summaryrefslogtreecommitdiff
path: root/module
diff options
context:
space:
mode:
authorStef Walter <stef@memberwebs.com>2008-12-09 20:59:55 +0000
committerStef Walter <stef@memberwebs.com>2008-12-09 20:59:55 +0000
commitae56e5c788e3ed6c60d98d445574d3042aaae24f (patch)
tree9b3acb30fbdfd9e791c81dafb895fd92b396ebfd /module
parent398b05acabebf6d882c0aaa94a4dfd3f5d6431d4 (diff)
Move into module folder
Diffstat (limited to 'module')
-rw-r--r--module/COPYING458
-rw-r--r--module/make-dist.sh9
-rw-r--r--module/p11-capi-builtin.c245
-rw-r--r--module/p11-capi-builtin.h30
-rw-r--r--module/p11-capi-cert.c775
-rw-r--r--module/p11-capi-cert.h37
-rw-r--r--module/p11-capi-der.c177
-rw-r--r--module/p11-capi-der.h35
-rw-r--r--module/p11-capi-key.c1083
-rw-r--r--module/p11-capi-key.h34
-rw-r--r--module/p11-capi-object.c290
-rw-r--r--module/p11-capi-object.h100
-rw-r--r--module/p11-capi-rsa.c415
-rw-r--r--module/p11-capi-rsa.h44
-rw-r--r--module/p11-capi-session.c983
-rw-r--r--module/p11-capi-session.h169
-rw-r--r--module/p11-capi-token.c354
-rw-r--r--module/p11-capi-token.h60
-rw-r--r--module/p11-capi-trust.c569
-rw-r--r--module/p11-capi-trust.h30
-rw-r--r--module/p11-capi-util.c547
-rw-r--r--module/p11-capi-util.h92
-rw-r--r--module/p11-capi.c1515
-rw-r--r--module/p11-capi.dep69
-rw-r--r--module/p11-capi.h126
-rw-r--r--module/p11-capi.vcproj428
-rw-r--r--module/pkcs11/Makefile.am9
-rw-r--r--module/pkcs11/pkcs11.h1357
-rw-r--r--module/pkcs11/pkcs11n.h221
-rw-r--r--module/x509-usages.h58
30 files changed, 10319 insertions, 0 deletions
diff --git a/module/COPYING b/module/COPYING
new file mode 100644
index 0000000..27950e8
--- /dev/null
+++ b/module/COPYING
@@ -0,0 +1,458 @@
+ GNU LESSER GENERAL PUBLIC LICENSE
+ Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL. It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+ Preamble
+
+ The licenses for most software are designed to take away your
+freedom to share and change it. By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+ This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it. You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+ When we speak of free software, we are referring to freedom of use,
+not price. Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+ To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights. These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+ For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you. You must make sure that they, too, receive or can get the source
+code. If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it. And you must show them these terms so they know their rights.
+
+ We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+ To protect each distributor, we want to make it very clear that
+there is no warranty for the free library. Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+ Finally, software patents pose a constant threat to the existence of
+any free program. We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder. Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+ Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License. This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License. We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+ When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library. The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom. The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+ We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License. It also provides other free software developers Less
+of an advantage over competing non-free programs. These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries. However, the Lesser license provides advantages in certain
+special circumstances.
+
+ For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard. To achieve this, non-free programs must be
+allowed to use the library. A more frequent case is that a free
+library does the same job as widely used non-free libraries. In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+ In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software. For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+ Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+ The precise terms and conditions for copying, distribution and
+modification follow. Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library". The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+ GNU LESSER GENERAL PUBLIC LICENSE
+ TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+ 0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+ A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+ The "Library", below, refers to any such software library or work
+which has been distributed under these terms. A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language. (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+ "Source code" for a work means the preferred form of the work for
+making modifications to it. For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+ Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope. The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it). Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+ 1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+ You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+ 2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+ a) The modified work must itself be a software library.
+
+ b) You must cause the files modified to carry prominent notices
+ stating that you changed the files and the date of any change.
+
+ c) You must cause the whole of the work to be licensed at no
+ charge to all third parties under the terms of this License.
+
+ d) If a facility in the modified Library refers to a function or a
+ table of data to be supplied by an application program that uses
+ the facility, other than as an argument passed when the facility
+ is invoked, then you must make a good faith effort to ensure that,
+ in the event an application does not supply such function or
+ table, the facility still operates, and performs whatever part of
+ its purpose remains meaningful.
+
+ (For example, a function in a library to compute square roots has
+ a purpose that is entirely well-defined independent of the
+ application. Therefore, Subsection 2d requires that any
+ application-supplied function or table used by this function must
+ be optional: if the application does not supply it, the square
+ root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole. If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works. But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+ 3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library. To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License. (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.) Do not make any other change in
+these notices.
+
+ Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+ This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+ 4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+ If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+ 5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library". Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+ However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library". The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+ When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library. The
+threshold for this to be true is not precisely defined by law.
+
+ If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work. (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+ Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+ 6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+ You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License. You must supply a copy of this License. If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License. Also, you must do one
+of these things:
+
+ a) Accompany the work with the complete corresponding
+ machine-readable source code for the Library including whatever
+ changes were used in the work (which must be distributed under
+ Sections 1 and 2 above); and, if the work is an executable linked
+ with the Library, with the complete machine-readable "work that
+ uses the Library", as object code and/or source code, so that the
+ user can modify the Library and then relink to produce a modified
+ executable containing the modified Library. (It is understood
+ that the user who changes the contents of definitions files in the
+ Library will not necessarily be able to recompile the application
+ to use the modified definitions.)
+
+ b) Use a suitable shared library mechanism for linking with the
+ Library. A suitable mechanism is one that (1) uses at run time a
+ copy of the library already present on the user's computer system,
+ rather than copying library functions into the executable, and (2)
+ will operate properly with a modified version of the library, if
+ the user installs one, as long as the modified version is
+ interface-compatible with the version that the work was made with.
+
+ c) Accompany the work with a written offer, valid for at
+ least three years, to give the same user the materials
+ specified in Subsection 6a, above, for a charge no more
+ than the cost of performing this distribution.
+
+ d) If distribution of the work is made by offering access to copy
+ from a designated place, offer equivalent access to copy the above
+ specified materials from the same place.
+
+ e) Verify that the user has already received a copy of these
+ materials or that you have already sent this user a copy.
+
+ For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it. However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+ It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system. Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+ 7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+ a) Accompany the combined library with a copy of the same work
+ based on the Library, uncombined with any other library
+ facilities. This must be distributed under the terms of the
+ Sections above.
+
+ b) Give prominent notice with the combined library of the fact
+ that part of it is a work based on the Library, and explaining
+ where to find the accompanying uncombined form of the same work.
+
+ 8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License. Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License. However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+ 9. You are not required to accept this License, since you have not
+signed it. However, nothing else grants you permission to modify or
+distribute the Library or its derivative works. These actions are
+prohibited by law if you do not accept this License. Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+ 10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions. You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+ 11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all. For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices. Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+ 12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded. In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+ 13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation. If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+ 14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission. For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this. Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+ NO WARRANTY
+
+ 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+ 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+ END OF TERMS AND CONDITIONS
diff --git a/module/make-dist.sh b/module/make-dist.sh
new file mode 100644
index 0000000..3c19301
--- /dev/null
+++ b/module/make-dist.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+VERSION=0.1
+
+tar -zcvf cryptoki-capi-$VERSION.tar.gz \
+ --exclude=*.tar.gz --exclude=.svn --exclude=sandbox \
+ --exclude=Debug --exclude=Release \
+ --exclude=*.plg --exclude=*.ncb --exclude=*.opt \
+ *
diff --git a/module/p11-capi-builtin.c b/module/p11-capi-builtin.c
new file mode 100644
index 0000000..95fd476
--- /dev/null
+++ b/module/p11-capi-builtin.c
@@ -0,0 +1,245 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "p11-capi.h"
+#include "p11-capi-object.h"
+#include "p11-capi-session.h"
+#include "p11-capi-token.h"
+
+#include "pkcs11/pkcs11n.h"
+
+/* --------------------------------------------------------------------------
+ * BUILT IN VALUES
+ */
+
+static const CK_BBOOL ck_true = CK_TRUE;
+static const CK_BBOOL ck_false = CK_FALSE;
+
+static const CK_OBJECT_CLASS cko_netscape_builtin_root_list = CKO_NETSCAPE_BUILTIN_ROOT_LIST;
+
+static const char ck_root_label[] = "Windows Certificate Roots";
+
+/* --------------------------------------------------------------------------
+ * BUILT IN OBJECTS
+ */
+
+#define CK_END_LIST (CK_ULONG)-1
+
+static const CK_ATTRIBUTE builtin_root[] = {
+ { CKA_TOKEN, (void*)&ck_true, sizeof(CK_BBOOL) },
+ { CKA_CLASS, (void*)&cko_netscape_builtin_root_list, sizeof(CK_OBJECT_CLASS) },
+ { CKA_PRIVATE, (void*)&ck_false, sizeof(CK_BBOOL) },
+ { CKA_MODIFIABLE, (void*)&ck_false, sizeof(CK_BBOOL) },
+ { CKA_LABEL, (void*)ck_root_label, sizeof(ck_root_label) },
+ { CK_END_LIST, NULL, 0 }
+};
+
+typedef struct _BuiltinMatch
+{
+ CK_ATTRIBUTE_PTR attr;
+ CK_ULONG slot_flags;
+}
+BuiltinMatch;
+
+static const BuiltinMatch all_builtins[] = {
+ { (CK_ATTRIBUTE_PTR)&builtin_root, P11C_SLOT_TRUSTED | P11C_SLOT_CA | P11C_SLOT_CERTS },
+ { NULL, 0 }
+};
+
+/* This is filled in later */
+static CK_ULONG num_builtins = 0;
+
+/* --------------------------------------------------------------------------
+ * IMPLEMENTATION
+ */
+
+/* Represents a loaded builtin object */
+typedef struct _BuiltinObject
+{
+ P11cObject obj;
+ CK_ATTRIBUTE_PTR attr;
+}
+BuiltinObject;
+
+typedef struct _BuiltinObjectData
+{
+ P11cObjectData base;
+ CK_ATTRIBUTE_PTR attr;
+}
+BuiltinObjectData;
+
+static CK_RV
+builtin_attribute(P11cObjectData* objdata, CK_ATTRIBUTE_PTR attr)
+{
+ BuiltinObjectData* bdata = (BuiltinObjectData*)objdata;
+ CK_ATTRIBUTE_PTR builtin = bdata->attr;
+
+ ASSERT(attr);
+ ASSERT(bdata);
+
+ while(builtin->type != CK_END_LIST)
+ {
+ if(builtin->type == attr->type)
+ {
+ if(builtin->ulValueLen == 0)
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+ return p11c_return_data(attr, builtin->pValue, builtin->ulValueLen);
+ }
+
+ builtin++;
+ }
+
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+}
+
+static void
+builtin_data_release(void* data)
+{
+ BuiltinObjectData* bdata = (BuiltinObjectData*)data;
+ ASSERT(bdata);
+ free(bdata);
+}
+
+static const P11cObjectDataVtable builtin_objdata_vtable = {
+ builtin_attribute,
+ builtin_attribute,
+ builtin_attribute,
+ builtin_data_release,
+};
+
+static CK_RV
+builtin_load_data(P11cSession* sess, P11cObject* obj, P11cObjectData** objdata)
+{
+ BuiltinObject* bobj = (BuiltinObject*)obj;
+ BuiltinObjectData* bdata;
+
+ ASSERT(bobj);
+ ASSERT(objdata);
+ ASSERT(num_builtins > 0);
+
+ bdata = (BuiltinObjectData*)calloc(1, sizeof(BuiltinObjectData));
+ if(!bdata)
+ return CKR_HOST_MEMORY;
+
+ /* Simple, just use same data */
+ bdata->attr = bobj->attr;
+
+ bdata->base.object = obj->id;
+ bdata->base.data_funcs = &builtin_objdata_vtable;
+
+ *objdata = &(bdata->base);
+ return CKR_OK;
+}
+
+static unsigned int
+builtin_hash_func(P11cObject* obj)
+{
+ return p11c_hash_pointer(((BuiltinObject*)obj)->attr);
+}
+
+static int
+builtin_equal_func(P11cObject* one, P11cObject* two)
+{
+ return ((BuiltinObject*)one)->attr == ((BuiltinObject*)two)->attr;
+}
+
+static void
+builtin_object_release(void* data)
+{
+ BuiltinObject* bobj = (BuiltinObject*)data;
+ ASSERT(bobj);
+ free(bobj);
+}
+
+static const P11cObjectVtable builtin_object_vtable = {
+ builtin_load_data,
+ builtin_hash_func,
+ builtin_equal_func,
+ builtin_object_release,
+};
+
+static CK_RV
+register_builtin_object(P11cSession* sess, CK_ATTRIBUTE_PTR attr, P11cObject** obj)
+{
+ BuiltinObject* bobj;
+ CK_RV ret;
+
+ bobj = calloc(1, sizeof(BuiltinObject));
+ if(!bobj)
+ return CKR_HOST_MEMORY;
+
+ bobj->attr = attr;
+
+ bobj->obj.id = 0;
+ bobj->obj.obj_funcs = &builtin_object_vtable;
+
+ ret = p11c_token_register_object(sess->slot, &(bobj->obj));
+ if(ret != CKR_OK)
+ {
+ free(bobj);
+ return ret;
+ }
+
+ ASSERT(bobj->obj.id != 0);
+ *obj = &(bobj->obj);
+ return CKR_OK;
+}
+
+CK_RV
+p11c_builtin_find(P11cSession* sess, CK_OBJECT_CLASS cls, CK_ATTRIBUTE_PTR match,
+ CK_ULONG count, P11cArray* arr)
+{
+ P11cObject* obj;
+ BuiltinObjectData bdata;
+ CK_RV ret = CKR_OK;
+ CK_ULONG i, fl;
+
+ /* First time around count total number */
+ if(!num_builtins)
+ {
+ while(all_builtins[num_builtins].attr)
+ ++num_builtins;
+ ASSERT(num_builtins > 0);
+ }
+
+ /* Match each certificate */
+ for(i = 0; i < num_builtins; ++i)
+ {
+ /* Only apply built in objects to appropriate slots */
+ fl = p11c_token_get_flags(sess->slot) & all_builtins[i].slot_flags;
+ if(fl != all_builtins[i].slot_flags)
+ continue;
+
+ bdata.attr = all_builtins[i].attr;
+ bdata.base.object = 0;
+ bdata.base.data_funcs = &builtin_objdata_vtable;
+
+ if(p11c_object_data_match(&bdata.base, match, count))
+ {
+ ret = register_builtin_object(sess, all_builtins[i].attr, &obj);
+ if(ret != CKR_OK)
+ break;
+
+ p11c_array_append(arr, obj->id);
+ }
+ }
+
+ return ret;
+}
+
diff --git a/module/p11-capi-builtin.h b/module/p11-capi-builtin.h
new file mode 100644
index 0000000..b398509
--- /dev/null
+++ b/module/p11-capi-builtin.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef P11C_BUILTIN_H
+#define P11C_BUILTIN_H
+
+#include "p11-capi.h"
+
+/* Find builtin objects matching criteria */
+CK_RV p11c_builtin_find (P11cSession* sess, CK_OBJECT_CLASS cls,
+ CK_ATTRIBUTE_PTR match, CK_ULONG count,
+ P11cArray* arr);
+
+#endif /* P11C_BUILTIN_H */
diff --git a/module/p11-capi-cert.c b/module/p11-capi-cert.c
new file mode 100644
index 0000000..53e198f
--- /dev/null
+++ b/module/p11-capi-cert.c
@@ -0,0 +1,775 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "p11-capi.h"
+#include "p11-capi-cert.h"
+#include "p11-capi-object.h"
+#include "p11-capi-session.h"
+#include "p11-capi-token.h"
+
+#include <memory.h>
+
+#ifndef CERT_FIND_KEY_IDENTIFIER
+#define CERT_FIND_KEY_IDENTIFIER 983040
+#endif
+
+#ifndef CERT_KEY_IDENTIFIER_PROP_ID
+#define CERT_KEY_IDENTIFIER_PROP_ID 20
+#endif
+
+typedef struct _CertObject
+{
+ P11cObject obj;
+
+ /* Together these can uniquely identify a certificate */
+ CRYPT_INTEGER_BLOB serial;
+ CERT_NAME_BLOB issuer;
+}
+CertObject;
+
+typedef struct _CertObjectData
+{
+ P11cObjectData base;
+ PCCERT_CONTEXT cert;
+ BOOL is_in_root;
+}
+CertObjectData;
+
+static CK_RV
+parse_basic_constraints(CertObjectData* cdata, CK_ULONG* category)
+{
+ CERT_BASIC_CONSTRAINTS_INFO* basic;
+ CERT_EXTENSION* ext;
+ DWORD size;
+ BYTE bits;
+ CK_RV ret;
+
+ ASSERT(cdata);
+ ASSERT(cdata->cert);
+
+ *category = 0;
+
+ ext = CertFindExtension(szOID_BASIC_CONSTRAINTS,
+ cdata->cert->pCertInfo->cExtension,
+ cdata->cert->pCertInfo->rgExtension);
+
+ /* No key usage, don't care */
+ if(!ext)
+ return CKR_OK;
+
+ /* Find the size of the decoded structure */
+ if(!CryptDecodeObject(P11c_ENCODINGS, X509_BASIC_CONSTRAINTS,
+ ext->Value.pbData, ext->Value.cbData, 0, NULL, &size))
+ return p11c_winerr_to_ckr(GetLastError());
+
+ /* Allocate enough memory */
+ basic = (CERT_BASIC_CONSTRAINTS_INFO*)calloc(1, size);
+ if(!basic)
+ return CKR_HOST_MEMORY;
+
+ /* And get the decoded structure */
+ if(CryptDecodeObject(P11c_ENCODINGS, X509_BASIC_CONSTRAINTS,
+ ext->Value.pbData, ext->Value.cbData, 0, basic, &size))
+ {
+ if(basic->SubjectType.cbData != 1)
+ {
+ DBG(("basic constraints bits are of invalid size"));
+ ret = CKR_GENERAL_ERROR;
+ }
+ else
+ {
+ /* All of the above was for 2 bits. Lovely */
+ bits = basic->SubjectType.pbData[0] & ~(0xff >> (8 - basic->SubjectType.cUnusedBits));
+ if((bits & CERT_CA_SUBJECT_FLAG) == CERT_CA_SUBJECT_FLAG)
+ *category = 2;
+ else if((bits & CERT_END_ENTITY_SUBJECT_FLAG) == CERT_END_ENTITY_SUBJECT_FLAG)
+ *category = 3;
+ else
+ *category = 0;
+ ret = CKR_OK;
+ }
+ }
+ else
+ {
+ ret = p11c_winerr_to_ckr(GetLastError());
+ }
+
+ free(basic);
+
+ return ret;
+}
+
+
+static CK_RV
+cert_bool_attribute(P11cObjectData* objdata, CK_ATTRIBUTE_PTR attr)
+{
+ CertObjectData* cdata = (CertObjectData*)objdata;
+ CK_BBOOL val;
+
+ ASSERT(cdata);
+
+ switch(attr->type)
+ {
+ /*
+ * Resides on the token
+ * - Always true for CAPI objects.
+ */
+ case CKA_TOKEN:
+ val = CK_TRUE;
+ break;
+
+ /*
+ * Private vs. Public object.
+ * - Always false for certificates.
+ */
+ case CKA_PRIVATE:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * If object can be modified.
+ * - Currently always false. In the future with additional
+ * functionality this may change.
+ */
+ case CKA_MODIFIABLE:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Whether the certificate can be trusted for the application
+ * in which it was created.
+ * - We just report on whether the certificate is a trusted root.
+ */
+ case CKA_TRUSTED:
+ val = cdata->is_in_root ? CK_TRUE : CK_FALSE;
+ break;
+
+ default:
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+ };
+
+ return p11c_return_data(attr, &val, sizeof(CK_BBOOL));
+}
+
+static CK_RV
+cert_ulong_attribute(P11cObjectData* objdata, CK_ATTRIBUTE_PTR attr)
+{
+ CertObjectData* cdata = (CertObjectData*)objdata;
+ CK_ULONG val;
+ CK_RV ret;
+
+ ASSERT(objdata);
+
+ switch(attr->type)
+ {
+
+ /*
+ * Object class.
+ * - Always CKO_CERTIFICATE for certificates.
+ */
+ case CKA_CLASS:
+ val = CKO_CERTIFICATE;
+ break;
+
+ /*
+ * Type of certificate.
+ * - Always X509.
+ */
+ case CKA_CERTIFICATE_TYPE:
+ val = CKC_X_509;
+ break;
+
+ /*
+ * Whether a CA, user certificate, other.
+ * - Get certificate szOID_ENHANCED_KEY_USAGE
+ * extension or CERT_CTL_PROP_ID and look into CTL_USAGE structure.
+ */
+ case CKA_CERTIFICATE_CATEGORY:
+ ret = parse_basic_constraints(cdata, &val);
+ if(ret != CKR_OK)
+ return ret;
+ break;
+
+ /*
+ * Java MIDP security domain.
+ * - Have no idea what this is. Spec says default to zero.
+ */
+ case CKA_JAVA_MIDP_SECURITY_DOMAIN:
+ val = 0;
+ break;
+
+ default:
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+ };
+
+ return p11c_return_data(attr, &val, sizeof(CK_ULONG));
+}
+
+static CK_RV
+cert_bytes_attribute(P11cObjectData* objdata, CK_ATTRIBUTE_PTR attr)
+{
+ CertObjectData* cdata = (CertObjectData*)objdata;
+ PCCERT_CONTEXT cert = cdata->cert;
+
+ ASSERT(sizeof(CK_ULONG) == sizeof(DWORD));
+ ASSERT(cdata);
+
+ return p11c_cert_certificate_get_bytes(cdata->cert, attr);
+}
+
+static void
+cert_data_release(void* data)
+{
+ CertObjectData* cdata = (CertObjectData*)data;
+ ASSERT(cdata && cdata->cert);
+ CertFreeCertificateContext(cdata->cert);
+ free(cdata);
+}
+
+static const P11cObjectDataVtable cert_objdata_vtable = {
+ cert_bool_attribute,
+ cert_ulong_attribute,
+ cert_bytes_attribute,
+ cert_data_release,
+};
+
+static P11cObjectData*
+cert_alloc_data(P11cSession* sess, P11cObject* obj, PCCERT_CONTEXT cert)
+{
+ CertObjectData* cdata;
+
+ cdata = (CertObjectData*)calloc(1, sizeof(CertObjectData));
+ if(!cdata)
+ return NULL;
+
+ cdata->cert = cert;
+ cdata->is_in_root = (p11c_token_get_flags(sess->slot) & P11C_SLOT_CA) ? TRUE : FALSE;
+
+ cdata->base.object = obj->id;
+ cdata->base.data_funcs = &cert_objdata_vtable;
+
+ return &(cdata->base);
+}
+
+static CK_RV
+cert_load_data(P11cSession* sess, P11cObject* obj, P11cObjectData** objdata)
+{
+ CertObject* cobj = (CertObject*)obj;
+ CERT_INFO info;
+ PCCERT_CONTEXT cert;
+
+ ASSERT(cobj);
+ ASSERT(objdata);
+
+ ASSERT(cobj->issuer.pbData);
+ ASSERT(cobj->issuer.cbData);
+ ASSERT(cobj->serial.pbData);
+ ASSERT(cobj->serial.cbData);
+
+ /* No store should mean no objects were loaded */
+ ASSERT(sess->store);
+
+ /* Setup our search */
+ memset(&info, 0, sizeof(info));
+ memcpy(&info.SerialNumber, &cobj->serial, sizeof(info.SerialNumber));
+ memcpy(&info.Issuer, &cobj->issuer, sizeof(info.Issuer));
+
+ cert = CertGetSubjectCertificateFromStore(sess->store, P11c_ENCODINGS, &info);
+
+ if(!cert)
+ {
+ DWORD err = GetLastError();
+
+ /* TODO: Is this right for a deleted certificate? */
+ ASSERT(err != E_INVALIDARG);
+ if(err == CRYPT_E_NOT_FOUND)
+ return CKR_OBJECT_HANDLE_INVALID;
+ else
+ return p11c_winerr_to_ckr(GetLastError());
+ }
+
+ *objdata = cert_alloc_data(sess, obj, cert);
+ if(!(*objdata))
+ {
+ CertFreeCertificateContext(cert);
+ return CKR_HOST_MEMORY;
+ }
+
+ return CKR_OK;
+}
+
+static unsigned int
+cert_hash_func(P11cObject* obj)
+{
+ CertObject* cobj = (CertObject*)obj;
+ return p11c_hash_data(cobj->issuer.pbData, cobj->issuer.cbData) ^
+ p11c_hash_data(cobj->serial.pbData, cobj->serial.cbData);
+}
+
+static int
+cert_equal_func(P11cObject* a, P11cObject* b)
+{
+ CertObject* ca = (CertObject*)a;
+ CertObject* cb = (CertObject*)b;
+ return ca->issuer.cbData == cb->issuer.cbData &&
+ memcmp(ca->issuer.pbData, cb->issuer.pbData, ca->issuer.cbData) == 0 &&
+ ca->serial.cbData == cb->serial.cbData &&
+ memcmp(ca->serial.pbData, cb->serial.pbData, ca->serial.cbData) == 0;
+}
+
+static void
+cert_object_release(void* data)
+{
+ CertObject* cobj = (CertObject*)data;
+ ASSERT(cobj);
+ free(cobj);
+}
+
+static const P11cObjectVtable cert_object_vtable = {
+ cert_load_data,
+ cert_hash_func,
+ cert_equal_func,
+ cert_object_release,
+};
+
+static CK_RV
+calculate_check_value(PCCERT_CONTEXT cert, CK_ATTRIBUTE_PTR attr)
+{
+ BYTE* buffer;
+ DWORD length;
+ CK_RV ret;
+
+ ASSERT(cert);
+ ASSERT(attr);
+
+ /* Short cut for the measuring case */
+ if(!attr->pValue)
+ {
+ attr->ulValueLen = 3;
+ return CKR_OK;
+ }
+
+ length = 0;
+ if(!CryptHashCertificate(0, CALG_SHA1, 0, cert->pbCertEncoded,
+ cert->cbCertEncoded, NULL, &length))
+ return p11c_winerr_to_ckr(GetLastError());
+
+ if(length < 3)
+ {
+ DBG(("SHA1 hash length too short: %d", length));
+ return CKR_DEVICE_ERROR;
+ }
+
+ buffer = malloc(length);
+ if(!buffer)
+ return CKR_HOST_MEMORY;
+
+ if(!CryptHashCertificate(0, CALG_SHA1, 0, cert->pbCertEncoded,
+ cert->cbCertEncoded, buffer, &length))
+ {
+ free(buffer);
+ return p11c_winerr_to_ckr(GetLastError());
+ }
+
+ ret = p11c_return_data(attr, buffer, 3);
+ free(buffer);
+ return ret;
+}
+
+
+CK_RV
+p11c_cert_certificate_get_bytes(PCCERT_CONTEXT cert, CK_ATTRIBUTE_PTR attr)
+{
+ DWORD err;
+
+ ASSERT(cert);
+ ASSERT(attr);
+
+ switch(attr->type)
+ {
+
+ /*
+ * Description of the object.
+ * - We use CAPI's CERT_FRIENDLY_NAME_PROP_ID property,
+ * converted into UTF8.
+ * - Yes this is slow, but this is not really a property
+ * that's searched on or retrieved intensively.
+ */
+ case CKA_LABEL:
+ {
+ WCHAR* utf16 = NULL;
+ DWORD size;
+
+ if(!CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, NULL, &size))
+ {
+ err = GetLastError();
+ if(err == CRYPT_E_NOT_FOUND)
+ utf16 = L"Unnamed Certificate";
+ else
+ return p11c_winerr_to_ckr(err);
+ }
+
+ if(!utf16)
+ {
+ utf16 = _alloca(size);
+ if(!CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, utf16, &size))
+ return p11c_winerr_to_ckr(GetLastError());
+ }
+
+ return p11c_return_string(attr, utf16);
+ }
+ break;
+
+ /*
+ * A byte array unique to this certificate. The CKA_ID of
+ * matching certificates and private keys should match.
+ * Should match the key identifier in an X.509v3 certificate.
+ *
+ * We use CAPI's CERT_KEY_IDENTIFIER_PROP_ID property directly.
+ */
+ case CKA_ID:
+ if(!CertGetCertificateContextProperty(cert, CERT_KEY_IDENTIFIER_PROP_ID,
+ attr->pValue, (DWORD*)&attr->ulValueLen))
+ {
+ err = GetLastError();
+ if(err == CRYPT_E_NOT_FOUND)
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+ return p11c_winerr_to_ckr(err);
+ }
+ return CKR_OK;
+
+
+ /*
+ * DER-encoding of the certificate subject name.
+ *
+ * We use CAPI's CERT_CONTEXT pCertInfo->Subject field
+ * directly.
+ */
+ case CKA_SUBJECT:
+ return p11c_return_data(attr, cert->pCertInfo->Subject.pbData,
+ cert->pCertInfo->Subject.cbData);
+
+ /*
+ * DER-encoding of the certificate issuer name.
+ *
+ * We use CAPI's CERT_CONTEXT pCertInfo->Issuer field
+ * directly.
+ */
+ case CKA_ISSUER:
+ return p11c_return_data(attr, cert->pCertInfo->Issuer.pbData,
+ cert->pCertInfo->Issuer.cbData);
+
+ /*
+ * DER-encoding of the certificate serial number.
+ */
+ case CKA_SERIAL_NUMBER:
+ if(!CryptEncodeObject(X509_ASN_ENCODING, X509_MULTI_BYTE_INTEGER,
+ &cert->pCertInfo->SerialNumber,
+ attr->pValue, (DWORD*)&attr->ulValueLen))
+ {
+ err = GetLastError();
+ if(err == ERROR_FILE_NOT_FOUND)
+ return CKR_GENERAL_ERROR;
+ return p11c_winerr_to_ckr(err);
+ }
+ return CKR_OK;
+
+ /*
+ * BER-encoding of the full certificate.
+ *
+ * We use CAPI's CERT_CONTEXT pbCertEncoded field directly.
+ */
+ case CKA_VALUE:
+ return p11c_return_data(attr, cert->pbCertEncoded,
+ cert->cbCertEncoded);
+
+ /*
+ * If CKA_VALUE not specified, this is where the full
+ * certificate can be found.
+ *
+ * We don't support this. All our certificates are present
+ * in full.
+ *
+ * - Spec says default to empty.
+ */
+ case CKA_URL:
+ return p11c_return_data(attr, "", 0);
+
+ /*
+ * Checksum
+ * - This is the first 3 bytes of the SHA hash of the DER.
+ */
+ case CKA_CHECK_VALUE:
+ return calculate_check_value(cert, attr);
+
+ /*
+ * Various hashes for remote retrieval.
+ * - Spec says default to empty.
+ */
+ case CKA_HASH_OF_SUBJECT_PUBLIC_KEY:
+ case CKA_HASH_OF_ISSUER_PUBLIC_KEY:
+ return p11c_return_data(attr, "", 0);
+
+ /*
+ * Start date for the certificate.
+ */
+ case CKA_START_DATE:
+ return p11c_return_filetime(attr, &cert->pCertInfo->NotBefore);
+
+ /*
+ * End date for the certificate.
+ */
+ case CKA_END_DATE:
+ return p11c_return_filetime(attr, &cert->pCertInfo->NotAfter);
+
+ default:
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+ };
+}
+
+PCCERT_CONTEXT
+p11c_cert_object_data_get_certificate(P11cObjectData* objdata)
+{
+ CertObjectData* cdata;
+
+ ASSERT(objdata);
+ ASSERT(objdata->data_funcs == &cert_objdata_vtable);
+
+ cdata = (CertObjectData*)objdata;
+ return cdata->cert;
+}
+
+static CK_RV
+register_cert_object(P11cSession* sess, PCCERT_CONTEXT cert, P11cObject** obj)
+{
+ CertObject* cobj;
+ CK_RV ret;
+ size_t len;
+
+ /* We save the Issuer and SerialNumber for identification later */
+ len = cert->pCertInfo->SerialNumber.cbData +
+ cert->pCertInfo->Issuer.cbData;
+
+ cobj = calloc(1, sizeof(CertObject) + len);
+ if(!cobj)
+ return CKR_HOST_MEMORY;
+
+ cobj->obj.id = 0;
+ cobj->obj.obj_funcs = &cert_object_vtable;
+
+ /* Copy Issuer data in */
+ cobj->issuer.cbData = cert->pCertInfo->Issuer.cbData;
+ cobj->issuer.pbData = (BYTE*)(cobj + 1);
+ memcpy(cobj->issuer.pbData, cert->pCertInfo->Issuer.pbData,
+ cobj->issuer.cbData);
+
+ /* Copy Serial Number data in */
+ cobj->serial.cbData = cert->pCertInfo->SerialNumber.cbData;
+ cobj->serial.pbData = cobj->issuer.pbData + cobj->issuer.cbData;
+ memcpy(cobj->serial.pbData, cert->pCertInfo->SerialNumber.pbData,
+ cobj->serial.cbData);
+
+ ret = p11c_token_register_object(sess->slot, &(cobj->obj));
+ if(ret != CKR_OK)
+ {
+ free(cobj);
+ return ret;
+ }
+
+ ASSERT(cobj->obj.id != 0);
+ *obj = &cobj->obj;
+ return CKR_OK;
+}
+
+static CK_RV
+find_in_store(P11cSession* sess, DWORD find_type, const void *find_criteria,
+ CK_ATTRIBUTE_PTR match, CK_ULONG count, P11cArray* arr)
+{
+ PCCERT_CONTEXT cert = NULL;
+ P11cObject* obj;
+ P11cObjectData* objdata;
+ CertObjectData cdata;
+ DWORD err;
+ CK_RV ret = CKR_OK;
+
+ /* No store, no objects */
+ if(!sess->store)
+ return CKR_OK;
+
+ for(;;)
+ {
+ cert = CertFindCertificateInStore(sess->store, P11c_ENCODINGS, 0,
+ find_type, find_criteria, cert);
+ if(cert == NULL)
+ {
+ err = GetLastError();
+
+ /* Certificate not found, we don't care */
+ if(err == CRYPT_E_NOT_FOUND)
+ return CKR_OK;
+ else
+ return p11c_winerr_to_ckr(err);
+ }
+
+ /* Match the certificate */
+ cdata.cert = cert;
+ cdata.base.object = 0;
+ cdata.base.data_funcs = &cert_objdata_vtable;
+
+ if(p11c_object_data_match(&cdata.base, match, count))
+ {
+ ret = register_cert_object(sess, cert, &obj);
+ if(ret == CKR_OK)
+ {
+ ASSERT(obj);
+
+ /* Store away the object data for performance reasons */
+ objdata = cert_alloc_data(sess, obj, cert);
+ if(objdata)
+ {
+ p11c_session_take_object_data(sess, obj, objdata);
+
+ /* For continuing the enumeration */
+ cert = CertDuplicateCertificateContext(cert);
+ }
+
+ p11c_array_append(arr, obj->id);
+ }
+ }
+ }
+
+ if(ret != CKR_OK && cert)
+ CertFreeCertificateContext(cert);
+
+ return ret;
+}
+
+CK_RV
+p11c_cert_find(P11cSession* sess, CK_OBJECT_CLASS cls, CK_ATTRIBUTE_PTR match,
+ CK_ULONG count, P11cArray* arr)
+{
+ CRYPT_INTEGER_BLOB* serial = NULL;
+ CK_RV ret;
+ CK_ULONG i;
+ DWORD size;
+
+ CERT_INFO find_info; /* For searching by issuer and serial */
+ CRYPT_HASH_BLOB find_key; /* For searching by ID */
+
+ /* We only have certificates here */
+ if(cls != CKO_CERTIFICATE && cls != CKO_ANY)
+ return CKR_OK;
+
+ /* Only work with slots that have certificates */
+ if(!(p11c_token_get_flags (sess->slot) & P11C_SLOT_CERTS))
+ return CKR_OK;
+
+ /*
+ * There are some better searches we can do rather than
+ * listing everything.
+ *
+ * CKA_ISSUER + CKA_SERIAL_NUMBER
+ * See if we have a issuer and serial number for a
+ * specific certificate to find.
+ *
+ * CKA_ID
+ * Search by key identifier
+ *
+ * TODO: could search by hash (use CertFindCertificateInStore
+ * with CERT_FIND_HASH or CERT_FIND_SHA1_HASH or CERT_FIND_MD5_HASH)
+ *
+ * TODO: could search by issuer (use CertFindCertificateInStore
+ * with CERT_FIND_ISSUER_NAME)
+ *
+ * TODO: could search by subject (use CertFindCertificateInStore
+ * with CERT_FIND_SUBJECT_NAME)
+ *
+ * TODO: could search by CKA_VALUE (use CertFindCertificateInStore
+ * with CERT_FIND_EXISTING)
+ */
+ memset(&find_info, 0, sizeof(find_info));
+ memset(&find_key, 0, sizeof(find_key));
+
+ for(i = 0; i < count; ++i)
+ {
+ if(!match[i].pValue || !match[i].ulValueLen)
+ continue;
+
+ if(match[i].type == CKA_ISSUER)
+ {
+ find_info.Issuer.cbData = match[i].ulValueLen;
+ find_info.Issuer.pbData = match[i].pValue;
+ }
+
+ else if(match[i].type == CKA_SERIAL_NUMBER && !serial)
+ {
+ if(!CryptDecodeObject(P11c_ENCODINGS, X509_MULTI_BYTE_INTEGER,
+ match[i].pValue, match[i].ulValueLen, 0, NULL, &size))
+ {
+ continue;
+ }
+
+ serial = calloc(1, size);
+ if(!serial)
+ continue;
+
+ if(!CryptDecodeObject(P11c_ENCODINGS, X509_MULTI_BYTE_INTEGER,
+ match[i].pValue, match[i].ulValueLen, 0, serial, &size))
+ continue;
+
+ ASSERT(serial->cbData);
+ ASSERT(serial->pbData);
+
+ find_info.SerialNumber.cbData = serial->cbData;
+ find_info.SerialNumber.pbData = serial->pbData;
+ }
+
+ else if(match[i].type == CKA_ID)
+ {
+ find_key.cbData = match[i].ulValueLen;
+ find_key.pbData = match[i].pValue;
+ }
+ }
+
+ /* Match a specific certificate */
+ if(find_info.SerialNumber.cbData && find_info.Issuer.cbData)
+ {
+ ret = find_in_store(sess, CERT_FIND_SUBJECT_CERT, &find_info,
+ match, count, arr);
+ }
+
+ /* Find all certificates with key identifier */
+ else if(find_key.cbData)
+ {
+ ret = find_in_store(sess, CERT_FIND_KEY_IDENTIFIER, &find_key,
+ match, count, arr);
+ }
+
+ /* Match any ol certificate */
+ else
+ {
+ ret = find_in_store(sess, CERT_FIND_ANY, NULL,
+ match, count, arr);
+ }
+
+ if(serial)
+ free(serial);
+
+ return ret;
+}
diff --git a/module/p11-capi-cert.h b/module/p11-capi-cert.h
new file mode 100644
index 0000000..f85d7b3
--- /dev/null
+++ b/module/p11-capi-cert.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef P11C_CERT_H
+#define P11C_CERT_H
+
+#include "p11-capi.h"
+#include "p11-capi-util.h"
+
+/* Find certificates matching criteria */
+CK_RV p11c_cert_find (P11cSession* sess, CK_OBJECT_CLASS cls,
+ CK_ATTRIBUTE_PTR match, CK_ULONG count,
+ P11cArray* arr);
+
+/* Called by trust and key stuff */
+CK_RV p11c_cert_certificate_get_bytes (PCCERT_CONTEXT cert,
+ CK_ATTRIBUTE_PTR attr);
+
+PCCERT_CONTEXT p11c_cert_object_data_get_certificate (P11cObjectData* objdata);
+
+#endif /* P11C_CERT_H */
diff --git a/module/p11-capi-der.c b/module/p11-capi-der.c
new file mode 100644
index 0000000..5698dff
--- /dev/null
+++ b/module/p11-capi-der.c
@@ -0,0 +1,177 @@
+/*
+ * Portions derived from NSS source files:
+ * lib/ckfw/capi/cobject.c
+ * lib/ckfw/capi/crsa.c
+ *
+ * Portions of this file:
+ * Copyright (C) Stef Walter 2008
+ *
+ */
+
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is the Netscape security libraries.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1994-2000
+ * the Initial Developer. All Rights Reserved.
