always_auth = 0;
348: int did_login = 0;
1.1 markus 349:
350: if (!k11->provider || !k11->provider->valid) {
1.28 djm 351: error("no pkcs11 (valid) provider found");
1.1 markus 352: return (-1);
353: }
1.28 djm 354:
1.1 markus 355: f = k11->provider->function_list;
356: si = &k11->provider->slotinfo[k11->slotidx];
1.28 djm 357:
1.1 markus 358: if ((si->token.flags & CKF_LOGIN_REQUIRED) && !si->logged_in) {
1.40 djm 359: if (pkcs11_login(k11, CKU_USER) < 0) {
360: error("login failed");
1.1 markus 361: return (-1);
362: }
1.40 djm 363: did_login = 1;
1.1 markus 364: }
1.28 djm 365:
366: memset(&key_filter, 0, sizeof(key_filter));
367: private_key_class = CKO_PRIVATE_KEY;
368: key_filter[0].type = CKA_CLASS;
369: key_filter[0].pValue = &private_key_class;
370: key_filter[0].ulValueLen = sizeof(private_key_class);
371:
372: key_filter[1].type = CKA_ID;
1.1 markus 373: key_filter[1].pValue = k11->keyid;
374: key_filter[1].ulValueLen = k11->keyid_len;
1.28 djm 375:
376: true_val = CK_TRUE;
377: key_filter[2].type = CKA_SIGN;
378: key_filter[2].pValue = &true_val;
379: key_filter[2].ulValueLen = sizeof(true_val);
380:
1.5 markus 381: /* try to find object w/CKA_SIGN first, retry w/o */
382: if (pkcs11_find(k11->provider, k11->slotidx, key_filter, 3, &obj) < 0 &&
383: pkcs11_find(k11->provider, k11->slotidx, key_filter, 2, &obj) < 0) {
384: error("cannot find private key");
1.28 djm 385: return (-1);
386: }
387:
388: memset(&mech, 0, sizeof(mech));
389: mech.mechanism = mech_type;
390: mech.pParameter = NULL_PTR;
391: mech.ulParameterLen = 0;
392:
393: if ((rv = f->C_SignInit(si->session, &mech, obj)) != CKR_OK) {
1.1 markus 394: error("C_SignInit failed: %lu", rv);
1.28 djm 395: return (-1);
1.40 djm 396: }
397:
398: pkcs11_check_obj_bool_attrib(k11, obj, CKA_ALWAYS_AUTHENTICATE,
399: &always_auth); /* ignore errors here */
400: if (always_auth && !did_login) {
401: debug("%s: always-auth key", __func__);
402: if (pkcs11_login(k11, CKU_CONTEXT_SPECIFIC) < 0) {
403: error("login failed for always-auth key");
404: return (-1);
405: }
1.1 markus 406: }
1.28 djm 407:
408: return (0);
409: }
410:
411: /* openssl callback doing the actual signing operation */
412: static int
413: pkcs11_rsa_private_encrypt(int flen, const u_char *from, u_char *to, RSA *rsa,
414: int padding)
415: {
416: struct pkcs11_key *k11;
417: struct pkcs11_slotinfo *si;
418: CK_FUNCTION_LIST *f;
419: CK_ULONG tlen = 0;
420: CK_RV rv;
421: int rval = -1;
422:
1.38 djm 423: if ((k11 = RSA_get_ex_data(rsa, rsa_idx)) == NULL) {
1.33 djm 424: error("RSA_get_ex_data failed for rsa %p", rsa);
1.28 djm 425: return (-1);
426: }
427:
428: if (pkcs11_get_key(k11, CKM_RSA_PKCS) == -1) {
429: error("pkcs11_get_key failed");
430: return (-1);
431: }
432:
433: f = k11->provider->function_list;
434: si = &k11->provider->slotinfo[k11->slotidx];
435: tlen = RSA_size(rsa);
436:
437: /* XXX handle CKR_BUFFER_TOO_SMALL */
438: rv = f->C_Sign(si->session, (CK_BYTE *)from, flen, to, &tlen);
439: if (rv == CKR_OK)
440: rval = tlen;
441: else
442: error("C_Sign failed: %lu", rv);
443:
1.1 markus 444: return (rval);
445: }
446:
447: static int
448: pkcs11_rsa_private_decrypt(int flen, const u_char *from, u_char *to, RSA *rsa,
449: int padding)
450: {
451: return (-1);
452: }
453:
1.33 djm 454: static int
455: pkcs11_rsa_start_wrapper(void)
456: {
457: if (rsa_method != NULL)
458: return (0);
459: rsa_method = RSA_meth_dup(RSA_get_default_method());
460: if (rsa_method == NULL)
461: return (-1);
1.34 djm 462: rsa_idx = RSA_get_ex_new_index(0, "ssh-pkcs11-rsa",
463: NULL, NULL, pkcs11_k11_free);
464: if (rsa_idx == -1)
465: return (-1);
1.33 djm 466: if (!RSA_meth_set1_name(rsa_method, "pkcs11") ||
467: !RSA_meth_set_priv_enc(rsa_method, pkcs11_rsa_private_encrypt) ||
1.34 djm 468: !RSA_meth_set_priv_dec(rsa_method, pkcs11_rsa_private_decrypt)) {
1.33 djm 469: error("%s: setup pkcs11 method failed", __func__);
470: return (-1);
471: }
472: return (0);
473: }
474:
1.1 markus 475: /* redirect private key operations for rsa key to pkcs11 token */
476: static int
477: pkcs11_rsa_wrap(struct pkcs11_provider *provider, CK_ULONG slotidx,
478: CK_ATTRIBUTE *keyid_attrib, RSA *rsa)
479: {
480: struct pkcs11_key *k11;
1.33 djm 481:
482: if (pkcs11_rsa_start_wrapper() == -1)
483: return (-1);
1.1 markus 484:
485: k11 = xcalloc(1, sizeof(*k11));
486: k11->provider = provider;
487: provider->refcount++; /* provider referenced by RSA key */
488: k11->slotidx = slotidx;
489: /* identify key object on smartcard */
490: k11->keyid_len = keyid_attrib->ulValueLen;
1.22 djm 491: if (k11->keyid_len > 0) {
492: k11->keyid = xmalloc(k11->keyid_len);
493: memcpy(k11->keyid, keyid_attrib->pValue, k11->keyid_len);
494: }
1.33 djm 495:
1.36 djm 496: RSA_set_method(rsa, rsa_method);
1.34 djm 497: RSA_set_ex_data(rsa, rsa_idx, k11);
1.1 markus 498: return (0);
499: }
500:
1.28 djm 501: /* openssl callback doing the actual signing operation */
502: static ECDSA_SIG *
503: ecdsa_do_sign(const unsigned char *dgst, int dgst_len, const BIGNUM *inv,
504: const BIGNUM *rp, EC_KEY *ec)
505: {
506: struct pkcs11_key *k11;
507: struct pkcs11_slotinfo *si;
508: CK_FUNCTION_LIST *f;
509: CK_ULONG siglen = 0, bnlen;
510: CK_RV rv;
511: ECDSA_SIG *ret = NULL;
512: u_char *sig;
1.37 djm 513: BIGNUM *r = NULL, *s = NULL;
1.28 djm 514:
1.38 djm 515: if ((k11 = EC_KEY_get_ex_data(ec, ec_key_idx)) == NULL) {
1.28 djm 516: ossl_error("EC_KEY_get_key_method_data failed for ec");
517: return (NULL);
518: }
519:
520: if (pkcs11_get_key(k11, CKM_ECDSA) == -1) {
521: error("pkcs11_get_key failed");
522: return (NULL);
523: }
524:
525: f = k11->provider->function_list;
526: si = &k11->provider->slotinfo[k11->slotidx];
527:
528: siglen = ECDSA_size(ec);
529: sig = xmalloc(siglen);
530:
531: /* XXX handle CKR_BUFFER_TOO_SMALL */
