780 lines
23 KiB
C
780 lines
23 KiB
C
|
/*
|
||
|
|
* Copyright Copyright 2003 Sun Microsystems, Inc. All rights reserved.
|
||
|
|
* Use is subject to license terms specified in the COPYING file
|
||
|
|
* distributed with the Net-SNMP package.
|
||
|
|
*/
|
||
|
|
|
||
|
|
/*
|
||
|
|
* pkcs.c
|
||
|
|
*/
|
||
|
|
|
||
|
|
#include <net-snmp/net-snmp-config.h>
|
||
|
|
#ifdef NETSNMP_USE_PKCS11
|
||
|
|
#include <net-snmp/types.h>
|
||
|
|
#include <net-snmp/output_api.h>
|
||
|
|
#include <net-snmp/config_api.h>
|
||
|
|
#include <net-snmp/library/snmp_api.h>
|
||
|
|
#include <net-snmp/library/tools.h>
|
||
|
|
#include <net-snmp/library/keytools.h>
|
||
|
|
#include <net-snmp/library/scapi.h>
|
||
|
|
#include <net-snmp/library/callback.h>
|
||
|
|
#include <security/cryptoki.h>
|
||
|
|
|
||
|
|
typedef struct netsnmp_pkcs_slot_session_s {
|
||
|
|
CK_SLOT_ID sid;
|
||
|
|
CK_SESSION_HANDLE hdl;
|
||
|
|
} netsnmp_pkcs_slot_session;
|
||
|
|
|
||
|
|
typedef struct netsnmp_pkcs_slot_info_s {
|
||
|
|
int count;
|
||
|
|
netsnmp_pkcs_slot_session *pSession;
|
||
|
|
} netsnmp_pkcs_slot_info;
|
||
|
|
|
||
|
|
static CK_RV get_session_handle(CK_MECHANISM_TYPE, CK_FLAGS,\
|
||
|
|
CK_SESSION_HANDLE_PTR);
|
||
|
|
static CK_RV get_slot_session_handle(netsnmp_pkcs_slot_session *,\
|
||
|
|
CK_SESSION_HANDLE_PTR);
|
||
|
|
static char *pkcserr_string(CK_RV);
|
||
|
|
static int free_slots(int, int, void *, void *);
|
||
|
|
|
||
|
|
static netsnmp_pkcs_slot_info *pSlot = NULL;
|
||
|
|
|
||
|
|
/*
|
||
|
|
* initialize the Cryptoki library.
|
||
|
|
*/
|
||
|
|
int
|
||
|
|
pkcs_init(void)
|
||
|
|
{
|
||
|
|
CK_RV rv;
|
||
|
|
CK_ULONG slotcount;
|
||
|
|
CK_SLOT_ID_PTR pSlotList = NULL;
|
||
|
|
netsnmp_pkcs_slot_session *tmp;
|
||
|
|
int i, rval = SNMPERR_SUCCESS;
|
||
|
|
/* Initialize pkcs */
|
||
|
|
if ((rv = C_Initialize(NULL)) != CKR_OK) {
|
||
|
|
DEBUGMSGTL(("pkcs_init", "C_Initialize failed: %s",
|
||
|
|
pkcserr_string(rv)));
|
||
|
|
return SNMPERR_SC_NOT_CONFIGURED;
|
||
|
|
}
|
||
|
|
|
||
|
|
/* Get slot count */
|
||
|
|
rv = C_GetSlotList(1, NULL_PTR, &slotcount);
|
||
|
|
if (rv != CKR_OK || slotcount == 0) {
|
||
|
|
DEBUGMSGTL(("pkcs_init", "C_GetSlotList failed: %s",
|
||
|
|
pkcserr_string(rv)));
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_init_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* Found at least one slot, allocate memory for slot list */
|
||
|
|
pSlotList = malloc(slotcount * sizeof (CK_SLOT_ID));
|
||
|
|
pSlot = malloc(sizeof (netsnmp_pkcs_slot_info));
|
||
|
|
pSlot->pSession = malloc(slotcount * sizeof (netsnmp_pkcs_slot_session));
|
||
|
|
|
||
|
|
if (pSlotList == NULL_PTR ||
|
||
|
|
pSlot == NULL_PTR ||
|
||
|
|
pSlot->pSession == NULL_PTR) {
|
||
|
|
DEBUGMSGTL(("pkcs_init","malloc failed."));
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_init_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* Get the list of slots */
|
||
|
|
if ((rv = C_GetSlotList(1, pSlotList, &slotcount)) != CKR_OK) {
|
||
|
|
DEBUGMSGTL(("pkcs_init", "C_GetSlotList failed: %s",
|
||
|
|
pkcserr_string(rv)));
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_init_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* initialize Slots structure */
|
||
|
|
pSlot->count = slotcount;
|
||
|
|
for (i = 0, tmp = pSlot->pSession; i < slotcount; i++, tmp++) {
|
||
|
|
tmp->sid = pSlotList[i];
|
||
|
|
tmp->hdl = NULL;
|
||
|
|
}
|
||
|
|
|
||
|
|
snmp_register_callback(SNMP_CALLBACK_LIBRARY, SNMP_CALLBACK_SHUTDOWN,
|
||
|
|
free_slots, NULL);
|
||
|
|
|
||
|
|
pkcs_init_quit:
|
||
|
|
SNMP_FREE(pSlotList);
|
||
|
|
return rval;
|
||
|
|
}
|
||
|
|
|
||
|
|
/*
|
||
|
|
* close all the opened sessions when finished with Cryptoki library.
