|
1 /* |
|
2 * Copyright (c) 2004, 2011, Oracle and/or its affiliates. All rights reserved. |
|
3 */ |
|
4 |
|
5 /* crypto/engine/hw_pk11.h */ |
|
6 /* |
|
7 * This product includes software developed by the OpenSSL Project for |
|
8 * use in the OpenSSL Toolkit (http://www.openssl.org/). |
|
9 * |
|
10 * This project also referenced hw_pkcs11-0.9.7b.patch written by |
|
11 * Afchine Madjlessi. |
|
12 */ |
|
13 /* |
|
14 * ==================================================================== |
|
15 * Copyright (c) 2000-2001 The OpenSSL Project. All rights reserved. |
|
16 * |
|
17 * Redistribution and use in source and binary forms, with or without |
|
18 * modification, are permitted provided that the following conditions |
|
19 * are met: |
|
20 * |
|
21 * 1. Redistributions of source code must retain the above copyright |
|
22 * notice, this list of conditions and the following disclaimer. |
|
23 * |
|
24 * 2. Redistributions in binary form must reproduce the above copyright |
|
25 * notice, this list of conditions and the following disclaimer in |
|
26 * the documentation and/or other materials provided with the |
|
27 * distribution. |
|
28 * |
|
29 * 3. All advertising materials mentioning features or use of this |
|
30 * software must display the following acknowledgment: |
|
31 * "This product includes software developed by the OpenSSL Project |
|
32 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" |
|
33 * |
|
34 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to |
|
35 * endorse or promote products derived from this software without |
|
36 * prior written permission. For written permission, please contact |
|
37 * [email protected]. |
|
38 * |
|
39 * 5. Products derived from this software may not be called "OpenSSL" |
|
40 * nor may "OpenSSL" appear in their names without prior written |
|
41 * permission of the OpenSSL Project. |
|
42 * |
|
43 * 6. Redistributions of any form whatsoever must retain the following |
|
44 * acknowledgment: |
|
45 * "This product includes software developed by the OpenSSL Project |
|
46 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" |
|
47 * |
|
48 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY |
|
49 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
|
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
|
51 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR |
|
52 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
|
53 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
|
54 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
|
55 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
|
56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, |
|
57 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
|
58 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED |
|
59 * OF THE POSSIBILITY OF SUCH DAMAGE. |
|
60 * ==================================================================== |
|
61 * |
|
62 * This product includes cryptographic software written by Eric Young |
|
63 * ([email protected]). This product includes software written by Tim |
|
64 * Hudson ([email protected]). |
|
65 * |
|
66 */ |
|
67 |
|
68 #ifndef HW_PK11_H |
|
69 #define HW_PK11_H |
|
70 |
|
71 #include "hw_pk11_err.h" |
|
72 |
|
73 /* max byte length of a symetric key we support */ |
|
74 #define PK11_KEY_LEN_MAX 32 |
|
75 |
|
76 /* |
|
77 * This structure encapsulates all reusable information for a PKCS#11 |
|
78 * session. A list of these objects is created on behalf of the |
|
79 * calling application using an on-demand method. Each operation |
