3
|
1 |
/*
|
7
|
2 |
* Copyright 2010 Sun Microsystems, Inc. All rights reserved.
|
3
|
3 |
* Use is subject to license terms.
|
|
4 |
*/
|
|
5 |
/*
|
|
6 |
* Redistribution and use in source and binary forms, with or without
|
|
7 |
* modification, are permitted provided that the following conditions
|
|
8 |
* are met:
|
|
9 |
*
|
|
10 |
* 1. Redistributions of source code must retain the above copyright
|
|
11 |
* notice, this list of conditions and the following disclaimer.
|
|
12 |
*
|
|
13 |
* 2. Redistributions in binary form must reproduce the above copyright
|
|
14 |
* notice, this list of conditions and the following disclaimer in
|
|
15 |
* the documentation and/or other materials provided with the
|
|
16 |
* distribution.
|
|
17 |
*
|
|
18 |
* 3. All advertising materials mentioning features or use of this
|
|
19 |
* software must display the following acknowledgment:
|
|
20 |
* "This product includes software developed by the OpenSSL Project
|
|
21 |
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
|
|
22 |
*
|
|
23 |
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
|
24 |
* endorse or promote products derived from this software without
|
|
25 |
* prior written permission. For written permission, please contact
|
|
26 |
* [email protected].
|
|
27 |
*
|
|
28 |
* 5. Products derived from this software may not be called "OpenSSL"
|
|
29 |
* nor may "OpenSSL" appear in their names without prior written
|
|
30 |
* permission of the OpenSSL Project.
|
|
31 |
*
|
|
32 |
* 6. Redistributions of any form whatsoever must retain the following
|
|
33 |
* acknowledgment:
|
|
34 |
* "This product includes software developed by the OpenSSL Project
|
|
35 |
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
|
|
36 |
*
|
|
37 |
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
|
38 |
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
39 |
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
40 |
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
|
41 |
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
42 |
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
43 |
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
|
44 |
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
45 |
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
46 |
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
47 |
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
|
48 |
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
49 |
*/
|
|
50 |
|
7
|
51 |
#pragma ident "@(#)hw_pk11_uri.c 1.2 10/02/01 SMI"
|
3
|
52 |
|
|
53 |
#include <stdio.h>
|
|
54 |
#include <stdlib.h>
|
|
55 |
#include <string.h>
|
|
56 |
#include <sys/types.h>
|
|
57 |
#include <sys/wait.h>
|
|
58 |
#include <sys/mman.h>
|
|
59 |
#include <unistd.h>
|
|
60 |
#include <strings.h>
|
|
61 |
#include <libgen.h>
|
|
62 |
#include <pthread.h>
|
|
63 |
#include <assert.h>
|
|
64 |
#include <errno.h>
|
|
65 |
|
|
66 |
#include <openssl/crypto.h>
|
|
67 |
|
|
68 |
#ifndef OPENSSL_NO_HW
|
|
69 |
#ifndef OPENSSL_NO_HW_PK11
|
|
70 |
|
|
71 |
#include <security/cryptoki.h>
|
|
72 |
#include <security/pkcs11.h>
|
|
73 |
#include "hw_pk11.h"
|
|
74 |
#include "hw_pk11_uri.h"
|
|
75 |
|
|
76 |
/*
|
|
77 |
* The keystore used is always from the pubkey slot so we need to know which one
|
|
78 |
* was selected so that we can get the information needed for the URI
|
|
79 |
* processing.
|
|
80 |
*/
|
|
81 |
extern CK_SLOT_ID pubkey_SLOTID;
|
|
82 |
extern CK_FUNCTION_LIST_PTR pFuncList;
|
|
83 |
|
|
84 |
/*
|
|
85 |
* Cached PIN so that child can use it during the re-login. Note that we do not
|
|
86 |
* cache the PIN by default.
|
|
87 |
*/
|
|
88 |
static char *token_pin;
|
|
89 |
|
|
90 |
static int mlock_pin_in_memory(char *pin);
|
|
91 |
static char *run_askpass(char *dialog);
|
|
92 |
|
|
93 |
/*
|
|
94 |
* Get the PIN. Either run the command and use its standard output as a PIN to
|
|
95 |
* fill in the PKCS11 URI structure, or read the PIN from the terminal. Using
|
|
96 |
* the external command is of higher precedence. The memory for PIN is allocated
|
|
97 |
* in this function and the PIN is always NULL terminated. The caller must take
|
|
98 |
* care of freeing the memory used for the PIN. The maximum PIN length accepted
|
|
99 |
* is PK11_MAX_PIN_LEN.
|
|
100 |
*
|
|
101 |
* The function is used also during the re-initialization of the engine after
|
|
102 |
* the fork.
|
|
103 |
*
|
|
104 |
* The function must not be called under the protection of the mutex "uri_lock"
|
|
105 |
* because the lock is acquired in the prefork function.