+ * Portions created by Red Hat, Inc, are Copyright (C) 2005
+ *
+ * Contributor(s):
+ * Bob Relyea (rrelyea@redhat.com)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "p11-capi.h"
+#include "p11-capi-der.h"
+
+/*
+ * unwrap a single DER value
+ */
+BYTE*
+p11c_der_unwrap(BYTE* src, DWORD n_src,
+ DWORD* n_result, BYTE** next)
+{
+ BYTE* start = src;
+ BYTE* end = src + n_src;
+ DWORD len = 0;
+
+ /* initialize error condition return values */
+ *n_result = 0;
+ if(next)
+ *next = src;
+
+ if(n_src < 2)
+ return start;
+
+ src++ ; /* skip the tag -- should check it against an expected value! */
+ len = (DWORD)*src++;
+ if(len & 0x80)
+ {
+ DWORD count = len & 0x7f;
+ len = 0;
+
+ if(count + 2 > n_src)
+ return start;
+
+ while(count-- > 0)
+ len = (len << 8) | (DWORD)*src++;
+ }
+
+ if(len + (src - start) > (DWORD)n_src)
+ return start;
+
+ if(next)
+ *next = src + len;
+
+ *n_result = len;
+ return src;
+}
+
+/*
+ * write a Decimal value to a string
+ */
+
+static char*
+put_decimal_string(char* cstr, DWORD value)
+{
+ DWORD tenpower;
+ BOOL first = TRUE;
+
+ for(tenpower = 10000000; tenpower; tenpower /= 10)
+ {
+ BYTE digit = (BYTE)(value / tenpower);
+ value = value % tenpower;
+
+ /* drop leading zeros */
+ if(first && (0 == digit))
+ continue;
+
+ first = FALSE;
+ *cstr++ = digit + '0';
+ }
+
+ /* if value was zero, put one of them out */
+ if(first)
+ *cstr++ = '0';
+
+ return cstr;
+}
+
+/*
+ * Create a Capi OID string value from a DER OID
+ */
+char*
+p11c_der_read_oid(BYTE* oid_tag, DWORD n_oid_tag)
+{
+ BYTE* oid;
+ char *oid_str;
+ char *cstr;
+ DWORD value;
+ DWORD n_oid;
+
+ /* wasn't an oid */
+ if(P11C_DER_OBJECT_ID != *oid_tag)
+ return NULL;
+
+ oid = p11c_der_unwrap(oid_tag, n_oid_tag, &n_oid, NULL);;
+ if(n_oid < 2)
+ return NULL;
+
+ oid_str = malloc(n_oid * 4);
+ if(!oid_str)
+ return NULL;
+
+ cstr = oid_str;
+ cstr = put_decimal_string(cstr, (*oid) / 40);
+ *cstr++ = '.';
+ cstr = put_decimal_string(cstr, (*oid) % 40);
+ n_oid--;
+
+ value = 0;
+ while(n_oid--)
+ {
+ oid++;
+ value = (value << 7) + (*oid & 0x7f);
+ if(0 == (*oid & 0x80))
+ {
+ *cstr++ = '.';
+ cstr = put_decimal_string(cstr, value);
+ value = 0;
+ }
+ }
+
+ *cstr = 0; /* NULL terminate */
+
+ if(value != 0)
+ {
+ free(oid_str);
+ return NULL;
+ }
+
+ return oid_str;
+}
diff --git a/module/p11-capi-der.h b/module/p11-capi-der.h
new file mode 100644
index 0000000..0807fcd
--- /dev/null
+++ b/module/p11-capi-der.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2008 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef P11C_DER_H
+#define P11C_DER_H
+
+#include "p11-capi.h"
+
+#define P11C_DER_OCTET_STRING 0x04
+#define P11C_DER_OBJECT_ID 0x06
+#define P11C_DER_SEQUENCE 0x10
+#define P11C_DER_CONSTRUCTED 0x20
+
+BYTE* p11c_der_unwrap (BYTE* src, DWORD n_src,
+ DWORD* n_result, BYTE** next);
+
+char* p11c_der_read_oid (BYTE* oid_tag, DWORD n_oid_tag);
+
+#endif /* P11C_DER_H */
diff --git a/module/p11-capi-key.c b/module/p11-capi-key.c
new file mode 100644
index 0000000..ed306d4
--- /dev/null
+++ b/module/p11-capi-key.c
@@ -0,0 +1,1083 @@
+/*
+ * Copyright (C) 2008 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "p11-capi.h"
+#include "p11-capi-cert.h"
+#include "p11-capi-key.h"
+#include "p11-capi-object.h"
+#include "p11-capi-session.h"
+#include "p11-capi-token.h"
+#include "x509-usages.h"
+
+typedef struct _KeyObject
+{
+ P11cObject obj;
+
+ /* The raw key identifier */
+ CRYPT_HASH_BLOB key_identifier;
+ CK_OBJECT_CLASS object_class;
+}
+KeyObject;
+
+typedef struct _KeyObjectData
+{
+ P11cObjectData base;
+ CK_OBJECT_CLASS object_class;
+ CRYPT_INTEGER_BLOB key_identifier;
+ CRYPT_DATA_BLOB raw_public_key;
+ CRYPT_KEY_PROV_INFO* prov_info;
+}
+KeyObjectData;
+
+static CK_RV
+load_key_handle(P11cObjectData* objdata, HCRYPTPROV* ret_prov,
+ HCRYPTKEY* ret_key)
+{
+ KeyObjectData* kdata = (KeyObjectData*)objdata;
+ HCRYPTPROV prov;
+ HCRYPTKEY key;
+ DWORD error;
+
+ ASSERT(kdata);
+ ASSERT(ret_key);
+ ASSERT(ret_prov);
+
+ if(!CryptAcquireContextW(&prov, kdata->prov_info->pwszContainerName,
+ kdata->prov_info->pwszProvName,
+ kdata->prov_info->dwProvType, 0))
+ {
+ return p11c_winerr_to_ckr(GetLastError());
+ }
+
+ if(!CryptGetUserKey(prov, kdata->prov_info->dwKeySpec, &key))
+ {
+ error = GetLastError();
+ CryptReleaseContext(prov, 0);
+ return p11c_winerr_to_ckr(error);
+ }
+
+ *ret_key = key;
+ *ret_prov = prov;
+
+ return CKR_OK;
+}
+
+
+static CK_RV
+load_raw_public_key(KeyObjectData* kdata)
+{
+ BOOL success = FALSE;
+ HCRYPTPROV prov;
+ HCRYPTKEY key;
+ CK_RV ret;
+ DWORD error;
+
+ ASSERT(kdata);
+ ASSERT(!kdata->raw_public_key.pbData);
+
+ ret = load_key_handle(&kdata->base, &prov, &key);
+ if(ret != CKR_OK)
+ return ret;
+
+ if(CryptExportKey(key, 0, PUBLICKEYBLOB, 0, NULL, &kdata->raw_public_key.cbData))
+ {
+ kdata->raw_public_key.pbData = malloc(kdata->raw_public_key.cbData);
+ if(!kdata->raw_public_key.pbData)
+ SetLastError(ERROR_NOT_ENOUGH_MEMORY);
+ else
+ {
+ if(CryptExportKey(key, 0, PUBLICKEYBLOB, 0, kdata->raw_public_key.pbData,
+ &kdata->raw_public_key.cbData))
+ {
+ success = TRUE;
+ }
+ }
+ }
+
+ CryptReleaseContext(prov, 0);
+ CryptDestroyKey(key);
+
+ if(success)
+ {
+ return CKR_OK;
+ }
+ else
+ {
+ error = GetLastError();
+ if(error == NTE_BAD_KEY_STATE)
+ return CKR_ATTRIBUTE_SENSITIVE;
+ return p11c_winerr_to_ckr(error);
+ }
+}
+
+static CK_RV
+lookup_rsa_attribute(KeyObjectData* kdata, CK_ATTRIBUTE_PTR attr)
+{
+ PUBLICKEYSTRUC* header;
+ RSAPUBKEY* pubkey;
+ CK_ULONG number;
+ CK_RV ret;
+
+ ASSERT(kdata);
+ ASSERT(attr);
+
+ if(!kdata->raw_public_key.pbData)
+ {
+ ret = load_raw_public_key(kdata);
+ if(ret != CKR_OK)
+ return ret;
+ }
+
+ header = (PUBLICKEYSTRUC*)kdata->raw_public_key.pbData;
+ if(!header->bType == PUBLICKEYBLOB)
+ return CKR_GENERAL_ERROR;
+
+ pubkey = (RSAPUBKEY*)(header + 1);
+ if(!pubkey->magic == 0x31415352)
+ return CKR_GENERAL_ERROR;
+
+ switch(attr->type)
+ {
+ case CKA_MODULUS_BITS:
+ number = pubkey->bitlen;
+ return p11c_return_data(attr, &number, sizeof(CK_ULONG));
+
+ case CKA_PUBLIC_EXPONENT:
+ return p11c_return_dword_as_bytes(attr, pubkey->pubexp);
+
+ case CKA_MODULUS:
+ return p11c_return_reversed_data(attr, (pubkey + 1),
+ pubkey->bitlen / 8);
+
+ case CKA_PRIVATE_EXPONENT:
+ case CKA_PRIME_1:
+ case CKA_PRIME_2:
+ case CKA_EXPONENT_1:
+ case CKA_EXPONENT_2:
+ case CKA_COEFFICIENT:
+ if(kdata->object_class == CKO_PRIVATE_KEY)
+ return CKR_ATTRIBUTE_SENSITIVE;
+ else
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+
+ default:
+ ASSERT(FALSE);
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+ }
+}
+
+static CK_RV
+key_bool_attribute(P11cObjectData* objdata, CK_ATTRIBUTE_PTR attr)
+{
+ KeyObjectData* kdata = (KeyObjectData*)objdata;
+ CK_BBOOL val;
+ CK_BBOOL is_private, is_rsa;
+
+ ASSERT(objdata);
+ ASSERT(attr);
+
+ is_private = (kdata->object_class == CKO_PRIVATE_KEY);
+ is_rsa = kdata->prov_info->dwProvType == PROV_RSA_FULL;
+
+ switch(attr->type)
+ {
+
+ /*
+ * Whether to authenticate before every use.
+ * - CAPI does all authentication
+ */
+ case CKA_ALWAYS_AUTHENTICATE:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Whether this key has always been sensitive.
+ * TODO: Can we detect this?
+ */
+ case CKA_ALWAYS_SENSITIVE:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Whether this key can be used to decrypt.
+ * - CKK_RSA but not CKK_DSA.
+ */
+ case CKA_DECRYPT:
+ val = is_private && is_rsa;
+ break;
+
+ /*
+ * Whether this key can be used to derive a session or
+ * other key.
+ * - Not true for CKK_RSA or CKK_DSA.
+ */
+ case CKA_DERIVE:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Whether or not this key can be used to encrypt?.
+ * TODO: Support for RSA public keys.
+ */
+ case CKA_ENCRYPT:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Whether this key can be exported or not.
+ * TODO: We may want to support this for public keys.
+ */
+ case CKA_EXTRACTABLE:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Whether this key was created on token.
+ * TODO: Can we implement this properly?
+ */
+ case CKA_LOCAL:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Whether this object is modifiable.
+ * - Keys are generally. never modifiable.
+ */
+ case CKA_MODIFIABLE:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Whether this key was ever extractable.
+ * TODO: Can we determine this?
+ */
+ case CKA_NEVER_EXTRACTABLE:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Whether this is a private object or not.
+ * - This 'private' means login before use. But maps
+ * well to private key use, since we're always logged in.
+ */
+ case CKA_PRIVATE:
+ val = is_private;
+ break;
+
+ /*
+ * Whether this is a sensitive object or not.
+ * - Private keys are sensitive, some attributes not
+ * readable.
+ */
+ case CKA_SENSITIVE:
+ val = is_private;
+ break;
+
+ /*
+ * Can this key sign stuff?
+ * - Private keys can sign.
+ */
+ case CKA_SIGN:
+ val = is_private;
+ break;
+
+ /*
+ * Can this key sign recoverable.
+ * TODO: Private RSA keys can sign recoverable.
+ */
+ case CKA_SIGN_RECOVER:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Is this stored on the token?
+ * - All CAPI objects are.
+ */
+ case CKA_TOKEN:
+ val = CK_TRUE;
+ break;
+
+ /*
+ * Is this key trusted?
+ * - A nebulous question.
+ */
+ case CKA_TRUSTED:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Key wrapping with public keys.
+ */
+ case CKA_WRAP:
+ if(is_private)
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Key wrapping on private keys.
+ */
+ case CKA_WRAP_WITH_TRUSTED:
+ if(!is_private)
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Can do a unwrap operation?
+ * - We don't implement this.
+ */
+ case CKA_UNWRAP:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Wrap, and unwrap stuff.
+ * - We don't implement this.
+ */
+ case CKA_UNWRAP_TEMPLATE:
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+
+ /*
+ * Whether this key can be used to verify?
+ * TODO: Support for public keys.
+ */
+ case CKA_VERIFY:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * Whether this key can be used to verify?
+ * TODO: Support for public keys.
+ */
+ case CKA_VERIFY_RECOVER:
+ val = CK_FALSE;
+ break;
+
+ default:
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+ };
+
+ return p11c_return_data(attr, &val, sizeof(CK_BBOOL));
+}
+
+static CK_RV
+key_ulong_attribute(P11cObjectData* objdata, CK_ATTRIBUTE_PTR attr)
+{
+ KeyObjectData* kdata = (KeyObjectData*)objdata;
+ CK_ULONG val;
+
+ ASSERT(kdata);
+ ASSERT(attr);
+
+ switch(attr->type)
+ {
+
+ /*
+ * Object class.
+ */
+ case CKA_CLASS:
+ val = kdata->object_class;
+ break;
+
+ /*
+ * The key type.
+ * - Right now we only support (and load) RSA.
+ */
+ case CKA_KEY_TYPE:
+ if(kdata->prov_info->dwProvType == PROV_RSA_FULL)
+ val = CKK_RSA;
+ else
+ val = CK_UNAVAILABLE_INFORMATION;
+ break;
+
+ /*
+ * The key generation mechanism.
+ * TODO: We don't yet support key generation.
+ */
+ case CKA_KEY_GEN_MECHANISM:
+ val = CK_UNAVAILABLE_INFORMATION;
+ break;
+
+ /*
+ * The RSA modulus bits.
+ */
+ case CKA_MODULUS_BITS:
+ if(kdata->prov_info->dwProvType == PROV_RSA_FULL)
+ return lookup_rsa_attribute(kdata, attr);
+ else
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+
+ default:
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+ };
+
+ return p11c_return_data(attr, &val, sizeof(CK_ULONG));
+}
+
+static CK_RV
+key_bytes_attribute(P11cObjectData* objdata, CK_ATTRIBUTE_PTR attr)
+{
+ KeyObjectData* kdata = (KeyObjectData*)objdata;
+ CK_MECHANISM_TYPE allowed_mechanisms[] = { CKM_RSA_PKCS };
+ WCHAR* label;
+
+ ASSERT(kdata);
+ ASSERT(attr);
+
+ switch(attr->type)
+ {
+ /*
+ * The ID of the key. This should match the ID we
+ * return for any matching certificates.
+ */
+ case CKA_ID:
+ return p11c_return_data(attr, kdata->key_identifier.pbData,
+ kdata->key_identifier.cbData);
+
+ /*
+ * The key label.
+ * - We use the container name.
+ */
+ case CKA_LABEL:
+ label = kdata->prov_info->pwszContainerName;
+ if(!label)
+ label = L"Unnamed Key";
+ return p11c_return_string(attr, label);
+
+ /*
+ * The subject of the related certificate.
+ * TODO: Implement this lookup.
+ */
+ case CKA_SUBJECT:
+ return p11c_return_data(attr, "", 0);
+
+ /*
+ * Allowed mechanisms with this key.
+ * - RSA used with CKM_RSA
+ * TODO: Needs updating when DSA implemented.
+ */
+ case CKA_ALLOWED_MECHANISMS:
+ return p11c_return_data(attr, &allowed_mechanisms,
+ sizeof(allowed_mechanisms));
+
+ /*
+ * Various RSA public attributes.
+ */
+ case CKA_MODULUS:
+ case CKA_PUBLIC_EXPONENT:
+ case CKA_PRIVATE_EXPONENT:
+ case CKA_PRIME_1:
+ case CKA_PRIME_2:
+ case CKA_EXPONENT_1:
+ case CKA_EXPONENT_2:
+ case CKA_COEFFICIENT:
+ if(kdata->prov_info->dwProvType == PROV_RSA_FULL)
+ return lookup_rsa_attribute(kdata, attr);
+ else
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+
+ /*
+ * Last date this key can be used.
+ * TODO: Does CAPI support this ability?
+ */
+ case CKA_END_DATE:
+ case CKA_START_DATE:
+ return p11c_return_data(attr, "", 0);
+
+ default:
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+ };
+}
+
+static void
+key_release(void* data)
+{
+ KeyObjectData* kdata = (KeyObjectData*)data;
+ ASSERT(kdata);
+
+ ASSERT(kdata->key_identifier.pbData);
+ ASSERT(kdata->prov_info);
+
+ free(kdata->key_identifier.pbData);
+ free(kdata->prov_info);
+
+ free(kdata);
+}
+
+static const P11cObjectDataVtable key_objdata_vtable = {
+ key_bool_attribute,
+ key_ulong_attribute,
+ key_bytes_attribute,
+ key_release,
+};
+
+static CRYPT_KEY_PROV_INFO*
+duplicate_prov_info(CRYPT_KEY_PROV_INFO* original)
+{
+ DWORD container_length, prov_length;
+ CRYPT_KEY_PROV_INFO* result;
+ DWORD length, i;
+ BYTE* at;
+ BYTE* end;
+
+ if(!original)
+ return NULL;
+
+ /* Go through and calculate the length */
+ length = sizeof(CRYPT_KEY_PROV_INFO);
+ if(original->pwszContainerName)
+ {
+ container_length = (wcslen(original->pwszContainerName) + 1) * sizeof(WCHAR);
+ length += container_length;
+ }
+
+ if(original->pwszProvName)
+ {
+ prov_length = (wcslen(original->pwszProvName) + 1) * sizeof(WCHAR);
+ length += prov_length;
+ }
+
+ length += sizeof(CRYPT_KEY_PROV_PARAM) * original->cProvParam;
+ for(i = 0; i < original->cProvParam; ++i)
+ length += original->rgProvParam[i].cbData;
+
+ /* Allocate a single block of memory for everything */
+ at = (BYTE*)malloc(length);
+ if(!at)
+ {
+ SetLastError(ERROR_NOT_ENOUGH_MEMORY);
+ return NULL;
+ }
+
+ /* Copy in very carefully */
+ end = at + length;
+
+ memcpy(at, original, sizeof(CRYPT_KEY_PROV_INFO));
+ result = (CRYPT_KEY_PROV_INFO*)at;
+ at += sizeof(CRYPT_KEY_PROV_INFO);
+
+ if(result->pwszContainerName)
+ {
+ memcpy(at, result->pwszContainerName, container_length);
+ result->pwszContainerName = (LPWSTR)at;
+ at += container_length;
+ }
+
+ if(result->pwszProvName)
+ {
+ memcpy(at, result->pwszProvName, prov_length);
+ result->pwszProvName = (LPWSTR)at;
+ at += prov_length;
+ }
+
+ if(original->cProvParam)
+ {
+ memcpy(at, result->rgProvParam, sizeof(CRYPT_KEY_PROV_PARAM) * result->cProvParam);
+ result->rgProvParam = (CRYPT_KEY_PROV_PARAM*)at;
+ at += sizeof(CRYPT_KEY_PROV_PARAM) * result->cProvParam;
+
+ for(i = 0; i < result->cProvParam; ++i)
+ {
+ memcpy(at, result->rgProvParam[i].pbData, result->rgProvParam[i].cbData);
+ result->rgProvParam[i].pbData = (BYTE*)at;
+ at += result->rgProvParam[i].cbData;
+ }
+ }
+
+ ASSERT(at == end);
+ return result;
+}
+
+static P11cObjectData*
+key_alloc_data(P11cSession* sess, P11cObject* obj, CRYPT_KEY_PROV_INFO* prov_info)
+{
+ KeyObject* kobj = (KeyObject*)obj;
+ KeyObjectData* kdata;
+
+ kdata = (KeyObjectData*)calloc(1, sizeof(KeyObjectData));
+ if(!kdata)
+ return NULL;
+
+ /* Allocate memory for key identifier */
+ kdata->key_identifier.pbData = malloc(kobj->key_identifier.cbData);
+ if(!kdata->key_identifier.pbData)
+ {
+ free(kdata);
+ return NULL;
+ }
+
+ /* Setup the object data */
+ kdata->object_class = kobj->object_class;
+ kdata->prov_info = prov_info;
+ kdata->key_identifier.cbData = kobj->key_identifier.cbData;
+ memcpy(kdata->key_identifier.pbData, kobj->key_identifier.pbData,
+ kdata->key_identifier.cbData);
+ kdata->raw_public_key.pbData = NULL;
+ kdata->raw_public_key.cbData = 0;
+
+ kdata->base.object = obj->id;
+ kdata->base.data_funcs = &key_objdata_vtable;
+
+ return &(kdata->base);
+}
+
+static BOOL WINAPI
+load_key_property_info(PCRYPT_HASH_BLOB key_identifier, DWORD flags,
+ void* reserved, void* arg, DWORD n_props, DWORD* props,
+ void** datas, DWORD* n_datas)
+{
+ CRYPT_KEY_PROV_INFO** prov_info = (CRYPT_KEY_PROV_INFO**)arg;
+ DWORD i;
+
+ /*
+ * Already got a provider info. This shouldn't happen
+ * but can occur if the same key is present twice.
+ */
+ if(*prov_info)
+ return TRUE;
+
+ /* Find the key provider info property */
+ for(i = 0; i < n_props; ++i)
+ {
+ if(props[i] == CERT_KEY_PROV_INFO_PROP_ID)
+ {
+ *prov_info = duplicate_prov_info((CRYPT_KEY_PROV_INFO*)datas[i]);
+ break;
+ }
+ }
+
+ return TRUE;
+}
+
+static CK_RV
+key_load_data(P11cSession* sess, P11cObject* obj, P11cObjectData** objdata)
+{
+ KeyObject* kobj = (KeyObject*)obj;
+ CRYPT_KEY_PROV_INFO* prov_info = NULL;
+
+ ASSERT(kobj);
+ ASSERT(objdata);
+
+ /* Load the provider info */
+ if(!CryptEnumKeyIdentifierProperties((CRYPT_HASH_BLOB*)&kobj->key_identifier,
+ CERT_KEY_PROV_INFO_PROP_ID, 0, NULL, NULL,
+ &prov_info, load_key_property_info))
+ return p11c_winerr_to_ckr(GetLastError());
+
+ /* No provider info, bad news */
+ if(!prov_info)
+ return CKR_GENERAL_ERROR;
+
+ *objdata = key_alloc_data(sess, obj, prov_info);
+ if(!(*objdata))
+ {
+ free(prov_info);
+ return CKR_HOST_MEMORY;
+ }
+
+ return CKR_OK;
+}
+
+static unsigned int
+key_hash_func(P11cObject* obj)
+{
+ KeyObject* kobj = (KeyObject*)obj;
+ return p11c_hash_data(kobj->key_identifier.pbData, kobj->key_identifier.cbData) ^
+ p11c_hash_integer((int)kobj->object_class);
+}
+
+static int
+key_equal_func(P11cObject* a, P11cObject* b)
+{
+ KeyObject* ka = (KeyObject*)a;
+ KeyObject* kb = (KeyObject*)b;
+ return ka->object_class == kb->object_class &&
+ ka->key_identifier.cbData == kb->key_identifier.cbData &&
+ memcmp(ka->key_identifier.pbData, kb->key_identifier.pbData, ka->key_identifier.cbData) == 0;
+}
+
+static void
+key_object_release(void* data)
+{
+ KeyObject* kobj = (KeyObject*)data;
+ ASSERT(kobj);
+ free(kobj);
+}
+
+static const P11cObjectVtable key_object_vtable = {
+ key_load_data,
+ key_hash_func,
+ key_equal_func,
+ key_object_release,
+};
+
+static CK_RV
+register_key_object(P11cSession* sess, CK_OBJECT_CLASS cls,
+ CRYPT_HASH_BLOB* key_identifier, P11cObject** obj)
+{
+ KeyObject* kobj;
+ CK_RV ret;
+
+ ASSERT(obj);
+ ASSERT(key_identifier);
+ ASSERT(cls == CKO_PRIVATE_KEY || cls == CKO_PUBLIC_KEY);
+
+ kobj = calloc(1, sizeof(KeyObject) + key_identifier->cbData);
+ if(!kobj)
+ return CKR_HOST_MEMORY;
+
+ kobj->obj.id = 0;
+ kobj->obj.obj_funcs = &key_object_vtable;
+
+ kobj->object_class = cls;
+ kobj->key_identifier.pbData = (BYTE*)(kobj + 1);
+ kobj->key_identifier.cbData = key_identifier->cbData;
+ memcpy(kobj->key_identifier.pbData, key_identifier->pbData,
+ kobj->key_identifier.cbData);
+
+ ret = p11c_token_register_object(sess->slot, &(kobj->obj));
+ if(ret != CKR_OK)
+ {
+ free(kobj);
+ return ret;
+ }
+
+ ASSERT(kobj->obj.id != 0);
+ *obj = &(kobj->obj);
+
+ return CKR_OK;
+}
+
+typedef struct _EnumArguments
+{
+ P11cSession* sess;
+ CK_OBJECT_CLASS object_class;
+ CK_ATTRIBUTE_PTR match;
+ CK_ULONG count;
+ P11cArray* results;
+ CK_RV ret;
+}
+EnumArguments;
+
+static BOOL WINAPI
+enum_key_property_info(PCRYPT_HASH_BLOB key_identifier, DWORD flags,
+ void* reserved, void* arg, DWORD n_props, DWORD* props,
+ void** datas, DWORD* n_datas)
+{
+ EnumArguments* args = (EnumArguments*)arg;
+ CRYPT_KEY_PROV_INFO* prov_info = NULL;
+ P11cObject *obj = NULL;
+ KeyObjectData kdata;
+ DWORD i;
+
+ /* Find the key provider info property */
+ for(i = 0; i < n_props; ++i)
+ {
+ if(props[i] == CERT_KEY_PROV_INFO_PROP_ID)
+ {
+ prov_info = (CRYPT_KEY_PROV_INFO*)datas[i];
+ break;
+ }
+ }
+
+ /* Strange key, skip */
+ if(!prov_info)
+ return TRUE;
+
+ /* Match the public key */
+ kdata.prov_info = prov_info;
+ kdata.object_class = args->object_class;
+ kdata.base.object = 0;
+ kdata.base.data_funcs = &key_objdata_vtable;
+
+ if(p11c_object_data_match(&kdata.base, args->match, args->count))
+ {
+ args->ret = register_key_object(args->sess, args->object_class, key_identifier, &obj);
+ if(args->ret == CKR_OK)
+ {
+ ASSERT(obj);
+ p11c_array_append(args->results, obj->id);
+ }
+ }
+
+ return TRUE;
+
+}
+
+static CK_RV
+find_any_keys(P11cSession* sess, CK_OBJECT_CLASS cls,
+ CK_ATTRIBUTE_PTR match, CK_ULONG count, P11cArray* arr)
+{
+ CRYPT_HASH_BLOB find_id;
+ EnumArguments enum_args;
+ CK_ULONG i;
+
+ /* Try to setup for an efficient search based on key id */
+ memset(&find_id, 0, sizeof(find_id));
+ for(i = 0; i < count; ++i)
+ {
+ if(!match[i].pValue || !match[i].ulValueLen)
+ continue;
+ if(match[i].type == CKA_ID)
+ {
+ find_id.cbData = match[i].ulValueLen;
+ find_id.pbData = match[i].pValue;
+ }
+ }
+
+ enum_args.sess = sess;
+ enum_args.match = match;
+ enum_args.count = count;
+ enum_args.results = arr;
+ enum_args.object_class = cls;
+ enum_args.ret = CKR_OK;
+
+ if(!CryptEnumKeyIdentifierProperties(find_id.cbData != 0 ? &find_id : NULL,
+ CERT_KEY_PROV_INFO_PROP_ID, 0, NULL, NULL,
+ &enum_args, enum_key_property_info))
+ return p11c_winerr_to_ckr(GetLastError());
+
+ return enum_args.ret;
+}
+
+static CK_RV
+list_matching_certificates(P11cSession* sess, CK_ATTRIBUTE_PTR match,
+ CK_ULONG count, P11cArray* arr)
+{
+ CK_OBJECT_CLASS cert_class = CKO_CERTIFICATE;
+ CK_ATTRIBUTE search[3];
+ CK_ULONG n_search = 0;
+ CK_ULONG i;
+
+ /* The class */
+ search[0].type = CKA_CLASS;
+ search[0].pValue = &cert_class;
+ search[0].ulValueLen = sizeof(CK_OBJECT_CLASS);
+ ++n_search;
+
+ for(i = 0; i < count && n_search < 3; ++i)
+ {
+ /*
+ * This is the attributes that tie a certificate
+ * to key object, so try match certs with these
+ */
+ if(match[i].type == CKA_ID)
+ {
+ search[n_search].type = match[i].type;
+ search[n_search].pValue = match[i].pValue;
+ search[n_search].ulValueLen = match[i].ulValueLen;
+ ++n_search;
+ }
+ }
+
+ /* Do the certificate search */
+ return p11c_cert_find(sess, CKO_CERTIFICATE, search, n_search, arr);
+}
+
+static CK_RV
+find_certificate_key(P11cSession* session, CK_OBJECT_CLASS cls,
+ CK_ATTRIBUTE_PTR match, CK_ULONG count,
+ PCCERT_CONTEXT cert, P11cArray* arr)
+{
+ CRYPT_KEY_PROV_INFO* prov_info;
+ CRYPT_HASH_BLOB key_identifier;
+ P11cObjectData* objdata;
+ KeyObjectData kdata;
+ P11cObject* obj;
+ DWORD prov_length;
+ DWORD error;
+ CK_RV ret = CKR_OK;
+
+ /* Look up the key provider info and identifier */
+ if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, NULL, &prov_length) ||
+ !CertGetCertificateContextProperty(cert, CERT_KEY_IDENTIFIER_PROP_ID, NULL, &key_identifier.cbData))
+ {
+ error = GetLastError();
+ if(error == CRYPT_E_NOT_FOUND)
+ return CKR_OK;
+ return p11c_winerr_to_ckr(error);
+ }
+
+ /* We own the info memory */
+ prov_info = malloc(prov_length);
+ if(!prov_info)
+ return CKR_HOST_MEMORY;
+ key_identifier.pbData = malloc(key_identifier.cbData);
+ if(!key_identifier.pbData)
+ {
+ free(prov_info);
+ return CKR_HOST_MEMORY;
+ }
+
+ /* Lookup the key provider info and identifier */
+ if(CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, prov_info, &prov_length) &&
+ CertGetCertificateContextProperty(cert, CERT_KEY_IDENTIFIER_PROP_ID, key_identifier.pbData, &key_identifier.cbData))
+ {
+ kdata.object_class = cls;
+ kdata.prov_info = prov_info;
+ kdata.key_identifier = key_identifier;
+ kdata.base.object = 0;
+ kdata.base.data_funcs = &key_objdata_vtable;
+
+ if(p11c_object_data_match(&kdata.base, match, count))
+ {
+ ret = register_key_object(session, cls, &key_identifier, &obj);
+ if(ret == CKR_OK)
+ {
+ ASSERT(obj);
+
+ /* Store away the object data for performance reasons */
+ objdata = key_alloc_data(session, obj, prov_info);
+ if(objdata)
+ {
+ p11c_session_take_object_data(session, obj, objdata);
+
+ /* Note these are used, and not to be freed */
+ key_identifier.pbData = NULL;
+ key_identifier.cbData = 0;
+ prov_info = NULL;
+ }
+
+ p11c_array_append(arr, obj->id);
+ }
+ }
+ }
+ else
+ {
+ ret = p11c_winerr_to_ckr(GetLastError());
+ }
+
+ if(key_identifier.pbData)
+ free(key_identifier.pbData);
+ if(prov_info)
+ free(prov_info);
+
+ return ret;
+}
+
+static CK_RV
+find_certificate_keys(P11cSession* session, CK_OBJECT_CLASS cls,
+ CK_ATTRIBUTE_PTR match, CK_ULONG count, P11cArray* arr)
+{
+ CK_OBJECT_HANDLE id;
+ P11cObjectData* certdata;
+ P11cArray* certarr;
+ PCCERT_CONTEXT cert;
+ CK_RV ret = CKR_OK;
+ CK_ULONG i;
+
+ /* Get a list of all certificates */
+ certarr = p11c_array_new(0, 1, sizeof(CK_OBJECT_HANDLE));
+ if(!certarr)
+ return CKR_HOST_MEMORY;
+ ret = list_matching_certificates(session, match, count, certarr);
+
+ /* Now match each of them against our criteria */
+ if(ret == CKR_OK)
+ {
+ for(i = 0; i < certarr->len; ++i)
+ {
+ id = p11c_array_index(certarr, CK_OBJECT_HANDLE, i);
+ ASSERT(id);
+
+ /* Get the certificate data for this certificate object */
+ if(p11c_session_get_object_data_for(session, id, &certdata) != CKR_OK)
+ continue;
+
+ /* Get the certificate context */
+ cert = p11c_cert_object_data_get_certificate(certdata);
+ if(!cert)
+ continue;
+
+ /* Remember we can have either or both keys for each certificate */
+ ret = find_certificate_key(session, cls, match, count, cert, arr);
+ }
+ }
+
+ p11c_array_free(certarr, TRUE);
+ return ret;
+}
+
+CK_RV
+p11c_key_find(P11cSession* sess, CK_OBJECT_CLASS cls,
+ CK_ATTRIBUTE_PTR match, CK_ULONG count, P11cArray* arr)
+{
+ CK_RV ret = CKR_OK;
+
+ /* Is this somewhere we have all keys present? */
+ if(p11c_token_get_flags(sess->slot) & P11C_SLOT_ANYKEY)
+ {
+ if((cls == CKO_PRIVATE_KEY || cls == CKO_ANY) && ret == CKR_OK)
+ ret = find_any_keys(sess, CKO_PRIVATE_KEY, match, count, arr);
+ if((cls == CKO_PUBLIC_KEY || cls == CKO_ANY) && ret == CKR_OK)
+ ret = find_any_keys(sess, CKO_PUBLIC_KEY, match, count, arr);
+ }
+
+ /* Otherwise we can only list the keys that have certificates */
+ else
+ {
+ if((cls == CKO_PRIVATE_KEY || cls == CKO_ANY) && ret == CKR_OK)
+ ret = find_certificate_keys(sess, CKO_PRIVATE_KEY, match, count, arr);
+ if((cls == CKO_PUBLIC_KEY || cls == CKO_ANY) && ret == CKR_OK)
+ ret = find_certificate_keys(sess, CKO_PUBLIC_KEY, match, count, arr);
+ }
+
+ return ret;
+}
+
+DWORD
+p11c_key_object_data_get_bits(P11cObjectData* objdata)
+{
+ KeyObjectData* kdata;
+ PUBLICKEYSTRUC* header;
+ RSAPUBKEY* pubkey;
+ CK_RV ret;
+
+ ASSERT(objdata);
+
+ kdata = (KeyObjectData*)objdata;
+
+ if(!kdata->raw_public_key.pbData)
+ {
+ ret = load_raw_public_key(kdata);
+ if(ret != CKR_OK)
+ return ret;
+ }
+
+ header = (PUBLICKEYSTRUC*)kdata->raw_public_key.pbData;
+ if(!header->bType == PUBLICKEYBLOB)
+ return 0;
+
+ pubkey = (RSAPUBKEY*)(header + 1);
+ if(!pubkey->magic == 0x31415352)
+ return 0;
+
+ return pubkey->bitlen;
+}
+
+CRYPT_KEY_PROV_INFO*
+p11c_key_object_data_get_prov_info(P11cObjectData* objdata)
+{
+ KeyObjectData* kdata;
+
+ ASSERT(objdata);
+ kdata = (KeyObjectData*)objdata;
+ return kdata->prov_info;
+}
diff --git a/module/p11-capi-key.h b/module/p11-capi-key.h
new file mode 100644
index 0000000..b57a2d3
--- /dev/null
+++ b/module/p11-capi-key.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2008 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef P11C_KEY_H
+#define P11C_KEY_H
+
+#include "p11-capi.h"
+
+/* Find key objects matching criteria */
+CK_RV p11c_key_find (P11cSession* sess, CK_OBJECT_CLASS cls,
+ CK_ATTRIBUTE_PTR match, CK_ULONG count,
+ P11cArray* arr);
+
+DWORD p11c_key_object_data_get_bits (P11cObjectData* objdata);
+
+CRYPT_KEY_PROV_INFO* p11c_key_object_data_get_prov_info (P11cObjectData* objdata);
+
+#endif /* P11C_KEY_H */
diff --git a/module/p11-capi-object.c b/module/p11-capi-object.c
new file mode 100644
index 0000000..6c2330e
--- /dev/null
+++ b/module/p11-capi-object.c
@@ -0,0 +1,290 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "p11-capi.h"
+#include "p11-capi-object.h"
+
+#include "pkcs11/pkcs11n.h"
+
+#include <memory.h>
+
+enum
+{
+ DATA_UNKNOWN = 0,
+ DATA_BOOL,
+ DATA_ULONG,
+ DATA_BYTES
+};
+
+int
+attribute_data_type(CK_ATTRIBUTE_TYPE type)
+{
+ switch(type)
+ {
+ // CK_ULONG attribute types
+ case CKA_CLASS:
+ case CKA_CERTIFICATE_TYPE:
+ case CKA_CERTIFICATE_CATEGORY:
+ case CKA_KEY_TYPE:
+ case CKA_MODULUS_BITS:
+ case CKA_PRIME_BITS:
+ /* case CKA_SUBPRIME_BITS: */
+ case CKA_SUB_PRIME_BITS:
+ case CKA_VALUE_BITS:
+ case CKA_VALUE_LEN:
+ case CKA_KEY_GEN_MECHANISM:
+ case CKA_HW_FEATURE_TYPE:
+ case CKA_PIXEL_X:
+ case CKA_PIXEL_Y:
+ case CKA_RESOLUTION:
+ case CKA_CHAR_ROWS:
+ case CKA_CHAR_COLUMNS:
+ case CKA_BITS_PER_PIXEL:
+ case CKA_MECHANISM_TYPE:
+ case CKA_JAVA_MIDP_SECURITY_DOMAIN:
+ case CKA_TRUST_SERVER_AUTH:
+ case CKA_TRUST_CLIENT_AUTH:
+ case CKA_TRUST_CODE_SIGNING:
+ case CKA_TRUST_EMAIL_PROTECTION:
+ case CKA_TRUST_IPSEC_END_SYSTEM:
+ case CKA_TRUST_IPSEC_TUNNEL:
+ case CKA_TRUST_IPSEC_USER:
+ case CKA_TRUST_TIME_STAMPING:
+ return DATA_ULONG;
+
+ // CK_BBOOL attribute types
+ case CKA_TOKEN:
+ case CKA_PRIVATE:
+ case CKA_MODIFIABLE:
+ case CKA_TRUSTED:
+ case CKA_SENSITIVE:
+ case CKA_DECRYPT:
+ case CKA_SIGN:
+ case CKA_SIGN_RECOVER:
+ case CKA_UNWRAP:
+ case CKA_EXTRACTABLE:
+ case CKA_NEVER_EXTRACTABLE:
+ case CKA_ALWAYS_SENSITIVE:
+ case CKA_WRAP_WITH_TRUSTED:
+ case CKA_ALWAYS_AUTHENTICATE:
+ case CKA_ENCRYPT:
+ case CKA_WRAP:
+ case CKA_VERIFY:
+ case CKA_VERIFY_RECOVER:
+ case CKA_DERIVE:
+ case CKA_LOCAL:
+ case CKA_RESET_ON_INIT:
+ case CKA_HAS_RESET:
+ case CKA_COLOR:
+ case CKA_TRUST_STEP_UP_APPROVED:
+ return DATA_BOOL;
+
+ // Raw or string data
+ case CKA_LABEL:
+ case CKA_APPLICATION:
+ case CKA_VALUE:
+ case CKA_OBJECT_ID:
+ case CKA_CHECK_VALUE:
+ case CKA_ISSUER:
+ case CKA_SERIAL_NUMBER:
+ case CKA_SUBJECT:
+ case CKA_ID:
+ case CKA_URL:
+ case CKA_HASH_OF_SUBJECT_PUBLIC_KEY:
+ case CKA_HASH_OF_ISSUER_PUBLIC_KEY:
+ case CKA_AC_ISSUER:
+ case CKA_OWNER:
+ case CKA_ATTR_TYPES:
+ case CKA_MODULUS:
+ case CKA_PUBLIC_EXPONENT:
+ case CKA_PRIVATE_EXPONENT:
+ case CKA_PRIME_1:
+ case CKA_PRIME_2:
+ case CKA_EXPONENT_1:
+ case CKA_EXPONENT_2:
+ case CKA_COEFFICIENT:
+ case CKA_PRIME:
+ case CKA_SUBPRIME:
+ case CKA_BASE:
+ case CKA_ECDSA_PARAMS:
+ /* case CKA_EC_PARAMS: */
+ case CKA_EC_POINT:
+ case CKA_CHAR_SETS:
+ case CKA_ENCODING_METHODS:
+ case CKA_MIME_TYPES:
+ case CKA_REQUIRED_CMS_ATTRIBUTES:
+ case CKA_DEFAULT_CMS_ATTRIBUTES:
+ case CKA_SUPPORTED_CMS_ATTRIBUTES:
+ case CKA_CERT_SHA1_HASH:
+ case CKA_CERT_MD5_HASH:
+ case CKA_ALLOWED_MECHANISMS:
+ case CKA_START_DATE:
+ case CKA_END_DATE:
+ return DATA_BYTES;
+
+ // Arrays are nasty
+ case CKA_WRAP_TEMPLATE:
+ case CKA_UNWRAP_TEMPLATE:
+ default:
+ DBG(("unknown attribute type: %x", type));
+ return DATA_UNKNOWN;
+ };
+}
+
+CK_BBOOL
+p11c_object_data_match_attr(P11cObjectData* objdata, CK_ATTRIBUTE_PTR match)
+{
+ CK_ATTRIBUTE attr;
+ CK_RV rv;
+ int dtype;
+
+ ASSERT(match);
+ ASSERT(objdata);
+ ASSERT(objdata->data_funcs);
+
+ /* Get the data type of the attribute */
+ dtype = attribute_data_type(match->type);
+ if(dtype == DATA_UNKNOWN)
+ return CK_FALSE;
+
+ /* We only do byte matching */
+ if(match->pValue == NULL)
+ return CK_FALSE;
+
+ /* Only load as much data as is needed */
+ attr.type = match->type;
+ attr.pValue = _alloca(match->ulValueLen > 4 ? match->ulValueLen : 4);
+ attr.ulValueLen = match->ulValueLen;
+
+ switch(dtype)
+ {
+ case DATA_BOOL:
+ rv = (objdata->data_funcs->get_bool)(objdata, &attr);
+ break;
+ case DATA_ULONG:
+ rv = (objdata->data_funcs->get_ulong)(objdata, &attr);
+ break;
+ case DATA_BYTES:
+ rv = (objdata->data_funcs->get_bytes)(objdata, &attr);
+ break;
+ default:
+ ASSERT(0 && "unrecognized type");
+ break;
+ };
+
+ /* Unrecognized attribute */
+ if(rv == CKR_ATTRIBUTE_TYPE_INVALID)
+ return CK_FALSE;
+
+ /* Value is longer than this one */
+ if(rv == CKR_BUFFER_TOO_SMALL)
+ return CK_FALSE;
+
+ /* All other errors */
+ if(rv != CKR_OK)
+ return CK_FALSE;
+
+ return (match->ulValueLen == attr.ulValueLen &&
+ memcmp(match->pValue, attr.pValue, attr.ulValueLen) == 0);
+}
+
+CK_BBOOL
+p11c_object_data_match(P11cObjectData* objdata, CK_ATTRIBUTE_PTR matches,
+ CK_ULONG count)
+{
+ CK_ULONG i;
+
+ for(i = 0; i < count; ++i)
+ {
+ if(!p11c_object_data_match_attr(objdata, &matches[i]))
+ return CK_FALSE;
+ }
+
+ return CK_TRUE;
+}
+
+CK_RV
+p11c_object_data_get_attrs(P11cObjectData* objdata, CK_ATTRIBUTE_PTR attrs,
+ CK_ULONG count)
+{
+ CK_ULONG i;
+ CK_RV rv, ret = CKR_OK;
+
+ ASSERT(objdata);
+ ASSERT(!count || attrs);
+
+ for(i = 0; i < count; ++i)
+ {
+ /* Get the data type of the attribute */
+ switch(attribute_data_type(attrs[i].type))
+ {
+ case DATA_BOOL:
+ rv = (objdata->data_funcs->get_bool)(objdata, &attrs[i]);
+ break;
+ case DATA_ULONG:
+ rv = (objdata->data_funcs->get_ulong)(objdata, &attrs[i]);
+ break;
+ case DATA_BYTES:
+ rv = (objdata->data_funcs->get_bytes)(objdata, &attrs[i]);
+ break;
+ case DATA_UNKNOWN:
+ rv = CKR_ATTRIBUTE_TYPE_INVALID;
+ break;
+ default:
+ ASSERT(0 && "unrecognized type");
+ break;
+ };
+
+ /* Not an error if they were just requesting the size */
+ if(rv != CKR_OK)
+ {
+ if(rv == CKR_BUFFER_TOO_SMALL)
+ {
+ if(!attrs[i].pValue)
+ rv = CKR_OK;
+ }
+
+ /* Attribute is sensitive */
+ else if(rv == CKR_ATTRIBUTE_SENSITIVE)
+ {
+ attrs[i].ulValueLen = (CK_ULONG)-1;
+ }
+
+ /* Attribute doesn't exist */
+ else if(rv == CKR_ATTRIBUTE_TYPE_INVALID)
+ {
+ DBG(("O%d: attribute not found: 0x%08x", objdata->object, attrs[i].type));
+ attrs[i].ulValueLen = (CK_ULONG)-1;
+ }
+
+ /* A fatal error? */
+ else
+ {
+ ret = rv;
+ break;
+ }
+
+ /* Transfer any non-fatal errors outward */
+ if(rv != CKR_OK && ret == CKR_OK)
+ ret = rv;
+ }
+ }
+
+ return ret;
+}
diff --git a/module/p11-capi-object.h b/module/p11-capi-object.h
new file mode 100644
index 0000000..e884ee1
--- /dev/null
+++ b/module/p11-capi-object.h
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef P11C_OBJECT_H
+#define P11C_OBJECT_H
+
+#include "p11-capi.h"
+
+/* Debug print something about an object */
+#define DBGO(obj, msg) \
+ p11c_debug("O%d: %s", (obj) ? (obj)->id : 0, (msg))
+
+/* A function to load data for an object */
+typedef CK_RV (*P11cLoadData)(P11cSession* sess, struct _P11cObject* obj,
+ P11cObjectData** objdata);
+
+/* Produce a hash code for an object */
+typedef CK_RV (*P11cHashObject)(struct _P11cObject* obj);
+
+/* Produce a hash code for an object */
+typedef CK_RV (*P11cEqualObject)(struct _P11cObject* one, struct _P11cObject* two);
+
+/* A function to free some data */
+typedef void (*P11cRelease)(void* data);
+
+/* Object functions */
+typedef struct _P11cObjectVtable
+{
+ P11cLoadData load_data;
+ P11cHashObject hash_object;
+ P11cEqualObject equal_object;
+ P11cRelease release;
+}
+P11cObjectVtable;
+
+/* Represents a object we've seen */
+struct _P11cObject
+{
+ CK_OBJECT_HANDLE id;
+ CK_SLOT_ID slot;
+ CK_SESSION_HANDLE session;
+ const P11cObjectVtable* obj_funcs;
+};
+
+/* A function to get an attribute from ObjectData */
+typedef CK_RV (*P11cGetAttribute)(P11cObjectData* objdata, CK_ATTRIBUTE_PTR attr);
+
+/* Object data functions */
+typedef struct _P11cObjectDataVtable
+{
+ P11cGetAttribute get_bool;
+ P11cGetAttribute get_ulong;
+ P11cGetAttribute get_bytes;
+ P11cRelease release;
+}
+P11cObjectDataVtable;
+
+/*
+ * Base class for object data. Different types of
+ * objects extend this with more detailed data
+ */
+struct _P11cObjectData
+{
+ CK_OBJECT_HANDLE object;
+ const P11cObjectDataVtable* data_funcs;
+};
+
+/* Match object data against all the given match attributes */
+CK_BBOOL p11c_object_data_match (P11cObjectData* objdata,
+ CK_ATTRIBUTE_PTR matches, CK_ULONG count);
+
+/* Match a single attribute against object data */
+CK_BBOOL p11c_object_data_match_attr (P11cObjectData* objdata,
+ CK_ATTRIBUTE_PTR match);
+
+/* Get a bunch of attributes from object data */
+CK_RV p11c_object_data_get_attrs (P11cObjectData* objdata, CK_ATTRIBUTE_PTR attrs,
+ CK_ULONG count);
+
+/* Debug print something about an object data */
+#define DBGOD(objdata, msg) \
+ p11c_debug("O%d: %s", (objdata) ? (objdata)->obj : 0, (msg))
+
+#endif /* P11C_OBJECT_H */
diff --git a/module/p11-capi-rsa.c b/module/p11-capi-rsa.c
new file mode 100644
index 0000000..18fc4eb
--- /dev/null
+++ b/module/p11-capi-rsa.c
@@ -0,0 +1,415 @@
+/*
+ * Copyright (C) 2008 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "p11-capi.h"
+#include "p11-capi-der.h"
+#include "p11-capi-key.h"
+#include "p11-capi-object.h"
+
+/*
+ * Portions derived from NSS source files:
+ * lib/ckfw/capi/crsa.c
+ */
+
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is the Netscape security libraries.
