39#include <libxml/tree.h>
40#include <libxml/parser.h>
41#include <libxml/xpath.h>
42#include <libxml/xpathInternals.h>
43#include <libxml/relaxng.h>
56#define HSM_TOKEN_LABEL_LENGTH 32
64ldns_pkcs11_rv_str(CK_RV rv)
73 return "CKR_HOST_MEMORY";
75 return "CKR_GENERAL_ERROR";
77 return "CKR_FUNCTION_FAILED";
79 return "CKR_SLOT_ID_INVALID";
81 return "CKR_ATTRIBUTE_READ_ONLY";
83 return "CKR_ATTRIBUTE_SENSITIVE";
85 return "CKR_ATTRIBUTE_TYPE_INVALID";
87 return "CKR_ATTRIBUTE_VALUE_INVALID";
89 return "CKR_DATA_INVALID";
91 return "CKR_DATA_LEN_RANGE";
93 return "CKR_DEVICE_ERROR";
95 return "CKR_DEVICE_MEMORY";
97 return "CKR_DEVICE_REMOVED";
99 return "CKR_ENCRYPTED_DATA_INVALID";
101 return "CKR_ENCRYPTED_DATA_LEN_RANGE";
103 return "CKR_FUNCTION_CANCELED";
105 return "CKR_FUNCTION_NOT_PARALLEL";
107 return "CKR_FUNCTION_NOT_SUPPORTED";
109 return "CKR_KEY_HANDLE_INVALID";
111 return "CKR_KEY_SIZE_RANGE";
113 return "CKR_KEY_TYPE_INCONSISTENT";
115 return "CKR_MECHANISM_INVALID";
117 return "CKR_MECHANISM_PARAM_INVALID";
119 return "CKR_OBJECT_HANDLE_INVALID";
121 return "CKR_OPERATION_ACTIVE";
123 return "CKR_OPERATION_NOT_INITIALIZED";
125 return "CKR_PIN_INCORRECT";
127 return "CKR_PIN_INVALID";
129 return "CKR_PIN_LEN_RANGE";
131 return "CKR_SESSION_CLOSED";
133 return "CKR_SESSION_COUNT";
135 return "CKR_SESSION_HANDLE_INVALID";
137 return "CKR_SESSION_PARALLEL_NOT_SUPPORTED";
139 return "CKR_SESSION_READ_ONLY";
141 return "CKR_SESSION_EXISTS";
143 return "CKR_SIGNATURE_INVALID";
145 return "CKR_SIGNATURE_LEN_RANGE";
147 return "CKR_TEMPLATE_INCOMPLETE";
149 return "CKR_TEMPLATE_INCONSISTENT";
151 return "CKR_TOKEN_NOT_PRESENT";
153 return "CKR_TOKEN_NOT_RECOGNIZED";
155 return "CKR_TOKEN_WRITE_PROTECTED";
157 return "CKR_UNWRAPPING_KEY_HANDLE_INVALID";
159 return "CKR_UNWRAPPING_KEY_SIZE_RANGE";
161 return "CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT";
163 return "CKR_USER_ALREADY_LOGGED_IN";
165 return "CKR_USER_NOT_LOGGED_IN";
167 return "CKR_USER_PIN_NOT_INITIALIZED";
169 return "CKR_USER_TYPE_INVALID";
171 return "CKR_WRAPPED_KEY_INVALID";
173 return "CKR_WRAPPED_KEY_LEN_RANGE";
175 return "CKR_WRAPPING_KEY_HANDLE_INVALID";
177 return "CKR_WRAPPING_KEY_SIZE_RANGE";
179 return "CKR_WRAPPING_KEY_TYPE_INCONSISTENT";
181 return "CKR_RANDOM_SEED_NOT_SUPPORTED";
186 return "CKR_VENDOR_DEFINED";
188 return "CKR_BUFFER_TOO_SMALL";
190 return "CKR_SAVED_STATE_INVALID";
192 return "CKR_INFORMATION_SENSITIVE";
194 return "CKR_STATE_UNSAVEABLE";
196 return "CKR_CRYPTOKI_NOT_INITIALIZED";
198 return "CKR_CRYPTOKI_ALREADY_INITIALIZED";
200 return "CKR_MUTEX_BAD";
202 return "CKR_MUTEX_NOT_LOCKED";
204 return "Unknown error";
210 const char *message, ...)
218 va_start(args, message);
237hsm_pkcs11_check_error(
hsm_ctx_t *
ctx, CK_RV rv,
const char *action)
252hsm_pkcs11_unload_functions(
void *handle)
255#if defined(HAVE_LOADLIBRARY)
257#elif defined(HAVE_DLOPEN)
258 (void) dlclose(handle);
267 CK_C_GetFunctionList pGetFunctionList = NULL;
269 if (module && module->
path) {
272#if defined(HAVE_LOADLIBRARY)
274 HINSTANCE hDLL = LoadLibrary(_T(module->
path));
282 pGetFunctionList = (CK_C_GetFunctionList)
283 GetProcAddress(hDLL, _T(
"C_GetFunctionList"));
285#elif defined(HAVE_DLOPEN)
287 void* pDynLib = dlopen(module->
path, RTLD_NOW | RTLD_LOCAL);
289 if (pDynLib == NULL) {
295 pGetFunctionList = (CK_C_GetFunctionList) functioncast(dlsym(pDynLib,
"C_GetFunctionList"));
297 module->handle = pDynLib;
304#ifdef HAVE_PKCS11_MODULE
305 return C_GetFunctionList(pkcs11_functions);
311 if (pGetFunctionList == NULL) {
327 if (data == NULL || len == NULL)
return;
331 while ((
unsigned short int)(*p) == 0 && l > 1) {
346 const char *token_name)
355 if (hsm_pkcs11_check_error(
ctx, rv,
"C_GetTokenInfo")) {
361 memcpy(token_name_bytes, token_name, strlen(token_name));
366 result = memcmp(token_info.
