/*

 * Copyright (c) 2004, 2012, Oracle and/or its affiliates. All rights reserved.

 */

/* crypto/engine/hw_pk11.c */

/*

 * This product includes software developed by the OpenSSL Project for

 * use in the OpenSSL Toolkit (http://www.openssl.org/).

 *

 * This project also referenced hw_pkcs11-0.9.7b.patch written by

 * Afchine Madjlessi.

 */

/*

 * ====================================================================

 * Copyright (c) 2000-2001 The OpenSSL Project.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 *

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 *

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in

 *    the documentation and/or other materials provided with the

 *    distribution.

 *

 * 3. All advertising materials mentioning features or use of this

 *    software must display the following acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"

 *

 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

 *    endorse or promote products derived from this software without

 *    prior written permission. For written permission, please contact

 *    [email protected].

 *

 * 5. Products derived from this software may not be called "OpenSSL"

 *    nor may "OpenSSL" appear in their names without prior written

 *    permission of the OpenSSL Project.

 *

 * 6. Redistributions of any form whatsoever must retain the following

 *    acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"

 *

 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 * OF THE POSSIBILITY OF SUCH DAMAGE.

 * ====================================================================

 *

 * This product includes cryptographic software written by Eric Young

 * ([email protected]).  This product includes software written by Tim

 * Hudson ([email protected]).

 *

 */

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <sys/types.h>

#include <unistd.h>

#include <strings.h>

#include <openssl/e_os2.h>

#include <openssl/crypto.h>

#include <openssl/engine.h>

#include <openssl/dso.h>

#include <openssl/err.h>

#include <openssl/bn.h>

#include <openssl/md5.h>

#include <openssl/pem.h>

#ifndef OPENSSL_NO_RSA

#include <openssl/rsa.h>

#endif

#ifndef OPENSSL_NO_DSA

#include <openssl/dsa.h>

#endif

#ifndef OPENSSL_NO_DH

#include <openssl/dh.h>

#endif

#include <openssl/rand.h>

#include <openssl/objects.h>

#include <openssl/x509.h>

#include <openssl/aes.h>

#include <cryptlib.h>

#include <dlfcn.h>

#include <pthread.h>

#ifndef OPENSSL_NO_HW

#ifndef OPENSSL_NO_HW_PK11

/* label for debug messages printed on stderr */

#define	PK11_DBG	"PKCS#11 ENGINE DEBUG"

/* prints a lot of debug messages on stderr about slot selection process */

#undef	DEBUG_SLOT_SELECTION

/*

 * Solaris specific code. See comment at check_hw_mechanisms() for more

 * information.

 */

#if defined(__SVR4) && defined(__sun)

#define	SOLARIS_HW_SLOT_SELECTION

#endif

#ifdef	SOLARIS_HW_SLOT_SELECTION

#include <sys/auxv.h>

#endif

#ifdef DEBUG_SLOT_SELECTION

#define	DEBUG_SLOT_SEL(...) fprintf(stderr, __VA_ARGS__)

#else

#define	DEBUG_SLOT_SEL(...)

#endif

/*

 * AES counter mode is not supported in the OpenSSL EVP API yet and neither

 * there are official OIDs for mechanisms based on this mode. With our changes,

 * an application can define its own EVP calls for AES counter mode and then

 * it can make use of hardware acceleration through this engine. However, it's

 * better if we keep AES CTR support code under ifdef's.

 */

#define	SOLARIS_AES_CTR

#include <security/cryptoki.h>

#include <security/pkcs11.h>

#include "hw_pk11.h"

#include "hw_pk11_uri.h"

#define	PK11_ENGINE_LIB_NAME "PKCS#11 engine"

#include "hw_pk11_err.c"

#ifdef	SOLARIS_AES_CTR

/*

 * NIDs for AES counter mode that will be defined during the engine

 * initialization.

