1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 * Copyright 2014 Nexenta Systems, Inc. All rights reserved. 25 * Copyright (c) 2018, Joyent, Inc. 26 */ 27 28 #include <stdlib.h> 29 #include <strings.h> 30 #include <sys/types.h> 31 #include <security/cryptoki.h> 32 #include "softObject.h" 33 #include "softOps.h" 34 #include "softSession.h" 35 #include "softMAC.h" 36 #include "softRSA.h" 37 #include "softDSA.h" 38 #include "softEC.h" 39 #include "softCrypt.h" 40 41 /* 42 * soft_sign_init() 43 * 44 * Arguments: 45 * session_p: pointer to soft_session_t struct 46 * pMechanism: pointer to CK_MECHANISM struct provided by application 47 * key_p: pointer to key soft_object_t struct 48 * 49 * Description: 50 * called by C_SignInit(). This function calls the corresponding 51 * sign init routine based on the mechanism. 52 * 53 */ 54 CK_RV 55 soft_sign_init(soft_session_t *session_p, CK_MECHANISM_PTR pMechanism, 56 soft_object_t *key_p) 57 { 58 59 switch (pMechanism->mechanism) { 60 61 case CKM_SSL3_MD5_MAC: 62 case CKM_SSL3_SHA1_MAC: 63 case CKM_MD5_HMAC_GENERAL: 64 case CKM_MD5_HMAC: 65 case CKM_SHA_1_HMAC_GENERAL: 66 case CKM_SHA_1_HMAC: 67 case CKM_SHA256_HMAC_GENERAL: 68 case CKM_SHA256_HMAC: 69 case CKM_SHA384_HMAC_GENERAL: 70 case CKM_SHA384_HMAC: 71 case CKM_SHA512_HMAC_GENERAL: 72 case CKM_SHA512_HMAC: 73 74 return (soft_hmac_sign_verify_init_common(session_p, 75 pMechanism, key_p, B_TRUE)); 76 77 case CKM_RSA_X_509: 78 case CKM_RSA_PKCS: 79 case CKM_MD5_RSA_PKCS: 80 case CKM_SHA1_RSA_PKCS: 81 case CKM_SHA256_RSA_PKCS: 82 case CKM_SHA384_RSA_PKCS: 83 case CKM_SHA512_RSA_PKCS: 84 85 return (soft_rsa_sign_verify_init_common(session_p, pMechanism, 86 key_p, B_TRUE)); 87 88 case CKM_DSA: 89 case CKM_DSA_SHA1: 90 91 return (soft_dsa_sign_verify_init_common(session_p, pMechanism, 92 key_p, B_TRUE)); 93 94 case CKM_ECDSA: 95 case CKM_ECDSA_SHA1: 96 97 return (soft_ecc_sign_verify_init_common(session_p, pMechanism, 98 key_p, B_TRUE)); 99 100 case CKM_DES_MAC_GENERAL: 101 case CKM_DES_MAC: 102 103 return (soft_des_sign_verify_init_common(session_p, pMechanism, 104 key_p, B_TRUE)); 105 106 case CKM_AES_CMAC_GENERAL: 107 case CKM_AES_CMAC: 108 case CKM_AES_GMAC: 109 110 return (soft_aes_sign_verify_init_common(session_p, pMechanism, 111 key_p, B_TRUE)); 112 113 default: 114 return (CKR_MECHANISM_INVALID); 115 } 116 117 } 118 119 120 /* 121 * soft_sign() 122 * 123 * Arguments: 124 * session_p: pointer to soft_session_t struct 125 * pData: pointer to the input data to be signed 126 * ulDataLen: length of the input data 127 * pSignature: pointer to the signature after signing 128 * pulSignatureLen: pointer to the length of the signature 129 * 130 * Description: 131 * called by C_Sign(). This function calls the corresponding 132 * sign routine based on the mechanism. 