xref: /illumos-gate/usr/src/lib/pkcs11/pkcs11_tpm/common/object.c (revision 33c15889ebc635ca950ad611560d0f818cb8706a)
1 /*
2  *		Common Public License Version 0.5
3  *
4  *		THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF
5  *		THIS COMMON PUBLIC LICENSE ("AGREEMENT"). ANY USE,
6  *		REPRODUCTION OR DISTRIBUTION OF THE PROGRAM CONSTITUTES
7  *		RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
8  *
9  *		1. DEFINITIONS
10  *
11  *		"Contribution" means:
12  *		      a) in the case of the initial Contributor, the
13  *		      initial code and documentation distributed under
14  *		      this Agreement, and
15  *
16  *		      b) in the case of each subsequent Contributor:
17  *		      i) changes to the Program, and
18  *		      ii) additions to the Program;
19  *
20  *		      where such changes and/or additions to the Program
21  *		      originate from and are distributed by that
22  *		      particular Contributor. A Contribution 'originates'
23  *		      from a Contributor if it was added to the Program
24  *		      by such Contributor itself or anyone acting on such
25  *		      Contributor's behalf. Contributions do not include
26  *		      additions to the Program which: (i) are separate
27  *		      modules of software distributed in conjunction with
28  *		      the Program under their own license agreement, and
29  *		      (ii) are not derivative works of the Program.
30  *
31  *
32  *		"Contributor" means any person or entity that distributes
33  *		the Program.
34  *
35  *		"Licensed Patents " mean patent claims licensable by a
36  *		Contributor which are necessarily infringed by the use or
37  *		sale of its Contribution alone or when combined with the
38  *		Program.
39  *
40  *		"Program" means the Contributions distributed in
41  *		accordance with this Agreement.
42  *
43  *		"Recipient" means anyone who receives the Program under
44  *		this Agreement, including all Contributors.
45  *
46  *		2. GRANT OF RIGHTS
47  *
48  *		      a) Subject to the terms of this Agreement, each
49  *		      Contributor hereby grants Recipient a
50  *		      no - exclusive, worldwide, royalt - free copyright
51  *		      license to reproduce, prepare derivative works of,
52  *		      publicly display, publicly perform, distribute and
53  *		      sublicense the Contribution of such Contributor, if
54  *		      any, and such derivative works, in source code and
55  *		      object code form.
56  *
57  *		      b) Subject to the terms of this Agreement, each
58  *		      Contributor hereby grants Recipient a
59  *		      no - exclusive, worldwide, royalt - free patent
60  *		      license under Licensed Patents to make, use, sell,
61  *		      offer to sell, import and otherwise transfer the
62  *		      Contribution of such Contributor, if any, in source
63  *		      code and object code form. This patent license
64  *		      shall apply to the combination of the Contribution
65  *		      and the Program if, at the time the Contribution is
66  *		      added by the Contributor, such addition of the
67  *		      Contribution causes such combination to be covered
68  *		      by the Licensed Patents. The patent license shall
69  *		      not apply to any other combinations which include
70  *		      the Contribution. No hardware per se is licensed
71  *		      hereunder.
72  *
73  *		      c) Recipient understands that although each
74  *		      Contributor grants the licenses to its
75  *		      Contributions set forth herein, no assurances are
76  *		      provided by any Contributor that the Program does
77  *		      not infringe the patent or other intellectual
78  *		      property rights of any other entity. Each
79  *		      Contributor disclaims any liability to Recipient
80  *		      for claims brought by any other entity based on
81  *		      infringement of intellectual property rights or
82  *		      otherwise. As a condition to exercising the rights
83  *		      and licenses granted hereunder, each Recipient
84  *		      hereby assumes sole responsibility to secure any
85  *		      other intellectual property rights needed, if any.
86  *
87  *		      For example, if a third party patent license is
88  *		      required to allow Recipient to distribute the
89  *		      Program, it is Recipient's responsibility to
90  *		      acquire that license before distributing the
91  *		      Program.
92  *
93  *		      d) Each Contributor represents that to its
94  *		      knowledge it has sufficient copyright rights in its
95  *		      Contribution, if any, to grant the copyright
96  *		      license set forth in this Agreement.
