2021-12-07 02:07:57 +03:00
|
|
|
/**
|
|
|
|
* WinPR: Windows Portable Runtime
|
|
|
|
* NCrypt pkcs11 provider
|
|
|
|
*
|
|
|
|
* Copyright 2021 David Fort <contact@hardening-consulting.com>
|
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
2022-04-28 00:26:28 +03:00
|
|
|
|
|
|
|
#include <stdlib.h>
|
2021-12-07 02:07:57 +03:00
|
|
|
#include <pkcs11-helper-1.0/pkcs11.h>
|
|
|
|
|
|
|
|
#include <winpr/library.h>
|
2022-02-14 15:05:59 +03:00
|
|
|
#include <winpr/assert.h>
|
|
|
|
#include <winpr/spec.h>
|
2022-10-16 18:36:20 +03:00
|
|
|
#include <winpr/smartcard.h>
|
|
|
|
#include <winpr/asn1.h>
|
2021-12-07 02:07:57 +03:00
|
|
|
|
|
|
|
#include "../log.h"
|
|
|
|
#include "ncrypt.h"
|
|
|
|
|
|
|
|
#define TAG WINPR_TAG("ncryptp11")
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
#define MAX_SLOTS 64
|
2022-07-21 18:43:50 +03:00
|
|
|
#define MAX_KEYS 64
|
2022-02-14 15:05:59 +03:00
|
|
|
#define MAX_KEYS_PER_SLOT 64
|
2021-12-07 02:07:57 +03:00
|
|
|
|
|
|
|
/** @brief ncrypt provider handle */
|
|
|
|
typedef struct
|
|
|
|
{
|
|
|
|
NCryptBaseProvider baseProvider;
|
|
|
|
|
|
|
|
HANDLE library;
|
|
|
|
CK_FUNCTION_LIST_PTR p11;
|
|
|
|
} NCryptP11ProviderHandle;
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
/** @brief a handle returned by NCryptOpenKey */
|
|
|
|
typedef struct
|
2021-12-07 02:07:57 +03:00
|
|
|
{
|
2022-02-14 15:05:59 +03:00
|
|
|
NCryptBaseHandle base;
|
|
|
|
NCryptP11ProviderHandle* provider;
|
|
|
|
CK_SLOT_ID slotId;
|
|
|
|
CK_BYTE keyCertId[64];
|
|
|
|
CK_ULONG keyCertIdLen;
|
|
|
|
} NCryptP11KeyHandle;
|
2021-12-07 02:07:57 +03:00
|
|
|
|
|
|
|
typedef struct
|
|
|
|
{
|
|
|
|
CK_SLOT_ID slotId;
|
|
|
|
CK_SLOT_INFO slotInfo;
|
|
|
|
CK_KEY_TYPE keyType;
|
|
|
|
CK_CHAR keyLabel[256];
|
|
|
|
CK_ULONG idLen;
|
|
|
|
CK_BYTE id[64];
|
2022-07-21 18:43:50 +03:00
|
|
|
} NCryptKeyEnum;
|
2021-12-07 02:07:57 +03:00
|
|
|
|
|
|
|
typedef struct
|
|
|
|
{
|
|
|
|
CK_ULONG nslots;
|
|
|
|
CK_SLOT_ID slots[MAX_SLOTS];
|
2022-07-21 18:43:50 +03:00
|
|
|
CK_ULONG nKeys;
|
|
|
|
NCryptKeyEnum keys[MAX_KEYS];
|
|
|
|
CK_ULONG keyIndex;
|
2021-12-07 02:07:57 +03:00
|
|
|
} P11EnumKeysState;
|
|
|
|
|
2022-11-14 13:10:55 +03:00
|
|
|
typedef struct
|
2022-10-16 18:36:20 +03:00
|
|
|
{
|
|
|
|
const char* label;
|
|
|
|
BYTE tag[3];
|
2022-11-14 13:10:55 +03:00
|
|
|
} piv_cert_tags_t;
|
|
|
|
static const piv_cert_tags_t piv_cert_tags[] = {
|
2022-10-16 18:36:20 +03:00
|
|
|
{ "Certificate for PIV Authentication", "\x5F\xC1\x05" },
|
|
|
|
{ "Certificate for Digital Signature", "\x5F\xC1\x0A" },
|
|
|
|
{ "Certificate for Key Management", "\x5F\xC1\x0B" },
|
|
|
|
{ "Certificate for Card Authentication", "\x5F\xC1\x01" },
|
|
|
|
};
|
|
|
|
|
2022-11-21 10:20:53 +03:00
|
|
|
static const BYTE APDU_PIV_SELECT_AID[] = { 0x00, 0xA4, 0x04, 0x00, 0x09, 0xA0, 0x00, 0x00,
|
|
|
|
0x03, 0x08, 0x00, 0x00, 0x10, 0x00, 0x00 };
|
|
|
|
static const BYTE APDU_PIV_GET_CHUID[] = { 0x00, 0xCB, 0x3F, 0xFF, 0x05, 0x5C,
|
|
|
|
0x03, 0x5F, 0xC1, 0x02, 0x00 };
|
2022-10-16 18:36:20 +03:00
|
|
|
#define PIV_CONTAINER_NAME_LEN 36
|
|
|
|
|
2022-07-21 18:43:50 +03:00
|
|
|
static CK_OBJECT_CLASS object_class_public_key = CKO_PUBLIC_KEY;
|
|
|
|
static CK_BBOOL object_verify = CK_TRUE;
|
2021-12-07 02:07:57 +03:00
|
|
|
static CK_KEY_TYPE object_ktype_rsa = CKK_RSA;
|
|
|
|
|
2022-07-21 18:43:50 +03:00
|
|
|
static CK_ATTRIBUTE public_key_filter[] = {
|
|
|
|
{ CKA_CLASS, &object_class_public_key, sizeof(object_class_public_key) },
|
|
|
|
{ CKA_VERIFY, &object_verify, sizeof(object_verify) },
|
2021-12-07 02:07:57 +03:00
|
|
|
{ CKA_KEY_TYPE, &object_ktype_rsa, sizeof(object_ktype_rsa) }
|
|
|
|
};
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
static SECURITY_STATUS NCryptP11StorageProvider_dtor(NCRYPT_HANDLE handle)
|
|
|
|
{
|
|
|
|
NCryptP11ProviderHandle* provider = (NCryptP11ProviderHandle*)handle;
|
|
|
|
CK_RV rv;
|
|
|
|
|
|
|
|
WINPR_ASSERT(provider);
|
|
|
|
rv = provider->p11->C_Finalize(NULL);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
|
|
|
if (provider->library)
|
|
|
|
FreeLibrary(provider->library);
|
|
|
|
|
2022-02-14 15:36:14 +03:00
|
|
|
return winpr_NCryptDefault_dtor(handle);
|
2022-02-14 15:05:59 +03:00
|
|
|
}
|
2022-01-10 17:27:10 +03:00
|
|
|
|
2022-06-23 08:57:38 +03:00
|
|
|
static void fix_padded_string(char* str, size_t maxlen)
|
2021-12-07 02:07:57 +03:00
|
|
|
{
|
2022-01-27 14:04:52 +03:00
|
|
|
char* ptr = str + maxlen - 1;
|
2021-12-07 02:07:57 +03:00
|
|
|
|
2022-01-10 17:27:10 +03:00
|
|
|
while (ptr > str && *ptr == ' ')
|
|
|
|
ptr--;
|
|
|
|
ptr++;
|
|
|
|
*ptr = 0;
|
2021-12-07 02:07:57 +03:00
|
|
|
}
|
2022-01-10 17:27:10 +03:00
|
|
|
|
2021-12-07 02:07:57 +03:00
|
|
|
static BOOL attributes_have_unallocated_buffers(CK_ATTRIBUTE_PTR attributes, CK_ULONG count)
|
|
|
|
{
|
|
|
|
CK_ULONG i;
|
|
|
|
|
|
|
|
for (i = 0; i < count; i++)
|
|
|
|
{
|
|
|
|
if (!attributes[i].pValue && (attributes[i].ulValueLen != CK_UNAVAILABLE_INFORMATION))
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
static BOOL attribute_allocate_attribute_array(CK_ATTRIBUTE_PTR attribute)
|
|
|
|
{
|
|
|
|
attribute->pValue = calloc(attribute->ulValueLen, sizeof(void*));
|
|
|
|
return !!attribute->pValue;
|
|
|
|
}
|
|
|
|
|
|
|
|
static BOOL attribute_allocate_ulong_array(CK_ATTRIBUTE_PTR attribute)
|
|
|
|
{
|
|
|
|
attribute->pValue = calloc(attribute->ulValueLen, sizeof(CK_ULONG));
|
|
|
|
return !!attribute->pValue;
|
|
|
|
}
|
|
|
|
|
|
|
|
static BOOL attribute_allocate_buffer(CK_ATTRIBUTE_PTR attribute)
|
|
|
|
{
|
|
|
|
attribute->pValue = calloc(attribute->ulValueLen, 1);
|
|
|
|
return !!attribute->pValue;
|
|
|
|
}
|
|
|
|
|
|
|
|
static BOOL attributes_allocate_buffers(CK_ATTRIBUTE_PTR attributes, CK_ULONG count)
|
|
|
|
{
|
|
|
|
CK_ULONG i;
|
|
|
|
BOOL ret = TRUE;
|
|
|
|
|
|
|
|
for (i = 0; i < count; i++)
|
|
|
|
{
|
|
|
|
if (attributes[i].pValue || (attributes[i].ulValueLen == CK_UNAVAILABLE_INFORMATION))
|
|
|
|
continue;
|
|
|
|
|
|
|
|
switch (attributes[i].type)
|
|
|
|
{
|
|
|
|
case CKA_WRAP_TEMPLATE:
|
|
|
|
case CKA_UNWRAP_TEMPLATE:
|
|
|
|
ret &= attribute_allocate_attribute_array(&attributes[i]);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case CKA_ALLOWED_MECHANISMS:
|
|
|
|
ret &= attribute_allocate_ulong_array(&attributes[i]);
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
ret &= attribute_allocate_buffer(&attributes[i]);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