 */

int NID_aes_128_ctr = NID_undef;

int NID_aes_192_ctr = NID_undef;

int NID_aes_256_ctr = NID_undef;

#endif	/* SOLARIS_AES_CTR */

/*

 * We use this lock to prevent multiple C_Login()s, guard getpassphrase(),

 * uri_struct manipulation, and static token info. All of that is used by the

 * RSA keys by reference feature.

 */

pthread_mutex_t *uri_lock = NULL;

#ifdef	SOLARIS_HW_SLOT_SELECTION

/*

 * Tables for symmetric ciphers and digest mechs found in the pkcs11_kernel

 * library. See comment at check_hw_mechanisms() for more information.

 */

int *hw_cnids;

int *hw_dnids;

#endif	/* SOLARIS_HW_SLOT_SELECTION */

/* PKCS#11 session caches and their locks for all operation types */

static PK11_CACHE session_cache[OP_MAX];

/*

 * We cache the flags so that we do not have to run C_GetTokenInfo() again when

 * logging into the token.

 */

CK_FLAGS pubkey_token_flags;

/*

 * As stated in v2.20, 11.7 Object Management Function, in section for

 * C_FindObjectsInit(), at most one search operation may be active at a given

 * time in a given session. Therefore, C_Find{,Init,Final}Objects() should be

 * grouped together to form one atomic search operation. This is already

 * ensured by the property of unique PKCS#11 session handle used for each

 * PK11_SESSION object.

 *

 * This is however not the biggest concern - maintaining consistency of the

 * underlying object store is more important. The same section of the spec also

 * says that one thread can be in the middle of a search operation while another

 * thread destroys the object matching the search template which would result in

 * invalid handle returned from the search operation.

 *

 * Hence, the following locks are used for both protection of the object stores.

 * They are also used for active list protection.

 */

pthread_mutex_t *find_lock[OP_MAX] = { NULL };

/*

 * lists of asymmetric key handles which are active (referenced by at least one

 * PK11_SESSION structure, either held by a thread or present in free_session

 * list) for given algorithm type

 */

PK11_active *active_list[OP_MAX] = { NULL };

/*

 * Create all secret key objects in a global session so that they are available

 * to use for other sessions. These other sessions may be opened or closed

 * without losing the secret key objects.

 */

static CK_SESSION_HANDLE	global_session = CK_INVALID_HANDLE;

/* Index for the supported ciphers */

enum pk11_cipher_id {

	PK11_DES_CBC,

	PK11_DES3_CBC,

	PK11_DES_ECB,

	PK11_DES3_ECB,

	PK11_RC4,

	PK11_AES_128_CBC,

	PK11_AES_192_CBC,

	PK11_AES_256_CBC,

	PK11_AES_128_ECB,

	PK11_AES_192_ECB,

	PK11_AES_256_ECB,

	PK11_BLOWFISH_CBC,

#ifdef	SOLARIS_AES_CTR

	PK11_AES_128_CTR,

	PK11_AES_192_CTR,

	PK11_AES_256_CTR,

#endif	/* SOLARIS_AES_CTR */

	PK11_CIPHER_MAX

};

/* Index for the supported digests */

enum pk11_digest_id {

	PK11_MD5,

	PK11_SHA1,

	PK11_SHA224,

	PK11_SHA256,

	PK11_SHA384,

	PK11_SHA512,

	PK11_DIGEST_MAX

};

typedef struct PK11_CIPHER_st

	{

	enum pk11_cipher_id	id;

	int			nid;

	int			iv_len;

	int			min_key_len;

	int			max_key_len;

	CK_KEY_TYPE		key_type;

	CK_MECHANISM_TYPE	mech_type;

	} PK11_CIPHER;

typedef struct PK11_DIGEST_st

	{

	enum pk11_digest_id	id;

	int			nid;

	CK_MECHANISM_TYPE	mech_type;

	} PK11_DIGEST;

/* ENGINE level stuff */

static int pk11_init(ENGINE *e);

static int pk11_library_init(ENGINE *e);

static int pk11_finish(ENGINE *e);

static int pk11_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());

static int pk11_destroy(ENGINE *e);