97  *
98  *		3. REQUIREMENTS
99  *
100  *		A Contributor may choose to distribute the Program in
101  *		object code form under its own license agreement, provided
102  *		that:
103  *		      a) it complies with the terms and conditions of
104  *		      this Agreement; and
105  *
106  *		      b) its license agreement:
107  *		      i) effectively disclaims on behalf of all
108  *		      Contributors all warranties and conditions, express
109  *		      and implied, including warranties or conditions of
110  *		      title and no - infringement, and implied warranties
111  *		      or conditions of merchantability and fitness for a
112  *		      particular purpose;
113  *
114  *		      ii) effectively excludes on behalf of all
115  *		      Contributors all liability for damages, including
116  *		      direct, indirect, special, incidental and
117  *		      consequential damages, such as lost profits;
118  *
119  *		      iii) states that any provisions which differ from
120  *		      this Agreement are offered by that Contributor
121  *		      alone and not by any other party; and
122  *
123  *		      iv) states that source code for the Program is
124  *		      available from such Contributor, and informs
125  *		      licensees how to obtain it in a reasonable manner
126  *		      on or through a medium customarily used for
127  *		      software exchange.
128  *
129  *		When the Program is made available in source code form:
130  *		      a) it must be made available under this Agreement;
131  *		      and
132  *		      b) a copy of this Agreement must be included with
133  *		      each copy of the Program.
134  *
135  *		Contributors may not remove or alter any copyright notices
136  *		contained within the Program.
137  *
138  *		Each Contributor must identify itself as the originator of
139  *		its Contribution, if any, in a manner that reasonably
140  *		allows subsequent Recipients to identify the originator of
141  *		the Contribution.
142  *
143  *
144  *		4. COMMERCIAL DISTRIBUTION
145  *
146  *		Commercial distributors of software may accept certain
147  *		responsibilities with respect to end users, business
148  *		partners and the like. While this license is intended to
149  *		facilitate the commercial use of the Program, the
150  *		Contributor who includes the Program in a commercial
151  *		product offering should do so in a manner which does not
152  *		create potential liability for other Contributors.
153  *		Therefore, if a Contributor includes the Program in a
154  *		commercial product offering, such Contributor ("Commercial
155  *		Contributor") hereby agrees to defend and indemnify every
156  *		other Contributor ("Indemnified Contributor") against any
157  *		losses, damages and costs (collectively "Losses") arising
158  *		from claims, lawsuits and other legal actions brought by a
159  *		third party against the Indemnified Contributor to the
160  *		extent caused by the acts or omissions of such Commercial
161  *		Contributor in connection with its distribution of the
162  *		Program in a commercial product offering. The obligations
163  *		in this section do not apply to any claims or Losses
164  *		relating to any actual or alleged intellectual property
165  *		infringement. In order to qualify, an Indemnified
166  *		Contributor must: a) promptly notify the Commercial
167  *		Contributor in writing of such claim, and b) allow the
168  *		Commercial Contributor to control, and cooperate with the
169  *		Commercial Contributor in, the defense and any related
170  *		settlement negotiations. The Indemnified Contributor may
171  *		participate in any such claim at its own expense.
172  *
173  *
174  *		For example, a Contributor might include the Program in a
175  *		commercial product offering, Product X. That Contributor
176  *		is then a Commercial Contributor. If that Commercial
177  *		Contributor then makes performance claims, or offers
178  *		warranties related to Product X, those performance claims
179  *		and warranties are such Commercial Contributor's
180  *		responsibility alone. Under this section, the Commercial
181  *		Contributor would have to defend claims against the other
182  *		Contributors related to those performance claims and
183  *		warranties, and if a court requires any other Contributor
184  *		to pay any damages as a result, the Commercial Contributor
185  *		must pay those damages.
186  *
187  *
188  *		5. NO WARRANTY
189  *
190  *		EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE
191  *		PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT
192  *		WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
193  *		IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR
194  *		CONDITIONS OF TITLE, NO - INFRINGEMENT, MERCHANTABILITY OR
195  *		FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is solely
196  *		responsible for determining the appropriateness of using
197  *		and distributing the Program and assumes all risks
198  *		associated with its exercise of rights under this
199  *		Agreement, including but not limited to the risks and
200  *		costs of program errors, compliance with applicable laws,
201  *		damage to or loss of data, programs or equipment, and
202  *		unavailability or interruption of operations.