+ *
+ * The Initial Developer of the Original Code is
+ * Red Hat, Inc.
+ * Portions created by the Initial Developer are Copyright (C) 2005
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ * Bob Relyea (rrelyea@redhat.com)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#define SSL3_SHAMD5_HASH_SIZE 36 /* LEN_MD5 (16) + LEN_SHA1 (20) */
+
+/*
+ * PKCS #11 sign for RSA expects to take a fully DER-encoded hash value,
+ * which includes the hash OID. CAPI expects to take a Hash Context. While
+ * CAPI does have the capability of setting a raw hash value, it does not
+ * have the ability to sign an arbitrary value. This function tries to
+ * reduce the passed in data into something that CAPI could actually sign.
+ */
+static CK_BYTE_PTR
+parse_rsa_pkcs_der_hash(CK_BYTE_PTR input, CK_ULONG n_input,
+ ALG_ID* algorithm, CK_ULONG_PTR n_hash)
+{
+ BYTE* algid;
+ BYTE* oid;
+ BYTE* hash_data;
+ BYTE* oid_str;
+ DWORD n_oid;
+ DWORD n_algid;
+
+ /*
+ * there are 2 types of hashes NSS typically tries to sign, regular
+ * RSA signature format (with encoded DER_OIDS), and SSL3 Signed hashes.
+ * CAPI knows not to add any oids to SSL3_Signed hashes, so if we have any
+ * random hash that is exactly the same size as an SSL3 hash, then we can
+ * just pass the data through. CAPI has know way of knowing if the value
+ * is really a combined hash or some other arbitrary data, so it's safe to
+ * handle this case first.
+ */
+ if(SSL3_SHAMD5_HASH_SIZE == n_input)
+ {
+ *n_hash = n_input;
+ *algorithm = CALG_SSL3_SHAMD5;
+ return input;
+ }
+
+ /* make sure we have a sequence tag */
+ if((P11C_DER_SEQUENCE | P11C_DER_CONSTRUCTED) != *input)
+ return NULL;
+
+ /*
+ * parse the input block to get 1) the hash oid, and 2) the raw hash value.
+ * unfortunatly CAPI doesn't have a builtin function to do this work, so
+ * we go ahead and do it by hand here.
+ *
+ * format is:
+ * SEQUENCE {
+ * SECQUENCE { // algid
+ * OID {} // oid
+ * ANY {} // optional params
+ * }
+ * OCTECT {} // hash
+ */
+
+ /* unwrap */
+ algid = p11c_der_unwrap(input, n_input, &n_algid, NULL);
+ if(!algid)
+ return NULL;
+
+ /* make sure there is not extra data at the end */
+ if(algid + n_algid != input + n_input)
+ return NULL;
+
+ /* wasn't an algid */
+ if((P11C_DER_SEQUENCE | P11C_DER_CONSTRUCTED) != *algid)
+ return NULL;
+
+ oid = p11c_der_unwrap(algid, n_algid, &n_oid, &hash_data);
+ if(!oid || !hash_data)
+ return NULL;
+
+ if(algorithm)
+ {
+ /*
+ * get the real oid as a string. Again, Microsoft does not
+ * export anything that does this for us
+ */
+ oid_str = p11c_der_read_oid(oid, n_oid);
+ if(!oid_str)
+ return NULL;
+
+ /* look up the hash alg from the oid (fortunately CAPI does to this) */
+ *algorithm = CertOIDToAlgId(oid_str);
+ free(oid_str);
+ }
+
+ /* wasn't a hash? */
+ if(P11C_DER_OCTET_STRING != *hash_data)
+ return NULL;
+
+ /* get the real raw hash */
+ return p11c_der_unwrap(hash_data, n_algid - (hash_data - algid),
+ n_hash, NULL);
+}
+
+CK_RV
+p11c_rsa_pkcs_sign_init(P11cObjectData *keydata, void** operation)
+{
+ CRYPT_KEY_PROV_INFO* prov_info;
+
+ ASSERT(keydata);
+ ASSERT(operation);
+ ASSERT(!*operation);
+
+ prov_info = p11c_key_object_data_get_prov_info(keydata);
+ if(prov_info->dwProvType != PROV_RSA_FULL)
+ return CKR_KEY_TYPE_INCONSISTENT;
+
+ *operation = keydata;
+ return CKR_OK;
+}
+
+CK_RV
+p11c_rsa_pkcs_sign_perform (CK_BYTE_PTR data, CK_ULONG n_data,
+ CK_BYTE_PTR signature, CK_ULONG_PTR n_signature,
+ void** operation)
+{
+ CRYPT_KEY_PROV_INFO* prov_info;
+ P11cObjectData* keydata;
+ ALG_ID algorithm;
+ BYTE* hash_data;
+ DWORD n_hash_data;
+ BOOL capifail;
+ DWORD len, check;
+ DWORD bits;
+ CK_RV ret;
+
+ HCRYPTPROV prov = 0;
+ HCRYPTHASH hash = 0;
+
+
+ ASSERT(operation);
+ ASSERT(*operation);
+
+ if(!data || !n_data)
+ return CKR_ARGUMENTS_BAD;
+
+ keydata = (P11cObjectData*)*operation;
+
+ prov_info = p11c_key_object_data_get_prov_info(keydata);
+ ASSERT(prov_info);
+
+ /* Calculate the number of bits */
+ bits = p11c_key_object_data_get_bits (keydata);
+ if(!bits)
+ return CKR_GENERAL_ERROR;
+
+ /* Want to know the length */
+ if(!signature)
+ {
+ *n_signature = bits / 8;
+ return CKR_OK;
+ }
+
+ /* TODO: Support arbitrary input on Vista */
+
+ /*
+ * PKCS #11 sign for RSA expects to take a fully DER-encoded hash value,
+ * which includes the hash OID. CAPI expects to take a Hash Context. While
+ * CAPI does have the capability of setting a raw hash value, it does not
+ * have the ability to sign an arbitrary value. This function tries to
+ * reduce the passed in data into something that CAPI could actually sign.
+ */
+ hash_data = parse_rsa_pkcs_der_hash(data, n_data, &algorithm, &n_hash_data);
+ if(!hash_data)
+ return CKR_DATA_INVALID;
+
+ capifail = TRUE;
+ if(CryptAcquireContextW(&prov, prov_info->pwszContainerName, prov_info->pwszProvName,
+ prov_info->dwProvType, 0))
+ {
+ if(CryptCreateHash(prov, algorithm, 0, 0, &hash))
+ {
+ /* make sure the hash lens match before we set it */
+ len = sizeof(DWORD);
+ if(CryptGetHashParam(hash, HP_HASHSIZE, (BYTE*)&check, &len, 0))
+ {
+ if(check != n_hash_data)
+ {
+ capifail = FALSE;
+ ret = CKR_DATA_INVALID;
+ }
+
+ /*
+ * we have an explicit hash, set it, note that the length is
+ * implicit by the hashAlg used in create
+ */
+ if(CryptSetHashParam(hash, HP_HASHVAL, hash_data, 0))
+ {
+ /* OK, we have the data in a hash structure, sign it! */
+ if(CryptSignHash(hash, prov_info->dwKeySpec,
+ NULL, 0, signature, n_signature))
+ {
+ /*
+ * OK, Microsoft likes to do things completely
+ * differently than anyone else. We need to reverse
+ * the data we recieved here
+ */
+ if(signature)
+ p11c_reverse_memory(signature, *n_signature);
+
+ capifail = FALSE;
+ ret = CKR_OK;
+ }
+ }
+ }
+ }
+ }
+
+ if(capifail)
+ ret = p11c_winerr_to_ckr(GetLastError());
+
+ if(hash)
+ CryptDestroyHash(hash);
+ if(prov)
+ CryptReleaseContext(prov, 0);
+
+ return ret;
+}
+
+void
+p11c_rsa_pkcs_sign_cleanup (void* operation)
+{
+ /* Nothing to do */
+}
+
+
+CK_RV
+p11c_rsa_pkcs_decrypt_init(P11cObjectData* keydata, void** operation)
+{
+ CRYPT_KEY_PROV_INFO* prov_info;
+
+ ASSERT(keydata);
+ ASSERT(operation);
+ ASSERT(!*operation);
+
+ prov_info = p11c_key_object_data_get_prov_info(keydata);
+ if(prov_info->dwProvType != PROV_RSA_FULL)
+ return CKR_KEY_TYPE_INCONSISTENT;
+
+ *operation = keydata;
+ return CKR_OK;
+}
+
+CK_RV
+p11c_rsa_pkcs_decrypt_perform(CK_BYTE_PTR encdata, CK_ULONG n_encdata,
+ CK_BYTE_PTR result, CK_ULONG_PTR n_result,
+ void** operation)
+{
+ CRYPT_KEY_PROV_INFO* prov_info;
+ P11cObjectData* keydata;
+ BOOL capifail;
+ DWORD bits, error;
+ CK_RV ret;
+
+ HCRYPTPROV prov = 0;
+ HCRYPTKEY key = 0;
+ void* buffer = NULL;
+
+ ASSERT(operation);
+ ASSERT(*operation);
+ ASSERT(encdata);
+ ASSERT(n_encdata);
+
+ keydata = (P11cObjectData*)*operation;
+
+ prov_info = p11c_key_object_data_get_prov_info(keydata);
+ ASSERT(prov_info);
+
+ /* Calculate the number of bits */
+ bits = p11c_key_object_data_get_bits (keydata);
+ if(!bits)
+ return CKR_GENERAL_ERROR;
+
+ /* Want to know the length */
+ if(!result)
+ {
+ *n_result = bits / 8;
+ return CKR_OK;
+ }
+
+ /*
+ * Copy the input, since CAPI operates in place, and
+ * we must also reverse it properly.
+ */
+ buffer = malloc(n_encdata);
+ if(!buffer)
+ return CKR_HOST_MEMORY;
+
+ memcpy(buffer, encdata, n_encdata);
+ p11c_reverse_memory(buffer, n_encdata);
+
+ capifail = TRUE;
+ if(CryptAcquireContextW(&prov, prov_info->pwszContainerName, prov_info->pwszProvName,
+ prov_info->dwProvType, 0))
+ {
+ if(CryptGetUserKey(prov, prov_info->dwKeySpec, &key))
+ {
+ *n_result = n_encdata;
+ if(CryptDecrypt(key, 0, TRUE, 0, buffer, n_result))
+ {
+ capifail = FALSE;
+ ret = CKR_OK;
+ }
+ }
+ }
+
+ if(capifail)
+ {
+ error = GetLastError();
+ switch(error)
+ {
+ case NTE_BAD_DATA:
+ ret = CKR_ENCRYPTED_DATA_INVALID;
+ default:
+ ret = p11c_winerr_to_ckr(error);
+ };
+ }
+
+ /* Copy the memory out to the result buffer */
+ if(ret == CKR_OK)
+ ret = p11c_return_data_raw(result, n_result, buffer, *n_result);
+
+ if(key)
+ CryptDestroyKey(key);
+ if(prov)
+ CryptReleaseContext(prov, 0);
+ if(buffer)
+ free(buffer);
+
+ return ret;
+}
+
+void
+p11c_rsa_pkcs_decrypt_cleanup(void* operation)
+{
+ /* Nothing to do */
+}
+
+void
+p11c_rsa_pkcs_get_info(CK_MECHANISM_TYPE mech, CK_MECHANISM_INFO_PTR info)
+{
+ ASSERT(mech == CKM_RSA_PKCS);
+ ASSERT(info != NULL);
+
+ info->ulMinKeySize = 384;
+ info->ulMaxKeySize = 16384;
+ info->flags = 0;
+}
diff --git a/module/p11-capi-rsa.h b/module/p11-capi-rsa.h
new file mode 100644
index 0000000..0ce571e
--- /dev/null
+++ b/module/p11-capi-rsa.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2008 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef P11C_RSA_H
+#define P11C_RSA_H
+
+#include "p11-capi.h"
+
+CK_RV p11c_rsa_pkcs_sign_init (P11cObjectData* keydata, void** operation);
+
+CK_RV p11c_rsa_pkcs_sign_perform (CK_BYTE_PTR data, CK_ULONG data_len,
+ CK_BYTE_PTR signature, CK_ULONG_PTR signature_len,
+ void** operation);
+
+void p11c_rsa_pkcs_sign_cleanup (void* operation);
+
+CK_RV p11c_rsa_pkcs_decrypt_init (P11cObjectData* keydata, void** operation);
+
+CK_RV p11c_rsa_pkcs_decrypt_perform (CK_BYTE_PTR encdata, CK_ULONG n_encdata,
+ CK_BYTE_PTR result, CK_ULONG_PTR n_result,
+ void** operation);
+
+void p11c_rsa_pkcs_decrypt_cleanup (void* operation);
+
+void p11c_rsa_pkcs_get_info (CK_MECHANISM_TYPE mech,
+ CK_MECHANISM_INFO_PTR info);
+
+#endif /* P11C_RSA_H */
diff --git a/module/p11-capi-session.c b/module/p11-capi-session.c
new file mode 100644
index 0000000..e921875
--- /dev/null
+++ b/module/p11-capi-session.c
@@ -0,0 +1,983 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include <stdlib.h>
+
+#include "p11-capi.h"
+#include "p11-capi-builtin.h"
+#include "p11-capi-cert.h"
+#include "p11-capi-key.h"
+#include "p11-capi-object.h"
+#include "p11-capi-rsa.h"
+#include "p11-capi-session.h"
+#include "p11-capi-token.h"
+#include "p11-capi-trust.h"
+
+/* For operation_type in P11cSession */
+enum
+{
+ OPERATION_NONE,
+ OPERATION_FIND,
+ OPERATION_SIGN,
+ OPERATION_DECRYPT
+};
+
+static P11cArray* all_sessions = NULL;
+
+static void
+object_data_release(P11cObjectData* objdata)
+{
+ ASSERT(objdata->data_funcs);
+ ASSERT(objdata->data_funcs->release);
+ (objdata->data_funcs->release)(objdata);
+}
+
+CK_RV
+p11c_session_create(CK_SLOT_ID slot, P11cSession** ret)
+{
+ P11cSession* sess;
+ const char *store;
+ DWORD err;
+
+ sess = calloc(1, sizeof(P11cSession));
+ if(!sess)
+ return CKR_HOST_MEMORY;
+
+ sess->object_data = p11c_hash_new(NULL, NULL);
+ if(!sess->object_data) {
+ free(sess);
+ return CKR_HOST_MEMORY;
+ }
+
+ sess->mutex = CreateMutex(NULL, FALSE, NULL);
+ if(!sess->mutex) {
+ p11c_hash_free(sess->object_data, NULL);
+ free(sess);
+ return CKR_HOST_MEMORY;
+ }
+
+ store = p11c_token_get_store_name(slot);
+ if(store)
+ {
+ sess->store = CertOpenSystemStore((HCRYPTPROV)NULL, store);
+ if(sess->store == NULL)
+ {
+ err = GetLastError();
+
+ /* Store not found, we don't care */
+ if(err != ERROR_FILE_NOT_FOUND)
+ {
+ p11c_hash_free(sess->object_data, NULL);
+ CloseHandle(sess->mutex);
+ free(sess);
+ return p11c_winerr_to_ckr(err);
+ }
+ }
+ }
+
+ sess->slot = slot;
+
+ DBGS(sess, "created");
+
+ *ret = sess;
+ return CKR_OK;
+}
+
+CK_RV
+p11c_session_register(P11cSession* sess)
+{
+ P11cSession* blank = NULL;
+ CK_SESSION_HANDLE id = 0;
+ CK_RV ret = CKR_OK;
+ size_t i;
+
+ ASSERT(sess);
+ ASSERT(sess->id == 0 && sess->refs == 0);
+
+ DBGS(sess, "registering new session");
+
+ p11c_lock_global();
+
+ /* Find a nice session identifier */
+ while(id == 0) {
+
+ /* Allocate sessions properly */
+ if(!all_sessions)
+ {
+ all_sessions = p11c_array_new(0, 1, sizeof(P11cSession*));
+ if(!all_sessions)
+ {
+ ret = CKR_HOST_MEMORY;
+ break;
+ }
+
+ /* A blank entry for '0' */
+ p11c_array_append(all_sessions, blank);
+
+ DBG(("allocated new session list"));
+ }
+
+ /*
+ * PKCS#11 GRAY AREA: We're assuming we can reuse session
+ * handles. PKCS#11 spec says they're like file handles,
+ * and file handles get reused :)
+ */
+
+ /* Note we never put anything in array position '0' */
+ for(i = 1; i < all_sessions->len; ++i)
+ {
+ /* Any empty position will do */
+ if(!p11c_array_index(all_sessions, P11cSession*, i))
+ {
+ id = i;
+ break;
+ }
+ }
+
+ /* Couldn't find a handle, append a handle */
+ if(id == 0)
+ {
+ id = all_sessions->len;
+ p11c_array_append(all_sessions, blank);
+ }
+ }
+
+ if(ret == CKR_OK)
+ {
+ ASSERT(id > 0 && id < all_sessions->len);
+ ASSERT(!p11c_array_index(all_sessions, P11cSession*, id));
+
+
+ /* And assign it to the session handle */
+ p11c_array_index(all_sessions, P11cSession*, i) = sess;
+ sess->id = id;
+
+ /* The session list reference */
+ ASSERT(sess->refs == 0);
+ sess->refs++;
+
+ DBGS(sess, "registered sesson id");
+ }
+
+ p11c_unlock_global();
+
+ return ret;
+}
+
+void
+p11c_session_destroy(P11cSession* sess)
+{
+ ASSERT(sess);
+ ASSERT(sess->refs == 0);
+
+ /* Ask any pending operations to cleanup */
+ if(sess->operation_type)
+ {
+ ASSERT(sess->operation_cancel);
+ (sess->operation_cancel)(sess);
+ }
+
+ ASSERT(sess->operation_type == 0);
+ ASSERT(sess->operation_data == NULL);
+ ASSERT(sess->operation_cancel == NULL);
+
+ if(sess->store)
+ CertCloseStore(sess->store, 0);
+
+ /* Make all the object adat go away */
+ ASSERT(sess->object_data != NULL);
+ p11c_hash_free(sess->object_data, object_data_release);
+
+ /* And make the mutex go away */
+ ASSERT(sess->mutex != NULL);
+ CloseHandle(sess->mutex);
+
+ DBGS(sess, "destroyed");
+ free(sess);
+}
+
+void
+p11c_session_get_info(P11cSession* sess, CK_SESSION_INFO_PTR info)
+{
+ ASSERT(sess);
+ ASSERT(info);
+
+ info->slotID = sess->slot;
+ info->flags = CKF_SERIAL_SESSION;
+ if(sess->read_write)
+ info->flags |= CKF_RW_SESSION;
+
+ if(p11c_token_is_logged_in(sess->slot))
+ info->state = sess->read_write ? CKS_RW_USER_FUNCTIONS : CKS_RO_USER_FUNCTIONS;
+ else
+ info->state = sess->read_write ? CKS_RW_PUBLIC_SESSION : CKS_RO_PUBLIC_SESSION;
+
+ /* TODO: We could implement some use of GetLastError() here */
+ info->ulDeviceError = 0;
+}
+
+static CK_RV
+lock_ref_internal(P11cArray* sessions, CK_SESSION_HANDLE id,
+ BOOL remove, BOOL writable, P11cSession** sess_ret)
+{
+ P11cSession *sess;
+ DWORD r;
+
+ ASSERT(sessions);
+ ASSERT(sess_ret);
+
+ if(id >= sessions->len)
+ {
+ DBG(("invalid session id: %d", id));
+ return CKR_SESSION_HANDLE_INVALID;
+ }
+
+ /* A seemingly valid id */
+ ASSERT(sessions);
+ sess = p11c_array_index(sessions, P11cSession*, id);
+
+ if(!sess)
+ {
+ DBG(("session does not exist: %d", id));
+ return CKR_SESSION_HANDLE_INVALID;
+ }
+
+ /* Make sure it's the right kind of session */
+ if(writable && !sess->read_write)
+ return CKR_SESSION_READ_ONLY;
+
+ ASSERT(sess->id == id);
+
+ /* Closing takes precedence over active operations */
+ if(!remove)
+ {
+ /*
+ * An initial check is done to make sure this session is not active.
+ * This is done outside of the lock. The real check is done later
+ * inside a lock. This is so we can return quickly without blocking
+ * in most cases.
+ */
+
+ if(sess->in_call)
+ {
+ DBGS(sess, ("an operation is already active in this session"));
+ return CKR_OPERATION_ACTIVE;
+ }
+ }
+
+ /* Lock the CallP11cSession */
+ r = WaitForSingleObject(sess->mutex, INFINITE);
+ ASSERT(r == WAIT_OBJECT_0);
+
+ /* Do the real check */
+ if(!remove && sess->in_call)
+ {
+ ReleaseMutex(sess->mutex);
+ DBGS(sess, ("an operation is already active in this session"));
+ return CKR_OPERATION_ACTIVE;
+ }
+
+ /* Make sure it doesn't go away */
+ ASSERT(sess->refs > 0);
+ sess->refs++;
+
+ DBGS(sess, "found and locked session");
+
+ /* And remove it if necessary */
+ if(remove)
+ {
+ p11c_array_index(sessions, P11cSession*, id) = NULL;
+
+ /* The session list reference */
+ sess->refs--;
+ ASSERT(sess->refs > 0);
+
+ DBGS(sess, "removed session from list");
+ }
+ else
+ {
+ ASSERT(!sess->in_call);
+ sess->in_call = 1;
+ }
+
+ *sess_ret = sess;
+ return CKR_OK;
+}
+
+CK_RV
+p11c_session_get_lock_ref(CK_ULONG id, BOOL writable, P11cSession **sess)
+{
+ /* This must be called without any locks held */
+
+ CK_RV ret = CKR_OK;
+
+ ASSERT(sess);
+
+ if(id <= 0)
+ {
+ DBG(("invalid session id passed: %d", id));
+ return CKR_ARGUMENTS_BAD;
+ }
+
+ p11c_lock_global();
+
+ ret = lock_ref_internal (all_sessions, id, FALSE, writable, sess);
+
+ p11c_unlock_global();
+
+ return ret;
+}
+
+CK_RV
+p11c_session_remove_lock_ref(CK_ULONG id, P11cSession **sess)
+{
+ /* This must be called without any locks held */
+
+ CK_RV ret = CKR_OK;
+
+ ASSERT(sess);
+
+ if(id <= 0)
+ {
+ DBG(("invalid session id passed: %d", id));
+ return CKR_ARGUMENTS_BAD;
+ }
+
+ p11c_lock_global();
+
+ ret = lock_ref_internal (all_sessions, id, TRUE, FALSE, sess);
+
+ p11c_unlock_global();
+
+ return ret;
+}
+
+void
+p11c_session_unref_unlock(P11cSession* sess)
+{
+ /* The CallP11cSession must be locked at this point */
+
+ int refs;
+ BOOL r;
+
+ ASSERT(sess);
+
+ ASSERT(sess->refs > 0);
+ sess->refs--;
+ refs = sess->refs;
+
+ sess->in_call = 0;
+
+ DBGS(sess, "unlocked session");
+
+ r = ReleaseMutex(sess->mutex);
+ ASSERT(r == TRUE);
+
+ /*
+ * At this point if no references are held, then we can safely
+ * delete. No other thread should be involved.
+ */
+
+ if(refs == 0)
+ p11c_session_destroy(sess);
+}
+
+CK_RV
+p11c_session_close_all(CK_SLOT_ID slot)
+{
+ /* This must be called without any locks held */
+
+ P11cArray* sessions;
+ P11cSession *sess;
+ size_t i;
+ CK_RV ret = CKR_OK;
+
+ /*
+ * PKCS#11 GRAY AREA: What happens when this gets called
+ * concurrently? We don't return an error on the second call,
+ * because by the time it returns, all sessions should be closed.
+ */
+
+ DBG(("closing all sessions for: %d", slot));
+
+ if(!all_sessions)
+ return CKR_OK;
+
+ p11c_lock_global();
+
+ sessions = p11c_array_sized_new(0, 1, sizeof(P11cSession*),
+ all_sessions->len);
+ if(!sessions)
+ ret = CKR_HOST_MEMORY;
+
+ /* Steal all the session data */
+ if(ret == CKR_OK)
+ {
+ for(i = 0; i < all_sessions->len; ++i)
+ {
+ sess = p11c_array_index(all_sessions, P11cSession*, i);
+ if(sess && (slot == ((CK_SLOT_ID)-1) || sess->slot == slot))
+ {
+ /* Steal this session */
+ p11c_array_index(all_sessions, P11cSession*, i) = NULL;
+ }
+ else
+ {
+ /* Not a session we're interested in */
+ sess = NULL;
+ }
+
+ /* Both null and normal sessions are set to preserve indexes */
+ p11c_array_append(sessions, sess);
+ }
+
+ ASSERT(sessions->len == all_sessions->len);
+ }
+
+ p11c_unlock_global();
+
+ if(ret != CKR_OK)
+ return ret;
+
+ /* Close each session in turn */
+ for(i = 0; i < sessions->len; ++i)
+ {
+ if(!p11c_array_index(sessions, P11cSession*, i))
+ continue;
+
+ /* We need any calls in other threads to finish, so wait here */
+ if(lock_ref_internal(sessions, i, TRUE, FALSE, &sess) == CKR_OK)
+ p11c_session_unref_unlock(sess);
+ }
+
+ /* We stole the memory above, free it now */
+ p11c_array_free(sessions, 1);
+ return CKR_OK;
+}
+
+void
+p11c_session_cleanup_all()
+{
+ p11c_session_close_all((CK_SLOT_ID)-1);
+
+ p11c_lock_global();
+
+ p11c_array_free(all_sessions, 1);
+ all_sessions = NULL;
+
+ p11c_unlock_global();
+}
+
+/* ----------------------------------------------------------------------------
+ * OBJECT DATA
+ */
+
+CK_RV
+p11c_session_get_object_data(P11cSession* sess, P11cObject* obj,
+ P11cObjectData** objdata)
+{
+ CK_OBJECT_HANDLE id;
+ P11cObjectData* newdata;
+ CK_RV ret;
+
+ ASSERT(sess);
+ ASSERT(sess->object_data);
+ ASSERT(obj);
+ ASSERT(obj->obj_funcs);
+ ASSERT(obj->obj_funcs->load_data);
+ ASSERT(objdata);
+
+ id = obj->id;
+
+ *objdata = p11c_hash_get(sess->object_data, p11c_hash_key(id));
+ if(*objdata)
+ return CKR_OK;
+
+ ret = (obj->obj_funcs->load_data)(sess, obj, &newdata);
+ if(ret != CKR_OK)
+ return ret;
+
+ newdata->object = id;
+ ASSERT(newdata->data_funcs);
+
+ if(!p11c_hash_set(sess->object_data, p11c_hash_key(id), newdata))
+ {
+ object_data_release(newdata);
+ return CKR_HOST_MEMORY;
+ }
+
+ *objdata = newdata;
+ return CKR_OK;
+}
+
+void
+p11c_session_clear_object_data(P11cSession* sess, P11cObject* obj)
+{
+ P11cObjectData* objdata;
+
+ ASSERT(sess);
+ ASSERT(sess->object_data);
+ ASSERT(obj);
+
+ objdata = (P11cObjectData*)p11c_hash_rem(sess->object_data, p11c_hash_key(obj->id));
+ if(objdata)
+ object_data_release(objdata);
+}
+
+void
+p11c_session_enum_object_data(P11cSession* sess,
+ P11cEnumObjectData enum_func, void* arg)
+{
+ CK_OBJECT_HANDLE i, max;
+ P11cObject* obj;
+ P11cObjectData* objdata;
+
+ ASSERT(sess);
+ ASSERT(sess->object_data);
+ ASSERT(enum_func);
+
+ max = p11c_token_get_max_handle();
+ for(i = 0; i < max; ++i)
+ {
+ objdata = (P11cObjectData*)p11c_hash_get(sess->object_data, p11c_hash_key(i));
+ if(!objdata)
+ continue;
+
+ obj = p11c_token_lookup_object(sess->slot, i);
+ if(!obj)
+ continue;
+
+ (enum_func)(sess, obj, objdata, arg);
+ }
+}
+
+CK_RV
+p11c_session_get_object_data_for(P11cSession* sess, CK_OBJECT_HANDLE hand,
+ P11cObjectData** objdata)
+{
+ P11cObject* obj;
+
+ obj = p11c_token_lookup_object(sess->slot, hand);
+ if(!obj)
+ return CKR_OBJECT_HANDLE_INVALID;
+
+ return p11c_session_get_object_data(sess, obj, objdata);
+}
+
+void
+p11c_session_take_object_data(P11cSession* sess, P11cObject* obj,
+ P11cObjectData* objdata)
+{
+ P11cObjectData* prev;
+
+ ASSERT(obj);
+ ASSERT(sess);
+ ASSERT(sess->object_data);
+
+ ASSERT(objdata);
+ objdata->object = obj->id;
+
+ prev = p11c_hash_rem(sess->object_data, p11c_hash_key(obj->id));
+ if(prev)
+ object_data_release(prev);
+
+ if(!p11c_hash_set(sess->object_data, p11c_hash_key(obj->id), objdata))
+ object_data_release(objdata);
+}
+
+
+/* ----------------------------------------------------------------------------
+ * FIND OPERATION
+ */
+
+static BOOL
+get_ulong_attribute(CK_ATTRIBUTE_TYPE type, CK_ATTRIBUTE_PTR templ,
+ CK_ULONG count, CK_ULONG* val)
+{
+ CK_ULONG i;
+
+ ASSERT(val);
+ ASSERT(!count || templ);
+
+ for(i = 0; i < count; ++i)
+ {
+ if(templ[i].type == type)
+ {
+ *val = *((CK_ULONG*)templ[i].pValue);
+ return TRUE;
+ }
+ }
+
+ return FALSE;
+}
+
+static CK_RV
+gather_objects(P11cSession* sess, CK_ATTRIBUTE_PTR match,
+ CK_ULONG count, P11cArray* arr)
+{
+ CK_OBJECT_CLASS ocls = CKO_ANY;
+ CK_RV ret = CKR_OK;
+
+ get_ulong_attribute(CKA_CLASS, match, count, &ocls);
+
+ /* Search for builtins */
+ ret = p11c_builtin_find(sess, ocls, match, count, arr);
+ if(ret != CKR_OK)
+ return ret;
+
+ /*
+ * Search through certificates.
