1 /* crypto/engine/hw_pkcs11.c */
2 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
3 * project 2000.
4 * Copied/modified by Kevin Stefanik (kstef@mtppi.org) for the OpenSC
5 * project 2003.
6 */
7 /* ====================================================================
8 * Copyright (c) 1999-2001 The OpenSSL Project. All rights reserved.
9 * Portions Copyright (c) 2003 Kevin Stefanik (kstef@mtppi.org)
10 * Portions Copyright (C) 2013 Texas Instruments Incorporated - http://www.ti.com/
11 *
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
14 * are met:
15 *
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 *
19 * 2. Redistributions in binary form must reproduce the above copyright
20 * notice, this list of conditions and the following disclaimer in
21 * the documentation and/or other materials provided with the
22 * distribution.
23 *
24 * 3. All advertising materials mentioning features or use of this
25 * software must display the following acknowledgment:
26 * "This product includes software developed by the OpenSSL Project
27 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
28 *
29 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
30 * endorse or promote products derived from this software without
31 * prior written permission. For written permission, please contact
32 * licensing@OpenSSL.org.
33 *
34 * 5. Products derived from this software may not be called "OpenSSL"
35 * nor may "OpenSSL" appear in their names without prior written
36 * permission of the OpenSSL Project.
37 *
38 * 6. Redistributions of any form whatsoever must retain the following
39 * acknowledgment:
40 * "This product includes software developed by the OpenSSL Project
41 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
42 *
43 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
44 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
45 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
46 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
47 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
48 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
49 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
50 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
51 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
52 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
53 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
54 * OF THE POSSIBILITY OF SUCH DAMAGE.
55 * ====================================================================
56 *
57 * This product includes cryptographic software written by Eric Young
58 * (eay@cryptsoft.com). This product includes software written by Tim
59 * Hudson (tjh@cryptsoft.com).
60 *
61 */
63 /*****************************************************************************
64 ChangeLog (01/04/2013):
65 Added following new functionalities
66 - API to list objects on the token
67 - API to store certificate to token
68 - API to generate & store RSA key pair to token
69 - API to get RSA public key from token
70 - API to Delete object from token
71 *****************************************************************************/
73 #include <config.h>
74 #include <stdio.h>
75 #include <string.h>
76 #include <openssl/crypto.h>
77 #include <openssl/objects.h>
78 #include <openssl/engine.h>
79 #include <openssl/dso.h>
80 #ifndef ENGINE_CMD_BASE
81 #error did not get engine.h
82 #endif
83 #include <libp11.h>
84 #include "engine_pkcs11.h"
86 #define PKCS11_ENGINE_ID "pkcs11"
87 #define PKCS11_ENGINE_NAME "pkcs11 engine"
89 #define CMD_SO_PATH ENGINE_CMD_BASE
90 #define CMD_MODULE_PATH (ENGINE_CMD_BASE+1)
91 #define CMD_PIN (ENGINE_CMD_BASE+2)
92 #define CMD_VERBOSE (ENGINE_CMD_BASE+3)
93 #define CMD_QUIET (ENGINE_CMD_BASE+4)
94 #define CMD_LOAD_CERT_CTRL (ENGINE_CMD_BASE+5)
95 #define CMD_INIT_ARGS (ENGINE_CMD_BASE+6)
96 #define CMD_LIST_OBJS (ENGINE_CMD_BASE+7)
97 #define CMD_STORE_CERT (ENGINE_CMD_BASE+8)
98 #define CMD_STORE_CERT_CTRL (ENGINE_CMD_BASE+9)
99 #define CMD_GEN_KEY (ENGINE_CMD_BASE+10)
100 #define CMD_DEL_OBJ (ENGINE_CMD_BASE+11)
101 #define CMD_GET_PUBKEY (ENGINE_CMD_BASE+12)
102 #define CMD_ENUMERATE_CERTS_CTRL (ENGINE_CMD_BASE+13)
104 static int pkcs11_engine_destroy(ENGINE * e);
105 static int pkcs11_engine_ctrl(ENGINE * e, int cmd, long i, void *p,
106 void (*f) ());
108 /* The definitions for control commands specific to this engine */
110 /* need to add function to pass in reader id? or user reader:key as key id string? */
