During a token reinitialization, to set up a SO PIN or a User PIN again,
the operation would fail mentioning that the hash of the old PIN doesn't
match the entered old PIN. This happens because during InitToken
operation we are resetting the NV data, and with this we are loosing the
hash and md5 of the old PIN.
To fix this, instead of calling init_token_data on every InitToken, we
do a load_token_data, that will check if we have a NV data already
created. If yes, it just loads it. If not, it calls init_token_data.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
On RHEL the compiler flagged 'for' loop initial declarations in macro
RETRY_START, because this is are only allowed in C99 mode.
Change the macro to use a do { ... } while (0) construct around the
for loop and declare the variable outside of the for loop.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
The check_user_and_group function checks for Root or effetive Root as
mentioned on the code comment, but the way that it is implemented it is
checking for Root AND effective Root, which is a totally different
logic.
Fix proposed by Red Hat.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
While performing RSA OpenSSL speed test it was resulting on segmentation
fault when using ICA token for RSA key lengths bigger than 512. Increased the
MAX_RSA_KEYLEN to 1920 so we are able to perform RSA speed test
successfully.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
The multi instance token support patch series also increased the
maximum number of tokens managed (NUMBER_SLOTS_MANAGED in slotmgr.h)
from 6 to 1024. The testcase gen_purpose passes a slot-id that
is supposed to be out of range to functions C_GetSlotInfo, C_GetTokenInfo,
C_GetMechanismList, and C_InitToken and expects CKR_SLOT_ID_INVALID
to be returned. With the increased number of managed slots, the
slot-id used by the testcase (i.e,. 999) is no longer out of range.
This commit changes the testcase to use slot-id 9999, so that it is
out of range again.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
For security reasons it is not a good idea to use environment variables
to pass the PKCS#11 pins to the tools. This patch changes the two EP11
related tools pkcsep11_migrate and pkcsep11_session to prompt for the
pins instead of using environment variables.
All other tools provided as part of the Opencryptoki package already
prompt for pins, so this patch makes the EP11 related tools to behave
the same way as the other tools.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Currently the strict session mode and/or VHSM mode is only
available for RW-User sessions, because the code needs to
create a special token object to store the EP11 session.
On read-only sessions token objects can not be created.
To circumvent this problem, and allow strict session mode
and/or VHSM mode also for read-only user sessions, a temporary
helper RW-USER session is created for storing the token object,
when logging in a RO-USER session. The helper session is closed
right after storing the token object.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
When vHSM mode is enabled via config option VHSM_MODE
in EP1 config file, all objects are bound to a pin blob
(obtained via m_Login) that is derived from the card pin.
That way, other EP11 token instances using the same EP11
adapters can not use objects created by this instance,
provided that each instance uses a different card pin.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
The cardpin command of pkcsep11_session allows to set a cardpin
for an EP11 token. A cardpin is required to enable the virtual
HSM (vHSM) mode.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
The pkcsep11_session performs EP11 session management functions,
such as logging out left over EP11 sessions from processes that
terminate unexpectedly, without logging out properly when strict
mode is enabled.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
When keys are used that are bound to an EP11 session, all EP11
library functions that deal with such keys may return return code
CKR_SESSION_CLOSED when the adapter where the EP11 function is routed
to does not yet know the session the key is bound to. This can happen
when new EP11 adapters come online dynamically.
The retry logic then performs a m_Login again on all available EP11
adapters, and then retries the original function.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
The EP11 session pinblob obtained from m_Login when strict
mode is enabled is passed to m_GenerateKey, m_GenerateKeyPair,
m_UnwrapKey, and m_DeriveKey functions of the EP11 library
to bind the returned key objects to the EP11 session.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
In order to allow the token specific object add routine
to use information that is anchored in the session structure,
the session needs to be passed to the token specific object
add routine.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
When strict mode is enabled via config option STRICT_MODE
in EP1 config file, use m_Login/m_Logout to login/logout
an EP11 session whenever a PKCS#11 session logs in/out.
During Login processing, the EP11 session (pinblob) is
stored in a private and hidden token object of class
CKO_HW_FEATURE with a vendor specific HW-feature type.
During Logout processing this token object is deleted.
When the program abends without performing a logout, the
EP11 session object is kept. This left over EP11 session
can then be logged out at later time using a to be
developed command line tool.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Add a void pointer field named private_data into the
SESSION structure. This allows tokens to anchor some
private session information into the session structure.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Add a new config option named "STRICT_MODE" to be specified
in the EP11 token configuration file ep11tok.conf.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Enhance the DH testcase to import a public and private DH key.