|
||
|
|
*/
|
||
|
|
static int
|
||
|
|
free_slots(int majorID, int minorID, void *serverarg, void *clientarg)
|
||
|
|
{
|
||
|
|
int slotcount, i;
|
||
|
|
|
||
|
|
if (pSlot != NULL) {
|
||
|
|
slotcount = pSlot->count;
|
||
|
|
for (i = 0; i < slotcount; i++) {
|
||
|
|
if (pSlot->pSession->hdl != NULL) {
|
||
|
|
free(pSlot->pSession->hdl);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
free(pSlot);
|
||
|
|
}
|
||
|
|
|
||
|
|
(void) C_Finalize(NULL);
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
/*
|
||
|
|
* generate random data
|
||
|
|
*/
|
||
|
|
int
|
||
|
|
pkcs_random(u_char * buf, size_t buflen)
|
||
|
|
{
|
||
|
|
CK_SESSION_HANDLE hSession;
|
||
|
|
|
||
|
|
if (pSlot != NULL &&
|
||
|
|
get_slot_session_handle(pSlot->pSession, &hSession) == CKR_OK &&
|
||
|
|
C_GenerateRandom(hSession, buf, buflen) == CKR_OK) {
|
||
|
|
return SNMPERR_SUCCESS;
|
||
|
|
}
|
||
|
|
|
||
|
|
return SNMPERR_GENERR;
|
||
|
|
}
|
||
|
|
|
||
|
|
/*
|
||
|
|
* retrieve the session handle from the first slot that supports the specified
|
||
|
|
* mechanism.
|
||
|
|
*/
|
||
|
|
static CK_RV
|
||
|
|
get_session_handle(CK_MECHANISM_TYPE mech_type, CK_FLAGS flag,
|
||
|
|
CK_SESSION_HANDLE_PTR sess)
|
||
|
|
{
|
||
|
|
CK_RV rv = CKR_OK;
|
||
|
|
CK_MECHANISM_INFO info;
|
||
|
|
netsnmp_pkcs_slot_session *p = NULL;
|
||
|
|
int i, slotcount = 0;
|
||
|
|
|
||
|
|
if (pSlot) {
|
||
|
|
slotcount = pSlot->count;
|
||
|
|
p = pSlot->pSession;
|
||
|
|
}
|
||
|
|
|
||
|
|
/* Find a slot with matching mechanism */
|
||
|
|
for (i = 0; i < slotcount; i++, p++) {
|
||
|
|
rv = C_GetMechanismInfo(p->sid, mech_type, &info);
|
||
|
|
|
||
|
|
if (rv != CKR_OK) {
|
||
|
|
continue; /* to the next slot */
|
||
|
|
} else {
|
||
|
|
if (info.flags & flag) {
|
||
|
|
rv = get_slot_session_handle(p, sess);
|
||
|
|
break; /* found */
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* Show error if no matching mechanism found */
|
||
|
|
if (i == slotcount) {
|
||
|
|
DEBUGMSGTL(("pkcs_init","No cryptographic provider for %s",
|
||
|
|
mech_type));
|
||
|
|
return CKR_SESSION_HANDLE_INVALID;
|
||
|
|
}
|
||
|
|
|
||
|
|
return rv;
|
||
|
|
}
|
||
|
|
|
||
|
|
/*
|
||
|
|
* retrieve the session handle from the specified slot.
|
||
|
|
*/
|
||
|
|
static CK_RV
|
||
|
|
get_slot_session_handle(netsnmp_pkcs_slot_session *p,
|
||
|
|
CK_SESSION_HANDLE_PTR sess)
|
||
|
|
{
|
||
|
|
CK_RV rv = CKR_OK;
|
||
|
|
if (p == NULL) {
|
||
|
|
*sess = NULL;
|
||
|
|
return CKR_SESSION_HANDLE_INVALID;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (p->hdl == NULL) {
|
||
|
|
/* Open a session */
|
||
|
|
rv = C_OpenSession(p->sid, CKF_SERIAL_SESSION,
|
||
|
|
NULL_PTR, NULL, &p->hdl);
|
||
|
|
|
||
|
|
if (rv != CKR_OK) {
|
||
|
|
DEBUGMSGTL(("get_slot_session_handle","can not open PKCS #11 session: %s",
|
||
|
|
pkcserr_string(rv)));
|
||
|
|
}
|
||
|
|
}
|
||
|
|
*sess = p->hdl;
|
||
|
|
|
||
|
|
return rv;
|
||
|
|
}
|
||
|
|
|
||
|
|
/*
|
||
|
|
* perform a signature operation to generate MAC.
