1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #pragma ident "%Z%%M% %I% %E% SMI" 27 28 #include <strings.h> 29 #include <errno.h> 30 #include <cryptoutil.h> 31 #include <unistd.h> /* for pid_t */ 32 #include <pthread.h> 33 #include <security/cryptoki.h> 34 #include "softGlobal.h" 35 #include "softSession.h" 36 #include "softObject.h" 37 #include "softKeystore.h" 38 #include "softKeystoreUtil.h" 39 40 #pragma fini(softtoken_fini) 41 42 static struct CK_FUNCTION_LIST functionList = { 43 { 2, 20 }, /* version */ 44 C_Initialize, 45 C_Finalize, 46 C_GetInfo, 47 C_GetFunctionList, 48 C_GetSlotList, 49 C_GetSlotInfo, 50 C_GetTokenInfo, 51 C_GetMechanismList, 52 C_GetMechanismInfo, 53 C_InitToken, 54 C_InitPIN, 55 C_SetPIN, 56 C_OpenSession, 57 C_CloseSession, 58 C_CloseAllSessions, 59 C_GetSessionInfo, 60 C_GetOperationState, 61 C_SetOperationState, 62 C_Login, 63 C_Logout, 64 C_CreateObject, 65 C_CopyObject, 66 C_DestroyObject, 67 C_GetObjectSize, 68 C_GetAttributeValue, 69 C_SetAttributeValue, 70 C_FindObjectsInit, 71 C_FindObjects, 72 C_FindObjectsFinal, 73 C_EncryptInit, 74 C_Encrypt, 75 C_EncryptUpdate, 76 C_EncryptFinal, 77 C_DecryptInit, 78 C_Decrypt, 79 C_DecryptUpdate, 80 C_DecryptFinal, 81 C_DigestInit, 82 C_Digest, 83 C_DigestUpdate, 84 C_DigestKey, 85 C_DigestFinal, 86 C_SignInit, 87 C_Sign, 88 C_SignUpdate, 89 C_SignFinal, 90 C_SignRecoverInit, 91 C_SignRecover, 92 C_VerifyInit, 93 C_Verify, 94 C_VerifyUpdate, 95 C_VerifyFinal, 96 C_VerifyRecoverInit, 97 C_VerifyRecover, 98 C_DigestEncryptUpdate, 99 C_DecryptDigestUpdate, 100 C_SignEncryptUpdate, 101 C_DecryptVerifyUpdate, 102 C_GenerateKey, 103 C_GenerateKeyPair, 104 C_WrapKey, 105 C_UnwrapKey, 106 C_DeriveKey, 107 C_SeedRandom, 108 C_GenerateRandom, 109 C_GetFunctionStatus, 110 C_CancelFunction, 111 C_WaitForSlotEvent 112 }; 113 114 boolean_t softtoken_initialized = B_FALSE; 115 116 static pid_t softtoken_pid = 0; 117 118 /* This mutex protects soft_session_list, all_sessions_closing */ 119 pthread_mutex_t soft_sessionlist_mutex; 120 soft_session_t *soft_session_list = NULL; 121 122 int all_sessions_closing = 0; 123 124 int soft_urandom_fd = -1; 125 int soft_urandom_seed_fd = -1; 126 int soft_random_fd = -1; 127 128 slot_t soft_slot; 129 obj_to_be_freed_list_t obj_delay_freed; 130 ses_to_be_freed_list_t ses_delay_freed; 131 132 /* protects softtoken_initialized and access to C_Initialize/C_Finalize */ 133 pthread_mutex_t soft_giant_mutex = PTHREAD_MUTEX_INITIALIZER; 134 135 static CK_RV finalize_common(boolean_t force, CK_VOID_PTR pReserved); 136 static void softtoken_fini(); 137 138 CK_RV 139 C_Initialize(CK_VOID_PTR pInitArgs) 140 { 141 142 int initialize_pid; 143 boolean_t supplied_ok; 144 CK_RV rv; 145 146 /* 147 * Get lock to insure only one thread enters this 148 * function at a time. 149 */ 150 (void) pthread_mutex_lock(&soft_giant_mutex); 151 152 initialize_pid = getpid(); 153 154 if (softtoken_initialized) { 155 if (initialize_pid == softtoken_pid) { 156 /* 157 * This process has called C_Initialize already 158 */ 159 (void) pthread_mutex_unlock(&soft_giant_mutex); 