diff options
Diffstat (limited to 'nss/lib/pk11wrap/pk11cxt.c')
| -rw-r--r-- | nss/lib/pk11wrap/pk11cxt.c | 1795 |
1 files changed, 1795 insertions, 0 deletions
diff --git a/nss/lib/pk11wrap/pk11cxt.c b/nss/lib/pk11wrap/pk11cxt.c new file mode 100644 index 0000000..0f170c3 --- /dev/null +++ b/nss/lib/pk11wrap/pk11cxt.c @@ -0,0 +1,1795 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +/* + * This file PK11Contexts which are used in multipart hashing, + * encryption/decryption, and signing/verication operations. + */ + +#include "seccomon.h" +#include "secmod.h" +#include "nssilock.h" +#include "secmodi.h" +#include "secmodti.h" +#include "pkcs11.h" +#include "pk11func.h" +#include "secitem.h" +#include "secoid.h" +#include "sechash.h" +#include "secerr.h" +#include "blapit.h" +#include "secport.h" + +static const SECItem pk11_null_params = { 0 }; + +/********************************************************************** + * + * Now Deal with Crypto Contexts + * + **********************************************************************/ + +/* + * the monitors... + */ +void +PK11_EnterContextMonitor(PK11Context *cx) +{ + /* if we own the session and our slot is ThreadSafe, only monitor + * the Context */ + if ((cx->ownSession) && (cx->slot->isThreadSafe)) { + /* Should this use monitors instead? */ + PZ_Lock(cx->sessionLock); + } else { + PK11_EnterSlotMonitor(cx->slot); + } +} + +void +PK11_ExitContextMonitor(PK11Context *cx) +{ + /* if we own the session and our slot is ThreadSafe, only monitor + * the Context */ + if ((cx->ownSession) && (cx->slot->isThreadSafe)) { + /* Should this use monitors instead? */ + PZ_Unlock(cx->sessionLock); + } else { + PK11_ExitSlotMonitor(cx->slot); + } +} + +/* + * Free up a Cipher Context + */ +void +PK11_DestroyContext(PK11Context *context, PRBool freeit) +{ + pk11_CloseSession(context->slot, context->session, context->ownSession); + /* initialize the critical fields of the context */ + if (context->savedData != NULL) + PORT_Free(context->savedData); + if (context->key) + PK11_FreeSymKey(context->key); + if (context->param && context->param != &pk11_null_params) + SECITEM_FreeItem(context->param, PR_TRUE); + if (context->sessionLock) + PZ_DestroyLock(context->sessionLock); + PK11_FreeSlot(context->slot); + if (freeit) + PORT_Free(context); +} + +/* + * save the current context. Allocate Space if necessary. + */ +static unsigned char * +pk11_saveContextHelper(PK11Context *context, unsigned char *buffer, + unsigned long *savedLength) +{ + CK_RV crv; + + /* If buffer is NULL, this will get the length */ + crv = PK11_GETTAB(context->slot)->C_GetOperationState(context->session, (CK_BYTE_PTR)buffer, savedLength); + if (!buffer || (crv == CKR_BUFFER_TOO_SMALL)) { + /* the given buffer wasn't big enough (or was NULL), but we + * have the length, so try again with a new buffer and the + * correct length + */ + unsigned long bufLen = *savedLength; + buffer = PORT_Alloc(bufLen); + if (buffer == NULL) { + return (unsigned char *)NULL; + } + crv = PK11_GETTAB(context->slot)->C_GetOperationState(context->session, (CK_BYTE_PTR)buffer, savedLength); + if (crv != CKR_OK) { + PORT_ZFree(buffer, bufLen); + } + } + if (crv != CKR_OK) { + PORT_SetError(PK11_MapError(crv)); + return (unsigned char *)NULL; + } + return buffer; +} + +void * +pk11_saveContext(PK11Context *context, void *space, unsigned long *savedLength) +{ + return pk11_saveContextHelper(context, + (unsigned char *)space, savedLength); +} + +/* + * restore the current context + */ +SECStatus +pk11_restoreContext(PK11Context *context, void *space, unsigned long savedLength) +{ + CK_RV crv; + CK_OBJECT_HANDLE objectID = context->objectID; + + PORT_Assert(space != NULL); + if (space == NULL) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + crv = PK11_GETTAB(context->slot)->C_SetOperationState(context->session, (CK_BYTE_PTR)space, savedLength, objectID, 0); + if (crv != CKR_OK) { + PORT_SetError(PK11_MapError(crv)); + return SECFailure; + } + return SECSuccess; +} + +SECStatus pk11_Finalize(PK11Context *context); + +/* + * Initialize a Message function. Particular function is passed in as a + * function pointer. Since all C_Message*Init funcitons have the same + * prototype, we just pick one of the the prototypes to declare our init + * function. + */ +static CK_RV +pk11_contextInitMessage(PK11Context *context, CK_MECHANISM_PTR mech, + CK_C_MessageEncryptInit initFunc, + CK_FLAGS flags, CK_RV scrv) +{ + PK11SlotInfo *slot = context->slot; + CK_VERSION version = slot->module->cryptokiVersion; + CK_RV crv = CKR_OK; + + context->ivCounter = 0; + context->ivMaxCount = 0; + context->ivFixedBits = 0; + context->ivLen = 0; + context->ivGen = CKG_NO_GENERATE; + context->simulate_mechanism = (mech)->mechanism; + context->simulate_message = PR_FALSE; + /* check that we can do the Message interface. We need to check + * for either 1) are we using a PKCS #11 v3 interface and 2) is the + * Message flag set on the mechanism. If either is false we simulate + * the message interface for the Encrypt and Decrypt cases using the + * PKCS #11 V2 interface. + * Sign and verify do not have V2 interfaces, so we go ahead and fail + * if those cases */ + if ((version.major >= 3) && + PK11_DoesMechanismFlag(slot, (mech)->mechanism, flags)) { + PK11_EnterContextMonitor(context); + crv = (*initFunc)((context)->session, (mech), (context)->objectID); + PK11_ExitContextMonitor(context); + if ((crv == CKR_FUNCTION_NOT_SUPPORTED) || + (crv == CKR_MECHANISM_INVALID)) { + /* we have a 3.0 interface, and the flag was set (or ignored) + * but the implementation was not there, use the V2 interface */ + crv = (scrv); + context->simulate_message = PR_TRUE; + } + } else { + crv = (scrv); + context->simulate_message = PR_TRUE; + } + return crv; +} + +/* + * Context initialization. Used by all flavors of CreateContext + */ +static SECStatus +pk11_context_init(PK11Context *context, CK_MECHANISM *mech_info) +{ + CK_RV crv; + SECStatus rv = SECSuccess; + + context->simulate_message = PR_FALSE; + switch (context->operation) { + case CKA_ENCRYPT: + PK11_EnterContextMonitor(context); + crv = PK11_GETTAB(context->slot)->C_EncryptInit(context->session, mech_info, context->objectID); + PK11_ExitContextMonitor(context); + break; + case CKA_DECRYPT: + PK11_EnterContextMonitor(context); + if (context->fortezzaHack) { + CK_ULONG count = 0; + /* generate the IV for fortezza */ + crv = PK11_GETTAB(context->slot)->C_EncryptInit(context->session, mech_info, context->objectID); + if (crv != CKR_OK) { + PK11_ExitContextMonitor(context); + break; + } + PK11_GETTAB(context->slot) + ->C_EncryptFinal(context->session, + NULL, &count); + } + crv = PK11_GETTAB(context->slot)->C_DecryptInit(context->session, mech_info, context->objectID); + PK11_ExitContextMonitor(context); + break; + case CKA_SIGN: + PK11_EnterContextMonitor(context); + crv = PK11_GETTAB(context->slot)->C_SignInit(context->session, mech_info, context->objectID); + PK11_ExitContextMonitor(context); + break; + case CKA_VERIFY: + /* NOTE: we previously has this set to C_SignInit for Macing. + * It turns out now one could possibly use it that way, though, + * because PK11_HashOp() always called C_VerifyUpdate on CKA_VERIFY, + * which would have failed. So everyone just calls us with CKA_SIGN + * when Macing even when they are verifying, no need to 'do it + * for them'. It needs to be VerifyInit now so that we can do + * PKCS #11 hash/Verify combo operations. */ + PK11_EnterContextMonitor(context); + crv = PK11_GETTAB(context->slot)->C_VerifyInit(context->session, mech_info, context->objectID); + PK11_ExitContextMonitor(context); + break; + case CKA_DIGEST: + PK11_EnterContextMonitor(context); + crv = PK11_GETTAB(context->slot)->C_DigestInit(context->session, mech_info); + PK11_ExitContextMonitor(context); + break; + + case CKA_NSS_MESSAGE | CKA_ENCRYPT: + crv = pk11_contextInitMessage(context, mech_info, + PK11_GETTAB(context->slot)->C_MessageEncryptInit, + CKF_MESSAGE_ENCRYPT, CKR_OK); + break; + case CKA_NSS_MESSAGE | CKA_DECRYPT: + crv = pk11_contextInitMessage(context, mech_info, + PK11_GETTAB(context->slot)->C_MessageDecryptInit, + CKF_MESSAGE_DECRYPT, CKR_OK); + break; + case CKA_NSS_MESSAGE | CKA_SIGN: + crv = pk11_contextInitMessage(context, mech_info, + PK11_GETTAB(context->slot)->C_MessageSignInit, + CKF_MESSAGE_SIGN, CKR_FUNCTION_NOT_SUPPORTED); + break; + case CKA_NSS_MESSAGE | CKA_VERIFY: + crv = pk11_contextInitMessage(context, mech_info, + PK11_GETTAB(context->slot)->C_MessageVerifyInit, + CKF_MESSAGE_VERIFY, CKR_FUNCTION_NOT_SUPPORTED); + break; + default: + crv = CKR_OPERATION_NOT_INITIALIZED; + break; + } + + if (crv != CKR_OK) { + PORT_SetError(PK11_MapError(crv)); + return SECFailure; + } + + /* handle the case where the token is using the old NSS mechanism */ + if (context->simulate_message && + !PK11_DoesMechanism(context->slot, context->simulate_mechanism)) { + if ((context->simulate_mechanism == CKM_CHACHA20_POLY1305) && + PK11_DoesMechanism(context->slot, CKM_NSS_CHACHA20_POLY1305)) { + context->simulate_mechanism = CKM_NSS_CHACHA20_POLY1305; + } else { + PORT_SetError(PK11_MapError(CKR_MECHANISM_INVALID)); + return SECFailure; + } + } + + /* + * handle session starvation case.. use our last session to multiplex + */ + if (!context->ownSession) { + PK11_EnterContextMonitor(context); + context->savedData = pk11_saveContext(context, context->savedData, + &context->savedLength); + if (context->savedData == NULL) + rv = SECFailure; + /* clear out out session for others to use */ + pk11_Finalize(context); + PK11_ExitContextMonitor(context); + } + return rv; +} + +/* + * Testing interfaces, not for general use. This function forces + * an AEAD context into simulation mode even though the target token + * can already do PKCS #11 v3.0 Message (i.e. softoken). + */ +SECStatus +_PK11_ContextSetAEADSimulation(PK11Context *context) +{ + CK_RV crv; + /* only message encrypt and message decrypt contexts can be simulated */ + if ((context->operation != (CKA_NSS_MESSAGE | CKA_ENCRYPT)) && + (context->operation != (CKA_NSS_MESSAGE | CKA_DECRYPT))) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + /* if we are already simulating, return */ + if (context->simulate_message) { + return SECSuccess; + } + /* we need to shutdown the existing AEAD operation */ + switch (context->operation) { + case CKA_NSS_MESSAGE | CKA_ENCRYPT: + crv = PK11_GETTAB(context->slot)->C_MessageEncryptFinal(context->session); + break; + case CKA_NSS_MESSAGE | CKA_DECRYPT: + crv = PK11_GETTAB(context->slot)->C_MessageDecryptFinal(context->session); + break; + default: + PORT_SetError(SEC_ERROR_NOT_INITIALIZED); + return SECFailure; + } + if (crv != CKR_OK) { + PORT_SetError(PK11_MapError(crv)); + return SECFailure; + } + context->simulate_message = PR_TRUE; + return SECSuccess; +} + +PRBool +_PK11_ContextGetAEADSimulation(PK11Context *context) +{ + return context->simulate_message; +} + +/* + * Common Helper Function do come up with a new context. + */ +static PK11Context * +pk11_CreateNewContextInSlot(CK_MECHANISM_TYPE type, + PK11SlotInfo *slot, CK_ATTRIBUTE_TYPE operation, + PK11SymKey *symKey, CK_OBJECT_HANDLE objectID, + const SECItem *param, void *pwArg) +{ + CK_MECHANISM mech_info; + PK11Context *context; + SECStatus rv; + + PORT_Assert(slot != NULL); + if (!slot || ((objectID == CK_INVALID_HANDLE) && ((operation != CKA_DIGEST) || + (type == CKM_SKIPJACK_CBC64)))) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return NULL; + } + context = (PK11Context *)PORT_Alloc(sizeof(PK11Context)); + if (context == NULL) { + return NULL; + } + + /* now deal with the fortezza hack... the fortezza hack is an attempt + * to get around the issue of the card not allowing you to do a FORTEZZA + * LoadIV/Encrypt, which was added because such a combination could be + * use to circumvent the key escrow system. Unfortunately SSL needs to + * do this kind of operation, so in SSL we do a loadIV (to verify it), + * Then GenerateIV, and through away the first 8 bytes on either side + * of the connection.