|
||
|
|
*/
|
||
|
|
int
|
||
|
|
pkcs_sign(CK_MECHANISM_TYPE mech_type, u_char * key, u_int keylen,
|
||
|
|
u_char * msg, u_int msglen, u_char * mac, size_t * maclen)
|
||
|
|
{
|
||
|
|
/*
|
||
|
|
* Key template
|
||
|
|
*/
|
||
|
|
CK_OBJECT_CLASS class = CKO_SECRET_KEY;
|
||
|
|
CK_KEY_TYPE keytype = CKK_GENERIC_SECRET;
|
||
|
|
CK_BBOOL truevalue = TRUE;
|
||
|
|
CK_BBOOL falsevalue= FALSE;
|
||
|
|
CK_ATTRIBUTE template[] = {
|
||
|
|
{CKA_CLASS, &class, sizeof (class)},
|
||
|
|
{CKA_KEY_TYPE, &keytype, sizeof (keytype)},
|
||
|
|
{CKA_SIGN, &truevalue, sizeof (truevalue)},
|
||
|
|
{CKA_TOKEN, &falsevalue, sizeof (falsevalue)},
|
||
|
|
{CKA_VALUE, key, keylen}
|
||
|
|
};
|
||
|
|
CK_SESSION_HANDLE hSession;
|
||
|
|
CK_MECHANISM mech;
|
||
|
|
CK_OBJECT_HANDLE hkey = (CK_OBJECT_HANDLE) 0;
|
||
|
|
int rval = SNMPERR_SUCCESS;
|
||
|
|
if (get_session_handle(mech_type, CKF_SIGN, &hSession) != CKR_OK ||
|
||
|
|
hSession == NULL) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_sign_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* create a key object */
|
||
|
|
if (C_CreateObject(hSession, template,
|
||
|
|
(sizeof (template) / sizeof (CK_ATTRIBUTE)), &hkey) != CKR_OK) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_sign_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
mech.mechanism = mech_type;
|
||
|
|
mech.pParameter = NULL_PTR;
|
||
|
|
mech.ulParameterLen = 0;
|
||
|
|
|
||
|
|
/* initialize a signature operation */
|
||
|
|
if (C_SignInit(hSession, &mech, hkey) != CKR_OK ) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_sign_quit);
|
||
|
|
}
|
||
|
|
/* continue a multiple-part signature operation */
|
||
|
|
if (C_SignUpdate(hSession, msg, msglen) != CKR_OK) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_sign_quit);
|
||
|
|
}
|
||
|
|
/* finish a multiple-part signature operation */
|
||
|
|
if (C_SignFinal(hSession, mac, maclen) != CKR_OK) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_sign_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
pkcs_sign_quit:
|
||
|
|
|
||
|
|
if (key != (CK_OBJECT_HANDLE) 0) {
|
||
|
|
(void) C_DestroyObject(hSession, hkey);
|
||
|
|
}
|
||
|
|
return rval;
|
||
|
|
}
|
||
|
|
|
||
|
|
/*
|
||
|
|
* perform a message-digesting operation.
|
||
|
|
*/
|
||
|
|
int
|
||
|
|
pkcs_digest(CK_MECHANISM_TYPE mech_type, u_char * msg, u_int msglen,
|
||
|
|
u_char * digest, size_t * digestlen)
|
||
|
|
{
|
||
|
|
int rval = SNMPERR_SUCCESS;
|
||
|
|
CK_SESSION_HANDLE hSession;
|
||
|
|
CK_MECHANISM mech;
|
||
|
|
if (get_session_handle(mech_type, CKF_DIGEST, &hSession) != CKR_OK ||
|
||
|
|
hSession == NULL) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_digest_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
mech.mechanism = mech_type;
|
||
|
|
mech.pParameter = NULL_PTR;
|
||
|
|
mech.ulParameterLen = 0;
|
||
|
|
|
||
|
|
/* initialize a message-digesting operation */
|
||
|
|
if (C_DigestInit(hSession, &mech)!= CKR_OK ) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_digest_quit);
|
||
|
|
}
|
||
|
|
/* continue a multiple-part message-digesting operation */
|
||
|
|
if (C_DigestUpdate(hSession, msg, msglen) != CKR_OK ) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_digest_quit);
|
||
|
|
}
|
||
|
|
/* finish a multiple-part message-digesting operation */
|
||
|
|
if (C_DigestFinal(hSession, digest, digestlen) != CKR_OK) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_digest_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
pkcs_digest_quit:
|
||
|
|
return rval;
|
||
|
|
}
|
||
|
|
|
||
|
|
/*
|
||
|
|
* encrypt plaintext into ciphertext using key and iv.
