36 #include <ldns/ldns.h> 38 #include <libxml/tree.h> 39 #include <libxml/parser.h> 40 #include <libxml/xpath.h> 41 #include <libxml/xpathInternals.h> 42 #include <libxml/relaxng.h> 53 #define HSM_TOKEN_LABEL_LENGTH 32 61 ldns_pkcs11_rv_str(CK_RV rv)
70 return "CKR_HOST_MEMORY";
72 return "CKR_GENERAL_ERROR";
74 return "CKR_FUNCTION_FAILED";
76 return "CKR_SLOT_ID_INVALID";
78 return "CKR_ATTRIBUTE_READ_ONLY";
80 return "CKR_ATTRIBUTE_SENSITIVE";
82 return "CKR_ATTRIBUTE_TYPE_INVALID";
84 return "CKR_ATTRIBUTE_VALUE_INVALID";
86 return "CKR_DATA_INVALID";
88 return "CKR_DATA_LEN_RANGE";
90 return "CKR_DEVICE_ERROR";
92 return "CKR_DEVICE_MEMORY";
94 return "CKR_DEVICE_REMOVED";
96 return "CKR_ENCRYPTED_DATA_INVALID";
98 return "CKR_ENCRYPTED_DATA_LEN_RANGE";
100 return "CKR_FUNCTION_CANCELED";
102 return "CKR_FUNCTION_NOT_PARALLEL";
104 return "CKR_FUNCTION_NOT_SUPPORTED";
106 return "CKR_KEY_HANDLE_INVALID";
108 return "CKR_KEY_SIZE_RANGE";
110 return "CKR_KEY_TYPE_INCONSISTENT";
112 return "CKR_MECHANISM_INVALID";
114 return "CKR_MECHANISM_PARAM_INVALID";
116 return "CKR_OBJECT_HANDLE_INVALID";
118 return "CKR_OPERATION_ACTIVE";
120 return "CKR_OPERATION_NOT_INITIALIZED";
122 return "CKR_PIN_INCORRECT";
124 return "CKR_PIN_INVALID";
126 return "CKR_PIN_LEN_RANGE";
128 return "CKR_SESSION_CLOSED";
130 return "CKR_SESSION_COUNT";
132 return "CKR_SESSION_HANDLE_INVALID";
134 return "CKR_SESSION_PARALLEL_NOT_SUPPORTED";
136 return "CKR_SESSION_READ_ONLY";
138 return "CKR_SESSION_EXISTS";
140 return "CKR_SIGNATURE_INVALID";
142 return "CKR_SIGNATURE_LEN_RANGE";
144 return "CKR_TEMPLATE_INCOMPLETE";
146 return "CKR_TEMPLATE_INCONSISTENT";
148 return "CKR_TOKEN_NOT_PRESENT";
150 return "CKR_TOKEN_NOT_RECOGNIZED";
152 return "CKR_TOKEN_WRITE_PROTECTED";
154 return "CKR_UNWRAPPING_KEY_HANDLE_INVALID";
156 return "CKR_UNWRAPPING_KEY_SIZE_RANGE";
158 return "CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT";
160 return "CKR_USER_ALREADY_LOGGED_IN";
162 return "CKR_USER_NOT_LOGGED_IN";
164 return "CKR_USER_PIN_NOT_INITIALIZED";
166 return "CKR_USER_TYPE_INVALID";
168 return "CKR_WRAPPED_KEY_INVALID";
170 return "CKR_WRAPPED_KEY_LEN_RANGE";
172 return "CKR_WRAPPING_KEY_HANDLE_INVALID";
174 return "CKR_WRAPPING_KEY_SIZE_RANGE";
176 return "CKR_WRAPPING_KEY_TYPE_INCONSISTENT";
178 return "CKR_RANDOM_SEED_NOT_SUPPORTED";
183 return "CKR_VENDOR_DEFINED";
185 return "CKR_BUFFER_TOO_SMALL";
187 return "CKR_SAVED_STATE_INVALID";
189 return "CKR_INFORMATION_SENSITIVE";
191 return "CKR_STATE_UNSAVEABLE";
193 return "CKR_CRYPTOKI_NOT_INITIALIZED";
195 return "CKR_CRYPTOKI_ALREADY_INITIALIZED";
197 return "CKR_MUTEX_BAD";
199 return "CKR_MUTEX_NOT_LOCKED";
201 return "Unknown error";
207 const char *message, ...)
211 if (ctx && ctx->
error == 0) {
215 va_start(args, message);
234 hsm_pkcs11_check_error(
hsm_ctx_t *
ctx, CK_RV rv,
const char *action)
237 if (ctx && ctx->
error == 0) {
238 ctx->
error = (int) rv;
249 hsm_pkcs11_unload_functions(
void *handle)
252 #if defined(HAVE_LOADLIBRARY) 254 #elif defined(HAVE_DLOPEN) 255 (void) dlclose(handle);
264 CK_C_GetFunctionList pGetFunctionList = NULL;
266 if (module && module->
path) {
269 #if defined(HAVE_LOADLIBRARY) 271 HINSTANCE hDLL = LoadLibrary(_T(module->
path));
279 pGetFunctionList = (CK_C_GetFunctionList)
280 GetProcAddress(hDLL, _T(
"C_GetFunctionList"));
282 #elif defined(HAVE_DLOPEN) 284 void* pDynLib = dlopen(module->
path, RTLD_NOW | RTLD_LOCAL);
286 if (pDynLib == NULL) {
292 pGetFunctionList = (CK_C_GetFunctionList) dlsym(pDynLib,
"C_GetFunctionList");
301 #ifdef HAVE_PKCS11_MODULE 302 return C_GetFunctionList(pkcs11_functions);
308 if (pGetFunctionList == NULL) {
324 if (data == NULL || len == NULL)
return;
328 while ((
unsigned short int)(*p) == 0 && l > 1) {
340 hsm_pkcs11_check_token_name(
hsm_ctx_t *ctx,
343 const char *token_name)
352 if (hsm_pkcs11_check_error(ctx, rv,
"C_GetTokenInfo")) {
358 memcpy(token_name_bytes, token_name, strlen(token_name));
363 result = memcmp(token_info.