label,
375 uint8_t use_pubkey, uint8_t allowextract, uint8_t require_backup)
379 if (!name || !module || !tokenlabel)
return NULL;
386 r->
name = strdup(name);
387 r->module = strdup(module);
394 r->
pin = strdup(pin);
412 if (r->module) free(r->module);
422 const char *token_name, CK_SLOT_ID *slotId)
430 if (token_name == NULL || slotId == NULL)
return HSM_ERROR;
433 if (hsm_pkcs11_check_error(
ctx, rv,
"get slot list")) {
439 "No slots found in HSM");
441 }
else if (slotCount > (SIZE_MAX /
sizeof(CK_SLOT_ID))) {
443 "Too many slots found in HSM");
447 CHECKALLOC(slotIds = malloc(
sizeof(CK_SLOT_ID) * slotCount));
450 if (hsm_pkcs11_check_error(
ctx, rv,
"get slot list")) {
454 for (cur_slot = 0; cur_slot < slotCount; cur_slot++) {
455 if (hsm_pkcs11_check_token_name(
ctx,
459 *slotId = slotIds[cur_slot];
467 "could not find token with the name %s", token_name);
476hsm_module_new(
const char *repository,
477 const char *token_label,
483 if (!repository || !path)
return NULL;
492 module->config = NULL;
496 module->name = strdup(repository);
497 module->token_label = strdup(token_label);
498 module->path = dupstr(path);
499 module->handle = NULL;
509 if (module->
name) free(module->
name);
511 if (module->
path) free(module->
path);
519hsm_session_new(
hsm_module_t *module, CK_SESSION_HANDLE session_handle)
523 session->module =
module;
524 session->
session = session_handle;
548 const char *repository,
const char *token_label,
549 const char *module_path,
const char *pin,
556 CK_SESSION_HANDLE session_handle;
557 int first = 1, result;
564 module = hsm_module_new(repository, token_label, module_path, config);
566 rv = hsm_pkcs11_load_functions(module);
569 "hsm_session_init()",
570 "PKCS#11 module load failed: %s", module_path);
571 hsm_module_free(module);
578 if (hsm_pkcs11_check_error(
ctx, rv,
"Initialization")) {
579 hsm_module_free(module);
585 result = hsm_get_slot_id(
ctx, module->
sym, token_label, &
slot_id);
587 hsm_module_free(module);
595 if (hsm_pkcs11_check_error(
ctx, rv,
"Open first session")) {
596 hsm_module_free(module);
601 (
unsigned char *) pin,
602 strlen((
char *)pin));
605 *session = hsm_session_new(module, session_handle);
609 if (session_handle) {
611 C_CloseSession(session_handle);
612 if (hsm_pkcs11_check_error(
ctx, rv,
613 "finalize after failed login")) {
614 hsm_module_free(module);
622 if (hsm_pkcs11_check_error(
ctx, rv,
"finalize after failed login")) {
623 hsm_module_free(module);
627 hsm_module_free(module);
632 "hsm_session_init()",
633 "Incorrect PIN for repository %s", repository);
647 CK_SESSION_HANDLE session_handle;
651 result = hsm_get_slot_id(
ctx,
652 session->module->sym,
653 session->module->token_label,
655 if (result !=
HSM_OK)
return NULL;
662 if (hsm_pkcs11_check_error(
ctx, rv,
"Clone session")) {
665 new_session = hsm_session_new(session->module, session_handle);
712 (void) hsm_pkcs11_check_error(
ctx, rv,
"Logout");
717 (void) hsm_pkcs11_check_error(
ctx, rv,
"Close session");
722 (void) hsm_pkcs11_check_error(
ctx, rv,
"Finalize");
723 hsm_pkcs11_unload_functions(session->module->handle);
725 hsm_module_free(session->module);
726 session->module = NULL;
728 hsm_session_free(session);
761 if (!
ctx || !session)
return -1;
777 new_ctx = hsm_ctx_new();
783 hsm_ctx_close(new_ctx, 0);
786 hsm_ctx_add_session(new_ctx, new_session);
826 CK_KEY_TYPE key_type;
837 if (hsm_pkcs11_check_error(
ctx, rv,
838 "Get attr value algorithm type")) {
846 if ((
CK_LONG)
template[0].ulValueLen < 1) {
886 if (hsm_pkcs11_check_error(
ctx, rv,
887 "Get attr value algorithm type")) {
891 if ((
CK_ULONG)
template[0].ulValueLen < 1) {
901 if (hsm_pkcs11_check_error(
ctx, rv,
"Could not get the size of the modulus of the private key")) {
906 modulus = (
CK_BYTE_PTR)malloc(template2[0].ulValueLen);
907 template2[0].pValue = modulus;
908 if (modulus == NULL) {
910 "Error allocating memory for modulus");
920 if (hsm_pkcs11_check_error(
ctx, rv,
"Could not get the modulus of the private key")) {
926 modulus_bits = template2[0].ulValueLen * 8;
928 for (
int i = 0; modulus_bits && (modulus[i] & mask) == 0; modulus_bits--) {
962 if (hsm_pkcs11_check_error(
ctx, rv,
"Could not get the size of the prime of the private key")) {
966 return template2[0].ulValueLen * 8;
972static unsigned char *
986 if (!session || !session->module || !key || !data_len) {
995 if (hsm_pkcs11_check_error(
ctx, rv,
"C_GetAttributeValue")) {
1008 if (hsm_pkcs11_check_error(
ctx, rv,
"get attribute value")) {
1013 if(
value_len !=
template[0].ulValueLen) {
1015 "HSM returned two different length for a same CKA_EC_POINT. " \
1016 "Abnormal behaviour detected.");
1024 "The DER value is too short");
1030 if (
value[0] != 0x04) {
1032 "Invalid identifier octet in the DER value");
1039 if (
value[1] <= 0x7F) {
1041 }
else if (
value[1] == 0x80) {
1043 "Indefinite length is not supported in DER values");
1048 header_len +=
value[1] & 0x80;
1054 "The value is too short");
1061 if (
value[header_len] != 0x04) {
1063 "The value is not uncompressed");
1070 CHECKALLOC(data = malloc(*data_len));
1072 memcpy(data,
value + header_len, *data_len);
1090 if (
value == NULL)
return 0;
1107static unsigned char *
1121 if (!session || !session->module || !key || !data_len) {
1130 if (hsm_pkcs11_check_error(
ctx, rv,
"C_GetAttributeValue")) {
1138 "Error allocating memory for value");
1148 if (hsm_pkcs11_check_error(
ctx, rv,
"get attribute value")) {
1153 if(
value_len !=
template[0].ulValueLen) {
1155 "HSM returned two different length for the same CKA_EC_POINT. " \
1156 "Abnormal behaviour detected.");
1164 "The DER value is too short");
1170 if (
value[0] != 0x04) {
1172 "Invalid identifier octet in the DER value");
1179 if (
value[1] <= 0x7F) {
1181 }
else if (
value[1] == 0x80) {
1183 "Indefinite length is not supported in DER values");
1188 header_len +=
value[1] & 0x80;
1194 "The value is too short");
1200 data = malloc(*data_len);
1203 "Error allocating memory for data");
1208 memcpy(data,
value + header_len, *data_len);
1227 if (
value == NULL)
return 0;
1261 return hsm_get_key_size_rsa(
ctx, session, key);
1264 return hsm_get_key_size_dsa(
ctx, session, key);
1270 return hsm_get_key_size_ecdsa(
ctx, session, key);
1272 return hsm_get_key_size_eddsa(
ctx, session, key);
1278static CK_OBJECT_HANDLE
1281 CK_OBJECT_CLASS key_class,
1286 CK_OBJECT_HANDLE object;
1290 {
CKA_CLASS, &key_class,
sizeof(key_class) },
1296 if (hsm_pkcs11_check_error(
ctx, rv,
"Find objects init")) {
1304 if (hsm_pkcs11_check_error(
ctx, rv,
"Find object")) {
1306 hsm_pkcs11_check_error(
ctx, rv,
"Find objects cleanup");
1311 if (hsm_pkcs11_check_error(
ctx, rv,
"Find object final")) {
1315 if (objectCount > 0) {
1327static unsigned char *
1328hsm_hex_parse(
const char *hex,
size_t *len)
1330 unsigned char *bytes;
1335 if (!len)
return NULL;
1338 if (!hex)
return NULL;
1339 hex_len = strlen(hex);
1340 if (hex_len % 2 != 0) {
1345 CHECKALLOC(bytes = malloc(*len));
1346 for (i = 0; i < *len; i++) {
1347 bytes[i] = ldns_hexdigit_to_int(hex[2*i]) * 16 +
1348 ldns_hexdigit_to_int(hex[2*i+1]);
1358hsm_hex_unparse(
char *dst,
const unsigned char *src,
size_t len)
1360 size_t dst_len = len*2 + 1;
1363 for (i = 0; i < len; i++) {
1364 snprintf(dst + (2*i), dst_len,
"%02x", src[i]);
1376 CK_OBJECT_HANDLE
object,
1392 if (hsm_pkcs11_check_error(
ctx, rv,
"Get attr value")) {
1397 if ((
CK_LONG)
template[0].ulValueLen < 1) {
1403 CHECKALLOC(
template[0].pValue = malloc(
template[0].ulValueLen));
1409 if (hsm_pkcs11_check_error(
ctx, rv,
"Get attr value 2")) {
1411 free(
template[0].pValue);
1415 *len =
template[0].ulValueLen;
1416 return template[0].pValue;
1426 CK_OBJECT_HANDLE
object)
1432 id = hsm_get_id_for_object(
ctx, session,
object, &len);
1434 if (!