|
||
|
|
*/
|
||
|
|
int
|
||
|
|
pkcs_encrpyt(CK_MECHANISM_TYPE mech_type, u_char * key, u_int keylen,
|
||
|
|
u_char * iv, u_int ivlen,
|
||
|
|
u_char * plaintext, u_int ptlen,
|
||
|
|
u_char * ciphertext, size_t * ctlen)
|
||
|
|
{
|
||
|
|
int rval = SNMPERR_SUCCESS;
|
||
|
|
int pad_size, offset;
|
||
|
|
/*
|
||
|
|
* Key template
|
||
|
|
*/
|
||
|
|
CK_OBJECT_CLASS class = CKO_SECRET_KEY;
|
||
|
|
CK_KEY_TYPE keytype = CKK_DES;
|
||
|
|
/* CK_KEY_TYPE AESkeytype = CKK_AES; */
|
||
|
|
CK_BBOOL truevalue = TRUE;
|
||
|
|
CK_BBOOL falsevalue = FALSE;
|
||
|
|
|
||
|
|
CK_ATTRIBUTE template[] = {
|
||
|
|
{CKA_CLASS, &class, sizeof (class)},
|
||
|
|
{CKA_KEY_TYPE, &keytype, sizeof (keytype)},
|
||
|
|
{CKA_ENCRYPT, &truevalue, sizeof (truevalue)},
|
||
|
|
{CKA_TOKEN, &falsevalue, sizeof (falsevalue)},
|
||
|
|
{CKA_VALUE, key, keylen}
|
||
|
|
};
|
||
|
|
|
||
|
|
CK_SESSION_HANDLE hSession;
|
||
|
|
CK_MECHANISM mech;
|
||
|
|
CK_OBJECT_HANDLE hkey = (CK_OBJECT_HANDLE) 0;
|
||
|
|
|
||
|
|
if (get_session_handle(mech_type, CKF_ENCRYPT,
|
||
|
|
&hSession) != CKR_OK ||
|
||
|
|
hSession == NULL) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_encrypt_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
if (C_CreateObject(hSession, template,
|
||
|
|
(sizeof (template) / sizeof (CK_ATTRIBUTE)),
|
||
|
|
&hkey) != CKR_OK) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_encrypt_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
mech.mechanism = mech_type;
|
||
|
|
mech.pParameter = iv;
|
||
|
|
mech.ulParameterLen = ivlen;
|
||
|
|
|
||
|
|
/* initialize an encryption operation */
|
||
|
|
if (C_EncryptInit(hSession, &mech, hkey) != CKR_OK ) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_encrypt_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
/* for DES */
|
||
|
|
pad_size = BYTESIZE(SNMP_TRANS_PRIVLEN_1DES);
|
||
|
|
|
||
|
|
if (ptlen + pad_size - ptlen % pad_size > *ctlen) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_encrypt_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
for (offset = 0; offset < ptlen; offset += pad_size) {
|
||
|
|
/* continue a multiple-part encryption operation */
|
||
|
|
if (C_EncryptUpdate(hSession, plaintext + offset, pad_size,
|
||
|
|
ciphertext + offset, ctlen) != CKR_OK) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_encrypt_quit);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/* finish a multiple-part encryption operation */
|
||
|
|
if (C_EncryptFinal(hSession, ciphertext + offset, ctlen) != CKR_OK) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_encrypt_quit);
|
||
|
|
}
|
||
|
|
*ctlen = offset;
|
||
|
|
|
||
|
|
pkcs_encrypt_quit:
|
||
|
|
if (key != (CK_OBJECT_HANDLE) 0) {
|
||
|
|
(void) C_DestroyObject(hSession, hkey);
|
||
|
|
}
|
||
|
|
return rval;
|
||
|
|
}
|
||
|
|
|
||
|
|
/*
|
||
|
|
* decrypt ciphertext into plaintext using key and iv.
