diff options
Diffstat (limited to 'lib/isc/include/pk11')
| -rw-r--r-- | lib/isc/include/pk11/Makefile.in | 38 | ||||
| -rw-r--r-- | lib/isc/include/pk11/README.site | 72 | ||||
| -rw-r--r-- | lib/isc/include/pk11/constants.h | 107 | ||||
| -rw-r--r-- | lib/isc/include/pk11/internal.h | 40 | ||||
| -rw-r--r-- | lib/isc/include/pk11/pk11.h | 302 | ||||
| -rw-r--r-- | lib/isc/include/pk11/result.h | 51 | ||||
| -rw-r--r-- | lib/isc/include/pk11/site.h | 112 |
7 files changed, 722 insertions, 0 deletions
diff --git a/lib/isc/include/pk11/Makefile.in b/lib/isc/include/pk11/Makefile.in new file mode 100644 index 0000000..395c924 --- /dev/null +++ b/lib/isc/include/pk11/Makefile.in @@ -0,0 +1,38 @@ +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +srcdir = @srcdir@ +VPATH = @srcdir@ +top_srcdir = @top_srcdir@ + +VERSION=@BIND9_VERSION@ + +# +# Only list headers that are to be installed and are not +# machine generated. The latter are handled specially in the +# install target below. +# +HEADERS = constants.h internal.h pk11.h result.h site.h +SUBDIRS = +TARGETS = + +@BIND9_MAKE_RULES@ + +installdirs: + $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${includedir}/pk11 + +install:: installdirs + for i in ${HEADERS}; do \ + ${INSTALL_DATA} ${srcdir}/$$i ${DESTDIR}${includedir}/pk11 || exit 1; \ + done + +uninstall:: + for i in ${HEADERS}; do \ + rm -f ${DESTDIR}${includedir}/pk11/$$i || exit 1; \ + done diff --git a/lib/isc/include/pk11/README.site b/lib/isc/include/pk11/README.site new file mode 100644 index 0000000..6c49891 --- /dev/null +++ b/lib/isc/include/pk11/README.site @@ -0,0 +1,72 @@ +Copyright (C) Internet Systems Consortium, Inc. ("ISC") + +See COPYRIGHT in the source root or http://isc.org/copyright.html for terms. + +How to use site.h for the PKCS#11 provider of your HSM +------------------------------------------------------ + +First run "pkcs11-tokens" (in bin/pkcs11). This tool is built when BIND9 +is configured with the --with-pcks11 flag. It prints the addresses of +selected tokens per algorithm: + + - random number generation + - RSA (sign/verify) + - DSA (sign/verify) + - DH (secret derivation) + - digest (hash) + - EC (ECDSA, sign/verify) + - GOST (Russian hash and sign/verify) + - AES (encrypt/decrypt) + +...and a summary of PKCS#11 tokens that have been found. + +Current well-known HSMs are predefined in site.h according to HSM "flavors": + + - Thales nCipher (default) + - OpenDNSSEC SoftHSMv2 + +...and with experimental status: + + - OpenDNSSEC SoftHSMv1 with SHA224 support added + - Cryptech + - AEP Keyper + +If BIND9 is configured with native PKCS#11 support (--enable-native-pkcs11), +then pkcs11-tokens will raise an error when a mandatory algorithm is not +supported. (The usual error is 0x70, or CKR_MECHANISM_INVALID; 0x0 +indicates that a required flag is not available.) The following steps +may be taken, depending on which algorithms indicate failures: + + - rand or RSA: nothing can be done; native PKCS#11 is not supported + in BIND9 with this HSM. + + - DSA or DH: run pkcs11-tokens with