/* RAND stuff */

static void pk11_rand_seed(const void *buf, int num);

static void pk11_rand_add(const void *buf, int num, double add_entropy);

static void pk11_rand_cleanup(void);

static int pk11_rand_bytes(unsigned char *buf, int num);

static int pk11_rand_status(void);

/* These functions are also used in other files */

PK11_SESSION *pk11_get_session(PK11_OPTYPE optype);

void pk11_return_session(PK11_SESSION *sp, PK11_OPTYPE optype);

/* active list manipulation functions used in this file */

extern int pk11_active_delete(CK_OBJECT_HANDLE h, PK11_OPTYPE type);

extern void pk11_free_active_list(PK11_OPTYPE type);

#ifndef OPENSSL_NO_RSA

int pk11_destroy_rsa_key_objects(PK11_SESSION *session);

int pk11_destroy_rsa_object_pub(PK11_SESSION *sp, CK_BBOOL uselock);

int pk11_destroy_rsa_object_priv(PK11_SESSION *sp, CK_BBOOL uselock);

#endif

#ifndef OPENSSL_NO_DSA

int pk11_destroy_dsa_key_objects(PK11_SESSION *session);

int pk11_destroy_dsa_object_pub(PK11_SESSION *sp, CK_BBOOL uselock);

int pk11_destroy_dsa_object_priv(PK11_SESSION *sp, CK_BBOOL uselock);

#endif

#ifndef OPENSSL_NO_DH

int pk11_destroy_dh_key_objects(PK11_SESSION *session);

int pk11_destroy_dh_object(PK11_SESSION *session, CK_BBOOL uselock);

#endif

/* Local helper functions */

static int pk11_free_all_sessions(void);

static int pk11_free_session_list(PK11_OPTYPE optype);

static int pk11_setup_session(PK11_SESSION *sp, PK11_OPTYPE optype);

static int pk11_destroy_cipher_key_objects(PK11_SESSION *session);

static int pk11_destroy_object(CK_SESSION_HANDLE handle, CK_OBJECT_HANDLE oh,

    CK_BBOOL persistent);

static const char *get_PK11_LIBNAME(void);

static void free_PK11_LIBNAME(void);

static long set_PK11_LIBNAME(const char *name);

/* Symmetric cipher and digest support functions */

static int cipher_nid_to_pk11(int nid);

#ifdef	SOLARIS_AES_CTR

static int pk11_add_NID(char *sn, char *ln);

static int pk11_add_aes_ctr_NIDs(void);

#endif	/* SOLARIS_AES_CTR */

static int pk11_usable_ciphers(const int **nids);

static int pk11_usable_digests(const int **nids);

static int pk11_cipher_init(EVP_CIPHER_CTX *ctx, const unsigned char *key,

	const unsigned char *iv, int enc);

static int pk11_cipher_final(PK11_SESSION *sp);

static int pk11_cipher_do_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

	const unsigned char *in, size_t inl);

static int pk11_cipher_cleanup(EVP_CIPHER_CTX *ctx);

static int pk11_engine_ciphers(ENGINE *e, const EVP_CIPHER **cipher,

	const int **nids, int nid);

static int pk11_engine_digests(ENGINE *e, const EVP_MD **digest,

	const int **nids, int nid);

static CK_OBJECT_HANDLE pk11_get_cipher_key(EVP_CIPHER_CTX *ctx,

	const unsigned char *key, CK_KEY_TYPE key_type, PK11_SESSION *sp);

static int check_new_cipher_key(PK11_SESSION *sp, const unsigned char *key,

	int key_len);

static int md_nid_to_pk11(int nid);

static int pk11_digest_init(EVP_MD_CTX *ctx);

static int pk11_digest_update(EVP_MD_CTX *ctx, const void *data,

	size_t count);

static int pk11_digest_final(EVP_MD_CTX *ctx, unsigned char *md);

static int pk11_digest_copy(EVP_MD_CTX *to, const EVP_MD_CTX *from);

static int pk11_digest_cleanup(EVP_MD_CTX *ctx);

static int pk11_choose_slots(int *any_slot_found);