|
||
|
|
*/
|
||
|
|
int
|
||
|
|
pkcs_decrpyt(CK_MECHANISM_TYPE mech_type, u_char * key, u_int keylen,
|
||
|
|
u_char * iv, u_int ivlen,
|
||
|
|
u_char * ciphertext, u_int ctlen,
|
||
|
|
u_char * plaintext, size_t * ptlen)
|
||
|
|
{
|
||
|
|
int rval = SNMPERR_SUCCESS;
|
||
|
|
/*
|
||
|
|
* Key template
|
||
|
|
*/
|
||
|
|
CK_OBJECT_CLASS class = CKO_SECRET_KEY;
|
||
|
|
CK_KEY_TYPE keytype = CKK_DES;
|
||
|
|
/* CK_KEY_TYPE AESkeytype = CKK_AES; */
|
||
|
|
CK_BBOOL truevalue = TRUE;
|
||
|
|
CK_BBOOL falsevalue= FALSE;
|
||
|
|
CK_ATTRIBUTE template[] = {
|
||
|
|
{CKA_CLASS, &class, sizeof (class)},
|
||
|
|
{CKA_KEY_TYPE, &keytype, sizeof (keytype)},
|
||
|
|
{CKA_DECRYPT, &truevalue, sizeof (truevalue)},
|
||
|
|
{CKA_TOKEN, &falsevalue, sizeof (falsevalue)},
|
||
|
|
{CKA_VALUE, key, keylen}
|
||
|
|
};
|
||
|
|
CK_SESSION_HANDLE hSession;
|
||
|
|
CK_MECHANISM mech;
|
||
|
|
CK_OBJECT_HANDLE hkey = (CK_OBJECT_HANDLE) 0;
|
||
|
|
|
||
|
|
if (get_session_handle(mech_type, CKF_DECRYPT, &hSession) != CKR_OK ||
|
||
|
|
hSession == NULL) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_decrypt_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
if (C_CreateObject(hSession, template,
|
||
|
|
(sizeof (template) / sizeof (CK_ATTRIBUTE)), &hkey) != CKR_OK) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_decrypt_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
mech.mechanism = mech_type;
|
||
|
|
mech.pParameter = iv;
|
||
|
|
mech.ulParameterLen = ivlen;
|
||
|
|
|
||
|
|
/* initialize a decryption operation */
|
||
|
|
if (C_DecryptInit(hSession, &mech, hkey) != CKR_OK ) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_decrypt_quit);
|
||
|
|
}
|
||
|
|
/* continue a multiple-part decryption operation */
|
||
|
|
if (C_DecryptUpdate(hSession, ciphertext, ctlen, plaintext,
|
||
|
|
ptlen) != CKR_OK) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_decrypt_quit);
|
||
|
|
}
|
||
|
|
/* finish a multiple-part decryption operation */
|
||
|
|
if (C_DecryptFinal(hSession, plaintext, ptlen) != CKR_OK) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_decrypt_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
pkcs_decrypt_quit:
|
||
|
|
if (key != (CK_OBJECT_HANDLE) 0) {
|
||
|
|
(void) C_DestroyObject(hSession, hkey);
|
||
|
|
}
|
||
|
|
return rval;
|
||
|
|
}
|
||
|
|
|
||
|
|
/*
|
||
|
|
* Convert a passphrase into a master user key, Ku, according to the
|
||
|
|
* algorithm given in RFC 2274 concerning the SNMPv3 User Security Model (USM)
|
||
|
|
*/
|
||
|
|
int
|
||
|
|
pkcs_generate_Ku(CK_MECHANISM_TYPE mech_type, u_char * passphrase, u_int pplen,
|
||
|
|
u_char * Ku, size_t * kulen)
|
||
|
|
{
|
||
|
|
int rval = SNMPERR_SUCCESS, nbytes = USM_LENGTH_EXPANDED_PASSPHRASE;
|
||
|
|
CK_SESSION_HANDLE hSession;
|
||
|
|
CK_MECHANISM mech;
|
||
|
|
u_int i, pindex = 0;
|
||
|
|
u_char buf[USM_LENGTH_KU_HASHBLOCK], *bufp;
|
||
|
|
|
||
|
|
if (get_session_handle(mech_type, CKF_DIGEST, &hSession) != CKR_OK ||
|
||
|
|
hSession == NULL) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_generate_Ku_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
mech.mechanism = mech_type;
|
||
|
|
mech.pParameter = NULL_PTR;
|
||
|
|
mech.ulParameterLen = 0;
|
||
|
|
|
||
|
|
/* initialize a message-digesting operation */
|
||
|
|
if (C_DigestInit(hSession, &mech)!= CKR_OK ) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_generate_Ku_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
while (nbytes > 0) {
|
||
|
|
bufp = buf;
|
||
|
|
for (i = 0; i < USM_LENGTH_KU_HASHBLOCK; i++) {
|
||
|
|
/*
|
||
|
|
* fill a buffer with the supplied passphrase. When the end
|
||
|
|
* of the passphrase is reachedcycle back to the beginning.
|
||
|
|
*/
|
||
|
|
*bufp++ = passphrase[pindex++ % pplen];
|
||
|
|
}
|
||
|
|
/* continue a multiple-part message-digesting operation */
|
||
|
|
if (C_DigestUpdate(hSession, buf, USM_LENGTH_KU_HASHBLOCK) != CKR_OK ) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_generate_Ku_quit);
|
||
|
|
}
|
||
|
|
nbytes -= USM_LENGTH_KU_HASHBLOCK;
|
||
|
|
}
|
||
|
|
/* finish a multiple-part message-digesting operation */
|
||
|
|
if (C_DigestFinal(hSession, Ku, kulen) != CKR_OK) {
|
||
|
|
QUITFUN(SNMPERR_GENERR, pkcs_generate_Ku_quit);
|
||
|
|
}
|
||
|
|
|
||
|
|
pkcs_generate_Ku_quit:
|
||
|
|
return rval;
|
||
|
|
}
|
||
|
|
|
||
|
|
/*
|
||
|
|
* pkcserr_stringor: returns a string representation of the given
|
||
|
|
* return code.