|
|
106 |
*
|
|
107 |
* Returns:
|
|
108 |
* 0 in case of troubles (and sets "*pin" to NULL)
|
|
109 |
* 1 if we got the PIN
|
|
110 |
*/
|
|
111 |
#define EXEC_SPEC "exec:"
|
|
112 |
#define BUILTIN_SPEC "builtin"
|
|
113 |
int
|
|
114 |
pk11_get_pin(char *dialog, char **pin)
|
|
115 |
{
|
|
116 |
/* Initialize as an error. */
|
|
117 |
*pin = NULL;
|
|
118 |
|
7
|
119 |
if (strcmp(dialog, BUILTIN_SPEC) == 0)
|
3
|
120 |
{
|
|
121 |
/* The getpassphrase() function is not MT safe. */
|
|
122 |
(void) pthread_mutex_lock(uri_lock);
|
|
123 |
/* Note that OpenSSL is not localized at all. */
|
|
124 |
*pin = getpassphrase("Enter token PIN: ");
|
|
125 |
if (*pin == NULL)
|
|
126 |
{
|
|
127 |
PK11err(PK11_F_GET_PIN, PK11_R_COULD_NOT_READ_PIN);
|
|
128 |
(void) pthread_mutex_unlock(uri_lock);
|
|
129 |
goto err;
|
|
130 |
}
|
|
131 |
else
|
|
132 |
{
|
|
133 |
char *pw;
|
|
134 |
|
|
135 |
/*
|
|
136 |
* getpassphrase() uses an internal buffer to hold the
|
|
137 |
* entered password. Note that it terminates the buffer
|
|
138 |
* with '\0'.
|
|
139 |
*/
|
|
140 |
if ((pw = strdup(*pin)) == NULL)
|
|
141 |
{
|
|
142 |
PK11err(PK11_F_GET_PIN, PK11_R_MALLOC_FAILURE);
|
|
143 |
(void) pthread_mutex_unlock(uri_lock);
|
|
144 |
goto err;
|
|
145 |
}
|
|
146 |
/* Zero the internal buffer to get rid of the PIN. */
|
|
147 |
memset(*pin, 0, strlen(*pin));
|
|
148 |
*pin = pw;
|
|
149 |
(void) pthread_mutex_unlock(uri_lock);
|
|
150 |
}
|
|
151 |
}
|
|
152 |
else
|
|
153 |
{
|
7
|
154 |
/*
|
|
155 |
* This is the "exec:" case. We will get the PIN from the output
|
|
156 |
* of an external command.
|
|
157 |
*/
|
|
158 |
if (strncmp(dialog, EXEC_SPEC, strlen(EXEC_SPEC)) == 0)
|
|
159 |
{
|
|
160 |
dialog += strlen(EXEC_SPEC);
|
|
161 |
if ((*pin = run_askpass(dialog)) == NULL)
|
|
162 |
goto err;
|
|
163 |
}
|
|
164 |
else
|
|
165 |
{
|
|
166 |
/*
|
|
167 |
* Invalid specification in the passphrasedialog
|
|
168 |
* keyword.
|
|
169 |
*/
|
|
170 |
PK11err(PK11_F_GET_PIN, PK11_R_BAD_PASSPHRASE_SPEC);
|
|
171 |
goto err;
|
|
172 |
}
|
3
|
173 |
}
|
|
174 |
|
|
175 |
return (1);
|
|
176 |
err:
|
|
177 |
return (0);
|
|
178 |
}
|
|
179 |
|
|
180 |
/*
|
|
181 |
* Process the PKCS#11 URI and get the PIN. It uses information from the
|
|
182 |
* passphrasedialog keyword to get the PIN. If passphrasedialog is not present
|
|
183 |
* it is not considered an error since it depends on the token attributes
|
|
184 |
* whether C_Login() is required. The function expects an allocated 'uri_struct'
|
|
185 |
* structure.
|
|
186 |
*
|
|
187 |
* Returns:
|
|
188 |
* 0 if URI is not valid at all, or if we could not get the PIN
|
|
189 |
* 1 if all is OK
|
|
190 |
* 2 if the URI is not the PKCS#11 URI. In that case, put the string
|
|
191 |
* pointer to the filename to "*file". Note that the pointer just points
|
|
192 |
* inside of the "uristr", possibly skipping the file:// prefix if present.
|
|
193 |
*/
|
|
194 |
int
|
|
195 |
pk11_process_pkcs11_uri(const char *uristr, pkcs11_uri *uri_struct,
|
|
196 |
const char **file)
|
|
197 |
{
|
|
198 |
char *uristr2, *l1, *l2, *tok, *name;
|
|
199 |
|
|
200 |
/* Check the "file://" case. */
|
|
201 |
if (strncmp(uristr, FILE_URI_PREFIX, strlen(FILE_URI_PREFIX)) == 0)
|
|
202 |
{
|
|
203 |
*file = uristr + strlen(FILE_URI_PREFIX);
|
|
204 |
return (2);
|
|
205 |
}
|
|
206 |
|
|
207 |
/* This is the "pkcs11:" case. */
|
|
208 |
if (strncmp(uristr, PK11_URI_PREFIX, strlen(PK11_URI_PREFIX)) != 0)
|
|
209 |
{
|
|
210 |
/* Not PKCS#11 URI at all, could be a filename. */
|
|
211 |
*file = (const char *)uristr;
|
|
212 |
return (2);
|
|
213 |
}
|
|
214 |
else
|
|
215 |
{
|
|
216 |
/* Dup the string and skip over the pkcs11: prefix then. */
|
|
217 |
uristr2 = strdup(uristr + strlen(PK11_URI_PREFIX));
|
|
218 |
if (uristr2 == NULL)
|
|
219 |
{
|
|
220 |
PK11err(PK11_F_CHECK_TOKEN_ATTRS,
|
|
221 |
PK11_R_MALLOC_FAILURE);
|
|
222 |
goto err;
|
|
223 |
}
|
|
224 |
}
|
|
225 |
|
|
226 |
/* Initialize the structure. */
|
|
227 |
memset(uri_struct, 0, sizeof (*uri_struct));
|
|
228 |
|
|
229 |
/*
|
|
230 |
* Using strtok_r() would silently skip over multiple semicolons. We
|
|
231 |
* must check that before moving on. We must also avoid ';' as the first
|
|
232 |
* and the last character in the URI.