+ *
+ * We always do this search first. In Windows a lots hangs off
+ * the certificates. For example private keys are not contained
+ * in the same stores that certificates are in. There are a different
+ * set of key containers many of which can be used together
+ * with a certificate stored in any store.
+ *
+ * The trust objects we expose also depend on the certificates
+ * loaded.
+ */
+ ret = p11c_cert_find(sess, ocls, match, count, arr);
+ if(ret != CKR_OK)
+ return ret;
+
+ /* Search through trust objects */
+ ret = p11c_trust_find(sess, ocls, match, count, arr);
+ if(ret != CKR_OK)
+ return ret;
+
+ /* Search through key objects */
+ ret = p11c_key_find(sess, ocls, match, count, arr);
+ if(ret != CKR_OK)
+ return ret;
+
+ return ret;
+}
+
+void
+cleanup_find_operation(P11cSession* sess)
+{
+ ASSERT(sess->operation_type == OPERATION_FIND);
+ if(sess->operation_data)
+ p11c_array_free((P11cArray*)sess->operation_data, TRUE);
+ sess->operation_type = OPERATION_NONE;
+ sess->operation_data = NULL;
+ sess->operation_cancel = NULL;
+}
+
+void
+purge_duplicate_objects(P11cArray* arr)
+{
+ P11cHash* checks;
+ CK_OBJECT_HANDLE v;
+ size_t i;
+
+ checks = p11c_hash_new(NULL, NULL);
+ if(!checks)
+ return;
+
+ for(i = 0; i < arr->len; )
+ {
+ v = p11c_array_index(arr, CK_OBJECT_HANDLE, i);
+ if(p11c_hash_get(checks, p11c_hash_key(v)))
+ {
+ p11c_array_remove_index(arr, i);
+ /* Look at same i again */
+ }
+ else
+ {
+ if(!p11c_hash_set(checks, p11c_hash_key(v), arr))
+ break;
+ ++i;
+ }
+ }
+
+ p11c_hash_free(checks, NULL);
+}
+
+CK_RV
+p11c_session_find_init(P11cSession* sess, CK_ATTRIBUTE_PTR match,
+ CK_ULONG count)
+{
+ P11cArray* arr;
+ CK_RV ret;
+
+ ASSERT(sess);
+ ASSERT(!count || match);
+
+ if(sess->operation_type != OPERATION_NONE)
+ return CKR_OPERATION_ACTIVE;
+
+ arr = p11c_array_new(0, 1, sizeof(CK_OBJECT_HANDLE));
+ if(!arr)
+ return CKR_HOST_MEMORY;
+
+ ret = gather_objects(sess, match, count, arr);
+ if(ret != CKR_OK)
+ {
+ p11c_array_free(arr, TRUE);
+ return ret;
+ }
+
+ /* Cleanup all duplicates in the array */
+ purge_duplicate_objects(arr);
+
+ sess->operation_type = OPERATION_FIND;
+ sess->operation_data = arr;
+ sess->operation_cancel = cleanup_find_operation;
+
+ return CKR_OK;
+}
+
+CK_RV
+p11c_session_find(P11cSession* sess, CK_OBJECT_HANDLE_PTR objects,
+ CK_ULONG max_object_count, CK_ULONG_PTR object_count)
+{
+ P11cArray* arr;
+ size_t i;
+
+ ASSERT(sess);
+ ASSERT(object_count);
+ ASSERT(!max_object_count || objects);
+
+ if(sess->operation_type != OPERATION_FIND)
+ return CKR_OPERATION_NOT_INITIALIZED;
+
+ if(!max_object_count)
+ {
+ *object_count = 0;
+ return CKR_OK;
+ }
+
+ arr = (P11cArray*)sess->operation_data;
+ *object_count = (max_object_count > arr->len ? arr->len : max_object_count);
+ for(i = 0; i < *object_count; ++i)
+ objects[i] = p11c_array_index(arr, CK_OBJECT_HANDLE, i);
+
+ p11c_array_remove_range(arr, 0, *object_count);
+
+ return CKR_OK;
+}
+
+CK_RV
+p11c_session_find_final(P11cSession* sess)
+{
+ ASSERT(sess);
+
+ if(sess->operation_type != OPERATION_FIND)
+ return CKR_OPERATION_NOT_INITIALIZED;
+
+ cleanup_find_operation(sess);
+ return CKR_OK;
+}
+
+
+/* ----------------------------------------------------------------------------
+ * CRYPTO OPERATIONS
+ */
+
+typedef struct _CryptoContext
+{
+ CK_MECHANISM_TYPE mech_type;
+ P11cDestroyFunc mech_cleanup;
+ void* mech_data;
+}
+CryptoContext;
+
+void
+cleanup_crypto_operation(P11cSession* sess)
+{
+ CryptoContext* ctx;
+
+ if(sess->operation_data)
+ {
+ ctx = (CryptoContext*)sess->operation_data;
+ if(ctx->mech_cleanup)
+ (ctx->mech_cleanup)(ctx->mech_data);
+ free(ctx);
+ }
+
+ sess->operation_type = OPERATION_NONE;
+ sess->operation_data = NULL;
+ sess->operation_cancel = NULL;
+}
+
+CK_RV
+p11c_session_sign_init(P11cSession* sess, CK_MECHANISM_PTR mech,
+ P11cObjectData *objdata)
+{
+ CryptoContext* ctx;
+ CK_RV ret;
+
+ ASSERT(sess);
+ ASSERT(mech);
+ ASSERT(objdata);
+
+ if(sess->operation_type != OPERATION_NONE)
+ return CKR_OPERATION_ACTIVE;
+
+ ctx = calloc(1, sizeof(CryptoContext));
+ if(!ctx)
+ return CKR_HOST_MEMORY;
+
+ ctx->mech_type = mech->mechanism;
+
+ switch(mech->mechanism)
+ {
+ case CKM_RSA_PKCS:
+ ret = p11c_rsa_pkcs_sign_init(objdata, &ctx->mech_data);
+ ctx->mech_cleanup = p11c_rsa_pkcs_sign_cleanup;
+ break;
+ default:
+ ret = CKR_MECHANISM_INVALID;
+ break;
+ };
+
+ if(ret != CKR_OK)
+ {
+ free(ctx);
+ ASSERT(!sess->operation_data);
+ return ret;
+ }
+
+ sess->operation_type = OPERATION_SIGN;
+ sess->operation_data = ctx;
+ sess->operation_cancel = cleanup_crypto_operation;
+ return CKR_OK;
+}
+
+CK_RV
+p11c_session_sign(P11cSession* sess, CK_BYTE_PTR data, CK_ULONG n_data,
+ CK_BYTE_PTR signature, CK_ULONG_PTR n_signature)
+{
+ CryptoContext *ctx;
+ BOOL incomplete;
+ CK_RV ret;
+
+ ASSERT(sess);
+ ASSERT(data);
+ ASSERT(n_data);
+
+ if(sess->operation_type != OPERATION_SIGN)
+ return CKR_OPERATION_NOT_INITIALIZED;
+
+ ctx = (CryptoContext*)sess->operation_data;
+ switch(ctx->mech_type)
+ {
+ case CKM_RSA_PKCS:
+ ret = p11c_rsa_pkcs_sign_perform(data, n_data, signature, n_signature,
+ &ctx->mech_data);
+ break;
+
+ default:
+ ASSERT(FALSE);
+ ret = CKR_GENERAL_ERROR;
+ break;
+ }
+
+ /* Buffer calculation, we don't end operation */
+ incomplete = (ret == CKR_BUFFER_TOO_SMALL || (ret == CKR_OK && !signature));
+
+ if(!incomplete)
+ cleanup_crypto_operation(sess);
+
+ return ret;
+}
+
+CK_RV
+p11c_session_decrypt_init(P11cSession* sess, CK_MECHANISM_PTR mech,
+ P11cObjectData *objdata)
+{
+ CryptoContext* ctx;
+ CK_RV ret;
+
+ ASSERT(sess);
+ ASSERT(mech);
+ ASSERT(objdata);
+
+ if(sess->operation_type != OPERATION_NONE)
+ return CKR_OPERATION_ACTIVE;
+
+ ctx = calloc(1, sizeof(CryptoContext));
+ if(!ctx)
+ return CKR_HOST_MEMORY;
+
+ ctx->mech_type = mech->mechanism;
+
+ switch(mech->mechanism)
+ {
+ case CKM_RSA_PKCS:
+ ret = p11c_rsa_pkcs_decrypt_init(objdata, &ctx->mech_data);
+ ctx->mech_cleanup = p11c_rsa_pkcs_decrypt_cleanup;
+ break;
+ default:
+ ret = CKR_MECHANISM_INVALID;
+ break;
+ };
+
+ if(ret != CKR_OK)
+ {
+ free(ctx);
+ ASSERT(!sess->operation_data);
+ return ret;
+ }
+
+ sess->operation_type = OPERATION_DECRYPT;
+ sess->operation_data = ctx;
+ sess->operation_cancel = cleanup_crypto_operation;
+ return CKR_OK;
+}
+
+CK_RV
+p11c_session_decrypt(P11cSession* sess, CK_BYTE_PTR encdata, CK_ULONG n_encdata,
+ CK_BYTE_PTR result, CK_ULONG_PTR n_result)
+{
+ CryptoContext *ctx;
+ BOOL incomplete;
+ CK_RV ret;
+
+ ASSERT(sess);
+ ASSERT(encdata);
+ ASSERT(n_encdata);
+
+ if(sess->operation_type != OPERATION_DECRYPT)
+ return CKR_OPERATION_NOT_INITIALIZED;
+
+ ctx = (CryptoContext*)sess->operation_data;
+ switch(ctx->mech_type)
+ {
+ case CKM_RSA_PKCS:
+ ret = p11c_rsa_pkcs_decrypt_perform(encdata, n_encdata, result, n_result,
+ &ctx->mech_data);
+ break;
+
+ default:
+ ASSERT(FALSE);
+ ret = CKR_GENERAL_ERROR;
+ break;
+ }
+
+ /* Buffer calculation, we don't end operation */
+ incomplete = (ret == CKR_BUFFER_TOO_SMALL || (ret == CKR_OK && !result));
+
+ if(!incomplete)
+ cleanup_crypto_operation(sess);
+
+ return ret;
+}
diff --git a/module/p11-capi-session.h b/module/p11-capi-session.h
new file mode 100644
index 0000000..8f84026
--- /dev/null
+++ b/module/p11-capi-session.h
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef P11C_SESSION_H
+#define P11C_SESSION_H
+
+#include "p11-capi.h"
+
+/* --------------------------------------------------------------------
+ *
+ * Session = P11cSession
+ * - A PKCS#11 Session
+ *
+ * Objects = P11cObject
+ * - There's a global list of objects in p11c-object.c indexed by
+ * object handle.
+ * - The object itself has no attributes or cached data, but knows how
+ * to load data when needed.
+ * - Each object has a unique key which guarantees we don't load the
+ * same object twice with two different object handles.
+ *
+ * Object Data = P11cObjectData
+ * - Object Data is owned by the Session
+ * - Loaded data and/or attributes for an object.
+ */
+
+/* Callback to cleanup a current operation */
+typedef void (*P11cSessionCancel) (struct _P11cSession* sess);
+
+/* Represents an open session */
+typedef struct _P11cSession
+{
+ CK_SESSION_HANDLE id; /* Unique ID for this session */
+ CK_SLOT_ID slot;
+ int in_call; /* Whether this session is use in PKCS#11 function */
+
+ HCERTSTORE store; /* Handle to an open certificate store */
+
+ BOOL read_write; /* A read-write session? */
+
+ int operation_type; /* Whether an operation is happening or not */
+ void* operation_data; /* Data for this operation */
+ P11cSessionCancel operation_cancel; /* Callback to cancel operation when necessary */
+
+ P11cHash* object_data;
+
+ CK_NOTIFY notify_callback; /* Application specified callback */
+ CK_VOID_PTR user_data; /* Argument for above */
+
+ int refs; /* Reference count */
+ HANDLE mutex; /* Mutex for protecting this structure */
+}
+P11cSession;
+
+/* Debug print something related to a session */
+#define DBGS(sess, msg) \
+ p11c_debug("S%d: %s", (sess) ? (sess)->id : 0, (msg))
+
+/* Create a session */
+CK_RV p11c_session_create (CK_SLOT_ID slot, P11cSession** ret);
+
+/* Destroy a session */
+void p11c_session_destroy (P11cSession* sess);
+
+/* Register a new session */
+CK_RV p11c_session_register (P11cSession* sess);
+
+/* Get information about a session */
+void p11c_session_get_info (P11cSession* sess,
+ CK_SESSION_INFO_PTR info);
+
+/* Get a session from a handle, and lock it */
+CK_RV p11c_session_get_lock_ref (CK_ULONG id, BOOL writable,
+ P11cSession **sess);
+
+/* Get a session from a handle, remove it from list, and lock it */
+CK_RV p11c_session_remove_lock_ref (CK_ULONG id, P11cSession **sess);
+
+/* Unlock and unreference a session */
+void p11c_session_unref_unlock (P11cSession* sess);
+
+/* Close all sessions on a certain slot/token */
+CK_RV p11c_session_close_all (CK_SLOT_ID slot);
+
+
+
+/* Start a find operation on a session */
+CK_RV p11c_session_find_init (P11cSession* sess,
+ CK_ATTRIBUTE_PTR templ,
+ CK_ULONG count);
+
+/* Return results from a find operation */
+CK_RV p11c_session_find (P11cSession* sess,
+ CK_OBJECT_HANDLE_PTR objects,
+ CK_ULONG max_object_count,
+ CK_ULONG_PTR object_count);
+
+/* End a find operation */
+CK_RV p11c_session_find_final (P11cSession* sess);
+
+
+/* Start a sign operation on a session */
+CK_RV p11c_session_sign_init (P11cSession* sess,
+ CK_MECHANISM_PTR mech,
+ P11cObjectData *objdata);
+
+/* Perform sign operation */
+CK_RV p11c_session_sign (P11cSession* sess,
+ CK_BYTE_PTR data, CK_ULONG n_data,
+ CK_BYTE_PTR sig, CK_ULONG_PTR n_sig);
+
+/* Start a decrypt operation on a session */
+CK_RV p11c_session_decrypt_init (P11cSession* sess,
+ CK_MECHANISM_PTR mech,
+ P11cObjectData *objdata);
+
+/* Perform decrypt operation */
+CK_RV p11c_session_decrypt (P11cSession* sess,
+ CK_BYTE_PTR encdata, CK_ULONG n_encdata,
+ CK_BYTE_PTR result, CK_ULONG_PTR n_result);
+
+/* Get object data for an object */
+CK_RV p11c_session_get_object_data (P11cSession* sess,
+ P11cObject* obj,
+ P11cObjectData** objdata);
+
+/* Get object data for an object handle */
+CK_RV p11c_session_get_object_data_for (P11cSession* sess,
+ CK_OBJECT_HANDLE hand,
+ P11cObjectData** objdata);
+
+/* Set object data for an object */
+void p11c_session_take_object_data (P11cSession* sess,
+ P11cObject* obj,
+ P11cObjectData* objdata);
+
+/* Clear object data for an object */
+void p11c_session_clear_object_data (P11cSession* sess,
+ P11cObject* obj);
+
+/* Enumerate object data for all objects */
+typedef void (*P11cEnumObjectData) (P11cSession* sess,
+ P11cObject* obj,
+ P11cObjectData* data,
+ void* arg);
+
+void p11c_session_enum_object_data (P11cSession* sess,
+ P11cEnumObjectData enum_func,
+ void* arg);
+
+void p11c_session_cleanup_all (void);
+
+#endif /* P11C_SESSION_H */
diff --git a/module/p11-capi-token.c b/module/p11-capi-token.c
new file mode 100644
index 0000000..f6ef2ca
--- /dev/null
+++ b/module/p11-capi-token.c
@@ -0,0 +1,354 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "p11-capi.h"
+#include "p11-capi-object.h"
+#include "p11-capi-token.h"
+
+static P11cArray* object_array = NULL;
+static P11cHash* object_hash = NULL;
+static P11cArray* logged_in_slots = NULL;
+
+typedef struct _SlotInfo
+{
+ const char* capi_store;
+ const char* display_name;
+ CK_ULONG slot_flags;
+}
+SlotInfo;
+
+#define SLOT_OFFSET 0x00001000
+
+static SlotInfo slot_info[] = {
+ { "My", "Personal Certificates", P11C_SLOT_TRUSTED | P11C_SLOT_CERTS },
+ { "AddressBook", "Address Book Certificates", P11C_SLOT_CERTS },
+ { "CA", "Certificate Authorities", P11C_SLOT_CA | P11C_SLOT_CERTS },
+ { "Root", "Root Authorities", P11C_SLOT_TRUSTED | P11C_SLOT_CA | P11C_SLOT_CERTS },
+ { "Trust", "Trust", P11C_SLOT_CERTS },
+ { "TrustedPeople", "Trusted People", P11C_SLOT_TRUSTED | P11C_SLOT_CERTS },
+ { "AuthRoot", "Auth Root", P11C_SLOT_CERTS },
+ { NULL, "All User Keys", P11C_SLOT_ANYKEY }
+};
+
+#define SLOT_TO_OFFSET(slot) \
+ ((slot) & ~(SLOT_OFFSET))
+
+#define OFFSET_TO_SLOT(offset) \
+ ((offset) | SLOT_OFFSET)
+
+unsigned int
+p11c_token_get_count(void)
+{
+ return sizeof(slot_info) / sizeof(slot_info[0]);
+}
+
+CK_SLOT_ID
+p11c_token_get_slot_id(unsigned int offset)
+{
+ ASSERT(offset < p11c_token_get_count());
+ return OFFSET_TO_SLOT(offset);
+}
+
+CK_BBOOL
+p11c_token_is_valid(CK_SLOT_ID slot)
+{
+ unsigned int offset = SLOT_TO_OFFSET(slot);
+ return offset >= 0 && offset < p11c_token_get_count();
+}
+
+const char*
+p11c_token_get_display_name(CK_SLOT_ID slot)
+{
+ unsigned int offset = SLOT_TO_OFFSET(slot);
+ ASSERT(p11c_token_is_valid(slot));
+ ASSERT(slot_info[offset].display_name);
+ return slot_info[offset].display_name;
+}
+
+const char*
+p11c_token_get_store_name(CK_SLOT_ID slot)
+{
+ unsigned int offset = SLOT_TO_OFFSET(slot);
+ ASSERT(p11c_token_is_valid(slot));
+ return slot_info[offset].capi_store;
+}
+
+CK_ULONG
+p11c_token_get_flags(CK_SLOT_ID slot)
+{
+ unsigned int offset = SLOT_TO_OFFSET(slot);
+ ASSERT(p11c_token_is_valid(slot));
+ return slot_info[offset].slot_flags;
+}
+
+static void
+object_free(P11cObject* obj)
+{
+ ASSERT(obj);
+ ASSERT(obj->obj_funcs);
+ ASSERT(obj->obj_funcs->release);
+ (obj->obj_funcs->release)(obj);
+}
+
+void
+p11c_token_cleanup_all(void)
+{
+ size_t i;
+
+ p11c_lock_global();
+
+ if(object_hash)
+ {
+ p11c_hash_free(object_hash, NULL);
+ object_hash = NULL;
+ }
+
+ if(object_array)
+ {
+ for(i = 1; i < object_array->len; ++i)
+ {
+ ASSERT(p11c_array_index(object_array, P11cObject*, i));
+ object_free(p11c_array_index(object_array, P11cObject*, i));
+ }
+
+ p11c_array_free(object_array, TRUE);
+ object_array = NULL;
+ }
+
+ if(logged_in_slots)
+ {
+ p11c_array_free(logged_in_slots, TRUE);
+ logged_in_slots = NULL;
+ }
+
+ p11c_unlock_global();
+}
+
+CK_OBJECT_HANDLE
+p11c_token_get_max_handle(void)
+{
+ if(!object_array)
+ return 0;
+ return object_array->len;
+}
+
+P11cObject*
+p11c_token_lookup_object(CK_SLOT_ID slot, CK_OBJECT_HANDLE obj)
+{
+ /* This must be called without any locks held */
+
+ P11cObject* ret = NULL;
+
+ ASSERT(slot);
+ ASSERT(obj > 0);
+
+ p11c_lock_global();
+
+ if(object_array && obj < object_array->len)
+ ret = p11c_array_index(object_array, P11cObject*, obj);
+
+ p11c_unlock_global();
+
+ /* Must belong to the right slot */
+ if(ret && ret->slot != slot)
+ ret = NULL;
+
+ return ret;
+}
+
+static unsigned int
+object_hash_func(const void* a)
+{
+ P11cObject* obj = (P11cObject*)a;
+ unsigned int hash = p11c_hash_pointer(obj->obj_funcs);
+ hash ^= (obj->obj_funcs->hash_object)(obj);
+ return hash;
+}
+
+static int
+object_equal_func(const void* a, const void* b)
+{
+ P11cObject* ca = (P11cObject*)a;
+ P11cObject* cb = (P11cObject*)b;
+ if(ca == cb)
+ return 1;
+ if(ca->obj_funcs != cb->obj_funcs)
+ return 0;
+ return (ca->obj_funcs->equal_object)(ca, cb);
+}
+
+CK_RV
+p11c_token_register_object(CK_SLOT_ID slot, P11cObject* obj)
+{
+ P11cObject* prev;
+ CK_RV ret = CKR_OK;
+
+ ASSERT(slot);
+ ASSERT(obj->id == 0);
+
+ DBG(("registering object"));
+
+ p11c_lock_global();
+
+ if(!object_array)
+ {
+ object_array = p11c_array_sized_new(0, 1, sizeof(P11cObject*), 16);
+ if(object_array)
+ {
+ /* A blank entry for '0' */
+ P11cObject* blank = NULL;
+ p11c_array_append(object_array, blank);
+ }
+
+ object_hash = p11c_hash_new(object_hash_func, object_equal_func);
+
+ if(!object_array || !object_hash)
+ {
+ /* Allocation failed above */
+ ret = CKR_HOST_MEMORY;
+ }
+ }
+
+ if(ret == CKR_OK)
+ {
+ ASSERT(object_array);
+ ASSERT(object_hash);
+
+ /* Look in the hash and find a previous object */
+ prev = p11c_hash_get(object_hash, obj);
+ if(prev)
+ {
+ /* Register it in the previous object's place */
+ obj->id = prev->id;
+ ASSERT(prev->id < object_array->len);
+ if(p11c_hash_set(object_hash, obj, obj))
+ {
+ p11c_array_index(object_array, P11cObject*, obj->id) = obj;
+ object_free(prev);
+ DBGO(obj, "found old object id");
+ }
+ else
+ {
+ ret = CKR_HOST_MEMORY;
+ }
+ }
+ else
+ {
+ /* Register it at the end of the array */
+ obj->id = object_array->len;
+ ASSERT(obj->id > 0);
+ if(p11c_hash_set(object_hash, obj, obj))
+ {
+ if(p11c_array_append(object_array, obj))
+ {
+ DBGO(obj, "registered new object id");
+ }
+ else
+ {
+ ret = CKR_HOST_MEMORY;
+
+ /* Roll back our addition */
+ p11c_hash_rem(object_hash, obj);
+ }
+ }
+ else
+ {
+ ret = CKR_HOST_MEMORY;
+ }
+ }
+ }
+
+ if(ret == CKR_OK)
+ obj->slot = slot;
+
+ p11c_unlock_global();
+
+ return ret;
+
+}
+
+CK_BBOOL
+p11c_token_is_logged_in(CK_SLOT_ID slot)
+{
+ unsigned int count, offset;
+
+ ASSERT(p11c_token_is_valid(slot));
+
+ if(!logged_in_slots)
+ return CK_FALSE;
+
+ offset = SLOT_TO_OFFSET(slot);
+ count = p11c_token_get_count();
+
+ ASSERT(logged_in_slots->len == count && offset < count);
+ return p11c_array_index(logged_in_slots, CK_BBOOL, offset);
+}
+
+CK_RV
+p11c_token_login(CK_SLOT_ID slot)
+{
+ unsigned int i, count;
+ unsigned int offset;
+ CK_BBOOL value;
+
+ ASSERT(p11c_token_is_valid(slot));
+
+ offset = SLOT_TO_OFFSET(slot);
+ count = p11c_token_get_count();
+
+ if(!logged_in_slots)
+ {
+ logged_in_slots = p11c_array_sized_new(0, 1, sizeof(CK_BBOOL), count);
+ if(!logged_in_slots)
+ return CKR_HOST_MEMORY;
+
+ value = CK_FALSE;
+ for(i = 0; i < count; ++i)
+ p11c_array_append(logged_in_slots, value);
+
+ }
+
+ ASSERT(logged_in_slots->len == count && offset < count);
+ if(p11c_array_index(logged_in_slots, CK_BBOOL, offset))
+ return CKR_USER_ALREADY_LOGGED_IN;
+
+ p11c_array_index(logged_in_slots, CK_BBOOL, offset) = CK_TRUE;
+ return CKR_OK;
+}
+
+CK_RV
+p11c_token_logout(CK_SLOT_ID slot)
+{
+ unsigned int count, offset;
+
+ ASSERT(p11c_token_is_valid(slot));
+
+ if(!logged_in_slots)
+ return CKR_USER_NOT_LOGGED_IN;
+
+ offset = SLOT_TO_OFFSET(slot);
+ count = p11c_token_get_count();
+
+ ASSERT(logged_in_slots->len == count && offset < count);
+ if(!p11c_array_index(logged_in_slots, CK_BBOOL, offset))
+ return CKR_USER_NOT_LOGGED_IN;
+
+ p11c_array_index(logged_in_slots, CK_BBOOL, offset) = CK_FALSE;
+ return CKR_OK;
+}
diff --git a/module/p11-capi-token.h b/module/p11-capi-token.h
new file mode 100644
index 0000000..e97f547
--- /dev/null
+++ b/module/p11-capi-token.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef P11C_TOKEN_H
+#define P11C_TOKEN_H
+
+#include "p11-capi.h"
+
+#define P11C_SLOT_CERTS 0x00000001
+#define P11C_SLOT_ANYKEY 0x00000002
+#define P11C_SLOT_CA 0x00000100
+#define P11C_SLOT_TRUSTED 0x00000200
+
+/* Register a new object, a handle will be assigned to obj->id */
+CK_RV p11c_token_register_object (CK_SLOT_ID slot, P11cObject* obj);
+
+/* Lookup an object for a given object handle */
+P11cObject* p11c_token_lookup_object (CK_SLOT_ID slot, CK_OBJECT_HANDLE obj);
+
+/* Clear all objects for all tokens. Only done when finalizing */
+void p11c_token_cleanup_all (void);
+
+/* Get the number of the maximum object handle currently in memory */
+CK_OBJECT_HANDLE p11c_token_get_max_handle (void);
+
+unsigned int p11c_token_get_count (void);
+
+CK_SLOT_ID p11c_token_get_slot_id (unsigned int index);
+
+CK_BBOOL p11c_token_is_valid (CK_SLOT_ID slot);
+
+const char* p11c_token_get_display_name (CK_SLOT_ID slot);
+
+const char* p11c_token_get_store_name (CK_SLOT_ID slot);
+
+CK_ULONG p11c_token_get_flags (CK_SLOT_ID slot);
+
+CK_RV p11c_token_login (CK_SLOT_ID slot);
+
+CK_RV p11c_token_logout (CK_SLOT_ID slot);
+
+CK_BBOOL p11c_token_is_logged_in (CK_SLOT_ID slot);
+
+#endif /* P11C_TOKEN_H */
diff --git a/module/p11-capi-trust.c b/module/p11-capi-trust.c
new file mode 100644
index 0000000..e45106a
--- /dev/null
+++ b/module/p11-capi-trust.c
@@ -0,0 +1,569 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "p11-capi.h"
+#include "p11-capi-cert.h"
+#include "p11-capi-object.h"
+#include "p11-capi-session.h"
+#include "p11-capi-token.h"
+#include "p11-capi-trust.h"
+#include "x509-usages.h"
+
+#include "pkcs11/pkcs11n.h"
+
+/*
+ * These are the attributes expected by NSS on a trust object:
+ *
+ * CKA_CLASS
+ * CKA_TOKEN
+ * CKA_LABEL
+ * CKA_CERT_SHA1_HASH
+ * CKA_CERT_MD5_HASH
+ * CKA_ISSUER
+ * CKA_SUBJECT
+ * CKA_TRUST_SERVER_AUTH
+ * CKA_TRUST_CLIENT_AUTH
+ * CKA_TRUST_EMAIL_PROTECTION
+ * CKA_TRUST_CODE_SIGNING
+ * CKA_SERIAL_NUMBER
+ */
+
+typedef struct _TrustObject
+{
+ P11cObject obj;
+ CK_OBJECT_HANDLE cert_obj;
+}
+TrustObject;
+
+typedef struct _TrustObjectData
+{
+ P11cObjectData base;
+
+ PCCERT_CONTEXT cert;
+ CERT_ENHKEY_USAGE* enhanced_usage;
+
+ BOOL has_usage;
+ BYTE usage;
+}
+TrustObjectData;
+
+static CK_TRUST
+has_usage(TrustObjectData* tdata, BYTE restriction)
+{
+ if(!tdata->has_usage)
+ CKT_NETSCAPE_TRUST_UNKNOWN;
+ if((tdata->usage & restriction) == restriction)
+ return CKT_NETSCAPE_TRUSTED;
+ return CKT_NETSCAPE_UNTRUSTED;
+
+}
+
+static CK_TRUST
+has_enhanced_usage(TrustObjectData* tdata, const char* oid)
+{
+ CERT_ENHKEY_USAGE* eusage = tdata->enhanced_usage;
+ DWORD i;
+
+ /* No usages, means anything goes */
+ if(eusage == NULL)
+ return CKT_NETSCAPE_TRUSTED_DELEGATOR;
+
+ for(i = 0; i < eusage->cUsageIdentifier; ++i)
+ {
+ if(eusage->rgpszUsageIdentifier[i] &&
+ strcmp(oid, eusage->rgpszUsageIdentifier[i]) == 0)
+ return CKT_NETSCAPE_TRUSTED_DELEGATOR;
+ }
+
+ return CKT_NETSCAPE_TRUST_UNKNOWN;
+}
+
+static CK_RV
+trust_bool_attribute(P11cObjectData* objdata, CK_ATTRIBUTE_PTR attr)
+{
+ CK_BBOOL val;
+
+ ASSERT(objdata);
+ ASSERT(attr);
+
+ switch(attr->type)
+ {
+ /*
+ * Resides on the token
+ * - Always true for CAPI objects.
+ */
+ case CKA_TOKEN:
+ val = CK_TRUE;
+ break;
+
+ /*
+ * Private vs. Public object.
+ * - Always false for certificates.
+ */
+ case CKA_PRIVATE:
+ val = CK_FALSE;
+ break;
+
+ /*
+ * If object can be modified.
+ */
+ case CKA_MODIFIABLE:
+ val = CK_TRUE;
+ break;
+
+ /*
+ * TODO: Figure out what this is.
+ */
+ case CKA_TRUST_STEP_UP_APPROVED:
+ val = CK_FALSE;
+ break;
+
+ default:
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+ };
+
+ return p11c_return_data(attr, &val, sizeof(CK_BBOOL));
+}
+
+static CK_RV
+trust_ulong_attribute(P11cObjectData* objdata, CK_ATTRIBUTE_PTR attr)
+{
+ TrustObjectData* tdata = (TrustObjectData*)objdata;
+ CK_ULONG val;
+
+ ASSERT(tdata);
+ ASSERT(attr);
+
+ switch(attr->type)
+ {
+
+ /*
+ * Object class.
+ * - Always CKO_NETSCAPE_TRUST for netscape trust
+ */
+ case CKA_CLASS:
+ val = CKO_NETSCAPE_TRUST;
+ break;
+
+ /*
+ * Key restrictions
+ */
+ case CKA_TRUST_DIGITAL_SIGNATURE:
+ val = has_usage(tdata, CERT_DIGITAL_SIGNATURE_KEY_USAGE);
+ break;
+ case CKA_TRUST_NON_REPUDIATION:
+ val = has_usage(tdata, CERT_NON_REPUDIATION_KEY_USAGE);
+ break;
+ case CKA_TRUST_KEY_ENCIPHERMENT:
+ val = has_usage(tdata, CERT_KEY_ENCIPHERMENT_KEY_USAGE);
+ break;
+ case CKA_TRUST_DATA_ENCIPHERMENT:
+ val = has_usage(tdata, CERT_DATA_ENCIPHERMENT_KEY_USAGE);
+ break;
+ case CKA_TRUST_KEY_AGREEMENT:
+ val = has_usage(tdata, CERT_KEY_AGREEMENT_KEY_USAGE);
+ break;
+ case CKA_TRUST_KEY_CERT_SIGN:
+ val = has_usage(tdata, CERT_KEY_CERT_SIGN_KEY_USAGE);
+ break;
+ case CKA_TRUST_CRL_SIGN:
+ val = has_usage(tdata, CERT_CRL_SIGN_KEY_USAGE);
+ break;
+
+ /*
+ * Various trust flags
+ */
+ case CKA_TRUST_SERVER_AUTH:
+ val = has_enhanced_usage(tdata, X509_USAGE_SERVER_AUTH);
+ break;
+ case CKA_TRUST_CLIENT_AUTH:
+ val = has_enhanced_usage(tdata, X509_USAGE_CLIENT_AUTH);
+ break;
+ case CKA_TRUST_CODE_SIGNING:
+ val = has_enhanced_usage(tdata, X509_USAGE_CODE_SIGNING);
+ break;
+ case CKA_TRUST_EMAIL_PROTECTION:
+ val = has_enhanced_usage(tdata, X509_USAGE_EMAIL);
+ break;
+ case CKA_TRUST_IPSEC_END_SYSTEM:
+ val = has_enhanced_usage(tdata, X509_USAGE_IPSEC_ENDPOINT);
+ break;
+ case CKA_TRUST_IPSEC_TUNNEL:
+ val = has_enhanced_usage(tdata, X509_USAGE_IPSEC_TUNNEL);
+ break;
+ case CKA_TRUST_IPSEC_USER:
+ val = has_enhanced_usage(tdata, X509_USAGE_IPSEC_USER);
+ break;
+ case CKA_TRUST_TIME_STAMPING:
+ val = has_enhanced_usage(tdata, X509_USAGE_TIME_STAMPING);
+ break;
+
+ default:
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+ };
+
+ return p11c_return_data(attr, &val, sizeof(CK_ULONG));
+}
+
+static CK_RV
+trust_bytes_attribute(P11cObjectData* objdata, CK_ATTRIBUTE_PTR attr)
+{
+ TrustObjectData* tdata = (TrustObjectData*)objdata;
+
+ ASSERT(tdata);
+ ASSERT(attr);
+
+ switch(attr->type)
+ {
+ /*
+ * Forward these through to the certificate itself.
+ */
+ case CKA_SUBJECT:
+ case CKA_ISSUER:
+ case CKA_SERIAL_NUMBER:
+ case CKA_LABEL:
+ ASSERT(tdata->cert);
+ return p11c_cert_certificate_get_bytes(tdata->cert, attr);
+
+ /*
+ * The hash of the DER encoded certificate.