|
80 * type (see PK11_OPTYPE below) has its own per-process list. |
|
81 * Each of the lists is basically a cache for faster PKCS#11 object |
|
82 * access to avoid expensive C_Find{,Init,Final}Object() calls. |
|
83 * |
|
84 * When a new request comes in, an object will be taken from the list |
|
85 * (if there is one) or a new one is created to handle the request |
|
86 * (if the list is empty). See pk11_get_session() on how it is done. |
|
87 */ |
|
88 typedef struct PK11_st_SESSION |
|
89 { |
|
90 struct PK11_st_SESSION *next; |
|
91 CK_SESSION_HANDLE session; /* PK11 session handle */ |
|
92 pid_t pid; /* Current process ID */ |
|
93 CK_BBOOL persistent; /* is that a keystore object? */ |
|
94 union |
|
95 { |
|
96 #ifndef OPENSSL_NO_RSA |
|
97 struct |
|
98 { |
|
99 CK_OBJECT_HANDLE rsa_pub_key; /* pub handle */ |
|
100 CK_OBJECT_HANDLE rsa_priv_key; /* priv handle */ |
|
101 RSA *rsa_pub; /* pub key addr */ |
|
102 BIGNUM *rsa_n_num; /* pub modulus */ |
|
103 BIGNUM *rsa_e_num; /* pub exponent */ |
|
104 RSA *rsa_priv; /* priv key addr */ |
|
105 BIGNUM *rsa_d_num; /* priv exponent */ |
|
106 } u_RSA; |
|
107 #endif /* OPENSSL_NO_RSA */ |
|
108 #ifndef OPENSSL_NO_DSA |
|
109 struct |
|
110 { |
|
111 CK_OBJECT_HANDLE dsa_pub_key; /* pub handle */ |
|
112 CK_OBJECT_HANDLE dsa_priv_key; /* priv handle */ |
|
113 DSA *dsa_pub; /* pub key addr */ |
|
114 BIGNUM *dsa_pub_num; /* pub key */ |
|
115 DSA *dsa_priv; /* priv key addr */ |
|
116 BIGNUM *dsa_priv_num; /* priv key */ |
|
117 } u_DSA; |
|
118 #endif /* OPENSSL_NO_DSA */ |
|
119 #ifndef OPENSSL_NO_DH |
|
120 struct |
|
121 { |
|
122 CK_OBJECT_HANDLE dh_key; /* key handle */ |
|
123 DH *dh; /* dh key addr */ |
|
124 BIGNUM *dh_priv_num; /* priv dh key */ |
|
125 } u_DH; |
|
126 #endif /* OPENSSL_NO_DH */ |
|
127 struct |
|
128 { |
|
129 CK_OBJECT_HANDLE cipher_key; /* key handle */ |
|
130 unsigned char key[PK11_KEY_LEN_MAX]; |
|
131 int key_len; /* priv key len */ |
|
132 int encrypt; /* 1/0 enc/decr */ |
|
133 } u_cipher; |
|
134 } opdata_u; |
|
135 } PK11_SESSION; |
|
136 |
|
137 #define opdata_rsa_pub_key opdata_u.u_RSA.rsa_pub_key |
|
138 #define opdata_rsa_priv_key opdata_u.u_RSA.rsa_priv_key |
|
139 #define opdata_rsa_pub opdata_u.u_RSA.rsa_pub |
|
140 #define opdata_rsa_priv opdata_u.u_RSA.rsa_priv |
|
141 #define opdata_rsa_n_num opdata_u.u_RSA.rsa_n_num |
|
142 #define opdata_rsa_e_num opdata_u.u_RSA.rsa_e_num |
|
143 #define opdata_rsa_d_num opdata_u.u_RSA.rsa_d_num |
|
144 #define opdata_dsa_pub_key opdata_u.u_DSA.dsa_pub_key |
|
145 #define opdata_dsa_priv_key opdata_u.u_DSA.dsa_priv_key |
|
146 #define opdata_dsa_pub opdata_u.u_DSA.dsa_pub |
|
147 #define opdata_dsa_pub_num opdata_u.u_DSA.dsa_pub_num |
|
148 #define opdata_dsa_priv opdata_u.u_DSA.dsa_priv |
|
149 #define opdata_dsa_priv_num opdata_u.u_DSA.dsa_priv_num |
|
150 #define opdata_dh_key opdata_u.u_DH.dh_key |
|
151 #define opdata_dh opdata_u.u_DH.dh |
|
152 #define opdata_dh_priv_num opdata_u.u_DH.dh_priv_num |
|
153 #define opdata_cipher_key opdata_u.u_cipher.cipher_key |
|
154 #define opdata_key opdata_u.u_cipher.key |
|
155 #define opdata_key_len opdata_u.u_cipher.key_len |
|
156 #define opdata_encrypt opdata_u.u_cipher.encrypt |
|
157 |
|
158 /* |
|
159 * We have 3 different groups of operation types: |
|
160 * 1) asymmetric operations |
|
161 * 2) random operations |
|
162 * 3) symmetric and digest operations |
|
163 * |
|
164 * This division into groups stems from the fact that it's common that hardware |