|
|
233 |
*/
|
|
234 |
if (strstr(uristr2, ";;") != NULL || uristr2[0] == ';' ||
|
|
235 |
(strlen(uristr2) > 0 && uristr2[strlen(uristr2) - 1] == ';'))
|
|
236 |
goto bad_uri;
|
|
237 |
|
|
238 |
tok = strtok_r(uristr2, ";", &l1);
|
|
239 |
for (; tok != NULL; tok = strtok_r(NULL, ";", &l1))
|
|
240 |
{
|
|
241 |
/* "tok" is not empty so there will be something in "name". */
|
|
242 |
name = strtok_r(tok, "=", &l2);
|
|
243 |
/* Check whether there is '=' at all. */
|
|
244 |
if (l2 == NULL)
|
|
245 |
goto bad_uri;
|
|
246 |
|
|
247 |
/*
|
|
248 |
* Fill out the URI structure. We do not accept duplicit
|
|
249 |
* attributes.
|
|
250 |
*/
|
|
251 |
if (strcmp(name, PK11_TOKEN) == 0)
|
|
252 |
if (uri_struct->token == NULL)
|
|
253 |
{
|
|
254 |
if ((uri_struct->token = strdup(l2)) == NULL)
|
|
255 |
goto no_mem;
|
|
256 |
}
|
|
257 |
else
|
|
258 |
goto bad_uri;
|
|
259 |
else if (strcmp(name, PK11_MANUF) == 0)
|
|
260 |
if (uri_struct->manuf == NULL)
|
|
261 |
{
|
|
262 |
if ((uri_struct->manuf = strdup(l2)) == NULL)
|
|
263 |
goto no_mem;
|
|
264 |
}
|
|
265 |
else
|
|
266 |
goto bad_uri;
|
|
267 |
else if (strcmp(name, PK11_SERIAL) == 0)
|
|
268 |
if (uri_struct->serial == NULL)
|
|
269 |
{
|
|
270 |
if ((uri_struct->serial = strdup(l2)) == NULL)
|
|
271 |
goto no_mem;
|
|
272 |
}
|
|
273 |
else
|
|
274 |
goto bad_uri;
|
|
275 |
else if (strcmp(name, PK11_MODEL) == 0)
|
|
276 |
if (uri_struct->model == NULL)
|
|
277 |
{
|
|
278 |
if ((uri_struct->model = strdup(l2)) == NULL)
|
|
279 |
goto no_mem;
|
|
280 |
}
|
|
281 |
else
|
|
282 |
goto bad_uri;
|
|
283 |
else if (strcmp(name, PK11_OBJECT) == 0)
|
|
284 |
if (uri_struct->object == NULL)
|
|
285 |
{
|
|
286 |
if ((uri_struct->object = strdup(l2)) == NULL)
|
|
287 |
goto no_mem;
|
|
288 |
}
|
|
289 |
else
|
|
290 |
goto bad_uri;
|
|
291 |
else if (strcmp(name, PK11_OBJECTTYPE) == 0)
|
|
292 |
if (uri_struct->objecttype == NULL)
|
|
293 |
{
|
|
294 |
uri_struct->objecttype = strdup(l2);
|
|
295 |
if (uri_struct->objecttype == NULL)
|
|
296 |
goto no_mem;
|
|
297 |
}
|
|
298 |
else
|
|
299 |
goto bad_uri;
|
|
300 |
else if (strcmp(name, PK11_ASKPASS) == 0)
|
|
301 |
if (uri_struct->askpass == NULL)
|
|
302 |
{
|
|
303 |
if ((uri_struct->askpass = strdup(l2)) == NULL)
|
|
304 |
goto no_mem;
|
|
305 |
}
|
|
306 |
else
|
|
307 |
goto bad_uri;
|
|
308 |
else
|
|
309 |
goto bad_uri;
|
|
310 |
}
|
|
311 |
|
|
312 |
/* The "object" token is mandatory in the PKCS#11 URI. */
|
|
313 |
if (uri_struct->object == NULL)
|
|
314 |
{
|
|
315 |
PK11err(PK11_F_LOAD_PRIVKEY, PK11_R_MISSING_OBJECT_LABEL);
|
|
316 |
goto err;
|
|
317 |
}
|
|
318 |
|
|
319 |
free(uristr2);
|
|
320 |
return (1);
|
|
321 |
bad_uri:
|
|
322 |
PK11err(PK11_F_LOAD_PRIVKEY, PK11_R_INVALID_PKCS11_URI);
|
|
323 |
if (uristr2 != NULL)
|
|
324 |
free(uristr2);
|
|
325 |
return (0);
|
|
326 |
no_mem:
|
|
327 |
PK11err(PK11_F_LOAD_PRIVKEY, PK11_R_MALLOC_FAILURE);
|
|
328 |
err:
|
|
329 |
pk11_free_pkcs11_uri(uri_struct, CK_FALSE);
|
|
330 |
if (uristr2 != NULL)
|
|
331 |
free(uristr2);
|
|
332 |
return (0);
|
|
333 |
}
|
|
334 |
|
|
335 |
/*
|
|
336 |
* Free the PKCS11 URI structure and anything that might be inside.