id)
return NULL;
1436 key = libhsm_key_new();
1437 key->
modulename = strdup(session->module->name);
1440 key->
public_key = hsm_find_object_handle_for_id(
1468 {
CKA_CLASS, &key_class,
sizeof(key_class) },
1475 CK_OBJECT_HANDLE
object[max_object_count];
1476 CK_OBJECT_HANDLE *key_handles = NULL, *new_key_handles = NULL;
1481 if (hsm_pkcs11_check_error(
ctx, rv,
"Find objects init")) {
1486 while (objectCount > 0) {
1491 if (hsm_pkcs11_check_error(
ctx, rv,
"Find first object")) {
1493 hsm_pkcs11_check_error(
ctx, rv,
"Find objects cleanup");
1497 total_count += objectCount;
1498 if (objectCount > 0 && store) {
1499 if (SIZE_MAX /
sizeof(CK_OBJECT_HANDLE) < total_count) {
1501 "Too much object handle returned by HSM to allocate key_handles");
1505 new_key_handles = realloc(key_handles, total_count *
sizeof(CK_OBJECT_HANDLE));
1506 if (new_key_handles != NULL) {
1507 key_handles = new_key_handles;
1510 "Error allocating memory for object handle (OOM)");
1514 for (i = 0; i < objectCount; i++) {
1515 key_handles[j] =
object[i];
1522 if (hsm_pkcs11_check_error(
ctx, rv,
"Find objects final")) {
1529 "Too much object handle returned by HSM to allocate keys");
1533 CHECKALLOC(keys = malloc(total_count *
sizeof(
libhsm_key_t *)));
1535 for (i = 0; i < total_count; i++) {
1536 key = libhsm_key_new_privkey_object_handle(
ctx, session,
1547 *count = total_count;
1568 return hsm_list_keys_session_internal(
ctx, session, count, 1);
1577 const unsigned char *
id,
size_t len)
1580 CK_OBJECT_HANDLE private_key_handle;
1582 private_key_handle = hsm_find_object_handle_for_id(
1588 if (private_key_handle != 0) {
1589 key = libhsm_key_new_privkey_object_handle(
ctx, session,
1590 private_key_handle);
1608 const unsigned char *
id,
1614 if (!
id)
return NULL;
1623 key = hsm_find_key_by_id_session(
ctx,
ctx->
session[i],
id, len);
1640hsm_find_repository_session(
hsm_ctx_t *
ctx,
const char *repository)
1652 strcmp(repository,
ctx->
session[i]->module->name) == 0)
1660 "hsm_find_repository_session()",
1661 "Can't find repository: %s", repository);
1675 unsigned long hKey = 0;
1676 unsigned char *data = NULL;
1677 size_t data_size = 0;
1685 if (!session || !session->module) {
1700 if (hsm_pkcs11_check_error(
ctx, rv,
"C_GetAttributeValue")) {
1703 public_exponent_len =
template[0].ulValueLen;
1704 modulus_len =
template[1].ulValueLen;
1706 CHECKALLOC(public_exponent =
template[0].pValue = malloc(public_exponent_len));
1708 CHECKALLOC(modulus =
template[1].pValue = malloc(modulus_len));
1715 if (hsm_pkcs11_check_error(
ctx, rv,
"get attribute value")) {
1716 free(
template[0].pValue);
1717 free(
template[1].pValue);
1722 hsm_remove_leading_zeroes(public_exponent, &public_exponent_len);
1723 hsm_remove_leading_zeroes(modulus, &modulus_len);
1725 data_size = public_exponent_len + modulus_len + 1;
1726 if (public_exponent_len <= 255) {
1727 CHECKALLOC(data = malloc(data_size));
1728 data[0] = public_exponent_len;
1729 memcpy(&data[1], public_exponent, public_exponent_len);
1730 memcpy(&data[1 + public_exponent_len], modulus, modulus_len);
1731 }
else if (public_exponent_len <= 65535) {
1733 CHECKALLOC(data = malloc(data_size));
1735 ldns_write_uint16(&data[1], (uint16_t) public_exponent_len);
1736 memcpy(&data[3], public_exponent, public_exponent_len);
1737 memcpy(&data[3 + public_exponent_len], modulus, modulus_len);
1740 "Public exponent too big");
1741 free(public_exponent);
1745 rdf = ldns_rdf_new(LDNS_RDF_TYPE_B64, data_size, data);
1746 free(public_exponent);
1765 unsigned char *data = NULL;
1766 size_t data_size = 0;
1776 if (!session || !session->module) {
1786 if (hsm_pkcs11_check_error(
ctx, rv,
"C_GetAttributeValue")) {
1789 prime_len =
template[0].ulValueLen;
1790 subprime_len =
template[1].ulValueLen;
1791 base_len =
template[2].ulValueLen;
1794 CHECKALLOC(prime =
template[0].pValue = malloc(prime_len));
1796 CHECKALLOC(subprime =
template[1].pValue = malloc(subprime_len));
1798 CHECKALLOC(base =
template[2].pValue = malloc(base_len));
1807 if (hsm_pkcs11_check_error(
ctx, rv,
"get attribute value")) {
1815 data_size = prime_len + subprime_len + base_len +
value_len + 1;
1816 CHECKALLOC(data = malloc(data_size));
1817 data[0] = (prime_len - 64) / 8;
1818 memcpy(&data[1], subprime, subprime_len);
1819 memcpy(&data[1 + subprime_len], prime, prime_len);
1820 memcpy(&data[1 + subprime_len + prime_len], base, base_len);
1821 memcpy(&data[1 + subprime_len + prime_len + base_len],
value,
value_len);
1823 rdf = ldns_rdf_new(LDNS_RDF_TYPE_B64, data_size, data);
1845 if (!session || !session->module) {
1855 if (hsm_pkcs11_check_error(
ctx, rv,
"C_GetAttributeValue")) {
1867 if (hsm_pkcs11_check_error(
ctx, rv,
"get attribute value")) {
1883 if (
value == NULL)
return NULL;
1885 ldns_rdf *rdf = ldns_rdf_new(LDNS_RDF_TYPE_B64,
value_len,
value);