203  *
204  *		6. DISCLAIMER OF LIABILITY
205  *		EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER
206  *		RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY
207  *		FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
208  *		OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION
209  *		LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF
210  *		LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
211  *		(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
212  *		OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE
213  *		OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE
214  *		POSSIBILITY OF SUCH DAMAGES.
215  *
216  *		7. GENERAL
217  *
218  *		If any provision of this Agreement is invalid or
219  *		unenforceable under applicable law, it shall not affect
220  *		the validity or enforceability of the remainder of the
221  *		terms of this Agreement, and without further action by the
222  *		parties hereto, such provision shall be reformed to the
223  *		minimum extent necessary to make such provision valid and
224  *		enforceable.
225  *
226  *
227  *		If Recipient institutes patent litigation against a
228  *		Contributor with respect to a patent applicable to
229  *		software (including a cros - claim or counterclaim in a
230  *		lawsuit), then any patent licenses granted by that
231  *		Contributor to such Recipient under this Agreement shall
232  *		terminate as of the date such litigation is filed. In
233  *		addition, If Recipient institutes patent litigation
234  *		against any entity (including a cros - claim or
235  *		counterclaim in a lawsuit) alleging that the Program
236  *		itself (excluding combinations of the Program with other
237  *		software or hardware) infringes such Recipient's
238  *		patent(s), then such Recipient's rights granted under
239  *		Section 2(b) shall terminate as of the date such
240  *		litigation is filed.
241  *
242  *		All Recipient's rights under this Agreement shall
243  *		terminate if it fails to comply with any of the material
244  *		terms or conditions of this Agreement and does not cure
245  *		such failure in a reasonable period of time after becoming
246  *		aware of such noncompliance. If all Recipient's rights
247  *		under this Agreement terminate, Recipient agrees to cease
248  *		use and distribution of the Program as soon as reasonably
249  *		practicable. However, Recipient's obligations under this
250  *		Agreement and any licenses granted by Recipient relating
251  *		to the Program shall continue and survive.
252  *
253  *		Everyone is permitted to copy and distribute copies of
254  *		this Agreement, but in order to avoid inconsistency the
255  *		Agreement is copyrighted and may only be modified in the
256  *		following manner. The Agreement Steward reserves the right
257  *		to publish new versions (including revisions) of this
258  *		Agreement from time to time. No one other than the
259  *		Agreement Steward has the right to modify this Agreement.
260  *
261  *		IBM is the initial Agreement Steward. IBM may assign the
262  *		responsibility to serve as the Agreement Steward to a
263  *		suitable separate entity. Each new version of the
264  *		Agreement will be given a distinguishing version number.
265  *		The Program (including Contributions) may always be
266  *		distributed subject to the version of the Agreement under
267  *		which it was received. In addition, after a new version of
268  *		the Agreement is published, Contributor may elect to
269  *		distribute the Program (including its Contributions) under
270  *		the new version. Except as expressly stated in Sections
271  *		2(a) and 2(b) above, Recipient receives no rights or
272  *		licenses to the intellectual property of any Contributor
273  *		under this Agreement, whether expressly, by implication,
274  *		estoppel or otherwise. All rights in the Program not
275  *		expressly granted under this Agreement are reserved.
276  *
277  *
278  *		This Agreement is governed by the laws of the State of New
279  *		York and the intellectual property laws of the United
280  *		States of America. No party to this Agreement will bring a
281  *		legal action under this Agreement more than one year after
282  *		the cause of action arose. Each party waives its rights to
283  *		a jury trial in any resulting litigation.
284  *
285  *
286  *
287  * (C) COPYRIGHT International Business Machines Corp. 2001, 2002
288  */
289 /*
290  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
291  * Use is subject to license terms.