112 static const ENGINE_CMD_DEFN pkcs11_cmd_defns[] = {
113 {CMD_SO_PATH,
114 "SO_PATH",
115 "Specifies the path to the 'pkcs11-engine' shared library",
116 ENGINE_CMD_FLAG_STRING},
117 {CMD_MODULE_PATH,
118 "MODULE_PATH",
119 "Specifies the path to the pkcs11 module shared library",
120 ENGINE_CMD_FLAG_STRING},
121 {CMD_PIN,
122 "PIN",
123 "Specifies the pin code",
124 ENGINE_CMD_FLAG_STRING},
125 {CMD_VERBOSE,
126 "VERBOSE",
127 "Print additional details",
128 ENGINE_CMD_FLAG_NO_INPUT},
129 {CMD_QUIET,
130 "QUIET",
131 "Remove additional details",
132 ENGINE_CMD_FLAG_NO_INPUT},
133 {CMD_LOAD_CERT_CTRL,
134 "LOAD_CERT_CTRL",
135 "Get the certificate from token",
136 ENGINE_CMD_FLAG_INTERNAL},
137 {CMD_INIT_ARGS,
138 "INIT_ARGS",
139 "Specifies additional initialization arguments to the pkcs11 module",
140 ENGINE_CMD_FLAG_STRING},
141 {CMD_LIST_OBJS,
142 "LIST_OBJS",
143 "List the objects from token",
144 ENGINE_CMD_FLAG_NUMERIC},
145 {CMD_STORE_CERT,
146 "STORE_CERT",
147 "Store X.509 certificate to token",
148 ENGINE_CMD_FLAG_STRING},
149 {CMD_STORE_CERT_CTRL,
150 "STORE_CERT_CTRL",
151 "Store X.509 certificate to token",
152 ENGINE_CMD_FLAG_INTERNAL},
153 {CMD_GEN_KEY,
154 "GEN_KEY",
155 "Generate & store RSA key pair to token",
156 ENGINE_CMD_FLAG_STRING},
157 {CMD_DEL_OBJ,
158 "DEL_OBJ",
159 "Delete objects from token",
160 ENGINE_CMD_FLAG_STRING},
161 {CMD_GET_PUBKEY,
162 "GET_PUBKEY",
163 "Get Public Key from token",
164 ENGINE_CMD_FLAG_STRING},
165 {CMD_ENUMERATE_CERTS_CTRL,
166 "ENUMERATE_CERTS_CTRL",
167 "Get all certificates from a token",
168 ENGINE_CMD_FLAG_INTERNAL},
169 {0, NULL, NULL, 0}
170 };
172 /* Destructor */
173 static int pkcs11_engine_destroy(ENGINE * e)
174 {
175 return 1;
176 }
178 static int pkcs11_engine_ctrl(ENGINE * e, int cmd, long i, void *p,
179 void (*f) ())
180 {
181 /*int initialised = ((pkcs11_dso == NULL) ? 0 : 1); */
182 switch (cmd) {
183 case CMD_MODULE_PATH:
184 return set_module((const char *)p);
185 case CMD_PIN:
186 return set_pin((const char *)p);
187 case CMD_VERBOSE:
188 return inc_verbose();
189 case CMD_LOAD_CERT_CTRL:
190 return load_cert_ctrl(e, p);
191 case CMD_INIT_ARGS:
192 return set_init_args((const char *)p);
193 case CMD_LIST_OBJS:
194 return list_token_objects(e, i);
195 case CMD_STORE_CERT:
196 return store_cert_cmd(e, (const char *)p);
197 case CMD_STORE_CERT_CTRL:
198 return store_cert_ctrl(e, p);
199 case CMD_GEN_KEY:
200 return gen_key_cmd(e, (const char *)p);
201 case CMD_DEL_OBJ:
202 return del_obj_cmd(e, (const char *)p);
203 case CMD_GET_PUBKEY:
204 return get_pubkey_cmd(e, (const char *)p);
205 case CMD_ENUMERATE_CERTS_CTRL:
206 return enumerate_certs_ctrl(e, p);
207 default:
208 break;
209 }
210 return 0;
211 }
213 #if 0
214 /* set up default rsa_meth_st with overloaded rsa functions */
215 /* the actual implementation needs to be in another object */
217 static int (*orig_finish) (RSA * rsa);
219 static int pkcs11_engine_rsa_finish(RSA * rsa)
220 {
222 pkcs11_rsa_finish(rsa);
224 if (orig_finish)
225 orig_finish(rsa);
226 return 1;
228 }
229 #endif
231 /* This internal function is used by ENGINE_pkcs11() and possibly by the
232 * "dynamic" ENGINE support too */
233 static int bind_helper(ENGINE * e)
234 {
235 if (!ENGINE_set_id(e, PKCS11_ENGINE_ID) ||
236 !ENGINE_set_destroy_function(e, pkcs11_engine_destroy) ||
237 !ENGINE_set_init_function(e, pkcs11_init) ||
238 !ENGINE_set_finish_function(e, pkcs11_finish) ||
239 !ENGINE_set_ctrl_function(e, pkcs11_engine_ctrl) ||
240 !ENGINE_set_cmd_defns(e, pkcs11_cmd_defns) ||
241 !ENGINE_set_name(e, PKCS11_ENGINE_NAME) ||
242 #ifndef OPENSSL_NO_RSA
243 !ENGINE_set_RSA(e, PKCS11_get_rsa_method()) ||
244 #endif
245 #ifndef OPENSSL_NO_DSA
246 !ENGINE_set_DSA(e, DSA_get_default_method()) ||
247 #endif
248 #ifndef OPENSSL_NO_DH
249 !ENGINE_set_DH(e, DH_get_default_method()) ||
250 #endif
251 !ENGINE_set_RAND(e, RAND_SSLeay()) ||
252 #if 0
253 !ENGINE_set_BN_mod_exp(e, BN_mod_exp) ||
254 #endif
255 !ENGINE_set_load_pubkey_function(e, pkcs11_load_public_key) ||
256 !ENGINE_set_load_privkey_function(e, pkcs11_load_private_key)) {
257 return 0;
258 } else {
259 return 1;
260 }
261 }
263 static int bind_fn(ENGINE * e, const char *id)
264 {
265 if (id && (strcmp(id, PKCS11_ENGINE_ID) != 0)) {
266 fprintf(stderr, "bad engine id\n");
267 return 0;
268 }
269 if (!bind_helper(e)) {
270 fprintf(stderr, "bind failed\n");
271 return 0;
272 }
273 return 1;
274 }
276 IMPLEMENT_DYNAMIC_CHECK_FN();
277 IMPLEMENT_DYNAMIC_BIND_FN(bind_fn);