532: rv = f->C_Sign(si->session, (CK_BYTE *)dgst, dgst_len, sig, &siglen);
533: if (rv != CKR_OK) {
534: error("C_Sign failed: %lu", rv);
535: goto done;
536: }
1.29 djm 537: if (siglen < 64 || siglen > 132 || siglen % 2) {
538: ossl_error("d2i_ECDSA_SIG failed");
539: goto done;
540: }
541: bnlen = siglen/2;
542: if ((ret = ECDSA_SIG_new()) == NULL) {
543: error("ECDSA_SIG_new failed");
544: goto done;
545: }
1.37 djm 546: if ((r = BN_bin2bn(sig, bnlen, NULL)) == NULL ||
547: (s = BN_bin2bn(sig+bnlen, bnlen, NULL)) == NULL) {
1.29 djm 548: ossl_error("d2i_ECDSA_SIG failed");
549: ECDSA_SIG_free(ret);
550: ret = NULL;
551: goto done;
1.28 djm 552: }
1.37 djm 553: if (!ECDSA_SIG_set0(ret, r, s)) {
554: error("%s: ECDSA_SIG_set0 failed", __func__);
555: ECDSA_SIG_free(ret);
556: ret = NULL;
557: goto done;
558: }
559: r = s = NULL; /* now owned by ret */
560: /* success */
1.28 djm 561: done:
1.37 djm 562: BN_free(r);
563: BN_free(s);
1.28 djm 564: free(sig);
565:
566: return (ret);
567: }
568:
569: static int
570: pkcs11_ecdsa_start_wrapper(void)
571: {
572: int (*orig_sign)(int, const unsigned char *, int, unsigned char *,
573: unsigned int *, const BIGNUM *, const BIGNUM *, EC_KEY *) = NULL;
574:
575: if (ec_key_method != NULL)
576: return (0);
1.32 djm 577: ec_key_idx = EC_KEY_get_ex_new_index(0, "ssh-pkcs11-ecdsa",
578: NULL, NULL, pkcs11_k11_free);
579: if (ec_key_idx == -1)
580: return (-1);
1.28 djm 581: ec_key_method = EC_KEY_METHOD_new(EC_KEY_OpenSSL());
582: if (ec_key_method == NULL)
583: return (-1);
584: EC_KEY_METHOD_get_sign(ec_key_method, &orig_sign, NULL, NULL);
585: EC_KEY_METHOD_set_sign(ec_key_method, orig_sign, NULL, ecdsa_do_sign);
586: return (0);
587: }
588:
589: static int
590: pkcs11_ecdsa_wrap(struct pkcs11_provider *provider, CK_ULONG slotidx,
591: CK_ATTRIBUTE *keyid_attrib, EC_KEY *ec)
592: {
593: struct pkcs11_key *k11;
594:
595: if (pkcs11_ecdsa_start_wrapper() == -1)
596: return (-1);
597:
598: k11 = xcalloc(1, sizeof(*k11));
599: k11->provider = provider;
600: provider->refcount++; /* provider referenced by ECDSA key */
601: k11->slotidx = slotidx;
602: /* identify key object on smartcard */
603: k11->keyid_len = keyid_attrib->ulValueLen;
604: k11->keyid = xmalloc(k11->keyid_len);
605: memcpy(k11->keyid, keyid_attrib->pValue, k11->keyid_len);
606:
1.36 djm 607: EC_KEY_set_method(ec, ec_key_method);
1.32 djm 608: EC_KEY_set_ex_data(ec, ec_key_idx, k11);
1.28 djm 609:
610: return (0);
611: }
612:
1.1 markus 613: /* remove trailing spaces */
614: static void
1.8 djm 615: rmspace(u_char *buf, size_t len)
1.1 markus 616: {
617: size_t i;
618:
619: if (!len)
620: return;
621: for (i = len - 1; i > 0; i--)
622: if (i == len - 1 || buf[i] == ' ')
623: buf[i] = '\0';
624: else
625: break;
626: }
627:
628: /*
629: * open a pkcs11 session and login if required.
630: * if pin == NULL we delay login until key use
631: */
632: static int
1.28 djm 633: pkcs11_open_session(struct pkcs11_provider *p, CK_ULONG slotidx, char *pin,
634: CK_ULONG user)
1.1 markus 635: {
1.41 djm 636: struct pkcs11_slotinfo *si;
637: CK_FUNCTION_LIST *f;
1.1 markus 638: CK_RV rv;
639: CK_SESSION_HANDLE session;
1.46 djm 640: int login_required, ret;
1.1 markus 641:
642: f = p->function_list;
1.41 djm 643: si = &p->slotinfo[slotidx];
644:
645: login_required = si->token.flags & CKF_LOGIN_REQUIRED;
646:
647: /* fail early before opening session */
1.46 djm 648: if (login_required && !pkcs11_interactive &&
1.42 djm 649: (pin == NULL || strlen(pin) == 0)) {
1.1 markus 650: error("pin required");
1.28 djm 651: return (-SSH_PKCS11_ERR_PIN_REQUIRED);
1.1 markus 652: }
653: if ((rv = f->C_OpenSession(p->slotlist[slotidx], CKF_RW_SESSION|
1.41 djm 654: CKF_SERIAL_SESSION, NULL, NULL, &session)) != CKR_OK) {
1.1 markus 655: error("C_OpenSession failed: %lu", rv);
656: return (-1);
657: }
1.46 djm 658: if (login_required && pin != NULL && strlen(pin) != 0) {
659: rv = f->C_Login(session, user, (u_char *)pin, strlen(pin));
1.16 djm 660: if (rv != CKR_OK && rv != CKR_USER_ALREADY_LOGGED_IN) {
1.1 markus 661: error("C_Login failed: %lu", rv);
1.28 djm 662: ret = (rv == CKR_PIN_LOCKED) ?
663: -SSH_PKCS11_ERR_PIN_LOCKED :
664: -SSH_PKCS11_ERR_LOGIN_FAIL;
1.1 markus 665: if ((rv = f->C_CloseSession(session)) != CKR_OK)
666: error("C_CloseSession failed: %lu", rv);
1.28 djm 667: return (ret);
1.1 markus 668: }
1.41 djm 669: si->logged_in = 1;
1.1 markus 670: }
1.41 djm 671: si->session = session;
1.1 markus 672: return (0);
673: }
674:
675: static int
1.15 djm 676: pkcs11_key_included(struct sshkey ***keysp, int *nkeys, struct sshkey *key)
1.9 markus 677: {
678: int i;
679:
680: for (i = 0; i < *nkeys; i++)
1.15 djm 681: if (sshkey_equal(key, (*keysp)[i]))
1.9 markus 682: return (1);
683: return (0);
684: }
685:
1.28 djm 686: static struct sshkey *
687: pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
688: CK_OBJECT_HANDLE *obj)
689: {
690: CK_ATTRIBUTE key_attr[3];
691: CK_SESSION_HANDLE session;
692: CK_FUNCTION_LIST *f = NULL;
693: CK_RV rv;
1.30 djm 694: ASN1_OCTET_STRING *octet = NULL;
1.28 djm 695: EC_KEY *ec = NULL;
696: EC_GROUP *group = NULL;
697: struct sshkey *key = NULL;
698: const unsigned char *attrp = NULL;
699: int i;
700: int nid;
701:
702: memset(&key_attr, 0, sizeof(key_attr));
703: key_attr[0].type = CKA_ID;
704: key_attr[1].type = CKA_EC_POINT;
705: key_attr[2].type = CKA_EC_PARAMS;
706:
707: session = p->slotinfo[slotidx].session;
708: f = p->function_list;
709:
710: /* figure out size of the attributes */
711: rv = f->C_GetAttributeValue(session, *obj, key_attr, 3);
712: if (rv != CKR_OK) {
713: error("C_GetAttributeValue failed: %lu", rv);
714: return (NULL);
715: }
716:
717: /*
718: * Allow CKA_ID (always first attribute) to be empty, but
719: * ensure that none of the others are zero length.
720: * XXX assumes CKA_ID is always first.