292  */
293 
294 #include "tpmtok_int.h"
295 
296 // object_create()
297 //
298 // Creates an object with the specified attributes.  Verifies that all required
299 // attributes are present and adds any missing attributes that have Cryptoki
300 // defined default values.  This routine does not check whether the session is
301 // authorized to create the object.  That is done elsewhere
302 // (see object_mgr_create())
303 CK_RV
object_create(CK_ATTRIBUTE * pTemplate,CK_ULONG ulCount,OBJECT ** obj)304 object_create(CK_ATTRIBUTE  * pTemplate,
305 	CK_ULONG	ulCount,
306 	OBJECT	** obj)
307 {
308 	OBJECT	* o	   = NULL;
309 	CK_ATTRIBUTE  * attr	= NULL;
310 	CK_ATTRIBUTE  * sensitive   = NULL;
311 	CK_ATTRIBUTE  * extractable = NULL;
312 	CK_ATTRIBUTE  * local	= NULL;
313 	CK_BBOOL	class_given = FALSE;
314 	CK_BBOOL	subclass_given = FALSE;
315 	CK_BBOOL	flag;
316 	CK_ULONG	class = 0xFFFFFFFF, subclass = 0xFFFFFFFF;
317 	CK_RV	   rc;
318 	unsigned int    i;
319 
320 	if (! pTemplate) {
321 		return (CKR_FUNCTION_FAILED);
322 	}
323 	// extract the object class and subclass
324 	//
325 	attr = pTemplate;
326 	for (i = 0; i < ulCount; i++, attr++) {
327 		if (attr->type == CKA_CLASS) {
328 			class = *(CK_OBJECT_CLASS *)attr->pValue;
329 			class_given = TRUE;
330 		}
331 
332 		if (attr->type == CKA_CERTIFICATE_TYPE) {
333 			subclass = *(CK_CERTIFICATE_TYPE *)attr->pValue;
334 			subclass_given = TRUE;
335 		}
336 
337 		if (attr->type == CKA_KEY_TYPE) {
338 			subclass = *(CK_KEY_TYPE *)attr->pValue;
339 			subclass_given = TRUE;
340 		}
341 
342 		if (attr->type == CKA_HW_FEATURE_TYPE) {
343 			subclass = *(CK_HW_FEATURE_TYPE *)attr->pValue;
344 			subclass_given = TRUE;
345 		}
346 	}
347 
348 	if (class_given == FALSE) {
349 		return (CKR_TEMPLATE_INCOMPLETE);
350 	}
351 	if (class != CKO_DATA && subclass_given != TRUE) {
352 		return (CKR_TEMPLATE_INCOMPLETE);
353 	}
354 
355 	rc = object_create_skel(pTemplate, ulCount,
356 	    MODE_CREATE, class, subclass, &o);
357 	if (rc != CKR_OK) {
358 		return (rc);
359 	}
360 	// for key objects, we need be careful...
361 	//
362 	// note:  I would think that keys loaded with C_CreateObject should
363 	//	have their CKA_NEVER_EXTRACTABLE == FALSE and
364 	//	CKA_ALWAYS_SENSITIVE == FALSE since the key data was presumably
365 	//	stored in the clear prior to the call to C_CreateObject.  The
366 	//	PKCS #11 spec doesn't impose this restriction however.
367 	//
368 	if (class == CKO_PRIVATE_KEY || class == CKO_SECRET_KEY) {
369 		rc = template_attribute_find(o->template, CKA_SENSITIVE, &attr);
370 		if (rc == FALSE) {
371 			rc = CKR_FUNCTION_FAILED;
372 			goto error;
373 		}
374 
375 		flag = *(CK_BBOOL *)attr->pValue;
376 
377 		rc = build_attribute(CKA_ALWAYS_SENSITIVE, &flag,
378 		    sizeof (CK_BYTE), &sensitive);
379 		if (rc != CKR_OK) {
380 			goto error;
381 		}
382 
383 		rc = template_attribute_find(o->template, CKA_EXTRACTABLE,
384 		    &attr);
385 		if (rc == FALSE) {
386 			rc = CKR_FUNCTION_FAILED;
387 			goto error;
388 		}
389 
390 		flag = *(CK_BBOOL *)attr->pValue;
391 		flag = (~flag) & 0x1;
392 
393 		rc = build_attribute(CKA_NEVER_EXTRACTABLE, &flag,
394 		    sizeof (CK_BYTE), &extractable);
395 		if (rc != CKR_OK) {
396 			goto error;
397 		}
398 		(void) template_update_attribute(o->template, sensitive);
399 		(void) template_update_attribute(o->template, extractable);
400 	}
401 
402 	*obj = o;
403 
404 	return (CKR_OK);
405 error:
406 	if (sensitive)    free(sensitive);
407 	if (extractable)  free(extractable);
408 	if (local)	free(local);
409 
410 	(void) object_free(o);
411 	return (rc);
412 }
413 
414 // object_copy()
415 //
416 // Builds a copy of the specified object.  The new object gets the original
417 // object's attribute template plus any additional attributes that are
418 // specified.   Verifies that all required attributes are present.  This
419 // routine does not check whether the session is authorized to copy the
420 // object -- routines at the individual object level don't have the
421 // concept of "session".  These checks are done by the object manager.