|
||
|
|
*/
|
||
|
|
static char *
|
||
|
|
pkcserr_string(CK_RV rv)
|
||
|
|
{
|
||
|
|
static char errstr[128];
|
||
|
|
switch (rv) {
|
||
|
|
case CKR_OK:
|
||
|
|
return ("CKR_OK");
|
||
|
|
break;
|
||
|
|
case CKR_CANCEL:
|
||
|
|
return ("CKR_CANCEL");
|
||
|
|
break;
|
||
|
|
case CKR_HOST_MEMORY:
|
||
|
|
return ("CKR_HOST_MEMORY");
|
||
|
|
break;
|
||
|
|
case CKR_SLOT_ID_INVALID:
|
||
|
|
return ("CKR_SLOT_ID_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_GENERAL_ERROR:
|
||
|
|
return ("CKR_GENERAL_ERROR");
|
||
|
|
break;
|
||
|
|
case CKR_FUNCTION_FAILED:
|
||
|
|
return ("CKR_FUNCTION_FAILED");
|
||
|
|
break;
|
||
|
|
case CKR_ARGUMENTS_BAD:
|
||
|
|
return ("CKR_ARGUMENTS_BAD");
|
||
|
|
break;
|
||
|
|
case CKR_NO_EVENT:
|
||
|
|
return ("CKR_NO_EVENT");
|
||
|
|
break;
|
||
|
|
case CKR_NEED_TO_CREATE_THREADS:
|
||
|
|
return ("CKR_NEED_TO_CREATE_THREADS");
|
||
|
|
break;
|
||
|
|
case CKR_CANT_LOCK:
|
||
|
|
return ("CKR_CANT_LOCK");
|
||
|
|
break;
|
||
|
|
case CKR_ATTRIBUTE_READ_ONLY:
|
||
|
|
return ("CKR_ATTRIBUTE_READ_ONLY");
|
||
|
|
break;
|
||
|
|
case CKR_ATTRIBUTE_SENSITIVE:
|
||
|
|
return ("CKR_ATTRIBUTE_SENSITIVE");
|
||
|
|
break;
|
||
|
|
case CKR_ATTRIBUTE_TYPE_INVALID:
|
||
|
|
return ("CKR_ATTRIBUTE_TYPE_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_ATTRIBUTE_VALUE_INVALID:
|
||
|
|
return ("CKR_ATTRIBUTE_VALUE_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_DATA_INVALID:
|
||
|
|
return ("CKR_DATA_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_DATA_LEN_RANGE:
|
||
|
|
return ("CKR_DATA_LEN_RANGE");
|
||
|
|
break;
|
||
|
|
case CKR_DEVICE_ERROR:
|
||
|
|
return ("CKR_DEVICE_ERROR");
|
||
|
|
break;
|
||
|
|
case CKR_DEVICE_MEMORY:
|
||
|
|
return ("CKR_DEVICE_MEMORY");
|
||
|
|
break;
|
||
|
|
case CKR_DEVICE_REMOVED:
|
||
|
|
return ("CKR_DEVICE_REMOVED");
|
||
|
|
break;
|
||
|
|
case CKR_ENCRYPTED_DATA_INVALID:
|
||
|
|
return ("CKR_ENCRYPTED_DATA_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_ENCRYPTED_DATA_LEN_RANGE:
|
||
|
|
return ("CKR_ENCRYPTED_DATA_LEN_RANGE");
|
||
|
|
break;
|
||
|
|
case CKR_FUNCTION_CANCELED:
|
||
|
|
return ("CKR_FUNCTION_CANCELED");
|
||
|
|
break;
|
||
|
|
case CKR_FUNCTION_NOT_PARALLEL:
|
||
|
|
return ("CKR_FUNCTION_NOT_PARALLEL");
|
||
|
|
break;
|
||
|
|
case CKR_FUNCTION_NOT_SUPPORTED:
|
||
|
|
return ("CKR_FUNCTION_NOT_SUPPORTED");
|
||
|
|
break;
|
||
|
|
case CKR_KEY_HANDLE_INVALID:
|
||
|
|
return ("CKR_KEY_HANDLE_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_KEY_SIZE_RANGE:
|
||
|
|
return ("CKR_KEY_SIZE_RANGE");
|
||
|
|
break;
|
||
|
|
case CKR_KEY_TYPE_INCONSISTENT:
|
||
|
|
return ("CKR_KEY_TYPE_INCONSISTENT");
|
||
|
|
break;
|
||
|
|
case CKR_KEY_NOT_NEEDED:
|
||
|
|
return ("CKR_KEY_NOT_NEEDED");
|
||
|
|
break;
|
||
|
|
case CKR_KEY_CHANGED:
|
||
|
|
return ("CKR_KEY_CHANGED");
|
||
|
|
break;
|
||
|
|
case CKR_KEY_NEEDED:
|
||
|
|
return ("CKR_KEY_NEEDED");
|
||
|
|
break;
|
||
|
|
case CKR_KEY_INDIGESTIBLE:
|
||
|
|
return ("CKR_KEY_INDIGESTIBLE");
|
||
|
|
break;
|
||
|
|
case CKR_KEY_FUNCTION_NOT_PERMITTED:
|
||
|
|
return ("CKR_KEY_FUNCTION_NOT_PERMITTED");
|
||
|
|
break;
|
||
|
|
case CKR_KEY_NOT_WRAPPABLE:
|
||
|
|
return ("CKR_KEY_NOT_WRAPPABLE");
|
||
|
|
break;
|
||
|
|
case CKR_KEY_UNEXTRACTABLE:
|
||
|
|
return ("CKR_KEY_UNEXTRACTABLE");
|
||
|
|
break;
|
||
|
|
case CKR_MECHANISM_INVALID:
|
||
|
|
return ("CKR_MECHANISM_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_MECHANISM_PARAM_INVALID:
|
||
|
|
return ("CKR_MECHANISM_PARAM_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_OBJECT_HANDLE_INVALID:
|
||
|
|
return ("CKR_OBJECT_HANDLE_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_OPERATION_ACTIVE:
|
||
|
|
return ("CKR_OPERATION_ACTIVE");
|
||
|
|
break;
|
||
|
|
case CKR_OPERATION_NOT_INITIALIZED:
|
||
|
|
return ("CKR_OPERATION_NOT_INITIALIZED");
|
||
|
|
break;
|
||
|
|
case CKR_PIN_INCORRECT:
|
||
|
|
return ("CKR_PIN_INCORRECT");
|
||
|
|
break;
|
||
|
|
case CKR_PIN_INVALID:
|
||
|
|
return ("CKR_PIN_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_PIN_LEN_RANGE:
|
||
|
|
return ("CKR_PIN_LEN_RANGE");
|
||
|
|
break;
|
||
|
|
case CKR_PIN_EXPIRED:
|
||
|
|
return ("CKR_PIN_EXPIRED");
|
||
|
|
break;
|
||
|
|
case CKR_PIN_LOCKED:
|
||
|
|
return ("CKR_PIN_LOCKED");
|
||
|
|
break;
|
||
|
|
case CKR_SESSION_CLOSED:
|
||
|
|
return ("CKR_SESSION_CLOSED");
|
||
|
|
break;
|
||
|
|
case CKR_SESSION_COUNT:
|
||
|
|
return ("CKR_SESSION_COUNT");
|
||
|
|
break;
|
||
|
|
case CKR_SESSION_HANDLE_INVALID:
|
||
|
|
return ("CKR_SESSION_HANDLE_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_SESSION_PARALLEL_NOT_SUPPORTED:
|
||
|
|
return ("CKR_SESSION_PARALLEL_NOT_SUPPORTED");
|
||
|
|
break;
|
||
|
|
case CKR_SESSION_READ_ONLY:
|
||
|
|
return ("CKR_SESSION_READ_ONLY");
|
||
|
|
break;
|
||
|
|
case CKR_SESSION_EXISTS:
|
||
|
|
return ("CKR_SESSION_EXISTS");
|
||
|
|
break;
|
||
|
|
case CKR_SESSION_READ_ONLY_EXISTS:
|
||
|
|
return ("CKR_SESSION_READ_ONLY_EXISTS");
|
||
|
|
break;
|
||
|
|
case CKR_SESSION_READ_WRITE_SO_EXISTS:
|
||
|
|
return ("CKR_SESSION_READ_WRITE_SO_EXISTS");
|
||
|
|
break;
|
||
|
|
case CKR_SIGNATURE_INVALID:
|
||
|
|
return ("CKR_SIGNATURE_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_SIGNATURE_LEN_RANGE:
|
||
|
|
return ("CKR_SIGNATURE_LEN_RANGE");
|
||
|
|
break;
|
||
|
|
case CKR_TEMPLATE_INCOMPLETE:
|
||
|
|
return ("CKR_TEMPLATE_INCOMPLETE");
|
||
|
|
break;
|
||
|
|
case CKR_TEMPLATE_INCONSISTENT:
|
||
|
|
return ("CKR_TEMPLATE_INCONSISTENT");
|
||
|
|
break;
|
||
|
|
case CKR_TOKEN_NOT_PRESENT:
|
||
|
|
return ("CKR_TOKEN_NOT_PRESENT");
|
||
|
|
break;
|
||
|
|
case CKR_TOKEN_NOT_RECOGNIZED:
|
||
|
|
return ("CKR_TOKEN_NOT_RECOGNIZED");
|
||
|
|
break;
|
||
|
|
case CKR_TOKEN_WRITE_PROTECTED:
|
||
|
|
return ("CKR_TOKEN_WRITE_PROTECTED");
|
||
|
|
break;
|
||
|
|
case CKR_UNWRAPPING_KEY_HANDLE_INVALID:
|
||
|
|
return ("CKR_UNWRAPPING_KEY_HANDLE_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_UNWRAPPING_KEY_SIZE_RANGE:
|
||
|
|
return ("CKR_UNWRAPPING_KEY_SIZE_RANGE");
|
||
|
|
break;
|
||
|
|
case CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT:
|
||
|
|
return ("CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT");
|
||
|
|
break;
|
||
|
|
case CKR_USER_ALREADY_LOGGED_IN:
|
||
|
|
return ("CKR_USER_ALREADY_LOGGED_IN");
|
||
|
|
break;
|
||
|
|
case CKR_USER_NOT_LOGGED_IN:
|
||
|
|
return ("CKR_USER_NOT_LOGGED_IN");
|
||
|
|
break;
|
||
|
|
case CKR_USER_PIN_NOT_INITIALIZED:
|
||
|
|
return ("CKR_USER_PIN_NOT_INITIALIZED");
|
||
|
|
break;
|
||
|
|
case CKR_USER_TYPE_INVALID:
|
||
|
|
return ("CKR_USER_TYPE_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_USER_ANOTHER_ALREADY_LOGGED_IN:
|
||
|
|
return ("CKR_USER_ANOTHER_ALREADY_LOGGED_IN");
|
||
|
|
break;
|
||
|
|
case CKR_USER_TOO_MANY_TYPES:
|
||
|
|
return ("CKR_USER_TOO_MANY_TYPES");
|
||
|
|
break;
|
||
|
|
case CKR_WRAPPED_KEY_INVALID:
|
||
|
|
return ("CKR_WRAPPED_KEY_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_WRAPPED_KEY_LEN_RANGE:
|
||
|
|
return ("CKR_WRAPPED_KEY_LEN_RANGE");
|
||
|
|
break;
|
||
|
|
case CKR_WRAPPING_KEY_HANDLE_INVALID:
|
||
|
|
return ("CKR_WRAPPING_KEY_HANDLE_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_WRAPPING_KEY_SIZE_RANGE:
|
||
|
|
return ("CKR_WRAPPING_KEY_SIZE_RANGE");
|
||
|
|
break;
|
||
|
|
case CKR_WRAPPING_KEY_TYPE_INCONSISTENT:
|
||
|
|
return ("CKR_WRAPPING_KEY_TYPE_INCONSISTENT");
|
||
|
|
break;
|
||
|
|
case CKR_RANDOM_SEED_NOT_SUPPORTED:
|
||
|
|
return ("CKR_RANDOM_SEED_NOT_SUPPORTED");
|
||
|
|
break;
|
||
|
|
case CKR_RANDOM_NO_RNG:
|
||
|
|
return ("CKR_RANDOM_NO_RNG");
|
||
|
|
break;
|
||
|
|
case CKR_DOMAIN_PARAMS_INVALID:
|
||
|
|
return ("CKR_DOMAIN_PARAMS_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_BUFFER_TOO_SMALL:
|
||
|
|
return ("CKR_BUFFER_TOO_SMALL");
|
||
|
|
break;
|
||
|
|
case CKR_SAVED_STATE_INVALID:
|
||
|
|
return ("CKR_SAVED_STATE_INVALID");
|
||
|
|
break;
|
||
|
|
case CKR_INFORMATION_SENSITIVE:
|
||
|
|
return ("CKR_INFORMATION_SENSITIVE");
|
||
|
|
break;
|
||
|
|
case CKR_STATE_UNSAVEABLE:
|
||
|
|
return ("CKR_STATE_UNSAVEABLE");
|
||
|
|
break;
|
||
|
|
case CKR_CRYPTOKI_NOT_INITIALIZED:
|
||
|
|
return ("CKR_CRYPTOKI_NOT_INITIALIZED");
|
||
|
|
break;
|
||
|
|
case CKR_CRYPTOKI_ALREADY_INITIALIZED:
|
||
|
|
return ("CKR_CRYPTOKI_ALREADY_INITIALIZED");
|
||
|
|
break;
|
||
|
|
case CKR_MUTEX_BAD:
|
||
|
|
return ("CKR_MUTEX_BAD");
|
||
|
|
break;
|
||
|
|
case CKR_MUTEX_NOT_LOCKED:
|
||
|
|
return ("CKR_MUTEX_NOT_LOCKED");
|
||
|
|
break;
|
||
|
|
case CKR_VENDOR_DEFINED:
|
||
|
|
return ("CKR_VENDOR_DEFINED");
|
||
|
|
break;
|
||
|
|
default:
|
||
|
|
/* rv not found */
|
||
|
|
snprintf(errstr, sizeof (errstr),
|
||
|
|
"Unknown return code: 0x%x", rv);
|
||
|
|
return (errstr);
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
#else
|
||
|
|
int pkcs_unused; /* Suppress "empty translation unit" warning */
|
||
|
|
#endif
|