static CK_RV object_load_attributes(NCryptP11ProviderHandle* provider, CK_SESSION_HANDLE session,
|
|
|
|
CK_OBJECT_HANDLE object, CK_ATTRIBUTE_PTR attributes,
|
|
|
|
CK_ULONG count)
|
2021-12-07 02:07:57 +03:00
|
|
|
{
|
2022-02-14 15:05:59 +03:00
|
|
|
CK_RV rv;
|
|
|
|
|
|
|
|
WINPR_ASSERT(provider);
|
|
|
|
WINPR_ASSERT(provider->p11);
|
|
|
|
WINPR_ASSERT(provider->p11->C_GetAttributeValue);
|
|
|
|
|
|
|
|
rv = provider->p11->C_GetAttributeValue(session, object, attributes, count);
|
2021-12-07 02:07:57 +03:00
|
|
|
|
|
|
|
switch (rv)
|
|
|
|
{
|
|
|
|
case CKR_OK:
|
|
|
|
if (!attributes_have_unallocated_buffers(attributes, count))
|
|
|
|
return rv;
|
2022-11-22 20:52:38 +03:00
|
|
|
/* fallthrough */
|
2021-12-07 02:07:57 +03:00
|
|
|
case CKR_ATTRIBUTE_SENSITIVE:
|
|
|
|
case CKR_ATTRIBUTE_TYPE_INVALID:
|
|
|
|
case CKR_BUFFER_TOO_SMALL:
|
|
|
|
/* attributes need some buffers for the result value */
|
|
|
|
if (!attributes_allocate_buffers(attributes, count))
|
|
|
|
return CKR_HOST_MEMORY;
|
|
|
|
|
|
|
|
rv = provider->p11->C_GetAttributeValue(session, object, attributes, count);
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
|
|
|
|
switch (rv)
|
|
|
|
{
|
|
|
|
case CKR_ATTRIBUTE_SENSITIVE:
|
|
|
|
case CKR_ATTRIBUTE_TYPE_INVALID:
|
|
|
|
case CKR_BUFFER_TOO_SMALL:
|
|
|
|
WLog_ERR(TAG, "C_GetAttributeValue return %d even after buffer allocation", rv);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
return rv;
|
|
|
|
}
|
|
|
|
|
2022-05-06 09:21:29 +03:00
|
|
|
static const char* CK_RV_error_string(CK_RV rv)
|
|
|
|
{
|
|
|
|
static char generic_buffer[200];
|
2022-06-23 08:57:38 +03:00
|
|
|
#define ERR_ENTRY(X) \
|
|
|
|
case X: \
|
|
|
|
return #X
|
2022-05-06 09:21:29 +03:00
|
|
|
|
|
|
|
switch (rv)
|
|
|
|
{
|
2022-06-23 08:57:38 +03:00
|
|
|
ERR_ENTRY(CKR_OK);
|
|
|
|
ERR_ENTRY(CKR_CANCEL);
|
|
|
|
ERR_ENTRY(CKR_HOST_MEMORY);
|
|
|
|
ERR_ENTRY(CKR_SLOT_ID_INVALID);
|
|
|
|
ERR_ENTRY(CKR_GENERAL_ERROR);
|
|
|
|
ERR_ENTRY(CKR_FUNCTION_FAILED);
|
|
|
|
ERR_ENTRY(CKR_ARGUMENTS_BAD);
|
|
|
|
ERR_ENTRY(CKR_NO_EVENT);
|
|
|
|
ERR_ENTRY(CKR_NEED_TO_CREATE_THREADS);
|
|
|
|
ERR_ENTRY(CKR_CANT_LOCK);
|
|
|
|
ERR_ENTRY(CKR_ATTRIBUTE_READ_ONLY);
|
|
|
|
ERR_ENTRY(CKR_ATTRIBUTE_SENSITIVE);
|
|
|
|
ERR_ENTRY(CKR_ATTRIBUTE_TYPE_INVALID);
|
|
|
|
ERR_ENTRY(CKR_ATTRIBUTE_VALUE_INVALID);
|
|
|
|
ERR_ENTRY(CKR_DATA_INVALID);
|
|
|
|
ERR_ENTRY(CKR_DATA_LEN_RANGE);
|
|
|
|
ERR_ENTRY(CKR_DEVICE_ERROR);
|
|
|
|
ERR_ENTRY(CKR_DEVICE_MEMORY);
|
|
|
|
ERR_ENTRY(CKR_DEVICE_REMOVED);
|
|
|
|
ERR_ENTRY(CKR_ENCRYPTED_DATA_INVALID);
|
|
|
|
ERR_ENTRY(CKR_ENCRYPTED_DATA_LEN_RANGE);
|
|
|
|
ERR_ENTRY(CKR_FUNCTION_CANCELED);
|
|
|
|
ERR_ENTRY(CKR_FUNCTION_NOT_PARALLEL);
|
|
|
|
ERR_ENTRY(CKR_FUNCTION_NOT_SUPPORTED);
|
|
|
|
ERR_ENTRY(CKR_KEY_HANDLE_INVALID);
|
|
|
|
ERR_ENTRY(CKR_KEY_SIZE_RANGE);
|
|
|
|
ERR_ENTRY(CKR_KEY_TYPE_INCONSISTENT);
|
|
|
|
ERR_ENTRY(CKR_KEY_NOT_NEEDED);
|
|
|
|
ERR_ENTRY(CKR_KEY_CHANGED);
|
|
|
|
ERR_ENTRY(CKR_KEY_NEEDED);
|
|
|
|
ERR_ENTRY(CKR_KEY_INDIGESTIBLE);
|
|
|
|
ERR_ENTRY(CKR_KEY_FUNCTION_NOT_PERMITTED);
|
|
|
|
ERR_ENTRY(CKR_KEY_NOT_WRAPPABLE);
|
|
|
|
ERR_ENTRY(CKR_KEY_UNEXTRACTABLE);
|
|
|
|
ERR_ENTRY(CKR_MECHANISM_INVALID);
|
|
|
|
ERR_ENTRY(CKR_MECHANISM_PARAM_INVALID);
|
|
|
|
ERR_ENTRY(CKR_OBJECT_HANDLE_INVALID);
|
|
|
|
ERR_ENTRY(CKR_OPERATION_ACTIVE);
|
|
|
|
ERR_ENTRY(CKR_OPERATION_NOT_INITIALIZED);
|
|
|
|
ERR_ENTRY(CKR_PIN_INCORRECT);
|
|
|
|
ERR_ENTRY(CKR_PIN_INVALID);
|
|
|
|
ERR_ENTRY(CKR_PIN_LEN_RANGE);
|
|
|
|
ERR_ENTRY(CKR_PIN_EXPIRED);
|
|
|
|
ERR_ENTRY(CKR_PIN_LOCKED);
|
|
|
|
ERR_ENTRY(CKR_SESSION_CLOSED);
|
|
|
|
ERR_ENTRY(CKR_SESSION_COUNT);
|
|
|
|
ERR_ENTRY(CKR_SESSION_HANDLE_INVALID);
|
|
|
|
ERR_ENTRY(CKR_SESSION_PARALLEL_NOT_SUPPORTED);
|
|
|
|
ERR_ENTRY(CKR_SESSION_READ_ONLY);
|
|
|
|
ERR_ENTRY(CKR_SESSION_EXISTS);
|
|
|
|
ERR_ENTRY(CKR_SESSION_READ_ONLY_EXISTS);
|
|
|
|
ERR_ENTRY(CKR_SESSION_READ_WRITE_SO_EXISTS);
|
|
|
|
ERR_ENTRY(CKR_SIGNATURE_INVALID);
|
|
|
|
ERR_ENTRY(CKR_SIGNATURE_LEN_RANGE);
|
|
|
|
ERR_ENTRY(CKR_TEMPLATE_INCOMPLETE);
|
|
|
|
ERR_ENTRY(CKR_TEMPLATE_INCONSISTENT);
|
|
|
|
ERR_ENTRY(CKR_TOKEN_NOT_PRESENT);
|
|
|
|
ERR_ENTRY(CKR_TOKEN_NOT_RECOGNIZED);
|
|
|
|
ERR_ENTRY(CKR_TOKEN_WRITE_PROTECTED);
|
|
|
|
ERR_ENTRY(CKR_UNWRAPPING_KEY_HANDLE_INVALID);
|
|
|
|
ERR_ENTRY(CKR_UNWRAPPING_KEY_SIZE_RANGE);
|
|
|
|
ERR_ENTRY(CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT);
|
|
|
|
ERR_ENTRY(CKR_USER_ALREADY_LOGGED_IN);
|
|
|
|
ERR_ENTRY(CKR_USER_NOT_LOGGED_IN);
|
|
|
|
ERR_ENTRY(CKR_USER_PIN_NOT_INITIALIZED);
|
|
|
|
ERR_ENTRY(CKR_USER_TYPE_INVALID);
|
|
|
|
ERR_ENTRY(CKR_USER_ANOTHER_ALREADY_LOGGED_IN);
|
|
|
|
ERR_ENTRY(CKR_USER_TOO_MANY_TYPES);
|
|
|
|
ERR_ENTRY(CKR_WRAPPED_KEY_INVALID);
|
|
|
|
ERR_ENTRY(CKR_WRAPPED_KEY_LEN_RANGE);
|
|
|
|
ERR_ENTRY(CKR_WRAPPING_KEY_HANDLE_INVALID);
|
|
|
|
ERR_ENTRY(CKR_WRAPPING_KEY_SIZE_RANGE);
|
|
|
|
ERR_ENTRY(CKR_WRAPPING_KEY_TYPE_INCONSISTENT);
|
|
|
|
ERR_ENTRY(CKR_RANDOM_SEED_NOT_SUPPORTED);
|
|
|
|
ERR_ENTRY(CKR_RANDOM_NO_RNG);
|
|
|
|
ERR_ENTRY(CKR_DOMAIN_PARAMS_INVALID);
|
|
|
|
ERR_ENTRY(CKR_BUFFER_TOO_SMALL);
|
|
|
|
ERR_ENTRY(CKR_SAVED_STATE_INVALID);
|
|
|
|
ERR_ENTRY(CKR_INFORMATION_SENSITIVE);
|
|
|
|
ERR_ENTRY(CKR_STATE_UNSAVEABLE);
|
|
|
|
ERR_ENTRY(CKR_CRYPTOKI_NOT_INITIALIZED);
|
|
|
|
ERR_ENTRY(CKR_CRYPTOKI_ALREADY_INITIALIZED);
|
|
|
|
ERR_ENTRY(CKR_MUTEX_BAD);
|
|
|
|
ERR_ENTRY(CKR_MUTEX_NOT_LOCKED);
|
|
|
|
ERR_ENTRY(CKR_FUNCTION_REJECTED);
|
|
|
|
default:
|
|
|
|
snprintf(generic_buffer, sizeof(generic_buffer), "unknown 0x%lx", rv);
|
|
|
|
return generic_buffer;
|
2022-05-06 09:21:29 +03:00
|
|
|
}
|
|
|
|
#undef ERR_ENTRY
|
|
|
|
}
|
|
|
|
|
2022-07-21 18:43:50 +03:00
|
|
|
static SECURITY_STATUS collect_keys(NCryptP11ProviderHandle* provider, P11EnumKeysState* state)
|
2021-12-07 02:07:57 +03:00
|
|
|
{
|
2022-02-14 15:05:59 +03:00
|
|
|
CK_OBJECT_HANDLE slotObjects[MAX_KEYS_PER_SLOT] = { 0 };
|
2021-12-07 02:07:57 +03:00
|
|
|
const char* step = NULL;
|
2022-02-14 15:05:59 +03:00
|
|
|
|
|
|
|
WINPR_ASSERT(provider);
|
|
|
|
|
2023-06-07 10:31:18 +03:00
|
|
|
CK_FUNCTION_LIST_PTR p11 = provider->p11;
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(p11);
|
2021-12-07 02:07:57 +03:00
|
|
|
|
2023-06-07 10:31:18 +03:00
|
|
|
WLog_DBG(TAG, "checking %" PRIu32 " slots for valid keys...", state->nslots);
|
2022-07-21 18:43:50 +03:00
|
|
|
state->nKeys = 0;
|
2023-06-07 10:31:18 +03:00
|
|
|