|
|
337 |
*/
|
|
338 |
void
|
|
339 |
pk11_free_pkcs11_uri(pkcs11_uri *uri_struct, CK_BBOOL free_uri_itself)
|
|
340 |
{
|
|
341 |
if (uri_struct->token != NULL)
|
|
342 |
free(uri_struct->token);
|
|
343 |
if (uri_struct->manuf != NULL)
|
|
344 |
free(uri_struct->manuf);
|
|
345 |
if (uri_struct->serial != NULL)
|
|
346 |
free(uri_struct->serial);
|
|
347 |
if (uri_struct->model != NULL)
|
|
348 |
free(uri_struct->model);
|
|
349 |
if (uri_struct->object != NULL)
|
|
350 |
free(uri_struct->object);
|
|
351 |
if (uri_struct->objecttype != NULL)
|
|
352 |
free(uri_struct->objecttype);
|
|
353 |
if (uri_struct->askpass != NULL)
|
|
354 |
free(uri_struct->askpass);
|
|
355 |
|
|
356 |
if (free_uri_itself == CK_TRUE)
|
|
357 |
OPENSSL_free(uri_struct);
|
|
358 |
}
|
|
359 |
|
|
360 |
/*
|
|
361 |
* While our keystore is always the one used by the pubkey slot (which is
|
|
362 |
* usually the Metaslot) we must make sure that those URI attributes that
|
|
363 |
* specify the keystore match the real attributes of our slot keystore. Note
|
|
364 |
* that one can use the METASLOT_OBJECTSTORE_TOKEN environment variable to
|
|
365 |
* change the Metaslot's keystore from the softtoken to something else (see
|
|
366 |
* libpkcs11(3LIB)). The user might want to use such attributes in the PKCS#11
|
|
367 |
* URI to make sure that the intended keystore is used.
|
|
368 |
*
|
|
369 |
* Returns:
|
|
370 |
* 1 on success
|
|
371 |
* 0 on failure
|
|
372 |
*/
|
|
373 |
int
|
|
374 |
pk11_check_token_attrs(pkcs11_uri *uri_struct)
|
|
375 |
{
|
|
376 |
CK_RV rv;
|
|
377 |
static CK_TOKEN_INFO_PTR token_info = NULL;
|
|
378 |
|
|
379 |
(void) pthread_mutex_lock(uri_lock);
|
|
380 |
if (token_info == NULL)
|
|
381 |
{
|
|
382 |
token_info = OPENSSL_malloc(sizeof (CK_TOKEN_INFO));
|
|
383 |
if (token_info == NULL)
|
|
384 |
{
|
|
385 |
PK11err(PK11_F_CHECK_TOKEN_ATTRS,
|
|
386 |
PK11_R_MALLOC_FAILURE);
|
|
387 |
goto err;
|
|
388 |
}
|
|
389 |
|
|
390 |
rv = pFuncList->C_GetTokenInfo(pubkey_SLOTID, token_info);
|
|
391 |
if (rv != CKR_OK)
|
|
392 |
{
|
|
393 |
PK11err_add_data(PK11_F_CHECK_TOKEN_ATTRS,
|
|
394 |
PK11_R_GETTOKENINFO, rv);
|
|
395 |
goto err;
|
|
396 |
}
|
|
397 |
}
|
|
398 |
|
|
399 |
if (uri_struct->token != NULL)
|
|
400 |
if (strncmp(uri_struct->token, (char *)token_info->label,
|
|
401 |
strlen(uri_struct->token) > 32 ? 32 :
|
|
402 |
strlen(uri_struct->token)) != 0)
|
|
403 |
{
|
|
404 |
goto urierr;
|
|
405 |
}
|
|
406 |
|
|
407 |
if (uri_struct->manuf != NULL)
|
|
408 |
if (strncmp(uri_struct->manuf,
|
|
409 |
(char *)token_info->manufacturerID,
|
|
410 |
strlen(uri_struct->manuf) > 32 ? 32 :
|
|
411 |
strlen(uri_struct->manuf)) != 0)
|
|
412 |
goto urierr;
|
|
413 |
|
|
414 |
if (uri_struct->model != NULL)
|
|
415 |
if (strncmp(uri_struct->model, (char *)token_info->model,
|
|
416 |
strlen(uri_struct->model) > 16 ? 16 :
|
|
417 |
strlen(uri_struct->model)) != 0)
|
|
418 |
goto urierr;
|
|
419 |
|
|
420 |
if (uri_struct->serial != NULL)
|
|
421 |
if (strncmp(uri_struct->serial,
|
|
422 |
(char *)token_info->serialNumber,
|
|
423 |
strlen(uri_struct->serial) > 16 ? 16 :
|
|
424 |
strlen(uri_struct->serial)) != 0)
|
|
425 |
goto urierr;
|
|
426 |
|
|
427 |
(void) pthread_mutex_unlock(uri_lock);
|
|
428 |
return (1);
|
|
429 |
|
|
430 |
urierr:
|
|
431 |
PK11err(PK11_F_CHECK_TOKEN_ATTRS, PK11_R_TOKEN_ATTRS_DO_NOT_MATCH);
|
|
432 |
/* Correct error already set above for the "err" label. */
|
|
433 |
err:
|
|
434 |
(void) pthread_mutex_unlock(uri_lock);
|
|
435 |
return (0);
|
|
436 |
}
|
|
437 |
|
|
438 |
/*
|
|
439 |
* Return the process PIN caching policy. We initialize it just once so if the
|
|
440 |
* process change OPENSSL_PKCS11_PIN_CACHING_POLICY during the operation it will
|
|
441 |
* not have any affect on the policy.