721: */
722: if (key_attr[1].ulValueLen == 0 ||
723: key_attr[2].ulValueLen == 0) {
724: error("invalid attribute length");
725: return (NULL);
726: }
727:
728: /* allocate buffers for attributes */
729: for (i = 0; i < 3; i++)
730: if (key_attr[i].ulValueLen > 0)
731: key_attr[i].pValue = xcalloc(1, key_attr[i].ulValueLen);
732:
733: /* retrieve ID, public point and curve parameters of EC key */
734: rv = f->C_GetAttributeValue(session, *obj, key_attr, 3);
735: if (rv != CKR_OK) {
736: error("C_GetAttributeValue failed: %lu", rv);
737: goto fail;
738: }
739:
740: ec = EC_KEY_new();
741: if (ec == NULL) {
742: error("EC_KEY_new failed");
743: goto fail;
744: }
745:
746: attrp = key_attr[2].pValue;
747: group = d2i_ECPKParameters(NULL, &attrp, key_attr[2].ulValueLen);
748: if (group == NULL) {
749: ossl_error("d2i_ECPKParameters failed");
750: goto fail;
751: }
752:
753: if (EC_KEY_set_group(ec, group) == 0) {
754: ossl_error("EC_KEY_set_group failed");
755: goto fail;
756: }
757:
758: if (key_attr[1].ulValueLen <= 2) {
759: error("CKA_EC_POINT too small");
760: goto fail;
761: }
762:
1.30 djm 763: attrp = key_attr[1].pValue;
764: octet = d2i_ASN1_OCTET_STRING(NULL, &attrp, key_attr[1].ulValueLen);
765: if (octet == NULL) {
766: ossl_error("d2i_ASN1_OCTET_STRING failed");
767: goto fail;
768: }
769: attrp = octet->data;
770: if (o2i_ECPublicKey(&ec, &attrp, octet->length) == NULL) {
771: ossl_error("o2i_ECPublicKey failed");
772: goto fail;
1.28 djm 773: }
774:
775: nid = sshkey_ecdsa_key_to_nid(ec);
776: if (nid < 0) {
777: error("couldn't get curve nid");
778: goto fail;
779: }
780:
781: if (pkcs11_ecdsa_wrap(p, slotidx, &key_attr[0], ec))
782: goto fail;
783:
784: key = sshkey_new(KEY_UNSPEC);
785: if (key == NULL) {
786: error("sshkey_new failed");
787: goto fail;
788: }
789:
790: key->ecdsa = ec;
791: key->ecdsa_nid = nid;
792: key->type = KEY_ECDSA;
793: key->flags |= SSHKEY_FLAG_EXT;
794: ec = NULL; /* now owned by key */
795:
796: fail:
797: for (i = 0; i < 3; i++)
798: free(key_attr[i].pValue);
799: if (ec)
800: EC_KEY_free(ec);
801: if (group)
802: EC_GROUP_free(group);
1.30 djm 803: if (octet)
804: ASN1_OCTET_STRING_free(octet);
1.28 djm 805:
806: return (key);
807: }
808:
809: static struct sshkey *
810: pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
811: CK_OBJECT_HANDLE *obj)
812: {
813: CK_ATTRIBUTE key_attr[3];
814: CK_SESSION_HANDLE session;
815: CK_FUNCTION_LIST *f = NULL;
816: CK_RV rv;
817: RSA *rsa = NULL;
818: BIGNUM *rsa_n, *rsa_e;
819: struct sshkey *key = NULL;
820: int i;
821:
822: memset(&key_attr, 0, sizeof(key_attr));
823: key_attr[0].type = CKA_ID;
824: key_attr[1].type = CKA_MODULUS;
825: key_attr[2].type = CKA_PUBLIC_EXPONENT;
826:
827: session = p->slotinfo[slotidx].session;
828: f = p->function_list;
829:
830: /* figure out size of the attributes */
831: rv = f->C_GetAttributeValue(session, *obj, key_attr, 3);
832: if (rv != CKR_OK) {
833: error("C_GetAttributeValue failed: %lu", rv);
834: return (NULL);
835: }
836:
837: /*
838: * Allow CKA_ID (always first attribute) to be empty, but
839: * ensure that none of the others are zero length.
840: * XXX assumes CKA_ID is always first.
841: */
842: if (key_attr[1].ulValueLen == 0 ||
843: key_attr[2].ulValueLen == 0) {
844: error("invalid attribute length");
845: return (NULL);
846: }
847:
848: /* allocate buffers for attributes */
849: for (i = 0; i < 3; i++)
850: if (key_attr[i].ulValueLen > 0)
851: key_attr[i].pValue = xcalloc(1, key_attr[i].ulValueLen);
852:
853: /* retrieve ID, modulus and public exponent of RSA key */
854: rv = f->C_GetAttributeValue(session, *obj, key_attr, 3);
855: if (rv != CKR_OK) {
856: error("C_GetAttributeValue failed: %lu", rv);
857: goto fail;
858: }
859:
860: rsa = RSA_new();
861: if (rsa == NULL) {
862: error("RSA_new failed");
863: goto fail;
864: }
865:
866: rsa_n = BN_bin2bn(key_attr[1].pValue, key_attr[1].ulValueLen, NULL);
867: rsa_e = BN_bin2bn(key_attr[2].pValue, key_attr[2].ulValueLen, NULL);
868: if (rsa_n == NULL || rsa_e == NULL) {
869: error("BN_bin2bn failed");
870: goto fail;
871: }
872: if (!RSA_set0_key(rsa, rsa_n, rsa_e, NULL))
873: fatal("%s: set key", __func__);
874: rsa_n = rsa_e = NULL; /* transferred */
875:
876: if (pkcs11_rsa_wrap(p, slotidx, &key_attr[0], rsa))
877: goto fail;
878:
879: key = sshkey_new(KEY_UNSPEC);
880: if (key == NULL) {
881: error("sshkey_new failed");
882: goto fail;
883: }
884:
885: key->rsa = rsa;
886: key->type = KEY_RSA;
887: key->flags |= SSHKEY_FLAG_EXT;
888: rsa = NULL; /* now owned by key */
889:
890: fail:
891: for (i = 0; i < 3; i++)
892: free(key_attr[i].pValue);
893: RSA_free(rsa);
894:
895: return (key);
896: }
897:
1.47 djm 898: static int
1.28 djm 899: pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
1.47 djm 900: CK_OBJECT_HANDLE *obj, struct sshkey **keyp, char **labelp)
1.28 djm 901: {
902: CK_ATTRIBUTE cert_attr[3];
903: CK_SESSION_HANDLE session;
904: CK_FUNCTION_LIST *f = NULL;
905: CK_RV rv;
906: X509 *x509 = NULL;
1.47 djm 907: X509_NAME *x509_name = NULL;
1.28 djm 908: EVP_PKEY *evp;
909: RSA *rsa = NULL;
910: EC_KEY *ec = NULL;
911: struct sshkey *key = NULL;
912: int i;
913: int nid;
1.47 djm 914: const u_char *cp;
915: char *subject = NULL;
916:
917: *keyp = NULL;
918: *labelp = NULL;
1.28 djm 919:
920: memset(&cert_attr, 0, sizeof(cert_attr));
921: cert_attr[0].type = CKA_ID;
922: cert_attr[1].type = CKA_SUBJECT;
923: cert_attr[2].type = CKA_VALUE;
924:
925: session = p->slotinfo[slotidx].session;
926: f = p->function_list;
927:
928: /* figure out size of the attributes */
929: rv = f->C_GetAttributeValue(session, *obj, cert_attr, 3);
930: if (rv != CKR_OK) {
931: error("C_GetAttributeValue failed: %lu", rv);
1.47 djm 932: return -1;
1.28 djm 933: }
934:
935: /*
936: * Allow CKA_ID (always first attribute) to be empty, but
937: * ensure that none of the others are zero length.
938: * XXX assumes CKA_ID is always first.