1897 if (
value == NULL)
return NULL;
1899 ldns_rdf *rdf = ldns_rdf_new(LDNS_RDF_TYPE_B64,
value_len,
value);
1908 switch (hsm_get_key_algorithm(
ctx, session, key)) {
1910 return hsm_get_key_rdata_rsa(
ctx, session, key);
1913 return hsm_get_key_rdata_dsa(
ctx, session, key);
1916 return hsm_get_key_rdata_gost(
ctx, session, key);
1919 return hsm_get_key_rdata_ecdsa(
ctx, session, key);
1921 return hsm_get_key_rdata_eddsa(
ctx, session, key);
1932hsm_create_prefix(
CK_ULONG digest_len,
1937 const CK_BYTE RSA_MD5_ID[] = { 0x30, 0x20, 0x30, 0x0C, 0x06, 0x08, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05, 0x05, 0x00, 0x04, 0x10 };
1938 const CK_BYTE RSA_SHA1_ID[] = { 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2B, 0x0E, 0x03, 0x02, 0x1A, 0x05, 0x00, 0x04, 0x14 };
1939 const CK_BYTE RSA_SHA256_ID[] = { 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20 };
1940 const CK_BYTE RSA_SHA512_ID[] = { 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40 };
1942 switch((ldns_signing_algorithm)
algorithm) {
1943 case LDNS_SIGN_RSAMD5:
1944 *data_size =
sizeof(RSA_MD5_ID) + digest_len;
1945 CHECKALLOC(data = malloc(*data_size));
1946 memcpy(data, RSA_MD5_ID,
sizeof(RSA_MD5_ID));
1948 case LDNS_SIGN_RSASHA1:
1949 case LDNS_SIGN_RSASHA1_NSEC3:
1950 *data_size =
sizeof(RSA_SHA1_ID) + digest_len;
1951 CHECKALLOC(data = malloc(*data_size));
1952 memcpy(data, RSA_SHA1_ID,
sizeof(RSA_SHA1_ID));
1954 case LDNS_SIGN_RSASHA256:
1955 *data_size =
sizeof(RSA_SHA256_ID) + digest_len;
1956 CHECKALLOC(data = malloc(*data_size));
1957 memcpy(data, RSA_SHA256_ID,
sizeof(RSA_SHA256_ID));
1959 case LDNS_SIGN_RSASHA512:
1960 *data_size =
sizeof(RSA_SHA512_ID) + digest_len;
1961 CHECKALLOC(data = malloc(*data_size));
1962 memcpy(data, RSA_SHA512_ID,
sizeof(RSA_SHA512_ID));
1965 case LDNS_SIGN_DSA_NSEC3:
1966 case LDNS_SIGN_ECC_GOST:
1967 case LDNS_SIGN_ECDSAP256SHA256:
1968 case LDNS_SIGN_ECDSAP384SHA384:
1969 *data_size = digest_len;
1970 CHECKALLOC(data = malloc(*data_size));
1981 CK_MECHANISM_TYPE mechanism_type,
1983 ldns_buffer *sign_buf)
1989 digest_mechanism.pParameter = NULL;
1990 digest_mechanism.ulParameterLen = 0;
1991 digest_mechanism.
mechanism = mechanism_type;
1992 CHECKALLOC(digest = malloc(digest_len));
1995 if (hsm_pkcs11_check_error(
ctx, rv,
"HSM digest init")) {
2001 ldns_buffer_begin(sign_buf),
2002 ldns_buffer_position(sign_buf),
2005 if (hsm_pkcs11_check_error(
ctx, rv,
"HSM digest")) {
2014 ldns_buffer *sign_buf,
2023 int data_direct = 0;
2034 session = hsm_find_key_session(
ctx, key);
2035 if (!session)
return NULL;
2040 switch ((ldns_signing_algorithm)
algorithm) {
2041 case LDNS_SIGN_RSAMD5:
2043 digest = hsm_digest_through_hsm(
ctx, session,
2047 case LDNS_SIGN_RSASHA1:
2048 case LDNS_SIGN_RSASHA1_NSEC3:
2050 case LDNS_SIGN_DSA_NSEC3:
2051 digest_len = LDNS_SHA1_DIGEST_LENGTH;
2052 CHECKALLOC(digest = malloc(digest_len));
2053 digest = ldns_sha1(ldns_buffer_begin(sign_buf),
2054 ldns_buffer_position(sign_buf),
2058 case LDNS_SIGN_RSASHA256:
2059 case LDNS_SIGN_ECDSAP256SHA256:
2060 digest_len = LDNS_SHA256_DIGEST_LENGTH;
2061 CHECKALLOC(digest = malloc(digest_len));
2062 digest = ldns_sha256(ldns_buffer_begin(sign_buf),
2063 ldns_buffer_position(sign_buf),
2066 case LDNS_SIGN_ECDSAP384SHA384:
2067 digest_len = LDNS_SHA384_DIGEST_LENGTH;
2068 CHECKALLOC(digest = malloc(digest_len));
2069 digest = ldns_sha384(ldns_buffer_begin(sign_buf),
2070 ldns_buffer_position(sign_buf),
2073 case LDNS_SIGN_RSASHA512:
2074 digest_len = LDNS_SHA512_DIGEST_LENGTH;
2075 CHECKALLOC(digest = malloc(digest_len));
2076 digest = ldns_sha512(ldns_buffer_begin(sign_buf),
2077 ldns_buffer_position(sign_buf),
2080 case LDNS_SIGN_ECC_GOST:
2082 digest = hsm_digest_through_hsm(
ctx, session,
2086#if (LDNS_REVISION >= ((1<<16)|(7<<8)|(0)))
2087 case LDNS_SIGN_ED25519:
2090 case LDNS_SIGN_ED448:
2100 if (!data_direct && !digest) {
2105 data = ldns_buffer_begin(sign_buf);
2106 data_len = ldns_buffer_position(sign_buf);
2111 data = hsm_create_prefix(digest_len,
algorithm, &data_len);
2112 memcpy(data + data_len - digest_len, digest, digest_len);
2115 sign_mechanism.pParameter = NULL;
2116 sign_mechanism.ulParameterLen = 0;
2117 switch((ldns_signing_algorithm)
algorithm) {
2118 case LDNS_SIGN_RSAMD5:
2119 case LDNS_SIGN_RSASHA1:
2120 case LDNS_SIGN_RSASHA1_NSEC3:
2121 case LDNS_SIGN_RSASHA256:
2122 case LDNS_SIGN_RSASHA512:
2126 case LDNS_SIGN_DSA_NSEC3:
2129 case LDNS_SIGN_ECC_GOST:
2132 case LDNS_SIGN_ECDSAP256SHA256:
2133 case LDNS_SIGN_ECDSAP384SHA384:
2136#if (LDNS_REVISION >= ((1<<16)|(7<<8)|(0)))
2137 case LDNS_SIGN_ED25519:
2140 case LDNS_SIGN_ED448:
2156 if (hsm_pkcs11_check_error(
ctx, rv,
"sign init")) {
2167 if (hsm_pkcs11_check_error(
ctx, rv,
"sign final")) {
2175 sig_rdf = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_B64,