for (CK_ULONG i = 0; i < state->nslots; i++)
|
2021-12-07 02:07:57 +03:00
|
|
|
{
|
2022-05-06 15:39:40 +03:00
|
|
|
CK_SESSION_HANDLE session = (CK_SESSION_HANDLE)NULL;
|
2023-06-07 10:31:18 +03:00
|
|
|
CK_SLOT_INFO slotInfo = { 0 };
|
|
|
|
CK_TOKEN_INFO tokenInfo = { 0 };
|
2021-12-07 02:07:57 +03:00
|
|
|
|
2022-03-03 00:00:01 +03:00
|
|
|
WINPR_ASSERT(p11->C_GetSlotInfo);
|
2023-06-07 10:31:18 +03:00
|
|
|
CK_RV rv = p11->C_GetSlotInfo(state->slots[i], &slotInfo);
|
2021-12-07 02:07:57 +03:00
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
WLog_ERR(TAG, "unable to retrieve information for slot #%d(%d)", i, state->slots[i]);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2022-06-23 08:57:38 +03:00
|
|
|
fix_padded_string((char*)slotInfo.slotDescription, sizeof(slotInfo.slotDescription));
|
2023-01-23 14:03:18 +03:00
|
|
|
WLog_DBG(TAG, "collecting keys for slot #%d(%lu) descr='%s' flags=0x%x", i, state->slots[i],
|
|
|
|
slotInfo.slotDescription, slotInfo.flags);
|
2022-05-06 09:21:29 +03:00
|
|
|
|
2022-06-23 08:57:38 +03:00
|
|
|
/* this is a safety guard as we're supposed to have listed only readers with tokens in them
|
|
|
|
*/
|
2022-05-06 09:21:29 +03:00
|
|
|
if (!(slotInfo.flags & CKF_TOKEN_PRESENT))
|
|
|
|
{
|
2022-05-06 15:39:40 +03:00
|
|
|
WLog_INFO(TAG, "token not present for slot #%d(%d)", i, state->slots[i]);
|
2022-05-06 09:21:29 +03:00
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2022-05-06 15:39:40 +03:00
|
|
|
WINPR_ASSERT(p11->C_GetTokenInfo);
|
|
|
|
rv = p11->C_GetTokenInfo(state->slots[i], &tokenInfo);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
WLog_INFO(TAG, "unable to retrieve token info for slot #%d(%d)", i, state->slots[i]);
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
2022-06-23 08:57:38 +03:00
|
|
|
fix_padded_string((char*)tokenInfo.label, sizeof(tokenInfo.label));
|
2023-01-23 14:03:18 +03:00
|
|
|
WLog_DBG(TAG, "token, label='%s' flags=0x%x", tokenInfo.label, tokenInfo.flags);
|
2022-05-06 15:39:40 +03:00
|
|
|
}
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(p11->C_OpenSession);
|
2021-12-07 02:07:57 +03:00
|
|
|
rv = p11->C_OpenSession(state->slots[i], CKF_SERIAL_SESSION, NULL, NULL, &session);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
2022-06-23 08:57:38 +03:00
|
|
|
WLog_ERR(TAG, "unable to openSession for slot #%d(%d), session=%p rv=%s", i,
|
|
|
|
state->slots[i], session, CK_RV_error_string(rv));
|
2021-12-07 02:07:57 +03:00
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(p11->C_FindObjectsInit);
|
2022-07-21 18:43:50 +03:00
|
|
|
rv = p11->C_FindObjectsInit(session, public_key_filter, ARRAYSIZE(public_key_filter));
|
2021-12-07 02:07:57 +03:00
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
// TODO: shall it be fatal ?
|
2022-05-06 09:21:29 +03:00
|
|
|
WLog_ERR(TAG, "unable to initiate search for slot #%d(%d), rv=%s", i, state->slots[i],
|
2022-06-23 08:57:38 +03:00
|
|
|
CK_RV_error_string(rv));
|
2021-12-07 02:07:57 +03:00
|
|
|
step = "C_FindObjectsInit";
|
|
|
|
goto cleanup_FindObjectsInit;
|
|
|
|
}
|
|
|
|
|
2023-06-07 10:31:18 +03:00
|
|
|
CK_ULONG nslotObjects = 0;
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(p11->C_FindObjects);
|
|
|
|
rv = p11->C_FindObjects(session, &slotObjects[0], ARRAYSIZE(slotObjects), &nslotObjects);
|
2021-12-07 02:07:57 +03:00
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
2022-05-06 09:21:29 +03:00
|
|
|
WLog_ERR(TAG, "unable to findObjects for slot #%d(%d), rv=%s", i, state->slots[i],
|
2022-06-23 08:57:38 +03:00
|
|
|
CK_RV_error_string(rv));
|
2021-12-07 02:07:57 +03:00
|
|
|
step = "C_FindObjects";
|
|
|
|
goto cleanup_FindObjects;
|
|
|
|
}
|
|
|
|
|
2023-01-23 14:03:18 +03:00
|
|
|
WLog_DBG(TAG, "slot has %d objects", nslotObjects);
|
2023-06-07 10:31:18 +03:00
|
|
|
for (CK_ULONG j = 0; j < nslotObjects; j++)
|
2021-12-07 02:07:57 +03:00
|
|
|
{
|
2022-07-21 18:43:50 +03:00
|
|
|
NCryptKeyEnum* key = &state->keys[state->nKeys];
|
|
|
|
CK_OBJECT_CLASS dataClass = CKO_PUBLIC_KEY;
|
2021-12-07 02:07:57 +03:00
|
|
|
CK_ATTRIBUTE key_or_certAttrs[] = {
|
2022-07-21 18:43:50 +03:00
|
|
|
{ CKA_ID, &key->id, sizeof(key->id) },
|
2021-12-07 02:07:57 +03:00
|
|
|
{ CKA_CLASS, &dataClass, sizeof(dataClass) },
|
2022-07-21 18:43:50 +03:00
|
|
|
{ CKA_LABEL, &key->keyLabel, sizeof(key->keyLabel) },
|
|
|
|
{ CKA_KEY_TYPE, &key->keyType, sizeof(key->keyType) }
|
2021-12-07 02:07:57 +03:00
|
|
|
};
|
|
|
|
|
|
|
|
rv = object_load_attributes(provider, session, slotObjects[j], key_or_certAttrs,
|
2022-02-14 15:05:59 +03:00
|
|
|
ARRAYSIZE(key_or_certAttrs));
|
2021-12-07 02:07:57 +03:00
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
2022-05-06 09:21:29 +03:00
|
|
|
WLog_ERR(TAG, "error getting attributes, rv=%s", CK_RV_error_string(rv));
|
2021-12-07 02:07:57 +03:00
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2022-07-21 18:43:50 +03:00
|
|
|
key->idLen = key_or_certAttrs[0].ulValueLen;
|
|
|
|
key->slotId = state->slots[i];
|
|
|
|
key->slotInfo = slotInfo;
|
|
|
|
state->nKeys++;
|
2021-12-07 02:07:57 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
cleanup_FindObjects:
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(p11->C_FindObjectsFinal);
|
2021-12-07 02:07:57 +03:00
|
|
|
rv = p11->C_FindObjectsFinal(session);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
2022-06-23 08:57:38 +03:00
|
|
|
WLog_ERR(TAG, "error during C_FindObjectsFinal for slot #%d(%d) (errorStep=%s), rv=%s",
|
|
|
|
i, state->slots[i], step, CK_RV_error_string(rv));
|
2021-12-07 02:07:57 +03:00
|
|
|
}
|
|
|
|
cleanup_FindObjectsInit:
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(p11->C_CloseSession);
|
2021-12-07 02:07:57 +03:00
|
|
|
rv = p11->C_CloseSession(session);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
2022-05-06 09:21:29 +03:00
|
|
|
WLog_ERR(TAG, "error closing session for slot #%d(%d) (errorStep=%s), rv=%s", i,
|
2022-06-23 08:57:38 +03:00
|
|
|
state->slots[i], step, CK_RV_error_string(rv));
|
2021-12-07 02:07:57 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return ERROR_SUCCESS;
|
|
|
|
}
|
|
|
|
|
2022-02-16 01:53:59 +03:00
|
|
|
static BOOL convertKeyType(CK_KEY_TYPE k, LPWSTR dest, DWORD len, DWORD* outlen)
|
2021-12-07 02:07:57 +03:00
|
|
|
{
|
2022-02-16 01:53:59 +03:00
|
|
|
DWORD retLen;
|
2021-12-07 02:07:57 +03:00
|
|
|
const WCHAR* r = NULL;
|
|
|
|
|
|
|
|
#define ALGO_CASE(V, S) \
|
|
|
|
case V: \
|
|
|
|
r = S; \
|
|
|
|
break
|
|
|
|
switch (k)
|
|
|
|
{
|
|
|