the -v (verbose) flag. If the + parameter generation mechanism is not supported you can make the token + selection to ignore the error. Note DSA and DH are not critical + algorithms; you can use BIND9 in production without them. + + - digest: run pkcs11-tokens with the -v (verbose) flag. If the problem is + with HMAC mechanisms, use the corresponding REPLACE flags in site.h. + If the problem is with MD5, use the corresponding DISABLE flag in + site.h. If the problem is with SHA224, contact the implementor of the + PKCS#11 provider and ask to have this hash algorithm implemented. For + any other problem, nothing can be done; native PKCS#11 is not supported + with this HSM. + + - EC: you may wish to configure BIND9 without ECDSA support by adding + --without-ecdsa to the "configure" arguments. + + - GOST: you SHOULD configure BIND9 without GOST support by adding + --without-gost to the "configure" arguments. + + - AES: you MUST reconfigure bind9 without AES support by adding + --without-aes to configure arguments. + +You can disable some algorithms (e.g. DSA, DH and MD5) using the +"disable-algorithms" option in named.conf, and some other algorithms can be +disabled at compile time (ECDSA, GOST, AES). Note, however, that disabling +algorithms can have unwanted side effects; for instance, disabling DH breaks +TKEY support. + +A final note: the DISABLE flags in site.h work for OpenSSL code too, but +this feature is not officially supported yet and should not be relied on. diff --git a/lib/isc/include/pk11/constants.h b/lib/isc/include/pk11/constants.h new file mode 100644 index 0000000..0abbf7e --- /dev/null +++ b/lib/isc/include/pk11/constants.h @@ -0,0 +1,107 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + + +#ifndef PK11_CONSTANTS_H +#define PK11_CONSTANTS_H 1 + +/*! \file pk11/constants.h */ + +/*% + * Static arrays of data used for key template initalization + */ +#ifdef WANT_ECC_CURVES +static CK_BYTE pk11_ecc_prime256v1[] = { + 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07 +}; +static CK_BYTE pk11_ecc_secp384r1[] = { + 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x22 +}; +static CK_BYTE pk11_ecc_ed25519[] = { + 0x06, 0x03, 0x2b, 0x65, 0x70 +}; +static CK_BYTE pk11_ecc_ed448[] = { + 0x06, 0x03, 0x2b, 0x65, 0x71 +}; +#endif + +#ifdef WANT_DH_PRIMES +static CK_BYTE pk11_dh_bn2[] = { 2 }; +static CK_BYTE pk11_dh_bn768[] = { + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xc9, 0x0f, 0xda, 0xa2, 0x21, 0x68, 0xc2, 0x34, + 0xc4, 0xc6, 0x62, 0x8b, 0x80, 0xdc, 0x1c, 0xd1, + 0x29, 0x02, 0x4e, 0x08, 0x8a, 0x67, 0xcc, 0x74, + 0x02, 0x0b, 0xbe, 0xa6, 0x3b, 0x13, 0x9b, 0x22, + 0x51, 0x4a, 0x08, 0x79, 0x8e, 0x34, 0x04, 0xdd, + 0xef, 0x95, 0x19, 0xb3, 0xcd, 0x3a, 0x43, 0x1b, + 0x30, 0x2b, 0x0a, 0x6d, 0xf2, 0x5f, 0x14, 0x37, + 0x4f, 0xe1, 0x35, 0x6d, 0x6d, 0x51, 0xc2, 0x45, + 0xe4, 0x85, 0xb5, 0x76, 0x62, 0x5e, 0x7e, 0xc6, + 0xf4, 0x4c, 0x42, 0xe9, 0xa6, 0x3a, 0x36, 0x20, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff +}; +static CK_BYTE pk11_dh_bn1024[] = { + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xc9, 