422 //
423 CK_RV
object_copy(CK_ATTRIBUTE * pTemplate,CK_ULONG ulCount,OBJECT * old_obj,OBJECT ** new_obj)424 object_copy(CK_ATTRIBUTE  * pTemplate,
425 	CK_ULONG	ulCount,
426 	OBJECT	* old_obj,
427 	OBJECT	** new_obj)
428 {
429 	TEMPLATE  * tmpl	= NULL;
430 	TEMPLATE  * new_tmpl = NULL;
431 	OBJECT    * o	= NULL;
432 	CK_BBOOL    found;
433 	CK_ULONG    class, subclass;
434 	CK_RV	rc;
435 
436 
437 	if (! old_obj || ! pTemplate || ! new_obj) {
438 		return (CKR_FUNCTION_FAILED);
439 	}
440 	o	= (OBJECT   *)malloc(sizeof (OBJECT));
441 	tmpl	= (TEMPLATE *)malloc(sizeof (TEMPLATE));
442 	new_tmpl = (TEMPLATE *)malloc(sizeof (TEMPLATE));
443 
444 	if (! o || ! tmpl || ! new_tmpl) {
445 		rc = CKR_HOST_MEMORY;
446 		goto error;
447 	}
448 
449 	(void) memset(o, 0x0, sizeof (OBJECT));
450 	(void) memset(tmpl,	0x0, sizeof (TEMPLATE));
451 	(void) memset(new_tmpl, 0x0, sizeof (TEMPLATE));
452 
453 	// copy the original object's attribute template
454 	//
455 	rc = template_copy(tmpl, old_obj->template);
456 	if (rc != CKR_OK) {
457 		goto error;
458 	}
459 	rc = template_add_attributes(new_tmpl, pTemplate, ulCount);
460 	if (rc != CKR_OK) {
461 		goto error;
462 	}
463 	// at this point, the new object has the list of attributes.  we need
464 	// to do some more checking now:
465 	//    1) invalid attribute values
466 	//    2) missing required attributes
467 	//    3) attributes inappropriate for the object class
468 	//    4) conflicting attributes/values
469 	//
470 
471 	found = template_get_class(tmpl, &class, &subclass);
472 	if (found == FALSE) {
473 		rc = CKR_TEMPLATE_INCONSISTENT;
474 		goto error;
475 	}
476 
477 	// The user cannot change object classes so we assume the existing
478 	// object attributes are valid.  we still need to check the new
479 	// attributes.   We cannot merge the new attributes in with the
480 	// old ones and then check for validity because some attributes
481 	// are added internally and are not allowed to be specified by
482 	// the user (ie. CKA_LOCAL for key types) but may still be part
483 	// of the old template.
484 	rc = template_validate_attributes(new_tmpl, class, subclass,
485 	    MODE_COPY);
486 	if (rc != CKR_OK)
487 		goto error;
488 
489 	rc = template_merge(tmpl, &new_tmpl);
490 	if (rc != CKR_OK) {
491 		goto error;
492 	}
493 
494 	rc = template_check_required_attributes(tmpl, class,
495 	    subclass, MODE_COPY);
496 	if (rc != CKR_OK)
497 		goto error;
498 
499 	o->template = tmpl;
500 	*new_obj = o;
501 
502 	return (CKR_OK);
503 error:
504 	if (tmpl)
505 		(void) template_free(tmpl);
506 	if (new_tmpl)
507 		(void) template_free(new_tmpl);
508 	if (o)
509 		(void) object_free(o);
510 
511 	return (rc);
512 }
513 
514 CK_RV
object_flatten(OBJECT * obj,CK_BYTE ** data,UINT32 * len)515 object_flatten(OBJECT    * obj,
516 	CK_BYTE  ** data,
517 	UINT32  *len)
518 {
519 	CK_BYTE    * buf = NULL;
520 	CK_ULONG_32	tmpl_len, total_len;
521 	CK_ULONG_32	offset;
522 	CK_ULONG_32	count;
523 	long	 rc;
524 
525 	if (! obj) {
526 		return (CKR_FUNCTION_FAILED);