|
|
442 |
*
|
|
443 |
* We assume that the "uri_lock" mutex is already locked.
|
|
444 |
*
|
|
445 |
* Returns the caching policy number.
|
|
446 |
*/
|
|
447 |
int
|
|
448 |
pk11_get_pin_caching_policy(void)
|
|
449 |
{
|
|
450 |
char *value = NULL;
|
|
451 |
static int policy = POLICY_NOT_INITIALIZED;
|
|
452 |
|
|
453 |
if (policy != POLICY_NOT_INITIALIZED)
|
|
454 |
return (policy);
|
|
455 |
|
|
456 |
value = getenv("OPENSSL_PKCS11_PIN_CACHING_POLICY");
|
|
457 |
|
|
458 |
if (value == NULL || strcmp(value, "none") == 0)
|
|
459 |
{
|
|
460 |
policy = POLICY_NONE;
|
|
461 |
goto done;
|
|
462 |
}
|
|
463 |
|
|
464 |
if (strcmp(value, "memory") == 0)
|
|
465 |
{
|
|
466 |
policy = POLICY_MEMORY;
|
|
467 |
goto done;
|
|
468 |
}
|
|
469 |
|
|
470 |
if (strcmp(value, "mlocked-memory") == 0)
|
|
471 |
{
|
|
472 |
policy = POLICY_MLOCKED_MEMORY;
|
|
473 |
goto done;
|
|
474 |
}
|
|
475 |
|
|
476 |
return (POLICY_WRONG_VALUE);
|
|
477 |
done:
|
|
478 |
return (policy);
|
|
479 |
}
|
|
480 |
|
|
481 |
/*
|
|
482 |
* Cache the PIN in memory once. We already know that we have either "memory" or
|
|
483 |
* "mlocked-memory" keyword correctly set.
|
|
484 |
*
|
|
485 |
* Returns:
|
|
486 |
* 1 on success
|
|
487 |
* 0 on failure
|
|
488 |
*/
|
|
489 |
int
|
|
490 |
pk11_cache_pin(char *pin)
|
|
491 |
{
|
|
492 |
(void) pthread_mutex_lock(uri_lock);
|
|
493 |
/* We set the PIN only once since all URIs must have it the same. */
|
|
494 |
if (token_pin != NULL)
|
|
495 |
goto ok;
|
|
496 |
|
|
497 |
if (pk11_get_pin_caching_policy() == POLICY_MEMORY)
|
|
498 |
if ((token_pin = strdup(pin)) == NULL)
|
|
499 |
{
|
|
500 |
PK11err(PK11_F_CACHE_PIN, PK11_R_MALLOC_FAILURE);
|
|
501 |
goto err;
|
|
502 |
}
|
7
|
503 |
else
|
|
504 |
if (pk11_get_pin_caching_policy() == POLICY_MLOCKED_MEMORY)
|
|
505 |
{
|
|
506 |
if (mlock_pin_in_memory(pin) == 0)
|
|
507 |
goto err;
|
|
508 |
}
|
3
|
509 |
|
|
510 |
ok:
|
|
511 |
(void) pthread_mutex_unlock(uri_lock);
|
|
512 |
return (1);
|
|
513 |
err:
|
|
514 |
(void) pthread_mutex_unlock(uri_lock);
|
|
515 |
return (0);
|
|
516 |
}
|
|
517 |
|
|
518 |
/*
|
|
519 |
* Cache the PIN in mlock(3C)ed memory. If mlock(3C) fails we will not resort to
|
|
520 |
* the normal memory caching.
|
|
521 |
*
|
|
522 |
* Note that this function must be called under the protection of the "uri_lock"
|
|
523 |
* mutex.
|
|
524 |
*
|
|
525 |
* Returns:
|
|
526 |
* 1 on success
|
|
527 |
* 0 on failure
|
|
528 |
*/
|
|
529 |
static int
|
|
530 |
mlock_pin_in_memory(char *pin)
|
|
531 |
{
|
|
532 |
void *addr = NULL;
|
|
533 |
long pagesize = 0;
|
|
534 |
|
|
535 |
/* mlock(3C) locks pages so we need one whole page for the PIN. */
|
|
536 |
if ((pagesize = sysconf(_SC_PAGESIZE)) == -1)
|
|
537 |
{
|
|
538 |
PK11err(PK11_F_MLOCK_PIN_IN_MEMORY, PK11_R_SYSCONF_FAILED);
|
|
539 |
goto err;
|
|
540 |
}
|
|
541 |
|
|
542 |
/* This will ensure we have a page aligned pointer... */
|
|
543 |
if ((addr = mmap(0, pagesize, PROT_READ | PROT_WRITE,
|
|
544 |
MAP_PRIVATE | MAP_ANON, -1, 0)) == MAP_FAILED)
|
|
545 |
{
|
|
546 |
PK11err(PK11_F_MLOCK_PIN_IN_MEMORY, PK11_R_MMAP_FAILED);
|
|
547 |
goto err;
|
|
548 |
}
|
|
549 |
|
|
550 |
/* ...because "addr" must be page aligned here. */
|
|
551 |
if (mlock(addr, pagesize) == -1)
|
|
552 |
{
|
|
553 |
/*
|
|
554 |
* Missing the PRIV_PROC_LOCK_MEMORY privilege might be a common
|
|
555 |
* problem so distinguish this situation from other issues.