133 * 134 */ 135 CK_RV 136 soft_sign(soft_session_t *session_p, CK_BYTE_PTR pData, 137 CK_ULONG ulDataLen, CK_BYTE_PTR pSignature, 138 CK_ULONG_PTR pulSignatureLen) 139 { 140 141 CK_MECHANISM_TYPE mechanism = session_p->sign.mech.mechanism; 142 CK_RV rv = CKR_OK; 143 144 switch (mechanism) { 145 146 case CKM_SSL3_MD5_MAC: 147 case CKM_SSL3_SHA1_MAC: 148 case CKM_MD5_HMAC_GENERAL: 149 case CKM_MD5_HMAC: 150 case CKM_SHA_1_HMAC_GENERAL: 151 case CKM_SHA_1_HMAC: 152 case CKM_SHA256_HMAC_GENERAL: 153 case CKM_SHA256_HMAC: 154 case CKM_SHA384_HMAC_GENERAL: 155 case CKM_SHA384_HMAC: 156 case CKM_SHA512_HMAC_GENERAL: 157 case CKM_SHA512_HMAC: 158 { 159 CK_BYTE hmac[SHA512_DIGEST_LENGTH]; /* use the maximum size */ 160 161 if (pSignature != NULL) { 162 /* Pass local buffer to avoid overflow. */ 163 rv = soft_hmac_sign_verify_common(session_p, pData, 164 ulDataLen, hmac, pulSignatureLen, B_TRUE); 165 } else { 166 /* Pass original pSignature, let callee to handle it. */ 167 rv = soft_hmac_sign_verify_common(session_p, pData, 168 ulDataLen, pSignature, pulSignatureLen, B_TRUE); 169 } 170 171 if ((rv == CKR_OK) && (pSignature != NULL)) 172 (void) memcpy(pSignature, hmac, *pulSignatureLen); 173 174 return (rv); 175 } 176 case CKM_DES_MAC_GENERAL: 177 case CKM_DES_MAC: 178 { 179 CK_BYTE signature[DES_BLOCK_LEN]; /* use the maximum size */ 180 181 if (pSignature != NULL) { 182 /* Pass local buffer to avoid overflow. */ 183 rv = soft_des_sign_verify_common(session_p, pData, 184 ulDataLen, signature, pulSignatureLen, B_TRUE, 185 B_FALSE); 186 } else { 187 /* Pass NULL, let callee to handle it. */ 188 rv = soft_des_sign_verify_common(session_p, pData, 189 ulDataLen, NULL, pulSignatureLen, B_TRUE, B_FALSE); 190 } 191 192 if ((rv == CKR_OK) && (pSignature != NULL)) 193 (void) memcpy(pSignature, signature, *pulSignatureLen); 194 195 return (rv); 196 } 197 case CKM_AES_CMAC_GENERAL: 198 case CKM_AES_CMAC: 199 case CKM_AES_GMAC: 200 { 201 CK_BYTE signature[AES_BLOCK_LEN]; 202 203 if (pSignature != NULL) { 204 /* Pass local buffer to avoid overflow. */ 205 rv = soft_aes_sign_verify_common(session_p, pData, 206 ulDataLen, signature, pulSignatureLen, B_TRUE, 207 B_FALSE); 208 } else { 209 /* Pass NULL, let callee handle it. */ 210 rv = soft_aes_sign_verify_common(session_p, pData, 211 ulDataLen, NULL, pulSignatureLen, B_TRUE, B_FALSE); 212 } 213 214 if ((rv == CKR_OK) && (pSignature != NULL)) 215 (void) memcpy(pSignature, signature, *pulSignatureLen); 216 217 return (rv); 218 } 219 case CKM_RSA_X_509: 220 case CKM_RSA_PKCS: 221 222 return (soft_rsa_sign_common(session_p, pData, ulDataLen, 223 pSignature, pulSignatureLen, mechanism)); 224 225 case CKM_MD5_RSA_PKCS: 226 case CKM_SHA1_RSA_PKCS: 227 case CKM_SHA256_RSA_PKCS: 228 case CKM_SHA384_RSA_PKCS: 229 case CKM_SHA512_RSA_PKCS: 230 231 return (soft_rsa_digest_sign_common(session_p, pData, ulDataLen, 232 pSignature, pulSignatureLen, mechanism, B_FALSE)); 233 234 case CKM_DSA: 235 236 return (soft_dsa_sign(session_p, pData, ulDataLen, 237 pSignature, pulSignatureLen)); 238 239 case CKM_DSA_SHA1: 240 241 return (soft_dsa_digest_sign_common(session_p, pData, ulDataLen, 242 pSignature, pulSignatureLen, B_FALSE)); 243 244 case CKM_ECDSA: 245 246 return (soft_ecc_sign(session_p, pData, ulDataLen, 247 pSignature, pulSignatureLen)); 248 249 case CKM_ECDSA_SHA1: 250 251 return (soft_ecc_digest_sign_common(session_p, pData, ulDataLen, 252 pSignature, pulSignatureLen, B_FALSE)); 253 254 default: 255 return (CKR_MECHANISM_INVALID); 256 } 257 } 258 259 260 /* 261 * soft_sign_update() 262 * 263 * Arguments: 264 * session_p: pointer to soft_session_t struct 265 * pPart: pointer to the input data to be signed 266 * ulPartLen: length of the input data 267 * 268 * Description: 269 * called by C_SignUpdate(). This function calls the corresponding 270 * sign update routine based on the mechanism. 