*/ + context->fortezzaHack = PR_FALSE; + if (type == CKM_SKIPJACK_CBC64) { + if (symKey && (symKey->origin == PK11_OriginFortezzaHack)) { + context->fortezzaHack = PR_TRUE; + } + } + + /* initialize the critical fields of the context */ + context->operation = operation; + /* If we were given a symKey, keep our own reference to it so + * that the key doesn't disappear in the middle of the operation + * if the caller frees it. Public and Private keys are not reference + * counted, so the caller just has to keep his copies around until + * the operation completes */ + context->key = symKey ? PK11_ReferenceSymKey(symKey) : NULL; + context->objectID = objectID; + context->slot = PK11_ReferenceSlot(slot); + context->session = pk11_GetNewSession(slot, &context->ownSession); + context->pwArg = pwArg; + /* get our session */ + context->savedData = NULL; + + /* save the parameters so that some digesting stuff can do multiple + * begins on a single context */ + context->type = type; + if (param) { + if (param->len > 0) { + context->param = SECITEM_DupItem(param); + } else { + context->param = (SECItem *)&pk11_null_params; + } + } else { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + context->param = NULL; + } + context->init = PR_FALSE; + context->sessionLock = PZ_NewLock(nssILockPK11cxt); + if ((context->param == NULL) || (context->sessionLock == NULL)) { + PK11_DestroyContext(context, PR_TRUE); + return NULL; + } + + mech_info.mechanism = type; + mech_info.pParameter = param->data; + mech_info.ulParameterLen = param->len; + rv = pk11_context_init(context, &mech_info); + + if (rv != SECSuccess) { + PK11_DestroyContext(context, PR_TRUE); + return NULL; + } + context->init = PR_TRUE; + return context; +} + +/* + * put together the various PK11_Create_Context calls used by different + * parts of libsec. + */ +PK11Context * +__PK11_CreateContextByRawKey(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, + PK11Origin origin, CK_ATTRIBUTE_TYPE operation, SECItem *key, + SECItem *param, void *wincx) +{ + PK11SymKey *symKey = NULL; + PK11Context *context = NULL; + + /* first get a slot */ + if (slot == NULL) { + slot = PK11_GetBestSlot(type, wincx); + if (slot == NULL) { + PORT_SetError(SEC_ERROR_NO_MODULE); + goto loser; + } + } else { + PK11_ReferenceSlot(slot); + } + + /* now import the key */ + symKey = PK11_ImportSymKey(slot, type, origin, operation, key, wincx); + if (symKey == NULL) + goto loser; + + context = PK11_CreateContextBySymKey(type, operation, symKey, param); + +loser: + if (symKey) { + PK11_FreeSymKey(symKey); + } + if (slot) { + PK11_FreeSlot(slot); + } + + return context; +} + +PK11Context * +PK11_CreateContextByRawKey(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, + PK11Origin origin, CK_ATTRIBUTE_TYPE operation, SECItem *key, + SECItem *param, void *wincx) +{ + return __PK11_CreateContextByRawKey(slot, type, origin, operation, + key, param, wincx); +} + +/* + * Create a context from a key. We really should make sure we aren't using + * the same key in multiple sessions! + */ +PK11Context * +PK11_CreateContextBySymKey(CK_MECHANISM_TYPE type, CK_ATTRIBUTE_TYPE operation, + PK11SymKey *symKey, const SECItem *param) +{ + PK11SymKey *newKey; + PK11Context *context; + + /* if this slot doesn't support the mechanism, go to a slot that does */ + newKey = pk11_ForceSlot(symKey, type, operation); + if (newKey == NULL) { + PK11_ReferenceSymKey(symKey); + } else { + symKey = newKey; + } + + /* Context keeps its reference to the symKey, so it's safe to + * free our reference we we are through, even though we may have + * created the key using pk11_ForceSlot. */ + context = pk11_CreateNewContextInSlot(type, symKey->slot, operation, symKey, + symKey->objectID, param, symKey->cx); + PK11_FreeSymKey(symKey); + return context; +} + +/* To support multipart public key operations (like hash/verify operations), + * we need to create contexts with public keys. */ +PK11Context * +PK11_CreateContextByPubKey(CK_MECHANISM_TYPE type, CK_ATTRIBUTE_TYPE operation, + SECKEYPublicKey *pubKey, const SECItem *param, + void *pwArg) +{ + PK11SlotInfo *slot = pubKey->pkcs11Slot; + SECItem nullparam = { 0, 0, 0 }; + + /* if this slot doesn't support the mechanism, go to a slot that does */ + /* public keys have all their data in the public key data structure, + * so there's no need to export the old key, just import this one. The + * import manages consistancy of the public key data structure */ + if (slot == NULL || !PK11_DoesMechanism(slot, type)) { + CK_OBJECT_HANDLE objectID; + slot = PK11_GetBestSlot(type, NULL); + if (slot == NULL) { + return NULL; + } + objectID = PK11_ImportPublicKey(slot, pubKey, PR_FALSE); + PK11_FreeSlot(slot); + if (objectID == CK_INVALID_HANDLE) { + return NULL; + } + } + + /* unlike symkeys, we accept a NULL parameter. map a null parameter + * to the empty parameter. This matches the semantics of + * PK11_VerifyWithMechanism */ + return pk11_CreateNewContextInSlot(type, pubKey->pkcs11Slot, operation, + NULL, pubKey->pkcs11ID, + param ? param : &nullparam, pwArg); +} + +/* To support multipart private key operations (like hash/sign operations), + * we need to create contexts with private keys. */ +PK11Context * +PK11_CreateContextByPrivKey(CK_MECHANISM_TYPE type, CK_ATTRIBUTE_TYPE operation, + SECKEYPrivateKey *privKey, const SECItem *param) +{ + SECItem nullparam = { 0, 0, 0 }; + /* Private keys are generally not movable. If the token the + * private key lives on can't do the operation, generally we are + * stuck anyway. So no need to try to manipulate the key into + * another token */ + + /* if this slot doesn't support the mechanism, go to a slot that does */ + /* unlike symkeys, we accept a NULL parameter. map a null parameter + * to the empty parameter. This matches the semantics of + * PK11_SignWithMechanism */ + return pk11_CreateNewContextInSlot(type, privKey->pkcs11Slot, operation, + NULL, privKey->pkcs11ID, + param ? param : &nullparam, + privKey->wincx); +} + +/* + * Digest contexts don't need keys, but the do need to find a slot. + * Macing should use PK11_CreateContextBySymKey. + */ +PK11Context * +PK11_CreateDigestContext(SECOidTag hashAlg) +{ + /* digesting has to work without authentication to the slot */ + CK_MECHANISM_TYPE type; + PK11SlotInfo *slot; + PK11Context *context; + SECItem param; + + type = PK11_AlgtagToMechanism(hashAlg); + slot = PK11_GetBestSlot(type, NULL); + if (slot == NULL) { + PORT_SetError(SEC_ERROR_NO_MODULE); + return NULL; + } + + /* maybe should really be PK11_GenerateNewParam?? */ + param.data = NULL; + param.len = 0; + param.type = 0; + + context = pk11_CreateNewContextInSlot(type, slot, CKA_DIGEST, NULL, + CK_INVALID_HANDLE, ¶m, NULL); + PK11_FreeSlot(slot); + return context; +} + +/* + * create a new context which is the clone of the state of old context. + */ +PK11Context * +PK11_CloneContext(PK11Context *old) +{ + PK11Context *newcx; + PRBool needFree = PR_FALSE; + SECStatus rv = SECSuccess; + void *data; + unsigned long len; + + newcx = pk11_CreateNewContextInSlot(old->type, old->slot, old->operation, + old->key, old->objectID, old->param, + old->pwArg); + if (newcx == NULL) + return NULL; + + /* now clone the save state. First we need to find the save state + * of the old session. If the old context owns it's session, + * the state needs to be saved, otherwise the state is in saveData. */ + if (old->ownSession) { + PK11_EnterContextMonitor(old); + data = pk11_saveContext(old, NULL, &len); + PK11_ExitContextMonitor(old); + needFree = PR_TRUE; + } else { + data = old->savedData; + len = old->savedLength; + } + + if (data == NULL) { + PK11_DestroyContext(newcx, PR_TRUE); + return NULL; + } + + /* now copy that state into our new context. Again we have different + * work if the new context owns it's own session. If it does, we + * restore the state gathered above. If it doesn't, we copy the + * saveData pointer... */ + if (newcx->ownSession) { + PK11_EnterContextMonitor(newcx); + rv = pk11_restoreContext(newcx, data, len); + PK11_ExitContextMonitor(newcx); + } else { + PORT_Assert(newcx->savedData != NULL); + if ((newcx->savedData == NULL) || (newcx->savedLength < len)) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + rv = SECFailure; + } else { + PORT_Memcpy(newcx->savedData, data, len); + newcx->savedLength = len; + } + } + + if (needFree) + PORT_Free(data); + + if (rv != SECSuccess) { + PK11_DestroyContext(newcx, PR_TRUE); + return NULL; + } + return newcx; +} + +/* + * save the current context state into a variable. Required to make FORTEZZA + * work. + */ +SECStatus +PK11_SaveContext(PK11Context *cx, unsigned char *save, int *len, int saveLength) +{ + unsigned char *data = NULL; + CK_ULONG length = saveLength; + + if (cx->ownSession) { + PK11_EnterContextMonitor(cx); + data = pk11_saveContextHelper(cx, save, &length); + PK11_ExitContextMonitor(cx); + if (data) + *len = length; + } else if ((unsigned)saveLength >= cx->savedLength) { + data = (unsigned char *)cx->savedData; + if (cx->savedData) { + PORT_Memcpy(save, cx->savedData, cx->savedLength); + } + *len = cx->savedLength; + } + if (data != NULL) { + if (cx->ownSession) { + PORT_ZFree(data, length); + } + return SECSuccess; + } else { + return SECFailure; + } +} + +/* same as above, but may allocate the return buffer. */ +unsigned char * +PK11_SaveContextAlloc(PK11Context *cx, + unsigned char *preAllocBuf, unsigned int pabLen, + unsigned int *stateLen) +{ + unsigned char *stateBuf = NULL; + unsigned long length = (unsigned long)pabLen; + + if (cx->ownSession) { + PK11_EnterContextMonitor(cx); + stateBuf = pk11_saveContextHelper(cx, preAllocBuf, &length); + PK11_ExitContextMonitor(cx); + *stateLen = (stateBuf != NULL) ? length : 0; + } else { + if (pabLen < cx->savedLength) { + stateBuf = (unsigned char *)PORT_Alloc(cx->savedLength); + if (!stateBuf) { + return (unsigned char *)NULL; + } + } else { + stateBuf = preAllocBuf; + } + if (cx->savedData) { + PORT_Memcpy(stateBuf, cx->savedData, cx->savedLength); + } + *stateLen = cx->savedLength; + } + return stateBuf; +} + +/* + * restore the context state into a new running context. Also required for + * FORTEZZA . + */ +SECStatus +PK11_RestoreContext(PK11Context *cx, unsigned char *save, int len) +{ + SECStatus rv = SECSuccess; + if (cx->ownSession) { + PK11_EnterContextMonitor(cx); + pk11_Finalize(cx); + rv = pk11_restoreContext(cx, save, len); + PK11_ExitContextMonitor(cx); + } else { + PORT_Assert(cx->savedData != NULL); + if ((cx->savedData == NULL) || (cx->savedLength < (unsigned)len)) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + rv = SECFailure; + } else { + PORT_Memcpy(cx->savedData, save, len); + cx->savedLength = len; + } + } + return rv; +} + +/* + * This is to get FIPS compliance until we can convert + * libjar to use PK11_ hashing functions. It returns PR_FALSE + * if we can't get a PK11 Context. + */ +PRBool +PK11_HashOK(SECOidTag algID) +{ + PK11Context *cx; + + cx = PK11_CreateDigestContext(algID); + if (cx == NULL) + return PR_FALSE; + PK11_DestroyContext(cx, PR_TRUE); + return PR_TRUE; +} + +/* + * start a new digesting or Mac'ing operation on this context + */ +SECStatus +PK11_DigestBegin(PK11Context *cx) +{ + CK_MECHANISM mech_info; + SECStatus rv; + + if (cx->init == PR_TRUE) { + return SECSuccess; + } + + /* + * make sure the old context is clear first + */ + PK11_EnterContextMonitor(cx); + pk11_Finalize(cx); + PK11_ExitContextMonitor(cx); + + mech_info.mechanism = cx->type; + mech_info.pParameter = cx->param->data; + mech_info.ulParameterLen = cx->param->len; + rv = pk11_context_init(cx, &mech_info); + + if (rv != SECSuccess) { + return SECFailure; + } + cx->init = PR_TRUE; + return SECSuccess; +} + +SECStatus +PK11_HashBuf(SECOidTag hashAlg, unsigned char *out, const unsigned char *in, + PRInt32 len) +{ + PK11Context *context; + unsigned int max_length; + unsigned int out_length; + SECStatus rv; + + /* len will be passed to PK11_DigestOp as unsigned. */ + if (len < 0) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + context = PK11_CreateDigestContext(hashAlg); + if (context == NULL) + return SECFailure; + + rv = PK11_DigestBegin(context); + if (rv != SECSuccess) { + PK11_DestroyContext(context, PR_TRUE); + return rv; + } + + rv = PK11_DigestOp(context, in, len); + if (rv != SECSuccess) { + PK11_DestroyContext(context, PR_TRUE); + return rv; + } + + /* XXX This really should have been an argument to this function! */ + max_length = HASH_ResultLenByOidTag(hashAlg); + PORT_Assert(max_length); + if (!max_length) + max_length = HASH_LENGTH_MAX; + + rv = PK11_DigestFinal(context, out, &out_length, max_length); + PK11_DestroyContext(context, PR_TRUE); + return rv; +} + +/* + * execute a bulk encryption operation + */ +SECStatus +PK11_CipherOp(PK11Context *context, unsigned char *out, int *outlen, + int maxout, const unsigned char *in, int inlen) +{ + CK_RV crv = CKR_OK; + CK_ULONG length = maxout; + CK_ULONG offset = 0; + SECStatus rv = SECSuccess; + unsigned char *saveOut = out; + unsigned char *allocOut = NULL; + + /* if we ran out of session, we need to restore our previously stored + * state. + */ + PK11_EnterContextMonitor(context); + if (!context->ownSession) { + rv = pk11_restoreContext(context, context->savedData, + context->savedLength); + if (rv != SECSuccess) { + PK11_ExitContextMonitor(context); + return rv; + } + } + + /* + * The fortezza hack is to send 8 extra bytes on the first encrypted and + * lose them on the first decrypt. + */ + if (context->fortezzaHack) { + unsigned char random[8]; + if (context->operation == CKA_ENCRYPT) { + PK11_ExitContextMonitor(context); + rv = PK11_GenerateRandom(random, sizeof(random)); + PK11_EnterContextMonitor(context); + + /* since we are offseting the output, we can't encrypt back into + * the same buffer... allocate a temporary buffer just for this + * call. */ + allocOut = out = (unsigned char *)PORT_Alloc(maxout); + if (out == NULL) { + PK11_ExitContextMonitor(context); + return SECFailure; + } + crv = PK11_GETTAB(context->slot)->C_EncryptUpdate(context->session, random, sizeof(random), out, &length); + + out += length; + maxout -= length; + offset = length; + } else if (context->operation == CKA_DECRYPT) { + length = sizeof(random); + crv = PK11_GETTAB(context->slot)->C_DecryptUpdate(context->session, (CK_BYTE_PTR)in, sizeof(random), random, &length); + inlen -= length; + in += length; + context->fortezzaHack = PR_FALSE; + } + } + + switch (context->operation) { + case CKA_ENCRYPT: + length = maxout; + crv = PK11_GETTAB(context->slot)->C_EncryptUpdate(context->session, (CK_BYTE_PTR)in, inlen, out, &length); + length += offset; + break; + case CKA_DECRYPT: + length = maxout; + crv = PK11_GETTAB(context->slot)->C_DecryptUpdate(context->session, (CK_BYTE_PTR)in, inlen, out, &length); + break; + default: + crv = CKR_OPERATION_NOT_INITIALIZED; + break; + } + + if (crv != CKR_OK) { + PORT_SetError(PK11_MapError(crv)); + *outlen = 0; + rv = SECFailure; + } else { + *outlen = length; + } + + if (context->fortezzaHack) { + if (context->operation == CKA_ENCRYPT) { + PORT_Assert(allocOut); + PORT_Memcpy(saveOut, allocOut, length); + PORT_Free(allocOut); + } + context->fortezzaHack = PR_FALSE; + } + + /* + * handle session starvation case.. use our last session to multiplex + */ + if (!context->ownSession) { + context->savedData = pk11_saveContext(context, context->savedData, + &context->savedLength); + if (context->savedData == NULL) + rv = SECFailure; + + /* clear out out session for others to use */ + pk11_Finalize(context); + } + PK11_ExitContextMonitor(context); + return rv; +} + +/* + * Simulate the IV generation that normally would happen in the token. + * + * This is a modifed copy of what is in freebl/gcm.c. We can't use the + * version in freebl because of layering, since freebl is inside the token + * boundary. These issues are traditionally handled by moving them to util, + * but we also have two different Random functions we have two switch between. + * Since this is primarily here for tokens that don't support the PKCS #11 + * Message Interface, it's OK if they diverge a bit. Slight semantic + * differences from the freebl/gcm.c version shouldn't be much more than the + * sematic differences between freebl and other tokens which do implement the + * Message Interface. */ +static SECStatus +pk11_GenerateIV(PK11Context *context, CK_GENERATOR_FUNCTION ivgen, + int fixedBits, unsigned char *iv, int ivLen) +{ + unsigned int i; + unsigned int flexBits; + unsigned int ivOffset; + unsigned int ivNewCount; + unsigned char ivMask; + unsigned char ivSave; + SECStatus rv; + + if (context->ivCounter != 0) { + /* If we've already generated a message, make sure all subsequent + * messages are using the same generator */ + if ((context->ivGen != ivgen) || + (context->ivFixedBits != fixedBits) || + (context->ivLen != ivLen)) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + } else { + /* remember these values */ + context->ivGen = ivgen; + context->ivFixedBits = fixedBits; + context->ivLen = ivLen; + /* now calculate how may bits of IV we have to supply */ + flexBits = ivLen * PR_BITS_PER_BYTE; + /* first make sure we aren't going to overflow */ + if (flexBits < fixedBits) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + flexBits -= fixedBits; + /* if we are generating a random number reduce the acceptable bits to + * avoid birthday attacks */ + if (ivgen == CKG_GENERATE_RANDOM) { + if (flexBits <= GCMIV_RANDOM_BIRTHDAY_BITS) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + /* see freebl/blapit.h for how GCMIV_RANDOM_BIRTHDAY_BITS is + * calculated. */ + flexBits -= GCMIV_RANDOM_BIRTHDAY_BITS; + flexBits = flexBits >> 1; + } + if (flexBits == 0) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + /* Turn those bits into the number of IV's we can safely return */ + if (flexBits >= sizeof(context->ivMaxCount) * PR_BITS_PER_BYTE) { + context->ivMaxCount = PR_UINT64(0xffffffffffffffff); + } else { + context->ivMaxCount = (PR_UINT64(1) << flexBits); + } + } + + /* no generate, accept the IV from the source */ + if (ivgen == CKG_NO_GENERATE) { + context->ivCounter = 1; + return SECSuccess; + } + + /* make sure we haven't exceeded the number of IVs we can return + * for this key, generator, and IV size */ + if (context->ivCounter >= context->ivMaxCount) { + /* use a unique error from just bad user input */ + PORT_SetError(SEC_ERROR_EXTRA_INPUT); + return SECFailure; + } + + /* build to mask to handle the first byte of the IV */ + ivOffset = fixedBits / PR_BITS_PER_BYTE; + ivMask = 0xff >> ((PR_BITS_PER_BYTE - (fixedBits & 7)) & 7); + ivNewCount = ivLen - ivOffset; + + /* finally generate the IV */ + switch (ivgen) { + case CKG_GENERATE: /* default to counter */ + case CKG_GENERATE_COUNTER: + iv[ivOffset] = (iv[ivOffset] & ~ivMask) | + (PORT_GET_BYTE_BE(context->ivCounter, 0, ivNewCount) & ivMask); + for (i = 1; i < ivNewCount; i++) { + iv[ivOffset + i] = + PORT_GET_BYTE_BE(context->ivCounter, i, ivNewCount); + } + break; + case CKG_GENERATE_COUNTER_XOR: + iv[ivOffset] ^= + (PORT_GET_BYTE_BE(context->ivCounter, 0, ivNewCount) & ivMask); + for (i = 1; i < ivNewCount; i++) { + iv[ivOffset + i] ^= + PORT_GET_BYTE_BE(context->ivCounter, i, ivNewCount); + } + break; + case CKG_GENERATE_RANDOM: + ivSave = iv[ivOffset] & ~ivMask; + rv = PK11_GenerateRandom(iv + ivOffset, ivNewCount); + iv[ivOffset] = ivSave | (iv[ivOffset] & ivMask); + if (rv != SECSuccess) { + return rv; + } + break; + } + context->ivCounter++; + return SECSuccess; +} + +/* + * PKCS #11 v2.40 did not have a message interface. If our module can't + * do the message interface use the old method of doing AEAD */ +static SECStatus +pk11_AEADSimulateOp(PK11Context *context, void *params, int paramslen, + const unsigned char *aad, int aadlen, + unsigned char *out, int *outlen, + int maxout, const unsigned char *in, int inlen) +{ + unsigned int length = maxout; + SECStatus rv = SECSuccess; + unsigned char *saveOut = out; + unsigned char *allocOut = NULL; + + /* + * first we need to convert the single shot (v2.40) parameters into + * the message version of the parameters. This usually involves + * copying the Nonce or IV, setting the AAD from our parameter list + * and handling the tag differences */ + CK_GCM_PARAMS_V3 gcm; + CK_GCM_MESSAGE_PARAMS *gcm_message; + CK_CCM_PARAMS ccm; + CK_CCM_MESSAGE_PARAMS *ccm_message; + CK_SALSA20_CHACHA20_POLY1305_PARAMS chacha_poly; + CK_SALSA20_CHACHA20_POLY1305_MSG_PARAMS *chacha_poly_message; + CK_NSS_AEAD_PARAMS