aboutsummaryrefslogtreecommitdiff
path: root/libhal.py
diff options
context:
space:
mode:
authorRob Austein <sra@hactrn.net>2017-04-11 00:14:59 -0400
committerRob Austein <sra@hactrn.net>2017-04-11 00:14:59 -0400
commitcc46a697de71e66e90653e3ac7fffe413acfd8c8 (patch)
treec6df3d427c9ea29b6cd71cb92a6e6a579e977076 /libhal.py
parenta90d24ee670af4e605cbd95418b000f811265c59 (diff)
API cleanup: pkey_open() and pkey_match().
pkey_open() now looks in both keystores rather than requiring the user to know. The chance of collision with randomly-generated UUID is low enough that we really ought to be able to present a single namespace. So now we do. pkey_match() now takes a couple of extra arguments which allow a single search to cover both keystores, as well as matching for specific key flags. The former interface was pretty much useless for anything involving flags, and required the user to issue a separate call for each keystore. User wheel is now exempt from the per-session key lookup constraints, Whether this is a good idea or not is an interesting question, but the whole PKCS #11 derived per-session key thing is weird to begin with, and having keystore listings on the console deliberately ignore session keys was just too confusing.
Diffstat (limited to 'libhal.py')
-rw-r--r--libhal.py17
1 files changed, 10 insertions, 7 deletions
diff --git a/libhal.py b/libhal.py
index 5a16c40..0c6b3f6 100644
--- a/libhal.py
+++ b/libhal.py
@@ -420,7 +420,8 @@ class HSM(object):
if status != 0:
raise HALError.table[status]()
- def __init__(self, sockname = os.getenv("CRYPTECH_RPC_CLIENT_SOCKET_NAME", "/tmp/.cryptech_muxd.rpc")):
+ def __init__(self, sockname = os.getenv("CRYPTECH_RPC_CLIENT_SOCKET_NAME",
+ "/tmp/.cryptech_muxd.rpc")):
self.socket = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
self.socket.connect(sockname)
self.sockfile = self.socket.makefile("rb")
@@ -561,8 +562,8 @@ class HSM(object):
logger.debug("Loaded pkey %s", pkey.uuid)
return pkey
- def pkey_open(self, uuid, flags = 0, client = 0, session = 0):
- with self.rpc(RPC_FUNC_PKEY_OPEN, session, uuid, flags, client = client) as r:
+ def pkey_open(self, uuid, client = 0, session = 0):
+ with self.rpc(RPC_FUNC_PKEY_OPEN, session, uuid, client = client) as r:
pkey = PKey(self, r.unpack_uint(), uuid)
logger.debug("Opened pkey %s", pkey.uuid)
return pkey
@@ -631,13 +632,15 @@ class HSM(object):
with self.rpc(RPC_FUNC_PKEY_VERIFY, pkey, hash, data, signature):
return
- def pkey_match(self, type = 0, curve = 0, flags = 0, attributes = {},
- length = 64, client = 0, session = 0):
+ def pkey_match(self, type = 0, curve = 0, mask = 0, flags = 0,
+ attributes = {}, length = 64, client = 0, session = 0):
u = UUID(int = 0)
n = length
+ s = 0
while n == length:
- with self.rpc(RPC_FUNC_PKEY_MATCH, session, type, curve, flags,
- attributes, length, u, client = client) as r:
+ with self.rpc(RPC_FUNC_PKEY_MATCH, session, type, curve, mask, flags,
+ attributes, s, length, u, client = client) as r:
+ s = r.unpack_uint()
n = r.unpack_uint()
for i in xrange(n):
u = UUID(bytes = r.unpack_bytes())