|
165 * providers may support operations from one group only. For example, hardware |
|
166 * providers on UltraSPARC T2, n2rng(7d), ncp(7d), and n2cp(7d), each support |
|
167 * only a single group of operations. |
|
168 * |
|
169 * For every group a different slot can be chosen. That means that we must have |
|
170 * at least 3 different lists of cached PKCS#11 sessions since sessions from |
|
171 * different groups may be initialized in different slots. |
|
172 * |
|
173 * To provide locking granularity in multithreaded environment, the groups are |
|
174 * further splitted into types with each type having a separate session cache. |
|
175 */ |
|
176 typedef enum PK11_OPTYPE_ENUM |
|
177 { |
|
178 OP_RAND, |
|
179 OP_RSA, |
|
180 OP_DSA, |
|
181 OP_DH, |
|
182 OP_CIPHER, |
|
183 OP_DIGEST, |
|
184 OP_MAX |
|
185 } PK11_OPTYPE; |
|
186 |
|
187 /* |
|
188 * This structure contains the heads of the lists forming the object caches |
|
189 * and locks associated with the lists. |
|
190 */ |
|
191 typedef struct PK11_st_CACHE |
|
192 { |
|
193 PK11_SESSION *head; |
|
194 pthread_mutex_t *lock; |
|
195 } PK11_CACHE; |
|
196 |
|
197 /* structure for tracking handles of asymmetric key objects */ |
|
198 typedef struct PK11_active_st |
|
199 { |
|
200 CK_OBJECT_HANDLE h; |
|
201 unsigned int refcnt; |
|
202 struct PK11_active_st *prev; |
|
203 struct PK11_active_st *next; |
|
204 } PK11_active; |
|
205 |
|
206 extern pthread_mutex_t *find_lock[]; |
|
207 extern PK11_active *active_list[]; |
|
208 /* |
|
209 * These variables are specific for the RSA keys by reference code. See |
|
210 * hw_pk11_pub.c for explanation. |
|
211 */ |
|
212 extern char *passphrasedialog; |
|
213 extern CK_FLAGS pubkey_token_flags; |
|
214 |
|
215 #define LOCK_OBJSTORE(alg_type) \ |
|
216 (void) pthread_mutex_lock(find_lock[alg_type]) |
|
217 #define UNLOCK_OBJSTORE(alg_type) \ |
|
218 (void) pthread_mutex_unlock(find_lock[alg_type]) |
|
219 |
|
220 extern PK11_SESSION *pk11_get_session(PK11_OPTYPE optype); |
|
221 extern void pk11_return_session(PK11_SESSION *sp, PK11_OPTYPE optype); |
|
222 |
|
223 #ifndef OPENSSL_NO_RSA |
|
224 extern int pk11_destroy_rsa_key_objects(PK11_SESSION *session); |
|
225 extern int pk11_destroy_rsa_object_pub(PK11_SESSION *sp, CK_BBOOL uselock); |
|
226 extern int pk11_destroy_rsa_object_priv(PK11_SESSION *sp, CK_BBOOL uselock); |
|
227 extern EVP_PKEY *pk11_load_privkey(ENGINE *e, const char *pubkey_file, |
|
228 UI_METHOD *ui_method, void *callback_data); |
|
229 extern EVP_PKEY *pk11_load_pubkey(ENGINE *e, const char *pubkey_file, |
|
230 UI_METHOD *ui_method, void *callback_data); |
|
231 extern RSA_METHOD *PK11_RSA(void); |
|
232 #endif /* OPENSSL_NO_RSA */ |
|
233 #ifndef OPENSSL_NO_DSA |
|
234 extern int pk11_destroy_dsa_key_objects(PK11_SESSION *session); |
|
235 extern int pk11_destroy_dsa_object_pub(PK11_SESSION *sp, CK_BBOOL uselock); |
|
236 extern int pk11_destroy_dsa_object_priv(PK11_SESSION *sp, CK_BBOOL uselock); |
|
237 extern DSA_METHOD *PK11_DSA(void); |
|
238 #endif /* OPENSSL_NO_DSA */ |
|
239 #ifndef OPENSSL_NO_DH |
|
240 extern int pk11_destroy_dh_key_objects(PK11_SESSION *session); |
|
241 extern int pk11_destroy_dh_object(PK11_SESSION *sp, CK_BBOOL uselock); |
|
242 extern DH_METHOD *PK11_DH(void); |
|
243 #endif /* OPENSSL_NO_DH */ |
|
244 |
|
245 extern int pk11_engine_pkey_methods(ENGINE *e, EVP_PKEY_METHOD **pmeth, |
|
246 const int **nids, int nid); |
|
247 |
|
248 extern CK_FUNCTION_LIST_PTR pFuncList; |
|
249 |
|
250 #endif /* HW_PK11_H */ |