/*

 * Copyright (c) 2004, 2012, Oracle and/or its affiliates. All rights reserved.

 *

 */

/* crypto/engine/hw_pk11_pub.c */

/*

 * This product includes software developed by the OpenSSL Project for

 * use in the OpenSSL Toolkit (http://www.openssl.org/).

 *

 * This project also referenced hw_pkcs11-0.9.7b.patch written by

 * Afchine Madjlessi.

 */

/*

 * ====================================================================

 * Copyright (c) 2000-2001 The OpenSSL Project.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 *

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 *

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in

 *    the documentation and/or other materials provided with the

 *    distribution.

 *

 * 3. All advertising materials mentioning features or use of this

 *    software must display the following acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"

 *

 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

 *    endorse or promote products derived from this software without

 *    prior written permission. For written permission, please contact

 *    [email protected].

 *

 * 5. Products derived from this software may not be called "OpenSSL"

 *    nor may "OpenSSL" appear in their names without prior written

 *    permission of the OpenSSL Project.

 *

 * 6. Redistributions of any form whatsoever must retain the following

 *    acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"

 *

 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 * OF THE POSSIBILITY OF SUCH DAMAGE.

 * ====================================================================

 *

 * This product includes cryptographic software written by Eric Young

 * ([email protected]).  This product includes software written by Tim

 * Hudson ([email protected]).

 *

 */

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <sys/types.h>

#include <unistd.h>

#include <strings.h>

#include <openssl/e_os2.h>

#include <openssl/crypto.h>

#include <openssl/engine.h>

#include <openssl/dso.h>

#include <openssl/err.h>

#include <openssl/bn.h>

#include <openssl/pem.h>

#ifndef OPENSSL_NO_RSA

#include <openssl/rsa.h>

#endif /* OPENSSL_NO_RSA */

#ifndef OPENSSL_NO_DSA

#include <openssl/dsa.h>

#endif /* OPENSSL_NO_DSA */

#ifndef OPENSSL_NO_DH

#include <openssl/dh.h>

#endif /* OPENSSL_NO_DH */

#include <openssl/rand.h>

#include <openssl/objects.h>

#include <openssl/x509.h>

#include <cryptlib.h>

#include <pthread.h>

#include <libgen.h>

#ifndef OPENSSL_NO_HW

#ifndef OPENSSL_NO_HW_PK11

#include <security/cryptoki.h>

#include <security/pkcs11.h>

#include "hw_pk11.h"

#include "hw_pk11_uri.h"

static CK_BBOOL pk11_login_done = CK_FALSE;

extern CK_SLOT_ID pubkey_SLOTID;

/*

 * During the reinitialization after a detected fork we will try to login to the

 * token using the passphrasedialog keyword that we inherit from the parent.

 */

char *passphrasedialog;

#ifndef OPENSSL_NO_RSA

/* RSA stuff */

static int pk11_RSA_public_encrypt(int flen, const unsigned char *from,

	unsigned char *to, RSA *rsa, int padding);

static int pk11_RSA_private_encrypt(int flen, const unsigned char *from,

	unsigned char *to, RSA *rsa, int padding);

static int pk11_RSA_public_decrypt(int flen, const unsigned char *from,

	unsigned char *to, RSA *rsa, int padding);

static int pk11_RSA_private_decrypt(int flen, const unsigned char *from,

	unsigned char *to, RSA *rsa, int padding);

static int pk11_RSA_init(RSA *rsa);

static int pk11_RSA_finish(RSA *rsa);

static int pk11_RSA_sign(int type, const unsigned char *m, unsigned int m_len,

	unsigned char *sigret, unsigned int *siglen, const RSA *rsa);

static int pk11_RSA_verify(int dtype, const unsigned char *m,

	unsigned int m_len, unsigned char *sigbuf, unsigned int siglen,

	const RSA *rsa);

EVP_PKEY *pk11_load_privkey(ENGINE*, const char *privkey_id,

	UI_METHOD *ui_method, void *callback_data);