|
ALGO_CASE(CKK_RSA, BCRYPT_RSA_ALGORITHM);
|
|
|
|
ALGO_CASE(CKK_DSA, BCRYPT_DSA_ALGORITHM);
|
|
|
|
ALGO_CASE(CKK_DH, BCRYPT_DH_ALGORITHM);
|
|
|
|
ALGO_CASE(CKK_ECDSA, BCRYPT_ECDSA_ALGORITHM);
|
|
|
|
ALGO_CASE(CKK_RC2, BCRYPT_RC2_ALGORITHM);
|
|
|
|
ALGO_CASE(CKK_RC4, BCRYPT_RC4_ALGORITHM);
|
|
|
|
ALGO_CASE(CKK_DES, BCRYPT_DES_ALGORITHM);
|
|
|
|
ALGO_CASE(CKK_DES3, BCRYPT_3DES_ALGORITHM);
|
|
|
|
case CKK_DES2:
|
|
|
|
case CKK_X9_42_DH:
|
|
|
|
case CKK_KEA:
|
|
|
|
case CKK_GENERIC_SECRET:
|
|
|
|
case CKK_CAST:
|
|
|
|
case CKK_CAST3:
|
|
|
|
case CKK_CAST128:
|
|
|
|
case CKK_RC5:
|
|
|
|
case CKK_IDEA:
|
|
|
|
case CKK_SKIPJACK:
|
|
|
|
case CKK_BATON:
|
|
|
|
case CKK_JUNIPER:
|
|
|
|
case CKK_CDMF:
|
|
|
|
case CKK_AES:
|
|
|
|
case CKK_BLOWFISH:
|
|
|
|
case CKK_TWOFISH:
|
2022-02-16 01:53:59 +03:00
|
|
|
default:
|
2021-12-07 02:07:57 +03:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
#undef ALGO_CASE
|
|
|
|
|
2022-02-16 01:53:59 +03:00
|
|
|
retLen = _wcslen(r);
|
|
|
|
if (outlen)
|
|
|
|
*outlen = retLen;
|
|
|
|
|
|
|
|
if (!r)
|
|
|
|
{
|
|
|
|
if (dest && len > 0)
|
|
|
|
dest[0] = 0;
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
if (retLen + 1 < len)
|
|
|
|
{
|
|
|
|
WLog_ERR(TAG, "target buffer is too small for algo name");
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (dest)
|
|
|
|
{
|
|
|
|
memcpy(dest, r, retLen * 2);
|
|
|
|
dest[retLen] = 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return TRUE;
|
2021-12-07 02:07:57 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
static void wprintKeyName(LPWSTR str, CK_SLOT_ID slotId, CK_BYTE* id, CK_ULONG idLen)
|
|
|
|
{
|
2022-10-28 09:09:27 +03:00
|
|
|
char asciiName[128] = { 0 };
|
2022-03-03 00:00:01 +03:00
|
|
|
char* ptr = asciiName;
|
|
|
|
const CK_BYTE* bytePtr;
|
2021-12-07 02:07:57 +03:00
|
|
|
CK_ULONG i;
|
|
|
|
|
2022-06-23 08:57:38 +03:00
|
|
|
*ptr = '\\';
|
|
|
|
ptr++;
|
2022-03-03 00:00:01 +03:00
|
|
|
|
|
|
|
bytePtr = ((CK_BYTE*)&slotId);
|
|
|
|
for (i = 0; i < sizeof(slotId); i++, bytePtr++, ptr += 2)
|
|
|
|
snprintf(ptr, 3, "%.2x", *bytePtr);
|
|
|
|
|
2022-06-23 08:57:38 +03:00
|
|
|
*ptr = '\\';
|
|
|
|
ptr++;
|
2021-12-07 02:07:57 +03:00
|
|
|
|
|
|
|
for (i = 0; i < idLen; i++, id++, ptr += 2)
|
|
|
|
snprintf(ptr, 3, "%.2x", *id);
|
|
|
|
|
2022-10-28 09:09:27 +03:00
|
|
|
ConvertUtf8NToWChar(asciiName, ARRAYSIZE(asciiName), str,
|
|
|
|
strnlen(asciiName, ARRAYSIZE(asciiName)) + 1);
|
2021-12-07 02:07:57 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
static size_t parseHex(const char* str, const char* end, CK_BYTE* target)
|
|
|
|
{
|
|
|
|
int ret = 0;
|
|
|
|
|
|
|
|
for (ret = 0; str != end && *str; str++, ret++, target++)
|
|
|
|
{
|
|
|
|
CK_BYTE v = 0;
|
|
|
|
if (*str <= '9' && *str >= '0')
|
|
|
|
{
|
|
|
|
v = (*str - '0');
|
|
|
|
}
|
|
|
|
else if (*str <= 'f' && *str >= 'a')
|
|
|
|
{
|
|
|
|
v = (10 + *str - 'a');
|
|
|
|
}
|
|
|
|
else if (*str <= 'F' && *str >= 'A')
|
|
|
|
{
|
|
|
|
v |= (10 + *str - 'A');
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
v <<= 4;
|
|
|
|
str++;
|
|
|
|
|
|
|
|
if (!*str || str == end)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
if (*str <= '9' && *str >= '0')
|
|
|
|
{
|
|
|
|
v |= (*str - '0');
|
|
|
|
}
|
|
|
|
else if (*str <= 'f' && *str >= 'a')
|
|
|
|
{
|
|
|
|
v |= (10 + *str - 'a');
|
|
|
|
}
|
|
|
|
else if (*str <= 'F' && *str >= 'A')
|
|
|
|
{
|
|
|
|
v |= (10 + *str - 'A');
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
*target = v;
|
|
|
|
}
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
static SECURITY_STATUS parseKeyName(LPCWSTR pszKeyName, CK_SLOT_ID* slotId, CK_BYTE* id,
|
|
|
|
CK_ULONG* idLen)
|
|
|
|
{
|
2022-01-07 13:07:30 +03:00
|
|
|
char asciiKeyName[128] = { 0 };
|
2021-12-07 02:07:57 +03:00
|
|
|
char* pos;
|
|
|
|
|
2022-10-28 09:09:27 +03:00
|
|
|
if (ConvertWCharToUtf8(pszKeyName, asciiKeyName, ARRAYSIZE(asciiKeyName)) < 0)
|
2021-12-07 02:07:57 +03:00
|
|
|
return NTE_BAD_KEY;
|
|
|
|
|
|
|
|
if (*asciiKeyName != '\\')
|
|
|
|
return NTE_BAD_KEY;
|
|
|
|
|
|
|
|
pos = strchr(&asciiKeyName[1], '\\');
|
|
|
|
if (!pos)
|
|
|
|
return NTE_BAD_KEY;
|
|
|
|
|
2022-12-09 16:05:00 +03:00
|
|
|
if ((size_t)(pos - &asciiKeyName[1]) > sizeof(CK_SLOT_ID) * 2ull)
|
2021-12-07 02:07:57 +03:00
|
|
|
return NTE_BAD_KEY;
|
|
|
|
|
|
|
|
*slotId = (CK_SLOT_ID)0;
|
2022-03-03 00:00:01 +03:00
|
|
|
if (parseHex(&asciiKeyName[1], pos, (CK_BYTE*)slotId) != sizeof(CK_SLOT_ID))
|
2021-12-07 02:07:57 +03:00
|
|
|
return NTE_BAD_KEY;
|
|
|
|
|
|
|
|
*idLen = parseHex(pos + 1, NULL, id);
|
|
|
|
if (!*idLen)
|
|
|
|
return NTE_BAD_KEY;
|
|
|
|
|
|
|
|
return ERROR_SUCCESS;
|
|
|
|
}
|
|
|
|
|
|
|
|
static SECURITY_STATUS NCryptP11EnumKeys(NCRYPT_PROV_HANDLE hProvider, LPCWSTR pszScope,
|
|
|
|
NCryptKeyName** ppKeyName, PVOID* ppEnumState,
|
|
|
|
DWORD dwFlags)
|
|
|
|
{
|
|
|
|
NCryptP11ProviderHandle* provider = (NCryptP11ProviderHandle*)hProvider;
|
|
|
|
P11EnumKeysState* state = (P11EnumKeysState*)*ppEnumState;
|
2022-02-14 15:05:59 +03:00
|
|
|
CK_RV rv = { 0 };
|
|
|
|
CK_SLOT_ID currentSlot = { 0 };
|
2021-12-07 02:07:57 +03:00
|
|
|
CK_SESSION_HANDLE currentSession = (CK_SESSION_HANDLE)NULL;
|
2022-01-07 13:07:30 +03:00
|
|
|
char slotFilterBuffer[65] = { 0 };
|
|
|
|
char* slotFilter = NULL;
|
|
|
|
size_t slotFilterLen = 0;
|
2021-12-07 02:07:57 +03:00
|
|
|
|
2023-06-07 10:31:18 +03:00
|
|
|
SECURITY_STATUS ret = checkNCryptHandle((NCRYPT_HANDLE)hProvider, WINPR_NCRYPT_PROVIDER);
|
2021-12-07 02:07:57 +03:00
|
|
|
if (ret != ERROR_SUCCESS)
|
|
|
|
return ret;
|
|
|
|
|
2022-01-07 13:07:30 +03:00
|
|
|
if (pszScope)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* check whether pszScope is of the form \\.\<reader name>\ for filtering by
|
|
|
|
* card reader
|
|
|
|
*/
|
2023-06-07 10:31:18 +03:00
|
|
|
char asciiScope[128 + 6 + 1] = { 0 };
|
2022-10-28 09:09:27 +03:00
|
|
|
size_t asciiScopeLen;
|
2022-01-07 13:07:30 +03:00
|
|
|
|
2023-06-07 10:31:18 +03:00
|
|
|
if (ConvertWCharToUtf8(pszScope, asciiScope, ARRAYSIZE(asciiScope) - 1) < 0)
|
|
|
|
{
|
|
|
|
WLog_WARN(TAG, "Invalid scope");
|
2022-01-07 13:07:30 +03:00
|
|
|
return NTE_INVALID_PARAMETER;
|
2023-06-07 10:31:18 +03:00
|
|
|
}
|
2022-01-07 13:07:30 +03:00
|
|
|
|
|
|
|
if (strstr(asciiScope, "\\\\.\\") != asciiScope)
|
2023-06-07 10:31:18 +03:00
|
|
|
{
|
|
|
|
WLog_WARN(TAG, "Invalid scope '%s'", asciiScope);
|
2022-01-07 13:07:30 +03:00
|
|
|
return NTE_INVALID_PARAMETER;