2189hsm_dname_is_wildcard(
const ldns_rdf* dname)
2191 return ( ldns_dname_label_count(dname) > 0 &&
2192 ldns_rdf_data(dname)[0] == 1 &&
2193 ldns_rdf_data(dname)[1] ==
'*');
2197hsm_create_empty_rrsig(
const ldns_rr_list *rrset,
2202 uint32_t orig_class;
2204 uint8_t label_count;
2206 label_count = ldns_dname_label_count(
2207 ldns_rr_owner(ldns_rr_list_rr(rrset, 0)));
2209 if (hsm_dname_is_wildcard(ldns_rr_owner(ldns_rr_list_rr(rrset, 0)))) {
2213 rrsig = ldns_rr_new_frm_type(LDNS_RR_TYPE_RRSIG);
2216 orig_ttl = ldns_rr_ttl(ldns_rr_list_rr(rrset, 0));
2217 orig_class = ldns_rr_get_class(ldns_rr_list_rr(rrset, 0));
2219 ldns_rr_set_class(rrsig, orig_class);
2220 ldns_rr_set_ttl(rrsig, orig_ttl);
2221 ldns_rr_set_owner(rrsig,
2224 ldns_rr_list_rr(rrset,
2230 (void)ldns_rr_rrsig_set_origttl(
2232 ldns_native2rdf_int32(LDNS_RDF_TYPE_INT32,
2235 (void)ldns_rr_rrsig_set_signame(
2237 ldns_rdf_clone(sign_params->
owner));
2239 (void)ldns_rr_rrsig_set_labels(
2241 ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8,
2246 (void)ldns_rr_rrsig_set_inception(
2248 ldns_native2rdf_int32(
2252 (void)ldns_rr_rrsig_set_inception(
2254 ldns_native2rdf_int32(LDNS_RDF_TYPE_TIME, now));
2257 (void)ldns_rr_rrsig_set_expiration(
2259 ldns_native2rdf_int32(
2263 (void)ldns_rr_rrsig_set_expiration(
2265 ldns_native2rdf_int32(
2267 now + LDNS_DEFAULT_EXP_TIME));
2270 (void)ldns_rr_rrsig_set_keytag(
2272 ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16,
2275 (void)ldns_rr_rrsig_set_algorithm(
2277 ldns_native2rdf_int8(
2281 (void)ldns_rr_rrsig_set_typecovered(
2283 ldns_native2rdf_int16(
2285 ldns_rr_get_type(ldns_rr_list_rr(rrset,
2298 char *(pin_callback)(
unsigned int,
const char *,
unsigned int))
2302 char* module_pin = NULL;
2305 int repositories = 0;
2316 hsm_config_default(&module_config);
2322 repo->module, repo->
pin, &module_config);
2330 if (module_pin == NULL)
break;
2332 repo->module, module_pin, &module_config);
2337 memset(module_pin, 0, strlen(module_pin));
2343 "No pin or callback function");
2354 if (result ==
HSM_OK && repositories == 0) {
2356 "No repositories found");
2390 CK_SESSION_HANDLE session_handle;
2398 if (session == NULL)
continue;
2404 if (hsm_pkcs11_check_error(
ctx, rv,
"get session info")) {
2412 "Session not logged in");
2423 if (hsm_pkcs11_check_error(
ctx, rv,
"test open session")) {
2428 if (hsm_pkcs11_check_error(
ctx, rv,
"test close session")) {
2441 hsm_ctx_close(
ctx, 0);
2453 params->
flags = LDNS_KEY_ZONE_KEY;
2457 params->
owner = NULL;
2465 if (params->
owner) ldns_rdf_deep_free(params->
owner);
2481 size_t key_count = 0;
2482 size_t cur_key_count;
2489 CHECKALLOC(keys = realloc(keys,
2490 (key_count + cur_key_count) *
sizeof(
libhsm_key_t *)));
2491 for (j = 0; j < cur_key_count; j++) {
2492 keys[key_count + j] = session_keys[j];
2494 key_count += cur_key_count;
2506 const char *repository)
2510 if (!repository)
return NULL;
2512 session = hsm_find_repository_session(
ctx, repository);
2517 return hsm_list_keys_session(
ctx, session, count);
2523 unsigned char *id_bytes;
2527 id_bytes = hsm_hex_parse(
id, &len);
2529 if (!id_bytes)
return NULL;
2531 key = hsm_find_key_by_id_bin(
ctx, id_bytes, len);
2537generate_unique_id(
hsm_ctx_t *
ctx,
unsigned char *buf,
size_t bufsize)
2542 while ((key = hsm_find_key_by_id_bin(
ctx, buf, bufsize))) {
2551 const char *repository,
2552 unsigned long keysize)
2557 unsigned char id[16];
2561 CK_OBJECT_HANDLE publicKey, privateKey;
2562 CK_KEY_TYPE keyType =
CKK_RSA;
2566 CK_BYTE publicExponent[] = { 1, 0, 1 };
2572 session = hsm_find_repository_session(
ctx, repository);
2573 if (!session)
return NULL;
2574 cextractable = session->module->config->allow_extract ?
CK_TRUE :
CK_FALSE;
2576 generate_unique_id(
ctx,
id, 16);
2580 hsm_hex_unparse(id_str,
id, 16);
2582 if (! session->module->config->use_pubkey) {
2592 {
CKA_WRAP, &cfalse,
sizeof(cfalse) },
2602 {
CKA_SIGN, &ctrue,
sizeof (ctrue) },
2613 publicKeyTemplate, 9,
2614 privateKeyTemplate, 10,
2617 if (hsm_pkcs11_check_error(
ctx, rv,
"generate key pair")) {
2621 new_key = libhsm_key_new();
2622 new_key->
modulename = strdup(session->module->name);
2624 if (session->module->config->use_pubkey) {
2639 const char *repository,
2640 unsigned long keysize)
2645 CK_OBJECT_HANDLE domainPar, publicKey, privateKey;
2651 unsigned char id[16];
2655 session = hsm_find_repository_session(
ctx, repository);
2656 if (!session)
return NULL;
2657 cextractable = session->module->config->allow_extract ?
CK_TRUE :
CK_FALSE;
2659 generate_unique_id(
ctx,
id, 16);
2663 hsm_hex_unparse(id_str,
id, 16);
2665 CK_KEY_TYPE keyType =
CKK_DSA;
2685 {
CKA_BASE, dsa_g,
sizeof(dsa_g) },
2691 {
CKA_WRAP, &cfalse,
sizeof(cfalse) },
2699 {
CKA_SIGN, &ctrue,
sizeof(ctrue) },
2708 cextractable = session->module->config->allow_extract ?