nss_chacha_poly; + CK_MECHANISM_TYPE mechanism = context->simulate_mechanism; + SECItem sim_params = { 0, NULL, 0 }; + unsigned char *tag = NULL; + unsigned int taglen; + PRBool encrypt; + + *outlen = 0; + /* figure out if we are encrypting or decrypting, as tags are + * handled differently in both */ + switch (context->operation) { + case CKA_NSS_MESSAGE | CKA_ENCRYPT: + encrypt = PR_TRUE; + break; + case CKA_NSS_MESSAGE | CKA_DECRYPT: + encrypt = PR_FALSE; + break; + default: + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + switch (mechanism) { + case CKM_CHACHA20_POLY1305: + case CKM_SALSA20_POLY1305: + if (paramslen != sizeof(CK_SALSA20_CHACHA20_POLY1305_MSG_PARAMS)) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + chacha_poly_message = + (CK_SALSA20_CHACHA20_POLY1305_MSG_PARAMS *)params; + chacha_poly.pNonce = chacha_poly_message->pNonce; + chacha_poly.ulNonceLen = chacha_poly_message->ulNonceLen; + chacha_poly.pAAD = (CK_BYTE_PTR)aad; + chacha_poly.ulAADLen = aadlen; + tag = chacha_poly_message->pTag; + taglen = 16; + sim_params.data = (unsigned char *)&chacha_poly; + sim_params.len = sizeof(chacha_poly); + /* SALSA20_POLY1305 and CHACHA20_POLY1305 do not generate the iv + * internally, don't simulate it either */ + break; + case CKM_NSS_CHACHA20_POLY1305: + if (paramslen != sizeof(CK_SALSA20_CHACHA20_POLY1305_MSG_PARAMS)) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + chacha_poly_message = + (CK_SALSA20_CHACHA20_POLY1305_MSG_PARAMS *)params; + tag = chacha_poly_message->pTag; + taglen = 16; + nss_chacha_poly.pNonce = chacha_poly_message->pNonce; + nss_chacha_poly.ulNonceLen = chacha_poly_message->ulNonceLen; + nss_chacha_poly.pAAD = (CK_BYTE_PTR)aad; + nss_chacha_poly.ulAADLen = aadlen; + nss_chacha_poly.ulTagLen = taglen; + sim_params.data = (unsigned char *)&nss_chacha_poly; + sim_params.len = sizeof(nss_chacha_poly); + /* CKM_NSS_CHACHA20_POLY1305 does not generate the iv + * internally, don't simulate it either */ + break; + case CKM_AES_CCM: + if (paramslen != sizeof(CK_CCM_MESSAGE_PARAMS)) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + ccm_message = (CK_CCM_MESSAGE_PARAMS *)params; + ccm.ulDataLen = ccm_message->ulDataLen; + ccm.pNonce = ccm_message->pNonce; + ccm.ulNonceLen = ccm_message->ulNonceLen; + ccm.pAAD = (CK_BYTE_PTR)aad; + ccm.ulAADLen = aadlen; + ccm.ulMACLen = ccm_message->ulMACLen; + tag = ccm_message->pMAC; + taglen = ccm_message->ulMACLen; + sim_params.data = (unsigned char *)&ccm; + sim_params.len = sizeof(ccm); + if (encrypt) { + /* simulate generating the IV */ + rv = pk11_GenerateIV(context, ccm_message->nonceGenerator, + ccm_message->ulNonceFixedBits, + ccm_message->pNonce, + ccm_message->ulNonceLen); + if (rv != SECSuccess) { + return rv; + } + } + break; + case CKM_AES_GCM: + if (paramslen != sizeof(CK_GCM_MESSAGE_PARAMS)) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + gcm_message = (CK_GCM_MESSAGE_PARAMS *)params; + gcm.pIv = gcm_message->pIv; + gcm.ulIvLen = gcm_message->ulIvLen; + gcm.ulIvBits = gcm.ulIvLen * PR_BITS_PER_BYTE; + gcm.pAAD = (CK_BYTE_PTR)aad; + gcm.ulAADLen = aadlen; + gcm.ulTagBits = gcm_message->ulTagBits; + tag = gcm_message->pTag; + taglen = (gcm_message->ulTagBits + (PR_BITS_PER_BYTE - 1)) / PR_BITS_PER_BYTE; + sim_params.data = (unsigned char *)&gcm; + sim_params.len = sizeof(gcm); + if (encrypt) { + /* simulate generating the IV */ + rv = pk11_GenerateIV(context, gcm_message->ivGenerator, + gcm_message->ulIvFixedBits, + gcm_message->pIv, gcm_message->ulIvLen); + if (rv != SECSuccess) { + return rv; + } + } + break; + default: + PORT_SetError(SEC_ERROR_INVALID_ALGORITHM); + return SECFailure; + } + /* now handle the tag. The message interface separates the tag from + * the data, while the single shot gets and puts the tag at the end of + * the encrypted data. */ + if (!encrypt) { + /* In the decrypt case, if the tag is already at the end of the + * input buffer we are golden, otherwise we'll need a new input + * buffer and copy the tag at the end of it */ + if (tag != in + inlen) { + allocOut = PORT_Alloc(inlen + taglen); + if (allocOut == NULL) { + return SECFailure; + } + PORT_Memcpy(allocOut, in, inlen); + PORT_Memcpy(allocOut + inlen, tag, taglen); + in = allocOut; + } + inlen = inlen + taglen; + } else { + /* if we end up allocating, we don't want to overrun this buffer, + * so we fail early here */ + if (maxout < inlen) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + /* in the encrypt case, we are fine if maxout is big enough to hold + * the tag. We'll copy the tag after the operation */ + if (maxout < inlen + taglen) { + allocOut = PORT_Alloc(inlen + taglen); + if (allocOut == NULL) { + return SECFailure; + } + out = allocOut; + length = maxout = inlen + taglen; + } + } + /* now do the operation */ + if (encrypt) { + rv = PK11_Encrypt(context->key, mechanism, &sim_params, out, &length, + maxout, in, inlen); + } else { + rv = PK11_Decrypt(context->key, mechanism, &sim_params, out, &length, + maxout, in, inlen); + } + if (rv != SECSuccess) { + /* If the mechanism was CKM_AES_GCM, the module may have been + * following the same error as old versions of NSS. Retry with + * the CK_NSS_GCM_PARAMS */ + if ((mechanism == CKM_AES_GCM) && + (PORT_GetError() == SEC_ERROR_BAD_DATA)) { + CK_NSS_GCM_PARAMS gcm_nss; + gcm_message = (CK_GCM_MESSAGE_PARAMS *)params; + gcm_nss.pIv = gcm_message->pIv; + gcm_nss.ulIvLen = gcm_message->ulIvLen; + gcm_nss.pAAD = (CK_BYTE_PTR)aad; + gcm_nss.ulAADLen = aadlen; + gcm_nss.ulTagBits = gcm_message->ulTagBits; + sim_params.data = (unsigned char *)&gcm_nss; + sim_params.len = sizeof(gcm_nss); + if (encrypt) { + rv = PK11_Encrypt(context->key, mechanism, &sim_params, out, + &length, maxout, in, inlen); + } else { + rv = PK11_Decrypt(context->key, mechanism, &sim_params, out, + &length, maxout, in, inlen); + } + if (rv != SECSuccess) { + goto fail; + } + } else { + goto fail; + } + } + + /* on encrypt, separate the output buffer from the tag */ + if (encrypt) { + if ((length < taglen) || (length > inlen + taglen)) { + /* PKCS #11 module should not return a length smaller than + * taglen, or bigger than inlen+taglen */ + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + rv = SECFailure; + goto fail; + } + length = length - taglen; + if (allocOut) { + /* + * If we used a temporary buffer, copy it out to the original + * buffer. + */ + PORT_Memcpy(saveOut, allocOut, length); + } + /* if the tag isn't in the right place, copy it out */ + if (tag != out + length) { + PORT_Memcpy(tag, out + length, taglen); + } + } + *outlen = length; + rv = SECSuccess; +fail: + if (allocOut) { + PORT_Free(allocOut); + } + return rv; +} + +/* + * Do an AEAD operation. This function optionally returns + * and IV on Encrypt for all mechanism. NSS knows which mechanisms + * generate IV's in the token and which don't. This allows the + * applications to make a single call without special handling for + * each AEAD mechanism (the special handling is all contained here. + */ +SECStatus +PK11_AEADOp(PK11Context *context, CK_GENERATOR_FUNCTION ivgen, + int fixedbits, unsigned char *iv, int ivlen, + const unsigned char *aad, int aadlen, + unsigned char *out, int *outlen, + int maxout, unsigned char *tag, int taglen, + const unsigned char *in, int inlen) +{ + CK_GCM_MESSAGE_PARAMS gcm_message; + CK_CCM_MESSAGE_PARAMS ccm_message; + CK_SALSA20_CHACHA20_POLY1305_MSG_PARAMS chacha_poly_message; + void *params; + int paramslen; + SECStatus rv; + + switch (context->simulate_mechanism) { + case CKM_CHACHA20_POLY1305: + case CKM_SALSA20_POLY1305: + case CKM_NSS_CHACHA20_POLY1305: + chacha_poly_message.pNonce = iv; + chacha_poly_message.ulNonceLen = ivlen; + chacha_poly_message.pTag = tag; + params = &chacha_poly_message; + paramslen = sizeof(CK_SALSA20_CHACHA20_POLY1305_MSG_PARAMS); + /* SALSA20_POLY1305 and CHACHA20_POLY1305 do not generate the iv + * internally, Do it here. */ + if (context->operation == (CKA_NSS_MESSAGE | CKA_ENCRYPT)) { + /* simulate generating the IV */ + rv = pk11_GenerateIV(context, ivgen, fixedbits, iv, ivlen); + if (rv != SECSuccess) { + return rv; + } + } + break; + case CKM_AES_GCM: + gcm_message.pIv = iv; + gcm_message.ulIvLen = ivlen; + gcm_message.ivGenerator = ivgen; + gcm_message.ulIvFixedBits = fixedbits; + gcm_message.pTag = tag; + gcm_message.ulTagBits = taglen * 8; + params = &gcm_message; + paramslen = sizeof(CK_GCM_MESSAGE_PARAMS); + /* GCM generates IV internally */ + break; + case CKM_AES_CCM: + ccm_message.ulDataLen = inlen; + ccm_message.pNonce = iv; + ccm_message.ulNonceLen = ivlen; + ccm_message.nonceGenerator = ivgen; + ccm_message.ulNonceFixedBits = fixedbits; + ccm_message.pMAC = tag; + ccm_message.ulMACLen = taglen; + params = &ccm_message; + paramslen = sizeof(CK_GCM_MESSAGE_PARAMS); + /* CCM generates IV internally */ + break; + + default: + PORT_SetError(SEC_ERROR_INVALID_ALGORITHM); + return SECFailure; + } + return PK11_AEADRawOp(context, params, paramslen, aad, aadlen, out, outlen, + maxout, in, inlen); +} + +/* Do and AED operation. The application builds the params on it's own + * and passes them in. This allows applications direct access to the params + * so they can use mechanisms not yet understood by, NSS, or get semantics + * not suppied by PK11_AEAD. */ +SECStatus +PK11_AEADRawOp(PK11Context *context, void *params, int paramslen, + const unsigned char *aad, int aadlen, + unsigned char *out, int *outlen, + int maxout, const unsigned char *in, int inlen) +{ + CK_RV crv = CKR_OK; + CK_ULONG length = maxout; + SECStatus rv = SECSuccess; + + PORT_Assert(outlen != NULL); + *outlen = 0; + if (((context->operation) & CKA_NSS_MESSAGE_MASK) != CKA_NSS_MESSAGE) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + /* + * The PKCS 11 module does not support the message interface, fall + * back to using single shot operation */ + if (context->simulate_message) { + return pk11_AEADSimulateOp(context, params, paramslen, aad, aadlen, + out, outlen, maxout, in, inlen); + } + + /* if we ran out of session, we need to restore our previously stored + * state. + */ + PK11_EnterContextMonitor(context); + if (!context->ownSession) { + rv = pk11_restoreContext(context, context->savedData, + context->savedLength); + if (rv != SECSuccess) { + PK11_ExitContextMonitor(context); + return rv; + } + } + + switch (context->operation) { + case CKA_NSS_MESSAGE | CKA_ENCRYPT: + length = maxout; + crv = PK11_GETTAB(context->slot)->C_EncryptMessage(context->session, params, paramslen, (CK_BYTE_PTR)aad, aadlen, (CK_BYTE_PTR)in, inlen, out, &length); + break; + case CKA_NSS_MESSAGE | CKA_DECRYPT: + length = maxout; + crv = PK11_GETTAB(context->slot)->C_DecryptMessage(context->session, params, paramslen, (CK_BYTE_PTR)aad, aadlen, (CK_BYTE_PTR)in, inlen, out, &length); + break; + case CKA_NSS_MESSAGE | CKA_SIGN: + length = maxout; + crv = PK11_GETTAB(context->slot)->C_SignMessage(context->session, params, paramslen, (CK_BYTE_PTR)in, inlen, out, &length); + break; + case CKA_NSS_MESSAGE | CKA_VERIFY: + length = maxout; /* sig length */ + crv = PK11_GETTAB(context->slot)->C_VerifyMessage(context->session, params, paramslen, (CK_BYTE_PTR)in, inlen, out /* sig */, length); + break; + default: + crv = CKR_OPERATION_NOT_INITIALIZED; + break; + } + + if (crv != CKR_OK) { + PORT_SetError(PK11_MapError(crv)); + rv = SECFailure; + } else { + *outlen = length; + } + + /* + * handle session starvation case.. use our last session to multiplex + */ + if (!context->ownSession) { + context->savedData = pk11_saveContext(context, context->savedData, + &context->savedLength); + if (context->savedData == NULL) + rv = SECFailure; + + /* clear out out session for others to use */ + pk11_Finalize(context); + } + PK11_ExitContextMonitor(context); + return rv; +} + +/* + * execute a digest/signature operation + */ +SECStatus +PK11_DigestOp(PK11Context *context, const unsigned char *in, unsigned inLen) +{ + CK_RV crv = CKR_OK; + SECStatus rv = SECSuccess; + + if (inLen == 0) { + return SECSuccess; + } + if (!in) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + /* if we ran out of session, we need to restore our previously stored + * state. + */ + context->init = PR_FALSE; + PK11_EnterContextMonitor(context); + if (!context->ownSession) { + rv = pk11_restoreContext(context, context->savedData, + context->savedLength); + if (rv != SECSuccess) { + PK11_ExitContextMonitor(context); + return rv; + } + } + + switch (context->operation) { + /* also for MAC'ing */ + case CKA_SIGN: + crv = PK11_GETTAB(context->slot)->C_SignUpdate(context->session, (unsigned char *)in, inLen); + break; + case CKA_VERIFY: + crv = PK11_GETTAB(context->slot)->C_VerifyUpdate(context->session, (unsigned char *)in, inLen); + break; + case CKA_DIGEST: + crv = PK11_GETTAB(context->slot)->C_DigestUpdate(context->session, (unsigned char *)in, inLen); + break; + default: + crv = CKR_OPERATION_NOT_INITIALIZED; + break; + } + + if (crv != CKR_OK) { + PORT_SetError(PK11_MapError(crv)); + rv = SECFailure; + } + + /* + * handle session starvation