|
2023-06-07 10:31:18 +03:00
|
|
|
}
|
2022-01-07 13:07:30 +03:00
|
|
|
|
2023-06-07 10:31:18 +03:00
|
|
|
asciiScopeLen = strnlen(asciiScope, ARRAYSIZE(asciiScope));
|
|
|
|
if ((asciiScopeLen < 1) || (asciiScope[asciiScopeLen - 1] != '\\'))
|
|
|
|
{
|
|
|
|
WLog_WARN(TAG, "Invalid scope '%s'", asciiScope);
|
2022-01-07 13:07:30 +03:00
|
|
|
return NTE_INVALID_PARAMETER;
|
2023-06-07 10:31:18 +03:00
|
|
|
}
|
2022-01-07 13:07:30 +03:00
|
|
|
|
|
|
|
asciiScope[asciiScopeLen - 1] = 0;
|
|
|
|
|
|
|
|
strncpy(slotFilterBuffer, &asciiScope[4], sizeof(slotFilterBuffer));
|
|
|
|
slotFilter = slotFilterBuffer;
|
|
|
|
slotFilterLen = asciiScopeLen - 5;
|
|
|
|
}
|
|
|
|
|
2021-12-07 02:07:57 +03:00
|
|
|
if (!state)
|
|
|
|
{
|
|
|
|
state = (P11EnumKeysState*)calloc(1, sizeof(*state));
|
|
|
|
if (!state)
|
|
|
|
return NTE_NO_MEMORY;
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(provider->p11->C_GetSlotList);
|
2021-12-07 02:07:57 +03:00
|
|
|
rv = provider->p11->C_GetSlotList(CK_TRUE, NULL, &state->nslots);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
/* TODO: perhaps convert rv to NTE_*** errors */
|
2023-06-07 10:31:18 +03:00
|
|
|
WLog_WARN(TAG, "C_GetSlotList failed with %u", rv);
|
2021-12-07 02:07:57 +03:00
|
|
|
return NTE_FAIL;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (state->nslots > MAX_SLOTS)
|
|
|
|
state->nslots = MAX_SLOTS;
|
|
|
|
|
|
|
|
rv = provider->p11->C_GetSlotList(CK_TRUE, state->slots, &state->nslots);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
free(state);
|
|
|
|
/* TODO: perhaps convert rv to NTE_*** errors */
|
2023-06-07 10:31:18 +03:00
|
|
|
WLog_WARN(TAG, "C_GetSlotList failed with %u", rv);
|
2021-12-07 02:07:57 +03:00
|
|
|
return NTE_FAIL;
|
|
|
|
}
|
|
|
|
|
2022-07-21 18:43:50 +03:00
|
|
|
ret = collect_keys(provider, state);
|
2021-12-07 02:07:57 +03:00
|
|
|
if (ret != ERROR_SUCCESS)
|
|
|
|
{
|
|
|
|
free(state);
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
*ppEnumState = state;
|
|
|
|
}
|
|
|
|
|
2022-07-21 18:43:50 +03:00
|
|
|
for (; state->keyIndex < state->nKeys; state->keyIndex++)
|
2021-12-07 02:07:57 +03:00
|
|
|
{
|
2022-02-14 15:05:59 +03:00
|
|
|
NCryptKeyName* keyName = NULL;
|
2022-07-21 18:43:50 +03:00
|
|
|
NCryptKeyEnum* key = &state->keys[state->keyIndex];
|
2021-12-07 02:07:57 +03:00
|
|
|
CK_OBJECT_CLASS oclass = CKO_CERTIFICATE;
|
|
|
|
CK_CERTIFICATE_TYPE ctype = CKC_X_509;
|
|
|
|
CK_ATTRIBUTE certificateFilter[] = { { CKA_CLASS, &oclass, sizeof(oclass) },
|
|
|
|
{ CKA_CERTIFICATE_TYPE, &ctype, sizeof(ctype) },
|
2022-07-21 18:43:50 +03:00
|
|
|
{ CKA_ID, key->id, key->idLen } };
|
2021-12-07 02:07:57 +03:00
|
|
|
CK_ULONG ncertObjects;
|
|
|
|
CK_OBJECT_HANDLE certObject;
|
|
|
|
|
2022-01-07 13:07:30 +03:00
|
|
|
/* check the reader filter if any */
|
2022-07-21 18:43:50 +03:00
|
|
|
if (slotFilter && memcmp(key->slotInfo.slotDescription, slotFilter, slotFilterLen) != 0)
|
2022-01-07 13:07:30 +03:00
|
|
|
continue;
|
|
|
|
|
2022-07-21 18:43:50 +03:00
|
|
|
if (!currentSession || (currentSlot != key->slotId))
|
2021-12-07 02:07:57 +03:00
|
|
|
{
|
2022-07-21 18:43:50 +03:00
|
|
|
/* if the current session doesn't match the current key's slot, open a new one
|
2021-12-07 02:07:57 +03:00
|
|
|
*/
|
|
|
|
if (currentSession)
|
|
|
|
{
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(provider->p11->C_CloseSession);
|
2021-12-07 02:07:57 +03:00
|
|
|
rv = provider->p11->C_CloseSession(currentSession);
|
|
|
|
currentSession = (CK_SESSION_HANDLE)NULL;
|
|
|
|
}
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(provider->p11->C_OpenSession);
|
2022-07-21 18:43:50 +03:00
|
|
|
rv = provider->p11->C_OpenSession(key->slotId, CKF_SERIAL_SESSION, NULL, NULL,
|
2021-12-07 02:07:57 +03:00
|
|
|
¤tSession);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
2022-07-21 18:43:50 +03:00
|
|
|
WLog_ERR(TAG, "unable to openSession for slot %d", key->slotId);
|
2021-12-07 02:07:57 +03:00
|
|
|
continue;
|
|
|
|
}
|
2022-07-21 18:43:50 +03:00
|
|
|
currentSlot = key->slotId;
|
2021-12-07 02:07:57 +03:00
|
|
|
}
|
|
|
|
|
2022-07-21 18:43:50 +03:00
|
|
|
/* look if we can find a certificate that matches the key's id */
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(provider->p11->C_FindObjectsInit);
|
2021-12-07 02:07:57 +03:00
|
|
|
rv = provider->p11->C_FindObjectsInit(currentSession, certificateFilter,
|
2022-02-14 15:05:59 +03:00
|
|
|
ARRAYSIZE(certificateFilter));
|
2021-12-07 02:07:57 +03:00
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
2022-07-21 18:43:50 +03:00
|
|
|
WLog_ERR(TAG, "unable to initiate search for slot %d", key->slotId);
|
2021-12-07 02:07:57 +03:00
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(provider->p11->C_FindObjects);
|
2021-12-07 02:07:57 +03:00
|
|
|
rv = provider->p11->C_FindObjects(currentSession, &certObject, 1, &ncertObjects);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
WLog_ERR(TAG, "unable to findObjects for slot %d", currentSlot);
|
|
|
|
goto cleanup_FindObjects;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (ncertObjects)
|
|
|
|
{
|
2022-02-16 01:53:59 +03:00
|
|
|
/* sizeof keyName struct + "\<slotId>\<certId>" + keyName->pszAlgid */
|
|
|
|
DWORD algoSz;
|
2022-06-23 08:57:38 +03:00
|
|
|
size_t KEYNAME_SZ =
|
2022-07-21 18:43:50 +03:00
|
|
|
(1 + (sizeof(key->slotId) * 2) /*slotId*/ + 1 + (key->idLen * 2) + 1) * 2;
|
2022-02-16 01:53:59 +03:00
|
|
|
|
2022-07-21 18:43:50 +03:00
|
|
|
convertKeyType(key->keyType, NULL, 0, &algoSz);
|
2022-02-16 01:53:59 +03:00
|
|
|
KEYNAME_SZ += (algoSz + 1) * 2;
|
|
|
|
|
2021-12-07 02:07:57 +03:00
|
|
|
keyName = calloc(1, sizeof(*keyName) + KEYNAME_SZ);
|
|
|
|
if (!keyName)
|
|
|
|
{
|
|
|
|
WLog_ERR(TAG, "unable to allocate keyName");
|
|
|
|
goto cleanup_FindObjects;
|
|
|
|
}
|
|
|
|
keyName->dwLegacyKeySpec = AT_KEYEXCHANGE | AT_SIGNATURE;
|
|
|
|
keyName->dwFlags = NCRYPT_MACHINE_KEY_FLAG;
|
|
|
|
keyName->pszName = (LPWSTR)(keyName + 1);
|
2022-07-21 18:43:50 +03:00
|
|
|
wprintKeyName(keyName->pszName, key->slotId, key->id, key->idLen);
|
2022-02-16 01:53:59 +03:00
|
|
|
|
|
|
|
keyName->pszAlgid = keyName->pszName + _wcslen(keyName->pszName) + 1;
|
2022-07-21 18:43:50 +03:00
|
|
|
convertKeyType(key->keyType, keyName->pszAlgid, algoSz + 1, NULL);
|
2021-12-07 02:07:57 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
cleanup_FindObjects:
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(provider->p11->C_FindObjectsFinal);
|