160 return (CKR_CRYPTOKI_ALREADY_INITIALIZED); 161 } else { 162 /* 163 * A fork has happened and the child is 164 * reinitializing. Do a finalize_common to close 165 * out any state from the parent, and then 166 * continue on. 167 */ 168 (void) finalize_common(B_TRUE, NULL); 169 } 170 } 171 172 if (pInitArgs != NULL) { 173 CK_C_INITIALIZE_ARGS *initargs1 = 174 (CK_C_INITIALIZE_ARGS *) pInitArgs; 175 176 /* pReserved must be NULL */ 177 if (initargs1->pReserved != NULL) { 178 (void) pthread_mutex_unlock(&soft_giant_mutex); 179 return (CKR_ARGUMENTS_BAD); 180 } 181 182 /* 183 * ALL supplied function pointers need to have the value 184 * either NULL or non-NULL. 185 */ 186 supplied_ok = (initargs1->CreateMutex == NULL && 187 initargs1->DestroyMutex == NULL && 188 initargs1->LockMutex == NULL && 189 initargs1->UnlockMutex == NULL) || 190 (initargs1->CreateMutex != NULL && 191 initargs1->DestroyMutex != NULL && 192 initargs1->LockMutex != NULL && 193 initargs1->UnlockMutex != NULL); 194 195 if (!supplied_ok) { 196 (void) pthread_mutex_unlock(&soft_giant_mutex); 197 return (CKR_ARGUMENTS_BAD); 198 } 199 200 /* 201 * When the CKF_OS_LOCKING_OK flag isn't set and mutex 202 * function pointers are supplied by an application, 203 * return an error. We must be able to use our own primitives. 204 */ 205 if (!(initargs1->flags & CKF_OS_LOCKING_OK) && 206 (initargs1->CreateMutex != NULL)) { 207 (void) pthread_mutex_unlock(&soft_giant_mutex); 208 return (CKR_CANT_LOCK); 209 } 210 } 211 212 /* Initialize the session list lock */ 213 if (pthread_mutex_init(&soft_sessionlist_mutex, NULL) != 0) { 214 (void) pthread_mutex_unlock(&soft_giant_mutex); 215 return (CKR_CANT_LOCK); 216 } 217 218 softtoken_initialized = B_TRUE; 219 softtoken_pid = initialize_pid; 220 221 /* 222 * token object related initialization 223 */ 224 soft_slot.authenticated = 0; 225 soft_slot.userpin_change_needed = 0; 226 soft_slot.token_object_list = NULL; 227 228 if ((rv = soft_init_token_session()) != CKR_OK) { 229 (void) pthread_mutex_unlock(&soft_giant_mutex); 230 return (rv); 231 } 232 233 /* Initialize the slot lock */ 234 if (pthread_mutex_init(&soft_slot.slot_mutex, NULL) != 0) { 235 (void) soft_destroy_token_session(); 236 (void) pthread_mutex_unlock(&soft_giant_mutex); 237 return (CKR_CANT_LOCK); 238 } 239 240 /* Get keystore version because it might not be 1 at this time */ 241 if (soft_keystore_get_version(&soft_slot.ks_version, B_FALSE) != 242 0) { 243 soft_token_present = B_FALSE; 244 } 245 246 if (soft_token_present) { 247 /* Load all the public token objects from keystore */ 248 if ((rv = soft_get_token_objects_from_keystore( 249 PUB_TOKENOBJS)) != CKR_OK) { 250 (void) pthread_mutex_destroy(&soft_slot.slot_mutex); 251 (void) soft_destroy_token_session(); 252 (void) pthread_mutex_unlock(&soft_giant_mutex); 253 return (rv); 254 } else { 255 /* 256 * Invalidate public token objects until the 257 * C_OpenSession is called. 