EVP_PKEY *pk11_load_pubkey(ENGINE*, const char *pubkey_id,

	UI_METHOD *ui_method, void *callback_data);

static int pk11_RSA_public_encrypt_low(int flen, const unsigned char *from,

	unsigned char *to, RSA *rsa);

static int pk11_RSA_private_encrypt_low(int flen, const unsigned char *from,

	unsigned char *to, RSA *rsa);

static int pk11_RSA_public_decrypt_low(int flen, const unsigned char *from,

	unsigned char *to, RSA *rsa);

static int pk11_RSA_private_decrypt_low(int flen, const unsigned char *from,

	unsigned char *to, RSA *rsa);

static CK_OBJECT_HANDLE pk11_get_public_rsa_key(RSA* rsa, PK11_SESSION *sp);

static CK_OBJECT_HANDLE pk11_get_private_rsa_key(RSA* rsa, PK11_SESSION *sp);

static int pk11_check_new_rsa_key_pub(PK11_SESSION *sp, const RSA *rsa);

static int pk11_check_new_rsa_key_priv(PK11_SESSION *sp, const RSA *rsa);

#endif

/* DSA stuff */

#ifndef OPENSSL_NO_DSA

static int pk11_DSA_init(DSA *dsa);

static int pk11_DSA_finish(DSA *dsa);

static DSA_SIG *pk11_dsa_do_sign(const unsigned char *dgst, int dlen,

	DSA *dsa);

static int pk11_dsa_do_verify(const unsigned char *dgst, int dgst_len,

	DSA_SIG *sig, DSA *dsa);

static CK_OBJECT_HANDLE pk11_get_public_dsa_key(DSA* dsa, DSA **key_ptr,

	BIGNUM **dsa_pub_num, CK_SESSION_HANDLE session);

static CK_OBJECT_HANDLE pk11_get_private_dsa_key(DSA* dsa, DSA **key_ptr,

	BIGNUM **dsa_priv_num, CK_SESSION_HANDLE session);

static int check_new_dsa_key_pub(PK11_SESSION *sp, DSA *dsa);

static int check_new_dsa_key_priv(PK11_SESSION *sp, DSA *dsa);

#endif

/* DH stuff */

#ifndef OPENSSL_NO_DH

static int pk11_DH_init(DH *dh);

static int pk11_DH_finish(DH *dh);

static int pk11_DH_generate_key(DH *dh);

static int pk11_DH_compute_key(unsigned char *key,

	const BIGNUM *pub_key, DH *dh);

static CK_OBJECT_HANDLE pk11_get_dh_key(DH* dh, DH **key_ptr,

	BIGNUM **priv_key, CK_SESSION_HANDLE session);

static int check_new_dh_key(PK11_SESSION *sp, DH *dh);

#endif

static int find_one_object(PK11_OPTYPE op, CK_SESSION_HANDLE s,

	CK_ATTRIBUTE_PTR ptempl, CK_ULONG nattr, CK_OBJECT_HANDLE_PTR pkey);

static int init_template_value(BIGNUM *bn, CK_VOID_PTR *pValue,

	CK_ULONG *ulValueLen);

static void attr_to_BN(CK_ATTRIBUTE_PTR attr, CK_BYTE attr_data[], BIGNUM **bn);

/* Read mode string to be used for fopen() */

#if SOLARIS_OPENSSL

static char *read_mode_flags = "rF";

#else

static char *read_mode_flags = "r";

#endif

/*

 * Increment existing or create a new reference for an asymmetric key PKCS#11

 * object handle in the active object list. If the operation fails, unlock (if

 * locked), set error variable and jump to the specified label. We use this list

 * so that we can track how many references to the PKCS#11 objects are used from

 * all our sessions structures. If we are replacing an object reference in the

 * session structure and the ref count for the reference being replaced gets to

 * 0 we know that we can safely free the object itself via C_ObjectDestroy().

 * See also TRY_OBJ_DESTROY.

 */

#define	KEY_HANDLE_REFHOLD(key_handle, alg_type, unlock, var, label)	\

	{								\

	if (pk11_active_add(key_handle, alg_type) < 0)			\

		{							\

		var = CK_TRUE;						\

		if (unlock)						\

			UNLOCK_OBJSTORE(alg_type);			\

		goto label;						\

		}							\

	}

/*

 * Find active list entry according to object handle and return pointer to the

 * entry otherwise return NULL.

 *

 * This function presumes it is called with lock protecting the active list

 * held.

 */

static PK11_active *pk11_active_find(CK_OBJECT_HANDLE h, PK11_OPTYPE type)

	{

	PK11_active *entry;

	for (entry = active_list[type]; entry != NULL; entry = entry->next)

		if (entry->h == h)

			return (entry);

	return (NULL);

	}

/*

 * Search for an entry in the active list using PKCS#11 object handle as a

 * search key and return refcnt of the found/created entry or -1 in case of

 * failure.