527 	}
528 	count    = template_get_count(obj->template);
529 	tmpl_len = template_get_compressed_size(obj->template);
530 
531 	total_len = tmpl_len + sizeof (CK_OBJECT_CLASS_32) +
532 	    sizeof (CK_ULONG_32) + 8;
533 
534 	buf = (CK_BYTE *)malloc(total_len);
535 	if (!buf) {
536 		return (CKR_HOST_MEMORY);
537 	}
538 
539 	(void) memset((CK_BYTE *)buf, 0x0, total_len);
540 
541 	offset = 0;
542 
543 	(void) memcpy(buf + offset, &obj->class, sizeof (CK_OBJECT_CLASS_32));
544 	offset += sizeof (CK_OBJECT_CLASS_32);
545 
546 	(void) memcpy(buf + offset, &count, sizeof (CK_ULONG_32));
547 	offset += sizeof (CK_ULONG_32);
548 
549 	(void) memcpy(buf + offset, &obj->name,  sizeof (CK_BYTE) * 8);
550 	offset += 8;
551 	rc = template_flatten(obj->template, buf + offset);
552 	if (rc != CKR_OK) {
553 		free(buf);
554 		return (rc);
555 	}
556 
557 	*data = buf;
558 	*len  = total_len;
559 
560 	return (CKR_OK);
561 }
562 
563 CK_BBOOL
object_free(OBJECT * obj)564 object_free(OBJECT *obj)
565 {
566 	(void) template_free(obj->template);
567 	free(obj);
568 
569 	return (TRUE);
570 }
571 
572 
573 // object_is_modifiable()
574 //
575 CK_BBOOL
object_is_modifiable(OBJECT * obj)576 object_is_modifiable(OBJECT *obj)
577 {
578 	CK_ATTRIBUTE  * attr = NULL;
579 	CK_BBOOL	modifiable;
580 	CK_BBOOL	found;
581 
582 	found = template_attribute_find(obj->template, CKA_MODIFIABLE, &attr);
583 	if (found == FALSE)
584 		return (TRUE);
585 
586 	modifiable = *(CK_BBOOL *)attr->pValue;
587 
588 	return (modifiable);
589 }
590 
591 
592 // object_is_private()
593 //
594 // an is_private member should probably be added to OBJECT
595 //
596 CK_BBOOL
object_is_private(OBJECT * obj)597 object_is_private(OBJECT *obj) {
598 	CK_ATTRIBUTE  * attr = NULL;
599 	CK_BBOOL	priv;
600 	CK_BBOOL	found;
601 
602 	found = template_attribute_find(obj->template, CKA_PRIVATE, &attr);
603 	if (found == FALSE)
604 		return (TRUE);
605 
606 	if (attr == NULL)
607 		return (TRUE);
608 
609 	priv = *((CK_BBOOL *)attr->pValue);
610 
611 	return (priv);
612 }
613 
614 CK_BBOOL
object_is_public(OBJECT * obj)615 object_is_public(OBJECT *obj) {
616 	CK_BBOOL rc;
617 
618 	rc = object_is_private(obj);
619 
620 	if (rc)
621 		return (FALSE);
622 	return (TRUE);
623 }
624 
625 CK_BBOOL
object_is_token_object(OBJECT * obj)626 object_is_token_object(OBJECT *obj) {
627 	CK_ATTRIBUTE  * attr = NULL;
628 	CK_BBOOL	is_token;
629 	CK_BBOOL	found;
630 
631 	found = template_attribute_find(obj->template,
632 	    CKA_TOKEN, &attr);
633 	if (found == FALSE)
634 		return (FALSE);
635 	is_token = *(CK_BBOOL *)attr->pValue;
636 	return (is_token);
637 }
638 
639 CK_BBOOL
object_is_session_object(OBJECT * obj)640 object_is_session_object(OBJECT *obj) {
641 	CK_BBOOL rc;
642 
643 	rc = object_is_token_object(obj);
644 
645 	if (rc)
646 		return (FALSE);
647 	else
648 		return (TRUE);
649 }
650 
651 CK_ULONG
object_get_size(OBJECT * obj)652 object_get_size(OBJECT *obj) {
653 	CK_ULONG  size;
654 
655 	size = sizeof (OBJECT) + template_get_size(obj->template);