+ */
+ case CKA_CERT_MD5_HASH:
+ case CKA_CERT_SHA1_HASH:
+ if(!CryptHashCertificate(0, attr->type == CKA_CERT_MD5_HASH ? CALG_MD5 : CALG_SHA1,
+ 0, tdata->cert->pbCertEncoded,
+ tdata->cert->cbCertEncoded, attr->pValue,
+ (DWORD*)(&attr->ulValueLen)))
+ return p11c_winerr_to_ckr(GetLastError());
+ return CKR_OK;
+ };
+
+ return CKR_ATTRIBUTE_TYPE_INVALID;
+}
+
+static unsigned int
+trust_hash_func(P11cObject* obj)
+{
+ return p11c_hash_integer(((TrustObject*)obj)->cert_obj);
+}
+
+static int
+trust_equal_func(P11cObject* a, P11cObject* b)
+{
+ return ((TrustObject*)a)->cert_obj == ((TrustObject*)b)->cert_obj;
+}
+
+static void
+trust_release(void* data)
+{
+ TrustObjectData* tdata = (TrustObjectData*)data;
+ ASSERT(tdata);
+
+ ASSERT(tdata->cert);
+ CertFreeCertificateContext(tdata->cert);
+
+ if(tdata->enhanced_usage)
+ free(tdata->enhanced_usage);
+
+ free(tdata);
+}
+
+static const P11cObjectDataVtable trust_objdata_vtable = {
+ trust_bool_attribute,
+ trust_ulong_attribute,
+ trust_bytes_attribute,
+ trust_release,
+};
+
+static CK_RV
+parse_usage(TrustObjectData* tdata, DWORD flags)
+{
+ DWORD size, err;
+ CERT_ENHKEY_USAGE* eusage;
+
+ ASSERT(!tdata->enhanced_usage);
+
+ /* Get the size of the enhanced_usage */
+ if(!CertGetEnhancedKeyUsage(tdata->cert, flags, NULL, &size))
+ {
+ err = GetLastError();
+
+ /* No enhanced_usage data is not an error */
+ if(err == CRYPT_E_NOT_FOUND)
+ return CKR_OK;
+ return p11c_winerr_to_ckr(err);
+ }
+
+ eusage = (CERT_ENHKEY_USAGE*)calloc(1, size);
+ if(!eusage)
+ return CKR_HOST_MEMORY;
+
+ /* Now get the actual enhanced usage property */
+ if(!CertGetEnhancedKeyUsage(tdata->cert, flags, eusage, &size))
+ {
+ err = GetLastError();
+ if(err == CRYPT_E_NOT_FOUND)
+ return CKR_OK;
+ return p11c_winerr_to_ckr(err);
+ }
+
+ tdata->enhanced_usage = eusage;
+ return CKR_OK;
+}
+
+static CK_RV
+parse_restrictions(TrustObjectData* tdata)
+{
+ CRYPT_BIT_BLOB* rst;
+ CERT_EXTENSION* ext;
+ DWORD size;
+
+ ASSERT(tdata);
+ ASSERT(tdata->cert);
+
+ tdata->has_usage = CK_FALSE;
+ tdata->usage = 0x00;
+
+ ext = CertFindExtension(szOID_KEY_USAGE,
+ tdata->cert->pCertInfo->cExtension,
+ tdata->cert->pCertInfo->rgExtension);
+
+ /* No key usage, don't care */
+ if(!ext)
+ return CKR_OK;
+
+ /* Find the size of the decoded structure */
+ if(!CryptDecodeObject(P11c_ENCODINGS, X509_KEY_USAGE,
+ ext->Value.pbData, ext->Value.cbData, 0, NULL, &size))
+ return p11c_winerr_to_ckr(GetLastError());
+
+ /* Allocate enough memory */
+ rst = (CRYPT_BIT_BLOB*)calloc(1, size);
+ if(!rst)
+ return CKR_HOST_MEMORY;
+
+ /* And get the decoded structure */
+ if(CryptDecodeObject(P11c_ENCODINGS, X509_KEY_USAGE,
+ ext->Value.pbData, ext->Value.cbData, 0, rst, &size))
+ {
+ if(rst->cbData != 1 &&
+ rst->cUnusedBits != 0)
+ {
+ DBG(("key usage are of invalid size"));
+ }
+ else
+ {
+ /* A valid byte of key restricted usage flags. Yes all that for one byte */
+ tdata->usage = *((BYTE*)(rst->pbData));
+ tdata->has_usage = TRUE;
+ }
+ }
+
+ free(rst);
+ return CKR_OK;
+}
+
+static CK_RV
+trust_load_data(P11cSession* sess, P11cObject* obj, P11cObjectData** objdata)
+{
+ TrustObject* tobj = (TrustObject*)obj;
+ TrustObjectData* tdata;
+ P11cObjectData* certdata;
+ CK_RV ret;
+
+ ASSERT(tobj);
+ ASSERT(objdata);
+
+ /* Get the raw data for the certificate */
+ ret = p11c_session_get_object_data_for(sess, tobj->cert_obj, &certdata);
+ if(ret != CKR_OK)
+ return ret;
+
+ tdata = (TrustObjectData*)calloc(1, sizeof(TrustObjectData));
+ if(!tdata)
+ return CKR_HOST_MEMORY;
+
+ tdata->cert = p11c_cert_object_data_get_certificate (certdata);
+ ASSERT(tdata->cert);
+
+ /* Dig up the restrictions data extension */
+ ret = parse_restrictions(tdata);
+ if(ret != CKR_OK)
+ {
+ free(tdata);
+ return ret;
+ }
+
+ /* Dig up the enhanced usage data property, and then try the extension */
+ ret = parse_usage(tdata, CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG);
+ if(ret == CKR_OK && !tdata->enhanced_usage)
+ ret = parse_usage(tdata, CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG);
+
+ if(ret != CKR_OK)
+ {
+ free(tdata);
+ return ret;
+ }
+
+ /* And keep a reference to the certificate */
+ tdata->cert = CertDuplicateCertificateContext(tdata->cert);
+
+ tdata->base.object = obj->id;
+ tdata->base.data_funcs = &trust_objdata_vtable;
+
+ *objdata = &(tdata->base);
+ return CKR_OK;
+}
+
+
+static void
+trust_object_release(void* data)
+{
+ TrustObject* tobj = (TrustObject*)data;
+ ASSERT(tobj);
+ free(tobj);
+}
+
+static const P11cObjectVtable trust_object_vtable = {
+ trust_load_data,
+ trust_hash_func,
+ trust_equal_func,
+ trust_object_release,
+};
+
+static CK_RV
+register_trust_object(P11cSession* sess, P11cObject* cert, P11cObject** obj)
+{
+ TrustObject* tobj;
+ CK_RV ret;
+
+ tobj = calloc(1, sizeof(TrustObject));
+ if(!tobj)
+ return CKR_HOST_MEMORY;
+
+ tobj->cert_obj = cert->id;
+
+ tobj->obj.id = 0;
+ tobj->obj.obj_funcs = &trust_object_vtable;
+
+ ret = p11c_token_register_object(sess->slot, &(tobj->obj));
+ if(ret != CKR_OK)
+ {
+ free(tobj);
+ return ret;
+ }
+
+ ASSERT(tobj->obj.id != 0);
+ *obj = &(tobj->obj);
+
+ return CKR_OK;
+}
+
+static CK_RV
+list_matching_certificates(P11cSession* sess, CK_ATTRIBUTE_PTR match,
+ CK_ULONG count, P11cArray* arr)
+{
+ CK_OBJECT_CLASS cert_class = CKO_CERTIFICATE;
+ CK_ATTRIBUTE search[3];
+ CK_ULONG n_search = 0;
+ CK_ULONG i;
+
+ /* The class */
+ search[0].type = CKA_CLASS;
+ search[0].pValue = &cert_class;
+ search[0].ulValueLen = sizeof(CK_OBJECT_CLASS);
+ ++n_search;
+
+ for(i = 0; i < count && n_search < 3; ++i)
+ {
+ /*
+ * These are the attributes that tie a certificate
+ * to trust object, so try match certs with these
+ */
+ if(match[i].type == CKA_ISSUER ||
+ match[i].type == CKA_SERIAL_NUMBER)
+ {
+ search[n_search].type = match[i].type;
+ search[n_search].pValue = match[i].pValue;
+ search[n_search].ulValueLen = match[i].ulValueLen;
+ ++n_search;
+ }
+ }
+
+ /* Do the certificate search */
+ return p11c_cert_find(sess, CKO_CERTIFICATE, search, n_search, arr);
+}
+
+CK_RV
+p11c_trust_find(P11cSession* sess, CK_OBJECT_CLASS cls,
+ CK_ATTRIBUTE_PTR match, CK_ULONG count, P11cArray* arr)
+{
+ CK_OBJECT_HANDLE id;
+ P11cObject* obj;
+ P11cObject* certobj;
+ P11cObjectData* objdata;
+ P11cArray* certarr;
+ CK_RV ret = CKR_OK;
+ CK_ULONG i;
+
+ /* We only have trust objects in here */
+ if(cls != CKO_NETSCAPE_TRUST && cls != CKO_ANY)
+ return CKR_OK;
+
+ /* Only work with slots that have certificates */
+ if(!(p11c_token_get_flags (sess->slot) & P11C_SLOT_CERTS))
+ return CKR_OK;
+
+ /* Get a list of all certificates */
+ certarr = p11c_array_new(0, 1, sizeof(CK_OBJECT_HANDLE));
+ if(!certarr)
+ return CKR_HOST_MEMORY;
+ ret = list_matching_certificates(sess, match, count, certarr);
+
+ /* Now match each of them against our criteria */
+ if(ret == CKR_OK)
+ {
+ for(i = 0; i < certarr->len; ++i)
+ {
+ id = p11c_array_index(certarr, CK_OBJECT_HANDLE, i);
+ ASSERT(id);
+
+ certobj = p11c_token_lookup_object(sess->slot, id);
+ ASSERT(certobj);
+
+ /* We'll register a trust object for any loaded certificate */
+ ret = register_trust_object(sess, certobj, &obj);
+ if(ret != CKR_OK)
+ break;
+
+ ASSERT(obj);
+
+ ret = p11c_session_get_object_data(sess, obj, &objdata);
+ if(ret != CKR_OK)
+ break;
+
+ /* Only return new object if it matches */
+ if(p11c_object_data_match(objdata, match, count))
+ p11c_array_append(arr, obj->id);
+ }
+ }
+
+ p11c_array_free(certarr, TRUE);
+ return ret;
+}
diff --git a/module/p11-capi-trust.h b/module/p11-capi-trust.h
new file mode 100644
index 0000000..639f2eb
--- /dev/null
+++ b/module/p11-capi-trust.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef P11C_TRUST_H
+#define P11C_TRUST_H
+
+#include "p11-capi.h"
+
+/* Find trust objects matching criteria */
+CK_RV p11c_trust_find (P11cSession* sess, CK_OBJECT_CLASS cls,
+ CK_ATTRIBUTE_PTR match, CK_ULONG count,
+ P11cArray* arr);
+
+#endif /* P11C_TRUST_H */
diff --git a/module/p11-capi-util.c b/module/p11-capi-util.c
new file mode 100644
index 0000000..5ebb72b
--- /dev/null
+++ b/module/p11-capi-util.c
@@ -0,0 +1,547 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "p11-capi-util.h"
+
+#include <sys/types.h>
+#include <stdlib.h>
+#include <string.h>
+
+
+void
+p11c_reverse_memory (void* data, size_t length)
+{
+ size_t end = length - 1;
+ size_t middle = length / 2;
+ unsigned char* buf = data;
+ size_t i;
+
+ for (i = 0; i < middle; i++)
+ {
+ unsigned char tmp = buf[i];
+ buf[i] = buf[end - i];
+ buf[end - i] = tmp;
+ }
+}
+
+/*
+ * Array code originially from Glib.
+ * Modified extensively by Stef Walter <nielsen@memberwebs.com>
+ */
+
+/* GLIB - Library of useful routines for C programming
+ * Copyright (C) 1995-1997 Peter Mattis, Spencer Kimball and Josh MacDonald
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+
+#define MIN_ARRAY_SIZE 16
+
+typedef struct _RealArray
+{
+ P11cArray pub;
+ size_t alloc;
+ size_t elt_size;
+ int zero_terminated : 1;
+ int clear : 1;
+}
+RealArray;
+
+#define array_elt_len(array, i) ((array)->elt_size * (i))
+#define array_elt_pos(array, i) (((char*)(array)->pub.data) + array_elt_len((array),(i)))
+#define array_elt_zero(array, pos, len) \
+ (memset(array_elt_pos((array), pos), 0, array_elt_len((array), len)))
+#define array_zero_terminate(array) \
+ { if ((array)->zero_terminated) \
+ array_elt_zero((array), (array)->pub.len, 1); }
+
+static unsigned int
+nearest_pow(unsigned int num)
+{
+ unsigned int n = 1;
+ while(n < num)
+ n <<= 1;
+ return n;
+}
+
+static int
+maybe_expand(RealArray *array, size_t len)
+{
+ void* mem;
+ size_t want_alloc = array_elt_len(array, array->pub.len + len +
+ array->zero_terminated);
+
+ if(want_alloc > array->alloc)
+ {
+ want_alloc = nearest_pow(want_alloc);
+ want_alloc = want_alloc > MIN_ARRAY_SIZE ? want_alloc : MIN_ARRAY_SIZE;
+
+ mem = realloc(array->pub.data, want_alloc);
+ if(!mem)
+ return 0;
+ array->pub.data = mem;
+
+ memset((char*)array->pub.data + array->alloc, 0, want_alloc - array->alloc);
+ array->alloc = want_alloc;
+ }
+
+ return 1;
+}
+
+P11cArray*
+p11c_array_new(int zero_terminated, int clear, size_t elt_size)
+{
+ return p11c_array_sized_new(zero_terminated, clear, elt_size, 0);
+}
+
+P11cArray*
+p11c_array_sized_new(int zero_terminated, int clear, size_t elt_size,
+ size_t reserved_size)
+{
+ RealArray *array = malloc(sizeof(RealArray));
+ if(!array)
+ return NULL;
+
+ array->pub.data = NULL;
+ array->pub.len = 0;
+ array->alloc = 0;
+ array->zero_terminated = (zero_terminated ? 1 : 0);
+ array->clear = (clear ? 1 : 0);
+ array->elt_size = elt_size;
+
+ if(array->zero_terminated || reserved_size != 0)
+ {
+ maybe_expand(array, reserved_size);
+ array_zero_terminate(array);
+ }
+
+ return (P11cArray*)array;
+}
+
+void*
+p11c_array_free(P11cArray* array, int free_segment)
+{
+ void* segment;
+
+ if(array == NULL)
+ return NULL;
+
+ if(free_segment)
+ {
+ if(array->data)
+ free(array->data);
+ segment = NULL;
+ }
+ else
+ segment = array->data;
+
+ free(array);
+ return segment;
+}
+
+int
+p11c_array_append_vals(P11cArray* parray, const void* data, size_t len)
+{
+ RealArray* array = (RealArray*)parray;
+ if(!maybe_expand(array, len))
+ return 0;
+
+ memcpy(array_elt_pos(array, array->pub.len), data,
+ array_elt_len(array, len));
+
+ array->pub.len += len;
+ array_zero_terminate(array);
+
+ return 1;
+}
+
+void
+p11c_array_remove_index(P11cArray* parray, unsigned int index)
+{
+ RealArray* array = (RealArray*)parray;
+
+ if(index >= array->pub.len)
+ return;
+
+ if(index != array->pub.len - 1)
+ memmove(array_elt_pos (array, index),
+ array_elt_pos (array, index + 1),
+ array_elt_len (array, array->pub.len - index - 1));
+
+ array->pub.len -= 1;
+
+ array_elt_zero (array, array->pub.len, 1);
+}
+
+void
+p11c_array_remove_range(P11cArray* parray, unsigned int index, size_t length)
+{
+ RealArray *array = (RealArray*)parray;
+
+ if(index >= array->pub.len)
+ return;
+ if(index + length > array->pub.len)
+ length = array->pub.len - index;
+ if(length == 0)
+ return;
+
+ if(index + length != array->pub.len)
+ memmove(array_elt_pos (array, index),
+ array_elt_pos (array, index + length),
+ (array->pub.len - (index + length)) * array->elt_size);
+
+ array->pub.len -= length;
+ array_elt_zero(array, array->pub.len, length);
+}
+
+
+/*
+ * Originally from apache 2.0
+ * Extensive modifications by <nielsen@memberwebs.com>
+ */
+
+/* Copyright 2000-2004 The Apache Software Foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+/*
+ * The internal form of a hash table.
+ *
+ * The table is an array indexed by the hash of the key; collisions
+ * are resolved by hanging a linked list of hash entries off each
+ * element of the array. Although this is a really simple design it
+ * isn't too bad given that pools have a low allocation overhead.
+ */
+
+typedef struct _HashEntry
+{
+ struct _HashEntry* next;
+ unsigned int hash;
+ const void* key;
+ void* val;
+}
+HashEntry;
+
+/*
+ * The size of the array is always a power of two. We use the maximum
+ * index rather than the size so that we can use bitwise-AND for
+ * modular arithmetic.
+ * The count of hash entries may be greater depending on the chosen
+ * collision rate.
+ */
+struct _P11cHash
+{
+ HashEntry** array;
+ P11cHashFunc hash_func;
+ P11cHashEqual equal_func;
+ size_t count;
+ size_t max;
+};
+
+
+#define INITIAL_MAX 15 /* tunable == 2^n - 1 */
+
+static int
+equal_default(const void* a, const void* b)
+{
+ return a == b;
+}
+
+/*
+ * Hash creation functions.
+ */
+
+static HashEntry**
+alloc_array(P11cHash* ht, size_t max)
+{
+ return calloc(1, sizeof(*(ht->array)) * (max + 1));
+}
+
+P11cHash*
+p11c_hash_new(P11cHashFunc hash_func, P11cHashEqual equal_func)
+{
+ P11cHash* ht = malloc(sizeof(P11cHash));
+ if(ht)
+ {
+ ht->hash_func = hash_func ? hash_func : p11c_hash_pointer;
+ ht->equal_func = equal_func ? equal_func : equal_default;
+ ht->count = 0;
+ ht->max = INITIAL_MAX;
+ ht->array = alloc_array(ht, ht->max);
+ if(!ht->array)
+ {
+ free(ht);
+ ht = NULL;
+ }
+ }
+ return ht;
+}
+
+void
+p11c_hash_free(P11cHash* ht, P11cHashDestroy destroy_func)
+{
+ HashEntry* he;
+ HashEntry* next;
+ size_t i;
+
+ for(i = 0; i <= ht->max; ++i)
+ {
+ for(he = ht->array[i]; he; )
+ {
+ next = he->next;
+ if(destroy_func)
+ (destroy_func)((void*)he->val);
+ free(he);
+ he = next;
+ }
+ }
+
+ if(ht->array)
+ free(ht->array);
+ free(ht);
+}
+
+/*
+ * Expanding a hash table
+ */
+static int
+expand_array(P11cHash* ht)
+{
+ HashEntry** new_array;
+ size_t new_max;
+ HashEntry* he;
+ HashEntry* next;
+ size_t i;
+
+ new_max = ht->max * 2 + 1;
+ new_array = alloc_array(ht, new_max);
+
+ if(!new_array)
+ return 0;
+
+ for(i = 0; i <= ht->max; ++i)
+ {
+ for(he = ht->array[i], next = he ? he->next : NULL;
+ he != NULL; he = next, next = next ? next->next : NULL)
+ {
+ unsigned int j = he->hash & new_max;
+ he->next = new_array[j];
+ new_array[j] = he;
+ }
+ }
+
+ if(ht->array)
+ free(ht->array);
+
+ ht->array = new_array;
+ ht->max = new_max;
+ return 1;
+}
+
+/*
+ * This is where we keep the details of the hash function and control
+ * the maximum collision rate.
+ *
+ * If val is non-NULL it creates and initializes a new hash entry if
+ * there isn't already one there; it returns an updatable pointer so
+ * that hash entries can be removed.
+ */
+
+static HashEntry**
+find_entry(P11cHash* ht, const void* key, void* val)
+{
+ HashEntry** hep;
+ HashEntry* he;
+ unsigned int hash;
+
+ hash = (ht->hash_func)(key);
+
+ /* scan linked list */
+ for(hep = &ht->array[hash & ht->max], he = *hep;
+ he; hep = &he->next, he = *hep)
+ {
+ if(he->hash == hash && (ht->equal_func)(he->key, key))
+ break;
+ }
+
+ if(he || !val)
+ return hep;
+
+ /* add a new entry for non-NULL val */
+ he = malloc(sizeof(*he));
+ if(he)
+ {
+ /* Key points to external data */
+ he->key = key;
+ he->next = NULL;
+ he->hash = hash;
+ he->val = val;
+
+ *hep = he;
+ ht->count++;
+ }
+
+ return hep;
+}
+
+void*
+p11c_hash_get(P11cHash* ht, const void *key)
+{
+ HashEntry** he = find_entry(ht, key, NULL);
+ if(he && *he)
+ return (void*)((*he)->val);
+ else
+ return NULL;
+}
+
+int
+p11c_hash_set(P11cHash* ht, const void* key, void* val)
+{
+ HashEntry** hep = find_entry(ht, key, val);
+ if(hep && *hep)
+ {
+ /* replace entry */
+ (*hep)->key = key;
+ (*hep)->val = val;
+
+ /* check that the collision rate isn't too high */
+ if(ht->count > ht->max)
+ {
+ if(!expand_array(ht))
+ return 0;
+ }
+
+ return 1;
+ }
+
+ return 0;
+}
+
+void*
+p11c_hash_rem(P11cHash* ht, const void* key)
+{
+ HashEntry** hep = find_entry(ht, key, NULL);
+ void* val = NULL;
+
+ if(hep && *hep)
+ {
+ HashEntry* old = *hep;
+ *hep = (*hep)->next;
+ --ht->count;
+ val = (void*)old->val;
+ free(old);
+ }
+
+ return val;
+}
+
+size_t
+p11c_hash_count(P11cHash* ht)
+{
+ return ht->count;
+}
+
+unsigned int
+p11c_hash_pointer(const void* ptr)
+{
+ return (unsigned int)ptr;
+}
+
+unsigned int
+p11c_hash_data(const void* data, size_t n_data)
+{
+ unsigned int hash = 0;
+ const unsigned char* end;
+ const unsigned char* p;
+
+ /*
+ * This is the popular `times 33' hash algorithm which is used by
+ * perl and also appears in Berkeley DB. This is one of the best
+ * known hash functions for strings because it is both computed
+ * very fast and distributes very well.
+ *
+ * The originator may be Dan Bernstein but the code in Berkeley DB
+ * cites Chris Torek as the source. The best citation I have found
+ * is "Chris Torek, Hash function for text in C, Usenet message
+ * <27038@mimsy.umd.edu> in comp.lang.c , October, 1990." in Rich
+ * Salz's USENIX 1992 paper about INN which can be found at
+ * <http://citeseer.nj.nec.com/salz92internetnews.html>.
+ *
+ * The magic of number 33, i.e. why it works better than many other
+ * constants, prime or not, has never been adequately explained by
+ * anyone. So I try an explanation: if one experimentally tests all
+ * multipliers between 1 and 256 (as I did while writing a low-level
+ * data structure library some time ago) one detects that even
+ * numbers are not useable at all. The remaining 128 odd numbers
+ * (except for the number 1) work more or less all equally well.
+ * They all distribute in an acceptable way and this way fill a hash
+ * table with an average percent of approx. 86%.
+ *
+ * If one compares the chi^2 values of the variants (see
+ * Bob Jenkins ``Hashing Frequently Asked Questions'' at
+ * http://burtleburtle.net/bob/hash/hashfaq.html for a description
+ * of chi^2), the number 33 not even has the best value. But the
+ * number 33 and a few other equally good numbers like 17, 31, 63,
+ * 127 and 129 have nevertheless a great advantage to the remaining
+ * numbers in the large set of possible multipliers: their multiply
+ * operation can be replaced by a faster operation based on just one
+ * shift plus either a single addition or subtraction operation. And
+ * because a hash function has to both distribute good _and_ has to
+ * be very fast to compute, those few numbers should be preferred.
+ *
+ * -- Ralf S. Engelschall <rse@engelschall.com>
+ */
+
+ for(p = data, end = p + n_data; p != end; ++p)
+ hash = hash * 33 + *p;
+
+ return hash;
+}
+
+unsigned int
+p11c_hash_integer(int integer)
+{
+ return integer;
+}
diff --git a/module/p11-capi-util.h b/module/p11-capi-util.h
new file mode 100644
index 0000000..ed3507d
--- /dev/null
+++ b/module/p11-capi-util.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef __P11C_UTIL_H__
+#define __P11C_UTIL_H__
+
+#include <stdlib.h>
+
+
+void p11c_reverse_memory (void* data, size_t length);
+
+/* --------------------------------------------------------------------------------
+ * ARRAYS
+ */
+
+typedef struct _Array
+{
+ void* data;
+ size_t len;
+}
+P11cArray;
+
+#define p11c_array_append(a,v) p11c_array_append_vals(a, &(v), 1)
+#define p11c_array_index(a,t,i) (((t*) (a)->data) [(i)])
+
+P11cArray* p11c_array_new (int zero_terminated, int zero,
+ size_t element_size);
+
+P11cArray* p11c_array_sized_new (int zero_terminated, int zero,
+ size_t element_size, size_t reserved_size);
+
+void* p11c_array_free (P11cArray* array, int free_segment);
+
+int p11c_array_append_vals (P11cArray* array, const void* data,
+ size_t num);
+
+void p11c_array_remove_index (P11cArray* array, unsigned int index);
+
+void p11c_array_remove_range (P11cArray* array, unsigned int index,
+ size_t count);
+
+
+/* --------------------------------------------------------------------------------
+ * HASHTABLE
+ */
+
+struct _P11cHash;
+typedef struct _P11cHash P11cHash;
+
+typedef unsigned int (*P11cHashFunc)(const void* key);
+
+typedef int (*P11cHashEqual)(const void* a, const void* b);
+
+typedef void (*P11cHashDestroy)(void* val);
+
+P11cHash* p11c_hash_new (P11cHashFunc hash_func, P11cHashEqual equal_func);
+
+void p11c_hash_free (P11cHash* ht, P11cHashDestroy destroy_func);
+
+size_t p11c_hash_count (P11cHash* ht);
+
+void* p11c_hash_get (P11cHash* ht, const void* key);
+
+int p11c_hash_set (P11cHash* ht, const void* key, void* val);
+
+void* p11c_hash_rem (P11cHash* ht, const void* key);
+
+unsigned int p11c_hash_pointer (const void* ptr);
+
+unsigned int p11c_hash_data (const void* data, size_t n_data);
+
+unsigned int p11c_hash_integer (int integer);
+
+#define p11c_hash_key(num) (((char*)NULL) + (size_t)(num))
+
+#endif /* __P11C_UTIL_H__ */
diff --git a/module/p11-capi.c b/module/p11-capi.c
new file mode 100644
index 0000000..b5f7f62
--- /dev/null
+++ b/module/p11-capi.c
@@ -0,0 +1,1515 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include <string.h>
+#include <stdarg.h>
+#include <stdio.h>
+
+#include "p11-capi.h"
+#include "p11-capi-object.h"
+#include "p11-capi-session.h"
+#include "p11-capi-rsa.h"
+#include "p11-capi-token.h"
+
+/* Warns about all the raw string usage in this file */
+#pragma warning (disable : 4996)
+
+/* -------------------------------------------------------------------
+ * GLOBALS / DEFINES
+ */
+
+static int cryptoki_initialized = 0;
+static HANDLE global_mutex = NULL;
+
+#define MANUFACTURER_ID "Cryptoki CAPI "
+#define LIBRARY_DESCRIPTION "Cryptoki CAPI Provider "
+#define LIBRARY_VERSION_MAJOR 1
+#define LIBRARY_VERSION_MINOR 1
+#define HARDWARE_VERSION_MAJOR 0
+#define HARDWARE_VERSION_MINOR 0
+#define FIRMWARE_VERSION_MAJOR 0
+#define FIRMWARE_VERSION_MINOR 0
+#define SLOT_TOKEN_SERIAL "1.0 "
+#define SLOT_TOKEN_MODEL "1.0 "
+#define MAX_PIN_LEN 256
+#define MIN_PIN_LEN 1
+
+static CK_MECHANISM_TYPE all_mechanisms[] = {
+ CKM_RSA_PKCS
+};
+
+/* -------------------------------------------------------------------
+ * MODULE GLOBAL FUNCTIONS
+ */
+
+#define LINE 1024
+
+void
+p11c_debug(const char* msg, ...)
+{
+ char buf[LINE];
+ va_list va;
+ size_t len;
+
+ va_start(va, msg);
+ _vsnprintf(buf, 1024, msg, va);
+ va_end(va);
+
+ buf[LINE - 1] = 0;
+ len = strlen (buf);
+
+ strncpy(buf + len, "\n", 1024 - len);
+ buf[LINE - 1] = 0;
+ // OutputDebugStringA(buf);
+}
+
+/* Bah humbug, MSVC doesn't have __func__ */
+#define ENTER(func) \
+ char* _func = #func; \
+ p11c_debug("%s: enter", _func)
+
+#define RETURN(ret) \
+ return (p11c_debug("%s: %d", _func, ret), ret)
+
+#define PREREQ(cond, ret) \
+ if (!(cond)) { p11c_debug("%s: %s failed: %d", _func, #cond, ret); return ret; }
+
+void
+p11c_lock_global(void)
+{
+ DWORD r;
+
+ ASSERT(global_mutex);
+
+ r = WaitForSingleObject(global_mutex, INFINITE);
+ ASSERT(r == WAIT_OBJECT_0);
+}
+
+void
+p11c_unlock_global(void)
+{
+ BOOL r;
+
+ ASSERT(global_mutex);
+
+ r = ReleaseMutex(global_mutex);
+ ASSERT(r);
+}
+
+CK_RV
+p11c_winerr_to_ckr(DWORD werr)
+{
+ switch(werr)
+ {
+ case ERROR_NOT_ENOUGH_MEMORY:
+ case ERROR_OUTOFMEMORY:
+ return CKR_HOST_MEMORY;
+ break;
+ case NTE_NO_MEMORY:
+ return CKR_DEVICE_MEMORY;
+ break;
+ case ERROR_MORE_DATA:
+ return CKR_BUFFER_TOO_SMALL;
+ case ERROR_INVALID_PARAMETER: /* these params were derived from the */
+ case ERROR_INVALID_HANDLE: /* inputs, so if they are bad, the input */
+ case NTE_BAD_ALGID: /* data is bad */
+ case NTE_BAD_HASH:
+ case NTE_BAD_TYPE:
+ case NTE_BAD_PUBLIC_KEY:
+ return CKR_DATA_INVALID;
+ case ERROR_BUSY:
+ case NTE_FAIL:
+ case NTE_BAD_UID:
+ return CKR_DEVICE_ERROR;
+ default:
+ return CKR_GENERAL_ERROR;
+ };
+}
+
+CK_RV
+p11c_return_data_raw(CK_VOID_PTR output, CK_ULONG_PTR n_output,
+ CK_VOID_PTR input, CK_ULONG n_input)
+{
+ ASSERT(n_output);
+ ASSERT(input);
+
+ /* Just asking for the length */
+ if(!output)
+ {
+ *n_output = n_input;
+ return CKR_OK;
+ }
+
+ /* Buffer is too short */
+ if(n_input > *n_output)
+ {
+ *n_output = n_input;
+ return CKR_BUFFER_TOO_SMALL;
+ }
+
+ *n_output = n_input;
+ memcpy(output, input, n_input);
+ return CKR_OK;
+}
+
+CK_RV
+p11c_return_data(CK_ATTRIBUTE_PTR attr, CK_VOID_PTR input, DWORD n_input)
+{
+ return p11c_return_data_raw(attr->pValue, &(attr->ulValueLen),
+ input, n_input);
+}
+
+CK_RV
+p11c_return_string(CK_ATTRIBUTE_PTR attr, WCHAR* string)
+{
+ CK_UTF8CHAR_PTR buffer;
+ int result;
+
+ SetLastError(0);
+
+ /*
+ * Sadly WideCharToMultiByte doesn't handle zero
+ * length strings properly. So we have to special
+ * case this part.
+ */
+ if(!string[0])
+ return p11c_return_data(attr, "", 0);
+
+ /* The length of the string, including null termination */
+ result = WideCharToMultiByte(CP_UTF8, 0, string, -1,
+ NULL, 0, NULL, NULL);
+
+ if(result)
+ {
+ /* Did the caller just want the length? */
+ if(!attr->pValue)
+ {
+ attr->ulValueLen = result - 1;
+ return CKR_OK;
+ }
+
+ /* Is the callers buffer too short? */
+ if((int)attr->ulValueLen < result - 1)
+ {
+ attr->ulValueLen = result - 1;
+ return CKR_BUFFER_TOO_SMALL;
+ }
+
+ /*
+ * Allocate a buffer for the conversion. We have to
+ * do this because strings in PKCS#11 are not null
+ * terminated and strings returned from
+ * WideCharToMultiByte are always null terminated.
+ */
+ buffer = malloc(result);
+ if(!buffer)
+ return CKR_HOST_MEMORY;
+
+ /* Do the actual conversion */
+ result = WideCharToMultiByte(CP_UTF8, 0, string, -1,
+ buffer, result, NULL, NULL);
+
+ if(result)
+ {
+ attr->ulValueLen = result - 1;
+ memcpy(attr->pValue, buffer, attr->ulValueLen);
+
+ free(buffer);
+ return CKR_OK;
+ }
+
+ free(buffer);
+ }
+
+ /*
+ * We should never have too little buffer, or
+ * get a zero length success code. It's a very
+ * strange error that arrives here.
+ */
+ return CKR_GENERAL_ERROR;
+}
+
+CK_RV
+p11c_return_dword_as_bytes(CK_ATTRIBUTE_PTR attr, DWORD value)
+{
+ int i;
+ CK_ULONG count = 0;
+ BOOL first = TRUE;
+ BYTE* at = attr->pValue;
+ CK_RV ret = CKR_OK;
+
+ for(i = 0; i < sizeof(DWORD); i++)
+ {
+ BYTE digit = (BYTE)((value >> (((sizeof(DWORD)-1)*8))) & 0xFF);
+ value = value << 8;
+
+ /* No leading zero */
+ if (first && digit == 0)
+ continue;
+
+ first = FALSE;
+ if(at)
+ {
+ if(count > attr->ulValueLen)
+ ret = CKR_BUFFER_TOO_SMALL;
+ else
+ *(at++) = digit;
+ }
+
+ count++;
+ }
+
+ attr->ulValueLen = count;
+ return ret;
+}
+
+CK_RV
+p11c_return_reversed_data(CK_ATTRIBUTE_PTR attr, CK_VOID_PTR data, CK_ULONG length)
+{
+ CK_RV ret = p11c_return_data(attr, data, length);
+ if(ret != CKR_OK || !attr->pValue)
+ return ret;
+
+ p11c_reverse_memory(attr->pValue, attr->ulValueLen);
+ return CKR_OK;
+}
+
+static void
+print_zero_decimal(CK_BYTE_PTR buffer, CK_ULONG length, WORD value)
+{
+ int i;
+ for(i = (int)length - 1; i >= 0; --i)
+ {
+ BYTE digit = value % 10;
+ buffer[i] = '0' + digit;
+ value /= 10;
+ }
+}
+
+CK_RV
+p11c_return_filetime(CK_ATTRIBUTE_PTR attr, FILETIME *ftime)
+{
+ SYSTEMTIME stime;
+ CK_DATE* date;
+
+ ASSERT(attr);
+ ASSERT(ftime);
+
+ if(!attr->pValue)
+ {
+ attr->ulValueLen = sizeof(CK_DATE);
+ return CKR_OK;
+ }
+
+ if(attr->ulValueLen < sizeof(CK_DATE))
+ {
+ attr->ulValueLen = sizeof(CK_DATE);
+ return CKR_BUFFER_TOO_SMALL;
+ }
+
+ if(!FileTimeToSystemTime(ftime, &stime))
+ {
+ DBG(("An invalid FILETIME was encountered"));
+ return CKR_GENERAL_ERROR;
+ }
+
+ date = (CK_DATE*)attr->pValue;
+ attr->ulValueLen = sizeof(CK_DATE);
+ print_zero_decimal(date->year, sizeof(date->year), stime.wYear);
+ print_zero_decimal(date->month, sizeof(date->month), stime.wMonth);
+ print_zero_decimal(date->day, sizeof(date->day), stime.wDay);
+
+ return CKR_OK;
+}
+
+/* ---------------------------------------------------------------- */
+
+static CK_RV
+PC_C_Initialize(CK_VOID_PTR init_args)
+{
+ ENTER(C_Initialize);
+ PREREQ(!cryptoki_initialized, CKR_CRYPTOKI_ALREADY_INITIALIZED);
+
+ if (init_args != NULL) {
+ CK_C_INITIALIZE_ARGS_PTR args;
+ int supplied_ok;
+
+ /* pReserved must be NULL */
+ args = init_args;
+ PREREQ(!args->pReserved, CKR_ARGUMENTS_BAD);
+
+ /* ALL supplied function pointers need to have the value either NULL or non-NULL. */
+ supplied_ok = (args->CreateMutex == NULL && args->DestroyMutex == NULL &&
+ args->LockMutex == NULL && args->UnlockMutex == NULL) ||
+ (args->CreateMutex != NULL && args->DestroyMutex != NULL &&
+ args->LockMutex != NULL && args->UnlockMutex != NULL);
+ PREREQ(supplied_ok, CKR_ARGUMENTS_BAD);
+
+ /*
+ * When the CKF_OS_LOCKING_OK flag isn't set and mutex function pointers are supplied
+ * by an application, return an error. We must be able to use our own locks.
+ */
+ if(!(args->flags & CKF_OS_LOCKING_OK) && (args->CreateMutex != NULL))
+ RETURN(CKR_CANT_LOCK);
+ }
+
+ if(!global_mutex)
+ {
+ global_mutex = CreateMutex(NULL, FALSE, NULL);
+ if(!global_mutex)
+ RETURN(CKR_CANT_LOCK);
+ }
+
+ cryptoki_initialized = 1;
+
+ RETURN(CKR_OK);
+}
+
+static CK_RV
+PC_C_Finalize(CK_VOID_PTR pReserved)
+{
+ ENTER(C_Finalize);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(!pReserved, CKR_ARGUMENTS_BAD);
+
+ cryptoki_initialized = 0;
+
+ p11c_session_cleanup_all();
+ p11c_token_cleanup_all();
+
+ RETURN(CKR_OK);
+}
+
+static CK_RV
+PC_C_GetInfo(CK_INFO_PTR info)
+{
+ ENTER(C_GetInfo);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(info, CKR_ARGUMENTS_BAD);
+
+ ASSERT(strlen(MANUFACTURER_ID) == 32);
+ ASSERT(strlen(LIBRARY_DESCRIPTION) == 32);
+
+ info->cryptokiVersion.major = CRYPTOKI_VERSION_MAJOR;
+ info->cryptokiVersion.minor = CRYPTOKI_VERSION_MINOR;
+ info->libraryVersion.major = LIBRARY_VERSION_MAJOR;
+ info->libraryVersion.minor = LIBRARY_VERSION_MINOR;
+ info->flags = 0;
+ strncpy((char*)info->manufacturerID, MANUFACTURER_ID, 32);
+ strncpy((char*)info->libraryDescription, LIBRARY_DESCRIPTION, 32);
+
+ RETURN(CKR_OK);
+}
+
+static CK_RV
+PC_C_GetFunctionList(CK_FUNCTION_LIST_PTR_PTR list)
+{
+ /* This would be a strange call to receive */
+ return C_GetFunctionList(list);
+}
+
+static CK_RV
+PC_C_GetSlotList(CK_BBOOL tokenPresent, CK_SLOT_ID_PTR slot_list, CK_ULONG_PTR count)
+{
+ unsigned int n_tokens, i;
+
+ ENTER(C_GetSlotList);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(count, CKR_ARGUMENTS_BAD);
+
+ /* All tokens are always present */
+
+ n_tokens = p11c_token_get_count();
+
+ /* Application only wants to know the number of slots. */
+ if(slot_list == NULL)
+ {
+ *count = n_tokens;
+ RETURN(CKR_OK);
+ }
+
+ if(*count < n_tokens)
+ {
+ *count = n_tokens;
+ RETURN(CKR_BUFFER_TOO_SMALL);
+ }
+
+ *count = n_tokens;
+ for(i = 0; i < n_tokens; ++i)
+ slot_list[i] = p11c_token_get_slot_id (i);
+ RETURN(CKR_OK);
+}
+
+static CK_RV
+PC_C_GetSlotInfo(CK_SLOT_ID id, CK_SLOT_INFO_PTR info)
+{
+ const char* name;
+
+ ENTER(C_GetSlotInfo);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(info, CKR_ARGUMENTS_BAD);
+
+ /* Make sure the slot ID is valid */
+ if(!p11c_token_is_valid(id))
+ RETURN(CKR_SLOT_ID_INVALID);
+
+ ASSERT(strlen(MANUFACTURER_ID) == 32);
+
+ /* Provide information about the slot in the provided buffer */
+ strncpy((char*)info->manufacturerID, MANUFACTURER_ID, 32);
+ info->hardwareVersion.major = HARDWARE_VERSION_MAJOR;
+ info->hardwareVersion.minor = HARDWARE_VERSION_MINOR;
+ info->firmwareVersion.major = FIRMWARE_VERSION_MAJOR;
+ info->firmwareVersion.minor = FIRMWARE_VERSION_MINOR;
+
+ /* Token is always present */
+ info->flags = CKF_TOKEN_PRESENT;
+
+ /* Slot name is blank padded, odd */
+ name = p11c_token_get_display_name(id);
+ memset((char*)info->slotDescription, ' ',
+ sizeof(info->slotDescription));
+ memcpy((char*)info->slotDescription, name,
+ min(strlen(name), sizeof(info->slotDescription)));
+
+ RETURN(CKR_OK);
+}
+
+static CK_RV
+PC_C_GetTokenInfo(CK_SLOT_ID id, CK_TOKEN_INFO_PTR info)
+{
+ const char* name;
+
+ ENTER(C_GetTokenInfo);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(info, CKR_ARGUMENTS_BAD);
+
+ /* Make sure the slot ID is valid */
+ if(!p11c_token_is_valid(id))
+ RETURN(CKR_SLOT_ID_INVALID);
+
+ ASSERT(strlen(MANUFACTURER_ID) == 32);
+ ASSERT(strlen(SLOT_TOKEN_MODEL) == 16);
+ ASSERT(strlen(SLOT_TOKEN_SERIAL) == 16);
+
+ /* Provide information about a token in the provided buffer */
+ strncpy((char*)info->manufacturerID, MANUFACTURER_ID, 32);
+ strncpy((char*)info->model, SLOT_TOKEN_MODEL, 16);
+ strncpy((char*)info->serialNumber, SLOT_TOKEN_SERIAL, 16);
+
+ /* Protected authentication path: Windows prompts for it's own PINs */
+ info->flags = CKF_TOKEN_INITIALIZED | CKF_PROTECTED_AUTHENTICATION_PATH;
+ info->ulMaxSessionCount = CK_EFFECTIVELY_INFINITE;
+ info->ulSessionCount = CK_EFFECTIVELY_INFINITE;
+ info->ulMaxRwSessionCount = CK_EFFECTIVELY_INFINITE;
+ info->ulRwSessionCount = CK_EFFECTIVELY_INFINITE;
+ info->ulMaxPinLen = MAX_PIN_LEN;
+ info->ulMinPinLen = MIN_PIN_LEN;
+ info->ulTotalPublicMemory = CK_UNAVAILABLE_INFORMATION;
+ info->ulFreePublicMemory = CK_UNAVAILABLE_INFORMATION;
+ info->ulTotalPrivateMemory = CK_UNAVAILABLE_INFORMATION;
+ info->ulFreePrivateMemory = CK_UNAVAILABLE_INFORMATION;
+ info->hardwareVersion.major = HARDWARE_VERSION_MAJOR;
+ info->hardwareVersion.minor = HARDWARE_VERSION_MINOR;
+ info->firmwareVersion.major = FIRMWARE_VERSION_MAJOR;
+ info->firmwareVersion.minor = FIRMWARE_VERSION_MINOR;
+ memset(info->utcTime, ' ', 16);
+
+ /* Slot name is blank padded, odd */
+ name = p11c_token_get_display_name(id);
+ memset((char*)info->label, ' ', sizeof(info->label));
+ memcpy((char*)info->label, name,
+ min(strlen(name), sizeof(info->label)));
+
+ RETURN(CKR_OK);
+}
+
+static CK_RV
+PC_C_GetMechanismList(CK_SLOT_ID id, CK_MECHANISM_TYPE_PTR mechanism_list,
+ CK_ULONG_PTR count)
+{
+ CK_ULONG n_mechs;
+
+ ENTER(C_GetMechanismList);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(count, CKR_ARGUMENTS_BAD);
+
+ if(!p11c_token_is_valid(id))
+ RETURN(CKR_SLOT_ID_INVALID);
+
+ n_mechs = sizeof(all_mechanisms) / sizeof(all_mechanisms[0]);
+
+ if(mechanism_list == NULL)
+ {
+ *count = n_mechs;
+ RETURN(CKR_OK);
+ }
+
+ if(*count < n_mechs)
+ {
+ *count = n_mechs;
+ RETURN(CKR_BUFFER_TOO_SMALL);
+ }
+
+ memcpy(mechanism_list, all_mechanisms,
+ n_mechs * sizeof(CK_MECHANISM_TYPE));
+ *count = n_mechs;
+ RETURN(CKR_OK);
+}
+
+static CK_RV
+PC_C_GetMechanismInfo(CK_SLOT_ID id, CK_MECHANISM_TYPE type,
+ CK_MECHANISM_INFO_PTR info)
+{
+ ENTER(C_GetMechanismInfo);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(info, CKR_ARGUMENTS_BAD);
+
+ if(!p11c_token_is_valid(id))
+ RETURN(CKR_SLOT_ID_INVALID);
+
+ if(type == CKM_RSA_PKCS)
+ {
+ p11c_rsa_pkcs_get_info(type, info);
+ RETURN(CKR_OK);
+ }
+
+ RETURN(CKR_MECHANISM_INVALID);
+}
+
+static CK_RV
+PC_C_InitToken(CK_SLOT_ID slot_id, CK_UTF8CHAR_PTR pin, CK_ULONG pin_len,
+ CK_UTF8CHAR_PTR label)
+{
+ ENTER(C_InitToken);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_WaitForSlotEvent(CK_FLAGS flags, CK_SLOT_ID_PTR pSlot, CK_VOID_PTR pReserved)
+{
+ ENTER(C_WaitForSlotEvent);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /*
+ * PKCS#11 GRAY AREA: What happens when we know we'll *never*
+ * have any slot events, and someone calls us without CKR_DONT_BLOCK?