0x0f, 0xda, 0xa2, 0x21, 0x68, 0xc2, 0x34, + 0xc4, 0xc6, 0x62, 0x8b, 0x80, 0xdc, 0x1c, 0xd1, + 0x29, 0x02, 0x4e, 0x08, 0x8a, 0x67, 0xcc, 0x74, + 0x02, 0x0b, 0xbe, 0xa6, 0x3b, 0x13, 0x9b, 0x22, + 0x51, 0x4a, 0x08, 0x79, 0x8e, 0x34, 0x04, 0xdd, + 0xef, 0x95, 0x19, 0xb3, 0xcd, 0x3a, 0x43, 0x1b, + 0x30, 0x2b, 0x0a, 0x6d, 0xf2, 0x5f, 0x14, 0x37, + 0x4f, 0xe1, 0x35, 0x6d, 0x6d, 0x51, 0xc2, 0x45, + 0xe4, 0x85, 0xb5, 0x76, 0x62, 0x5e, 0x7e, 0xc6, + 0xf4, 0x4c, 0x42, 0xe9, 0xa6, 0x37, 0xed, 0x6b, + 0x0b, 0xff, 0x5c, 0xb6, 0xf4, 0x06, 0xb7, 0xed, + 0xee, 0x38, 0x6b, 0xfb, 0x5a, 0x89, 0x9f, 0xa5, + 0xae, 0x9f, 0x24, 0x11, 0x7c, 0x4b, 0x1f, 0xe6, + 0x49, 0x28, 0x66, 0x51, 0xec, 0xe6, 0x53, 0x81, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff +}; +static CK_BYTE pk11_dh_bn1536[] = { + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xc9, 0x0f, 0xda, 0xa2, 0x21, 0x68, 0xc2, 0x34, + 0xc4, 0xc6, 0x62, 0x8b, 0x80, 0xdc, 0x1c, 0xd1, + 0x29, 0x02, 0x4e, 0x08, 0x8a, 0x67, 0xcc, 0x74, + 0x02, 0x0b, 0xbe, 0xa6, 0x3b, 0x13, 0x9b, 0x22, + 0x51, 0x4a, 0x08, 0x79, 0x8e, 0x34, 0x04, 0xdd, + 0xef, 0x95, 0x19, 0xb3, 0xcd, 0x3a, 0x43, 0x1b, + 0x30, 0x2b, 0x0a, 0x6d, 0xf2, 0x5f, 0x14, 0x37, + 0x4f, 0xe1, 0x35, 0x6d, 0x6d, 0x51, 0xc2, 0x45, + 0xe4, 0x85, 0xb5, 0x76, 0x62, 0x5e, 0x7e, 0xc6, + 0xf4, 0x4c, 0x42, 0xe9, 0xa6, 0x37, 0xed, 0x6b, + 0x0b, 0xff, 0x5c, 0xb6, 0xf4, 0x06, 0xb7, 0xed, + 0xee, 0x38, 0x6b, 0xfb, 0x5a, 0x89, 0x9f, 0xa5, + 0xae, 0x9f, 0x24, 0x11, 0x7c, 0x4b, 0x1f, 0xe6, + 0x49, 0x28, 0x66, 0x51, 0xec, 0xe4, 0x5b, 0x3d, + 0xc2, 0x00, 0x7c, 0xb8, 0xa1, 0x63, 0xbf, 0x05, + 0x98, 0xda, 0x48, 0x36, 0x1c, 0x55, 0xd3, 0x9a, + 0x69, 0x16, 0x3f, 0xa8, 0xfd, 0x24, 0xcf, 0x5f, + 0x83, 0x65, 0x5d, 0x23, 0xdc, 0xa3, 0xad, 0x96, + 0x1c, 0x62, 0xf3, 0x56, 0x20, 0x85, 0x52, 0xbb, + 0x9e, 0xd5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6d, + 0x67, 0x0c, 0x35, 0x4e, 0x4a, 0xbc, 0x98, 0x04, + 0xf1, 0x74, 0x6c, 0x08, 0xca, 0x23, 0x73, 0x27, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff +}; +#endif + +#ifdef WANT_GOST_PARAMS +static CK_BYTE pk11_gost_a_paramset[] = { + 0x06, 0x07, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x23, 0x01 +}; +static CK_BYTE pk11_gost_paramset[] = { + 0x06, 0x07, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x1e, 0x01 +}; +#endif + +#endif /* PK11_CONSTANTS_H */ diff --git a/lib/isc/include/pk11/internal.h b/lib/isc/include/pk11/internal.h new file mode 100644 index 0000000..aa8907a --- /dev/null +++ b/lib/isc/include/pk11/internal.h @@ -0,0 +1,40 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + + +#ifndef PK11_INTERNAL_H +#define PK11_INTERNAL_H 1 + +/*! \file pk11/internal.h */ + +ISC_LANG_BEGINDECLS + +const char *pk11_get_lib_name(void); + +void *pk11_mem_get(size_t size); + +void pk11_mem_put(void *ptr, size_t size); + +CK_SLOT_ID pk11_get_best_token(pk11_optype_t optype); + +unsigned int pk11_numbits(CK_BYTE_PTR data, unsigned int bytecnt); + +CK_ATTRIBUTE *pk11_attribute_first(const pk11_object_t *obj); + +CK_ATTRIBUTE *pk11_attribute_next(const pk11_object_t *obj, + CK_ATTRIBUTE *attr); + +CK_ATTRIBUTE *pk11_attribute_bytype(const pk11_object_t *obj, + CK_ATTRIBUTE_TYPE type); + +ISC_LANG_ENDDECLS + +#endif /* PK11_INTERNAL_H */ diff --git a/lib/isc/include/pk11/pk11.h b/lib/isc/include/pk11/pk11.h new file mode 100644 index 0000000..2ff21fb --- /dev/null +++ b/lib/isc/include/pk11/pk11.h @@ -0,0 +1,302 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +#ifndef PK11_PK11_H +#define PK11_PK11_H 1 + +/*! \file pk11/pk11.h */ + +#include <stdbool.h> + +#include <isc/lang.h> +#include <isc/magic.h> +#include <isc/types.h> + +#define PK11_FATALCHECK(func, args) \ + ((void) (((rv = (func) args) == CKR_OK) || \ + ((pk11_error_fatalcheck)(__FILE__, __LINE__, #func, rv), 0))) + +#include <pkcs11/cryptoki.h> +#include <pk11/site.h> + +ISC_LANG_BEGINDECLS + +#define SES_MAGIC ISC_MAGIC('P','K','S','S') +#define TOK_MAGIC ISC_MAGIC('P','K','T','K') + +#define VALID_SES(x) ISC_MAGIC_VALID(x, SES_MAGIC) +#define VALID_TOK(x) ISC_MAGIC_VALID(x, TOK_MAGIC) + +typedef struct pk11_context pk11_context_t; + +struct pk11_object { + CK_OBJECT_HANDLE object; + CK_SLOT_ID slot; + CK_BBOOL ontoken; + CK_BBOOL reqlogon; + CK_BYTE attrcnt; + CK_ATTRIBUTE *repr; +}; + +struct pk11_context { + void *handle; + CK_SESSION_HANDLE session; + CK_BBOOL ontoken; + CK_OBJECT_HANDLE object; +#if defined(PK11_MD5_HMAC_REPLACE) || defined(PK11_SHA_1_HMAC_REPLACE) || \ + defined(PK11_SHA224_HMAC_REPLACE) || defined(PK11_SHA256_HMAC_REPLACE) || \ + defined(PK11_SHA384_HMAC_REPLACE) || defined(PK11_SHA512_HMAC_REPLACE) + unsigned char *key; +#endif +}; + +typedef struct pk11_object pk11_object_t; + +typedef enum { + OP_ANY = 0, + OP_RAND = 1, + OP_RSA = 2, + OP_DSA = 3, + OP_DH = 4, + OP_DIGEST = 5, + OP_EC = 6, + OP_GOST = 7, + OP_AES = 8, + OP_MAX = 9 +} pk11_optype_t; + +/*% + * Global flag to make choose_slots() verbose + */ +LIBISC_EXTERNAL_DATA extern bool pk11_verbose_init; + +/*% + * Function prototypes + */ + +void pk11_set_lib_name(const char *lib_name); +/*%< + * Set the PKCS#11 provider (aka library) path/name. + */ + +isc_result_t pk11_initialize(isc_mem_t *mctx, const char *engine); +/*%< + * Initialize PKCS#11 device + * + * mctx: memory context to attach to pk11_mctx. + * engine: PKCS#11 provider (aka library) path/name. + * + * returns: + * ISC_R_SUCCESS + * PK11_R_NOPROVIDER: can't load the provider + * PK11_R_INITFAILED: C_Initialize() failed + * PK11_R_NORANDOMSERVICE: can't find required random service + * PK11_R_NODIGESTSERVICE: can't find required digest service + * PK11_R_NOAESSERVICE: can't find required AES service + */ + +isc_result_t pk11_get_session(pk11_context_t *ctx, + pk11_optype_t optype, + bool need_services, + bool rw, + bool logon, + const char *pin, + CK_SLOT_ID slot); +/*%< + * Initialize PKCS#11 device and acquire a session. + * + * need_services: + * if true, this session requires full PKCS#11 API + * support including random and digest services, and + * the lack of these services will cause the session not + * to be initialized. If false, the function will return + * an error