2021-12-07 02:07:57 +03:00
|
|
|
rv = provider->p11->C_FindObjectsFinal(currentSession);
|
|
|
|
|
|
|
|
if (keyName)
|
|
|
|
{
|
|
|
|
*ppKeyName = keyName;
|
2022-07-21 18:43:50 +03:00
|
|
|
state->keyIndex++;
|
2021-12-07 02:07:57 +03:00
|
|
|
return ERROR_SUCCESS;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return NTE_NO_MORE_ITEMS;
|
|
|
|
}
|
|
|
|
|
2022-11-28 15:32:40 +03:00
|
|
|
static SECURITY_STATUS get_piv_container_name(NCryptP11KeyHandle* key, const BYTE* piv_tag,
|
|
|
|
BYTE* output, size_t output_len)
|
2022-10-16 18:36:20 +03:00
|
|
|
{
|
|
|
|
CK_SLOT_INFO slot_info = { 0 };
|
|
|
|
CK_FUNCTION_LIST_PTR p11 = NULL;
|
|
|
|
WCHAR* reader = NULL;
|
|
|
|
SCARDCONTEXT context = 0;
|
|
|
|
SCARDHANDLE card = 0;
|
|
|
|
DWORD proto = 0;
|
|
|
|
const SCARD_IO_REQUEST* pci = NULL;
|
|
|
|
BYTE buf[258] = { 0 };
|
|
|
|
char container_name[PIV_CONTAINER_NAME_LEN + 1] = { 0 };
|
|
|
|
DWORD buf_len = 0;
|
|
|
|
SECURITY_STATUS ret = NTE_BAD_KEY;
|
|
|
|
WinPrAsn1Decoder dec = { 0 };
|
|
|
|
WinPrAsn1Decoder dec2 = { 0 };
|
|
|
|
size_t len = 0;
|
|
|
|
BYTE tag = 0;
|
|
|
|
BYTE* p = NULL;
|
|
|
|
wStream s = { 0 };
|
|
|
|
|
|
|
|
WINPR_ASSERT(key);
|
|
|
|
WINPR_ASSERT(piv_tag);
|
|
|
|
|
|
|
|
WINPR_ASSERT(key->provider);
|
|
|
|
p11 = key->provider->p11;
|
|
|
|
WINPR_ASSERT(p11);
|
|
|
|
|
|
|
|
/* Get the reader the card is in */
|
|
|
|
WINPR_ASSERT(p11->C_GetSlotInfo);
|
|
|
|
if (p11->C_GetSlotInfo(key->slotId, &slot_info) != CKR_OK)
|
|
|
|
return NTE_BAD_KEY;
|
|
|
|
|
|
|
|
fix_padded_string((char*)slot_info.slotDescription, sizeof(slot_info.slotDescription));
|
2022-10-28 09:09:27 +03:00
|
|
|
reader = ConvertUtf8NToWCharAlloc((char*)slot_info.slotDescription,
|
|
|
|
ARRAYSIZE(slot_info.slotDescription), NULL);
|
|
|
|
ret = NTE_NO_MEMORY;
|
|
|
|
if (!reader)
|
|
|
|
goto out;
|
2022-10-16 18:36:20 +03:00
|
|
|
|
2022-10-28 09:09:27 +03:00
|
|
|
ret = NTE_BAD_KEY;
|
2022-10-16 18:36:20 +03:00
|
|
|
if (SCardEstablishContext(SCARD_SCOPE_USER, NULL, NULL, &context) != SCARD_S_SUCCESS)
|
2022-10-28 09:09:27 +03:00
|
|
|
goto out;
|
2022-10-16 18:36:20 +03:00
|
|
|
|
|
|
|
if (SCardConnectW(context, reader, SCARD_SHARE_SHARED, SCARD_PROTOCOL_Tx, &card, &proto) !=
|
|
|
|
SCARD_S_SUCCESS)
|
|
|
|
goto out;
|
|
|
|
pci = (proto == SCARD_PROTOCOL_T0) ? SCARD_PCI_T0 : SCARD_PCI_T1;
|
|
|
|
|
|
|
|
buf_len = sizeof(buf);
|
|
|
|
if (SCardTransmit(card, pci, APDU_PIV_SELECT_AID, sizeof(APDU_PIV_SELECT_AID), NULL, buf,
|
|
|
|
&buf_len) != SCARD_S_SUCCESS)
|
|
|
|
goto out;
|
|
|
|
if ((buf[buf_len - 2] != 0x90 || buf[buf_len - 1] != 0) && buf[buf_len - 2] != 0x61)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
buf_len = sizeof(buf);
|
|
|
|
if (SCardTransmit(card, pci, APDU_PIV_GET_CHUID, sizeof(APDU_PIV_GET_CHUID), NULL, buf,
|
|
|
|
&buf_len) != SCARD_S_SUCCESS)
|
|
|
|
goto out;
|
|
|
|
if ((buf[buf_len - 2] != 0x90 || buf[buf_len - 1] != 0) && buf[buf_len - 2] != 0x61)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
/* Find the GUID field in the CHUID data object */
|
|
|
|
WinPrAsn1Decoder_InitMem(&dec, WINPR_ASN1_BER, buf, buf_len);
|
|
|
|
if (!WinPrAsn1DecReadTagAndLen(&dec, &tag, &len) || tag != 0x53)
|
|
|
|
goto out;
|
|
|
|
while (WinPrAsn1DecReadTagLenValue(&dec, &tag, &len, &dec2) && tag != 0x34)
|
|
|
|
;
|
|
|
|
if (tag != 0x34 || len != 16)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
s = WinPrAsn1DecGetStream(&dec2);
|
|
|
|
p = Stream_Buffer(&s);
|
|
|
|
|
|
|
|
/* Construct the value Windows would use for a PIV key's container name */
|
|
|
|
snprintf(container_name, PIV_CONTAINER_NAME_LEN + 1,
|
|
|
|
"%.2x%.2x%.2x%.2x-%.2x%.2x-%.2x%.2x-%.2x%.2x-%.2x%.2x%.2x%.2x%.2x%.2x", p[3], p[2],
|
|
|
|
p[1], p[0], p[5], p[4], p[7], p[6], p[8], p[9], p[10], p[11], p[12], piv_tag[0],
|
|
|
|
piv_tag[1], piv_tag[2]);
|
|
|
|
|
|
|
|
/* And convert it to UTF-16 */
|
2022-10-28 09:09:27 +03:00
|
|
|
union
|
|
|
|
{
|
|
|
|
WCHAR* wc;
|
|
|
|
BYTE* b;
|
|
|
|
} cnv;
|
|
|
|
cnv.b = output;
|
|
|
|
if (ConvertUtf8NToWChar(container_name, ARRAYSIZE(container_name), cnv.wc,
|
|
|
|
output_len / sizeof(WCHAR)) > 0)
|
2022-10-16 18:36:20 +03:00
|
|
|
ret = ERROR_SUCCESS;
|
|
|
|
|
|
|
|
out:
|
2022-10-28 09:09:27 +03:00
|
|
|
free(reader);
|
2022-10-16 18:36:20 +03:00
|
|
|
if (card)
|
|
|
|
SCardDisconnect(card, SCARD_LEAVE_CARD);
|
|
|
|
if (context)
|
|
|
|
SCardReleaseContext(context);
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
static SECURITY_STATUS check_for_piv_container_name(NCryptP11KeyHandle* key, BYTE* pbOutput,
|
|
|
|
DWORD cbOutput, DWORD* pcbResult, char* label,
|
|
|
|
size_t label_len)
|
|
|
|
{
|
2022-11-14 13:10:55 +03:00
|
|
|
for (size_t i = 0; i < ARRAYSIZE(piv_cert_tags); i++)
|
2022-10-16 18:36:20 +03:00
|
|
|
{
|
2022-11-14 13:10:55 +03:00
|
|
|
const piv_cert_tags_t* cur = &piv_cert_tags[i];
|
|
|
|
if (strncmp(label, cur->label, label_len) == 0)
|
2022-10-16 18:36:20 +03:00
|
|
|
{
|
2022-11-30 00:53:13 +03:00
|
|
|
*pcbResult = (PIV_CONTAINER_NAME_LEN + 1) * sizeof(WCHAR);
|
2022-10-16 18:36:20 +03:00
|
|
|
if (!pbOutput)
|
|
|
|
return ERROR_SUCCESS;
|
2022-11-14 13:10:55 +03:00
|
|
|
else if (cbOutput < (PIV_CONTAINER_NAME_LEN + 1) * sizeof(WCHAR))
|
2022-10-16 18:36:20 +03:00
|
|
|
return NTE_NO_MEMORY;
|
2022-11-14 13:10:55 +03:00
|
|
|
else
|
|
|
|
return get_piv_container_name(key, cur->tag, pbOutput, cbOutput);
|
2022-10-16 18:36:20 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return NTE_NOT_FOUND;
|
|
|
|
}
|
|
|
|
|
2021-12-07 02:07:57 +03:00
|
|
|
static SECURITY_STATUS NCryptP11KeyGetProperties(NCryptP11KeyHandle* keyHandle,
|
|
|
|
NCryptKeyGetPropertyEnum property, PBYTE pbOutput,
|
|
|
|
DWORD cbOutput, DWORD* pcbResult, DWORD dwFlags)
|
|
|
|
{
|
|
|
|
SECURITY_STATUS ret = NTE_FAIL;
|
|
|
|
CK_RV rv;
|
|
|
|
CK_SESSION_HANDLE session;
|
|
|
|
CK_OBJECT_HANDLE objectHandle;
|
|
|
|
CK_ULONG objectCount;
|
2022-02-14 15:05:59 +03:00
|
|
|
NCryptP11ProviderHandle* provider;
|
2021-12-07 02:07:57 +03:00
|
|
|
CK_OBJECT_CLASS oclass = CKO_CERTIFICATE;
|
|
|
|
CK_CERTIFICATE_TYPE ctype = CKC_X_509;
|
|
|
|
CK_ATTRIBUTE certificateFilter[] = { { CKA_CLASS, &oclass, sizeof(oclass) },
|
|
|
|
{ CKA_CERTIFICATE_TYPE, &ctype, sizeof(ctype) },
|
|
|
|
{ CKA_ID, keyHandle->keyCertId,
|
|
|
|
keyHandle->keyCertIdLen } };
|
|
|
|
CK_ATTRIBUTE* objectFilter = certificateFilter;
|
2022-02-14 15:05:59 +03:00
|
|
|
CK_ULONG objectFilterLen = ARRAYSIZE(certificateFilter);
|
|
|
|
|
|
|
