diff options
| -rw-r--r-- | pkcs11.c | 143 |
1 files changed, 128 insertions, 15 deletions
@@ -1394,6 +1394,95 @@ static int p11_object_pkey_type(const CK_OBJECT_HANDLE object_handle, * Fetch the libhal pkey handle for a key object. */ +static inline int p11_object_get_rsa_public_key(const p11_session_t * const session, + const CK_OBJECT_HANDLE object_handle, + hal_pkey_handle_t *pkey_handle, + const char *flavor, + const uint8_t * const name, const size_t name_len, + const hal_key_flags_t flags) +{ + static const char select_format[] = + " WITH a (type, value) " + " AS (SELECT type, value FROM %s_attribute NATURAL JOIN object WHERE object_handle = ?1)" + " SELECT a1.value, a2.value FROM a AS a1, a AS a2 WHERE a1.type = %u AND a2.type = %u"; + + uint8_t keybuf[hal_rsa_key_t_size]; + hal_rsa_key_t *key = NULL; + sqlite3_stmt *q = NULL; + + int ok + = (sql_check_ok(sql_prepare(&q, select_format, flavor, + CKA_MODULUS, CKA_PUBLIC_EXPONENT)) && + sql_check_ok(sqlite3_bind_int64(q, 1, object_handle)) && + sql_check_row(sqlite3_step(q)) && + sqlite3_column_type(q, 0) == SQLITE_BLOB && + sqlite3_column_type(q, 1) == SQLITE_BLOB && + hal_check(hal_rsa_key_load_public(&key, keybuf, sizeof(keybuf), + sqlite3_column_blob( q, 0), + sqlite3_column_bytes(q, 0), + sqlite3_column_blob( q, 1), + sqlite3_column_bytes(q, 1)))); + + if (ok) { + uint8_t der[hal_rsa_public_key_to_der_len(key)]; + ok = (hal_check(hal_rsa_public_key_to_der(key, der, NULL, sizeof(der))) && + hal_check(hal_rpc_pkey_load(p11_session_hal_client(session), + p11_session_hal_session(session), + pkey_handle, HAL_KEY_TYPE_RSA_PUBLIC, + HAL_CURVE_NONE, name, name_len, + der, sizeof(der), flags))); + } + + sqlite3_finalize(q); + return ok; +} + +static inline int p11_object_get_ec_public_key(const p11_session_t * const session, + const CK_OBJECT_HANDLE object_handle, + hal_pkey_handle_t *pkey_handle, + const char *flavor, + const uint8_t * const name, const size_t name_len, + const hal_key_flags_t flags) +{ + static const char select_format[] = + " WITH a (type, value) " + " AS (SELECT type, value FROM %s_attribute NATURAL JOIN object WHERE object_handle = ?1)" + " SELECT a1.value, a2.value FROM a AS a1, a AS a2 WHERE a1.type = %u AND a2.type = %u"; + + uint8_t keybuf[hal_ecdsa_key_t_size]; + hal_ecdsa_key_t *key = NULL; + hal_curve_name_t curve; + sqlite3_stmt *q = NULL; + + int ok + = (sql_check_ok(sql_prepare(&q, select_format, flavor, + CKA_EC_PARAMS, CKA_EC_POINT)) && + sql_check_ok(sqlite3_bind_int64(q, 1, object_handle)) && + sql_check_row(sqlite3_step(q)) && + sqlite3_column_type(q, 0) == SQLITE_BLOB && + sqlite3_column_type(q, 1) == SQLITE_BLOB && + ec_curve_oid_to_name(sqlite3_column_blob( q, 0), + sqlite3_column_bytes(q, 0), + &curve) && + hal_check(hal_ecdsa_key_from_ecpoint(&key, keybuf, sizeof(keybuf), + sqlite3_column_blob( q, 1), + sqlite3_column_bytes(q, 1), + curve))); + + if (ok) { + uint8_t der[hal_ecdsa_public_key_to_der_len(key)]; + ok = (hal_check(hal_ecdsa_public_key_to_der(key, der, NULL, sizeof(der))) && + hal_check(hal_rpc_pkey_load(p11_session_hal_client(session), + p11_session_hal_session(session), + pkey_handle, HAL_KEY_TYPE_EC_PUBLIC, + curve, name, name_len, + der, sizeof(der), flags))); + } + + sqlite3_finalize(q); + return ok; +} + static int p11_object_get_pkey_handle(const p11_session_t * const session, const CK_OBJECT_HANDLE object_handle, hal_pkey_handle_t *pkey_handle) @@ -1404,17 +1493,17 @@ static int p11_object_get_pkey_handle(const p11_session_t * const session, const char *flavor = is_token_handle(object_handle) ? "token" : "session"; + hal_key_flags_t flags = is_token_handle(object_handle) ? 0 : HAL_KEY_FLAG_PROXIMATE; hal_key_type_t pkey_type; sqlite3_stmt *q = NULL; - int ok; + hal_error_t err; + int ok = 0; assert(pkey_handle != NULL); - ok = (sql_check_ok(sql_prepare(&q, select_format, flavor, CKA_ID)) && - sql_check_ok(sqlite3_bind_int64(q, 1, object_handle)) && - sql_check_row(sqlite3_step(q))); - - if (!ok) + if (!sql_check_ok(sql_prepare(&q, select_format, flavor, CKA_ID)) || + !sql_check_ok(sqlite3_bind_int64(q, 1, object_handle)) || + !sql_check_row(sqlite3_step(q))) goto fail; switch (sqlite3_column_type(q, 1)) { @@ -1424,22 +1513,46 @@ static int p11_object_get_pkey_handle(const p11_session_t * const session, break; case SQLITE_NULL: - ok = p11_object_pkey_type(object_handle, &pkey_type); - if (!ok) + if (!p11_object_pkey_type(object_handle, &pkey_type)) goto fail; break; default: - ok = 0; goto fail; } - ok = hal_check(hal_rpc_pkey_find(p11_session_hal_client(session), - p11_session_hal_session(session), - pkey_handle, pkey_type, - sqlite3_column_blob(q, 0), - sqlite3_column_bytes(q, 0), - 0)); + err = hal_rpc_pkey_find(p11_session_hal_client(session), + p11_session_hal_session(session), + pkey_handle, pkey_type, + sqlite3_column_blob(q, 0), + sqlite3_column_bytes(q, 0), + flags); + + if (err == HAL_ERROR_KEY_NOT_FOUND) { + switch (pkey_type) { + + case HAL_KEY_TYPE_RSA_PUBLIC: + if (!p11_object_get_rsa_public_key(session, object_handle, pkey_handle, flavor, + sqlite3_column_blob(q, 0), sqlite3_column_bytes(q, 0), flags)) + goto fail; + break; + + case HAL_KEY_TYPE_EC_PUBLIC: + if (!p11_object_get_ec_public_key(session, object_handle, pkey_handle, flavor, + sqlite3_column_blob(q, 0), sqlite3_column_bytes(q, 0), flags)) + goto fail; + break; + + default: + (void) hal_check(err); + goto fail; + } + } + + else if (!hal_check(err)) + goto fail; + + ok = 1; fail: sqlite3_finalize(q); |