label,
372 uint8_t use_pubkey, uint8_t allowextract, uint8_t require_backup)
376 if (!name || !module || !tokenlabel)
return NULL;
383 r->
name = strdup(name);
384 r->
module = strdup(module);
391 r->
pin = strdup(pin);
419 const char *token_name, CK_SLOT_ID *slotId)
427 if (token_name == NULL || slotId == NULL)
return HSM_ERROR;
430 if (hsm_pkcs11_check_error(ctx, rv,
"get slot list")) {
436 "No slots found in HSM");
438 }
else if (slotCount > (SIZE_MAX /
sizeof(CK_SLOT_ID))) {
440 "Too many slots found in HSM");
444 slotIds = malloc(
sizeof(CK_SLOT_ID) * slotCount);
445 if(slotIds == NULL) {
447 "Could not allocate slot ID table");
452 if (hsm_pkcs11_check_error(ctx, rv,
"get slot list")) {
456 for (cur_slot = 0; cur_slot < slotCount; cur_slot++) {
457 if (hsm_pkcs11_check_token_name(ctx,
461 *slotId = slotIds[cur_slot];
469 "could not find token with the name %s", token_name);
478 hsm_module_new(
const char *repository,
479 const char *token_label,
485 if (!repository || !path)
return NULL;
489 if (!module)
return NULL;
503 module->
name = strdup(repository);
505 module->
path = strdup(path);
516 if (module->
name) free(module->
name);
518 if (module->
path) free(module->
path);
526 hsm_session_new(
hsm_module_t *module, CK_SESSION_HANDLE session_handle)
531 session->
session = session_handle;
555 const char *repository,
const char *token_label,
556 const char *module_path,
const char *pin,
563 CK_SESSION_HANDLE session_handle;
564 int first = 1, result;
571 module = hsm_module_new(repository, token_label, module_path, config);
573 rv = hsm_pkcs11_load_functions(module);
576 "hsm_session_init()",
577 "PKCS#11 module load failed: %s", module_path);
578 hsm_module_free(module);
585 if (hsm_pkcs11_check_error(ctx, rv,
"Initialization")) {
586 hsm_module_free(module);
592 result = hsm_get_slot_id(ctx, module->
sym, token_label, &slot_id);
594 hsm_module_free(module);
602 if (hsm_pkcs11_check_error(ctx, rv,
"Open first session")) {
603 hsm_module_free(module);
608 (
unsigned char *) pin,
609 strlen((
char *)pin));
612 *session = hsm_session_new(module, session_handle);
616 if (session_handle) {
618 C_CloseSession(session_handle);
619 if (hsm_pkcs11_check_error(ctx, rv,
620 "finalize after failed login")) {
621 hsm_module_free(module);
629 if (hsm_pkcs11_check_error(ctx, rv,
"finalize after failed login")) {
630 hsm_module_free(module);
634 hsm_module_free(module);
639 "hsm_session_init()",
640 "Incorrect PIN for repository %s", repository);
654 CK_SESSION_HANDLE session_handle;
658 result = hsm_get_slot_id(ctx,
662 if (result !=
HSM_OK)
return NULL;
669 if (hsm_pkcs11_check_error(ctx, rv,
"Clone session")) {
672 new_session = hsm_session_new(session->
module, session_handle);
698 hsm_session_free(ctx->
session[i]);
721 (void) hsm_pkcs11_check_error(ctx, rv,
"Logout");
726 (void) hsm_pkcs11_check_error(ctx, rv,
"Close session");
731 (void) hsm_pkcs11_check_error(ctx, rv,
"Finalize");
734 hsm_module_free(session->
module);
737 hsm_session_free(session);
747 hsm_ctx_close(
hsm_ctx_t *ctx,
int unload)
753 hsm_session_close(ctx, ctx->
session[i], unload);
770 if (!ctx || !session)
return -1;
786 new_ctx = hsm_ctx_new();
788 new_session = hsm_session_clone(ctx, ctx->
session[i]);
792 hsm_ctx_close(new_ctx, 0);
795 hsm_ctx_add_session(new_ctx, new_session);
835 CK_KEY_TYPE key_type;
846 if (hsm_pkcs11_check_error(ctx, rv,
847 "Get attr value algorithm type")) {
855 if ((
CK_LONG)
template[0].ulValueLen < 1) {
895 if (hsm_pkcs11_check_error(ctx, rv,
896 "Get attr value algorithm type")) {
900 if ((
CK_ULONG)
template[0].ulValueLen < 1) {
910 if (hsm_pkcs11_check_error(ctx, rv,
"Could not get the size of the modulus of the private key")) {
915 modulus = (
CK_BYTE_PTR)malloc(template2[0].ulValueLen);
916 template2[0].pValue = modulus;
917 if (modulus == NULL) {
919 "Error allocating memory for modulus");
929 if (hsm_pkcs11_check_error(ctx, rv,
"Could not get the modulus of the private key")) {
935 modulus_bits = template2[0].ulValueLen * 8;
937 for (
int i = 0; modulus_bits && (modulus[i] & mask) == 0; modulus_bits--) {
971 if (hsm_pkcs11_check_error(ctx, rv,
"Could not get the size of the prime of the private key")) {
975 return template2[0].ulValueLen * 8;
981 static unsigned char *
995 if (!session || !session->
module || !key || !data_len) {
1004 if (hsm_pkcs11_check_error(ctx, rv,
"C_GetAttributeValue")) {
1007 value_len =
template[0].ulValueLen;
1009 value =
template[0].pValue = malloc(value_len);
1012 "Error allocating memory for value");
1015 memset(value, 0, value_len);
1022 if (hsm_pkcs11_check_error(ctx, rv,
"get attribute value")) {
1027 if(value_len !=
template[0].ulValueLen) {
1029 "HSM returned two different length for a same CKA_EC_POINT. " \
1030 "Abnormal behaviour detected.");
1036 if (value_len < 2) {
1038 "The DER value is too short");
1044 if (value[0] != 0x04) {
1046 "Invalid identifier octet in the DER value");
1053 if (value[1] <= 0x7F) {
1055 }
else if (value[1] == 0x80) {
1057 "Indefinite length is not supported in DER values");
1062 header_len += value[1] & 0x80;
1066 if (value_len - header_len < 2) {
1068 "The value is too short");
1075 if (value[header_len] != 0x04) {
1077 "The value is not uncompressed");
1083 *data_len = value_len - header_len;
1084 data = malloc(*data_len);
1087 "Error allocating memory for data");
1092 memcpy(data, value + header_len, *data_len);
1107 unsigned char*
value = hsm_get_key_ecdsa_value(ctx, session, key, &value_len);
1110 if (value == NULL)
return 0;
1112 if( ((
CK_ULONG) - 1) / (8/2) < value_len) {
1118 bits = value_len * 8 / 2;
1129 switch (algorithm) {
1131 return hsm_get_key_size_rsa(ctx, session, key);
1134 return hsm_get_key_size_dsa(ctx, session, key);
1140 return hsm_get_key_size_ecdsa(ctx, session, key);
1146 static CK_OBJECT_HANDLE
1147 hsm_find_object_handle_for_id(
hsm_ctx_t *ctx,
1149 CK_OBJECT_CLASS key_class,
1154 CK_OBJECT_HANDLE object;
1158 {
CKA_CLASS, &key_class,
sizeof(key_class) },
1164 if (hsm_pkcs11_check_error(ctx, rv,
"Find objects init")) {
1172 if (hsm_pkcs11_check_error(ctx, rv,
"Find object")) {
1174 hsm_pkcs11_check_error(ctx, rv,
"Find objects cleanup");
1179 if (hsm_pkcs11_check_error(ctx, rv,
"Find object final")) {
1183 if (objectCount > 0) {
1195 static unsigned char *
1196 hsm_hex_parse(
const char *hex,
size_t *len)
1198 unsigned char *bytes;
1203 if (!len)
return NULL;
1206 if (!hex)
return NULL;
1207 hex_len = strlen(hex);
1208 if (hex_len % 2 != 0) {
1213 bytes = malloc(*len);
1214 for (i = 0; i < *len; i++) {
1215 bytes[i] = ldns_hexdigit_to_int(hex[2*i]) * 16 +
1216 ldns_hexdigit_to_int(hex[2*i+1]);
1226 hsm_hex_unparse(
char *dst,
const unsigned char *src,
size_t len)
1228 size_t dst_len = len*2 + 1;
1231 for (i = 0; i < len; i++) {
1232 snprintf(dst + (2*i), dst_len,
"%02x", src[i]);
1244 CK_OBJECT_HANDLE
object,
1260 if (hsm_pkcs11_check_error(ctx, rv,
"Get attr value")) {
1265 if ((
CK_LONG)
template[0].ulValueLen < 1) {
1271 template[0].pValue = malloc(
template[0].ulValueLen);
1277 if (hsm_pkcs11_check_error(ctx, rv,
"Get attr value 2")) {
1279 free(
template[0].pValue);
1283 *len =
template[0].ulValueLen;
1284 return template[0].pValue;
1292 libhsm_key_new_privkey_object_handle(
hsm_ctx_t *ctx,
1294 CK_OBJECT_HANDLE
object)
1300 id = hsm_get_id_for_object(ctx, session,
object, &len);
1302 if (!