 *

 * This function presumes it is called with lock protecting the active list

 * held.

 */

int

pk11_active_add(CK_OBJECT_HANDLE h, PK11_OPTYPE type)

	{

	PK11_active *entry = NULL;

	if (h == CK_INVALID_HANDLE)

		{

		PK11err(PK11_F_ACTIVE_ADD, PK11_R_INVALID_HANDLE);

		return (-1);

		}

	/* search for entry in the active list */

	if ((entry = pk11_active_find(h, type)) != NULL)

		entry->refcnt++;

	else

		{

		/* not found, create new entry and add it to the list */

		entry = OPENSSL_malloc(sizeof (PK11_active));

		if (entry == NULL)

			{

			PK11err(PK11_F_ACTIVE_ADD, PK11_R_MALLOC_FAILURE);

			return (-1);

			}

		entry->h = h;

		entry->refcnt = 1;

		entry->prev = NULL;

		entry->next = NULL;

		/* connect the newly created entry to the list */

		if (active_list[type] == NULL)

			active_list[type] = entry;

		else /* make the entry first in the list */

			{

			entry->next = active_list[type];

			active_list[type]->prev = entry;

			active_list[type] = entry;

			}

		}

	return (entry->refcnt);

	}

/*

 * Remove active list entry from the list and free it.

 *

 * This function presumes it is called with lock protecting the active list

 * held.

 */

void

pk11_active_remove(PK11_active *entry, PK11_OPTYPE type)

	{

	PK11_active *prev_entry;

	/* remove the entry from the list and free it */

	if ((prev_entry = entry->prev) != NULL)

		{

		prev_entry->next = entry->next;

		if (entry->next != NULL)

			entry->next->prev = prev_entry;

		}

	else

		{

		active_list[type] = entry->next;

		/* we were the first but not the only one */

		if (entry->next != NULL)

			entry->next->prev = NULL;

		}

	/* sanitization */

	entry->h = CK_INVALID_HANDLE;

	entry->prev = NULL;

	entry->next = NULL;

	OPENSSL_free(entry);

	}

/* Free all entries from the active list. */

void

pk11_free_active_list(PK11_OPTYPE type)

	{

	PK11_active *entry;

	/* only for asymmetric types since only they have C_Find* locks. */

	switch (type)

		{

		case OP_RSA:

		case OP_DSA:

		case OP_DH:

			break;

		default:

			return;

		}

	/* see find_lock array definition for more info on object locking */

	LOCK_OBJSTORE(type);

	while ((entry = active_list[type]) != NULL)

		pk11_active_remove(entry, type);

	UNLOCK_OBJSTORE(type);

	}

/*

 * Search for active list entry associated with given PKCS#11 object handle,

 * decrement its refcnt and if it drops to 0, disconnect the entry and free it.

 *

 * Return 1 if the PKCS#11 object associated with the entry has no references,

 * return 0 if there is at least one reference, -1 on error.

 *

 * This function presumes it is called with lock protecting the active list

 * held.

 */

int

pk11_active_delete(CK_OBJECT_HANDLE h, PK11_OPTYPE type)

	{

	PK11_active *entry = NULL;

	if ((entry = pk11_active_find(h, type)) == NULL)

		{

		PK11err(PK11_F_ACTIVE_DELETE, PK11_R_INVALID_HANDLE);

		return (-1);

		}

	OPENSSL_assert(entry->refcnt > 0);

	entry->refcnt--;

	if (entry->refcnt == 0)

		{

		pk11_active_remove(entry, type);

		return (1);

		}

	return (0);

	}

#ifndef OPENSSL_NO_RSA

/* Our internal RSA_METHOD that we provide pointers to */

static RSA_METHOD pk11_rsa =

	{

	"PKCS#11 RSA method",

	pk11_RSA_public_encrypt,		/* rsa_pub_encrypt */

	pk11_RSA_public_decrypt,		/* rsa_pub_decrypt */

	pk11_RSA_private_encrypt,		/* rsa_priv_encrypt */

	pk11_RSA_private_decrypt,		/* rsa_priv_decrypt */

	NULL,					/* rsa_mod_exp */

	NULL,					/* bn_mod_exp */

	pk11_RSA_init,				/* init */

	pk11_RSA_finish,			/* finish */

	RSA_FLAG_SIGN_VER,			/* flags */

	NULL,					/* app_data */

	pk11_RSA_sign,				/* rsa_sign */

	pk11_RSA_verify				/* rsa_verify */

	};