|
WINPR_ASSERT(keyHandle);
|
|
|
|
provider = keyHandle->provider;
|
|
|
|
WINPR_ASSERT(provider);
|
2021-12-07 02:07:57 +03:00
|
|
|
|
|
|
|
switch (property)
|
2022-01-27 14:04:52 +03:00
|
|
|
|
2021-12-07 02:07:57 +03:00
|
|
|
{
|
|
|
|
case NCRYPT_PROPERTY_CERTIFICATE:
|
2022-10-16 18:36:20 +03:00
|
|
|
case NCRYPT_PROPERTY_NAME:
|
2021-12-07 02:07:57 +03:00
|
|
|
break;
|
2022-01-27 14:04:52 +03:00
|
|
|
case NCRYPT_PROPERTY_READER:
|
|
|
|
{
|
2022-01-10 17:27:10 +03:00
|
|
|
CK_SLOT_INFO slotInfo;
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(provider->p11->C_GetSlotInfo);
|
2022-01-10 17:27:10 +03:00
|
|
|
rv = provider->p11->C_GetSlotInfo(keyHandle->slotId, &slotInfo);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
return NTE_BAD_KEY;
|
|
|
|
|
2022-01-27 14:04:52 +03:00
|
|
|
#define SLOT_DESC_SZ sizeof(slotInfo.slotDescription)
|
2022-01-17 00:28:51 +03:00
|
|
|
fix_padded_string((char*)slotInfo.slotDescription, SLOT_DESC_SZ);
|
|
|
|
*pcbResult = 2 * (strnlen((char*)slotInfo.slotDescription, SLOT_DESC_SZ) + 1);
|
2022-01-10 17:27:10 +03:00
|
|
|
if (pbOutput)
|
|
|
|
{
|
2022-10-28 09:09:27 +03:00
|
|
|
union
|
|
|
|
{
|
|
|
|
WCHAR* wc;
|
|
|
|
BYTE* b;
|
|
|
|
} cnv;
|
|
|
|
cnv.b = pbOutput;
|
2022-01-27 14:04:52 +03:00
|
|
|
if (cbOutput < *pcbResult)
|
2022-01-10 17:27:10 +03:00
|
|
|
return NTE_NO_MEMORY;
|
|
|
|
|
2022-10-28 09:09:27 +03:00
|
|
|
if (ConvertUtf8ToWChar((char*)slotInfo.slotDescription, cnv.wc,
|
|
|
|
cbOutput / sizeof(WCHAR)) < 0)
|
2022-01-17 00:28:51 +03:00
|
|
|
return NTE_NO_MEMORY;
|
2022-01-10 17:27:10 +03:00
|
|
|
}
|
|
|
|
return ERROR_SUCCESS;
|
|
|
|
}
|
2022-01-27 14:04:52 +03:00
|
|
|
case NCRYPT_PROPERTY_SLOTID:
|
|
|
|
{
|
|
|
|
*pcbResult = 4;
|
|
|
|
if (pbOutput)
|
|
|
|
{
|
|
|
|
UINT32* ptr = (UINT32*)pbOutput;
|
|
|
|
|
|
|
|
if (cbOutput < 4)
|
|
|
|
return NTE_NO_MEMORY;
|
|
|
|
|
|
|
|
*ptr = keyHandle->slotId;
|
|
|
|
}
|
|
|
|
return ERROR_SUCCESS;
|
|
|
|
}
|
2022-01-10 17:27:10 +03:00
|
|
|
case NCRYPT_PROPERTY_UNKNOWN:
|
2021-12-07 02:07:57 +03:00
|
|
|
default:
|
|
|
|
return NTE_NOT_SUPPORTED;
|
|
|
|
}
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(provider->p11->C_OpenSession);
|
2021-12-07 02:07:57 +03:00
|
|
|
rv = provider->p11->C_OpenSession(keyHandle->slotId, CKF_SERIAL_SESSION, NULL, NULL, &session);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
WLog_ERR(TAG, "error opening session on slot %d", keyHandle->slotId);
|
|
|
|
return NTE_FAIL;
|
|
|
|
}
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(provider->p11->C_FindObjectsInit);
|
2021-12-07 02:07:57 +03:00
|
|
|
rv = provider->p11->C_FindObjectsInit(session, objectFilter, objectFilterLen);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
WLog_ERR(TAG, "unable to initiate search for slot %d", keyHandle->slotId);
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(provider->p11->C_FindObjects);
|
2021-12-07 02:07:57 +03:00
|
|
|
rv = provider->p11->C_FindObjects(session, &objectHandle, 1, &objectCount);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
WLog_ERR(TAG, "unable to findObjects for slot %d", keyHandle->slotId);
|
|
|
|
goto out_final;
|
|
|
|
}
|
|
|
|
if (!objectCount)
|
|
|
|
{
|
|
|
|
ret = NTE_NOT_FOUND;
|
|
|
|
goto out_final;
|
|
|
|
}
|
|
|
|
|
|
|
|
switch (property)
|
|
|
|
{
|
|
|
|
case NCRYPT_PROPERTY_CERTIFICATE:
|
|
|
|
{
|
|
|
|
CK_ATTRIBUTE certValue = { CKA_VALUE, pbOutput, cbOutput };
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(provider->p11->C_GetAttributeValue);
|
2021-12-07 02:07:57 +03:00
|
|
|
rv = provider->p11->C_GetAttributeValue(session, objectHandle, &certValue, 1);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
// TODO: do a kind of translation from CKR_* to NTE_*
|
|
|
|
}
|
|
|
|
|
|
|
|
*pcbResult = certValue.ulValueLen;
|
|
|
|
ret = ERROR_SUCCESS;
|
|
|
|
break;
|
|
|
|
}
|
2022-10-16 18:36:20 +03:00
|
|
|
case NCRYPT_PROPERTY_NAME:
|
|
|
|
{
|
|
|
|
CK_ATTRIBUTE attr = { CKA_LABEL, NULL, 0 };
|
|
|
|
char* label = NULL;
|
|
|
|
|
|
|
|
WINPR_ASSERT(provider->p11->C_GetAttributeValue);
|
|
|
|
rv = provider->p11->C_GetAttributeValue(session, objectHandle, &attr, 1);
|
|
|
|
if (rv == CKR_OK)
|
|
|
|
{
|
|
|
|
label = calloc(1, attr.ulValueLen);
|
|
|
|
if (!label)
|
|
|
|
{
|
|
|
|
ret = NTE_NO_MEMORY;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
attr.pValue = label;
|
|
|
|
rv = provider->p11->C_GetAttributeValue(session, objectHandle, &attr, 1);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (rv == CKR_OK)
|
|
|
|
{
|
|
|
|
/* Check if we have a PIV card */
|
|
|
|
ret = check_for_piv_container_name(keyHandle, pbOutput, cbOutput, pcbResult, label,
|
|
|
|
attr.ulValueLen);
|
|
|
|
|
|
|
|
/* Otherwise, at least for GIDS cards the label will be the correct value */
|
|
|
|
if (ret == NTE_NOT_FOUND)
|
|
|
|
{
|
2022-10-28 09:09:27 +03:00
|
|
|
union
|
|
|
|
{
|
|
|
|
WCHAR* wc;
|
|
|
|
BYTE* b;
|
|
|
|
} cnv;
|
|
|
|
const size_t olen = pbOutput ? cbOutput / sizeof(WCHAR) : 0;
|
|
|
|
cnv.b = pbOutput;
|
|
|
|
SSIZE_T size = ConvertUtf8NToWChar(label, attr.ulValueLen, cnv.wc, olen);
|
|
|
|
if (size < 0)
|
|
|
|
ret = ERROR_CONVERT_TO_LARGE;
|
|
|
|
else
|
|
|
|
ret = ERROR_SUCCESS;
|
2022-10-16 18:36:20 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
free(label);
|
|
|
|
break;
|
|
|
|
}
|
2021-12-07 02:07:57 +03:00
|
|
|
default:
|
|
|
|
ret = NTE_NOT_SUPPORTED;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
out_final:
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(provider->p11->C_FindObjectsFinal);
|
2021-12-07 02:07:57 +03:00
|
|
|
rv = provider->p11->C_FindObjectsFinal(session);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
WLog_ERR(TAG, "error in C_FindObjectsFinal() for slot %d", keyHandle->slotId);
|
|
|
|
}
|
|
|
|
out:
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(provider->p11->C_CloseSession);
|
2021-12-07 02:07:57 +03:00
|
|
|
rv = provider->p11->C_CloseSession(session);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
WLog_ERR(TAG, "error in C_CloseSession() for slot %d", keyHandle->slotId);
|
|
|
|
}
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
static SECURITY_STATUS NCryptP11GetProperty(NCRYPT_HANDLE hObject, NCryptKeyGetPropertyEnum prop,
|
|
|
|
PBYTE pbOutput, DWORD cbOutput, DWORD* pcbResult,
|
|
|
|
DWORD dwFlags)
|
|
|
|
{
|
|
|
|
NCryptBaseHandle* base = (NCryptBaseHandle*)hObject;
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_ASSERT(base);
|