id)
return NULL;
1304 key = libhsm_key_new();
1308 key->
public_key = hsm_find_object_handle_for_id(
1326 hsm_list_keys_session_internal(
hsm_ctx_t *ctx,
1336 {
CKA_CLASS, &key_class,
sizeof(key_class) },
1343 CK_OBJECT_HANDLE
object[max_object_count];
1344 CK_OBJECT_HANDLE *key_handles = NULL, *new_key_handles = NULL;
1349 if (hsm_pkcs11_check_error(ctx, rv,
"Find objects init")) {
1354 while (objectCount > 0) {
1359 if (hsm_pkcs11_check_error(ctx, rv,
"Find first object")) {
1361 hsm_pkcs11_check_error(ctx, rv,
"Find objects cleanup");
1365 total_count += objectCount;
1366 if (objectCount > 0 && store) {
1367 if (SIZE_MAX /
sizeof(CK_OBJECT_HANDLE) < total_count) {
1369 "Too much object handle returned by HSM to allocate key_handles");
1373 new_key_handles = realloc(key_handles, total_count *
sizeof(CK_OBJECT_HANDLE));
1374 if (new_key_handles != NULL) {
1375 key_handles = new_key_handles;
1378 "Error allocating memory for object handle (OOM)");
1382 for (i = 0; i < objectCount; i++) {
1383 key_handles[j] =
object[i];
1390 if (hsm_pkcs11_check_error(ctx, rv,
"Find objects final")) {
1397 "Too much object handle returned by HSM to allocate keys");
1404 "Error allocating memory for keys table (OOM)");
1408 for (i = 0; i < total_count; i++) {
1409 key = libhsm_key_new_privkey_object_handle(ctx, session,
1420 *count = total_count;
1441 return hsm_list_keys_session_internal(ctx, session, count, 1);
1450 const unsigned char *
id,
size_t len)
1453 CK_OBJECT_HANDLE private_key_handle;
1455 private_key_handle = hsm_find_object_handle_for_id(
1461 if (private_key_handle != 0) {
1462 key = libhsm_key_new_privkey_object_handle(ctx, session,
1463 private_key_handle);
1481 const unsigned char *
id,
1487 if (!
id)
return NULL;
1490 key = hsm_find_key_by_id_session(ctx, ctx->
session[i],
id, len);
1491 if (key)
return key;
1503 hsm_find_repository_session(
hsm_ctx_t *ctx,
const char *repository)
1523 "hsm_find_repository_session()",
1524 "Can't find repository: %s", repository);
1538 unsigned long hKey = 0;
1539 unsigned char *data = NULL;
1540 size_t data_size = 0;
1548 if (!session || !session->
module) {
1563 if (hsm_pkcs11_check_error(ctx, rv,
"C_GetAttributeValue")) {
1566 public_exponent_len =
template[0].ulValueLen;
1567 modulus_len =
template[1].ulValueLen;
1569 public_exponent =
template[0].pValue = malloc(public_exponent_len);
1570 if (!public_exponent) {
1572 "Error allocating memory for public exponent");
1576 modulus =
template[1].pValue = malloc(modulus_len);
1579 "Error allocating memory for modulus");
1580 free(public_exponent);
1589 if (hsm_pkcs11_check_error(ctx, rv,
"get attribute value")) {
1590 free(
template[0].pValue);
1591 free(
template[1].pValue);
1596 hsm_remove_leading_zeroes(public_exponent, &public_exponent_len);
1597 hsm_remove_leading_zeroes(modulus, &modulus_len);
1599 data_size = public_exponent_len + modulus_len + 1;
1600 if (public_exponent_len <= 255) {
1601 data = malloc(data_size);
1604 "Error allocating memory for pub key rr data");
1605 free(public_exponent);
1609 data[0] = public_exponent_len;
1610 memcpy(&data[1], public_exponent, public_exponent_len);
1611 memcpy(&data[1 + public_exponent_len], modulus, modulus_len);
1612 }
else if (public_exponent_len <= 65535) {
1614 data = malloc(data_size);
1617 "Error allocating memory for pub key rr data");
1618 free(public_exponent);
1623 ldns_write_uint16(&data[1], (uint16_t) public_exponent_len);
1624 memcpy(&data[3], public_exponent, public_exponent_len);
1625 memcpy(&data[3 + public_exponent_len], modulus, modulus_len);
1628 "Public exponent too big");
1629 free(public_exponent);
1633 rdf = ldns_rdf_new(LDNS_RDF_TYPE_B64, data_size, data);
1634 free(public_exponent);
1653 unsigned char *data = NULL;
1654 size_t data_size = 0;
1664 if (!session || !session->