static void pk11_find_symmetric_ciphers(CK_FUNCTION_LIST_PTR pflist,

    CK_SLOT_ID current_slot, int *current_slot_n_cipher,

    int *local_cipher_nids);

static void pk11_find_digests(CK_FUNCTION_LIST_PTR pflist,

    CK_SLOT_ID current_slot, int *current_slot_n_digest,

    int *local_digest_nids);

static void pk11_get_symmetric_cipher(CK_FUNCTION_LIST_PTR, int slot_id,

    int *current_slot_n_cipher, int *local_cipher_nids,

    PK11_CIPHER *cipher);

static void pk11_get_digest(CK_FUNCTION_LIST_PTR pflist, int slot_id,

    int *current_slot_n_digest, int *local_digest_nids,

    PK11_DIGEST *digest);

static int pk11_init_all_locks(void);

static void pk11_free_all_locks(void);

#ifdef	SOLARIS_HW_SLOT_SELECTION

static int check_hw_mechanisms(void);

static int nid_in_table(int nid, int *nid_table);

static int hw_aes_instruction_set_present(void);

#endif	/* SOLARIS_HW_SLOT_SELECTION */

#define	TRY_OBJ_DESTROY(sp, obj_hdl, retval, uselock, alg_type)	\

	{								\

	if (uselock)							\

		LOCK_OBJSTORE(alg_type);				\

	if (pk11_active_delete(obj_hdl, alg_type) == 1)			\

		{							\

		retval = pk11_destroy_object(sp->session, obj_hdl,	\

		    sp->persistent);					\

		}							\

	if (uselock)							\

		UNLOCK_OBJSTORE(alg_type);				\

	}

static int cipher_nids[PK11_CIPHER_MAX];

static int digest_nids[PK11_DIGEST_MAX];

static int cipher_count		= 0;

static int digest_count		= 0;

static CK_BBOOL pk11_have_rsa	= CK_FALSE;

static CK_BBOOL pk11_have_dsa	= CK_FALSE;

static CK_BBOOL pk11_have_dh	= CK_FALSE;

static CK_BBOOL pk11_have_random = CK_FALSE;

/*

 * Static list of ciphers.

 * Note, that ciphers array is indexed by member PK11_CIPHER.id,

 * thus ciphers[i].id == i

 * Rows must be kept in sync with enum pk11_cipher_id.