2021-12-07 02:07:57 +03:00
|
|
|
switch (base->type)
|
|
|
|
{
|
|
|
|
case WINPR_NCRYPT_PROVIDER:
|
|
|
|
return ERROR_CALL_NOT_IMPLEMENTED;
|
|
|
|
case WINPR_NCRYPT_KEY:
|
|
|
|
return NCryptP11KeyGetProperties((NCryptP11KeyHandle*)hObject, prop, pbOutput, cbOutput,
|
|
|
|
pcbResult, dwFlags);
|
|
|
|
default:
|
|
|
|
return ERROR_INVALID_HANDLE;
|
|
|
|
}
|
|
|
|
return ERROR_SUCCESS;
|
|
|
|
}
|
|
|
|
|
|
|
|
static SECURITY_STATUS NCryptP11OpenKey(NCRYPT_PROV_HANDLE hProvider, NCRYPT_KEY_HANDLE* phKey,
|
|
|
|
LPCWSTR pszKeyName, DWORD dwLegacyKeySpec, DWORD dwFlags)
|
|
|
|
{
|
|
|
|
SECURITY_STATUS ret;
|
|
|
|
CK_SLOT_ID slotId;
|
2022-02-14 15:05:59 +03:00
|
|
|
CK_BYTE keyCertId[64] = { 0 };
|
2021-12-07 02:07:57 +03:00
|
|
|
CK_ULONG keyCertIdLen;
|
|
|
|
NCryptP11KeyHandle* keyHandle;
|
|
|
|
|
|
|
|
ret = parseKeyName(pszKeyName, &slotId, keyCertId, &keyCertIdLen);
|
|
|
|
if (ret != ERROR_SUCCESS)
|
|
|
|
return ret;
|
|
|
|
|
2022-02-14 15:05:59 +03:00
|
|
|
keyHandle = (NCryptP11KeyHandle*)ncrypt_new_handle(
|
|
|
|
WINPR_NCRYPT_KEY, sizeof(*keyHandle), NCryptP11GetProperty, winpr_NCryptDefault_dtor);
|
2021-12-07 02:07:57 +03:00
|
|
|
if (!keyHandle)
|
|
|
|
return NTE_NO_MEMORY;
|
|
|
|
|
|
|
|
keyHandle->provider = (NCryptP11ProviderHandle*)hProvider;
|
|
|
|
keyHandle->slotId = slotId;
|
|
|
|
memcpy(keyHandle->keyCertId, keyCertId, sizeof(keyCertId));
|
|
|
|
keyHandle->keyCertIdLen = keyCertIdLen;
|
|
|
|
*phKey = (NCRYPT_KEY_HANDLE)keyHandle;
|
|
|
|
return ERROR_SUCCESS;
|
|
|
|
}
|
|
|
|
|
2022-02-14 15:36:14 +03:00
|
|
|
static SECURITY_STATUS initialize_pkcs11(HANDLE handle,
|
|
|
|
CK_RV (*c_get_function_list)(CK_FUNCTION_LIST_PTR_PTR),
|
|
|
|
NCRYPT_PROV_HANDLE* phProvider)
|
2021-12-07 02:07:57 +03:00
|
|
|
{
|
2022-02-14 15:36:14 +03:00
|
|
|
SECURITY_STATUS status = ERROR_SUCCESS;
|
|
|
|
NCryptP11ProviderHandle* ret;
|
2021-12-07 02:07:57 +03:00
|
|
|
CK_RV rv;
|
|
|
|
|
2022-02-14 15:36:14 +03:00
|
|
|
WINPR_ASSERT(c_get_function_list);
|
|
|
|
WINPR_ASSERT(phProvider);
|
2021-12-07 02:07:57 +03:00
|
|
|
|
|
|
|
ret = (NCryptP11ProviderHandle*)ncrypt_new_handle(
|
2022-02-14 15:05:59 +03:00
|
|
|
WINPR_NCRYPT_PROVIDER, sizeof(*ret), NCryptP11GetProperty, NCryptP11StorageProvider_dtor);
|
2021-12-07 02:07:57 +03:00
|
|
|
if (!ret)
|
2022-02-14 15:36:14 +03:00
|
|
|
{
|
|
|
|
if (handle)
|
|
|
|
FreeLibrary(handle);
|
2021-12-07 02:07:57 +03:00
|
|
|
return NTE_NO_MEMORY;
|
2022-02-14 15:36:14 +03:00
|
|
|
}
|
2021-12-07 02:07:57 +03:00
|
|
|
|
2022-02-14 15:36:14 +03:00
|
|
|
ret->library = handle;
|
2021-12-07 02:07:57 +03:00
|
|
|
ret->baseProvider.enumKeysFn = NCryptP11EnumKeys;
|
|
|
|
ret->baseProvider.openKeyFn = NCryptP11OpenKey;
|
|
|
|
|
2022-02-14 15:36:14 +03:00
|
|
|
rv = c_get_function_list(&ret->p11);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
status = NTE_PROVIDER_DLL_FAIL;
|
|
|
|
goto fail;
|
|
|
|
}
|
|
|
|
|
|
|
|
WINPR_ASSERT(ret->p11->C_Initialize);
|
|
|
|
rv = ret->p11->C_Initialize(NULL);
|
|
|
|
if (rv != CKR_OK)
|
|
|
|
{
|
|
|
|
status = NTE_PROVIDER_DLL_FAIL;
|
|
|
|
goto fail;
|
|
|
|
}
|
|
|
|
|
|
|
|
*phProvider = (NCRYPT_PROV_HANDLE)ret;
|
|
|
|
|
|
|
|
fail:
|
|
|
|
if (status != ERROR_SUCCESS)
|
|
|
|
ret->baseProvider.baseHandle.releaseFn((NCRYPT_HANDLE)ret);
|
|
|
|
return status;
|
|
|
|
}
|
|
|
|
|
|
|
|
SECURITY_STATUS NCryptOpenP11StorageProviderEx(NCRYPT_PROV_HANDLE* phProvider,
|
|
|
|
LPCWSTR pszProviderName, DWORD dwFlags,
|
|
|
|
LPCSTR* modulePaths)
|
|
|
|
{
|
2022-02-14 17:51:39 +03:00
|
|
|
SECURITY_STATUS status = ERROR_INVALID_PARAMETER;
|
2022-02-14 17:48:13 +03:00
|
|
|
#if defined(__LP64__) || (defined(__x86_64__) && !defined(__ILP32__)) || defined(_M_X64) || \
|
|
|
|
defined(__ia64) || defined(_M_IA64) || defined(__aarch64__) || defined(__powerpc64__)
|
|
|
|
#define LIBS64
|
|
|
|
#endif
|
|
|
|
|
|
|
|
LPCSTR openscPaths[] = { "opensc-pkcs11.so", /* In case winpr is installed in system paths */
|
|
|
|
#ifdef __APPLE__
|
|
|
|
"/usr/local/lib/pkcs11/opensc-pkcs11.so",
|
|
|
|
#else
|
|
|
|
/* linux and UNIXes */
|
|
|
|
#ifdef LIBS64
|
|
|
|
"/usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so", /* Ubuntu/debian
|
|
|
|
*/
|
|
|
|
"/lib64/pkcs11/opensc-pkcs11.so", /* Fedora */
|
|
|
|
#else
|
|
|
|
"/usr/lib/i386-linux-gnu/opensc-pkcs11.so", /* debian */
|
|
|
|
"/lib32/pkcs11/opensc-pkcs11.so", /* Fedora */
|
|
|
|
#endif
|
|
|
|
#endif
|
|
|
|
NULL };
|
2022-02-14 15:36:14 +03:00
|
|
|
|
|
|
|
if (!phProvider)
|
|
|
|
return ERROR_INVALID_PARAMETER;
|
|
|
|
|
|
|
|
#if defined(WITH_OPENSC_PKCS11_LINKED)
|
2022-02-14 17:48:13 +03:00
|
|
|
if (!modulePaths)
|
|
|
|
return initialize_pkcs11(NULL, C_GetFunctionList, phProvider);
|
|
|
|
#endif
|
|
|
|
|
|
|
|
if (!modulePaths)
|
|
|
|
modulePaths = openscPaths;
|
|
|
|
|
2021-12-07 02:07:57 +03:00
|
|
|
while (*modulePaths)
|
|
|
|
{
|
2022-02-14 17:51:39 +03:00
|
|
|
HANDLE library = LoadLibrary(*modulePaths);
|
2022-11-14 13:26:11 +03:00
|
|
|
typedef CK_RV (*c_get_function_list_t)(CK_FUNCTION_LIST_PTR_PTR);
|
|
|
|
c_get_function_list_t c_get_function_list;
|
2022-02-14 15:36:14 +03:00
|
|
|
|
2022-01-17 00:28:51 +03:00
|
|
|
WLog_DBG(TAG, "Trying pkcs11-helper module '%s'", *modulePaths);
|
2022-02-14 15:36:14 +03:00
|
|
|
if (!library)
|
2021-12-07 02:07:57 +03:00
|
|
|
{
|
|
|
|
status = NTE_PROV_DLL_NOT_FOUND;
|
2022-01-17 00:28:51 +03:00
|
|
|
goto out_load_library;
|
2021-12-07 02:07:57 +03:00
|
|
|
}
|
|
|
|
|
2022-11-14 13:26:11 +03:00
|
|
|
c_get_function_list = (c_get_function_list_t)GetProcAddress(library, "C_GetFunctionList");
|
2021-12-07 02:07:57 +03:00
|
|
|
if (!c_get_function_list)
|
|
|
|
{
|
|
|
|
status = NTE_PROV_TYPE_ENTRY_BAD;
|
2022-02-14 15:36:14 +03:00
|
|
|
goto out_load_library;
|
2021-12-07 02:07:57 +03:00
|
|
|
}
|
|
|
|
|
2022-02-14 15:36:14 +03:00
|
|
|
status = initialize_pkcs11(library, c_get_function_list, phProvider);
|
|
|
|
if (status != ERROR_SUCCESS)
|
2021-12-07 02:07:57 +03:00
|
|
|
{
|
|
|
|
status = NTE_PROVIDER_DLL_FAIL;
|
2022-02-14 15:36:14 +03:00
|
|
|
goto out_load_library;
|
2021-12-07 02:07:57 +03:00
|
|
|
}
|
|
|
|
|
2022-01-17 00:28:51 +03:00
|
|
|
WLog_DBG(TAG, "module '%s' loaded", *modulePaths);
|
2021-12-07 02:07:57 +03:00
|
|
|
return ERROR_SUCCESS;
|
|
|
|
|
2022-01-17 00:28:51 +03:00
|
|
|
out_load_library:
|
2021-12-07 02:07:57 +03:00
|
|
|
modulePaths++;
|
|
|
|
}
|
2022-02-14 17:48:13 +03:00
|
|
|
|
2021-12-07 02:07:57 +03:00
|
|
|
return status;
|
|
|
|
}
|