module) {
1674 if (hsm_pkcs11_check_error(ctx, rv,
"C_GetAttributeValue")) {
1677 prime_len =
template[0].ulValueLen;
1678 subprime_len =
template[1].ulValueLen;
1679 base_len =
template[2].ulValueLen;
1680 value_len =
template[3].ulValueLen;
1682 prime =
template[0].pValue = malloc(prime_len);
1685 "Error allocating memory for prime");
1689 subprime =
template[1].pValue = malloc(subprime_len);
1692 "Error allocating memory for subprime");
1697 base =
template[2].pValue = malloc(base_len);
1700 "Error allocating memory for base");
1706 value =
template[3].pValue = malloc(value_len);
1709 "Error allocating memory for value");
1721 if (hsm_pkcs11_check_error(ctx, rv,
"get attribute value")) {
1729 data_size = prime_len + subprime_len + base_len + value_len + 1;
1730 data = malloc(data_size);
1733 "Error allocating memory for pub key rr data");
1740 data[0] = (prime_len - 64) / 8;
1741 memcpy(&data[1], subprime, subprime_len);
1742 memcpy(&data[1 + subprime_len], prime, prime_len);
1743 memcpy(&data[1 + subprime_len + prime_len], base, base_len);
1744 memcpy(&data[1 + subprime_len + prime_len + base_len], value, value_len);
1746 rdf = ldns_rdf_new(LDNS_RDF_TYPE_B64, data_size, data);
1768 if (!session || !session->
module) {
1778 if (hsm_pkcs11_check_error(ctx, rv,
"C_GetAttributeValue")) {
1781 value_len =
template[0].ulValueLen;
1783 value =
template[0].pValue = malloc(value_len);
1786 "Error allocating memory for value");
1795 if (hsm_pkcs11_check_error(ctx, rv,
"get attribute value")) {
1800 rdf = ldns_rdf_new(LDNS_RDF_TYPE_B64, value_len, value);
1809 unsigned char*
value = hsm_get_key_ecdsa_value(ctx, session, key, &value_len);
1811 if (value == NULL)
return NULL;
1813 ldns_rdf *rdf = ldns_rdf_new(LDNS_RDF_TYPE_B64, value_len, value);
1822 switch (hsm_get_key_algorithm(ctx, session, key)) {
1824 return hsm_get_key_rdata_rsa(ctx, session, key);
1827 return hsm_get_key_rdata_dsa(ctx, session, key);
1830 return hsm_get_key_rdata_gost(ctx, session, key);
1833 return hsm_get_key_rdata_ecdsa(ctx, session, key);
1844 hsm_create_prefix(
CK_ULONG digest_len,
1849 const CK_BYTE RSA_MD5_ID[] = { 0x30, 0x20, 0x30, 0x0C, 0x06, 0x08, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05, 0x05, 0x00, 0x04, 0x10 };
1850 const CK_BYTE RSA_SHA1_ID[] = { 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2B, 0x0E, 0x03, 0x02, 0x1A, 0x05, 0x00, 0x04, 0x14 };
1851 const CK_BYTE RSA_SHA256_ID[] = { 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20 };
1852 const CK_BYTE RSA_SHA512_ID[] = { 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40 };
1854 switch((ldns_signing_algorithm)
algorithm) {
1855 case LDNS_SIGN_RSAMD5:
1856 *data_size =
sizeof(RSA_MD5_ID) + digest_len;
1857 data = malloc(*data_size);
1858 memcpy(data, RSA_MD5_ID,
sizeof(RSA_MD5_ID));
1860 case LDNS_SIGN_RSASHA1:
1861 case LDNS_SIGN_RSASHA1_NSEC3:
1862 *data_size =
sizeof(RSA_SHA1_ID) + digest_len;
1863 data = malloc(*data_size);
1864 memcpy(data, RSA_SHA1_ID,
sizeof(RSA_SHA1_ID));
1866 case LDNS_SIGN_RSASHA256:
1867 *data_size =
sizeof(RSA_SHA256_ID) + digest_len;
1868 data = malloc(*data_size);
1869 memcpy(data, RSA_SHA256_ID,
sizeof(RSA_SHA256_ID));
1871 case LDNS_SIGN_RSASHA512:
1872 *data_size =
sizeof(RSA_SHA512_ID) + digest_len;
1873 data = malloc(*data_size);
1874 memcpy(data, RSA_SHA512_ID,
sizeof(RSA_SHA512_ID));
1877 case LDNS_SIGN_DSA_NSEC3:
1878 case LDNS_SIGN_ECC_GOST:
1880 #if !defined LDNS_BUILD_CONFIG_USE_ECDSA || LDNS_BUILD_CONFIG_USE_ECDSA 1881 case LDNS_SIGN_ECDSAP256SHA256:
1882 case LDNS_SIGN_ECDSAP384SHA384:
1884 *data_size = digest_len;
1885 data = malloc(*data_size);
1896 CK_MECHANISM_TYPE mechanism_type,
1898 ldns_buffer *sign_buf)
1904 digest_mechanism.pParameter = NULL;
1905 digest_mechanism.ulParameterLen = 0;
1906 digest_mechanism.