CK_TRUE :
CK_FALSE;
2716 if (hsm_pkcs11_check_error(
ctx, rv,
"generate domain parameters")) {
2721 domainPar, publicKeyTemplate, 3);
2722 if (hsm_pkcs11_check_error(
ctx, rv,
"get domain parameters")) {
2727 if (hsm_pkcs11_check_error(
ctx, rv,
"destroy domain parameters")) {
2735 publicKeyTemplate, 10,
2736 privateKeyTemplate, 10,
2739 if (hsm_pkcs11_check_error(
ctx, rv,
"generate key pair")) {
2743 new_key = libhsm_key_new();
2744 new_key->
modulename = strdup(session->module->name);
2753 const char *repository)
2758 CK_OBJECT_HANDLE publicKey, privateKey;
2764 unsigned char id[16];
2768 session = hsm_find_repository_session(
ctx, repository);
2769 if (!session)
return NULL;
2770 cextractable = session->module->config->allow_extract ?
CK_TRUE :
CK_FALSE;
2772 generate_unique_id(
ctx,
id, 16);
2776 hsm_hex_unparse(id_str,
id, 16);
2783 CK_BYTE oid1[] = { 0x06, 0x07, 0x2A, 0x85, 0x03, 0x02, 0x02, 0x23, 0x01 };
2784 CK_BYTE oid2[] = { 0x06, 0x07, 0x2A, 0x85, 0x03, 0x02, 0x02, 0x1E, 0x01 };
2794 {
CKA_WRAP, &cfalse,
sizeof(cfalse) },
2802 {
CKA_SIGN, &ctrue,
sizeof(ctrue) },
2815 publicKeyTemplate, 9,
2816 privateKeyTemplate, 10,
2819 if (hsm_pkcs11_check_error(
ctx, rv,
"generate key pair")) {
2823 new_key = libhsm_key_new();
2824 new_key->
modulename = strdup(session->module->name);
2833 const char *repository,
2839 CK_OBJECT_HANDLE publicKey, privateKey;
2845 unsigned char id[16];
2849 session = hsm_find_repository_session(
ctx, repository);
2850 if (!session)
return NULL;
2851 cextractable = session->module->config->allow_extract ?
CK_TRUE :
CK_FALSE;
2853 generate_unique_id(
ctx,
id, 16);
2857 hsm_hex_unparse(id_str,
id, 16);
2859 CK_KEY_TYPE keyType =
CKK_EC;
2864 CK_BYTE oidP256[] = { 0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07 };
2865 CK_BYTE oidP384[] = { 0x06, 0x05, 0x2B, 0x81, 0x04, 0x00, 0x22 };
2874 {
CKA_WRAP, &cfalse,
sizeof(cfalse) },
2882 {
CKA_SIGN, &ctrue,
sizeof(ctrue) },
2892 if (strcmp(curve,
"P-256") == 0)
2894 publicKeyTemplate[0].pValue = oidP256;
2895 publicKeyTemplate[0].ulValueLen =
sizeof(oidP256);
2897 else if (strcmp(curve,
"P-384") == 0)
2899 publicKeyTemplate[0].pValue = oidP384;
2900 publicKeyTemplate[0].ulValueLen =
sizeof(oidP384);
2911 publicKeyTemplate, 8,
2912 privateKeyTemplate, 10,
2915 if (hsm_pkcs11_check_error(
ctx, rv,
"generate key pair")) {
2919 new_key = libhsm_key_new();
2920 new_key->
modulename = strdup(session->module->name);
2929 const char *repository,
2935 CK_OBJECT_HANDLE publicKey, privateKey;
2941 unsigned char id[16];
2945 session = hsm_find_repository_session(
ctx, repository);
2946 if (!session)
return NULL;
2947 cextractable = session->module->config->allow_extract ?
CK_TRUE :
CK_FALSE;
2949 generate_unique_id(
ctx,
id, 16);
2953 hsm_hex_unparse(id_str,
id, 16);
2960 CK_BYTE oid25519[] = { 0x06, 0x03, 0x2B, 0x65, 0x70 };
2961 CK_BYTE oid448[] = { 0x06, 0x03, 0x2B, 0x65, 0x71 };
2970 {
CKA_WRAP, &cfalse,
sizeof(cfalse) },
2978 {
CKA_SIGN, &ctrue,
sizeof(ctrue) },
2988 if (strcmp(curve,
"edwards25519") == 0)
2990 publicKeyTemplate[0].pValue = oid25519;
2991 publicKeyTemplate[0].ulValueLen =
sizeof(oid25519);
2993 else if (strcmp(curve,
"edwards448") == 0)
2995 publicKeyTemplate[0].pValue = oid448;
2996 publicKeyTemplate[0].ulValueLen =
sizeof(oid448);
3007 publicKeyTemplate, 8,
3008 privateKeyTemplate, 10,
3011 if (hsm_pkcs11_check_error(
ctx, rv,
"generate key pair")) {
3015 new_key = libhsm_key_new();
3016 new_key->
modulename = strdup(session->module->name);
3028 if (!key)
return -1;
3030 session = hsm_find_key_session(
ctx, key);
3031 if (!session)
return -2;
3035 if (hsm_pkcs11_check_error(
ctx, rv,
"Destroy private key")) {
3043 if (hsm_pkcs11_check_error(
ctx, rv,
"Destroy public key")) {
3056 for (i = 0; i < count; i++) {
3070 if (!key)
return NULL;
3072 session = hsm_find_key_session(
ctx, key);
3073 if (!session)
return NULL;
3075 id = hsm_get_id_for_object(
ctx, session, key->
private_key, &len);
3076 if (!