271 * 272 */ 273 CK_RV 274 soft_sign_update(soft_session_t *session_p, CK_BYTE_PTR pPart, 275 CK_ULONG ulPartLen) 276 { 277 CK_MECHANISM_TYPE mechanism = session_p->sign.mech.mechanism; 278 279 switch (mechanism) { 280 281 case CKM_SSL3_MD5_MAC: 282 case CKM_SSL3_SHA1_MAC: 283 case CKM_MD5_HMAC_GENERAL: 284 case CKM_MD5_HMAC: 285 case CKM_SHA_1_HMAC_GENERAL: 286 case CKM_SHA_1_HMAC: 287 case CKM_SHA256_HMAC_GENERAL: 288 case CKM_SHA256_HMAC: 289 case CKM_SHA384_HMAC_GENERAL: 290 case CKM_SHA384_HMAC: 291 case CKM_SHA512_HMAC_GENERAL: 292 case CKM_SHA512_HMAC: 293 294 return (soft_hmac_sign_verify_update(session_p, pPart, 295 ulPartLen, B_TRUE)); 296 297 case CKM_DES_MAC_GENERAL: 298 case CKM_DES_MAC: 299 300 return (soft_des_mac_sign_verify_update(session_p, pPart, 301 ulPartLen)); 302 303 case CKM_AES_CMAC_GENERAL: 304 case CKM_AES_CMAC: 305 case CKM_AES_GMAC: 306 307 return (soft_aes_mac_sign_verify_update(session_p, pPart, 308 ulPartLen)); 309 310 case CKM_MD5_RSA_PKCS: 311 case CKM_SHA1_RSA_PKCS: 312 case CKM_SHA256_RSA_PKCS: 313 case CKM_SHA384_RSA_PKCS: 314 case CKM_SHA512_RSA_PKCS: 315 /* 316 * The MD5/SHA1 digest value is accumulated in the context 317 * of the multiple-part digesting operation. In the final 318 * operation, the digest is encoded and then perform RSA 319 * signing. 320 */ 321 case CKM_DSA_SHA1: 322 case CKM_ECDSA_SHA1: 323 324 return (soft_digest_update(session_p, pPart, ulPartLen)); 325 326 default: 327 /* PKCS11: The mechanism only supports single-part operation. */ 328 return (CKR_MECHANISM_INVALID); 329 } 330 } 331 332 333 /* 334 * soft_sign_final() 335 * 336 * Arguments: 337 * session_p: pointer to soft_session_t struct 338 * pSignature: pointer to the signature after signing 339 * pulSignatureLen: pointer to the length of the signature 340 * 341 * Description: 342 * called by C_SignFinal(). This function calls the corresponding 343 * sign final routine based on the mechanism. 344 * 345 */ 346 CK_RV 347 soft_sign_final(soft_session_t *session_p, CK_BYTE_PTR pSignature, 348 CK_ULONG_PTR pulSignatureLen) 349 { 350 351 CK_MECHANISM_TYPE mechanism = session_p->sign.mech.mechanism; 352 CK_RV rv = CKR_OK; 353 354 switch (mechanism) { 355 356 case CKM_SSL3_MD5_MAC: 357 case CKM_SSL3_SHA1_MAC: 358 case CKM_MD5_HMAC_GENERAL: 359 case CKM_MD5_HMAC: 360 case CKM_SHA_1_HMAC_GENERAL: 361 case CKM_SHA_1_HMAC: 362 case CKM_SHA256_HMAC_GENERAL: 363 case CKM_SHA256_HMAC: 364 case CKM_SHA384_HMAC_GENERAL: 365 case CKM_SHA384_HMAC: 366 case CKM_SHA512_HMAC_GENERAL: 367 case CKM_SHA512_HMAC: 368 { 369 CK_BYTE hmac[SHA512_DIGEST_LENGTH]; /* use the maximum size */ 370 371 if (pSignature != NULL) { 372 /* Pass local buffer to avoid overflow */ 373 rv = soft_hmac_sign_verify_common(session_p, NULL, 374 0, hmac, pulSignatureLen, B_TRUE); 375 } else { 376 /* Pass original pSignature, let callee to handle it. */ 377 rv = soft_hmac_sign_verify_common(session_p, NULL, 378 0, pSignature, pulSignatureLen, B_TRUE); 379 } 380 381 if ((rv == CKR_OK) && (pSignature != NULL)) 382 (void) memcpy(pSignature, hmac, *pulSignatureLen); 383 384 return (rv); 385 } 386 case CKM_DES_MAC_GENERAL: 387 case CKM_DES_MAC: 388 { 389 CK_BYTE signature[DES_BLOCK_LEN]; /* use the maximum size */ 390 391 if (pSignature != NULL) { 392 /* Pass local buffer to avoid overflow. */ 393 rv = soft_des_sign_verify_common(session_p, NULL, 0, 394 signature, pulSignatureLen, B_TRUE, B_TRUE); 395 } else { 396 /* Pass NULL, let callee to handle it. */ 397 rv = soft_des_sign_verify_common(session_p, NULL, 0, 398 NULL, pulSignatureLen, B_TRUE, B_TRUE); 399 } 400 401 if ((rv == CKR_OK) && (pSignature != NULL)) 402 (void) memcpy(pSignature, signature, *pulSignatureLen); 403 404 return (rv); 405 } 406 case CKM_AES_CMAC_GENERAL: 407 case CKM_AES_CMAC: 408 case CKM_AES_GMAC: 409 { 410 CK_BYTE signature[AES_BLOCK_LEN]; /* use the maximum size */ 411 412 if (pSignature != NULL) { 413 /* Pass local buffer to avoid overflow. */ 414 rv = soft_aes_sign_verify_common(session_p, NULL, 0, 415 signature, pulSignatureLen, B_TRUE, B_TRUE); 416 } else { 417 /* Pass NULL, let callee handle it. */ 418 rv = soft_aes_sign_verify_common(session_p, NULL, 0, 419 NULL, pulSignatureLen, B_TRUE, B_TRUE); 420 } 421 422 if ((rv == CKR_OK) && (pSignature != NULL)) 423 (void) memcpy(pSignature, signature, *pulSignatureLen); 424 425 return (rv); 426 } 427 case CKM_MD5_RSA_PKCS: 428 case CKM_SHA1_RSA_PKCS: 429 case CKM_SHA256_RSA_PKCS: 430 case CKM_SHA384_RSA_PKCS: 431 case CKM_SHA512_RSA_PKCS: 432 433 return (soft_rsa_digest_sign_common(session_p, NULL, 0, 434 pSignature, pulSignatureLen, mechanism, B_TRUE)); 435 436 case CKM_DSA_SHA1: 437 438 return (soft_dsa_digest_sign_common(session_p, NULL, 0, 439 pSignature, pulSignatureLen, B_TRUE)); 440 441 case CKM_ECDSA_SHA1: 442 443 return (soft_ecc_digest_sign_common(session_p, NULL, 0, 444 pSignature, pulSignatureLen, B_TRUE)); 445 446 default: 447 /* PKCS11: The mechanism only supports single-part operation. */ 448 return (CKR_MECHANISM_INVALID); 449 } 450 } 451 452 453 CK_RV 454 soft_sign_recover_init(soft_session_t *session_p, CK_MECHANISM_PTR pMechanism, 455 soft_object_t *key_p) 456 { 457 458 switch (pMechanism->mechanism) { 459 460 case CKM_RSA_X_509: 461 case CKM_RSA_PKCS: 462 463 return (soft_rsa_sign_verify_init_common(session_p, pMechanism, 464 key_p, B_TRUE)); 465 466 default: 467 return (CKR_MECHANISM_INVALID); 468 } 469 } 470 471 472 CK_RV 473 soft_sign_recover(soft_session_t *session_p, CK_BYTE_PTR pData, 474 CK_ULONG ulDataLen, CK_BYTE_PTR pSignature, 475 CK_ULONG_PTR pulSignatureLen) 476 { 477 478 CK_MECHANISM_TYPE mechanism = session_p->sign.mech.mechanism; 479 480 switch (mechanism) { 481 482 case CKM_RSA_X_509: 483 case CKM_RSA_PKCS: 484 485 return (soft_rsa_sign_common(session_p, pData, ulDataLen, 486 pSignature, pulSignatureLen, mechanism)); 487 488 default: 489 return (CKR_MECHANISM_INVALID); 490 } 491 } 492 493 /* 494 * This function frees the allocated active crypto context. 