This man page was lacking the necessity of setting the PKCS11_USER_PIN
environment variable before executing the pkcsep11_migrate tool.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
A recent change in commit ecf145ec74
causes that no trace messages are written into the trace file.
This commit fixes the problem.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Modified ock_tests so it can run also on a specified testcase instead of running
all tests. Also made it possible to run testcases in different tokens in
parallel.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
C_FindObjectsInit has special handling for objects with
CKA_CLASS = CKO_HW_FEATURE as well as CKA_HIDDEN = TRUE.
This fix allows to find hidden HW-feature objects.
Without this fix, when CKA_HIDDEN = TRUE is found first in
the template, then CKA_CLASS = CKO_HW_FEATURE is ignored.
Also when CKA_CLASS = CKO_HW_FEATURE is found first, then
CKA_HIDDEN = TRUE is ignored. This causes that either hidden
or HW-feature objects can be searched for, but not both
together.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Allow vendor defined hardware features (those where
CK_HW_FEATURE_TYPE is >= CKH_VENDOR_DEFINED) for object
class CKO_HW_FEATURE in several template checking routines.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
The debug output in dump_shm() is missing \n at the end of the
lines. This causes unreadable debug output.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Introduce a field private_data in structure STDLL_TokData_t that allows
a token to anchor a pointer to a private control block to store all its
variables that are supposed to be global on a per token instance basis.
Instead of adding token specific fields for this purpose to the STDLL_TokData_t
structure (which is part of common code), the private_data field provides a
token implementation independent way of storing information on a per token
instance basis.
This patch also removes the EP11 specific field target_list from STDLL_TokData_t
into a EP11 specific private data block to keep STDLL_TokData_t free from any
token implementation specific fields.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
During install the tmpfiles.conf is copied together with pkcsslotd.service into
the usr/lib/systemd/system/. But we already have tmpfiles.conf as
opencryptoki.conf in the correct folder usr/lib/tmpfiles.d/. So we can remove
it.
Also fixed some documents name in spec file.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
The old (previous version 3) pkcs11_startup configuration script was still being
called and mentioned in some of the code. Removed it to fix.
There is still mentioning of pkcs11_startup in some documents, those should be
maintained.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Add packages to be installed to enable token build by default.
Now, with this configuration, the CCA, Software, ICSF and TPM
tokens will be built by default.
Signed-off-by: Paulo Vital <pvital@linux.vnet.ibm.com>
Update checkings to build tokens. Now, CCA and Software tokens
are enabled by default. The others, when checked the dependencies
and requested to build, will be enabled.
Signed-off-by: Paulo Vital <pvital@linux.vnet.ibm.com>
After the implementation of the Multi Token Instances (MTI) some
of the function signatures have changed and old patches provided
by the distros were not reflected.
This patch removes the call of the function
object_mgr_purge_private_token_objects() from the
clear_internal_structures(), since it has being called by the TPM
functions that calls clear_internal_structures().
Signed-off-by: Paulo Vital <pvital@linux.vnet.ibm.com>
The TPM token code uses some global variables to track the storage
root key, root public & private keys, and leaf public & private keys
from the TPM. These variables are not properly reinitialized during
unload and reload of the module.
Patch applied from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=603104
This patch fixes#2
Signed-off-by: David Smith <dds@google.com>
Signed-off-by: Paulo Vital <pvital@linux.vnet.ibm.com>
This changes were missing to make the implementation using locks to be able to
make use of MTI.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
The PKCS#11 standard requires the CKA_ALWAYS_AUTHENTICATE attribute
to be present in private key objects. Actually this attribute is not
set as one of the default attributes. Further, it will be rejected
when it's declared within the application defined key template.
This fix will add the CKA_ALWAYS_AUTHENTICATE attribute by default
to any private key object. The value is set to 'false'. The calling
application is free to overrule by setting the attribute value
within the key template to 'true'.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
As an alternative solution to transactional memory, the user can specify during
build time if he wants to make use of read/write locks implementation. Just
include --enable-locks in configure step.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Added some verification code to check that the opencryptoki
configuration file doesn't contain duplicate token names and
therefore overlapping token directories.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
The TOKEN_DATA structure size has been increased due to additional
information. This will break the migrate path when trying to load
older NVTOK.DAT files into shared memory.
Restore the old TOKEN_DATA layout and move master_key to
STDLL_TokData_t will solve the issue.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
The TOKEN_DATA structure size has been increased due to additional
information. This will break the migrate path when trying to load
older NVTOK.DAT files into shared memory.
Restore the old TOKEN_DATA layout and move so_pin_md5 to
STDLL_TokData_t will solve the issue.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
The TOKEN_DATA structure size has been increased due to additional
information. This will break the migrate path when trying to load
older NVTOK.DAT files into shared memory.
Restore the old TOKEN_DATA layout and move user_pin_md5 to
STDLL_TokData_t will solve the issue.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
We had moved from the deprecated _BSD_SOURCE to _DEFAULT_SOURCE, but some
distros are still running on older versions of glibc, so to avoid
incompatibility we check for the glibc and define the necessary source.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Each token gets his own lockfile. The file handle is stored in
the token individual data structure. The locking functions are
called with token individual lockfiles.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
Preparation: Move the lock_init, lock_creation functions
onto the right position, right after Tokdata instanciation.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
Preparation: Passing the Tokdata information into the login(),
destroy_object() function since it will be needed for the locking
mechanism.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
Preparation: Passing the Tokdata information into the attach(),
detach() function since it will be needed for the locking mechanism.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
The access permissions of the token directories are not set correctly
under certain circumstances. Enforce correct permissions using umask
while creating token directories.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
Increase the number of tokens that can be plugged to opencryptoki.
The new maximum number is set to 1024.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
Adapt the token library load count to consider multiple tokens that
are using the same shared token library.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
Adapt TPM token helper functions with respect to the newly
introduced token data storage.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
Adapt ICSF token helper functions with respect to the newly
introduced token data storage.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
Fix EP11 Makefile in order to pull in all required sources that are
required in case the EP11 token is the only token type at start time.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
Define dummy mech_list container in order to avoid build problems.
Internally the EP11 don't use a static mechanism list. It retrieves
the supported mechanisms from the crypto adapter directly.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
Remove EP11 mechanism list at initializatin time since this will
decrease the performance when running with a large number of tokens.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