id)
return NULL;
3079 CHECKALLOC(id_str = malloc(len * 2 + 1));
3081 hsm_hex_unparse(id_str,
id, len);
3095 session = hsm_find_key_session(
ctx, key);
3096 if (!session)
return NULL;
3101 if (key_info->
id == NULL) {
3102 key_info->
id = strdup(
"");
3105 key_info->
algorithm = (
unsigned long) hsm_get_key_algorithm(
ctx,
3108 key_info->
keysize = (
unsigned long) hsm_get_key_size(
ctx,
3155 const ldns_rr_list* rrset,
3160 ldns_buffer *sign_buf;
3164 if (!key)
return NULL;
3165 if (!sign_params)
return NULL;
3167 signature = hsm_create_empty_rrsig((ldns_rr_list *)rrset,
3173 sign_buf = ldns_buffer_new(LDNS_MAX_PACKETLEN);
3175 if (ldns_rrsig2buffer_wire(sign_buf, signature)
3176 != LDNS_STATUS_OK) {
3177 ldns_buffer_free(sign_buf);
3179 ldns_rr_free(signature);
3184 for(i = 0; i < ldns_rr_list_rr_count(rrset); i++) {
3185 ldns_rr2canonical(ldns_rr_list_rr(rrset, i));
3189 if (ldns_rr_list2buffer_wire(sign_buf, rrset)
3190 != LDNS_STATUS_OK) {
3191 ldns_buffer_free(sign_buf);
3192 ldns_rr_free(signature);
3196 b64_rdf = hsm_sign_buffer(
ctx, sign_buf, key, sign_params->
algorithm);
3198 ldns_buffer_free(sign_buf);
3201 ldns_rr_free(signature);
3205 ldns_rr_rrsig_set_sig(signature, b64_rdf);
3233 sign_params->
owner = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME,
"dummy");
3234 sign_params->
algorithm = (ldns_algorithm) alg;
3235 sign_params->
flags = LDNS_KEY_ZONE_KEY;
3237 sign_params->
flags |= LDNS_KEY_SEP_KEY;
3254 tag = ldns_calc_keytag(dnskey_rr);
3256 ldns_rr_free(dnskey_rr);
3284 session = hsm_find_key_session(
ctx, key);
3285 if (!session)
return NULL;
3287 dnskey = ldns_rr_new();
3288 ldns_rr_set_type(dnskey, LDNS_RR_TYPE_DNSKEY);
3290 ldns_rr_set_owner(dnskey, ldns_rdf_clone(sign_params->
owner));
3292 ldns_rr_push_rdf(dnskey,
3293 ldns_native2rdf_int16(LDNS_RDF_TYPE_INT16,
3294 sign_params->
flags));
3295 ldns_rr_push_rdf(dnskey,
3296 ldns_native2rdf_int8(LDNS_RDF_TYPE_INT8,
3297 LDNS_DNSSEC_KEYPROTO));
3298 ldns_rr_push_rdf(dnskey,
3299 ldns_native2rdf_int8(LDNS_RDF_TYPE_ALG,
3302 rdata = hsm_get_key_rdata(
ctx, session, key);
3303 if (rdata == NULL) {
3304 ldns_rr_free(dnskey);
3307 ldns_rr_push_rdf(dnskey, rdata);
3314 unsigned char *buffer,
3315 unsigned long length)
3320 if (!buffer)
return -1;
3344 unsigned char rnd_buf[4];
3347 memcpy(&rnd, rnd_buf, 4);
3359 unsigned char rnd_buf[8];
3362 memcpy(&rnd, rnd_buf, 8);
3375 const char *token_label,
3383 result = hsm_session_init(
_hsm_ctx,
3391 result = hsm_ctx_add_session(
_hsm_ctx, session);
3402 strcmp(
ctx->
session[i]->module->name, repository) == 0) {
3408 "hsm_token_attached()",
3409 "Can't find repository: %s", repository);
3448 printf(
"\t\tmodule at %p (sym %p)\n", (
void *) session->module, (
void *) session->module->sym);
3449 printf(
"\t\tmodule path: %s\n", session->module->path);
3450 printf(
"\t\trepository name: %s\n", session->module->name);
3451 printf(
"\t\ttoken label: %s\n", session->module->token_label);
3452 printf(
"\t\tsess handle: %u\n", (
unsigned int) session->
session);
3458 printf(
"CTX Sessions: %lu\n",
3461 printf(
"\tSession at %p\n", (
void *)
ctx->
session[i]);
3473 printf(
"\tprivkey handle: %u\n", (
unsigned int) key->
private_key);
3475 printf(
"\tpubkey handle: %u\n", (
unsigned int) key->
public_key);
3477 printf(
"\tpubkey handle: %s\n",
"NULL");
3479 printf(
"\trepository: %s\n", key->
modulename);
3481 printf(
"\tsize: %lu\n", key_info->
keysize);
3482 printf(
"\tid: %s\n", key_info->
id);
3485 printf(
"key: hsm_get_key_info() returned NULL\n");
3488 printf(
"key: <void>\n");
3500 fprintf(stderr,
"%s\n", message);
3503 fprintf(stderr,
"Unknown error\n");
3520 result = hsm_get_slot_id(
ctx,
3521 session->module->sym,
3522 session->module->token_label,
3524 if (result !=
HSM_OK)
return;
3527 if (hsm_pkcs11_check_error(
ctx, rv,
"C_GetTokenInfo")) {
3531 printf(
"Repository: %s\n",session->module->name);
3533 printf(
"\tModule: %s\n", session->module->path);
3534 printf(
"\tSlot: %lu\n",
slot_id);
3535 printf(
"\tToken Label: %.*s\n",
3536 (
int)
sizeof(token_info.
label), token_info.
label);
3537 printf(
"\tManufacturer: %.*s\n",
3538 (
int)
sizeof(token_info.manufacturerID), token_info.manufacturerID);
3539 printf(
"\tModel: %.*s\n",
3540 (
int)
sizeof(token_info.
model), token_info.
model);
3541 printf(
"\tSerial: %.*s\n",
3542 (
int)
sizeof(token_info.serialNumber), token_info.serialNumber);
3550keycache_cmpfunc(
const void* a,
const void* b)
3552 const char* x = (
const char*)a;
3553 const char* y = (
const char*)b;
3554 return strcmp(x, y);
3558keycache_delfunc(ldns_rbnode_t* node,
void* cargo)
3561 free((
void*)node->key);
3563 free((
void*)node->data);
3570 ctx->
keycache = ldns_rbtree_create(keycache_cmpfunc);
3578 ldns_traverse_postorder(
ctx->
keycache, keycache_delfunc, NULL);
3588 ldns_rbnode_t* node;
3591 node = ldns_rbtree_search(
ctx->
keycache, locator);
3593 if (node == LDNS_RBTREE_NULL || node == NULL) {
3598 CHECKALLOC(node = malloc(
sizeof(ldns_rbnode_t)));
3599 node->key = strdup(locator);
3607 if (node == LDNS_RBTREE_NULL || node == NULL)
hsm_repository_t * hsm_repository_new(char *name, char *module, char *tokenlabel, char *pin, uint8_t use_pubkey, uint8_t allowextract, uint8_t require_backup)
ldns_rr * hsm_sign_rrset(hsm_ctx_t *ctx, const ldns_rr_list *rrset, const libhsm_key_t *key, const hsm_sign_params_t *sign_params)
void libhsm_key_list_free(libhsm_key_t **key_list, size_t count)
void hsm_ctx_set_error(hsm_ctx_t *ctx, int error, const char *action, const char *message,...)