+ * In case there's a thread dedicated to calling this function in a
+ * loop, we wait 1 seconds when called without CKR_DONT_BLOCK.
+ */
+
+ if(!(flags & CKF_DONT_BLOCK))
+ Sleep(1000);
+
+ RETURN(CKR_NO_EVENT);
+}
+
+static CK_RV
+PC_C_OpenSession(CK_SLOT_ID id, CK_FLAGS flags, CK_VOID_PTR application,
+ CK_NOTIFY notify, CK_SESSION_HANDLE_PTR session)
+{
+ P11cSession* sess;
+ CK_RV ret;
+
+ ENTER(C_OpenSession);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(session, CKR_ARGUMENTS_BAD);
+ PREREQ(flags & CKF_SERIAL_SESSION, CKR_SESSION_PARALLEL_NOT_SUPPORTED);
+
+ if(!p11c_token_is_valid(id))
+ RETURN(CKR_SLOT_ID_INVALID);
+
+ ret = p11c_session_create(id, &sess);
+ if(ret != CKR_OK)
+ RETURN(ret);
+
+ sess->notify_callback = notify;
+ sess->user_data = application;
+
+ if(flags & CKF_RW_SESSION)
+ sess->read_write = TRUE;
+
+ ret = p11c_session_register(sess);
+ if(ret == CKR_OK)
+ {
+ /* ID should have been assigned when registering */
+ ASSERT(sess->id > 0);
+ *session = sess->id;
+ }
+ else
+ {
+ p11c_session_destroy(sess);
+ }
+
+ RETURN(ret);
+}
+
+static CK_RV
+PC_C_CloseSession(CK_SESSION_HANDLE session)
+{
+ P11cSession* sess;
+ CK_RV ret;
+
+ ENTER(C_CloseSession);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ ret = p11c_session_remove_lock_ref(session, &sess);
+ if(ret == CKR_OK)
+ {
+ /* This will unref and possibly destroy the session */
+ p11c_session_unref_unlock(sess);
+ }
+
+ RETURN(ret);
+}
+
+static CK_RV
+PC_C_CloseAllSessions(CK_SLOT_ID id)
+{
+ ENTER(C_CloseAllSession);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ if(!p11c_token_is_valid(id))
+ RETURN(CKR_SLOT_ID_INVALID);
+
+ p11c_session_close_all(id);
+ RETURN(CKR_OK);
+}
+
+static CK_RV
+PC_C_GetFunctionStatus(CK_SESSION_HANDLE session)
+{
+ ENTER(C_GetFunctionStatus);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ RETURN(CKR_FUNCTION_NOT_PARALLEL);
+}
+
+static CK_RV
+PC_C_CancelFunction(CK_SESSION_HANDLE session)
+{
+ ENTER(C_CancelFunction);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ RETURN(CKR_FUNCTION_NOT_PARALLEL);
+}
+
+static CK_RV
+PC_C_GetSessionInfo(CK_SESSION_HANDLE session, CK_SESSION_INFO_PTR info)
+{
+ P11cSession* sess;
+ CK_RV ret;
+
+ ENTER(C_GetSessionInfo);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(info, CKR_ARGUMENTS_BAD);
+
+ ret = p11c_session_get_lock_ref(session, FALSE, &sess);
+ if(ret == CKR_OK)
+ {
+ p11c_session_get_info(sess, info);
+ p11c_session_unref_unlock(sess);
+ }
+
+ RETURN(ret);
+}
+
+static CK_RV
+PC_C_InitPIN(CK_SESSION_HANDLE session, CK_UTF8CHAR_PTR pin,
+ CK_ULONG pin_len)
+{
+ ENTER(C_InitPIN);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* We don't support this stuff. We don't support 'SO' logins. */
+ RETURN(CKR_USER_NOT_LOGGED_IN);
+}
+
+static CK_RV
+PC_C_SetPIN(CK_SESSION_HANDLE session, CK_UTF8CHAR_PTR old_pin,
+ CK_ULONG old_len, CK_UTF8CHAR_PTR new_pin, CK_ULONG new_len)
+{
+ ENTER(C_SetPIN);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* Not supported, Windows takes care of this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_GetOperationState(CK_SESSION_HANDLE session, CK_BYTE_PTR operation_state,
+ CK_ULONG_PTR operation_state_len)
+{
+ ENTER(C_GetOperationState);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* Nasty, no sirrr */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_SetOperationState(CK_SESSION_HANDLE session, CK_BYTE_PTR operation_state,
+ CK_ULONG operation_state_len, CK_OBJECT_HANDLE encryption_key,
+ CK_OBJECT_HANDLE authentication_key)
+{
+ ENTER(C_SetOperationState);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* Nasty, no sirrr */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_Login(CK_SESSION_HANDLE session, CK_USER_TYPE user_type,
+ CK_UTF8CHAR_PTR pin, CK_ULONG pin_len)
+{
+ P11cSession* sess;
+ CK_RV ret;
+
+ ENTER(C_Login);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ ret = p11c_session_get_lock_ref(session, FALSE, &sess);
+ if(ret == CKR_OK)
+ {
+ switch(user_type)
+ {
+ case CKU_USER:
+ ret = p11c_token_login(sess->slot);
+ break;
+ case CKU_SO:
+ ret = CKR_USER_TYPE_INVALID;
+ break;
+ default:
+ ret = CKR_USER_TYPE_INVALID;
+ break;
+ }
+
+ p11c_session_unref_unlock(sess);
+ }
+
+ RETURN(ret);
+}
+
+static CK_RV
+PC_C_Logout(CK_SESSION_HANDLE session)
+{
+ P11cSession* sess;
+ CK_RV ret;
+
+ ENTER(C_Logout);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ ret = p11c_session_get_lock_ref(session, FALSE, &sess);
+ if(ret == CKR_OK)
+ {
+ ret = p11c_token_logout(sess->slot);
+ p11c_session_unref_unlock(sess);
+ }
+
+ RETURN(ret);
+}
+
+static CK_RV
+PC_C_CreateObject(CK_SESSION_HANDLE session, CK_ATTRIBUTE_PTR templ,
+ CK_ULONG count, CK_OBJECT_HANDLE_PTR object)
+{
+ ENTER(C_CreateObject);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: See if we need to support this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_CopyObject(CK_SESSION_HANDLE session, CK_OBJECT_HANDLE object,
+ CK_ATTRIBUTE_PTR templ, CK_ULONG count,
+ CK_OBJECT_HANDLE_PTR new_object)
+{
+ ENTER(C_CopyObject);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: See if we need to support this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+
+static CK_RV
+PC_C_DestroyObject(CK_SESSION_HANDLE session, CK_OBJECT_HANDLE object)
+{
+ ENTER(C_DestroyObject);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: See if we need to support this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_GetObjectSize(CK_SESSION_HANDLE session, CK_OBJECT_HANDLE object,
+ CK_ULONG_PTR size)
+{
+ ENTER(C_GetObjectSize);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: Implement this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_GetAttributeValue(CK_SESSION_HANDLE session, CK_OBJECT_HANDLE object,
+ CK_ATTRIBUTE_PTR templ, CK_ULONG count)
+{
+ P11cSession* sess;
+ P11cObjectData* objdata;
+ CK_RV ret;
+
+ ENTER(C_GetAttributeValue);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(object, CKR_OBJECT_HANDLE_INVALID);
+ PREREQ(!count || templ, CKR_ARGUMENTS_BAD);
+
+ ret = p11c_session_get_lock_ref(session, FALSE, &sess);
+ if(ret == CKR_OK)
+ {
+ ret = p11c_session_get_object_data_for(sess, object, &objdata);
+ if(ret == CKR_OK)
+ ret = p11c_object_data_get_attrs(objdata, templ, count);
+
+ p11c_session_unref_unlock(sess);
+ }
+
+ RETURN(ret);
+}
+
+static CK_RV
+PC_C_SetAttributeValue(CK_SESSION_HANDLE session, CK_OBJECT_HANDLE object,
+ CK_ATTRIBUTE_PTR templ, CK_ULONG count)
+{
+ ENTER(C_SetAttributeValue);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: See if we need to implement this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_FindObjectsInit(CK_SESSION_HANDLE session, CK_ATTRIBUTE_PTR templ,
+ CK_ULONG count)
+{
+ P11cSession* sess;
+ CK_RV ret;
+
+ ENTER(C_FindObjectsInit);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(!count || templ, CKR_ARGUMENTS_BAD);
+
+ ret = p11c_session_get_lock_ref(session, FALSE, &sess);
+ if(ret == CKR_OK)
+ {
+ ret = p11c_session_find_init(sess, templ, count);
+ p11c_session_unref_unlock(sess);
+ }
+
+ RETURN(ret);
+}
+
+static CK_RV
+PC_C_FindObjects(CK_SESSION_HANDLE session, CK_OBJECT_HANDLE_PTR objects,
+ CK_ULONG max_object_count, CK_ULONG_PTR object_count)
+{
+ P11cSession* sess;
+ CK_RV ret;
+
+ ENTER(C_FindObjects);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(object_count, CKR_ARGUMENTS_BAD);
+ PREREQ(!max_object_count || objects, CKR_ARGUMENTS_BAD);
+
+ ret = p11c_session_get_lock_ref(session, FALSE, &sess);
+ if(ret == CKR_OK)
+ {
+ ret = p11c_session_find(sess, objects, max_object_count, object_count);
+ p11c_session_unref_unlock(sess);
+ }
+
+ RETURN(ret);
+}
+
+static CK_RV
+PC_C_FindObjectsFinal(CK_SESSION_HANDLE session)
+{
+ P11cSession* sess;
+ CK_RV ret;
+
+ ENTER(C_FindObjectsFinal);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ ret = p11c_session_get_lock_ref(session, FALSE, &sess);
+ if(ret == CKR_OK)
+ {
+ ret = p11c_session_find_final(sess);
+ p11c_session_unref_unlock(sess);
+ }
+
+ RETURN(ret);
+}
+
+static CK_RV
+PC_C_EncryptInit(CK_SESSION_HANDLE session, CK_MECHANISM_PTR mechanism,
+ CK_OBJECT_HANDLE key)
+{
+ ENTER(C_EncryptInit);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: See if we need to implement this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_Encrypt(CK_SESSION_HANDLE session, CK_BYTE_PTR data, CK_ULONG data_len,
+ CK_BYTE_PTR encrypted_data, CK_ULONG_PTR encrypted_data_len)
+{
+ ENTER(C_Encrypt);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: See if we need to implement this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_EncryptUpdate(CK_SESSION_HANDLE session, CK_BYTE_PTR part,
+ CK_ULONG part_len, CK_BYTE_PTR encrypted_part,
+ CK_ULONG_PTR encrypted_part_len)
+{
+ ENTER(C_EncryptUpdate);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support incremental crypto operations. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_EncryptFinal(CK_SESSION_HANDLE session, CK_BYTE_PTR last_encrypted_part,
+ CK_ULONG_PTR last_encrypted_part_len)
+{
+ ENTER(C_EncryptFinal);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support incremental crypto operations. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_DecryptInit(CK_SESSION_HANDLE session, CK_MECHANISM_PTR mechanism,
+ CK_OBJECT_HANDLE key)
+{
+ P11cObjectData* objdata;
+ P11cSession* sess;
+ CK_RV ret;
+
+ ENTER(C_DecryptInit);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(mechanism, CKR_ARGUMENTS_BAD);
+ PREREQ(key, CKR_ARGUMENTS_BAD);
+
+ ret = p11c_session_get_lock_ref(session, FALSE, &sess);
+ if(ret == CKR_OK)
+ {
+ ret = p11c_session_get_object_data_for(sess, key, &objdata);
+ if(ret == CKR_OK)
+ ret = p11c_session_decrypt_init(sess, mechanism, objdata);
+
+ p11c_session_unref_unlock(sess);
+ }
+
+ RETURN(ret);
+}
+
+static CK_RV
+PC_C_Decrypt(CK_SESSION_HANDLE session, CK_BYTE_PTR encrypted_data,
+ CK_ULONG encrypted_data_len, CK_BYTE_PTR data, CK_ULONG_PTR data_len)
+{
+ P11cSession* sess;
+ CK_RV ret;
+
+ ENTER(C_Decrypt);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(encrypted_data, CKR_ARGUMENTS_BAD);
+ PREREQ(encrypted_data_len, CKR_ARGUMENTS_BAD);
+
+ ret = p11c_session_get_lock_ref(session, FALSE, &sess);
+ if(ret == CKR_OK)
+ {
+ ret = p11c_session_decrypt(sess, encrypted_data, encrypted_data_len,
+ data, data_len);
+ p11c_session_unref_unlock(sess);
+ }
+
+ RETURN(ret);
+}
+
+static CK_RV
+PC_C_DecryptUpdate(CK_SESSION_HANDLE session, CK_BYTE_PTR encrypted_part,
+ CK_ULONG encrypted_part_len, CK_BYTE_PTR part, CK_ULONG_PTR part_len)
+{
+ ENTER(C_DecryptUpdate);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support incremental crypto operations. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_DecryptFinal(CK_SESSION_HANDLE session, CK_BYTE_PTR pLastPart,
+ CK_ULONG_PTR last_part_len)
+{
+ ENTER(C_DecryptFinal);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support incremental crypto operations. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_DigestInit(CK_SESSION_HANDLE session, CK_MECHANISM_PTR mechanism)
+{
+ ENTER(C_DigestInit);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support digest. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_Digest(CK_SESSION_HANDLE session, CK_BYTE_PTR data, CK_ULONG data_len,
+ CK_BYTE_PTR digest, CK_ULONG_PTR digest_len)
+{
+ ENTER(C_Digest);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support digest. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_DigestUpdate(CK_SESSION_HANDLE session, CK_BYTE_PTR part, CK_ULONG part_len)
+{
+ ENTER(C_DigestUpdate);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support digest. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_DigestKey(CK_SESSION_HANDLE session, CK_OBJECT_HANDLE key)
+{
+ ENTER(C_DigestKey);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support digest. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_DigestFinal(CK_SESSION_HANDLE session, CK_BYTE_PTR digest,
+ CK_ULONG_PTR digest_len)
+{
+ ENTER(C_DigestFinal);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support digest. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_SignInit(CK_SESSION_HANDLE session, CK_MECHANISM_PTR mechanism,
+ CK_OBJECT_HANDLE key)
+{
+ P11cObjectData* objdata;
+ P11cSession* sess;
+ CK_RV ret;
+
+ ENTER(C_SignInit);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(mechanism, CKR_ARGUMENTS_BAD);
+ PREREQ(key, CKR_ARGUMENTS_BAD);
+
+ ret = p11c_session_get_lock_ref(session, FALSE, &sess);
+ if(ret == CKR_OK)
+ {
+ ret = p11c_session_get_object_data_for(sess, key, &objdata);
+ if(ret == CKR_OK)
+ ret = p11c_session_sign_init(sess, mechanism, objdata);
+
+ p11c_session_unref_unlock(sess);
+ }
+
+ RETURN(ret);
+}
+
+static CK_RV
+PC_C_Sign(CK_SESSION_HANDLE session, CK_BYTE_PTR data, CK_ULONG data_len,
+ CK_BYTE_PTR signature, CK_ULONG_PTR signature_len)
+{
+ P11cSession* sess;
+ CK_RV ret;
+
+ ENTER(C_Sign);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+ PREREQ(data, CKR_ARGUMENTS_BAD);
+ PREREQ(data_len, CKR_ARGUMENTS_BAD);
+
+ ret = p11c_session_get_lock_ref(session, FALSE, &sess);
+ if(ret == CKR_OK)
+ {
+ ret = p11c_session_sign(sess, data, data_len, signature, signature_len);
+ p11c_session_unref_unlock(sess);
+ }
+
+ RETURN(ret);
+}
+
+static CK_RV
+PC_C_SignUpdate(CK_SESSION_HANDLE session, CK_BYTE_PTR part, CK_ULONG part_len)
+{
+ ENTER(C_SignUpdate);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support incremental crypto operations. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_SignFinal(CK_SESSION_HANDLE session, CK_BYTE_PTR signature,
+ CK_ULONG_PTR signature_len)
+{
+ ENTER(C_SignFinal);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support incremental crypto operations. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_SignRecoverInit(CK_SESSION_HANDLE session, CK_MECHANISM_PTR mechanism,
+ CK_OBJECT_HANDLE key)
+{
+ ENTER(C_SignRecoverInit);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: Implement this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_SignRecover(CK_SESSION_HANDLE session, CK_BYTE_PTR data, CK_ULONG data_len,
+ CK_BYTE_PTR signature, CK_ULONG_PTR signature_len)
+{
+ ENTER(C_SignRecover);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: Implement this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_VerifyInit(CK_SESSION_HANDLE session, CK_MECHANISM_PTR mechanism,
+ CK_OBJECT_HANDLE key)
+{
+ ENTER(C_VerifyInit);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: See if we need to implement this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_Verify(CK_SESSION_HANDLE session, CK_BYTE_PTR data, CK_ULONG data_len,
+ CK_BYTE_PTR signature, CK_ULONG signature_len)
+{
+ ENTER(C_Verify);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: See if we need to implement this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_VerifyUpdate(CK_SESSION_HANDLE session, CK_BYTE_PTR part, CK_ULONG part_len)
+{
+ ENTER(C_VerifyUpdate);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support incremental crypto operations. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_VerifyFinal(CK_SESSION_HANDLE session, CK_BYTE_PTR signature,
+ CK_ULONG signature_len)
+{
+ ENTER(C_VerifyFinal);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support incremental crypto operations. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_VerifyRecoverInit(CK_SESSION_HANDLE session, CK_MECHANISM_PTR mechanism,
+ CK_OBJECT_HANDLE key)
+{
+ ENTER(C_VerifyRecoverInit);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: See if we need to implement this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_VerifyRecover(CK_SESSION_HANDLE session, CK_BYTE_PTR signature,
+ CK_ULONG signature_len, CK_BYTE_PTR data, CK_ULONG_PTR data_len)
+{
+ ENTER(C_VerifyRecover);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: See if we need to implement this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_DigestEncryptUpdate(CK_SESSION_HANDLE session, CK_BYTE_PTR part,
+ CK_ULONG part_len, CK_BYTE_PTR encrypted_part,
+ CK_ULONG_PTR encrypted_part_len)
+{
+ ENTER(C_DigestEncryptUpdate);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support incremental crypto operations. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_DecryptDigestUpdate(CK_SESSION_HANDLE session, CK_BYTE_PTR encrypted_part,
+ CK_ULONG encrypted_part_len, CK_BYTE_PTR part,
+ CK_ULONG_PTR part_len)
+{
+ ENTER(C_DecryptDigestUpdate);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support incremental crypto operations. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_SignEncryptUpdate(CK_SESSION_HANDLE session, CK_BYTE_PTR part,
+ CK_ULONG part_len, CK_BYTE_PTR encrypted_part,
+ CK_ULONG_PTR encrypted_part_len)
+{
+ ENTER(C_SignEncryptUpdate);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support incremental crypto operations. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_DecryptVerifyUpdate(CK_SESSION_HANDLE session, CK_BYTE_PTR encrypted_part,
+ CK_ULONG encrypted_part_len, CK_BYTE_PTR part,
+ CK_ULONG_PTR part_len)
+{
+ ENTER(C_DecryptVerifyUpdate);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* RSA/DSA mechs don't support incremental crypto operations. */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_GenerateKey(CK_SESSION_HANDLE session, CK_MECHANISM_PTR mechanism,
+ CK_ATTRIBUTE_PTR templ, CK_ULONG count,
+ CK_OBJECT_HANDLE_PTR key)
+{
+ ENTER(C_GenerateKey);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* Let key generation happen via Windows interfaces */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_GenerateKeyPair(CK_SESSION_HANDLE session, CK_MECHANISM_PTR mechanism,
+ CK_ATTRIBUTE_PTR public_key_template, CK_ULONG public_key_attribute_count,
+ CK_ATTRIBUTE_PTR private_key_template, CK_ULONG private_key_attribute_count,
+ CK_OBJECT_HANDLE_PTR public_key, CK_OBJECT_HANDLE_PTR private_key)
+{
+ ENTER(C_GenerateKeyPair);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* Let key generation happen via Windows interfaces */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_WrapKey(CK_SESSION_HANDLE session, CK_MECHANISM_PTR mechanism,
+ CK_OBJECT_HANDLE wrapping_key, CK_OBJECT_HANDLE key,
+ CK_BYTE_PTR wrapped_key, CK_ULONG_PTR wrapped_key_len)
+{
+ ENTER(C_WrapKey);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: See if we need to implement this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_UnwrapKey(CK_SESSION_HANDLE session, CK_MECHANISM_PTR mechanism,
+ CK_OBJECT_HANDLE unwrapping_key, CK_BYTE_PTR wrapped_key,
+ CK_ULONG wrapped_key_len, CK_ATTRIBUTE_PTR templ,
+ CK_ULONG count, CK_OBJECT_HANDLE_PTR key)
+{
+ ENTER(C_UnwrapKey);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* TODO: See if we need to implement this */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_DeriveKey(CK_SESSION_HANDLE session, CK_MECHANISM_PTR mechanism,
+ CK_OBJECT_HANDLE base_key, CK_ATTRIBUTE_PTR templ,
+ CK_ULONG count, CK_OBJECT_HANDLE_PTR key)
+{
+ ENTER(C_DeriveKey);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /* Can't do this with RSA */
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_SeedRandom(CK_SESSION_HANDLE session, CK_BYTE_PTR seed, CK_ULONG seed_len)
+{
+ ENTER(C_SeedRandom);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /*
+ * TODO: Perhaps at some point in the future we may want
+ * to see if we can hook into the Windows RNG
+ */
+
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_RV
+PC_C_GenerateRandom(CK_SESSION_HANDLE session, CK_BYTE_PTR random_data,
+ CK_ULONG random_len)
+{
+ ENTER(C_GenerateRandom);
+ PREREQ(cryptoki_initialized, CKR_CRYPTOKI_NOT_INITIALIZED);
+
+ /*
+ * TODO: Perhaps at some point in the future we may want
+ * to see if we can hook into the Windows RNG
+ */
+
+ RETURN(CKR_FUNCTION_NOT_SUPPORTED);
+}
+
+static CK_FUNCTION_LIST functionList = {
+ { 2, 11 }, /* version */
+ PC_C_Initialize,
+ PC_C_Finalize,
+ PC_C_GetInfo,
+ PC_C_GetFunctionList,
+ PC_C_GetSlotList,
+ PC_C_GetSlotInfo,
+ PC_C_GetTokenInfo,
+ PC_C_GetMechanismList,
+ PC_C_GetMechanismInfo,
+ PC_C_InitToken,
+ PC_C_InitPIN,
+ PC_C_SetPIN,
+ PC_C_OpenSession,
+ PC_C_CloseSession,
+ PC_C_CloseAllSessions,
+ PC_C_GetSessionInfo,
+ PC_C_GetOperationState,
+ PC_C_SetOperationState,
+ PC_C_Login,
+ PC_C_Logout,
+ PC_C_CreateObject,
+ PC_C_CopyObject,
+ PC_C_DestroyObject,
+ PC_C_GetObjectSize,
+ PC_C_GetAttributeValue,
+ PC_C_SetAttributeValue,
+ PC_C_FindObjectsInit,
+ PC_C_FindObjects,
+ PC_C_FindObjectsFinal,
+ PC_C_EncryptInit,
+ PC_C_Encrypt,
+ PC_C_EncryptUpdate,
+ PC_C_EncryptFinal,
+ PC_C_DecryptInit,
+ PC_C_Decrypt,
+ PC_C_DecryptUpdate,
+ PC_C_DecryptFinal,
+ PC_C_DigestInit,
+ PC_C_Digest,
+ PC_C_DigestUpdate,
+ PC_C_DigestKey,
+ PC_C_DigestFinal,
+ PC_C_SignInit,
+ PC_C_Sign,
+ PC_C_SignUpdate,
+ PC_C_SignFinal,
+ PC_C_SignRecoverInit,
+ PC_C_SignRecover,
+ PC_C_VerifyInit,
+ PC_C_Verify,
+ PC_C_VerifyUpdate,
+ PC_C_VerifyFinal,
+ PC_C_VerifyRecoverInit,
+ PC_C_VerifyRecover,
+ PC_C_DigestEncryptUpdate,
+ PC_C_DecryptDigestUpdate,
+ PC_C_SignEncryptUpdate,
+ PC_C_DecryptVerifyUpdate,
+ PC_C_GenerateKey,
+ PC_C_GenerateKeyPair,
+ PC_C_WrapKey,
+ PC_C_UnwrapKey,
+ PC_C_DeriveKey,
+ PC_C_SeedRandom,
+ PC_C_GenerateRandom,
+ PC_C_GetFunctionStatus,
+ PC_C_CancelFunction,
+ PC_C_WaitForSlotEvent
+};
+
+__declspec(dllexport) CK_RV
+C_GetFunctionList(CK_FUNCTION_LIST_PTR_PTR list)
+{
+ if(!list)
+ return CKR_ARGUMENTS_BAD;
+
+ *list = &functionList;
+ return CKR_OK;
+}
diff --git a/module/p11-capi.dep b/module/p11-capi.dep
new file mode 100644
index 0000000..c04832a
--- /dev/null
+++ b/module/p11-capi.dep
@@ -0,0 +1,69 @@
+# Microsoft Developer Studio Generated Dependency File, included by p11c.mak
+
+".\p11-capi-builtin.c" : \
+ "..\..\..\..\program files\microsoft visual studio\vc98\include\basetsd.h"\
+ ".\p11-capi-util.h"\
+ ".\p11-capi.h"\
+ ".\pkcs11\cryptoki.h"\
+ ".\pkcs11\pkcs11.h"\
+ ".\pkcs11\pkcs11f.h"\
+ ".\pkcs11\pkcs11n.h"\
+ ".\pkcs11\pkcs11t.h"\
+
+
+".\p11-capi-cert.c" : \
+ "..\..\..\..\program files\microsoft visual studio\vc98\include\basetsd.h"\
+ ".\p11-capi-util.h"\
+ ".\p11-capi.h"\
+ ".\pkcs11\cryptoki.h"\
+ ".\pkcs11\pkcs11.h"\
+ ".\pkcs11\pkcs11f.h"\
+ ".\pkcs11\pkcs11t.h"\
+
+
+".\p11-capi-object.c" : \
+ "..\..\..\..\program files\microsoft visual studio\vc98\include\basetsd.h"\
+ ".\p11-capi-util.h"\
+ ".\p11-capi.h"\
+ ".\pkcs11\cryptoki.h"\
+ ".\pkcs11\pkcs11.h"\
+ ".\pkcs11\pkcs11f.h"\
+ ".\pkcs11\pkcs11n.h"\
+ ".\pkcs11\pkcs11t.h"\
+
+
+".\p11-capi-session.c" : \
+ "..\..\..\..\program files\microsoft visual studio\vc98\include\basetsd.h"\
+ ".\p11-capi-util.h"\
+ ".\p11-capi.h"\
+ ".\pkcs11\cryptoki.h"\
+ ".\pkcs11\pkcs11.h"\
+ ".\pkcs11\pkcs11f.h"\
+ ".\pkcs11\pkcs11t.h"\
+
+
+".\p11-capi-trust.c" : \
+ "..\..\..\..\program files\microsoft visual studio\vc98\include\basetsd.h"\
+ ".\p11-capi-util.h"\
+ ".\p11-capi.h"\
+ ".\pkcs11\cryptoki.h"\
+ ".\pkcs11\pkcs11.h"\
+ ".\pkcs11\pkcs11f.h"\
+ ".\pkcs11\pkcs11n.h"\
+ ".\pkcs11\pkcs11t.h"\
+ ".\x509-usages.h"\
+
+
+".\p11-capi-util.c" : \
+ ".\p11-capi-util.h"\
+
+
+.\p11-capi.c : \
+ "..\..\..\..\program files\microsoft visual studio\vc98\include\basetsd.h"\
+ ".\p11-capi-util.h"\
+ ".\p11-capi.h"\
+ ".\pkcs11\cryptoki.h"\
+ ".\pkcs11\pkcs11.h"\
+ ".\pkcs11\pkcs11f.h"\
+ ".\pkcs11\pkcs11t.h"\
+
diff --git a/module/p11-capi.h b/module/p11-capi.h
new file mode 100644
index 0000000..e522bfa
--- /dev/null
+++ b/module/p11-capi.h
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2007 Stef Walter
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef P11C_H
+#define P11C_H
+
+/* --------------------------------------------------------------------
+ *
+ * Session = P11cSession
+ * - A PKCS#11 Session
+ *
+ * Objects = P11cObject
+ * - There's a global list of objects in p11c-object.c indexed by
+ * object handle.
+ * - The object itself has no attributes or cached data, but knows how
+ * to load data when needed.
+ * - Each object has a unique key which guarantees we don't load the
+ * same object twice with two different object handles.
+ *
+ * Object Data = P11cObjectData
+ * - Object Data is owned by the Session
+ * - Loaded data and/or attributes for an object.
+ */
+
+#define WIN32_LEAN_AND_MEAN
+#define _WIN32_WINNT 0x400
+#include <windows.h>
+#include <wincrypt.h>
+
+#define P11c_ENCODINGS (X509_ASN_ENCODING | PKCS_7_ASN_ENCODING)
+
+#define CRYPTOKI_EXPORTS
+#include "pkcs11/pkcs11.h"
+
+#include "p11-capi-util.h"
+
+struct _P11cSlot;
+struct _P11cObject;
+struct _P11cObjectData;
+struct _P11cSession;
+
+typedef struct _P11cSlot P11cSlot;
+typedef struct _P11cObject P11cObject;
+typedef struct _P11cObjectData P11cObjectData;
+typedef struct _P11cSession P11cSession;
+
+/* ------------------------------------------------------------------
+ * cryptoki-capi.c
+ *
+ * Module helper and logging functions.
+ */
+
+#define DBG(args) p11c_debug args
+
+void p11c_debug (const char* msg, ...);
+
+/*
+ * Protect global data with these.
+ */
+void p11c_lock_global (void);
+void p11c_unlock_global (void);
+
+/*
+ * Convert a GetLastError() windows error to a
+ * PKCS#11 return code.
+ */
+CK_RV p11c_winerr_to_ckr (DWORD werr);
+
+/*
+ * This stores data in the output buffer with appropriate
+ * PKCS#11 codes when the buffer is too short, or the caller
+ * just wants to know the length, etc.
+ */
+CK_RV p11c_return_data (CK_ATTRIBUTE_PTR attr,
+ CK_VOID_PTR src, DWORD slen);
+
+CK_RV p11c_return_data_raw (CK_VOID_PTR output, CK_ULONG_PTR n_output,
+ CK_VOID_PTR input, CK_ULONG n_input);
+
+/*
+ * This stores a string in the output buffer with appropriate
+ * PKCS#11 codes when the buffer is too short, or the caller
+ * just wants to know the length, etc.
+ */
+CK_RV p11c_return_string (CK_ATTRIBUTE_PTR attr,
+ WCHAR* string);
+
+CK_RV p11c_return_dword_as_bytes (CK_ATTRIBUTE_PTR attr,
+ DWORD value);
+
+CK_RV p11c_return_reversed_data (CK_ATTRIBUTE_PTR attr,
+ CK_VOID_PTR data, CK_ULONG length);
+
+CK_RV p11c_return_filetime (CK_ATTRIBUTE_PTR attr,
+ FILETIME* ftime);
+
+/* ------------------------------------------------------------------ */
+
+typedef void (*P11cDestroyFunc)(void* data);
+
+#ifndef ASSERT
+#include "assert.h"
+#define ASSERT assert
+#endif
+
+/* Represents 'any' class in searches */
+#define CKO_ANY CK_INVALID_HANDLE
+
+
+#endif /* P11C_CAPI_H */
diff --git a/module/p11-capi.vcproj b/module/p11-capi.vcproj
new file mode 100644
index 0000000..7c554d1
--- /dev/null
+++ b/module/p11-capi.vcproj
@@ -0,0 +1,428 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioProject
+ ProjectType="Visual C++"
+ Version="8.00"
+ Name="p11-capi"
+ ProjectGUID="{5FC3E27C-F74F-41ED-8BE9-8A586AFC059A}"
+ RootNamespace="p11-capi"
+ >
+ <Platforms>
+ <Platform
+ Name="Win32"
+ />
+ </Platforms>
+ <ToolFiles>
+ </ToolFiles>
+ <Configurations>
+ <Configuration
+ Name="Debug|Win32"
+ OutputDirectory=".\Debug"
+ IntermediateDirectory=".\Debug"
+ ConfigurationType="2"
+ InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC60.vsprops"
+ UseOfMFC="0"
+ ATLMinimizesCRunTimeLibraryUsage="false"
+ CharacterSet="2"
+ >
+ <Tool
+ Name="VCPreBuildEventTool"
+ />
+ <Tool
+ Name="VCCustomBuildTool"
+ />
+ <Tool
+ Name="VCXMLDataGeneratorTool"
+ />
+ <Tool
+ Name="VCWebServiceProxyGeneratorTool"
+ />
+ <Tool
+ Name="VCMIDLTool"
+ PreprocessorDefinitions="_DEBUG"
+ MkTypLibCompatible="true"
+ SuppressStartupBanner="true"
+ TargetEnvironment="1"
+ TypeLibraryName=".\Debug/p11-capi.tlb"
+ HeaderFileName=""
+ />
+ <Tool
+ Name="VCCLCompilerTool"
+ Optimization="0"
+ PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_USRDLL;CRYPTOKI_CAPI_EXPORTS"
+ MinimalRebuild="true"
+ BasicRuntimeChecks="3"
+ RuntimeLibrary="1"
+ PrecompiledHeaderFile=".\Debug/p11-capi.pch"
+ AssemblerListingLocation=".\Debug/"
+ ObjectFile=".\Debug/"
+ ProgramDataBaseFileName=".\Debug/"
+ WarningLevel="3"
+ SuppressStartupBanner="true"
+ DebugInformationFormat="4"
+ />
+ <Tool
+ Name="VCManagedResourceCompilerTool"
+ />
+ <Tool
+ Name="VCResourceCompilerTool"
+ PreprocessorDefinitions="_DEBUG"
+ Culture="1033"
+ />
+ <Tool
+ Name="VCPreLinkEventTool"
+ />
+ <Tool
+ Name="VCLinkerTool"
+ AdditionalDependencies="odbc32.lib odbccp32.lib crypt32.lib advapi32.lib"
+ OutputFile=".\Debug/p11-capi.dll"
+ LinkIncremental="2"
+ SuppressStartupBanner="true"
+ GenerateDebugInformation="true"
+ ProgramDatabaseFile=".\Debug/p11-capi.pdb"
+ ImportLibrary=".\Debug/p11-capi.lib"
+ TargetMachine="1"
+ />
+ <Tool
+ Name="VCALinkTool"
+ />
+ <Tool
+ Name="VCManifestTool"
+ />
+ <Tool
+ Name="VCXDCMakeTool"
+ />
+ <Tool
+ Name="VCBscMakeTool"
+ SuppressStartupBanner="true"
+ OutputFile=".\Debug/p11-capi.bsc"
+ />
+ <Tool
+ Name="VCFxCopTool"
+ />
+ <Tool
+ Name="VCAppVerifierTool"
+ />
+ <Tool
+ Name="VCWebDeploymentTool"
+ />
+ <Tool
+ Name="VCPostBuildEventTool"
+ />
+ </Configuration>
+ <Configuration
+ Name="Release|Win32"
+ OutputDirectory=".\Release"
+ IntermediateDirectory=".\Release"
+ ConfigurationType="2"
+ InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC60.vsprops"
+ UseOfMFC="0"
+ ATLMinimizesCRunTimeLibraryUsage="false"
+ CharacterSet="2"
+ >
+ <Tool
+ Name="VCPreBuildEventTool"
+ />
+ <Tool
+ Name="VCCustomBuildTool"
+ />
+ <Tool
+ Name="VCXMLDataGeneratorTool"
+ />
+ <Tool
+ Name="VCWebServiceProxyGeneratorTool"
+ />
+ <Tool
+ Name="VCMIDLTool"
+ PreprocessorDefinitions="NDEBUG"
+ MkTypLibCompatible="true"
+ SuppressStartupBanner="true"
+ TargetEnvironment="1"
+ TypeLibraryName=".\Release/p11-capi.tlb"
+ HeaderFileName=""
+ />
+ <Tool
+ Name="VCCLCompilerTool"
+ Optimization="2"
+ InlineFunctionExpansion="1"
+ PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;CRYPTOKI_CAPI_EXPORTS"
+ StringPooling="true"
+ RuntimeLibrary="0"
+ EnableFunctionLevelLinking="true"
+ PrecompiledHeaderFile=".\Release/p11-capi.pch"
+ AssemblerListingLocation=".\Release/"
+ ObjectFile=".\Release/"
+ ProgramDataBaseFileName=".\Release/"
+ WarningLevel="3"
+ SuppressStartupBanner="true"
+ />
+ <Tool
+ Name="VCManagedResourceCompilerTool"
+ />
+ <Tool
+ Name="VCResourceCompilerTool"
+ PreprocessorDefinitions="NDEBUG"
+ Culture="1033"
+ />
+ <Tool
+ Name="VCPreLinkEventTool"
+ />
+ <Tool
+ Name="VCLinkerTool"
+ AdditionalDependencies="odbc32.lib odbccp32.lib crypt32.lib"
+ OutputFile=".\Release/p11-capi.dll"
+ LinkIncremental="1"
+ SuppressStartupBanner="true"
+ ProgramDatabaseFile=".\Release/p11-capi.pdb"
+ ImportLibrary=".\Release/p11-capi.lib"
+ TargetMachine="1"
+ />
+ <Tool
+ Name="VCALinkTool"
+ />
+ <Tool
+ Name="VCManifestTool"
+ />
+ <Tool
+ Name="VCXDCMakeTool"
+ />
+ <Tool
+ Name="VCBscMakeTool"
+ SuppressStartupBanner="true"
+ OutputFile=".\Release/p11-capi.bsc"
+ />
+ <Tool
+ Name="VCFxCopTool"
+ />
+ <Tool
+ Name="VCAppVerifierTool"
+ />
+ <Tool
+ Name="VCWebDeploymentTool"
+ />
+ <Tool
+ Name="VCPostBuildEventTool"
+ />
+ </Configuration>
+ </Configurations>
+ <References>
+ </References>
+ <Files>
+ <Filter
+ Name="Source Files"
+ Filter="cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+ >
+ <File
+ RelativePath="p11-capi-builtin.c"
+ >
+ <FileConfiguration
+ Name="Debug|Win32"
+ >
+ <Tool
+ Name="VCCLCompilerTool"
+ PreprocessorDefinitions=""
+ />
+ </FileConfiguration>
+ <FileConfiguration
+ Name="Release|Win32"
+ >
+ <Tool
+ Name="VCCLCompilerTool"
+ PreprocessorDefinitions=""
+ />
+ </FileConfiguration>
+ </File>
+ <File
+ RelativePath="p11-capi-cert.c"
+ >
+ <FileConfiguration
+ Name="Debug|Win32"
+ >
+ <Tool
+ Name="VCCLCompilerTool"
+ PreprocessorDefinitions=""
+ />
+ </FileConfiguration>
+ <FileConfiguration
+ Name="Release|Win32"
+ >
+ <Tool
+ Name="VCCLCompilerTool"
+ PreprocessorDefinitions=""
+ />
+ </FileConfiguration>
+ </File>
+ <File
+ RelativePath=".\p11-capi-der.c"
+ >
+ </File>
+ <File
+ RelativePath=".\p11-capi-key.c"
+ >
+ </File>
+ <File
+ RelativePath="p11-capi-object.c"
+ >
+ <FileConfiguration
+ Name="Debug|Win32"
+ >
+ <Tool
+ Name="VCCLCompilerTool"
+ PreprocessorDefinitions=""
+ />
+ </FileConfiguration>
+ <FileConfiguration
+ Name="Release|Win32"
+ >
+ <Tool
+ Name="VCCLCompilerTool"
+ PreprocessorDefinitions=""
+ />
+ </FileConfiguration>
+ </File>
+ <File
+ RelativePath=".\p11-capi-rsa.c"
+ >
+ </File>
+ <File
+ RelativePath="p11-capi-session.c"
+ >
+ <FileConfiguration
+ Name="Debug|Win32"
+ >
+ <Tool
+ Name="VCCLCompilerTool"
+ PreprocessorDefinitions=""
+ />
+ </FileConfiguration>
+ <FileConfiguration
+ Name="Release|Win32"
+ >
+ <Tool
+ Name="VCCLCompilerTool"
+ PreprocessorDefinitions=""
+ />
+ </FileConfiguration>
+ </File>
+ <File
+ RelativePath="p11-capi-token.c"
+ >
+ <FileConfiguration
+ Name="Debug|Win32"
+ >
+ <Tool
+ Name="VCCLCompilerTool"
+ PreprocessorDefinitions=""
+ />
+ </FileConfiguration>
+ <FileConfiguration
+ Name="Release|Win32"
+ >
+ <Tool
+ Name="VCCLCompilerTool"
+ PreprocessorDefinitions=""
+ />
+ </FileConfiguration>
+ </File>
+ <File
+ RelativePath=".\p11-capi-trust.c"
+ >
+ </File>
+ <File
+ RelativePath="p11-capi-util.c"
+ >
+ <FileConfiguration
+ Name="Debug|Win32"
+ >
+ <Tool
+ Name="VCCLCompilerTool"
+ PreprocessorDefinitions=""
+ />
+ </FileConfiguration>
+ <FileConfiguration
+ Name="Release|Win32"
+ >
+ <Tool
+ Name="VCCLCompilerTool"
+ PreprocessorDefinitions=""
+ />
+ </FileConfiguration>
+ </File>
+ <File
+ RelativePath="p11-capi.c"
+ >
+ <FileConfiguration
+ Name="Debug|Win32"
+ >
+ <Tool
+ Name="VCCLCompilerTool"
+ PreprocessorDefinitions=""
+ />
+ </FileConfiguration>
+ <FileConfiguration
+ Name="Release|Win32"
+ >
+ <Tool
+ Name="VCCLCompilerTool"
+ PreprocessorDefinitions=""
+ />
+ </FileConfiguration>
+ </File>
+ </Filter>
+ <Filter
+ Name="Header Files"
+ Filter="h;hpp;hxx;hm;inl"
+ >
+ <File
+ RelativePath=".\p11-capi-cert.h"
+ >
+ </File>
+ <File
+ RelativePath=".\p11-capi-der.h"
+ >
+ </File>
+ <File
+ RelativePath=".\p11-capi-key.h"
+ >
+ </File>
+ <File
+ RelativePath=".\p11-capi-object.h"
+ >
+ </File>
+ <File
+ RelativePath=".\p11-capi-rsa.h"
+ >
+ </File>
+ <File
+ RelativePath=".\p11-capi-session.h"
+ >
+ </File>
+ <File
+ RelativePath=".\p11-capi-token.h"
+ >
+ </File>
+ <File
+ RelativePath=".\p11-capi-trust.h"
+ >
+ </File>
+ <File
+ RelativePath="p11-capi-util.h"
+ >
+ </File>
+ <File
+ RelativePath="p11-capi.h"
+ >
+ </File>
+ <File
+ RelativePath="pkcs11\pkcs11.h"
+ >
+ </File>
+ </Filter>
+ <Filter
+ Name="Resource Files"
+ Filter="ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+ >
+ </Filter>
+ </Files>
+ <Globals>
+ </Globals>
+</VisualStudioProject>
diff --git a/module/pkcs11/Makefile.am b/module/pkcs11/Makefile.am
new file mode 100644
index 0000000..b3598ba
--- /dev/null
+++ b/module/pkcs11/Makefile.am
@@ -0,0 +1,9 @@
+
+EXTRA_DIST = \
+ cryptoki.h \
+ pkcs11.h \
+ pkcs11f.h \
+ pkcs11t.h \
+ pkcs-11v2-20a3.h
+
+
diff --git a/module/pkcs11/pkcs11.h b/module/pkcs11/pkcs11.h
new file mode 100644
index 0000000..2e6a1e3
--- /dev/null
+++ b/module/pkcs11/pkcs11.h
@@ -0,0 +1,1357 @@
+/* pkcs11.h
+ Copyright 2006, 2007 g10 Code GmbH
+ Copyright 2006 Andreas Jellinghaus
+
+ This file is free software; as a special exception the author gives
+ unlimited permission to copy and/or distribute it, with or without
+ modifications, as long as this notice is preserved.