939: */
940: if (cert_attr[1].ulValueLen == 0 ||
941: cert_attr[2].ulValueLen == 0) {
942: error("invalid attribute length");
1.47 djm 943: return -1;
1.28 djm 944: }
945:
946: /* allocate buffers for attributes */
947: for (i = 0; i < 3; i++)
948: if (cert_attr[i].ulValueLen > 0)
949: cert_attr[i].pValue = xcalloc(1, cert_attr[i].ulValueLen);
950:
951: /* retrieve ID, subject and value of certificate */
952: rv = f->C_GetAttributeValue(session, *obj, cert_attr, 3);
953: if (rv != CKR_OK) {
954: error("C_GetAttributeValue failed: %lu", rv);
1.47 djm 955: goto out;
1.28 djm 956: }
957:
1.47 djm 958: /* Decode DER-encoded cert subject */
959: cp = cert_attr[2].pValue;
960: if ((x509_name = d2i_X509_NAME(NULL, &cp,
961: cert_attr[1].ulValueLen)) == NULL ||
962: (subject = X509_NAME_oneline(x509_name, NULL, 0)) == NULL)
963: subject = xstrdup("invalid subject");
964: X509_NAME_free(x509_name);
1.28 djm 965:
966: cp = cert_attr[2].pValue;
1.47 djm 967: if ((x509 = d2i_X509(NULL, &cp, cert_attr[2].ulValueLen)) == NULL) {
1.28 djm 968: error("d2i_x509 failed");
1.47 djm 969: goto out;
1.28 djm 970: }
971:
1.47 djm 972: if ((evp = X509_get_pubkey(x509)) == NULL) {
1.28 djm 973: error("X509_get_pubkey failed");
1.47 djm 974: goto out;
1.28 djm 975: }
976:
977: if (EVP_PKEY_base_id(evp) == EVP_PKEY_RSA) {
978: if (EVP_PKEY_get0_RSA(evp) == NULL) {
979: error("invalid x509; no rsa key");
1.47 djm 980: goto out;
1.28 djm 981: }
982: if ((rsa = RSAPublicKey_dup(EVP_PKEY_get0_RSA(evp))) == NULL) {
983: error("RSAPublicKey_dup failed");
1.47 djm 984: goto out;
1.28 djm 985: }
986:
987: if (pkcs11_rsa_wrap(p, slotidx, &cert_attr[0], rsa))
1.47 djm 988: goto out;
1.28 djm 989:
990: key = sshkey_new(KEY_UNSPEC);
991: if (key == NULL) {
992: error("sshkey_new failed");
1.47 djm 993: goto out;
1.28 djm 994: }
995:
996: key->rsa = rsa;
997: key->type = KEY_RSA;
998: key->flags |= SSHKEY_FLAG_EXT;
999: rsa = NULL; /* now owned by key */
1000: } else if (EVP_PKEY_base_id(evp) == EVP_PKEY_EC) {
1.31 djm 1001: if (EVP_PKEY_get0_EC_KEY(evp) == NULL) {
1.28 djm 1002: error("invalid x509; no ec key");
1.47 djm 1003: goto out;
1.28 djm 1004: }
1.31 djm 1005: if ((ec = EC_KEY_dup(EVP_PKEY_get0_EC_KEY(evp))) == NULL) {
1.28 djm 1006: error("EC_KEY_dup failed");
1.47 djm 1007: goto out;
1.28 djm 1008: }
1009:
1010: nid = sshkey_ecdsa_key_to_nid(ec);
1011: if (nid < 0) {
1012: error("couldn't get curve nid");
1.47 djm 1013: goto out;
1.28 djm 1014: }
1015:
1016: if (pkcs11_ecdsa_wrap(p, slotidx, &cert_attr[0], ec))
1.47 djm 1017: goto out;
1.28 djm 1018:
1019: key = sshkey_new(KEY_UNSPEC);
1020: if (key == NULL) {
1021: error("sshkey_new failed");
1.47 djm 1022: goto out;
1.28 djm 1023: }
1024:
1025: key->ecdsa = ec;
1026: key->ecdsa_nid = nid;
1027: key->type = KEY_ECDSA;
1028: key->flags |= SSHKEY_FLAG_EXT;
1029: ec = NULL; /* now owned by key */
1.47 djm 1030: } else {
1.28 djm 1031: error("unknown certificate key type");
1.47 djm 1032: goto out;
1033: }
1034: out:
1.28 djm 1035: for (i = 0; i < 3; i++)
1036: free(cert_attr[i].pValue);
1037: X509_free(x509);
1038: RSA_free(rsa);
1039: EC_KEY_free(ec);
1.47 djm 1040: if (key == NULL) {
1041: free(subject);
1042: return -1;
1043: }
1044: /* success */
1045: *keyp = key;
1046: *labelp = subject;
1047: return 0;
1.28 djm 1048: }
1049:
1050: #if 0
1.9 markus 1051: static int
1.27 djm 1052: have_rsa_key(const RSA *rsa)
1053: {
1054: const BIGNUM *rsa_n, *rsa_e;
1055:
1056: RSA_get0_key(rsa, &rsa_n, &rsa_e, NULL);
1057: return rsa_n != NULL && rsa_e != NULL;
1058: }
1.28 djm 1059: #endif
1.27 djm 1060:
1.28 djm 1061: /*
1062: * lookup certificates for token in slot identified by slotidx,
1063: * add 'wrapped' public keys to the 'keysp' array and increment nkeys.
1064: * keysp points to an (possibly empty) array with *nkeys keys.
1065: */
1.27 djm 1066: static int
1.28 djm 1067: pkcs11_fetch_certs(struct pkcs11_provider *p, CK_ULONG slotidx,
1.47 djm 1068: struct sshkey ***keysp, char ***labelsp, int *nkeys)
1.1 markus 1069: {
1.28 djm 1070: struct sshkey *key = NULL;
1071: CK_OBJECT_CLASS key_class;
1072: CK_ATTRIBUTE key_attr[1];
1073: CK_SESSION_HANDLE session;
1074: CK_FUNCTION_LIST *f = NULL;
1075: CK_RV rv;
1076: CK_OBJECT_HANDLE obj;
1077: CK_ULONG n = 0;
1078: int ret = -1;
1.47 djm 1079: char *label;
1.28 djm 1080:
1081: memset(&key_attr, 0, sizeof(key_attr));
1082: memset(&obj, 0, sizeof(obj));
1083:
1084: key_class = CKO_CERTIFICATE;
1085: key_attr[0].type = CKA_CLASS;
1086: key_attr[0].pValue = &key_class;
1087: key_attr[0].ulValueLen = sizeof(key_class);
1.1 markus 1088:
1.28 djm 1089: session = p->slotinfo[slotidx].session;
1.1 markus 1090: f = p->function_list;
1.28 djm 1091:
1092: rv = f->C_FindObjectsInit(session, key_attr, 1);
1093: if (rv != CKR_OK) {
1.1 markus 1094: error("C_FindObjectsInit failed: %lu", rv);
1.28 djm 1095: goto fail;
1.1 markus 1096: }
1.28 djm 1097:
1.1 markus 1098: while (1) {
1.28 djm 1099: CK_CERTIFICATE_TYPE ck_cert_type;
1100:
1101: rv = f->C_FindObjects(session, &obj, 1, &n);
1102: if (rv != CKR_OK) {
1103: error("C_FindObjects failed: %lu", rv);
1104: goto fail;
1.1 markus 1105: }
1.28 djm 1106: if (n == 0)
1.1 markus 1107: break;
1.28 djm 1108:
1109: memset(&ck_cert_type, 0, sizeof(ck_cert_type));
1110: memset(&key_attr, 0, sizeof(key_attr));
1111: key_attr[0].type = CKA_CERTIFICATE_TYPE;
1112: key_attr[0].pValue = &ck_cert_type;
1113: key_attr[0].ulValueLen = sizeof(ck_cert_type);
1114:
1115: rv = f->C_GetAttributeValue(session, obj, key_attr, 1);
1116: if (rv != CKR_OK) {
1.1 markus 1117: error("C_GetAttributeValue failed: %lu", rv);
1.28 djm 1118: goto fail;
1119: }
1120:
1.47 djm 1121: key = NULL;
1122: label = NULL;
1.28 djm 1123: switch (ck_cert_type) {
1124: case CKC_X_509:
1.47 djm 1125: if (pkcs11_fetch_x509_pubkey(p, slotidx, &obj,
1126: &key, &label) != 0) {
1127: error("failed to fetch key");
1128: continue;
1129: }
1.28 djm 1130: break;
1131: default:
1.47 djm 1132: error("skipping unsupported certificate type %lu",
1133: ck_cert_type);
1.6 markus 1134: continue;
1135: }
1.28 djm 1136:
1137: if (pkcs11_key_included(keysp, nkeys, key)) {
1138: sshkey_free(key);
1139: } else {
1140: /* expand key array and add key */
1141: *keysp = xrecallocarray(*keysp, *nkeys,
1142: *nkeys + 1, sizeof(struct sshkey *));
1143: (*keysp)[*nkeys] = key;
1.47 djm 1144: if (labelsp != NULL) {
1145: *labelsp = xrecallocarray(*labelsp, *nkeys,
1146: *nkeys + 1, sizeof(char *));
1147: (*labelsp)[*nkeys] = xstrdup((char *)label);
1148: }
1.28 djm 1149: *nkeys = *nkeys + 1;
1150: debug("have %d keys", *nkeys);
1.21 djm 1151: }
1.28 djm 1152: }
1153:
1154: ret = 0;
1155: fail:
1156: rv = f->C_FindObjectsFinal(session);
1157: if (rv != CKR_OK) {
1158: error("C_FindObjectsFinal failed: %lu", rv);
1159: ret = -1;
1160: }
1161:
1162: return (ret);
1163: }
1.21 djm 1164:
1.28 djm 1165: /*
1166: * lookup public keys for token in slot identified by slotidx,
1167: * add 'wrapped' public keys to the 'keysp' array and increment nkeys.