mechanism = mechanism_type;
1907 digest = malloc(digest_len);
1910 if (hsm_pkcs11_check_error(ctx, rv,
"HSM digest init")) {
1916 ldns_buffer_begin(sign_buf),
1917 ldns_buffer_position(sign_buf),
1920 if (hsm_pkcs11_check_error(ctx, rv,
"HSM digest")) {
1929 ldns_buffer *sign_buf,
1947 session = hsm_find_key_session(ctx, key);
1948 if (!session)
return NULL;
1953 switch ((ldns_signing_algorithm)algorithm) {
1954 case LDNS_SIGN_RSAMD5:
1956 digest = hsm_digest_through_hsm(ctx, session,
1960 case LDNS_SIGN_RSASHA1:
1961 case LDNS_SIGN_RSASHA1_NSEC3:
1963 case LDNS_SIGN_DSA_NSEC3:
1964 digest_len = LDNS_SHA1_DIGEST_LENGTH;
1965 digest = malloc(digest_len);
1966 digest = ldns_sha1(ldns_buffer_begin(sign_buf),
1967 ldns_buffer_position(sign_buf),
1971 case LDNS_SIGN_RSASHA256:
1973 #if !defined LDNS_BUILD_CONFIG_USE_ECDSA || LDNS_BUILD_CONFIG_USE_ECDSA 1974 case LDNS_SIGN_ECDSAP256SHA256:
1976 digest_len = LDNS_SHA256_DIGEST_LENGTH;
1977 digest = malloc(digest_len);
1978 digest = ldns_sha256(ldns_buffer_begin(sign_buf),
1979 ldns_buffer_position(sign_buf),
1983 #if !defined LDNS_BUILD_CONFIG_USE_ECDSA || LDNS_BUILD_CONFIG_USE_ECDSA 1984 case LDNS_SIGN_ECDSAP384SHA384:
1985 digest_len = LDNS_SHA384_DIGEST_LENGTH;
1986 digest = malloc(digest_len);
1987 digest = ldns_sha384(ldns_buffer_begin(sign_buf),
1988 ldns_buffer_position(sign_buf),
1992 case LDNS_SIGN_RSASHA512:
1993 digest_len = LDNS_SHA512_DIGEST_LENGTH;
1994 digest = malloc(digest_len);
1995 digest = ldns_sha512(ldns_buffer_begin(sign_buf),
1996 ldns_buffer_position(sign_buf),
1999 case LDNS_SIGN_ECC_GOST:
2001 digest = hsm_digest_through_hsm(ctx, session,
2018 data = hsm_create_prefix(digest_len, algorithm, &data_len);
2019 memcpy(data + data_len - digest_len, digest, digest_len);
2021 sign_mechanism.pParameter = NULL;
2022 sign_mechanism.ulParameterLen = 0;
2023 switch((ldns_signing_algorithm)algorithm) {
2024 case LDNS_SIGN_RSAMD5:
2025 case LDNS_SIGN_RSASHA1:
2026 case LDNS_SIGN_RSASHA1_NSEC3:
2027 case LDNS_SIGN_RSASHA256:
2028 case LDNS_SIGN_RSASHA512:
2032 case LDNS_SIGN_DSA_NSEC3:
2035 case LDNS_SIGN_ECC_GOST:
2039 #if !defined LDNS_BUILD_CONFIG_USE_ECDSA || LDNS_BUILD_CONFIG_USE_ECDSA 2040 case LDNS_SIGN_ECDSAP256SHA256:
2041 case LDNS_SIGN_ECDSAP384SHA384:
2057 if (hsm_pkcs11_check_error(ctx, rv,
"sign init")) {
2066 if (hsm_pkcs11_check_error(ctx, rv,
"sign final")) {
2072 sig_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64,
2084 hsm_dname_is_wildcard(
const ldns_rdf* dname)
2086 return ( ldns_dname_label_count(dname) > 0 &&
2087 ldns_rdf_data(dname)[0] == 1 &&
2088 ldns_rdf_data(dname)[1] ==
'*');
2092 hsm_create_empty_rrsig(
const ldns_rr_list *rrset,
2097 uint32_t orig_class;
2099 uint8_t label_count;
2101 label_count = ldns_dname_label_count(
2102 ldns_rr_owner(ldns_rr_list_rr(rrset, 0)));
2104 if (hsm_dname_is_wildcard(ldns_rr_owner(ldns_rr_list_rr(rrset, 0)))) {
2108 rrsig = ldns_rr_new_frm_type(LDNS_RR_TYPE_RRSIG);
2111 orig_ttl = ldns_rr_ttl(ldns_rr_list_rr(rrset, 0));
2112 orig_class = ldns_rr_get_class(ldns_rr_list_rr(rrset, 0));
2114 ldns_rr_set_class(rrsig, orig_class);
2115 ldns_rr_set_ttl(rrsig, orig_ttl);
2116 ldns_rr_set_owner(rrsig,
2119 ldns_rr_list_rr(rrset,
2125 (void)ldns_rr_rrsig_set_origttl(
2127 ldns_native2rdf_int32(LDNS_RDF_TYPE_INT32,
2130 (void)ldns_rr_rrsig_set_signame(
2132 ldns_rdf_clone(sign_params->
owner));
2134 (void)ldns_rr_rrsig_set_labels(
2136 ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8,
2141 (void)ldns_rr_rrsig_set_inception(
2143 ldns_native2rdf_int32(
2147 (void)ldns_rr_rrsig_set_inception(
2149 ldns_native2rdf_int32(LDNS_RDF_TYPE_TIME, now));
2152 (void)ldns_rr_rrsig_set_expiration(
2154 ldns_native2rdf_int32(
2158 (void)ldns_rr_rrsig_set_expiration(
2160 ldns_native2rdf_int32(
2162 now + LDNS_DEFAULT_EXP_TIME));
2165 (void)ldns_rr_rrsig_set_keytag(
2167 ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16,
2170 (void)ldns_rr_rrsig_set_algorithm(
2172 ldns_native2rdf_int8(
2176 (void)ldns_rr_rrsig_set_typecovered(
2178 ldns_native2rdf_int16(
2180 ldns_rr_get_type(ldns_rr_list_rr(rrset,
2193 char *(pin_callback)(
unsigned int,
const char *,
unsigned int))
2197 char* module_pin = NULL;
2200 int repositories = 0;
2205 if ((_hsm_ctx = hsm_ctx_new())) {
2211 hsm_config_default(&module_config);
2217 repo->
module, repo->
pin, &module_config);
2225 if (module_pin == NULL)
break;
2227 repo->
module, module_pin, &module_config);
2232 memset(module_pin, 0, strlen(module_pin));
2238 "No pin or callback function");
2249 if (result ==
HSM_OK && repositories == 0) {
2251 "No repositories found");
2263 hsm_ctx_close(_hsm_ctx, 1);
2273 newctx = hsm_ctx_clone(_hsm_ctx);
2285 CK_SESSION_HANDLE session_handle;
2293 if (session == NULL)
continue;