+
+ This file is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY, to the extent permitted by law; without even
+ the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ PURPOSE. */
+
+/* Please submit changes back to the Scute project at
+ http://www.scute.org/ (or send them to marcus@g10code.com), so that
+ they can be picked up by other projects from there as well. */
+
+/* This file is a modified implementation of the PKCS #11 standard by
+ RSA Security Inc. It is mostly a drop-in replacement, with the
+ following change:
+
+ This header file does not require any macro definitions by the user
+ (like CK_DEFINE_FUNCTION etc). In fact, it defines those macros
+ for you (if useful, some are missing, let me know if you need
+ more).
+
+ There is an additional API available that does comply better to the
+ GNU coding standard. It can be switched on by defining
+ CRYPTOKI_GNU before including this header file. For this, the
+ following changes are made to the specification:
+
+ All structure types are changed to a "struct ck_foo" where CK_FOO
+ is the type name in PKCS #11.
+
+ All non-structure types are changed to ck_foo_t where CK_FOO is the
+ lowercase version of the type name in PKCS #11. The basic types
+ (CK_ULONG et al.) are removed without substitute.
+
+ All members of structures are modified in the following way: Type
+ indication prefixes are removed, and underscore characters are
+ inserted before words. Then the result is lowercased.
+
+ Note that function names are still in the original case, as they
+ need for ABI compatibility.
+
+ CK_FALSE, CK_TRUE and NULL_PTR are removed without substitute. Use
+ <stdbool.h>.
+
+ If CRYPTOKI_COMPAT is defined before including this header file,
+ then none of the API changes above take place, and the API is the
+ one defined by the PKCS #11 standard. */
+
+#ifndef PKCS11_H
+#define PKCS11_H 1
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+/* The version of cryptoki we implement. The revision is changed with
+ each modification of this file. If you do not use the "official"
+ version of this file, please consider deleting the revision macro
+ (you may use a macro with a different name to keep track of your
+ versions). */
+#define CRYPTOKI_VERSION_MAJOR 2
+#define CRYPTOKI_VERSION_MINOR 20
+#define CRYPTOKI_VERSION_REVISION 6
+
+
+/* Compatibility interface is default, unless CRYPTOKI_GNU is
+ given. */
+#ifndef CRYPTOKI_GNU
+#ifndef CRYPTOKI_COMPAT
+#define CRYPTOKI_COMPAT 1
+#endif
+#endif
+
+/* System dependencies. */
+
+#if defined(_WIN32) || defined(CRYPTOKI_FORCE_WIN32)
+
+/* There is a matching pop below. */
+#pragma pack(push, cryptoki, 1)
+
+#ifdef CRYPTOKI_EXPORTS
+#define CK_SPEC __declspec(dllexport)
+#else
+#define CK_SPEC __declspec(dllimport)
+#endif
+
+#else
+
+#define CK_SPEC
+
+#endif
+
+
+#ifdef CRYPTOKI_COMPAT
+ /* If we are in compatibility mode, switch all exposed names to the
+ PKCS #11 variant. There are corresponding #undefs below. */
+
+#define ck_flags_t CK_FLAGS
+#define ck_version _CK_VERSION
+
+#define ck_info _CK_INFO
+#define cryptoki_version cryptokiVersion
+#define manufacturer_id manufacturerID
+#define library_description libraryDescription
+#define library_version libraryVersion
+
+#define ck_notification_t CK_NOTIFICATION
+#define ck_slot_id_t CK_SLOT_ID
+
+#define ck_slot_info _CK_SLOT_INFO
+#define slot_description slotDescription
+#define hardware_version hardwareVersion
+#define firmware_version firmwareVersion
+
+#define ck_token_info _CK_TOKEN_INFO
+#define serial_number serialNumber
+#define max_session_count ulMaxSessionCount
+#define session_count ulSessionCount
+#define max_rw_session_count ulMaxRwSessionCount
+#define rw_session_count ulRwSessionCount
+#define max_pin_len ulMaxPinLen
+#define min_pin_len ulMinPinLen
+#define total_public_memory ulTotalPublicMemory
+#define free_public_memory ulFreePublicMemory
+#define total_private_memory ulTotalPrivateMemory
+#define free_private_memory ulFreePrivateMemory
+#define utc_time utcTime
+
+#define ck_session_handle_t CK_SESSION_HANDLE
+#define ck_user_type_t CK_USER_TYPE
+#define ck_state_t CK_STATE
+
+#define ck_session_info _CK_SESSION_INFO
+#define slot_id slotID
+#define device_error ulDeviceError
+
+#define ck_object_handle_t CK_OBJECT_HANDLE
+#define ck_object_class_t CK_OBJECT_CLASS
+#define ck_hw_feature_type_t CK_HW_FEATURE_TYPE
+#define ck_key_type_t CK_KEY_TYPE
+#define ck_certificate_type_t CK_CERTIFICATE_TYPE
+#define ck_attribute_type_t CK_ATTRIBUTE_TYPE
+
+#define ck_attribute _CK_ATTRIBUTE
+#define value pValue
+#define value_len ulValueLen
+
+#define ck_date _CK_DATE
+
+#define ck_mechanism_type_t CK_MECHANISM_TYPE
+
+#define ck_mechanism _CK_MECHANISM
+#define parameter pParameter
+#define parameter_len ulParameterLen
+
+#define ck_mechanism_info _CK_MECHANISM_INFO
+#define min_key_size ulMinKeySize
+#define max_key_size ulMaxKeySize
+
+#define ck_rv_t CK_RV
+#define ck_notify_t CK_NOTIFY
+
+#define ck_function_list _CK_FUNCTION_LIST
+
+#define ck_createmutex_t CK_CREATEMUTEX
+#define ck_destroymutex_t CK_DESTROYMUTEX
+#define ck_lockmutex_t CK_LOCKMUTEX
+#define ck_unlockmutex_t CK_UNLOCKMUTEX
+
+#define ck_c_initialize_args _CK_C_INITIALIZE_ARGS
+#define create_mutex CreateMutex
+#define destroy_mutex DestroyMutex
+#define lock_mutex LockMutex
+#define unlock_mutex UnlockMutex
+#define reserved pReserved
+
+#endif /* CRYPTOKI_COMPAT */
+
+
+
+typedef unsigned long ck_flags_t;
+
+struct ck_version
+{
+ unsigned char major;
+ unsigned char minor;
+};
+
+
+struct ck_info
+{
+ struct ck_version cryptoki_version;
+ unsigned char manufacturer_id[32];
+ ck_flags_t flags;
+ unsigned char library_description[32];
+ struct ck_version library_version;
+};
+
+
+typedef unsigned long ck_notification_t;
+
+#define CKN_SURRENDER (0)
+
+
+typedef unsigned long ck_slot_id_t;
+
+
+struct ck_slot_info
+{
+ unsigned char slot_description[64];
+ unsigned char manufacturer_id[32];
+ ck_flags_t flags;
+ struct ck_version hardware_version;
+ struct ck_version firmware_version;
+};
+
+
+#define CKF_TOKEN_PRESENT (1 << 0)
+#define CKF_REMOVABLE_DEVICE (1 << 1)
+#define CKF_HW_SLOT (1 << 2)
+#define CKF_ARRAY_ATTRIBUTE (1 << 30)
+
+
+struct ck_token_info
+{
+ unsigned char label[32];
+ unsigned char manufacturer_id[32];
+ unsigned char model[16];
+ unsigned char serial_number[16];
+ ck_flags_t flags;
+ unsigned long max_session_count;
+ unsigned long session_count;
+ unsigned long max_rw_session_count;
+ unsigned long rw_session_count;
+ unsigned long max_pin_len;
+ unsigned long min_pin_len;
+ unsigned long total_public_memory;
+ unsigned long free_public_memory;
+ unsigned long total_private_memory;
+ unsigned long free_private_memory;
+ struct ck_version hardware_version;
+ struct ck_version firmware_version;
+ unsigned char utc_time[16];
+};
+
+
+#define CKF_RNG (1 << 0)
+#define CKF_WRITE_PROTECTED (1 << 1)
+#define CKF_LOGIN_REQUIRED (1 << 2)
+#define CKF_USER_PIN_INITIALIZED (1 << 3)
+#define CKF_RESTORE_KEY_NOT_NEEDED (1 << 5)
+#define CKF_CLOCK_ON_TOKEN (1 << 6)
+#define CKF_PROTECTED_AUTHENTICATION_PATH (1 << 8)
+#define CKF_DUAL_CRYPTO_OPERATIONS (1 << 9)
+#define CKF_TOKEN_INITIALIZED (1 << 10)
+#define CKF_SECONDARY_AUTHENTICATION (1 << 11)
+#define CKF_USER_PIN_COUNT_LOW (1 << 16)
+#define CKF_USER_PIN_FINAL_TRY (1 << 17)
+#define CKF_USER_PIN_LOCKED (1 << 18)
+#define CKF_USER_PIN_TO_BE_CHANGED (1 << 19)
+#define CKF_SO_PIN_COUNT_LOW (1 << 20)
+#define CKF_SO_PIN_FINAL_TRY (1 << 21)
+#define CKF_SO_PIN_LOCKED (1 << 22)
+#define CKF_SO_PIN_TO_BE_CHANGED (1 << 23)
+
+#define CK_UNAVAILABLE_INFORMATION ((unsigned long) -1)
+#define CK_EFFECTIVELY_INFINITE (0)
+
+
+typedef unsigned long ck_session_handle_t;
+
+#define CK_INVALID_HANDLE (0)
+
+
+typedef unsigned long ck_user_type_t;
+
+#define CKU_SO (0)
+#define CKU_USER (1)
+#define CKU_CONTEXT_SPECIFIC (2)
+
+
+typedef unsigned long ck_state_t;
+
+#define CKS_RO_PUBLIC_SESSION (0)
+#define CKS_RO_USER_FUNCTIONS (1)
+#define CKS_RW_PUBLIC_SESSION (2)
+#define CKS_RW_USER_FUNCTIONS (3)
+#define CKS_RW_SO_FUNCTIONS (4)
+
+
+struct ck_session_info
+{
+ ck_slot_id_t slot_id;
+ ck_state_t state;
+ ck_flags_t flags;
+ unsigned long device_error;
+};
+
+#define CKF_RW_SESSION (1 << 1)
+#define CKF_SERIAL_SESSION (1 << 2)
+
+
+typedef unsigned long ck_object_handle_t;
+
+
+typedef unsigned long ck_object_class_t;
+
+#define CKO_DATA (0)
+#define CKO_CERTIFICATE (1)
+#define CKO_PUBLIC_KEY (2)
+#define CKO_PRIVATE_KEY (3)
+#define CKO_SECRET_KEY (4)
+#define CKO_HW_FEATURE (5)
+#define CKO_DOMAIN_PARAMETERS (6)
+#define CKO_MECHANISM (7)
+#define CKO_VENDOR_DEFINED ((unsigned long) (1 << 31))
+
+
+typedef unsigned long ck_hw_feature_type_t;
+
+#define CKH_MONOTONIC_COUNTER (1)
+#define CKH_CLOCK (2)
+#define CKH_USER_INTERFACE (3)
+#define CKH_VENDOR_DEFINED ((unsigned long) (1 << 31))
+
+
+typedef unsigned long ck_key_type_t;
+
+#define CKK_RSA (0)
+#define CKK_DSA (1)
+#define CKK_DH (2)
+#define CKK_ECDSA (3)
+#define CKK_EC (3)
+#define CKK_X9_42_DH (4)
+#define CKK_KEA (5)
+#define CKK_GENERIC_SECRET (0x10)
+#define CKK_RC2 (0x11)
+#define CKK_RC4 (0x12)
+#define CKK_DES (0x13)
+#define CKK_DES2 (0x14)
+#define CKK_DES3 (0x15)
+#define CKK_CAST (0x16)
+#define CKK_CAST3 (0x17)
+#define CKK_CAST128 (0x18)
+#define CKK_RC5 (0x19)
+#define CKK_IDEA (0x1a)
+#define CKK_SKIPJACK (0x1b)
+#define CKK_BATON (0x1c)
+#define CKK_JUNIPER (0x1d)
+#define CKK_CDMF (0x1e)
+#define CKK_AES (0x1f)
+#define CKK_BLOWFISH (0x20)
+#define CKK_TWOFISH (0x21)
+#define CKK_VENDOR_DEFINED ((unsigned long) (1 << 31))
+
+
+typedef unsigned long ck_certificate_type_t;
+
+#define CKC_X_509 (0)
+#define CKC_X_509_ATTR_CERT (1)
+#define CKC_WTLS (2)
+#define CKC_VENDOR_DEFINED ((unsigned long) (1 << 31))
+
+
+typedef unsigned long ck_attribute_type_t;
+
+#define CKA_CLASS (0)
+#define CKA_TOKEN (1)
+#define CKA_PRIVATE (2)
+#define CKA_LABEL (3)
+#define CKA_APPLICATION (0x10)
+#define CKA_VALUE (0x11)
+#define CKA_OBJECT_ID (0x12)
+#define CKA_CERTIFICATE_TYPE (0x80)
+#define CKA_ISSUER (0x81)
+#define CKA_SERIAL_NUMBER (0x82)
+#define CKA_AC_ISSUER (0x83)
+#define CKA_OWNER (0x84)
+#define CKA_ATTR_TYPES (0x85)
+#define CKA_TRUSTED (0x86)
+#define CKA_CERTIFICATE_CATEGORY (0x87)
+#define CKA_JAVA_MIDP_SECURITY_DOMAIN (0x88)
+#define CKA_URL (0x89)
+#define CKA_HASH_OF_SUBJECT_PUBLIC_KEY (0x8a)
+#define CKA_HASH_OF_ISSUER_PUBLIC_KEY (0x8b)
+#define CKA_CHECK_VALUE (0x90)
+#define CKA_KEY_TYPE (0x100)
+#define CKA_SUBJECT (0x101)
+#define CKA_ID (0x102)
+#define CKA_SENSITIVE (0x103)
+#define CKA_ENCRYPT (0x104)
+#define CKA_DECRYPT (0x105)
+#define CKA_WRAP (0x106)
+#define CKA_UNWRAP (0x107)
+#define CKA_SIGN (0x108)
+#define CKA_SIGN_RECOVER (0x109)
+#define CKA_VERIFY (0x10a)
+#define CKA_VERIFY_RECOVER (0x10b)
+#define CKA_DERIVE (0x10c)
+#define CKA_START_DATE (0x110)
+#define CKA_END_DATE (0x111)
+#define CKA_MODULUS (0x120)
+#define CKA_MODULUS_BITS (0x121)
+#define CKA_PUBLIC_EXPONENT (0x122)
+#define CKA_PRIVATE_EXPONENT (0x123)
+#define CKA_PRIME_1 (0x124)
+#define CKA_PRIME_2 (0x125)
+#define CKA_EXPONENT_1 (0x126)
+#define CKA_EXPONENT_2 (0x127)
+#define CKA_COEFFICIENT (0x128)
+#define CKA_PRIME (0x130)
+#define CKA_SUBPRIME (0x131)
+#define CKA_BASE (0x132)
+#define CKA_PRIME_BITS (0x133)
+#define CKA_SUB_PRIME_BITS (0x134)
+#define CKA_VALUE_BITS (0x160)
+#define CKA_VALUE_LEN (0x161)
+#define CKA_EXTRACTABLE (0x162)
+#define CKA_LOCAL (0x163)
+#define CKA_NEVER_EXTRACTABLE (0x164)
+#define CKA_ALWAYS_SENSITIVE (0x165)
+#define CKA_KEY_GEN_MECHANISM (0x166)
+#define CKA_MODIFIABLE (0x170)
+#define CKA_ECDSA_PARAMS (0x180)
+#define CKA_EC_PARAMS (0x180)
+#define CKA_EC_POINT (0x181)
+#define CKA_SECONDARY_AUTH (0x200)
+#define CKA_AUTH_PIN_FLAGS (0x201)
+#define CKA_ALWAYS_AUTHENTICATE (0x202)
+#define CKA_WRAP_WITH_TRUSTED (0x210)
+#define CKA_HW_FEATURE_TYPE (0x300)
+#define CKA_RESET_ON_INIT (0x301)
+#define CKA_HAS_RESET (0x302)
+#define CKA_PIXEL_X (0x400)
+#define CKA_PIXEL_Y (0x401)
+#define CKA_RESOLUTION (0x402)
+#define CKA_CHAR_ROWS (0x403)
+#define CKA_CHAR_COLUMNS (0x404)
+#define CKA_COLOR (0x405)
+#define CKA_BITS_PER_PIXEL (0x406)
+#define CKA_CHAR_SETS (0x480)
+#define CKA_ENCODING_METHODS (0x481)
+#define CKA_MIME_TYPES (0x482)
+#define CKA_MECHANISM_TYPE (0x500)
+#define CKA_REQUIRED_CMS_ATTRIBUTES (0x501)
+#define CKA_DEFAULT_CMS_ATTRIBUTES (0x502)
+#define CKA_SUPPORTED_CMS_ATTRIBUTES (0x503)
+#define CKA_WRAP_TEMPLATE (CKF_ARRAY_ATTRIBUTE | 0x211)
+#define CKA_UNWRAP_TEMPLATE (CKF_ARRAY_ATTRIBUTE | 0x212)
+#define CKA_ALLOWED_MECHANISMS (CKF_ARRAY_ATTRIBUTE | 0x600)
+#define CKA_VENDOR_DEFINED ((unsigned long) (1 << 31))
+
+
+struct ck_attribute
+{
+ ck_attribute_type_t type;
+ void *value;
+ unsigned long value_len;
+};
+
+
+struct ck_date
+{
+ unsigned char year[4];
+ unsigned char month[2];
+ unsigned char day[2];
+};
+
+
+typedef unsigned long ck_mechanism_type_t;
+
+#define CKM_RSA_PKCS_KEY_PAIR_GEN (0)
+#define CKM_RSA_PKCS (1)
+#define CKM_RSA_9796 (2)
+#define CKM_RSA_X_509 (3)
+#define CKM_MD2_RSA_PKCS (4)
+#define CKM_MD5_RSA_PKCS (5)
+#define CKM_SHA1_RSA_PKCS (6)
+#define CKM_RIPEMD128_RSA_PKCS (7)
+#define CKM_RIPEMD160_RSA_PKCS (8)
+#define CKM_RSA_PKCS_OAEP (9)
+#define CKM_RSA_X9_31_KEY_PAIR_GEN (0xa)
+#define CKM_RSA_X9_31 (0xb)
+#define CKM_SHA1_RSA_X9_31 (0xc)
+#define CKM_RSA_PKCS_PSS (0xd)
+#define CKM_SHA1_RSA_PKCS_PSS (0xe)
+#define CKM_DSA_KEY_PAIR_GEN (0x10)
+#define CKM_DSA (0x11)
+#define CKM_DSA_SHA1 (0x12)
+#define CKM_DH_PKCS_KEY_PAIR_GEN (0x20)
+#define CKM_DH_PKCS_DERIVE (0x21)
+#define CKM_X9_42_DH_KEY_PAIR_GEN (0x30)
+#define CKM_X9_42_DH_DERIVE (0x31)
+#define CKM_X9_42_DH_HYBRID_DERIVE (0x32)
+#define CKM_X9_42_MQV_DERIVE (0x33)
+#define CKM_SHA256_RSA_PKCS (0x40)
+#define CKM_SHA384_RSA_PKCS (0x41)
+#define CKM_SHA512_RSA_PKCS (0x42)
+#define CKM_SHA256_RSA_PKCS_PSS (0x43)
+#define CKM_SHA384_RSA_PKCS_PSS (0x44)
+#define CKM_SHA512_RSA_PKCS_PSS (0x45)
+#define CKM_RC2_KEY_GEN (0x100)
+#define CKM_RC2_ECB (0x101)
+#define CKM_RC2_CBC (0x102)
+#define CKM_RC2_MAC (0x103)
+#define CKM_RC2_MAC_GENERAL (0x104)
+#define CKM_RC2_CBC_PAD (0x105)
+#define CKM_RC4_KEY_GEN (0x110)
+#define CKM_RC4 (0x111)
+#define CKM_DES_KEY_GEN (0x120)
+#define CKM_DES_ECB (0x121)
+#define CKM_DES_CBC (0x122)
+#define CKM_DES_MAC (0x123)
+#define CKM_DES_MAC_GENERAL (0x124)
+#define CKM_DES_CBC_PAD (0x125)
+#define CKM_DES2_KEY_GEN (0x130)
+#define CKM_DES3_KEY_GEN (0x131)
+#define CKM_DES3_ECB (0x132)
+#define CKM_DES3_CBC (0x133)
+#define CKM_DES3_MAC (0x134)
+#define CKM_DES3_MAC_GENERAL (0x135)
+#define CKM_DES3_CBC_PAD (0x136)
+#define CKM_CDMF_KEY_GEN (0x140)
+#define CKM_CDMF_ECB (0x141)
+#define CKM_CDMF_CBC (0x142)
+#define CKM_CDMF_MAC (0x143)
+#define CKM_CDMF_MAC_GENERAL (0x144)
+#define CKM_CDMF_CBC_PAD (0x145)
+#define CKM_MD2 (0x200)
+#define CKM_MD2_HMAC (0x201)
+#define CKM_MD2_HMAC_GENERAL (0x202)
+#define CKM_MD5 (0x210)
+#define CKM_MD5_HMAC (0x211)
+#define CKM_MD5_HMAC_GENERAL (0x212)
+#define CKM_SHA_1 (0x220)
+#define CKM_SHA_1_HMAC (0x221)
+#define CKM_SHA_1_HMAC_GENERAL (0x222)
+#define CKM_RIPEMD128 (0x230)
+#define CKM_RIPEMD128_HMAC (0x231)
+#define CKM_RIPEMD128_HMAC_GENERAL (0x232)
+#define CKM_RIPEMD160 (0x240)
+#define CKM_RIPEMD160_HMAC (0x241)
+#define CKM_RIPEMD160_HMAC_GENERAL (0x242)
+#define CKM_SHA256 (0x250)
+#define CKM_SHA256_HMAC (0x251)
+#define CKM_SHA256_HMAC_GENERAL (0x252)
+#define CKM_SHA384 (0x260)
+#define CKM_SHA384_HMAC (0x261)
+#define CKM_SHA384_HMAC_GENERAL (0x262)
+#define CKM_SHA512 (0x270)
+#define CKM_SHA512_HMAC (0x271)
+#define CKM_SHA512_HMAC_GENERAL (0x272)
+#define CKM_CAST_KEY_GEN (0x300)
+#define CKM_CAST_ECB (0x301)
+#define CKM_CAST_CBC (0x302)
+#define CKM_CAST_MAC (0x303)
+#define CKM_CAST_MAC_GENERAL (0x304)
+#define CKM_CAST_CBC_PAD (0x305)
+#define CKM_CAST3_KEY_GEN (0x310)
+#define CKM_CAST3_ECB (0x311)
+#define CKM_CAST3_CBC (0x312)
+#define CKM_CAST3_MAC (0x313)
+#define CKM_CAST3_MAC_GENERAL (0x314)
+#define CKM_CAST3_CBC_PAD (0x315)
+#define CKM_CAST5_KEY_GEN (0x320)
+#define CKM_CAST128_KEY_GEN (0x320)
+#define CKM_CAST5_ECB (0x321)
+#define CKM_CAST128_ECB (0x321)
+#define CKM_CAST5_CBC (0x322)
+#define CKM_CAST128_CBC (0x322)
+#define CKM_CAST5_MAC (0x323)
+#define CKM_CAST128_MAC (0x323)
+#define CKM_CAST5_MAC_GENERAL (0x324)
+#define CKM_CAST128_MAC_GENERAL (0x324)
+#define CKM_CAST5_CBC_PAD (0x325)
+#define CKM_CAST128_CBC_PAD (0x325)
+#define CKM_RC5_KEY_GEN (0x330)
+#define CKM_RC5_ECB (0x331)
+#define CKM_RC5_CBC (0x332)
+#define CKM_RC5_MAC (0x333)
+#define CKM_RC5_MAC_GENERAL (0x334)
+#define CKM_RC5_CBC_PAD (0x335)
+#define CKM_IDEA_KEY_GEN (0x340)
+#define CKM_IDEA_ECB (0x341)
+#define CKM_IDEA_CBC (0x342)
+#define CKM_IDEA_MAC (0x343)
+#define CKM_IDEA_MAC_GENERAL (0x344)
+#define CKM_IDEA_CBC_PAD (0x345)
+#define CKM_GENERIC_SECRET_KEY_GEN (0x350)
+#define CKM_CONCATENATE_BASE_AND_KEY (0x360)
+#define CKM_CONCATENATE_BASE_AND_DATA (0x362)
+#define CKM_CONCATENATE_DATA_AND_BASE (0x363)
+#define CKM_XOR_BASE_AND_DATA (0x364)
+#define CKM_EXTRACT_KEY_FROM_KEY (0x365)
+#define CKM_SSL3_PRE_MASTER_KEY_GEN (0x370)
+#define CKM_SSL3_MASTER_KEY_DERIVE (0x371)
+#define CKM_SSL3_KEY_AND_MAC_DERIVE (0x372)
+#define CKM_SSL3_MASTER_KEY_DERIVE_DH (0x373)
+#define CKM_TLS_PRE_MASTER_KEY_GEN (0x374)
+#define CKM_TLS_MASTER_KEY_DERIVE (0x375)
+#define CKM_TLS_KEY_AND_MAC_DERIVE (0x376)
+#define CKM_TLS_MASTER_KEY_DERIVE_DH (0x377)
+#define CKM_SSL3_MD5_MAC (0x380)
+#define CKM_SSL3_SHA1_MAC (0x381)
+#define CKM_MD5_KEY_DERIVATION (0x390)
+#define CKM_MD2_KEY_DERIVATION (0x391)
+#define CKM_SHA1_KEY_DERIVATION (0x392)
+#define CKM_PBE_MD2_DES_CBC (0x3a0)
+#define CKM_PBE_MD5_DES_CBC (0x3a1)
+#define CKM_PBE_MD5_CAST_CBC (0x3a2)
+#define CKM_PBE_MD5_CAST3_CBC (0x3a3)
+#define CKM_PBE_MD5_CAST5_CBC (0x3a4)
+#define CKM_PBE_MD5_CAST128_CBC (0x3a4)
+#define CKM_PBE_SHA1_CAST5_CBC (0x3a5)
+#define CKM_PBE_SHA1_CAST128_CBC (0x3a5)
+#define CKM_PBE_SHA1_RC4_128 (0x3a6)
+#define CKM_PBE_SHA1_RC4_40 (0x3a7)
+#define CKM_PBE_SHA1_DES3_EDE_CBC (0x3a8)
+#define CKM_PBE_SHA1_DES2_EDE_CBC (0x3a9)
+#define CKM_PBE_SHA1_RC2_128_CBC (0x3aa)
+#define CKM_PBE_SHA1_RC2_40_CBC (0x3ab)
+#define CKM_PKCS5_PBKD2 (0x3b0)
+#define CKM_PBA_SHA1_WITH_SHA1_HMAC (0x3c0)
+#define CKM_KEY_WRAP_LYNKS (0x400)
+#define CKM_KEY_WRAP_SET_OAEP (0x401)
+#define CKM_SKIPJACK_KEY_GEN (0x1000)
+#define CKM_SKIPJACK_ECB64 (0x1001)
+#define CKM_SKIPJACK_CBC64 (0x1002)
+#define CKM_SKIPJACK_OFB64 (0x1003)
+#define CKM_SKIPJACK_CFB64 (0x1004)
+#define CKM_SKIPJACK_CFB32 (0x1005)
+#define CKM_SKIPJACK_CFB16 (0x1006)
+#define CKM_SKIPJACK_CFB8 (0x1007)
+#define CKM_SKIPJACK_WRAP (0x1008)
+#define CKM_SKIPJACK_PRIVATE_WRAP (0x1009)
+#define CKM_SKIPJACK_RELAYX (0x100a)
+#define CKM_KEA_KEY_PAIR_GEN (0x1010)
+#define CKM_KEA_KEY_DERIVE (0x1011)
+#define CKM_FORTEZZA_TIMESTAMP (0x1020)
+#define CKM_BATON_KEY_GEN (0x1030)
+#define CKM_BATON_ECB128 (0x1031)
+#define CKM_BATON_ECB96 (0x1032)
+#define CKM_BATON_CBC128 (0x1033)
+#define CKM_BATON_COUNTER (0x1034)
+#define CKM_BATON_SHUFFLE (0x1035)
+#define CKM_BATON_WRAP (0x1036)
+#define CKM_ECDSA_KEY_PAIR_GEN (0x1040)
+#define CKM_EC_KEY_PAIR_GEN (0x1040)
+#define CKM_ECDSA (0x1041)
+#define CKM_ECDSA_SHA1 (0x1042)
+#define CKM_ECDH1_DERIVE (0x1050)
+#define CKM_ECDH1_COFACTOR_DERIVE (0x1051)
+#define CKM_ECMQV_DERIVE (0x1052)
+#define CKM_JUNIPER_KEY_GEN (0x1060)
+#define CKM_JUNIPER_ECB128 (0x1061)
+#define CKM_JUNIPER_CBC128 (0x1062)
+#define CKM_JUNIPER_COUNTER (0x1063)
+#define CKM_JUNIPER_SHUFFLE (0x1064)
+#define CKM_JUNIPER_WRAP (0x1065)
+#define CKM_FASTHASH (0x1070)
+#define CKM_AES_KEY_GEN (0x1080)
+#define CKM_AES_ECB (0x1081)
+#define CKM_AES_CBC (0x1082)
+#define CKM_AES_MAC (0x1083)
+#define CKM_AES_MAC_GENERAL (0x1084)
+#define CKM_AES_CBC_PAD (0x1085)
+#define CKM_DSA_PARAMETER_GEN (0x2000)
+#define CKM_DH_PKCS_PARAMETER_GEN (0x2001)
+#define CKM_X9_42_DH_PARAMETER_GEN (0x2002)
+#define CKM_VENDOR_DEFINED ((unsigned long) (1 << 31))
+
+
+struct ck_mechanism
+{
+ ck_mechanism_type_t mechanism;
+ void *parameter;
+ unsigned long parameter_len;
+};
+
+
+struct ck_mechanism_info
+{
+ unsigned long min_key_size;
+ unsigned long max_key_size;
+ ck_flags_t flags;
+};
+
+#define CKF_HW (1 << 0)
+#define CKF_ENCRYPT (1 << 8)
+#define CKF_DECRYPT (1 << 9)
+#define CKF_DIGEST (1 << 10)
+#define CKF_SIGN (1 << 11)
+#define CKF_SIGN_RECOVER (1 << 12)
+#define CKF_VERIFY (1 << 13)
+#define CKF_VERIFY_RECOVER (1 << 14)
+#define CKF_GENERATE (1 << 15)
+#define CKF_GENERATE_KEY_PAIR (1 << 16)
+#define CKF_WRAP (1 << 17)
+#define CKF_UNWRAP (1 << 18)
+#define CKF_DERIVE (1 << 19)
+#define CKF_EXTENSION ((unsigned long) (1 << 31))
+
+
+/* Flags for C_WaitForSlotEvent. */
+#define CKF_DONT_BLOCK (1)
+
+
+typedef unsigned long ck_rv_t;
+
+
+typedef ck_rv_t (*ck_notify_t) (ck_session_handle_t session,
+ ck_notification_t event, void *application);
+
+/* Forward reference. */
+struct ck_function_list;
+
+#define _CK_DECLARE_FUNCTION(name, args) \
+typedef ck_rv_t (*CK_ ## name) args; \
+ck_rv_t CK_SPEC name args
+
+_CK_DECLARE_FUNCTION (C_Initialize, (void *init_args));
+_CK_DECLARE_FUNCTION (C_Finalize, (void *reserved));
+_CK_DECLARE_FUNCTION (C_GetInfo, (struct ck_info *info));
+_CK_DECLARE_FUNCTION (C_GetFunctionList,
+ (struct ck_function_list **function_list));
+
+_CK_DECLARE_FUNCTION (C_GetSlotList,
+ (unsigned char token_present, ck_slot_id_t *slot_list,
+ unsigned long *count));
+_CK_DECLARE_FUNCTION (C_GetSlotInfo,
+ (ck_slot_id_t slot_id, struct ck_slot_info *info));
+_CK_DECLARE_FUNCTION (C_GetTokenInfo,
+ (ck_slot_id_t slot_id, struct ck_token_info *info));
+_CK_DECLARE_FUNCTION (C_WaitForSlotEvent,
+ (ck_flags_t flags, ck_slot_id_t *slot, void *reserved));
+_CK_DECLARE_FUNCTION (C_GetMechanismList,
+ (ck_slot_id_t slot_id,
+ ck_mechanism_type_t *mechanism_list,
+ unsigned long *count));
+_CK_DECLARE_FUNCTION (C_GetMechanismInfo,
+ (ck_slot_id_t slot_id, ck_mechanism_type_t type,
+ struct ck_mechanism_info *info));
+_CK_DECLARE_FUNCTION (C_InitToken,
+ (ck_slot_id_t slot_id, unsigned char *pin,
+ unsigned long pin_len, unsigned char *label));
+_CK_DECLARE_FUNCTION (C_InitPIN,
+ (ck_session_handle_t session, unsigned char *pin,
+ unsigned long pin_len));
+_CK_DECLARE_FUNCTION (C_SetPIN,
+ (ck_session_handle_t session, unsigned char *old_pin,
+ unsigned long old_len, unsigned char *new_pin,
+ unsigned long new_len));
+
+_CK_DECLARE_FUNCTION (C_OpenSession,
+ (ck_slot_id_t slot_id, ck_flags_t flags,
+ void *application, ck_notify_t notify,
+ ck_session_handle_t *session));
+_CK_DECLARE_FUNCTION (C_CloseSession, (ck_session_handle_t session));
+_CK_DECLARE_FUNCTION (C_CloseAllSessions, (ck_slot_id_t slot_id));
+_CK_DECLARE_FUNCTION (C_GetSessionInfo,
+ (ck_session_handle_t session,
+ struct ck_session_info *info));
+_CK_DECLARE_FUNCTION (C_GetOperationState,
+ (ck_session_handle_t session,
+ unsigned char *operation_state,
+ unsigned long *operation_state_len));
+_CK_DECLARE_FUNCTION (C_SetOperationState,
+ (ck_session_handle_t session,
+ unsigned char *operation_state,
+ unsigned long operation_state_len,
+ ck_object_handle_t encryption_key,
+ ck_object_handle_t authentiation_key));
+_CK_DECLARE_FUNCTION (C_Login,
+ (ck_session_handle_t session, ck_user_type_t user_type,
+ unsigned char *pin, unsigned long pin_len));
+_CK_DECLARE_FUNCTION (C_Logout, (ck_session_handle_t session));
+
+_CK_DECLARE_FUNCTION (C_CreateObject,
+ (ck_session_handle_t session,
+ struct ck_attribute *templ,
+ unsigned long count, ck_object_handle_t *object));
+_CK_DECLARE_FUNCTION (C_CopyObject,
+ (ck_session_handle_t session, ck_object_handle_t object,
+ struct ck_attribute *templ, unsigned long count,
+ ck_object_handle_t *new_object));
+_CK_DECLARE_FUNCTION (C_DestroyObject,
+ (ck_session_handle_t session,
+ ck_object_handle_t object));
+_CK_DECLARE_FUNCTION (C_GetObjectSize,
+ (ck_session_handle_t session,
+ ck_object_handle_t object,
+ unsigned long *size));
+_CK_DECLARE_FUNCTION (C_GetAttributeValue,
+ (ck_session_handle_t session,
+ ck_object_handle_t object,
+ struct ck_attribute *templ,
+ unsigned long count));
+_CK_DECLARE_FUNCTION (C_SetAttributeValue,
+ (ck_session_handle_t session,
+ ck_object_handle_t object,
+ struct ck_attribute *templ,
+ unsigned long count));
+_CK_DECLARE_FUNCTION (C_FindObjectsInit,
+ (ck_session_handle_t session,
+ struct ck_attribute *templ,
+ unsigned long count));
+_CK_DECLARE_FUNCTION (C_FindObjects,
+ (ck_session_handle_t session,
+ ck_object_handle_t *object,
+ unsigned long max_object_count,
+ unsigned long *object_count));
+_CK_DECLARE_FUNCTION (C_FindObjectsFinal,
+ (ck_session_handle_t session));
+
+_CK_DECLARE_FUNCTION (C_EncryptInit,
+ (ck_session_handle_t session,
+ struct ck_mechanism *mechanism,
+ ck_object_handle_t key));
+_CK_DECLARE_FUNCTION (C_Encrypt,
+ (ck_session_handle_t session,