1168: * keysp points to an (possibly empty) array with *nkeys keys.
1169: */
1170: static int
1171: pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx,
1.47 djm 1172: struct sshkey ***keysp, char ***labelsp, int *nkeys)
1.28 djm 1173: {
1174: struct sshkey *key = NULL;
1175: CK_OBJECT_CLASS key_class;
1.47 djm 1176: CK_ATTRIBUTE key_attr[2];
1.28 djm 1177: CK_SESSION_HANDLE session;
1178: CK_FUNCTION_LIST *f = NULL;
1179: CK_RV rv;
1180: CK_OBJECT_HANDLE obj;
1181: CK_ULONG n = 0;
1182: int ret = -1;
1183:
1184: memset(&key_attr, 0, sizeof(key_attr));
1185: memset(&obj, 0, sizeof(obj));
1186:
1187: key_class = CKO_PUBLIC_KEY;
1188: key_attr[0].type = CKA_CLASS;
1189: key_attr[0].pValue = &key_class;
1190: key_attr[0].ulValueLen = sizeof(key_class);
1191:
1192: session = p->slotinfo[slotidx].session;
1193: f = p->function_list;
1194:
1195: rv = f->C_FindObjectsInit(session, key_attr, 1);
1196: if (rv != CKR_OK) {
1197: error("C_FindObjectsInit failed: %lu", rv);
1198: goto fail;
1199: }
1200:
1201: while (1) {
1202: CK_KEY_TYPE ck_key_type;
1.47 djm 1203: CK_UTF8CHAR label[256];
1.28 djm 1204:
1205: rv = f->C_FindObjects(session, &obj, 1, &n);
1206: if (rv != CKR_OK) {
1207: error("C_FindObjects failed: %lu", rv);
1208: goto fail;
1209: }
1210: if (n == 0)
1211: break;
1212:
1213: memset(&ck_key_type, 0, sizeof(ck_key_type));
1214: memset(&key_attr, 0, sizeof(key_attr));
1215: key_attr[0].type = CKA_KEY_TYPE;
1216: key_attr[0].pValue = &ck_key_type;
1217: key_attr[0].ulValueLen = sizeof(ck_key_type);
1.47 djm 1218: key_attr[1].type = CKA_LABEL;
1219: key_attr[1].pValue = &label;
1220: key_attr[1].ulValueLen = sizeof(label) - 1;
1.28 djm 1221:
1.47 djm 1222: rv = f->C_GetAttributeValue(session, obj, key_attr, 2);
1.28 djm 1223: if (rv != CKR_OK) {
1.1 markus 1224: error("C_GetAttributeValue failed: %lu", rv);
1.28 djm 1225: goto fail;
1226: }
1227:
1.47 djm 1228: label[key_attr[1].ulValueLen] = '\0';
1229:
1.28 djm 1230: switch (ck_key_type) {
1231: case CKK_RSA:
1232: key = pkcs11_fetch_rsa_pubkey(p, slotidx, &obj);
1233: break;
1234: case CKK_ECDSA:
1235: key = pkcs11_fetch_ecdsa_pubkey(p, slotidx, &obj);
1236: break;
1237: default:
1238: /* XXX print key type? */
1.43 markus 1239: key = NULL;
1.28 djm 1240: error("skipping unsupported key type");
1241: }
1242:
1243: if (key == NULL) {
1244: error("failed to fetch key");
1245: continue;
1246: }
1247:
1248: if (pkcs11_key_included(keysp, nkeys, key)) {
1249: sshkey_free(key);
1.1 markus 1250: } else {
1.28 djm 1251: /* expand key array and add key */
1252: *keysp = xrecallocarray(*keysp, *nkeys,
1253: *nkeys + 1, sizeof(struct sshkey *));
1254: (*keysp)[*nkeys] = key;
1.47 djm 1255: if (labelsp != NULL) {
1256: *labelsp = xrecallocarray(*labelsp, *nkeys,
1257: *nkeys + 1, sizeof(char *));
1258: (*labelsp)[*nkeys] = xstrdup((char *)label);
1259: }
1.28 djm 1260: *nkeys = *nkeys + 1;
1261: debug("have %d keys", *nkeys);
1.1 markus 1262: }
1263: }
1.28 djm 1264:
1265: ret = 0;
1266: fail:
1267: rv = f->C_FindObjectsFinal(session);
1268: if (rv != CKR_OK) {
1.1 markus 1269: error("C_FindObjectsFinal failed: %lu", rv);
1.28 djm 1270: ret = -1;
1271: }
1272:
1273: return (ret);
1274: }
1275:
1276: #ifdef WITH_PKCS11_KEYGEN
1277: #define FILL_ATTR(attr, idx, typ, val, len) \
1278: { (attr[idx]).type=(typ); (attr[idx]).pValue=(val); (attr[idx]).ulValueLen=len; idx++; }
1279:
1280: static struct sshkey *
1281: pkcs11_rsa_generate_private_key(struct pkcs11_provider *p, CK_ULONG slotidx,
1282: char *label, CK_ULONG bits, CK_BYTE keyid, u_int32_t *err)
1283: {
1284: struct pkcs11_slotinfo *si;
1285: char *plabel = label ? label : "";
1286: int npub = 0, npriv = 0;
1287: CK_RV rv;
1288: CK_FUNCTION_LIST *f;
1289: CK_SESSION_HANDLE session;
1290: CK_BBOOL true_val = CK_TRUE, false_val = CK_FALSE;
1291: CK_OBJECT_HANDLE pubKey, privKey;
1292: CK_ATTRIBUTE tpub[16], tpriv[16];
1293: CK_MECHANISM mech = {
1294: CKM_RSA_PKCS_KEY_PAIR_GEN, NULL_PTR, 0
1295: };
1296: CK_BYTE pubExponent[] = {
1297: 0x01, 0x00, 0x01 /* RSA_F4 in bytes */
1298: };
1299:
1300: *err = 0;
1301:
1302: FILL_ATTR(tpub, npub, CKA_TOKEN, &true_val, sizeof(true_val));
1303: FILL_ATTR(tpub, npub, CKA_LABEL, plabel, strlen(plabel));
1304: FILL_ATTR(tpub, npub, CKA_ENCRYPT, &false_val, sizeof(false_val));
1305: FILL_ATTR(tpub, npub, CKA_VERIFY, &true_val, sizeof(true_val));
1306: FILL_ATTR(tpub, npub, CKA_VERIFY_RECOVER, &false_val,
1307: sizeof(false_val));
1308: FILL_ATTR(tpub, npub, CKA_WRAP, &false_val, sizeof(false_val));
1309: FILL_ATTR(tpub, npub, CKA_DERIVE, &false_val, sizeof(false_val));
1310: FILL_ATTR(tpub, npub, CKA_MODULUS_BITS, &bits, sizeof(bits));
1311: FILL_ATTR(tpub, npub, CKA_PUBLIC_EXPONENT, pubExponent,
1312: sizeof(pubExponent));
1313: FILL_ATTR(tpub, npub, CKA_ID, &keyid, sizeof(keyid));
1314:
1315: FILL_ATTR(tpriv, npriv, CKA_TOKEN, &true_val, sizeof(true_val));
1316: FILL_ATTR(tpriv, npriv, CKA_LABEL, plabel, strlen(plabel));
1317: FILL_ATTR(tpriv, npriv, CKA_PRIVATE, &true_val, sizeof(true_val));