After import, the keys are used to derive a generic secret
key to ensure that imported key is usable.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Enhance the DSA testcase to import a public and private
DSA key. After import, the keys are used to sign and verify
some data to ensure that imported key is usable.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Cleanup the use of CKR_FUNCTION_FAILED return code in EP11
(and obj_mgr.c in common code). When CKR_FUNCTION_FAILED is
returned the caller usually can obtain the device error using
C_GetSessionInfo (field ulDeviceError in CK_SESSION_INFO).
After the cleanup only one error case returns CKR_FUNCTION_FAILED:
When BER handling fails (errors other than CKR_HOST_MEMORY).
Because of this, there is no need to provide a reason code
in ulDeviceError in the session info structure.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Improved the error handling during EP11 token initialization.
Any error that hinders the token from being initialized properly
now also issues a syslog message with an descriptive message.
That way users can find out what is going wrong without the need
to enable the trace and inspect the trace file.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
The EP11 CP-filter config file is is used to associate certain
control points with mechanisms that are dependent on these
control points.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
The list of mechanisms returned by C_GetMechanismList
filtered according to the CP-Filter config file. Only
those mechanisms are reported where the associated control
points are set. Also C_GetMechanismInfo will return
CKR_MECHANISM_INVALID when the mechanism to get info for
is restricted by the current control point setting.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
The list of mechanisms returned by C_GetMechanismList is
filtered using the control point settings of the used crypto
adapters.The EP11 CP-filter config file is used to
associate certain control points with mechanisms that are
dependent on these control points. The default CP-filter
config file is 'ep11cpfilter.conf' located in the same
directory as this EP11 token configuration file.
You can optionally specify the name and/or location of the
CP-filter file in the EP 11 Token Config file with keyword
CPFILTER:
CPFILTER /etc/opencryptoki/ep11cpfilter.conf
The syntax of the CP-Filter file is as follows:
cp: mech1, mech2, ...
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Add a set of functions to query the control points of EP11
cards. If the ep11 config file uses APQN_ANY, then sysfs is
used to determine all available EP11 cards.
If an APQN_WHIELIST is used, then only those cards in the
white list are used.
When the cards have different control points settings, a
warning message is issued to syslog, and the minimum
control point setting of all cards is returned.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
When option FORCE_SENSITIVE is specified in the ep11 config
file, then for secret keys (CKA_CLASS = CKO_SECRET_KEY) the
attribute CKA_SENSITIVE is set to CK_TRUE if it is not explicitly
specified in the template.
This applies to C_GenerateKey, C_GenerateKeyPair, C_UnwrapKey,
and C_DeriveKey.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Add mechanisms CKM_SHA512_224, CKM_SHA512_224_HMAC, CKM_SHA512_224_HMAC_GENERAL
CKM_SHA512_256, CKM_SHA512_256_HMAC, and CKM_SHA512_256_HMAC_GENERAL
to common code and the EP11 token.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Add mechanisms CKM_SHA224_KEY_DERIVATION, CKM_SHA384_KEY_DERIVATION,
and CKM_SHA512_KEY_DERIVATION to common code and EP11.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
The digest testcase (digest_func.c) will now also test
mechanisms CKM_SHA224, CKM_SHA224_HMAC, and
CKM_SHA224_HMAC_GENERAL.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Add mechanisms CKM_SHA224, CKM_SHA224_HMAC, and CKM_SHA224_HMAC_GENERAL
to common code, the CCA token, and the EP11 token.
Note that some SHA-2 related defines in defs.h need to be changed
to avoid a name clash. Defines for SHA-256 are named SHA2_xxx, defines
for SHA-384 are named SHA3_xxx and defines for SHA-512 are named
SHA5_xxx. The names of those defines are changed for 2 reasons:
1.) How would the defines for SHA-224 by named? SHA2_xxx is misleading here.
2.) There is already a SHA-3. So SHA3_xxx is misleading as well.
The defines are changed to SHA256_xxx, SHA384_xxx, and SHA512_xxx.
Also new defines for SHA224_xxx are added.
This change requires changes in several files where these defines are used.
Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
PKCS#11 v2.20 defines two macros (CK_TRUE and CK_FALSE) for use with
values of type CK_BBOOL. For backwards compatibility, we keep defining
TRUE and FALSE and CK_DISABLE_TRUE_VENDOR which may be set by the
application vendor.
Fix#23.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