|
|
556 |
*/
|
|
557 |
if (errno == EPERM)
|
|
558 |
PK11err(PK11_F_MLOCK_PIN_IN_MEMORY,
|
|
559 |
PK11_R_PRIV_PROC_LOCK_MEMORY_MISSING);
|
|
560 |
else
|
|
561 |
PK11err(PK11_F_MLOCK_PIN_IN_MEMORY,
|
|
562 |
PK11_R_MLOCK_FAILED);
|
|
563 |
|
|
564 |
/*
|
|
565 |
* We already have a problem here so there is no need to check
|
|
566 |
* that we could unmap the page. The PIN is not there yet
|
|
567 |
* anyway.
|
|
568 |
*/
|
|
569 |
(void) munmap(addr, pagesize);
|
|
570 |
goto err;
|
|
571 |
}
|
|
572 |
|
|
573 |
/* Copy the PIN to the mlocked memory. */
|
|
574 |
token_pin = (char *)addr;
|
|
575 |
strlcpy(token_pin, pin, PK11_MAX_PIN_LEN + 1);
|
|
576 |
return (1);
|
|
577 |
err:
|
|
578 |
return (0);
|
|
579 |
}
|
|
580 |
|
|
581 |
/*
|
|
582 |
* Log in to the keystore if we are supposed to do that at all. Take care of
|
|
583 |
* reading and caching the PIN etc. Log in only once even when called from
|
|
584 |
* multiple threads.
|
|
585 |
*
|
|
586 |
* Returns:
|
|
587 |
* 1 on success
|
|
588 |
* 0 on failure
|
|
589 |
*/
|
|
590 |
int
|
|
591 |
pk11_token_login(CK_SESSION_HANDLE session, CK_BBOOL *login_done,
|
|
592 |
pkcs11_uri *uri_struct, CK_BBOOL is_private)
|
|
593 |
{
|
|
594 |
CK_RV rv;
|
|
595 |
|
|
596 |
if ((pubkey_token_flags & CKF_TOKEN_INITIALIZED) == 0)
|
|
597 |
{
|
|
598 |
PK11err(PK11_F_TOKEN_LOGIN,
|
|
599 |
PK11_R_TOKEN_NOT_INITIALIZED);
|
|
600 |
goto err;
|
|
601 |
}
|
|
602 |
|
|
603 |
/*
|
|
604 |
* If login is required or needed but the PIN has not been even
|
|
605 |
* initialized we can bail out right now. Note that we are supposed to
|
|
606 |
* always log in if we are going to access private keys. However, we may
|
|
607 |
* need to log in even for accessing public keys in case that the
|
|
608 |
* CKF_LOGIN_REQUIRED flag is set.
|
|
609 |
*/
|
|
610 |
if ((pubkey_token_flags & CKF_LOGIN_REQUIRED ||
|
|
611 |
is_private == CK_TRUE) && ~pubkey_token_flags &
|
|
612 |
CKF_USER_PIN_INITIALIZED)
|
|
613 |
{
|
|
614 |
PK11err(PK11_F_TOKEN_LOGIN, PK11_R_TOKEN_PIN_NOT_SET);
|
|
615 |
goto err;
|
|
616 |
}
|
|
617 |
|
|
618 |
/*
|
|
619 |
* Note on locking: it is possible that more than one thread gets into
|
|
620 |
* pk11_get_pin() so we must deal with that. We cannot avoid it since we
|
|
621 |
* cannot guard fork() in there with a lock because we could end up in
|
|
622 |
* a dead lock in the child. Why? Remember we are in a multithreaded
|
|
623 |
* environment so we must lock all mutexes in the prefork function to
|
|
624 |
* avoid a situation in which a thread that did not call fork() held a
|
|
625 |
* lock, making future unlocking impossible. We lock right before
|
|
626 |
* C_Login().
|
|
627 |
*/
|
|
628 |
if (pubkey_token_flags & CKF_LOGIN_REQUIRED || is_private == CK_TRUE)
|
|
629 |
{
|
|
630 |
if (*login_done == CK_FALSE &&
|
|
631 |
uri_struct->askpass == NULL)
|
|
632 |
{
|
|
633 |
PK11err(PK11_F_TOKEN_LOGIN,
|
|
634 |
PK11_R_TOKEN_PIN_NOT_PROVIDED);
|
|
635 |
goto err;
|
|
636 |
}
|
|
637 |
|
|
638 |
if (*login_done == CK_FALSE &&
|
|
639 |
uri_struct->askpass != NULL)
|
|
640 |
{
|
|
641 |
if (pk11_get_pin(uri_struct->askpass,
|
|
642 |
&uri_struct->pin) == 0)
|
|
643 |
{
|
|
644 |
PK11err(PK11_F_TOKEN_LOGIN,
|
|
645 |
PK11_R_TOKEN_PIN_NOT_PROVIDED);
|
|
646 |
goto err;
|
|
647 |
}
|
|
648 |
}
|
|
649 |
|
|
650 |
/*
|
|
651 |
* Note that what we are logging into is the keystore from
|
|
652 |
* pubkey_SLOTID because we work with OP_RSA session type here.