1318: FILL_ATTR(tpriv, npriv, CKA_SENSITIVE, &true_val, sizeof(true_val));
1319: FILL_ATTR(tpriv, npriv, CKA_DECRYPT, &false_val, sizeof(false_val));
1320: FILL_ATTR(tpriv, npriv, CKA_SIGN, &true_val, sizeof(true_val));
1321: FILL_ATTR(tpriv, npriv, CKA_SIGN_RECOVER, &false_val,
1322: sizeof(false_val));
1323: FILL_ATTR(tpriv, npriv, CKA_UNWRAP, &false_val, sizeof(false_val));
1324: FILL_ATTR(tpriv, npriv, CKA_DERIVE, &false_val, sizeof(false_val));
1325: FILL_ATTR(tpriv, npriv, CKA_ID, &keyid, sizeof(keyid));
1326:
1327: f = p->function_list;
1328: si = &p->slotinfo[slotidx];
1329: session = si->session;
1330:
1331: if ((rv = f->C_GenerateKeyPair(session, &mech, tpub, npub, tpriv, npriv,
1332: &pubKey, &privKey)) != CKR_OK) {
1333: error("%s: key generation failed: error 0x%lx", __func__, rv);
1334: *err = rv;
1335: return NULL;
1336: }
1337:
1338: return pkcs11_fetch_rsa_pubkey(p, slotidx, &pubKey);
1339: }
1340:
1341: static int
1342: pkcs11_decode_hex(const char *hex, unsigned char **dest, size_t *rlen)
1343: {
1344: size_t i, len;
1345: char ptr[3];
1346:
1347: if (dest)
1348: *dest = NULL;
1349: if (rlen)
1350: *rlen = 0;
1351:
1352: if ((len = strlen(hex)) % 2)
1353: return -1;
1354: len /= 2;
1355:
1356: *dest = xmalloc(len);
1357:
1358: ptr[2] = '\0';
1359: for (i = 0; i < len; i++) {
1360: ptr[0] = hex[2 * i];
1361: ptr[1] = hex[(2 * i) + 1];
1362: if (!isxdigit(ptr[0]) || !isxdigit(ptr[1]))
1363: return -1;
1364: (*dest)[i] = (unsigned char)strtoul(ptr, NULL, 16);
1365: }
1366:
1367: if (rlen)
1368: *rlen = len;
1369:
1370: return 0;
1371: }
1372:
1373: static struct ec_curve_info {
1374: const char *name;
1375: const char *oid;
1376: const char *oid_encoded;
1377: size_t size;
1378: } ec_curve_infos[] = {
1379: {"prime256v1", "1.2.840.10045.3.1.7", "06082A8648CE3D030107", 256},
1380: {"secp384r1", "1.3.132.0.34", "06052B81040022", 384},
1381: {"secp521r1", "1.3.132.0.35", "06052B81040023", 521},
1.35 djm 1382: {NULL, NULL, NULL, 0},
1.28 djm 1383: };
1384:
1385: static struct sshkey *
1386: pkcs11_ecdsa_generate_private_key(struct pkcs11_provider *p, CK_ULONG slotidx,
1387: char *label, CK_ULONG bits, CK_BYTE keyid, u_int32_t *err)
1388: {
1389: struct pkcs11_slotinfo *si;
1390: char *plabel = label ? label : "";
1391: int i;
1392: size_t ecparams_size;
1393: unsigned char *ecparams = NULL;
1394: int npub = 0, npriv = 0;
1395: CK_RV rv;
1396: CK_FUNCTION_LIST *f;
1397: CK_SESSION_HANDLE session;
1398: CK_BBOOL true_val = CK_TRUE, false_val = CK_FALSE;
1399: CK_OBJECT_HANDLE pubKey, privKey;
1400: CK_MECHANISM mech = {
1401: CKM_EC_KEY_PAIR_GEN, NULL_PTR, 0
1402: };
1403: CK_ATTRIBUTE tpub[16], tpriv[16];
1404:
1405: *err = 0;
1406:
1407: for (i = 0; ec_curve_infos[i].name; i++) {
1408: if (ec_curve_infos[i].size == bits)
1409: break;
1410: }
1411: if (!ec_curve_infos[i].name) {
1412: error("%s: invalid key size %lu", __func__, bits);
1413: return NULL;
1414: }
1415: if (pkcs11_decode_hex(ec_curve_infos[i].oid_encoded, &ecparams,
1416: &ecparams_size) == -1) {
1417: error("%s: invalid oid", __func__);
1418: return NULL;
1419: }
1420:
1421: FILL_ATTR(tpub, npub, CKA_TOKEN, &true_val, sizeof(true_val));
1422: FILL_ATTR(tpub, npub, CKA_LABEL, plabel, strlen(plabel));
1423: FILL_ATTR(tpub, npub, CKA_ENCRYPT, &false_val, sizeof(false_val));
1424: FILL_ATTR(tpub, npub, CKA_VERIFY, &true_val, sizeof(true_val));
1425: FILL_ATTR(tpub, npub, CKA_VERIFY_RECOVER, &false_val,
1426: sizeof(false_val));
1427: FILL_ATTR(tpub, npub, CKA_WRAP, &false_val, sizeof(false_val));
1428: FILL_ATTR(tpub, npub, CKA_DERIVE, &false_val, sizeof(false_val));
1429: FILL_ATTR(tpub, npub, CKA_EC_PARAMS, ecparams, ecparams_size);
1430: FILL_ATTR(tpub, npub, CKA_ID, &keyid, sizeof(keyid));
1431:
1432: FILL_ATTR(tpriv, npriv, CKA_TOKEN, &true_val, sizeof(true_val));
1433: FILL_ATTR(tpriv, npriv, CKA_LABEL, plabel, strlen(plabel));
1434: FILL_ATTR(tpriv, npriv, CKA_PRIVATE, &true_val, sizeof(true_val));
1435: FILL_ATTR(tpriv, npriv, CKA_SENSITIVE, &true_val, sizeof(true_val));
1436: FILL_ATTR(tpriv, npriv, CKA_DECRYPT, &false_val, sizeof(false_val));
1437: FILL_ATTR(tpriv, npriv, CKA_SIGN, &true_val, sizeof(true_val));
1438: FILL_ATTR(tpriv, npriv, CKA_SIGN_RECOVER, &false_val,
1439: sizeof(false_val));
1440: FILL_ATTR(tpriv, npriv, CKA_UNWRAP, &false_val, sizeof(false_val));
1441: FILL_ATTR(tpriv, npriv, CKA_DERIVE, &false_val, sizeof(false_val));
1442: FILL_ATTR(tpriv, npriv, CKA_ID, &keyid, sizeof(keyid));
1443:
1444: f = p->function_list;
1445: si = &p->slotinfo[slotidx];
1446: session = si->session;
1447:
1448: if ((rv = f->C_GenerateKeyPair(session, &mech, tpub, npub, tpriv, npriv,
1449: &pubKey, &privKey)) != CKR_OK) {
1450: error("%s: key generation failed: error 0x%lx", __func__, rv);
1451: *err = rv;
1452: return NULL;
1453: }
1454:
1455: return pkcs11_fetch_ecdsa_pubkey(p, slotidx, &pubKey);
1.1 markus 1456: }
1.28 djm 1457: #endif /* WITH_PKCS11_KEYGEN */
1.1 markus 1458:
1.28 djm 1459: /*
1460: * register a new provider, fails if provider already exists. if
1461: * keyp is provided, fetch keys.