code indicating the missing service, but the + * session will be usable for other purposes. + * rw: if true, session will be read/write (useful for + * generating or destroying keys); otherwise read-only. + * login: indicates whether to log in to the device + * pin: optional PIN, overriding any PIN currently associated + * with the + * slot: device slot ID + */ + +void pk11_return_session(pk11_context_t *ctx); +/*%< + * Release an active PKCS#11 session for reuse. + */ + +isc_result_t pk11_finalize(void); +/*%< + * Shut down PKCS#11 device and free all sessions. + */ + +isc_result_t pk11_rand_bytes(unsigned char *buf, int num); + +void pk11_rand_seed_fromfile(const char *randomfile); + +isc_result_t pk11_parse_uri(pk11_object_t *obj, const char *label, + isc_mem_t *mctx, pk11_optype_t optype); + +ISC_PLATFORM_NORETURN_PRE void +pk11_error_fatalcheck(const char *file, int line, + const char *funcname, CK_RV rv) +ISC_PLATFORM_NORETURN_POST; + +void pk11_dump_tokens(void); + +CK_RV +pkcs_C_Initialize(CK_VOID_PTR pReserved); + +char *pk11_get_load_error_message(void); + +CK_RV +pkcs_C_Finalize(CK_VOID_PTR pReserved); + +CK_RV +pkcs_C_GetSlotList(CK_BBOOL tokenPresent, CK_SLOT_ID_PTR pSlotList, + CK_ULONG_PTR pulCount); + +CK_RV +pkcs_C_GetTokenInfo(CK_SLOT_ID slotID, CK_TOKEN_INFO_PTR pInfo); + +CK_RV +pkcs_C_GetMechanismInfo(CK_SLOT_ID slotID, CK_MECHANISM_TYPE type, + CK_MECHANISM_INFO_PTR pInfo); + +CK_RV +pkcs_C_OpenSession(CK_SLOT_ID slotID, CK_FLAGS flags, + CK_VOID_PTR pApplication, + CK_RV (*Notify) (CK_SESSION_HANDLE hSession, + CK_NOTIFICATION event, + CK_VOID_PTR pApplication), + CK_SESSION_HANDLE_PTR phSession); + +CK_RV +pkcs_C_CloseSession(CK_SESSION_HANDLE hSession); + +CK_RV +pkcs_C_Login(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType, + CK_CHAR_PTR pPin, CK_ULONG usPinLen); + +CK_RV +pkcs_C_Logout(CK_SESSION_HANDLE hSession); + +CK_RV +pkcs_C_CreateObject(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate, + CK_ULONG usCount, CK_OBJECT_HANDLE_PTR phObject); + +CK_RV +pkcs_C_DestroyObject(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject); + +CK_RV +pkcs_C_GetAttributeValue(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject, + CK_ATTRIBUTE_PTR pTemplate, CK_ULONG usCount); + +CK_RV +pkcs_C_SetAttributeValue(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject, + CK_ATTRIBUTE_PTR pTemplate, CK_ULONG usCount); + +CK_RV +pkcs_C_FindObjectsInit(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate, + CK_ULONG usCount); + +CK_RV +pkcs_C_FindObjects(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE_PTR phObject, + CK_ULONG usMaxObjectCount, CK_ULONG_PTR pusObjectCount); + +CK_RV +pkcs_C_FindObjectsFinal(CK_SESSION_HANDLE hSession); + +CK_RV +pkcs_C_EncryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, + CK_OBJECT_HANDLE hKey); + +CK_RV +pkcs_C_Encrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, + CK_ULONG ulDataLen, CK_BYTE_PTR pEncryptedData, + CK_ULONG_PTR pulEncryptedDataLen); + +CK_RV +pkcs_C_DigestInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism); + +CK_RV +pkcs_C_DigestUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart, + CK_ULONG ulPartLen); + +CK_RV +pkcs_C_DigestFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pDigest, + CK_ULONG_PTR pulDigestLen); + +CK_RV +pkcs_C_SignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, + CK_OBJECT_HANDLE hKey); + +CK_RV +pkcs_C_Sign(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, + CK_ULONG ulDataLen, CK_BYTE_PTR pSignature, + CK_ULONG_PTR pulSignatureLen); + +CK_RV +pkcs_C_SignUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart, + CK_ULONG ulPartLen); + +CK_RV +pkcs_C_SignFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature, + CK_ULONG_PTR pulSignatureLen); + +CK_RV +pkcs_C_VerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, + CK_OBJECT_HANDLE hKey); + +CK_RV +pkcs_C_Verify(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData, + CK_ULONG ulDataLen, CK_BYTE_PTR pSignature, + CK_ULONG ulSignatureLen); + +CK_RV +pkcs_C_VerifyUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart, + CK_ULONG ulPartLen); + +CK_RV +pkcs_C_VerifyFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature, + CK_ULONG ulSignatureLen); + +CK_RV +pkcs_C_GenerateKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, + CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, + CK_OBJECT_HANDLE_PTR phKey); + +CK_RV +pkcs_C_GenerateKeyPair(CK_SESSION_HANDLE hSession, + CK_MECHANISM_PTR pMechanism, + CK_ATTRIBUTE_PTR pPublicKeyTemplate, + CK_ULONG usPublicKeyAttributeCount, + CK_ATTRIBUTE_PTR pPrivateKeyTemplate, + CK_ULONG usPrivateKeyAttributeCount, + CK_OBJECT_HANDLE_PTR phPrivateKey, + CK_OBJECT_HANDLE_PTR phPublicKey); + +CK_RV +pkcs_C_DeriveKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, + CK_OBJECT_HANDLE hBaseKey, CK_ATTRIBUTE_PTR pTemplate, + CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey); + +CK_RV +pkcs_C_SeedRandom(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSeed, + CK_ULONG ulSeedLen); + +CK_RV +pkcs_C_GenerateRandom(CK_SESSION_HANDLE hSession, CK_BYTE_PTR RandomData, + CK_ULONG ulRandomLen); + +ISC_LANG_ENDDECLS + +#endif /* PK11_PK11_H */ diff --git a/lib/isc/include/pk11/result.h b/lib/isc/include/pk11/result.h new file mode 100644 index 0000000..cce9150 --- /dev/null +++ b/lib/isc/include/pk11/result.h @@ -0,0 +1,51 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +#ifndef PK11_RESULT_H +#define PK11_RESULT_H 1 + +/*! \file pk11/result.h */ + +#include <isc/lang.h> +#include <isc/resultclass.h> + +/* + * Nothing in this file truly depends on <isc/result.h>, but the + * PK11 result codes are considered to be publicly derived from + * the ISC result codes, so including this file buys you the ISC_R_ + * namespace too. + */ +#include <isc/result.h> /* Contractual promise. */ + +#define PK11_R_INITFAILED (ISC_RESULTCLASS_PK11 + 0) +#define PK11_R_NOPROVIDER (ISC_RESULTCLASS_PK11 + 1) +#define PK11_R_NORANDOMSERVICE (ISC_RESULTCLASS_PK11 + 2) +#define PK11_R_NODIGESTSERVICE (ISC_RESULTCLASS_PK11 + 3) +#define PK11_R_NOAESSERVICE (ISC_RESULTCLASS_PK11 + 4) + +#define