+ unsigned char *data, unsigned long data_len,
+ unsigned char *encrypted_data,
+ unsigned long *encrypted_data_len));
+_CK_DECLARE_FUNCTION (C_EncryptUpdate,
+ (ck_session_handle_t session,
+ unsigned char *part, unsigned long part_len,
+ unsigned char *encrypted_part,
+ unsigned long *encrypted_part_len));
+_CK_DECLARE_FUNCTION (C_EncryptFinal,
+ (ck_session_handle_t session,
+ unsigned char *last_encrypted_part,
+ unsigned long *last_encrypted_part_len));
+
+_CK_DECLARE_FUNCTION (C_DecryptInit,
+ (ck_session_handle_t session,
+ struct ck_mechanism *mechanism,
+ ck_object_handle_t key));
+_CK_DECLARE_FUNCTION (C_Decrypt,
+ (ck_session_handle_t session,
+ unsigned char *encrypted_data,
+ unsigned long encrypted_data_len,
+ unsigned char *data, unsigned long *data_len));
+_CK_DECLARE_FUNCTION (C_DecryptUpdate,
+ (ck_session_handle_t session,
+ unsigned char *encrypted_part,
+ unsigned long encrypted_part_len,
+ unsigned char *part, unsigned long *part_len));
+_CK_DECLARE_FUNCTION (C_DecryptFinal,
+ (ck_session_handle_t session,
+ unsigned char *last_part,
+ unsigned long *last_part_len));
+
+_CK_DECLARE_FUNCTION (C_DigestInit,
+ (ck_session_handle_t session,
+ struct ck_mechanism *mechanism));
+_CK_DECLARE_FUNCTION (C_Digest,
+ (ck_session_handle_t session,
+ unsigned char *data, unsigned long data_len,
+ unsigned char *digest,
+ unsigned long *digest_len));
+_CK_DECLARE_FUNCTION (C_DigestUpdate,
+ (ck_session_handle_t session,
+ unsigned char *part, unsigned long part_len));
+_CK_DECLARE_FUNCTION (C_DigestKey,
+ (ck_session_handle_t session, ck_object_handle_t key));
+_CK_DECLARE_FUNCTION (C_DigestFinal,
+ (ck_session_handle_t session,
+ unsigned char *digest,
+ unsigned long *digest_len));
+
+_CK_DECLARE_FUNCTION (C_SignInit,
+ (ck_session_handle_t session,
+ struct ck_mechanism *mechanism,
+ ck_object_handle_t key));
+_CK_DECLARE_FUNCTION (C_Sign,
+ (ck_session_handle_t session,
+ unsigned char *data, unsigned long data_len,
+ unsigned char *signature,
+ unsigned long *signature_len));
+_CK_DECLARE_FUNCTION (C_SignUpdate,
+ (ck_session_handle_t session,
+ unsigned char *part, unsigned long part_len));
+_CK_DECLARE_FUNCTION (C_SignFinal,
+ (ck_session_handle_t session,
+ unsigned char *signature,
+ unsigned long *signature_len));
+_CK_DECLARE_FUNCTION (C_SignRecoverInit,
+ (ck_session_handle_t session,
+ struct ck_mechanism *mechanism,
+ ck_object_handle_t key));
+_CK_DECLARE_FUNCTION (C_SignRecover,
+ (ck_session_handle_t session,
+ unsigned char *data, unsigned long data_len,
+ unsigned char *signature,
+ unsigned long *signature_len));
+
+_CK_DECLARE_FUNCTION (C_VerifyInit,
+ (ck_session_handle_t session,
+ struct ck_mechanism *mechanism,
+ ck_object_handle_t key));
+_CK_DECLARE_FUNCTION (C_Verify,
+ (ck_session_handle_t session,
+ unsigned char *data, unsigned long data_len,
+ unsigned char *signature,
+ unsigned long signature_len));
+_CK_DECLARE_FUNCTION (C_VerifyUpdate,
+ (ck_session_handle_t session,
+ unsigned char *part, unsigned long part_len));
+_CK_DECLARE_FUNCTION (C_VerifyFinal,
+ (ck_session_handle_t session,
+ unsigned char *signature,
+ unsigned long signature_len));
+_CK_DECLARE_FUNCTION (C_VerifyRecoverInit,
+ (ck_session_handle_t session,
+ struct ck_mechanism *mechanism,
+ ck_object_handle_t key));
+_CK_DECLARE_FUNCTION (C_VerifyRecover,
+ (ck_session_handle_t session,
+ unsigned char *signature,
+ unsigned long signature_len,
+ unsigned char *data,
+ unsigned long *data_len));
+
+_CK_DECLARE_FUNCTION (C_DigestEncryptUpdate,
+ (ck_session_handle_t session,
+ unsigned char *part, unsigned long part_len,
+ unsigned char *encrypted_part,
+ unsigned long *encrypted_part_len));
+_CK_DECLARE_FUNCTION (C_DecryptDigestUpdate,
+ (ck_session_handle_t session,
+ unsigned char *encrypted_part,
+ unsigned long encrypted_part_len,
+ unsigned char *part,
+ unsigned long *part_len));
+_CK_DECLARE_FUNCTION (C_SignEncryptUpdate,
+ (ck_session_handle_t session,
+ unsigned char *part, unsigned long part_len,
+ unsigned char *encrypted_part,
+ unsigned long *encrypted_part_len));
+_CK_DECLARE_FUNCTION (C_DecryptVerifyUpdate,
+ (ck_session_handle_t session,
+ unsigned char *encrypted_part,
+ unsigned long encrypted_part_len,
+ unsigned char *part,
+ unsigned long *part_len));
+
+_CK_DECLARE_FUNCTION (C_GenerateKey,
+ (ck_session_handle_t session,
+ struct ck_mechanism *mechanism,
+ struct ck_attribute *templ,
+ unsigned long count,
+ ck_object_handle_t *key));
+_CK_DECLARE_FUNCTION (C_GenerateKeyPair,
+ (ck_session_handle_t session,
+ struct ck_mechanism *mechanism,
+ struct ck_attribute *public_key_template,
+ unsigned long public_key_attribute_count,
+ struct ck_attribute *private_key_template,
+ unsigned long private_key_attribute_count,
+ ck_object_handle_t *public_key,
+ ck_object_handle_t *private_key));
+_CK_DECLARE_FUNCTION (C_WrapKey,
+ (ck_session_handle_t session,
+ struct ck_mechanism *mechanism,
+ ck_object_handle_t wrapping_key,
+ ck_object_handle_t key,
+ unsigned char *wrapped_key,
+ unsigned long *wrapped_key_len));
+_CK_DECLARE_FUNCTION (C_UnwrapKey,
+ (ck_session_handle_t session,
+ struct ck_mechanism *mechanism,
+ ck_object_handle_t unwrapping_key,
+ unsigned char *wrapped_key,
+ unsigned long wrapped_key_len,
+ struct ck_attribute *templ,
+ unsigned long attribute_count,
+ ck_object_handle_t *key));
+_CK_DECLARE_FUNCTION (C_DeriveKey,
+ (ck_session_handle_t session,
+ struct ck_mechanism *mechanism,
+ ck_object_handle_t base_key,
+ struct ck_attribute *templ,
+ unsigned long attribute_count,
+ ck_object_handle_t *key));
+
+_CK_DECLARE_FUNCTION (C_SeedRandom,
+ (ck_session_handle_t session, unsigned char *seed,
+ unsigned long seed_len));
+_CK_DECLARE_FUNCTION (C_GenerateRandom,
+ (ck_session_handle_t session,
+ unsigned char *random_data,
+ unsigned long random_len));
+
+_CK_DECLARE_FUNCTION (C_GetFunctionStatus, (ck_session_handle_t session));
+_CK_DECLARE_FUNCTION (C_CancelFunction, (ck_session_handle_t session));
+
+
+struct ck_function_list
+{
+ struct ck_version version;
+ CK_C_Initialize C_Initialize;
+ CK_C_Finalize C_Finalize;
+ CK_C_GetInfo C_GetInfo;
+ CK_C_GetFunctionList C_GetFunctionList;
+ CK_C_GetSlotList C_GetSlotList;
+ CK_C_GetSlotInfo C_GetSlotInfo;
+ CK_C_GetTokenInfo C_GetTokenInfo;
+ CK_C_GetMechanismList C_GetMechanismList;
+ CK_C_GetMechanismInfo C_GetMechanismInfo;
+ CK_C_InitToken C_InitToken;
+ CK_C_InitPIN C_InitPIN;
+ CK_C_SetPIN C_SetPIN;
+ CK_C_OpenSession C_OpenSession;
+ CK_C_CloseSession C_CloseSession;
+ CK_C_CloseAllSessions C_CloseAllSessions;
+ CK_C_GetSessionInfo C_GetSessionInfo;
+ CK_C_GetOperationState C_GetOperationState;
+ CK_C_SetOperationState C_SetOperationState;
+ CK_C_Login C_Login;
+ CK_C_Logout C_Logout;
+ CK_C_CreateObject C_CreateObject;
+ CK_C_CopyObject C_CopyObject;
+ CK_C_DestroyObject C_DestroyObject;
+ CK_C_GetObjectSize C_GetObjectSize;
+ CK_C_GetAttributeValue C_GetAttributeValue;
+ CK_C_SetAttributeValue C_SetAttributeValue;
+ CK_C_FindObjectsInit C_FindObjectsInit;
+ CK_C_FindObjects C_FindObjects;
+ CK_C_FindObjectsFinal C_FindObjectsFinal;
+ CK_C_EncryptInit C_EncryptInit;
+ CK_C_Encrypt C_Encrypt;
+ CK_C_EncryptUpdate C_EncryptUpdate;
+ CK_C_EncryptFinal C_EncryptFinal;
+ CK_C_DecryptInit C_DecryptInit;
+ CK_C_Decrypt C_Decrypt;
+ CK_C_DecryptUpdate C_DecryptUpdate;
+ CK_C_DecryptFinal C_DecryptFinal;
+ CK_C_DigestInit C_DigestInit;
+ CK_C_Digest C_Digest;
+ CK_C_DigestUpdate C_DigestUpdate;
+ CK_C_DigestKey C_DigestKey;
+ CK_C_DigestFinal C_DigestFinal;
+ CK_C_SignInit C_SignInit;
+ CK_C_Sign C_Sign;
+ CK_C_SignUpdate C_SignUpdate;
+ CK_C_SignFinal C_SignFinal;
+ CK_C_SignRecoverInit C_SignRecoverInit;
+ CK_C_SignRecover C_SignRecover;
+ CK_C_VerifyInit C_VerifyInit;
+ CK_C_Verify C_Verify;
+ CK_C_VerifyUpdate C_VerifyUpdate;
+ CK_C_VerifyFinal C_VerifyFinal;
+ CK_C_VerifyRecoverInit C_VerifyRecoverInit;
+ CK_C_VerifyRecover C_VerifyRecover;
+ CK_C_DigestEncryptUpdate C_DigestEncryptUpdate;
+ CK_C_DecryptDigestUpdate C_DecryptDigestUpdate;
+ CK_C_SignEncryptUpdate C_SignEncryptUpdate;
+ CK_C_DecryptVerifyUpdate C_DecryptVerifyUpdate;
+ CK_C_GenerateKey C_GenerateKey;
+ CK_C_GenerateKeyPair C_GenerateKeyPair;
+ CK_C_WrapKey C_WrapKey;
+ CK_C_UnwrapKey C_UnwrapKey;
+ CK_C_DeriveKey C_DeriveKey;
+ CK_C_SeedRandom C_SeedRandom;
+ CK_C_GenerateRandom C_GenerateRandom;
+ CK_C_GetFunctionStatus C_GetFunctionStatus;
+ CK_C_CancelFunction C_CancelFunction;
+ CK_C_WaitForSlotEvent C_WaitForSlotEvent;
+};
+
+
+typedef ck_rv_t (*ck_createmutex_t) (void **mutex);
+typedef ck_rv_t (*ck_destroymutex_t) (void *mutex);
+typedef ck_rv_t (*ck_lockmutex_t) (void *mutex);
+typedef ck_rv_t (*ck_unlockmutex_t) (void *mutex);
+
+
+struct ck_c_initialize_args
+{
+ ck_createmutex_t create_mutex;
+ ck_destroymutex_t destroy_mutex;
+ ck_lockmutex_t lock_mutex;
+ ck_unlockmutex_t unlock_mutex;
+ ck_flags_t flags;
+ void *reserved;
+};
+
+
+#define CKF_LIBRARY_CANT_CREATE_OS_THREADS (1 << 0)
+#define CKF_OS_LOCKING_OK (1 << 1)
+
+#define CKR_OK (0)
+#define CKR_CANCEL (1)
+#define CKR_HOST_MEMORY (2)
+#define CKR_SLOT_ID_INVALID (3)
+#define CKR_GENERAL_ERROR (5)
+#define CKR_FUNCTION_FAILED (6)
+#define CKR_ARGUMENTS_BAD (7)
+#define CKR_NO_EVENT (8)
+#define CKR_NEED_TO_CREATE_THREADS (9)
+#define CKR_CANT_LOCK (0xa)
+#define CKR_ATTRIBUTE_READ_ONLY (0x10)
+#define CKR_ATTRIBUTE_SENSITIVE (0x11)
+#define CKR_ATTRIBUTE_TYPE_INVALID (0x12)
+#define CKR_ATTRIBUTE_VALUE_INVALID (0x13)
+#define CKR_DATA_INVALID (0x20)
+#define CKR_DATA_LEN_RANGE (0x21)
+#define CKR_DEVICE_ERROR (0x30)
+#define CKR_DEVICE_MEMORY (0x31)
+#define CKR_DEVICE_REMOVED (0x32)
+#define CKR_ENCRYPTED_DATA_INVALID (0x40)
+#define CKR_ENCRYPTED_DATA_LEN_RANGE (0x41)
+#define CKR_FUNCTION_CANCELED (0x50)
+#define CKR_FUNCTION_NOT_PARALLEL (0x51)
+#define CKR_FUNCTION_NOT_SUPPORTED (0x54)
+#define CKR_KEY_HANDLE_INVALID (0x60)
+#define CKR_KEY_SIZE_RANGE (0x62)
+#define CKR_KEY_TYPE_INCONSISTENT (0x63)
+#define CKR_KEY_NOT_NEEDED (0x64)
+#define CKR_KEY_CHANGED (0x65)
+#define CKR_KEY_NEEDED (0x66)
+#define CKR_KEY_INDIGESTIBLE (0x67)
+#define CKR_KEY_FUNCTION_NOT_PERMITTED (0x68)
+#define CKR_KEY_NOT_WRAPPABLE (0x69)
+#define CKR_KEY_UNEXTRACTABLE (0x6a)
+#define CKR_MECHANISM_INVALID (0x70)
+#define CKR_MECHANISM_PARAM_INVALID (0x71)
+#define CKR_OBJECT_HANDLE_INVALID (0x82)
+#define CKR_OPERATION_ACTIVE (0x90)
+#define CKR_OPERATION_NOT_INITIALIZED (0x91)
+#define CKR_PIN_INCORRECT (0xa0)
+#define CKR_PIN_INVALID (0xa1)
+#define CKR_PIN_LEN_RANGE (0xa2)
+#define CKR_PIN_EXPIRED (0xa3)
+#define CKR_PIN_LOCKED (0xa4)
+#define CKR_SESSION_CLOSED (0xb0)
+#define CKR_SESSION_COUNT (0xb1)
+#define CKR_SESSION_HANDLE_INVALID (0xb3)
+#define CKR_SESSION_PARALLEL_NOT_SUPPORTED (0xb4)
+#define CKR_SESSION_READ_ONLY (0xb5)
+#define CKR_SESSION_EXISTS (0xb6)
+#define CKR_SESSION_READ_ONLY_EXISTS (0xb7)
+#define CKR_SESSION_READ_WRITE_SO_EXISTS (0xb8)
+#define CKR_SIGNATURE_INVALID (0xc0)
+#define CKR_SIGNATURE_LEN_RANGE (0xc1)
+#define CKR_TEMPLATE_INCOMPLETE (0xd0)
+#define CKR_TEMPLATE_INCONSISTENT (0xd1)
+#define CKR_TOKEN_NOT_PRESENT (0xe0)
+#define CKR_TOKEN_NOT_RECOGNIZED (0xe1)
+#define CKR_TOKEN_WRITE_PROTECTED (0xe2)
+#define CKR_UNWRAPPING_KEY_HANDLE_INVALID (0xf0)
+#define CKR_UNWRAPPING_KEY_SIZE_RANGE (0xf1)
+#define CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT (0xf2)
+#define CKR_USER_ALREADY_LOGGED_IN (0x100)
+#define CKR_USER_NOT_LOGGED_IN (0x101)
+#define CKR_USER_PIN_NOT_INITIALIZED (0x102)
+#define CKR_USER_TYPE_INVALID (0x103)
+#define CKR_USER_ANOTHER_ALREADY_LOGGED_IN (0x104)
+#define CKR_USER_TOO_MANY_TYPES (0x105)
+#define CKR_WRAPPED_KEY_INVALID (0x110)
+#define CKR_WRAPPED_KEY_LEN_RANGE (0x112)
+#define CKR_WRAPPING_KEY_HANDLE_INVALID (0x113)
+#define CKR_WRAPPING_KEY_SIZE_RANGE (0x114)
+#define CKR_WRAPPING_KEY_TYPE_INCONSISTENT (0x115)
+#define CKR_RANDOM_SEED_NOT_SUPPORTED (0x120)
+#define CKR_RANDOM_NO_RNG (0x121)
+#define CKR_DOMAIN_PARAMS_INVALID (0x130)
+#define CKR_BUFFER_TOO_SMALL (0x150)
+#define CKR_SAVED_STATE_INVALID (0x160)
+#define CKR_INFORMATION_SENSITIVE (0x170)
+#define CKR_STATE_UNSAVEABLE (0x180)
+#define CKR_CRYPTOKI_NOT_INITIALIZED (0x190)
+#define CKR_CRYPTOKI_ALREADY_INITIALIZED (0x191)
+#define CKR_MUTEX_BAD (0x1a0)
+#define CKR_MUTEX_NOT_LOCKED (0x1a1)
+#define CKR_FUNCTION_REJECTED (0x200)
+#define CKR_VENDOR_DEFINED ((unsigned long) (1 << 31))
+
+
+
+/* Compatibility layer. */
+
+#ifdef CRYPTOKI_COMPAT
+
+#undef CK_DEFINE_FUNCTION
+#define CK_DEFINE_FUNCTION(retval, name) retval CK_SPEC name
+
+/* For NULL. */
+#include <stddef.h>
+
+typedef unsigned char CK_BYTE;
+typedef unsigned char CK_CHAR;
+typedef unsigned char CK_UTF8CHAR;
+typedef unsigned char CK_BBOOL;
+typedef unsigned long int CK_ULONG;
+typedef long int CK_LONG;
+typedef CK_BYTE *CK_BYTE_PTR;
+typedef CK_CHAR *CK_CHAR_PTR;
+typedef CK_UTF8CHAR *CK_UTF8CHAR_PTR;
+typedef CK_ULONG *CK_ULONG_PTR;
+typedef void *CK_VOID_PTR;
+typedef void **CK_VOID_PTR_PTR;
+#define CK_FALSE 0
+#define CK_TRUE 1
+#ifndef CK_DISABLE_TRUE_FALSE
+#ifndef FALSE
+#define FALSE 0
+#endif
+#ifndef TRUE
+#define TRUE 1
+#endif
+#endif
+
+typedef struct ck_version CK_VERSION;
+typedef struct ck_version *CK_VERSION_PTR;
+
+typedef struct ck_info CK_INFO;
+typedef struct ck_info *CK_INFO_PTR;
+
+typedef ck_slot_id_t *CK_SLOT_ID_PTR;
+
+typedef struct ck_slot_info CK_SLOT_INFO;
+typedef struct ck_slot_info *CK_SLOT_INFO_PTR;
+
+typedef struct ck_token_info CK_TOKEN_INFO;
+typedef struct ck_token_info *CK_TOKEN_INFO_PTR;
+
+typedef ck_session_handle_t *CK_SESSION_HANDLE_PTR;
+
+typedef struct ck_session_info CK_SESSION_INFO;
+typedef struct ck_session_info *CK_SESSION_INFO_PTR;
+
+typedef ck_object_handle_t *CK_OBJECT_HANDLE_PTR;
+
+typedef ck_object_class_t *CK_OBJECT_CLASS_PTR;
+
+typedef struct ck_attribute CK_ATTRIBUTE;
+typedef struct ck_attribute *CK_ATTRIBUTE_PTR;
+
+typedef struct ck_date CK_DATE;
+typedef struct ck_date *CK_DATE_PTR;
+
+typedef ck_mechanism_type_t *CK_MECHANISM_TYPE_PTR;
+
+typedef struct ck_mechanism CK_MECHANISM;
+typedef struct ck_mechanism *CK_MECHANISM_PTR;
+
+typedef struct ck_mechanism_info CK_MECHANISM_INFO;
+typedef struct ck_mechanism_info *CK_MECHANISM_INFO_PTR;
+
+typedef struct ck_function_list CK_FUNCTION_LIST;
+typedef struct ck_function_list *CK_FUNCTION_LIST_PTR;
+typedef struct ck_function_list **CK_FUNCTION_LIST_PTR_PTR;
+
+typedef struct ck_c_initialize_args CK_C_INITIALIZE_ARGS;
+typedef struct ck_c_initialize_args *CK_C_INITIALIZE_ARGS_PTR;
+
+#define NULL_PTR NULL
+
+/* Delete the helper macros defined at the top of the file. */
+#undef ck_flags_t
+#undef ck_version
+
+#undef ck_info
+#undef cryptoki_version
+#undef manufacturer_id
+#undef library_description
+#undef library_version
+
+#undef ck_notification_t
+#undef ck_slot_id_t
+
+#undef ck_slot_info
+#undef slot_description
+#undef hardware_version
+#undef firmware_version
+
+#undef ck_token_info
+#undef serial_number
+#undef max_session_count
+#undef session_count
+#undef max_rw_session_count
+#undef rw_session_count
+#undef max_pin_len
+#undef min_pin_len
+#undef total_public_memory
+#undef free_public_memory
+#undef total_private_memory
+#undef free_private_memory
+#undef utc_time
+
+#undef ck_session_handle_t
+#undef ck_user_type_t
+#undef ck_state_t
+
+#undef ck_session_info
+#undef slot_id
+#undef device_error
+
+#undef ck_object_handle_t
+#undef ck_object_class_t
+#undef ck_hw_feature_type_t
+#undef ck_key_type_t
+#undef ck_certificate_type_t
+#undef ck_attribute_type_t
+
+#undef ck_attribute
+#undef value
+#undef value_len
+
+#undef ck_date
+
+#undef ck_mechanism_type_t
+
+#undef ck_mechanism
+#undef parameter
+#undef parameter_len
+
+#undef ck_mechanism_info
+#undef min_key_size
+#undef max_key_size
+
+#undef ck_rv_t
+#undef ck_notify_t
+
+#undef ck_function_list
+
+#undef ck_createmutex_t
+#undef ck_destroymutex_t
+#undef ck_lockmutex_t
+#undef ck_unlockmutex_t
+
+#undef ck_c_initialize_args
+#undef create_mutex
+#undef destroy_mutex
+#undef lock_mutex
+#undef unlock_mutex
+#undef reserved
+
+#endif /* CRYPTOKI_COMPAT */
+
+
+/* System dependencies. */
+#if defined(_WIN32) || defined(CRYPTOKI_FORCE_WIN32)
+#pragma pack(pop, cryptoki)
+#endif
+
+#if defined(__cplusplus)
+}
+#endif
+
+#endif /* PKCS11_H */
diff --git a/module/pkcs11/pkcs11n.h b/module/pkcs11/pkcs11n.h
new file mode 100644
index 0000000..d611d75
--- /dev/null
+++ b/module/pkcs11/pkcs11n.h
@@ -0,0 +1,221 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is the Netscape security libraries.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1994-2000
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ * Dr Stephen Henson <stephen.henson@gemplus.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef _PKCS11N_H_
+#define _PKCS11N_H_
+
+#ifdef DEBUG
+static const char CKT_CVS_ID[] = "@(#) $RCSfile: pkcs11n.h,v $ $Revision: 1.15 $ $Date: 2005/09/28 17:12:17 $";
+#endif /* DEBUG */
+
+/*
+ * pkcs11n.h
+ *
+ * This file contains the NSS-specific type definitions for Cryptoki
+ * (PKCS#11).
+ */
+
+/*
+ * NSSCK_VENDOR_NETSCAPE
+ *
+ * Cryptoki reserves the high half of all the number spaces for
+ * vendor-defined use. I'd like to keep all of our Netscape-
+ * specific values together, but not in the oh-so-obvious
+ * 0x80000001, 0x80000002, etc. area. So I've picked an offset,
+ * and constructed values for the beginnings of our spaces.
+ *
+ * Note that some "historical" Netscape values don't fall within
+ * this range.
+ */
+#define NSSCK_VENDOR_NETSCAPE 0x4E534350 /* NSCP */
+
+/*
+ * Netscape-defined object classes
+ *
+ */
+#define CKO_NETSCAPE (CKO_VENDOR_DEFINED|NSSCK_VENDOR_NETSCAPE)
+
+#define CKO_NETSCAPE_CRL (CKO_NETSCAPE + 1)
+#define CKO_NETSCAPE_SMIME (CKO_NETSCAPE + 2)
+#define CKO_NETSCAPE_TRUST (CKO_NETSCAPE + 3)
+#define CKO_NETSCAPE_BUILTIN_ROOT_LIST (CKO_NETSCAPE + 4)
+#define CKO_NETSCAPE_NEWSLOT (CKO_NETSCAPE + 5)
+#define CKO_NETSCAPE_DELSLOT (CKO_NETSCAPE + 6)
+
+/*
+ * Netscape-defined key types
+ *
+ */
+#define CKK_NETSCAPE (CKK_VENDOR_DEFINED|NSSCK_VENDOR_NETSCAPE)
+
+#define CKK_NETSCAPE_PKCS8 (CKK_NETSCAPE + 1)
+/*
+ * Netscape-defined certificate types
+ *
+ */
+#define CKC_NETSCAPE (CKC_VENDOR_DEFINED|NSSCK_VENDOR_NETSCAPE)
+
+/*
+ * Netscape-defined object attributes
+ *
+ */
+#define CKA_NETSCAPE (CKA_VENDOR_DEFINED|NSSCK_VENDOR_NETSCAPE)
+
+#define CKA_NETSCAPE_URL (CKA_NETSCAPE + 1)
+#define CKA_NETSCAPE_EMAIL (CKA_NETSCAPE + 2)
+#define CKA_NETSCAPE_SMIME_INFO (CKA_NETSCAPE + 3)
+#define CKA_NETSCAPE_SMIME_TIMESTAMP (CKA_NETSCAPE + 4)
+#define CKA_NETSCAPE_PKCS8_SALT (CKA_NETSCAPE + 5)
+#define CKA_NETSCAPE_PASSWORD_CHECK (CKA_NETSCAPE + 6)
+#define CKA_NETSCAPE_EXPIRES (CKA_NETSCAPE + 7)
+#define CKA_NETSCAPE_KRL (CKA_NETSCAPE + 8)
+
+#define CKA_NETSCAPE_PQG_COUNTER (CKA_NETSCAPE + 20)
+#define CKA_NETSCAPE_PQG_SEED (CKA_NETSCAPE + 21)
+#define CKA_NETSCAPE_PQG_H (CKA_NETSCAPE + 22)
+#define CKA_NETSCAPE_PQG_SEED_BITS (CKA_NETSCAPE + 23)
+#define CKA_NETSCAPE_MODULE_SPEC (CKA_NETSCAPE + 24)
+
+/*
+ * Trust attributes:
+ *
+ * If trust goes standard, these probably will too. So I'll
+ * put them all in one place.
+ */
+
+#define CKA_TRUST (CKA_NETSCAPE + 0x2000)
+
+/* "Usage" key information */
+#define CKA_TRUST_DIGITAL_SIGNATURE (CKA_TRUST + 1)
+#define CKA_TRUST_NON_REPUDIATION (CKA_TRUST + 2)
+#define CKA_TRUST_KEY_ENCIPHERMENT (CKA_TRUST + 3)
+#define CKA_TRUST_DATA_ENCIPHERMENT (CKA_TRUST + 4)
+#define CKA_TRUST_KEY_AGREEMENT (CKA_TRUST + 5)
+#define CKA_TRUST_KEY_CERT_SIGN (CKA_TRUST + 6)
+#define CKA_TRUST_CRL_SIGN (CKA_TRUST + 7)
+
+/* "Purpose" trust information */
+#define CKA_TRUST_SERVER_AUTH (CKA_TRUST + 8)
+#define CKA_TRUST_CLIENT_AUTH (CKA_TRUST + 9)
+#define CKA_TRUST_CODE_SIGNING (CKA_TRUST + 10)
+#define CKA_TRUST_EMAIL_PROTECTION (CKA_TRUST + 11)
+#define CKA_TRUST_IPSEC_END_SYSTEM (CKA_TRUST + 12)
+#define CKA_TRUST_IPSEC_TUNNEL (CKA_TRUST + 13)
+#define CKA_TRUST_IPSEC_USER (CKA_TRUST + 14)
+#define CKA_TRUST_TIME_STAMPING (CKA_TRUST + 15)
+#define CKA_TRUST_STEP_UP_APPROVED (CKA_TRUST + 16)
+
+#define CKA_CERT_SHA1_HASH (CKA_TRUST + 100)
+#define CKA_CERT_MD5_HASH (CKA_TRUST + 101)
+
+/* Netscape trust stuff */
+/* XXX fgmr new ones here-- step-up, etc. */
+
+/* HISTORICAL: define used to pass in the database key for DSA private keys */
+#define CKA_NETSCAPE_DB 0xD5A0DB00L
+#define CKA_NETSCAPE_TRUST 0x80000001L
+
+/*
+ * Netscape-defined crypto mechanisms
+ *
+ */
+#define CKM_NETSCAPE (CKM_VENDOR_DEFINED|NSSCK_VENDOR_NETSCAPE)
+
+#define CKM_NETSCAPE_AES_KEY_WRAP (CKM_NETSCAPE + 1)
+#define CKM_NETSCAPE_AES_KEY_WRAP_PAD (CKM_NETSCAPE + 2)
+
+/*
+ * HISTORICAL:
+ * Do not attempt to use these. They are only used by NETSCAPE's internal
+ * PKCS #11 interface. Most of these are place holders for other mechanism
+ * and will change in the future.
+ */
+#define CKM_NETSCAPE_PBE_SHA1_DES_CBC 0x80000002L
+#define CKM_NETSCAPE_PBE_SHA1_TRIPLE_DES_CBC 0x80000003L
+#define CKM_NETSCAPE_PBE_SHA1_40_BIT_RC2_CBC 0x80000004L
+#define CKM_NETSCAPE_PBE_SHA1_128_BIT_RC2_CBC 0x80000005L
+#define CKM_NETSCAPE_PBE_SHA1_40_BIT_RC4 0x80000006L
+#define CKM_NETSCAPE_PBE_SHA1_128_BIT_RC4 0x80000007L
+#define CKM_NETSCAPE_PBE_SHA1_FAULTY_3DES_CBC 0x80000008L
+#define CKM_NETSCAPE_PBE_SHA1_HMAC_KEY_GEN 0x80000009L
+#define CKM_NETSCAPE_PBE_MD5_HMAC_KEY_GEN 0x8000000aL
+#define CKM_NETSCAPE_PBE_MD2_HMAC_KEY_GEN 0x8000000bL
+
+#define CKM_TLS_PRF_GENERAL 0x80000373L
+
+/*
+ * Netscape-defined return values
+ *
+ */
+#define CKR_NETSCAPE (CKM_VENDOR_DEFINED|NSSCK_VENDOR_NETSCAPE)
+
+#define CKR_NETSCAPE_CERTDB_FAILED (CKR_NETSCAPE + 1)
+#define CKR_NETSCAPE_KEYDB_FAILED (CKR_NETSCAPE + 2)
+
+/*
+ * Trust info
+ *
+ * This isn't part of the Cryptoki standard (yet), so I'm putting
+ * all the definitions here. Some of this would move to nssckt.h
+ * if trust info were made part of the standard. In view of this
+ * possibility, I'm putting my (Netscape) values in the netscape
+ * vendor space, like everything else.
+ */
+
+typedef CK_ULONG CK_TRUST;
+
+/* The following trust types are defined: */
+#define CKT_VENDOR_DEFINED 0x80000000
+
+#define CKT_NETSCAPE (CKT_VENDOR_DEFINED|NSSCK_VENDOR_NETSCAPE)
+
+/* If trust goes standard, these'll probably drop out of vendor space. */
+#define CKT_NETSCAPE_TRUSTED (CKT_NETSCAPE + 1)
+#define CKT_NETSCAPE_TRUSTED_DELEGATOR (CKT_NETSCAPE + 2)
+#define CKT_NETSCAPE_UNTRUSTED (CKT_NETSCAPE + 3)
+#define CKT_NETSCAPE_MUST_VERIFY (CKT_NETSCAPE + 4)
+#define CKT_NETSCAPE_TRUST_UNKNOWN (CKT_NETSCAPE + 5) /* default */
+
+/*
+ * These may well remain Netscape-specific; I'm only using them
+ * to cache resolution data.
+ */
+#define CKT_NETSCAPE_VALID (CKT_NETSCAPE + 10)
+#define CKT_NETSCAPE_VALID_DELEGATOR (CKT_NETSCAPE + 11)
+
+
+#endif /* _PKCS11N_H_ */
diff --git a/module/x509-usages.h b/module/x509-usages.h
new file mode 100644
index 0000000..e06309b
--- /dev/null
+++ b/module/x509-usages.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2007 Nate Nielsen
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef _X509_USAGES_H_
+#define _X509_USAGES_H_
+
+
+#define X509_USAGE_SERVER_AUTH "1.3.6.1.5.5.7.3.1"
+#define X509_USAGE_CLIENT_AUTH "1.3.6.1.5.5.7.3.2"
+#define X509_USAGE_CODE_SIGNING "1.3.6.1.5.5.7.3.3"
+#define X509_USAGE_EMAIL "1.3.6.1.5.5.7.3.4"
+#define X509_USAGE_TIME_STAMPING "1.3.6.1.5.5.7.3.8"
+#define X509_USAGE_IPSEC_ENDPOINT "1.3.6.1.5.5.7.3.5"
+#define X509_USAGE_IPSEC_TUNNEL "1.3.6.1.5.5.7.3.6"
+#define X509_USAGE_IPSEC_USER "1.3.6.1.5.5.7.3.7"
+#define X509_USAGE_IKE_INTERMEDIATE "1.3.6.1.5.5.8.2.2"
+
+
+#define MS_USAGE_TRUST_LIST_SIGNING "1.3.6.1.4.1.311.10.3.1"
+#define MS_USAGE_TIME_STAMPING "1.3.6.1.4.1.311.10.3.2"
+#define MS_USAGE_EFS "1.3.6.1.4.1.311.10.3.4"
+#define MS_USAGE_DRIVER_VERIFICATION "1.3.6.1.4.1.311.10.3.5"
+#define MS_USAGE_SYSTEM_VERIFICATION "1.3.6.1.4.1.311.10.3.6"
+#define MS_USAGE_OEM_VERIFICATION "1.3.6.1.4.1.311.10.3.7"
+#define MS_USAGE_EMBEDDED_VERIFICATION "1.3.6.1.4.1.311.10.3.8"
+#define MS_USAGE_KEY_PACK "1.3.6.1.4.1.311.10.6.1"
+#define MS_USAGE_LICENSE_SERVER "1.3.6.1.4.1.311.10.6.2"
+#define MS_USAGE_SMART_CARD "1.3.6.1.4.1.311.20.2.2"
+#define MS_USAGE_DIGITAL_RIGHTS "1.3.6.1.4.1.311.10.5.1"
+#define MS_USAGE_QUALIFIED_SUBORDINATION "1.3.6.1.4.1.311.10.3.10"
+#define MS_USAGE_KEY_RECOVERY "1.3.6.1.4.1.311.10.3.11"
+#define MS_USAGE_DOCUMENT_SIGNING "1.3.6.1.4.1.311.10.3.12"
+#define MS_USAGE_FILE_RECOVERY "1.3.6.1.4.1.311.10.3.4.1"
+#define MS_USAGE_ROOT_SIGNER_LIST "1.3.6.1.4.1.311.10.3.9"
+#define MS_USAGE_APPLICATION_POLICIES "1.3.6.1.4.1.311.10.12.1"
+#define MS_USAGE_AD_EMAIL_REPLICATION "1.3.6.1.4.1.311.21.19"
+#define MS_USAGE_CERTIFICATE_REQUEST_AGENT "1.3.6.1.4.1.311.20.2.1"
+#define MS_USAGE_KEY_RECOVERY_AGENT "1.3.6.1.4.1.311.21.6"
+#define MS_USAGE_CA_ENCRYPTION_CERTIFICATE "1.3.6.1.4.1.311.21.5"
+#define MS_USAGE_LIFETIME_SIGNING "1.3.6.1.4.1.311.10.3.13"
+
+#endif /* _X509_USAGES_H_ */