1462: */
1463: static int
1.47 djm 1464: pkcs11_register_provider(char *provider_id, char *pin,
1465: struct sshkey ***keyp, char ***labelsp,
1.28 djm 1466: struct pkcs11_provider **providerp, CK_ULONG user)
1.1 markus 1467: {
1468: int nkeys, need_finalize = 0;
1.28 djm 1469: int ret = -1;
1.1 markus 1470: struct pkcs11_provider *p = NULL;
1471: void *handle = NULL;
1472: CK_RV (*getfunctionlist)(CK_FUNCTION_LIST **);
1473: CK_RV rv;
1474: CK_FUNCTION_LIST *f = NULL;
1475: CK_TOKEN_INFO *token;
1476: CK_ULONG i;
1477:
1.28 djm 1478: if (providerp == NULL)
1479: goto fail;
1480: *providerp = NULL;
1481:
1482: if (keyp != NULL)
1483: *keyp = NULL;
1.47 djm 1484: if (labelsp != NULL)
1485: *labelsp = NULL;
1.28 djm 1486:
1.1 markus 1487: if (pkcs11_provider_lookup(provider_id) != NULL) {
1.23 djm 1488: debug("%s: provider already registered: %s",
1489: __func__, provider_id);
1.1 markus 1490: goto fail;
1491: }
1.28 djm 1492: /* open shared pkcs11-library */
1.1 markus 1493: if ((handle = dlopen(provider_id, RTLD_NOW)) == NULL) {
1494: error("dlopen %s failed: %s", provider_id, dlerror());
1495: goto fail;
1496: }
1497: if ((getfunctionlist = dlsym(handle, "C_GetFunctionList")) == NULL) {
1498: error("dlsym(C_GetFunctionList) failed: %s", dlerror());
1499: goto fail;
1500: }
1501: p = xcalloc(1, sizeof(*p));
1502: p->name = xstrdup(provider_id);
1503: p->handle = handle;
1504: /* setup the pkcs11 callbacks */
1505: if ((rv = (*getfunctionlist)(&f)) != CKR_OK) {
1.23 djm 1506: error("C_GetFunctionList for provider %s failed: %lu",
1507: provider_id, rv);
1.1 markus 1508: goto fail;
1509: }
1510: p->function_list = f;
1511: if ((rv = f->C_Initialize(NULL)) != CKR_OK) {
1.23 djm 1512: error("C_Initialize for provider %s failed: %lu",
1513: provider_id, rv);
1.1 markus 1514: goto fail;
1515: }
1516: need_finalize = 1;
1517: if ((rv = f->C_GetInfo(&p->info)) != CKR_OK) {
1.23 djm 1518: error("C_GetInfo for provider %s failed: %lu",
1519: provider_id, rv);
1.1 markus 1520: goto fail;
1521: }
1522: rmspace(p->info.manufacturerID, sizeof(p->info.manufacturerID));
1523: rmspace(p->info.libraryDescription, sizeof(p->info.libraryDescription));
1.23 djm 1524: debug("provider %s: manufacturerID <%s> cryptokiVersion %d.%d"
1.1 markus 1525: " libraryDescription <%s> libraryVersion %d.%d",
1.23 djm 1526: provider_id,
1.1 markus 1527: p->info.manufacturerID,
1528: p->info.cryptokiVersion.major,
1529: p->info.cryptokiVersion.minor,
1530: p->info.libraryDescription,
1531: p->info.libraryVersion.major,
1532: p->info.libraryVersion.minor);
1533: if ((rv = f->C_GetSlotList(CK_TRUE, NULL, &p->nslots)) != CKR_OK) {
1534: error("C_GetSlotList failed: %lu", rv);
1535: goto fail;
1536: }
1537: if (p->nslots == 0) {
1.44 djm 1538: debug("%s: provider %s returned no slots", __func__,
1.23 djm 1539: provider_id);
1.28 djm 1540: ret = -SSH_PKCS11_ERR_NO_SLOTS;
1.1 markus 1541: goto fail;
1542: }
1543: p->slotlist = xcalloc(p->nslots, sizeof(CK_SLOT_ID));
1544: if ((rv = f->C_GetSlotList(CK_TRUE, p->slotlist, &p->nslots))
1545: != CKR_OK) {
1.23 djm 1546: error("C_GetSlotList for provider %s failed: %lu",
1547: provider_id, rv);
1.1 markus 1548: goto fail;
1549: }
1550: p->slotinfo = xcalloc(p->nslots, sizeof(struct pkcs11_slotinfo));
1551: p->valid = 1;
1552: nkeys = 0;
1553: for (i = 0; i < p->nslots; i++) {
1554: token = &p->slotinfo[i].token;
1555: if ((rv = f->C_GetTokenInfo(p->slotlist[i], token))
1556: != CKR_OK) {
1.23 djm 1557: error("C_GetTokenInfo for provider %s slot %lu "
1558: "failed: %lu", provider_id, (unsigned long)i, rv);
1.20 djm 1559: continue;
1560: }
1561: if ((token->flags & CKF_TOKEN_INITIALIZED) == 0) {
1.23 djm 1562: debug2("%s: ignoring uninitialised token in "
1563: "provider %s slot %lu", __func__,
1564: provider_id, (unsigned long)i);
1.1 markus 1565: continue;
1566: }
1567: rmspace(token->label, sizeof(token->label));
1568: rmspace(token->manufacturerID, sizeof(token->manufacturerID));
1569: rmspace(token->model, sizeof(token->model));
1570: rmspace(token->serialNumber, sizeof(token->serialNumber));
1.23 djm 1571: debug("provider %s slot %lu: label <%s> manufacturerID <%s> "
1572: "model <%s> serial <%s> flags 0x%lx",
1573: provider_id, (unsigned long)i,
1.1 markus 1574: token->label, token->manufacturerID, token->model,
1575: token->serialNumber, token->flags);
1.28 djm 1576: /*
1577: * open session, login with pin and retrieve public
1578: * keys (if keyp is provided)
1579: */
1.45 djm 1580: if ((ret = pkcs11_open_session(p, i, pin, user)) != 0 ||
1581: keyp == NULL)
1582: continue;
1.47 djm 1583: pkcs11_fetch_keys(p, i, keyp, labelsp, &nkeys);
1584: pkcs11_fetch_certs(p, i, keyp, labelsp, &nkeys);
1.45 djm 1585: if (nkeys == 0 && !p->slotinfo[i].logged_in &&
1586: pkcs11_interactive) {
1587: /*
1588: * Some tokens require login before they will
1589: * expose keys.