 */

static PK11_CIPHER ciphers[] =

	{

	{ PK11_DES_CBC,		NID_des_cbc,		8,	 8,   8,

		CKK_DES,	CKM_DES_CBC, },

	{ PK11_DES3_CBC,	NID_des_ede3_cbc,	8,	24,  24,

		CKK_DES3,	CKM_DES3_CBC, },

	{ PK11_DES_ECB,		NID_des_ecb,		0,	 8,   8,

		CKK_DES,	CKM_DES_ECB, },

	{ PK11_DES3_ECB,	NID_des_ede3_ecb,	0,	24,  24,

		CKK_DES3,	CKM_DES3_ECB, },

	{ PK11_RC4,		NID_rc4,		0,	16, 256,

		CKK_RC4,	CKM_RC4, },

	{ PK11_AES_128_CBC,	NID_aes_128_cbc,	16,	16,  16,

		CKK_AES,	CKM_AES_CBC, },

	{ PK11_AES_192_CBC,	NID_aes_192_cbc,	16,	24,  24,

		CKK_AES,	CKM_AES_CBC, },

	{ PK11_AES_256_CBC,	NID_aes_256_cbc,	16,	32,  32,

		CKK_AES,	CKM_AES_CBC, },

	{ PK11_AES_128_ECB,	NID_aes_128_ecb,	0,	16,  16,

		CKK_AES,	CKM_AES_ECB, },

	{ PK11_AES_192_ECB,	NID_aes_192_ecb,	0,	24,  24,

		CKK_AES,	CKM_AES_ECB, },

	{ PK11_AES_256_ECB,	NID_aes_256_ecb,	0,	32,  32,

		CKK_AES,	CKM_AES_ECB, },

	{ PK11_BLOWFISH_CBC,	NID_bf_cbc,		8,	16,  16,

		CKK_BLOWFISH,	CKM_BLOWFISH_CBC, },

#ifdef	SOLARIS_AES_CTR

	/* we don't know the correct NIDs until the engine is initialized */

	{ PK11_AES_128_CTR,	NID_undef,		16,	16,  16,

		CKK_AES,	CKM_AES_CTR, },

	{ PK11_AES_192_CTR,	NID_undef,		16,	24,  24,

		CKK_AES,	CKM_AES_CTR, },

	{ PK11_AES_256_CTR,	NID_undef,		16,	32,  32,

		CKK_AES,	CKM_AES_CTR, },

#endif	/* SOLARIS_AES_CTR */

	};

/*

 * Static list of digests.

 * Note, that digests array is indexed by member PK11_DIGEST.id,

 * thus digests[i].id == i

 * Rows must be kept in sync with enum pk11_digest_id.

 */

static PK11_DIGEST digests[] =

	{

	{PK11_MD5,	NID_md5,	CKM_MD5, },

	{PK11_SHA1,	NID_sha1,	CKM_SHA_1, },

	{PK11_SHA224,	NID_sha224,	CKM_SHA224, },

	{PK11_SHA256,	NID_sha256,	CKM_SHA256, },

	{PK11_SHA384,	NID_sha384,	CKM_SHA384, },

	{PK11_SHA512,	NID_sha512,	CKM_SHA512, },

	{0,		NID_undef,	0xFFFF, },

	};

/*

 * Structure to be used for the cipher_data/md_data in

 * EVP_CIPHER_CTX/EVP_MD_CTX structures in order to use the same pk11

 * session in multiple cipher_update calls

 */

typedef struct PK11_CIPHER_STATE_st

	{

	PK11_SESSION	*sp;

	} PK11_CIPHER_STATE;

/*

 * libcrypto EVP stuff - this is how we get wired to EVP so the engine gets

 * called when libcrypto requests a cipher NID.

 *

 * Note how the PK11_CIPHER_STATE is used here.

 */

/* DES CBC EVP */

static const EVP_CIPHER pk11_des_cbc =

	{

	NID_des_cbc,

	8, 8, 8,

	EVP_CIPH_CBC_MODE,

	pk11_cipher_init,

	pk11_cipher_do_cipher,

	pk11_cipher_cleanup,

	sizeof (PK11_CIPHER_STATE),

	EVP_CIPHER_set_asn1_iv,

	EVP_CIPHER_get_asn1_iv,

	NULL

	};

/* 3DES CBC EVP */

static const EVP_CIPHER pk11_3des_cbc =

	{

	NID_des_ede3_cbc,

	8, 24, 8,

	EVP_CIPH_CBC_MODE,

	pk11_cipher_init,

	pk11_cipher_do_cipher,

	pk11_cipher_cleanup,

	sizeof (PK11_CIPHER_STATE),

	EVP_CIPHER_set_asn1_iv,

	EVP_CIPHER_get_asn1_iv,

	NULL

	};

/*

 * ECB modes don't use an Initial Vector so that's why set_asn1_parameters and

 * get_asn1_parameters fields are set to NULL.

 */

static const EVP_CIPHER pk11_des_ecb =

	{

	NID_des_ecb,

	8, 8, 8,

	EVP_CIPH_ECB_MODE,

	pk11_cipher_init,

	pk11_cipher_do_cipher,

	pk11_cipher_cleanup,

	sizeof (PK11_CIPHER_STATE),

	NULL,

	NULL,

	NULL

	};

static const EVP_CIPHER pk11_3des_ecb =

	{

	NID_des_ede3_ecb,

	8, 24, 8,

	EVP_CIPH_ECB_MODE,

	pk11_cipher_init,

	pk11_cipher_do_cipher,

	pk11_cipher_cleanup,

	sizeof (PK11_CIPHER_STATE),

	NULL,

	NULL,

	NULL

	};