|
|
653 |
* That also means that we can work with only one keystore in
|
|
654 |
* the engine.
|
|
655 |
*
|
|
656 |
* We must make sure we do not try to login more than once.
|
|
657 |
* Also, see the comment above on locking strategy.
|
|
658 |
*/
|
|
659 |
(void) pthread_mutex_lock(uri_lock);
|
|
660 |
if (*login_done == CK_FALSE)
|
|
661 |
{
|
|
662 |
if ((rv = pFuncList->C_Login(session,
|
|
663 |
CKU_USER, (CK_UTF8CHAR*)uri_struct->pin,
|
|
664 |
strlen(uri_struct->pin))) != CKR_OK)
|
|
665 |
{
|
|
666 |
PK11err_add_data(PK11_F_TOKEN_LOGIN,
|
|
667 |
PK11_R_TOKEN_LOGIN_FAILED, rv);
|
|
668 |
goto err_locked;
|
|
669 |
}
|
|
670 |
|
|
671 |
*login_done = CK_TRUE;
|
|
672 |
|
|
673 |
/*
|
|
674 |
* Cache the passphrasedialog for possible child (which
|
|
675 |
* would need to relogin).
|
|
676 |
*/
|
|
677 |
if (passphrasedialog == NULL &&
|
|
678 |
uri_struct->askpass != NULL)
|
|
679 |
{
|
|
680 |
passphrasedialog =
|
|
681 |
strdup(uri_struct->askpass);
|
|
682 |
|
|
683 |
if (passphrasedialog == NULL)
|
|
684 |
{
|
|
685 |
PK11err_add_data(PK11_F_TOKEN_LOGIN,
|
|
686 |
PK11_R_MALLOC_FAILURE, rv);
|
|
687 |
goto err_locked;
|
|
688 |
}
|
|
689 |
}
|
|
690 |
|
|
691 |
/*
|
|
692 |
* Check the PIN caching policy. Note that user might
|
|
693 |
* have provided a PIN even when no PIN was required -
|
|
694 |
* in that case we always remove the PIN from memory.
|
|
695 |
*/
|
|
696 |
if (pk11_get_pin_caching_policy() ==
|
|
697 |
POLICY_WRONG_VALUE)
|
|
698 |
{
|
|
699 |
PK11err(PK11_F_TOKEN_LOGIN,
|
|
700 |
PK11_R_PIN_CACHING_POLICY_INVALID);
|
|
701 |
goto err_locked;
|
|
702 |
}
|
|
703 |
|
|
704 |
if (pk11_get_pin_caching_policy() != POLICY_NONE)
|
|
705 |
if (pk11_cache_pin(uri_struct->pin) == 0)
|
|
706 |
goto err_locked;
|
|
707 |
}
|
|
708 |
(void) pthread_mutex_unlock(uri_lock);
|
|
709 |
}
|
|
710 |
else
|
|
711 |
{
|
|
712 |
/*
|
|
713 |
* If token does not require login we take it as the
|
|
714 |
* login was done.
|
|
715 |
*/
|
|
716 |
*login_done = CK_TRUE;
|
|
717 |
}
|
|
718 |
|
|
719 |
/*
|
|
720 |
* If we raced at pk11_get_pin() we must make sure that all threads that
|
|
721 |
* called pk11_get_pin() will erase the PIN from memory, not just the
|
|
722 |
* one that called C_Login(). Note that if we were supposed to cache the
|
|
723 |
* PIN it was already cached by now so filling "uri_struct.pin" with
|
|
724 |
* zero bytes is always OK since pk11_cache_pin() makes a copy of it.
|
|
725 |
*/
|
|
726 |
if (uri_struct->pin != NULL)
|
|
727 |
memset(uri_struct->pin, 0, strlen(uri_struct->pin));
|
|
728 |
|
|
729 |
return (1);
|
|
730 |
|
|
731 |
err_locked:
|
|
732 |
(void) pthread_mutex_unlock(uri_lock);
|
|
733 |
err:
|
|
734 |
/* Always get rid of the PIN. */
|
|
735 |
if (uri_struct->pin != NULL)
|
|
736 |
memset(uri_struct->pin, 0, strlen(uri_struct->pin));
|
|
737 |
return (0);
|
|
738 |
}
|
|
739 |
|
|
740 |
/*
|
|
741 |
* Log in to the keystore in the child if we were logged in in the parent. There
|
|
742 |
* are similarities in the code with pk11_token_login() but still it is quite
|
|
743 |
* different so we need a separate function for this.
|
|
744 |
*
|
|
745 |
* Note that this function is called under the locked session mutex when fork is
|
|
746 |
* detected. That means that C_Login() will be called from the child just once.
|
|
747 |
*
|
|
748 |
* Returns:
|
|
749 |
* 1 on success
|
|
750 |
* 0 on failure
|
|
751 |
*/
|
|
752 |
int
|
|
753 |
pk11_token_relogin(CK_SESSION_HANDLE session)
|
|
754 |
{
|
|
755 |
CK_RV rv;
|
|
756 |
|
|
757 |
/*
|
|
758 |
* We are in the child so check if we should login to the token again.