case.. use our last session to multiplex + */ + if (!context->ownSession) { + context->savedData = pk11_saveContext(context, context->savedData, + &context->savedLength); + if (context->savedData == NULL) + rv = SECFailure; + + /* clear out out session for others to use */ + pk11_Finalize(context); + } + PK11_ExitContextMonitor(context); + return rv; +} + +/* + * Digest a key if possible./ + */ +SECStatus +PK11_DigestKey(PK11Context *context, PK11SymKey *key) +{ + CK_RV crv = CKR_OK; + SECStatus rv = SECSuccess; + PK11SymKey *newKey = NULL; + + if (!context || !key) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + /* if we ran out of session, we need to restore our previously stored + * state. + */ + if (context->slot != key->slot) { + newKey = pk11_CopyToSlot(context->slot, CKM_SSL3_SHA1_MAC, CKA_SIGN, key); + } else { + newKey = PK11_ReferenceSymKey(key); + } + + context->init = PR_FALSE; + PK11_EnterContextMonitor(context); + if (!context->ownSession) { + rv = pk11_restoreContext(context, context->savedData, + context->savedLength); + if (rv != SECSuccess) { + PK11_ExitContextMonitor(context); + PK11_FreeSymKey(newKey); + return rv; + } + } + + if (newKey == NULL) { + crv = CKR_KEY_TYPE_INCONSISTENT; + if (key->data.data) { + crv = PK11_GETTAB(context->slot)->C_DigestUpdate(context->session, key->data.data, key->data.len); + } + } else { + crv = PK11_GETTAB(context->slot)->C_DigestKey(context->session, newKey->objectID); + } + + if (crv != CKR_OK) { + PORT_SetError(PK11_MapError(crv)); + rv = SECFailure; + } + + /* + * handle session starvation case.. use our last session to multiplex + */ + if (!context->ownSession) { + context->savedData = pk11_saveContext(context, context->savedData, + &context->savedLength); + if (context->savedData == NULL) + rv = SECFailure; + + /* clear out out session for others to use */ + pk11_Finalize(context); + } + PK11_ExitContextMonitor(context); + if (newKey) + PK11_FreeSymKey(newKey); + return rv; +} + +/* + * externally callable version of the lowercase pk11_finalize(). + */ +SECStatus +PK11_Finalize(PK11Context *context) +{ + SECStatus rv; + + PK11_EnterContextMonitor(context); + rv = pk11_Finalize(context); + PK11_ExitContextMonitor(context); + return rv; +} + +/* + * clean up a cipher operation, so the session can be used by + * someone new. + */ +SECStatus +pk11_Finalize(PK11Context *context) +{ + CK_ULONG count = 0; + CK_RV crv; + unsigned char stackBuf[256]; + unsigned char *buffer = NULL; + + if (!context->ownSession) { + return SECSuccess; + } + +finalize: + switch (context->operation) { + case CKA_ENCRYPT: + crv = PK11_GETTAB(context->slot)->C_EncryptFinal(context->session, buffer, &count); + break; + case CKA_DECRYPT: + crv = PK11_GETTAB(context->slot)->C_DecryptFinal(context->session, buffer, &count); + break; + case CKA_SIGN: + crv = PK11_GETTAB(context->slot)->C_SignFinal(context->session, buffer, &count); + break; + case CKA_VERIFY: + crv = PK11_GETTAB(context->slot)->C_VerifyFinal(context->session, buffer, count); + break; + case CKA_DIGEST: + crv = PK11_GETTAB(context->slot)->C_DigestFinal(context->session, buffer, &count); + break; + case CKA_NSS_MESSAGE | CKA_ENCRYPT: + crv = PK11_GETTAB(context->slot)->C_MessageEncryptFinal(context->session); + break; + case CKA_NSS_MESSAGE | CKA_DECRYPT: + crv = PK11_GETTAB(context->slot)->C_MessageDecryptFinal(context->session); + break; + case CKA_NSS_MESSAGE | CKA_SIGN: + crv = PK11_GETTAB(context->slot)->C_MessageSignFinal(context->session); + break; + case CKA_NSS_MESSAGE | CKA_VERIFY: + crv = PK11_GETTAB(context->slot)->C_MessageVerifyFinal(context->session); + break; + default: + crv = CKR_OPERATION_NOT_INITIALIZED; + break; + } + + if (crv != CKR_OK) { + if (buffer != stackBuf) { + PORT_Free(buffer); + } + if (crv == CKR_OPERATION_NOT_INITIALIZED) { + /* if there's no operation, it is finalized */ + return SECSuccess; + } + PORT_SetError(PK11_MapError(crv)); + return SECFailure; + } + + /* Message interface does not need to allocate a final buffer */ + if (((context->operation) & CKA_NSS_MESSAGE_MASK) == CKA_NSS_MESSAGE) { + return SECSuccess; + } + + /* try to finalize the session with a buffer */ + if (buffer == NULL) { + if (count <= sizeof stackBuf) { + buffer = stackBuf; + } else { + buffer = PORT_Alloc(count); + if (buffer == NULL) { + return SECFailure; + } + } + goto finalize; + } + if (buffer != stackBuf) { + PORT_Free(buffer); + } + return SECSuccess; +} + +/* + * Return the final digested or signed data... + * this routine can either take pre initialized data, or allocate data + * either out of an arena or out of the standard heap. + */ +SECStatus +PK11_DigestFinal(PK11Context *context, unsigned char *data, + unsigned int *outLen, unsigned int length) +{ + CK_ULONG len; + CK_RV crv; + SECStatus rv; + + /* message interface returns no data on Final, Should not use DigestFinal + * in this case */ + if (((context->operation) & CKA_NSS_MESSAGE_MASK) == CKA_NSS_MESSAGE) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + /* if we ran out of session, we need to restore our previously stored + * state. + */ + PK11_EnterContextMonitor(context); + if (!context->ownSession) { + rv = pk11_restoreContext(context, context->savedData, + context->savedLength); + if (rv != SECSuccess) { + PK11_ExitContextMonitor(context); + return rv; + } + } + + len = length; + switch (context->operation) { + case CKA_SIGN: + crv = PK11_GETTAB(context->slot)->C_SignFinal(context->session, data, &len); + break; + case CKA_VERIFY: + crv = PK11_GETTAB(context->slot)->C_VerifyFinal(context->session, data, len); + break; + case CKA_DIGEST: + crv = PK11_GETTAB(context->slot)->C_DigestFinal(context->session, data, &len); + break; + case CKA_ENCRYPT: + crv = PK11_GETTAB(context->slot)->C_EncryptFinal(context->session, data, &len); + break; + case CKA_DECRYPT: + crv = PK11_GETTAB(context->slot)->C_DecryptFinal(context->session, data, &len); + break; + default: + crv = CKR_OPERATION_NOT_INITIALIZED; + break; + } + PK11_ExitContextMonitor(context); + + context->init = PR_FALSE; /* allow Begin to start up again */ + + if (crv != CKR_OK) { + PORT_SetError(PK11_MapError(crv)); + return SECFailure; + } + *outLen = (unsigned int)len; + return SECSuccess; +} + +PRBool +PK11_ContextGetFIPSStatus(PK11Context *context) +{ + if (context->slot == NULL) { + return PR_FALSE; + } + return pk11slot_GetFIPSStatus(context->slot, context->session, + CK_INVALID_HANDLE, context->init ? CKT_NSS_SESSION_CHECK : CKT_NSS_SESSION_LAST_CHECK); +} |