const libhsm_key_t * keycache_lookup(hsm_ctx_t *ctx, const char *locator)
pthread_mutex_t _hsm_ctx_mutex
uint64_t hsm_random64(hsm_ctx_t *ctx)
char * hsm_get_error(hsm_ctx_t *gctx)
uint32_t hsm_random32(hsm_ctx_t *ctx)
void hsm_print_error(hsm_ctx_t *gctx)
libhsm_key_t * hsm_find_key_by_id(hsm_ctx_t *ctx, const char *id)
int hsm_token_attached(hsm_ctx_t *ctx, const char *repository)
#define HSM_TOKEN_LABEL_LENGTH
libhsm_key_t * hsm_generate_rsa_key(hsm_ctx_t *ctx, const char *repository, unsigned long keysize)
libhsm_key_t * hsm_generate_gost_key(hsm_ctx_t *ctx, const char *repository)
void hsm_print_key(hsm_ctx_t *ctx, libhsm_key_t *key)
hsm_sign_params_t * hsm_sign_params_new()
void hsm_print_ctx(hsm_ctx_t *ctx)
void hsm_repository_free(hsm_repository_t *r)
int hsm_attach(const char *repository, const char *token_label, const char *path, const char *pin, const hsm_config_t *config)
char * hsm_get_key_id(hsm_ctx_t *ctx, const libhsm_key_t *key)
void libhsm_key_info_free(libhsm_key_info_t *key_info)
libhsm_key_t ** hsm_list_keys_repository(hsm_ctx_t *ctx, size_t *count, const char *repository)
int hsm_random_buffer(hsm_ctx_t *ctx, unsigned char *buffer, unsigned long length)
int hsm_open2(hsm_repository_t *rlist, char *(pin_callback)(unsigned int, const char *, unsigned int))
ldns_rr * hsm_get_dnskey(hsm_ctx_t *ctx, const libhsm_key_t *key, const hsm_sign_params_t *sign_params)
libhsm_key_t * hsm_generate_dsa_key(hsm_ctx_t *ctx, const char *repository, unsigned long keysize)
libhsm_key_t * hsm_generate_eddsa_key(hsm_ctx_t *ctx, const char *repository, const char *curve)
int hsm_keytag(const char *loc, int alg, int sep, uint16_t *keytag)
libhsm_key_t * hsm_generate_ecdsa_key(hsm_ctx_t *ctx, const char *repository, const char *curve)
void hsm_print_session(hsm_session_t *session)
void keycache_create(hsm_ctx_t *ctx)
int hsm_remove_key(hsm_ctx_t *ctx, libhsm_key_t *key)
void hsm_print_tokeninfo(hsm_ctx_t *ctx)
libhsm_key_info_t * hsm_get_key_info(hsm_ctx_t *ctx, const libhsm_key_t *key)
void hsm_destroy_context(hsm_ctx_t *ctx)
libhsm_key_t ** hsm_list_keys(hsm_ctx_t *ctx, size_t *count)
void keycache_destroy(hsm_ctx_t *ctx)
void libhsm_key_free(libhsm_key_t *key)
void hsm_sign_params_free(hsm_sign_params_t *params)
hsm_ctx_t * hsm_create_context()
#define HSM_NO_REPOSITORIES
#define HSM_ERROR_MSGSIZE
#define HSM_MODULE_NOT_FOUND
#define HSM_REPOSITORY_NOT_FOUND
#define HSM_MAX_SIGNATURE_LENGTH
#define HSM_PIN_INCORRECT
#define CKM_DSA_PARAMETER_GEN
#define CKR_SESSION_COUNT
#define CKR_DEVICE_MEMORY
#define CKR_GENERAL_ERROR
#define CKR_MECHANISM_INVALID
#define CKR_SLOT_ID_INVALID
#define CKR_ATTRIBUTE_TYPE_INVALID
#define CKR_FUNCTION_CANCELED
#define CKR_UNWRAPPING_KEY_HANDLE_INVALID
#define CKR_WRAPPING_KEY_SIZE_RANGE
#define CKR_MECHANISM_PARAM_INVALID
#define CKR_TOKEN_NOT_RECOGNIZED
#define CKR_ATTRIBUTE_SENSITIVE
#define CKR_PIN_LEN_RANGE
#define CKR_RANDOM_SEED_NOT_SUPPORTED
#define CKR_SESSION_PARALLEL_NOT_SUPPORTED
#define CKR_ATTRIBUTE_READ_ONLY
#define CKR_WRAPPING_KEY_TYPE_INCONSISTENT
#define CKR_SESSION_EXISTS
unsigned long int CK_ULONG
#define CKA_PUBLIC_EXPONENT
#define CKM_RSA_PKCS_KEY_PAIR_GEN
#define CKR_SESSION_READ_ONLY
#define CKA_GOSTR3410PARAMS
#define CKR_ENCRYPTED_DATA_LEN_RANGE
#define CKR_SIGNATURE_INVALID
#define CKR_SESSION_HANDLE_INVALID
struct ck_function_list * CK_FUNCTION_LIST_PTR
#define CKR_TOKEN_NOT_PRESENT
#define CKR_CRYPTOKI_NOT_INITIALIZED
#define CKR_PIN_INCORRECT
#define CKR_WRAPPED_KEY_INVALID
#define CKR_WRAPPING_KEY_HANDLE_INVALID
#define CKR_MUTEX_NOT_LOCKED
#define CKR_SESSION_CLOSED
#define CKM_DSA_KEY_PAIR_GEN
#define CKF_OS_LOCKING_OK
#define CKM_EC_EDWARDS_KEY_PAIR_GEN
#define CKR_OBJECT_HANDLE_INVALID
#define CKR_UNWRAPPING_KEY_SIZE_RANGE
#define CKR_ENCRYPTED_DATA_INVALID
#define CKR_CRYPTOKI_ALREADY_INITIALIZED
#define CKF_SERIAL_SESSION
#define CKR_FUNCTION_FAILED
#define CKR_OPERATION_NOT_INITIALIZED
#define CKM_EC_KEY_PAIR_GEN
#define CKR_KEY_SIZE_RANGE
#define CKR_TEMPLATE_INCONSISTENT
#define CKR_OPERATION_ACTIVE
#define CKR_DATA_LEN_RANGE
#define CKR_BUFFER_TOO_SMALL
#define CKS_RW_USER_FUNCTIONS
#define CKR_USER_PIN_NOT_INITIALIZED
#define CKR_USER_ALREADY_LOGGED_IN
#define CKR_STATE_UNSAVEABLE
#define CKR_INFORMATION_SENSITIVE
#define CKR_ATTRIBUTE_VALUE_INVALID
#define CKR_FUNCTION_NOT_SUPPORTED
#define CKR_USER_NOT_LOGGED_IN
#define CKR_DEVICE_REMOVED
#define CKR_TOKEN_WRITE_PROTECTED
#define CKR_TEMPLATE_INCOMPLETE
#define CKM_GOSTR3410_KEY_PAIR_GEN
#define CKR_FUNCTION_NOT_PARALLEL
#define CKR_SIGNATURE_LEN_RANGE
#define CKR_USER_TYPE_INVALID
#define CKR_KEY_HANDLE_INVALID
#define CKA_GOSTR3411PARAMS
#define CKR_SAVED_STATE_INVALID
unsigned char CK_UTF8CHAR
#define CKR_WRAPPED_KEY_LEN_RANGE
#define CKR_KEY_TYPE_INCONSISTENT
#define CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT
CK_C_GetSlotList C_GetSlotList
CK_C_GetTokenInfo C_GetTokenInfo
ck_mechanism_type_t mechanism
unsigned int allow_extract
char error_message[HSM_ERROR_MSGSIZE]
const char * error_action
hsm_session_t * session[HSM_MAX_SESSIONS]
pthread_mutex_t * keycache_lock
unsigned int allow_extract
hsm_module_t *unsigned long session
unsigned long private_key