2299 if (hsm_pkcs11_check_error(ctx, rv,
"get session info")) {
2307 "Session not logged in");
2318 if (hsm_pkcs11_check_error(ctx, rv,
"test open session")) {
2323 if (hsm_pkcs11_check_error(ctx, rv,
"test close session")) {
2336 hsm_ctx_close(ctx, 0);
2351 params->
flags = LDNS_KEY_ZONE_KEY;
2355 params->
owner = NULL;
2363 if (params->
owner) ldns_rdf_deep_free(params->
owner);
2379 size_t key_count = 0;
2380 size_t cur_key_count;
2385 session_keys = hsm_list_keys_session(ctx, ctx->
session[i],
2387 keys = realloc(keys,
2389 for (j = 0; j < cur_key_count; j++) {
2390 keys[key_count + j] = session_keys[j];
2392 key_count += cur_key_count;
2404 const char *repository)
2408 if (!repository)
return NULL;
2410 session = hsm_find_repository_session(ctx, repository);
2415 return hsm_list_keys_session(ctx, session, count);
2421 unsigned char *id_bytes;
2425 id_bytes = hsm_hex_parse(
id, &len);
2427 if (!id_bytes)
return NULL;
2429 key = hsm_find_key_by_id_bin(ctx, id_bytes, len);
2435 generate_unique_id(
hsm_ctx_t *ctx,
unsigned char *buf,
size_t bufsize)
2440 while ((key = hsm_find_key_by_id_bin(ctx, buf, bufsize))) {
2449 const char *repository,
2450 unsigned long keysize)
2455 unsigned char id[16];
2459 CK_OBJECT_HANDLE publicKey, privateKey;
2460 CK_KEY_TYPE keyType =
CKK_RSA;
2464 CK_BYTE publicExponent[] = { 1, 0, 1 };
2470 session = hsm_find_repository_session(ctx, repository);
2471 if (!session)
return NULL;
2474 generate_unique_id(ctx,
id, 16);
2478 hsm_hex_unparse(id_str,
id, 16);
2490 {
CKA_WRAP, &cfalse,
sizeof(cfalse) },
2500 {
CKA_SIGN, &ctrue,
sizeof (ctrue) },
2511 publicKeyTemplate, 9,
2512 privateKeyTemplate, 10,
2515 if (hsm_pkcs11_check_error(ctx, rv,
"generate key pair")) {
2519 new_key = libhsm_key_new();
2537 const char *repository,
2538 unsigned long keysize)
2543 CK_OBJECT_HANDLE domainPar, publicKey, privateKey;
2549 unsigned char id[16];
2553 session = hsm_find_repository_session(ctx, repository);
2554 if (!session)
return NULL;
2557 generate_unique_id(ctx,
id, 16);
2561 hsm_hex_unparse(id_str,
id, 16);
2563 CK_KEY_TYPE keyType =
CKK_DSA;
2583 {
CKA_BASE, dsa_g,
sizeof(dsa_g) },
2589 {
CKA_WRAP, &cfalse,
sizeof(cfalse) },
2597 {
CKA_SIGN, &ctrue,
sizeof(ctrue) },
2614 if (hsm_pkcs11_check_error(ctx, rv,
"generate domain parameters")) {
2619 domainPar, publicKeyTemplate, 3);
2620 if (hsm_pkcs11_check_error(ctx, rv,
"get domain parameters")) {
2625 if (hsm_pkcs11_check_error(ctx, rv,
"destroy domain parameters")) {
2633 publicKeyTemplate, 10,
2634 privateKeyTemplate, 10,
2637 if (hsm_pkcs11_check_error(ctx, rv,
"generate key pair")) {
2641 new_key = libhsm_key_new();
2651 const char *repository)
2656 CK_OBJECT_HANDLE publicKey, privateKey;
2662 unsigned char id[16];
2666 session = hsm_find_repository_session(ctx, repository);
2667 if (!session)
return NULL;
2670 generate_unique_id(ctx,
id, 16);
2674 hsm_hex_unparse(id_str,
id, 16);
2681 CK_BYTE oid1[] = { 0x06, 0x07, 0x2A, 0x85, 0x03, 0x02, 0x02, 0x23, 0x01 };
2682 CK_BYTE oid2[] = { 0x06, 0x07, 0x2A, 0x85, 0x03, 0x02, 0x02, 0x1E, 0x01 };
2692 {
CKA_WRAP, &cfalse,
sizeof(cfalse) },
2700 {
CKA_SIGN, &ctrue,
sizeof(ctrue) },
2713 publicKeyTemplate, 9,
2714 privateKeyTemplate, 10,
2717 if (hsm_pkcs11_check_error(ctx, rv,
"generate key pair")) {
2721 new_key = libhsm_key_new();
2731 const char *repository,
2737 CK_OBJECT_HANDLE publicKey, privateKey;
2743 unsigned char id[16];
2747 session = hsm_find_repository_session(ctx, repository);
2748 if (!session)
return NULL;
2751 generate_unique_id(ctx,
id, 16);
2755 hsm_hex_unparse(id_str,
id, 16);
2757 CK_KEY_TYPE keyType =
CKK_EC;
2762 CK_BYTE oidP256[] = { 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07 };
2763 CK_BYTE oidP384[] = { 0x06, 0x05, 0x2B, 0x81, 0x04, 0x00, 0x22 };
2772 {
CKA_WRAP, &cfalse,
sizeof(cfalse) },
2780 {
CKA_SIGN, &ctrue,
sizeof(ctrue) },
2790 if (strcmp(curve,
"P-256") == 0)
2792 publicKeyTemplate[0].pValue = oidP256;
2793 publicKeyTemplate[0].ulValueLen =
sizeof(oidP256);
2795 else if (strcmp(curve,
"P-384") == 0)
2797 publicKeyTemplate[0].pValue = oidP384;
2798 publicKeyTemplate[0].ulValueLen =
sizeof(oidP384);
2809 publicKeyTemplate, 8,
2810 privateKeyTemplate, 10,
2813 if (hsm_pkcs11_check_error(ctx, rv,
"generate key pair")) {
2817 new_key = libhsm_key_new();
2830 if (!key)
return -1;
2832 session = hsm_find_key_session(ctx, key);
2833 if (!session)
return -2;
2837 if (hsm_pkcs11_check_error(ctx, rv,
"Destroy private key")) {
2845 if (hsm_pkcs11_check_error(ctx, rv,
"Destroy public key")) {
2858 for (i = 0; i < count; i++) {
2872 if (!key)
return NULL;
2874 session = hsm_find_key_session(ctx, key);
2875 if (!session)
return NULL;
2877 id = hsm_get_id_for_object(ctx, session, key->
private_key, &len);
2878 if (!