495 * It is only called by the first tier of sign/verify routines 496 * and the caller of this function may or may not hold the session mutex. 497 */ 498 void 499 soft_sign_verify_cleanup(soft_session_t *session_p, boolean_t sign, 500 boolean_t lock_held) 501 { 502 503 crypto_active_op_t *active_op; 504 boolean_t lock_true = B_TRUE; 505 506 if (!lock_held) 507 (void) pthread_mutex_lock(&session_p->session_mutex); 508 509 active_op = (sign) ? &(session_p->sign) : &(session_p->verify); 510 511 switch (active_op->mech.mechanism) { 512 513 case CKM_MD5_RSA_PKCS: 514 case CKM_SHA1_RSA_PKCS: 515 case CKM_SHA256_RSA_PKCS: 516 case CKM_SHA384_RSA_PKCS: 517 case CKM_SHA512_RSA_PKCS: 518 if (session_p->digest.context != NULL) { 519 free(session_p->digest.context); 520 session_p->digest.context = NULL; 521 session_p->digest.flags = 0; 522 } 523 /* FALLTHRU */ 524 525 case CKM_RSA_PKCS: 526 case CKM_RSA_X_509: 527 { 528 soft_rsa_ctx_t *rsa_ctx = 529 (soft_rsa_ctx_t *)active_op->context; 530 531 if (rsa_ctx != NULL && rsa_ctx->key != NULL) { 532 soft_cleanup_object(rsa_ctx->key); 533 free(rsa_ctx->key); 534 } 535 break; 536 537 } 538 case CKM_DSA_SHA1: 539 if (session_p->digest.context != NULL) { 540 free(session_p->digest.context); 541 session_p->digest.context = NULL; 542 session_p->digest.flags = 0; 543 } 544 545 /* FALLTHRU */ 546 case CKM_DSA: 547 { 548 soft_dsa_ctx_t *dsa_ctx = 549 (soft_dsa_ctx_t *)active_op->context; 550 551 if (dsa_ctx != NULL && dsa_ctx->key != NULL) { 552 soft_cleanup_object(dsa_ctx->key); 553 free(dsa_ctx->key); 554 } 555 break; 556 557 } 558 case CKM_SSL3_MD5_MAC: 559 case CKM_SSL3_SHA1_MAC: 560 case CKM_MD5_HMAC_GENERAL: 561 case CKM_MD5_HMAC: 562 case CKM_SHA_1_HMAC_GENERAL: 563 case CKM_SHA_1_HMAC: 564 case CKM_SHA256_HMAC_GENERAL: 565 case CKM_SHA256_HMAC: 566 case CKM_SHA384_HMAC_GENERAL: 567 case CKM_SHA384_HMAC: 568 case CKM_SHA512_HMAC_GENERAL: 569 case CKM_SHA512_HMAC: 570 if (active_op->context != NULL) { 571 explicit_bzero(active_op->context, 572 sizeof (soft_hmac_ctx_t)); 573 } 574 break; 575 case CKM_DES_MAC_GENERAL: 576 case CKM_DES_MAC: 577 if (session_p->encrypt.context != NULL) { 578 free(session_p->encrypt.context); 579 session_p->encrypt.context = NULL; 580 session_p->encrypt.flags = 0; 581 } 582 if (active_op->context != NULL) { 583 explicit_bzero(active_op->context, 584 sizeof (soft_des_ctx_t)); 585 } 586 break; 587 588 case CKM_AES_CMAC_GENERAL: 589 case CKM_AES_CMAC: 590 case CKM_AES_GMAC: 591 if (session_p->encrypt.context != NULL) { 592 soft_aes_free_ctx(session_p->encrypt.context); 593 session_p->encrypt.context = NULL; 594 session_p->encrypt.flags = 0; 595 } 596 if (active_op->context != NULL) { 597 explicit_bzero(active_op->context, 598 sizeof (soft_aes_sign_ctx_t)); 599 } 600 break; 601 602 } 603 604 if (active_op->context != NULL) { 605 free(active_op->context); 606 active_op->context = NULL; 607 } 608 609 active_op->flags = 0; 610 611 if (!lock_held) 612 SES_REFRELE(session_p, lock_true); 613 } 614