656 
657 	return (size);
658 }
659 
660 CK_RV
object_get_attribute_values(OBJECT * obj,CK_ATTRIBUTE * pTemplate,CK_ULONG ulCount)661 object_get_attribute_values(OBJECT	* obj,
662 	CK_ATTRIBUTE  * pTemplate,
663 	CK_ULONG	ulCount)
664 {
665 	TEMPLATE	  *obj_tmpl = NULL;
666 	CK_ATTRIBUTE	*attr	= NULL;
667 	CK_ULONG	   i;
668 	CK_BBOOL	   flag;
669 	CK_RV		rc;
670 
671 	rc = CKR_OK;
672 
673 	obj_tmpl = obj->template;
674 
675 	for (i = 0; i < ulCount; i++) {
676 		flag = template_check_exportability(obj_tmpl,
677 		    pTemplate[i].type);
678 		if (flag == FALSE) {
679 			rc = CKR_ATTRIBUTE_SENSITIVE;
680 			pTemplate[i].ulValueLen = (CK_ULONG) - 1;
681 			continue;
682 		}
683 
684 		flag = template_attribute_find(obj_tmpl,
685 		    pTemplate[i].type, &attr);
686 		if (flag == FALSE) {
687 			rc = CKR_ATTRIBUTE_TYPE_INVALID;
688 			pTemplate[i].ulValueLen = (CK_ULONG) - 1;
689 			continue;
690 		}
691 
692 		if (pTemplate[i].pValue == NULL) {
693 			pTemplate[i].ulValueLen = attr->ulValueLen;
694 		} else if (pTemplate[i].ulValueLen >= attr->ulValueLen) {
695 			(void) memcpy(pTemplate[i].pValue, attr->pValue,
696 			    attr->ulValueLen);
697 			pTemplate[i].ulValueLen = attr->ulValueLen;
698 		} else {
699 			rc = CKR_BUFFER_TOO_SMALL;
700 			pTemplate[i].ulValueLen = (CK_ULONG) - 1;
701 		}
702 	}
703 
704 	return (rc);
705 }
706 
707 CK_RV
object_set_attribute_values(OBJECT * obj,CK_ATTRIBUTE * pTemplate,CK_ULONG ulCount)708 object_set_attribute_values(OBJECT	* obj,
709 	CK_ATTRIBUTE  * pTemplate,
710 	CK_ULONG	ulCount)
711 {
712 	TEMPLATE * new_tmpl;
713 	CK_BBOOL   found;
714 	CK_ULONG   class, subclass;
715 	CK_RV	rc;
716 
717 	if (! obj || ! pTemplate) {
718 		return (CKR_FUNCTION_FAILED);
719 	}
720 
721 	found = template_get_class(obj->template, &class, &subclass);
722 	if (found == FALSE) {
723 		rc = CKR_FUNCTION_FAILED;
724 		goto error;
725 	}
726 
727 	new_tmpl = (TEMPLATE *)malloc(sizeof (TEMPLATE));
728 	if (! new_tmpl) {
729 		return (CKR_HOST_MEMORY);
730 	}
731 	(void) memset(new_tmpl, 0x0, sizeof (TEMPLATE));
732 
733 	rc = template_add_attributes(new_tmpl, pTemplate, ulCount);
734 	if (rc != CKR_OK) {
735 		goto error;
736 	}
737 
738 	rc = template_validate_attributes(new_tmpl, class,
739 	    subclass, MODE_MODIFY);
740 	if (rc != CKR_OK) {
741 		goto error;
742 	}
743 
744 	rc = template_merge(obj->template, &new_tmpl);
745 	if (rc != CKR_OK) {
746 		return (rc);
747 	}
748 	return (CKR_OK);
749 error:
750 	if (new_tmpl)
751 		(void) template_free(new_tmpl);
752 	return (rc);
753 }
754 
755 CK_RV
object_restore(CK_BYTE * data,OBJECT ** new_obj,CK_BBOOL replace)756 object_restore(CK_BYTE *data, OBJECT **new_obj, CK_BBOOL replace) {
757 	TEMPLATE  * tmpl = NULL;
758 	OBJECT    * obj  = NULL;
759 	CK_ULONG    offset = 0;
760 	CK_ULONG_32    count = 0;
761 	CK_RV	rc;
762 
763 	if (! data || ! new_obj) {
764 		return (CKR_FUNCTION_FAILED);
765 	}
766 	obj = (OBJECT *)malloc(sizeof (OBJECT));
767 	if (! obj) {
768 		rc = CKR_HOST_MEMORY;
769 		goto error;
770 	}