1590: */
1591: if (pkcs11_login_slot(p, &p->slotinfo[i],
1592: CKU_USER) < 0) {
1593: error("login failed");
1.28 djm 1594: continue;
1.45 djm 1595: }
1.47 djm 1596: pkcs11_fetch_keys(p, i, keyp, labelsp, &nkeys);
1597: pkcs11_fetch_certs(p, i, keyp, labelsp, &nkeys);
1.28 djm 1598: }
1.1 markus 1599: }
1.28 djm 1600:
1601: /* now owned by caller */
1602: *providerp = p;
1603:
1604: TAILQ_INSERT_TAIL(&pkcs11_providers, p, next);
1605: p->refcount++; /* add to provider list */
1606:
1607: return (nkeys);
1.1 markus 1608: fail:
1609: if (need_finalize && (rv = f->C_Finalize(NULL)) != CKR_OK)
1.23 djm 1610: error("C_Finalize for provider %s failed: %lu",
1611: provider_id, rv);
1.1 markus 1612: if (p) {
1.28 djm 1613: free(p->name);
1.7 djm 1614: free(p->slotlist);
1615: free(p->slotinfo);
1616: free(p);
1.1 markus 1617: }
1618: if (handle)
1619: dlclose(handle);
1.48 markus 1620: if (ret > 0)
1621: ret = -1;
1.28 djm 1622: return (ret);
1623: }
1624:
1625: /*
1626: * register a new provider and get number of keys hold by the token,
1627: * fails if provider already exists
1628: */
1629: int
1.47 djm 1630: pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp,
1631: char ***labelsp)
1.28 djm 1632: {
1633: struct pkcs11_provider *p = NULL;
1634: int nkeys;
1635:
1.47 djm 1636: nkeys = pkcs11_register_provider(provider_id, pin, keyp, labelsp,
1637: &p, CKU_USER);
1.28 djm 1638:
1639: /* no keys found or some other error, de-register provider */
1640: if (nkeys <= 0 && p != NULL) {
1641: TAILQ_REMOVE(&pkcs11_providers, p, next);
1642: pkcs11_provider_finalize(p);
1643: pkcs11_provider_unref(p);
1644: }
1645: if (nkeys == 0)
1646: debug("%s: provider %s returned no keys", __func__,
1647: provider_id);
1648:
1649: return (nkeys);
1650: }
1651:
1652: #ifdef WITH_PKCS11_KEYGEN
1653: struct sshkey *
1654: pkcs11_gakp(char *provider_id, char *pin, unsigned int slotidx, char *label,
1655: unsigned int type, unsigned int bits, unsigned char keyid, u_int32_t *err)
1656: {
1657: struct pkcs11_provider *p = NULL;
1658: struct pkcs11_slotinfo *si;
1659: CK_FUNCTION_LIST *f;
1660: CK_SESSION_HANDLE session;
1661: struct sshkey *k = NULL;
1662: int ret = -1, reset_pin = 0, reset_provider = 0;
1663: CK_RV rv;
1664:
1665: *err = 0;
1666:
1667: if ((p = pkcs11_provider_lookup(provider_id)) != NULL)
1668: debug("%s: provider \"%s\" available", __func__, provider_id);
1.47 djm 1669: else if ((ret = pkcs11_register_provider(provider_id, pin, NULL, NULL,
1670: &p, CKU_SO)) < 0) {
1.28 djm 1671: debug("%s: could not register provider %s", __func__,
1672: provider_id);
1673: goto out;
1674: } else
1675: reset_provider = 1;
1676:
1677: f = p->function_list;
1678: si = &p->slotinfo[slotidx];
1679: session = si->session;
1680:
1681: if ((rv = f->C_SetOperationState(session , pin, strlen(pin),
1682: CK_INVALID_HANDLE, CK_INVALID_HANDLE)) != CKR_OK) {
1683: debug("%s: could not supply SO pin: %lu", __func__, rv);
1684: reset_pin = 0;
1685: } else
1686: reset_pin = 1;
1687:
1688: switch (type) {
1689: case KEY_RSA:
1690: if ((k = pkcs11_rsa_generate_private_key(p, slotidx, label,
1691: bits, keyid, err)) == NULL) {
1692: debug("%s: failed to generate RSA key", __func__);
1693: goto out;
1694: }
1695: break;
1696: case KEY_ECDSA:
1697: if ((k = pkcs11_ecdsa_generate_private_key(p, slotidx, label,
1698: bits, keyid, err)) == NULL) {
1699: debug("%s: failed to generate ECDSA key", __func__);
1700: goto out;
1701: }
1702: break;
1703: default:
1704: *err = SSH_PKCS11_ERR_GENERIC;
1705: debug("%s: unknown type %d", __func__, type);
1706: goto out;
1707: }
1708:
1709: out:
1710: if (reset_pin)
1711: f->C_SetOperationState(session , NULL, 0, CK_INVALID_HANDLE,
1712: CK_INVALID_HANDLE);
1713:
1714: if (reset_provider)
1715: pkcs11_del_provider(provider_id);
1716:
1717: return (k);
1718: }
1719:
1720: struct sshkey *
1721: pkcs11_destroy_keypair(char *provider_id, char *pin, unsigned long slotidx,
1722: unsigned char keyid, u_int32_t *err)
1723: {
1724: struct pkcs11_provider *p = NULL;
1725: struct pkcs11_slotinfo *si;
1726: struct sshkey *k = NULL;
1727: int reset_pin = 0, reset_provider = 0;
1728: CK_ULONG nattrs;
1729: CK_FUNCTION_LIST *f;
1730: CK_SESSION_HANDLE session;
1731: CK_ATTRIBUTE attrs[16];
1732: CK_OBJECT_CLASS key_class;
1733: CK_KEY_TYPE key_type;
1734: CK_OBJECT_HANDLE obj = CK_INVALID_HANDLE;
1735: CK_RV rv;
1736:
1737: *err = 0;
1738:
1739: if ((p = pkcs11_provider_lookup(provider_id)) != NULL) {
1740: debug("%s: using provider \"%s\"", __func__, provider_id);
1.47 djm 1741: } else if (pkcs11_register_provider(provider_id, pin, NULL, NULL, &p,
1.28 djm 1742: CKU_SO) < 0) {
1743: debug("%s: could not register provider %s", __func__,
1744: provider_id);
1745: goto out;
1746: } else
1747: reset_provider = 1;
1748:
1749: f = p->function_list;
1750: si = &p->slotinfo[slotidx];
1751: session = si->session;
1752:
1753: if ((rv = f->C_SetOperationState(session , pin, strlen(pin),
1754: CK_INVALID_HANDLE, CK_INVALID_HANDLE)) != CKR_OK) {
1755: debug("%s: could not supply SO pin: %lu", __func__, rv);
1756: reset_pin = 0;
1757: } else
1758: reset_pin = 1;
1759:
1760: /* private key */
1761: nattrs = 0;
1762: key_class = CKO_PRIVATE_KEY;
1763: FILL_ATTR(attrs, nattrs, CKA_CLASS, &key_class, sizeof(key_class));
1764: FILL_ATTR(attrs, nattrs, CKA_ID, &keyid, sizeof(keyid));
1765:
1766: if (pkcs11_find(p, slotidx, attrs, nattrs, &obj) == 0 &&
1767: obj != CK_INVALID_HANDLE) {
1768: if ((rv = f->C_DestroyObject(session, obj)) != CKR_OK) {
1769: debug("%s: could not destroy private key 0x%hhx",
1770: __func__, keyid);
1771: *err = rv;
1772: goto out;
1773: }
1774: }
1775:
1776: /* public key */
1777: nattrs = 0;
1778: key_class = CKO_PUBLIC_KEY;
1779: FILL_ATTR(attrs, nattrs, CKA_CLASS, &key_class, sizeof(key_class));
1780: FILL_ATTR(attrs, nattrs, CKA_ID, &keyid, sizeof(keyid));
1781:
1782: if (pkcs11_find(p, slotidx, attrs, nattrs, &obj) == 0 &&
1783: obj != CK_INVALID_HANDLE) {
1784:
1785: /* get key type */
1786: nattrs = 0;
1787: FILL_ATTR(attrs, nattrs, CKA_KEY_TYPE, &key_type,
1788: sizeof(key_type));
1789: rv = f->C_GetAttributeValue(session, obj, attrs, nattrs);
1790: if (rv != CKR_OK) {
1791: debug("%s: could not get key type of public key 0x%hhx",
1792: __func__, keyid);
1793: *err = rv;
1794: key_type = -1;
1795: }
1796: if (key_type == CKK_RSA)
1797: k = pkcs11_fetch_rsa_pubkey(p, slotidx, &obj);
1798: else if (key_type == CKK_ECDSA)
1799: k = pkcs11_fetch_ecdsa_pubkey(p, slotidx, &obj);
1800:
1801: if ((rv = f->C_DestroyObject(session, obj)) != CKR_OK) {
1802: debug("%s: could not destroy public key 0x%hhx",
1803: __func__, keyid);
1804: *err = rv;
1805: goto out;
1806: }
1807: }
1808:
1809: out:
1810: if (reset_pin)
1811: f->C_SetOperationState(session , NULL, 0, CK_INVALID_HANDLE,
1812: CK_INVALID_HANDLE);
1813:
1814: if (reset_provider)
1815: pkcs11_del_provider(provider_id);
1816:
1817: return (k);
1.1 markus 1818: }
1.28 djm 1819: #endif /* WITH_PKCS11_KEYGEN */
1.2 markus 1820: #else
1821: int
1.50 ! djm 1822: pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp,
! 1823: char ***labelsp)
1.2 markus 1824: {
1825: error("dlopen() not supported");
1826: return (-1);
1827: }
1.28 djm 1828: #endif /* HAVE_DLOPEN */