258 */ 259 soft_validate_token_objects(B_FALSE); 260 } 261 } 262 263 (void) pthread_mutex_unlock(&soft_giant_mutex); 264 265 /* Initialize the object_to_be_freed list */ 266 (void) pthread_mutex_init(&obj_delay_freed.obj_to_be_free_mutex, NULL); 267 obj_delay_freed.count = 0; 268 obj_delay_freed.first = NULL; 269 obj_delay_freed.last = NULL; 270 271 (void) pthread_mutex_init(&ses_delay_freed.ses_to_be_free_mutex, NULL); 272 ses_delay_freed.count = 0; 273 ses_delay_freed.first = NULL; 274 ses_delay_freed.last = NULL; 275 return (CKR_OK); 276 277 } 278 279 /* 280 * C_Finalize is a wrapper around finalize_common. The 281 * soft_giant_mutex should be locked by C_Finalize(). 282 */ 283 CK_RV 284 C_Finalize(CK_VOID_PTR pReserved) 285 { 286 287 CK_RV rv; 288 289 (void) pthread_mutex_lock(&soft_giant_mutex); 290 291 rv = finalize_common(B_FALSE, pReserved); 292 293 (void) pthread_mutex_unlock(&soft_giant_mutex); 294 295 return (rv); 296 297 } 298 299 /* 300 * finalize_common() does the work for C_Finalize. soft_giant_mutex 301 * must be held before calling this function. 302 */ 303 static CK_RV 304 finalize_common(boolean_t force, CK_VOID_PTR pReserved) { 305 306 CK_RV rv = CKR_OK; 307 struct object *delay_free_obj, *tmpo; 308 struct session *delay_free_ses, *tmps; 309 310 if (!softtoken_initialized) { 311 return (CKR_CRYPTOKI_NOT_INITIALIZED); 312 } 313 314 /* Check to see if pReseved is NULL */ 315 if (pReserved != NULL) { 316 return (CKR_ARGUMENTS_BAD); 317 } 318 319 (void) pthread_mutex_lock(&soft_sessionlist_mutex); 320 /* 321 * Set all_sessions_closing flag so any access to any 322 * existing sessions will be rejected. 323 */ 324 all_sessions_closing = 1; 325 (void) pthread_mutex_unlock(&soft_sessionlist_mutex); 326 327 /* Delete all the sessions and release the allocated resources */ 328 rv = soft_delete_all_sessions(force); 329 330 (void) pthread_mutex_lock(&soft_sessionlist_mutex); 331 /* Reset all_sessions_closing flag. */ 332 all_sessions_closing = 0; 333 (void) pthread_mutex_unlock(&soft_sessionlist_mutex); 334 335 softtoken_initialized = B_FALSE; 336 softtoken_pid = 0; 337 338 if (soft_urandom_fd > 0) { 339 (void) close(soft_urandom_fd); 340 soft_urandom_fd = -1; 341 } 342 343 if (soft_urandom_seed_fd > 0) { 344 (void) close(soft_urandom_seed_fd); 345 soft_urandom_seed_fd = -1; 346 } 347 348 if (soft_random_fd > 0) { 349 (void) close(soft_random_fd); 350 soft_random_fd = -1; 351 } 352 353 /* Destroy the session list lock here */ 354 (void) pthread_mutex_destroy(&soft_sessionlist_mutex); 355 356 /* 357 * Destroy token object related stuffs 358 * 1. Clean up the token object list 359 * 2. Destroy slot mutex 360 * 3. Destroy mutex in token_session 361 */ 362 soft_delete_all_in_core_token_objects(ALL_TOKEN); 363 (void) pthread_mutex_destroy(&soft_slot.slot_mutex); 364 (void) soft_destroy_token_session(); 365 366 /* 367 * free all entries in the delay_freed list 368 */ 369 delay_free_obj = obj_delay_freed.first; 370 while (delay_free_obj != NULL) { 371 tmpo = delay_free_obj->next; 372 free(delay_free_obj); 373 delay_free_obj = tmpo; 374 } 375 (void) pthread_mutex_destroy(&obj_delay_freed.obj_to_be_free_mutex); 376 377 delay_free_ses = ses_delay_freed.first; 378 while (delay_free_ses != NULL) { 379 tmps = delay_free_ses->next; 380 free(delay_free_ses); 381 delay_free_ses = tmps; 382 } 383 (void) pthread_mutex_destroy(&ses_delay_freed.ses_to_be_free_mutex); 384 385 return (rv); 386 } 387 388 /* 389 * softtoken_fini() function required to make sure complete cleanup 390 * is done if softtoken is ever unloaded without a C_Finalize() call. 391 */ 392 static void 393 softtoken_fini() 394 { 395 (void) pthread_mutex_lock(&soft_giant_mutex); 396 397 /* if we're not initilized, do not attempt to finalize */ 398 if (!softtoken_initialized) { 399 (void) pthread_mutex_unlock(&soft_giant_mutex); 400 return; 401 } 402 403 (void) finalize_common(B_TRUE, NULL_PTR); 404 405 (void) pthread_mutex_unlock(&soft_giant_mutex); 406 } 407 408 CK_RV 409 C_GetInfo(CK_INFO_PTR pInfo) 410 { 411 if (!softtoken_initialized) 412 return (CKR_CRYPTOKI_NOT_INITIALIZED); 413 414 if (pInfo == NULL) { 415 return (CKR_ARGUMENTS_BAD); 416 } 417 418 /* Provide general information in the provided buffer */ 419 pInfo->cryptokiVersion.major = CRYPTOKI_VERSION_MAJOR; 420 pInfo->cryptokiVersion.minor = CRYPTOKI_VERSION_MINOR; 421 (void) strncpy((char *)pInfo->manufacturerID, 422 SOFT_MANUFACTURER_ID, 32); 423 pInfo->flags = 0; 424 (void) strncpy((char *)pInfo->libraryDescription, 425 LIBRARY_DESCRIPTION, 32); 426 pInfo->libraryVersion.major = LIBRARY_VERSION_MAJOR; 427 pInfo->libraryVersion.major = LIBRARY_VERSION_MINOR; 428 429 return (CKR_OK); 430 } 431 432 CK_RV 433 C_GetFunctionList(CK_FUNCTION_LIST_PTR_PTR ppFunctionList) 434 { 435 if (ppFunctionList == NULL) { 436 return (CKR_ARGUMENTS_BAD); 437 } 438 439 *ppFunctionList = &functionList; 440 441 return (CKR_OK); 442 } 443 444 /* 445 * PKCS#11 states that C_GetFunctionStatus should always return 446 * CKR_FUNCTION_NOT_PARALLEL 447 */ 448 /*ARGSUSED*/ 449 CK_RV 450 C_GetFunctionStatus(CK_SESSION_HANDLE hSession) 451 { 452 return (CKR_FUNCTION_NOT_PARALLEL); 453 } 454 455 /* 456 * PKCS#11 states that C_CancelFunction should always return 457 * CKR_FUNCTION_NOT_PARALLEL 458 */ 459 /*ARGSUSED*/ 460 CK_RV 461 C_CancelFunction(CK_SESSION_HANDLE hSession) 462 { 463 return (CKR_FUNCTION_NOT_PARALLEL); 464 } 465 466 /* 467 * Perform a write that can handle EINTR. 468 */ 469 int 470 looping_write(int fd, void *buf, int len) 471 { 472 char *p = buf; 473 int cc, len2 = 0; 474 475 if (len == 0) 476 return (0); 477 478 do { 479 cc = write(fd, p, len); 480 if (cc < 0) { 481 if (errno == EINTR) 482 continue; 483 return (cc); 484 } else if (cc == 0) { 485 return (len2); 486 } else { 487 p += cc; 488 len2 += cc; 489 len -= cc; 490 } 491 } while (len > 0); 492 return (len2); 493 } 494 495 /* 496 * Perform a read that can handle EINTR. 497 */ 498 int 499 looping_read(int fd, void *buf, int len) 500 { 501 char *p = buf; 502 int cc, len2 = 0; 503 504 do { 505 cc = read(fd, p, len); 506 if (cc < 0) { 507 if (errno == EINTR) 508 continue; 509 return (cc); /* errno is already set */ 510 } else if (cc == 0) { 511 return (len2); 512 } else { 513 p += cc; 514 len2 += cc; 515 len -= cc; 516 } 517 } while (len > 0); 518 return (len2); 519 } 520