771 
772 
773 	(void) memset(obj, 0x0, sizeof (OBJECT));
774 
775 	(void) memcpy(&obj->class, data + offset, sizeof (CK_OBJECT_CLASS_32));
776 	offset += sizeof (CK_OBJECT_CLASS_32);
777 
778 	(void) memcpy(&count, data + offset, sizeof (CK_ULONG_32));
779 	offset += sizeof (CK_ULONG_32);
780 
781 
782 	(void) memcpy(&obj->name, data + offset, 8);
783 	offset += 8;
784 
785 	rc = template_unflatten(&tmpl, data + offset, count);
786 	if (rc != CKR_OK) {
787 		goto error;
788 	}
789 	obj->template = tmpl;
790 
791 	if (replace == FALSE) {
792 		 *new_obj = obj;
793 	} else {
794 		(void) template_free((*new_obj)->template);
795 		(void) memcpy(*new_obj, obj, sizeof (OBJECT));
796 
797 		free(obj);
798 	}
799 
800 	return (CKR_OK);
801 error:
802 	if (obj)
803 		(void) object_free(obj);
804 	if (tmpl)
805 		(void) template_free(tmpl);
806 
807 	return (rc);
808 }
809 
810 
811 //
812 //
813 CK_RV
object_create_skel(CK_ATTRIBUTE * pTemplate,CK_ULONG ulCount,CK_ULONG mode,CK_ULONG class,CK_ULONG subclass,OBJECT ** obj)814 object_create_skel(CK_ATTRIBUTE  * pTemplate,
815 	CK_ULONG	ulCount,
816 	CK_ULONG	mode,
817 	CK_ULONG	class,
818 	CK_ULONG	subclass,
819 	OBJECT	** obj) {
820 	TEMPLATE  * tmpl  = NULL;
821 	TEMPLATE  * tmpl2 = NULL;
822 	OBJECT   * o	= NULL;
823 	CK_RV	rc;
824 
825 
826 	if (! obj) {
827 		return (CKR_FUNCTION_FAILED);
828 	}
829 	if (! pTemplate && (ulCount != 0)) {
830 		return (CKR_FUNCTION_FAILED);
831 	}
832 	o	= (OBJECT *)malloc(sizeof (OBJECT));
833 	tmpl  = (TEMPLATE *)malloc(sizeof (TEMPLATE));
834 	tmpl2 = (TEMPLATE *)malloc(sizeof (TEMPLATE));
835 
836 	if (! o || ! tmpl || ! tmpl2) {
837 		rc = CKR_HOST_MEMORY;
838 		goto done;
839 	}
840 	(void) memset(o,	0x0, sizeof (OBJECT));
841 	(void) memset(tmpl,  0x0, sizeof (TEMPLATE));
842 	(void) memset(tmpl2, 0x0, sizeof (TEMPLATE));
843 
844 
845 	rc = template_add_default_attributes(tmpl, class, subclass, mode);
846 	if (rc != CKR_OK)
847 		goto done;
848 
849 	rc = template_add_attributes(tmpl2, pTemplate, ulCount);
850 	if (rc != CKR_OK)
851 		goto done;
852 
853 
854 	// at this point, the new template has the list of attributes.  we need
855 	// to do some more checking now:
856 	//    1) invalid attribute values
857 	//    2) missing required attributes
858 	//    3) attributes inappropriate for the object class
859 	//    4) conflicting attributes/values
860 	//
861 
862 	rc = template_validate_attributes(tmpl2, class, subclass, mode);
863 	if (rc != CKR_OK) {
864 		goto done;
865 	}
866 
867 	rc = template_check_required_attributes(tmpl2, class, subclass, mode);
868 	if (rc != CKR_OK) {
869 		goto done;
870 	}
871 
872 	rc = template_merge(tmpl, &tmpl2);
873 	if (rc != CKR_OK) {
874 		goto done;
875 	}
876 	// at this point, we should have a valid object with correct attributes
877 	//
878 	o->template = tmpl;
879 	 *obj = o;
880 
881 	return (CKR_OK);
882 	done:
883 	if (o)	free(o);
884 	if (tmpl)
885 		(void) template_free(tmpl);
886 	if (tmpl2)
887 		(void) template_free(tmpl2);
888 
889 	return (rc);
890 }
891