This patch enables the use of backspace when entering PINs
in the pkcsconf tool. It also disables any form of echoing
(e.g., stars) when keys are pressed
Tested on opensuse 11.3 only so far.
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
* Fix init_user_pin() and set_user_pin() always acting on
first slot
* Fix token initialization (and token info, slot info) by requiring
a single slot to be specified in the command-line.
* Only allow one slot specification in command-line arguments.
Also do the same for SO PIN, user PIN and new PIN
* Removed one warning from display_pkcs11_info(), plus
re-indented affected functions.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
pkcs11_startup was still looking for an old library filename in
order to determine if the CCA 4+ library is really installed or not.
This was preventing the CCA token from being properly configured in
opencryptoki 2.3 and later.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
This patch makes 3 changes to pkcsconf:
1. removes the code inside #define SHM, which appears to be a relic from a bygone era, when apps started pkcsslotd themselves
2. changes the prototype of get_slot_list(), which can be simplified now that SHM is removed
3. always return a non-zero return code to the command line
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
usr/sbin/pkcsconf/pkcsconf.c | 183 +-----------------------------------------
1 files changed, 4 insertions(+), 179 deletions(-)
This patch allows pkcsconf to return a non-zero return code when a failure occurs. This is helpful when pkcsconf is called from a script because its a simple way to test for success or failure.
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
usr/sbin/pkcsconf/pkcsconf.c | 19 ++++++++++++-------
1 files changed, 12 insertions(+), 7 deletions(-)
pkcsconf currently prints all token/slot info for every slot available. This happens even when providing -c <slot_id>. This patch makes pkcsconf print only 1 slot/token's info if -c is provided.
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
usr/sbin/pkcsconf/pkcsconf.c | 187 +++++++++++++++++++++++++-----------------
1 files changed, 113 insertions(+), 74 deletions(-)
Use p11_get_ckr() function from p11util.c to add human-readable
codes to pkcsconf error messages.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
Documentation files were scattered across different places. Consolidate
them in doc/ to make packaging easier, while avoiding collisions.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
* Create the local state directory for opencryptoki (usually
$prefix/var/lib/opencryptoki) when installing pkcs_slot.
pkcs_slot can take care of creating it on the first execution,
but creating it on 'make install' allow us to proper package
it.
* The pkcs_slot script already creates those directories
if not present, but explicitly creating them in 'make install'
allows us to better packaging
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
This patch adds the text of the mechanism type and its flags to the output of pkcsconf -m.
Old:
Mechanism #2
Mechanism: 0x131
Key Size: 24-24
Flags: 0x8001
Mechanism #3
Mechanism: 0x1
Key Size: 512-2048
Flags: 0x67B01
New:
Mechanism #2
Mechanism: 0x131 (CKM_DES3_KEY_GEN)
Key Size: 24-24
Flags: 0x8001 (CKF_HW|CKF_GENERATE)
Mechanism #3
Mechanism: 0x1 (CKM_RSA_PKCS)
Key Size: 512-2048
Flags: 0x67B01 (CKF_HW|CKF_ENCRYPT|CKF_DECRYPT|CKF_SIGN|CKF_SIGN_RECOVER|CKF_VERIFY|CKF_VERIFY_RECOVER|CKF_WRAP|CKF_UNWRAP)
Addressed Klaus Kiwi's concerns on using the mechanism and flag values from pkcs11types.h.
This patch should apply cleanly to the opencryptoki-next branch.
signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Fix minor typo in pkcsconf ouput when no slots were found.
C_GetSlotCount is in reality C_GetSlotList
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
When no option is given pkcsconf does nothing and quits silently with a zero
return code. It should output the usage information and return non-zero code.
Signed-off-by: Dan Horák <dan@danny.cz>
* master:
Fixed the pkcsslotd init script to make it return codes according to LSB specification.
Version update.
Fix wrong log message for "API already initialized" condition
Check for vendor-defined object classes
Fix public exponent attribute endianness bug
AES support included into the CCA token.
Makes pkcscca_migrate tool link dynamically to libcsulcca.so by using dlopen() instead.
Conflicts:
configure.in - took version number from master ("2.3.1")
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
Unfortunately I couldn't split this patch in a sane way, because
essentially we're rewriting configure.in here.
In summary, the main changes are:
* Use AC_ARG_ENABLE() only to enable/disable building certain parts
of the code
* Use AC_ARG_WITH() only to specify libraries that may be needed by
certain portions of the code
* All AC_ARG_ENABLE() macros comes with architecture-independent
defaults. This means that we won't be trying to guess what
features (tokens) we should or should not be building.
* All AC_ARG_WITH() macros have 'check' as the default (check for
that library in the default search path)
* IMPORTANT: Separate pkcscca_migrate from cca token build, as only
the former requires the CCA libraries to link.
* No more dependencies of what stdll can be built based on arch.
Theoretically all stdll can be built on all archs, given that
it has the relevant libraries also (we know this is not always
true, so sometimes the user needs to explicitly disable a token
with --without-FEATURE to build on certain archs)
* The (special case of) ica stdll: builds ica_s390_stdll on s390
archs while using ica_stdll on any other arch.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
Like other patches in this series, this patch avoids doing pathname
resolution at configure time by using sed to process scripts at
build time.
Also fixed to use standard directories and utilities variables
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
This patch moves the processing of usr/sbin/pkcs_slot/pkcs_slot.in
to use a sed script at build time instead of relying on configure
to process it at configure time.
Also use the right autoconf macros to try to identify where
(and what) utilities to use.
In addition, try to use standard directory variables.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
- add CCA Token support for both pkcs11_startup and pkcs_slot scripts
- pkcs11_startup cleanups:
* Fix 4758_status command pathname
* Use the same pathname for both checking and calling
the 4758_status command.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
characters are not echoed to the terminal, it is probably best to just
terminate the PIN attempt if the Backspace key is pressed and start
over in order to avoid potential human error.
performed in order to include opencryptoki into Ubuntu main, as a build
dependency for ecryptfs-utils.
* https://bugs.launchpad.net/bugs/247593
In this patch, I attempted to find all hard coded values of 2048 that
pertained to paths. I created #define'd a MAX_PATH value to 4096 and
changed all references I could find to that.
Note that this is entirely untested, though assuming it compiles, it
should be a rather simple (though comprehensive) set of changes.
Dustin Kirkland <kirkland@canonical.com>
structures padded due to alignment variations between x86_64 64bit
and 32 bit (i386) binaries.
Full path removed from pk_config_data file. Library paths added to
ld.so.conf.d files for library location.