RSA_METHOD *

PK11_RSA(void)

	{

	return (&pk11_rsa);

	}

#endif

#ifndef OPENSSL_NO_DSA

/* Our internal DSA_METHOD that we provide pointers to */

static DSA_METHOD pk11_dsa =

	{

	"PKCS#11 DSA method",

	pk11_dsa_do_sign, 	/* dsa_do_sign */

	NULL, 			/* dsa_sign_setup */

	pk11_dsa_do_verify, 	/* dsa_do_verify */

	NULL,			/* dsa_mod_exp */

	NULL, 			/* bn_mod_exp */

	pk11_DSA_init, 		/* init */

	pk11_DSA_finish, 	/* finish */

	0, 			/* flags */

	NULL 			/* app_data */

	};

DSA_METHOD *

PK11_DSA(void)

	{

	return (&pk11_dsa);

	}

#endif

#ifndef OPENSSL_NO_DH

/*

 * PKCS #11 V2.20, section 11.2 specifies that the number of bytes needed for

 * output buffer may somewhat exceed the precise number of bytes needed, but

 * should not exceed it by a large amount. That may be caused, for example, by

 * rounding it up to multiple of X in the underlying bignum library. 8 should be

 * enough.

 */

#define	DH_BUF_RESERVE	8

/* Our internal DH_METHOD that we provide pointers to */

static DH_METHOD pk11_dh =

	{

	"PKCS#11 DH method",

	pk11_DH_generate_key,	/* generate_key */

	pk11_DH_compute_key,	/* compute_key */

	NULL,			/* bn_mod_exp */

	pk11_DH_init,		/* init */

	pk11_DH_finish,		/* finish */

	0,			/* flags */

	NULL,			/* app_data */

	NULL			/* generate_params */

	};

DH_METHOD *

PK11_DH(void)

	{

	return (&pk11_dh);

	}

#endif

/* Size of an SSL signature: MD5+SHA1 */

#define	SSL_SIG_LENGTH		36

/* Lengths of DSA data and signature */

#define	DSA_DATA_LEN		20

#define	DSA_SIGNATURE_LEN	40

static CK_BBOOL pk11_true = CK_TRUE;

static CK_BBOOL pk11_false = CK_FALSE;

#ifndef OPENSSL_NO_RSA

/*

 * Similiar to OpenSSL to take advantage of the paddings. The goal is to

 * support all paddings in this engine although PK11 library does not

 * support all the paddings used in OpenSSL.

 * The input errors should have been checked in the padding functions.

 */

static int pk11_RSA_public_encrypt(int flen, const unsigned char *from,

		unsigned char *to, RSA *rsa, int padding)

	{

	int i, num = 0, r = -1;

	unsigned char *buf = NULL;

	num = BN_num_bytes(rsa->n);

	if ((buf = (unsigned char *)OPENSSL_malloc(num)) == NULL)

		{

		PK11err(PK11_F_RSA_PUB_ENC, PK11_R_MALLOC_FAILURE);

		goto err;

		}

	switch (padding)

		{

	case RSA_PKCS1_PADDING:

		i = RSA_padding_add_PKCS1_type_2(buf, num, from, flen);

		break;

#ifndef OPENSSL_NO_SHA

	case RSA_PKCS1_OAEP_PADDING:

		i = RSA_padding_add_PKCS1_OAEP(buf, num, from, flen, NULL, 0);

		break;

#endif

	case RSA_SSLV23_PADDING:

		i = RSA_padding_add_SSLv23(buf, num, from, flen);

		break;

	case RSA_NO_PADDING:

		i = RSA_padding_add_none(buf, num, from, flen);

		break;

	default:

		PK11err(PK11_F_RSA_PUB_ENC, PK11_R_UNKNOWN_PADDING_TYPE);

		goto err;

		}

	if (i <= 0) goto err;

	/* PK11 functions are called here */

	r = pk11_RSA_public_encrypt_low(num, buf, to, rsa);

err:

	if (buf != NULL)

		{

		OPENSSL_cleanse(buf, num);

		OPENSSL_free(buf);

		}

	return (r);

	}

/*

 * Similar to Openssl to take advantage of the paddings. The input errors

 * should be catched in the padding functions

 */

static int pk11_RSA_private_encrypt(int flen, const unsigned char *from,

	unsigned char *to, RSA *rsa, int padding)

	{

	int i, num = 0, r = -1;

	unsigned char *buf = NULL;