id)
return NULL;
2881 id_str = malloc(len * 2 + 1);
2887 hsm_hex_unparse(id_str,
id, len);
2901 session = hsm_find_key_session(ctx, key);
2902 if (!session)
return NULL;
2907 if (key_info->
id == NULL) {
2908 key_info->
id = strdup(
"");
2911 key_info->
algorithm = (
unsigned long) hsm_get_key_algorithm(ctx,
2914 key_info->
keysize = (
unsigned long) hsm_get_key_size(ctx,
2958 const ldns_rr_list* rrset,
2963 ldns_buffer *sign_buf;
2967 if (!key)
return NULL;
2968 if (!sign_params)
return NULL;
2970 signature = hsm_create_empty_rrsig((ldns_rr_list *)rrset,
2976 sign_buf = ldns_buffer_new(LDNS_MAX_PACKETLEN);
2978 if (ldns_rrsig2buffer_wire(sign_buf, signature)
2979 != LDNS_STATUS_OK) {
2980 ldns_buffer_free(sign_buf);
2982 ldns_rr_free(signature);
2987 for(i = 0; i < ldns_rr_list_rr_count(rrset); i++) {
2988 ldns_rr2canonical(ldns_rr_list_rr(rrset, i));
2992 if (ldns_rr_list2buffer_wire(sign_buf, rrset)
2993 != LDNS_STATUS_OK) {
2994 ldns_buffer_free(sign_buf);
2995 ldns_rr_free(signature);
2999 b64_rdf = hsm_sign_buffer(ctx, sign_buf, key, sign_params->
algorithm);
3001 ldns_buffer_free(sign_buf);
3004 ldns_rr_free(signature);
3008 ldns_rr_rrsig_set_sig(signature, b64_rdf);
3036 sign_params->
owner = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME,
"dummy");
3037 sign_params->
algorithm = (ldns_algorithm) alg;
3038 sign_params->
flags = LDNS_KEY_ZONE_KEY;
3040 sign_params->
flags |= LDNS_KEY_SEP_KEY;
3057 tag = ldns_calc_keytag(dnskey_rr);
3059 ldns_rr_free(dnskey_rr);
3087 session = hsm_find_key_session(ctx, key);
3088 if (!session)
return NULL;
3090 dnskey = ldns_rr_new();
3091 ldns_rr_set_type(dnskey, LDNS_RR_TYPE_DNSKEY);
3093 ldns_rr_set_owner(dnskey, ldns_rdf_clone(sign_params->
owner));
3095 ldns_rr_push_rdf(dnskey,
3096 ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16,
3097 sign_params->
flags));
3098 ldns_rr_push_rdf(dnskey,
3099 ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8,
3100 LDNS_DNSSEC_KEYPROTO));
3101 ldns_rr_push_rdf(dnskey,
3102 ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG,
3105 rdata = hsm_get_key_rdata(ctx, session, key);
3106 if (rdata == NULL) {
3107 ldns_rr_free(dnskey);
3110 ldns_rr_push_rdf(dnskey, rdata);
3117 unsigned char *buffer,
3118 unsigned long length)
3123 if (!buffer)
return -1;
3147 unsigned char rnd_buf[4];
3150 memcpy(&rnd, rnd_buf, 4);
3162 unsigned char rnd_buf[8];
3165 memcpy(&rnd, rnd_buf, 8);
3178 const char *token_label,
3186 result = hsm_session_init(_hsm_ctx,
3194 result = hsm_ctx_add_session(_hsm_ctx, session);
3211 "hsm_token_attached()",
3212 "Can't find repository: %s", repository);
3233 if (message == NULL) {
3234 return strdup(
"libhsm memory allocation failed");
3250 printf(
"\t\tmodule at %p (sym %p)\n", (
void *) session->
module, (
void *) session->
module->
sym);
3251 printf(
"\t\tmodule path: %s\n", session->
module->
path);
3252 printf(
"\t\trepository name: %s\n", session->
module->
name);
3254 printf(
"\t\tsess handle: %u\n", (
unsigned int) session->
session);
3260 printf(
"CTX Sessions: %lu\n",
3263 printf(
"\tSession at %p\n", (
void *) ctx->
session[i]);
3275 printf(
"\tprivkey handle: %u\n", (
unsigned int) key->
private_key);
3277 printf(
"\tpubkey handle: %u\n", (
unsigned int) key->
public_key);
3279 printf(
"\tpubkey handle: %s\n",
"NULL");
3281 printf(
"\trepository: %s\n", key->
modulename);
3283 printf(
"\tsize: %lu\n", key_info->
keysize);
3284 printf(
"\tid: %s\n", key_info->
id);
3287 printf(
"key: hsm_get_key_info() returned NULL\n");
3290 printf(
"key: <void>\n");
3302 fprintf(stderr,
"%s\n", message);
3305 fprintf(stderr,
"Unknown error\n");
3322 result = hsm_get_slot_id(ctx,
3326 if (result !=
HSM_OK)
return;
3329 if (hsm_pkcs11_check_error(ctx, rv,
"C_GetTokenInfo")) {
3333 printf(
"Repository: %s\n",session->
module->
name);
3335 printf(
"\tModule: %s\n", session->
module->
path);
3336 printf(
"\tSlot: %lu\n", slot_id);
3337 printf(
"\tToken Label: %.*s\n",
3338 (
int)
sizeof(token_info.
label), token_info.
label);
3339 printf(
"\tManufacturer: %.*s\n",
3340 (
int)
sizeof(token_info.manufacturerID), token_info.manufacturerID);
3341 printf(
"\tModel: %.*s\n",
3342 (
int)
sizeof(token_info.
model), token_info.
model);
3343 printf(
"\tSerial: %.*s\n",
3344 (
int)
sizeof(token_info.serialNumber), token_info.serialNumber);
3352 keycache_cmpfunc(
const void* a,
const void* b)
3354 const char* x = (
const char*)a;
3355 const char* y = (
const char*)b;
3356 return strcmp(x, y);
3360 keycache_delfunc(ldns_rbnode_t* node,
void* cargo)
3363 free((
void*)node->key);
3365 free((
void*)node->data);
3372 ctx->
keycache = ldns_rbtree_create(keycache_cmpfunc);
3380 ldns_traverse_postorder(ctx->
keycache, keycache_delfunc, NULL);
3390 ldns_rbnode_t* node;
3393 node = ldns_rbtree_search(ctx->
keycache, locator);
3395 if (node == LDNS_RBTREE_NULL || node == NULL) {
3400 node = malloc(
sizeof(ldns_rbnode_t));
3401 node->key = strdup(locator);
3404 node = ldns_rbtree_insert(ctx->
keycache, node);
3409 if (node == LDNS_RBTREE_NULL || node == NULL)
#define CKR_SIGNATURE_INVALID
#define CKR_SAVED_STATE_INVALID
#define CKR_SESSION_EXISTS
#define CKR_RANDOM_SEED_NOT_SUPPORTED
#define CKR_SESSION_COUNT
int hsm_attach(const char *repository, const char *token_label, const char *path, const char *pin, const hsm_config_t *config)
#define CKR_KEY_SIZE_RANGE
#define CKF_OS_LOCKING_OK
#define CKR_KEY_TYPE_INCONSISTENT
void hsm_print_session(hsm_session_t *session)
#define CKF_SERIAL_SESSION
CK_C_GetSlotList C_GetSlotList
#define CKR_SESSION_PARALLEL_NOT_SUPPORTED
#define CKM_GOSTR3410_KEY_PAIR_GEN
#define CKR_STATE_UNSAVEABLE
#define CKR_MUTEX_NOT_LOCKED
char * hsm_get_error(hsm_ctx_t *gctx)
const char * error_action
ldns_rr * hsm_sign_rrset(hsm_ctx_t *ctx, const ldns_rr_list *rrset, const libhsm_key_t *key, const hsm_sign_params_t *sign_params)
#define HSM_MAX_SIGNATURE_LENGTH
void hsm_sign_params_free(hsm_sign_params_t *params)
#define CKR_SESSION_READ_ONLY
#define CKA_GOSTR3410PARAMS
#define CKM_EC_KEY_PAIR_GEN
#define CKR_WRAPPING_KEY_HANDLE_INVALID
#define CKR_USER_NOT_LOGGED_IN
void libhsm_key_free(libhsm_key_t *key)
uint32_t hsm_random32(hsm_ctx_t *ctx)
#define CKR_ATTRIBUTE_SENSITIVE
#define CKR_TEMPLATE_INCOMPLETE
void hsm_ctx_set_error(hsm_ctx_t *ctx, int error, const char *action, const char *message,...)