|
|
759 |
* Note that it is enough to log in to the token through one session
|
|
760 |
* only, all already open and all future sessions can access the token
|
|
761 |
* then.
|
|
762 |
*/
|
|
763 |
if (passphrasedialog != NULL)
|
|
764 |
{
|
|
765 |
char *pin = NULL;
|
|
766 |
|
|
767 |
/* If we cached the PIN then use it. */
|
|
768 |
if (token_pin != NULL)
|
|
769 |
pin = token_pin;
|
|
770 |
else if (pk11_get_pin(passphrasedialog, &pin) == 0)
|
|
771 |
goto err;
|
|
772 |
|
|
773 |
(void) pthread_mutex_lock(uri_lock);
|
|
774 |
if ((rv = pFuncList->C_Login(session, CKU_USER,
|
|
775 |
(CK_UTF8CHAR_PTR)pin, strlen(pin))) != CKR_OK)
|
|
776 |
{
|
|
777 |
PK11err_add_data(PK11_F_TOKEN_RELOGIN,
|
|
778 |
PK11_R_TOKEN_LOGIN_FAILED, rv);
|
|
779 |
(void) pthread_mutex_unlock(uri_lock);
|
|
780 |
goto err;
|
|
781 |
}
|
|
782 |
(void) pthread_mutex_unlock(uri_lock);
|
|
783 |
|
|
784 |
/* Forget the PIN now if we did not cache it before. */
|
|
785 |
if (pin != token_pin)
|
|
786 |
{
|
|
787 |
memset(pin, 0, strlen(pin));
|
|
788 |
OPENSSL_free(pin);
|
|
789 |
}
|
|
790 |
}
|
|
791 |
|
|
792 |
return (1);
|
|
793 |
err:
|
|
794 |
return (0);
|
|
795 |
}
|
|
796 |
|
|
797 |
/*
|
|
798 |
* This function forks and runs an external command. It would be nice if we
|
|
799 |
* could use popen(3C)/pclose(3C) for that but unfortunately we need to be able
|
|
800 |
* to get rid of the PIN from the memory. With p(open|close) function calls we
|
|
801 |
* cannot control the stdio's memory used for buffering and our tests showed
|
|
802 |
* that the PIN really stays there even after pclose().
|
|
803 |
*
|
|
804 |
* Returns:
|
|
805 |
* allocated buffer on success
|
|
806 |
* NULL on failure
|
|
807 |
*/
|
|
808 |
static char *
|
|
809 |
run_askpass(char *dialog)
|
|
810 |
{
|
|
811 |
pid_t pid;
|
|
812 |
int n, p[2];
|
|
813 |
char *buf = NULL;
|
|
814 |
|
|
815 |
if (pipe(p) == -1)
|
|
816 |
{
|
|
817 |
PK11err(PK11_F_RUN_ASKPASS, PK11_R_PIPE_FAILED);
|
|
818 |
return (NULL);
|
|
819 |
}
|
|
820 |
|
|
821 |
switch (pid = fork())
|
|
822 |
{
|
|
823 |
case -1:
|
|
824 |
PK11err(PK11_F_RUN_ASKPASS, PK11_R_FORK_FAILED);
|
|
825 |
return (NULL);
|
|
826 |
/* child */
|
|
827 |
case 0:
|
|
828 |
/*
|
|
829 |
* This should make sure that dup2() will not fail on
|
|
830 |
* file descriptor shortage.
|
|
831 |
*/
|
|
832 |
close(p[0]);
|
|
833 |
(void) dup2(p[1], 1);
|
|
834 |
close(p[1]);
|
|
835 |
/*
|
|
836 |
* Note that we cannot use PK11err() here since we are
|
|
837 |
* in the child. However, parent will get read() error
|
|
838 |
* so do not worry.
|
|
839 |
*/
|
|
840 |
(void) execl(dialog, basename(dialog), NULL);
|
|
841 |
exit(1);
|
|
842 |
/* parent */
|
|
843 |
default:
|
|
844 |
/* +1 is for the terminating '\0' */
|
|
845 |
buf = (char *)OPENSSL_malloc(PK11_MAX_PIN_LEN + 1);
|
|
846 |
if (buf == NULL)
|
|
847 |
{
|
7
|
848 |
PK11err(PK11_F_RUN_ASKPASS,
|
3
|
849 |
PK11_R_MALLOC_FAILURE);
|
|
850 |
return (NULL);
|
|
851 |
}
|
|
852 |
|
|
853 |
close(p[1]);
|
|
854 |
n = read(p[0], buf, PK11_MAX_PIN_LEN);
|
|
855 |
if (n == -1 || n == 0)
|
|
856 |
{
|
|
857 |
PK11err(PK11_F_RUN_ASKPASS,
|
|
858 |
PK11_R_PIN_NOT_READ_FROM_COMMAND);
|
|
859 |
OPENSSL_free(buf);
|
|
860 |
return (NULL);
|
|
861 |
}
|
|
862 |
buf[n] = '\0';
|
|
863 |
|
|
864 |
(void) waitpid(pid, NULL, 0);
|
7
|
865 |
}
|
3
|
866 |
|
|
867 |
return (buf);
|
|
868 |
}
|
|
869 |
|
|
870 |
#endif /* OPENSSL_NO_HW_PK11 */
|
|
871 |
#endif /* OPENSSL_NO_HW */
|