PK11_R_NRESULTS 5 /* Number of results */ + +ISC_LANG_BEGINDECLS + +LIBISC_EXTERNAL_DATA extern isc_msgcat_t *pk11_msgcat; + +void +pk11_initmsgcat(void); + +const char * +pk11_result_totext(isc_result_t); + +void +pk11_result_register(void); + +ISC_LANG_ENDDECLS + +#endif /* PK11_RESULT_H */ diff --git a/lib/isc/include/pk11/site.h b/lib/isc/include/pk11/site.h new file mode 100644 index 0000000..1d97dbb --- /dev/null +++ b/lib/isc/include/pk11/site.h @@ -0,0 +1,112 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +/* The documentation about this file is in README.site */ + +#ifndef PK11_SITE_H +#define PK11_SITE_H 1 + +/*! \file pk11/site.h */ + +/*\brief Put here specific PKCS#11 tweaks + * + *\li PK11_<mechanism>_SKIP: + * Don't consider the lack of this mechanism as a fatal error. + * + *\li PK11_<mechanism>_REPLACE: + * Same as SKIP, and implement the mechanism using lower-level steps. + * + *\li PK11_<algorithm>_DISABLE: + * Same as SKIP, and disable support for the algorithm. + * + *\li PK11_PAD_HMAC_KEYS: + * Extend HMAC keys shorter than digest length. + */ + +/* current implemented flags are: +PK11_DH_PKCS_PARAMETER_GEN_SKIP +PK11_DSA_PARAMETER_GEN_SKIP +PK11_RSA_PKCS_REPLACE +PK11_MD5_HMAC_REPLACE +PK11_SHA_1_HMAC_REPLACE +PK11_SHA224_HMAC_REPLACE +PK11_SHA256_HMAC_REPLACE +PK11_SHA384_HMAC_REPLACE +PK11_SHA512_HMAC_REPLACE +PK11_MD5_DISABLE +PK11_DSA_DISABLE +PK11_DH_DISABLE +PK11_PAD_HMAC_KEYS +*/ + +/* + * Predefined flavors + */ +/* Thales nCipher */ +#define PK11_THALES_FLAVOR 0 +/* SoftHSMv1 with SHA224 */ +#define PK11_SOFTHSMV1_FLAVOR 1 +/* SoftHSMv2 */ +#define PK11_SOFTHSMV2_FLAVOR 2 +/* Cryptech */ +#define PK11_CRYPTECH_FLAVOR 3 +/* AEP Keyper */ +#define PK11_AEP_FLAVOR 4 + +/* Default is for Thales nCipher */ +#ifndef PK11_FLAVOR +#define PK11_FLAVOR PK11_THALES_FLAVOR +#endif + +#if PK11_FLAVOR == PK11_THALES_FLAVOR +#define PK11_DH_PKCS_PARAMETER_GEN_SKIP +/* doesn't work but supported #define PK11_DSA_PARAMETER_GEN_SKIP */ +#define PK11_MD5_HMAC_REPLACE +#endif + +#if PK11_FLAVOR == PK11_SOFTHSMV1_FLAVOR +#define PK11_PAD_HMAC_KEYS +#endif + +#if PK11_FLAVOR == PK11_SOFTHSMV2_FLAVOR +/* SoftHSMv2 was updated to enforce minimal key sizes... argh! */ +#define PK11_MD5_HMAC_REPLACE +#define PK11_SHA_1_HMAC_REPLACE +#define PK11_SHA224_HMAC_REPLACE +#define PK11_SHA256_HMAC_REPLACE +#define PK11_SHA384_HMAC_REPLACE +#define PK11_SHA512_HMAC_REPLACE +#endif + +#if PK11_FLAVOR == PK11_CRYPTECH_FLAVOR +#define PK11_DH_DISABLE +#define PK11_DSA_DISABLE +#define PK11_MD5_DISABLE +#define PK11_SHA_1_HMAC_REPLACE +#define PK11_SHA224_HMAC_REPLACE +#define PK11_SHA256_HMAC_REPLACE +#define PK11_SHA384_HMAC_REPLACE +#define PK11_SHA512_HMAC_REPLACE +#endif + +#if PK11_FLAVOR == PK11_AEP_FLAVOR +#define PK11_DH_DISABLE +#define PK11_DSA_DISABLE +#define PK11_RSA_PKCS_REPLACE +#define PK11_MD5_HMAC_REPLACE +#define PK11_SHA_1_HMAC_REPLACE +#define PK11_SHA224_HMAC_REPLACE +#define PK11_SHA256_HMAC_REPLACE +#define PK11_SHA384_HMAC_REPLACE +#define PK11_SHA512_HMAC_REPLACE +#endif + +#endif /* PK11_SITE_H */ |