#define CKM_DSA_PARAMETER_GEN
#define CKR_PIN_LEN_RANGE
int hsm_keytag(const char *loc, int alg, int ksk, uint16_t *keytag)
#define CKR_INFORMATION_SENSITIVE
libhsm_key_t * hsm_find_key_by_id(hsm_ctx_t *ctx, const char *id)
#define CKR_GENERAL_ERROR
hsm_repository_t * hsm_repository_new(char *name, char *module, char *tokenlabel, char *pin, uint8_t use_pubkey, uint8_t allowextract, uint8_t require_backup)
unsigned long int CK_ULONG
#define CKA_PUBLIC_EXPONENT
libhsm_key_t * hsm_generate_rsa_key(hsm_ctx_t *ctx, const char *repository, unsigned long keysize)
void keycache_destroy(hsm_ctx_t *ctx)
#define HSM_TOKEN_LABEL_LENGTH
unsigned int allow_extract
void hsm_destroy_context(hsm_ctx_t *ctx)
ck_mechanism_type_t mechanism
#define CKR_PIN_INCORRECT
void hsm_print_tokeninfo(hsm_ctx_t *ctx)
#define CKR_FUNCTION_FAILED
#define CKR_OPERATION_ACTIVE
#define CKR_SLOT_ID_INVALID
libhsm_key_t ** hsm_list_keys_repository(hsm_ctx_t *ctx, size_t *count, const char *repository)
ldns_rr * hsm_get_dnskey(hsm_ctx_t *ctx, const libhsm_key_t *key, const hsm_sign_params_t *sign_params)
#define CKA_GOSTR3411PARAMS
#define CKR_UNWRAPPING_KEY_HANDLE_INVALID
#define CKR_ENCRYPTED_DATA_LEN_RANGE
#define HSM_MODULE_NOT_FOUND
libhsm_key_t * hsm_generate_ecdsa_key(hsm_ctx_t *ctx, const char *repository, const char *curve)
#define CKR_MECHANISM_INVALID
#define CKR_FUNCTION_CANCELED
int hsm_open2(hsm_repository_t *rlist, char *(pin_callback)(unsigned int, const char *, unsigned int))
int hsm_token_attached(hsm_ctx_t *ctx, const char *repository)
#define CKR_WRAPPED_KEY_LEN_RANGE
#define CKR_KEY_HANDLE_INVALID
#define HSM_ERROR_MSGSIZE
CK_C_GetTokenInfo C_GetTokenInfo
#define CKR_CRYPTOKI_ALREADY_INITIALIZED
#define CKM_DSA_KEY_PAIR_GEN
#define HSM_REPOSITORY_NOT_FOUND
#define HSM_NO_REPOSITORIES
hsm_sign_params_t * hsm_sign_params_new()
unsigned int allow_extract
#define CKM_RSA_PKCS_KEY_PAIR_GEN
#define CKR_ATTRIBUTE_VALUE_INVALID
void libhsm_key_info_free(libhsm_key_info_t *key_info)
#define CKR_FUNCTION_NOT_PARALLEL
void keycache_create(hsm_ctx_t *ctx)
void hsm_print_key(hsm_ctx_t *ctx, libhsm_key_t *key)
pthread_mutex_t * keycache_lock
#define CKR_SIGNATURE_LEN_RANGE
pthread_mutex_t _hsm_ctx_mutex
libhsm_key_t * hsm_generate_gost_key(hsm_ctx_t *ctx, const char *repository)
libhsm_key_t ** hsm_list_keys(hsm_ctx_t *ctx, size_t *count)
#define CKR_CRYPTOKI_NOT_INITIALIZED
const libhsm_key_t * keycache_lookup(hsm_ctx_t *ctx, const char *locator)
#define CKR_ENCRYPTED_DATA_INVALID
#define HSM_PIN_INCORRECT
#define CKR_ATTRIBUTE_TYPE_INVALID
#define CKR_UNWRAPPING_KEY_SIZE_RANGE
#define CKR_USER_PIN_NOT_INITIALIZED
char error_message[HSM_ERROR_MSGSIZE]
#define CKR_WRAPPING_KEY_TYPE_INCONSISTENT
#define CKR_TEMPLATE_INCONSISTENT
#define CKR_ATTRIBUTE_READ_ONLY
#define CKR_TOKEN_NOT_RECOGNIZED
#define CKR_WRAPPING_KEY_SIZE_RANGE
#define CKR_TOKEN_WRITE_PROTECTED
int hsm_remove_key(hsm_ctx_t *ctx, libhsm_key_t *key)
#define CKR_OBJECT_HANDLE_INVALID
char * hsm_get_key_id(hsm_ctx_t *ctx, const libhsm_key_t *key)
hsm_session_t * session[HSM_MAX_SESSIONS]
unsigned char CK_UTF8CHAR
void hsm_repository_free(hsm_repository_t *r)
uint64_t hsm_random64(hsm_ctx_t *ctx)
libhsm_key_t * hsm_generate_dsa_key(hsm_ctx_t *ctx, const char *repository, unsigned long keysize)
#define CKS_RW_USER_FUNCTIONS
#define CKR_OPERATION_NOT_INITIALIZED
#define CKR_BUFFER_TOO_SMALL
hsm_ctx_t * hsm_create_context()
int hsm_random_buffer(hsm_ctx_t *ctx, unsigned char *buffer, unsigned long length)
#define CKR_SESSION_CLOSED
#define CKR_DEVICE_MEMORY
struct ck_function_list * CK_FUNCTION_LIST_PTR
void hsm_print_ctx(hsm_ctx_t *ctx)
#define CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT
#define CKR_FUNCTION_NOT_SUPPORTED
#define CKR_USER_TYPE_INVALID
#define CKR_DEVICE_REMOVED
unsigned long private_key
void libhsm_key_list_free(libhsm_key_t **key_list, size_t count)
#define CKR_TOKEN_NOT_PRESENT
#define CKR_WRAPPED_KEY_INVALID
libhsm_key_info_t * hsm_get_key_info(hsm_ctx_t *ctx, const libhsm_key_t *key)
#define CKR_USER_ALREADY_LOGGED_IN
void hsm_print_error(hsm_ctx_t *gctx)
#define CKR_MECHANISM_PARAM_INVALID
#define CKR_DATA_LEN_RANGE
#define CKR_SESSION_HANDLE_INVALID