diff options
Diffstat (limited to 'py11/__init__.py')
| -rw-r--r-- | py11/__init__.py | 197 |
1 files changed, 197 insertions, 0 deletions
diff --git a/py11/__init__.py b/py11/__init__.py new file mode 100644 index 0000000..d99c1b0 --- /dev/null +++ b/py11/__init__.py @@ -0,0 +1,197 @@ +# An attempt at a Python interface to PKCS 11 using the scary ctypes +# module from the Python standard library. + +from struct import pack, unpack +from ctypes import * +from .exceptions import * +from .types import * +from .constants import * + +# Prototypes for the PKCS #11 public functions. +# +# We don't bother implementing C_GetFunctionList(), because it would +# be extremely tedious and it's not all that useful to us in Python. +# Instead, we emulate its behavior in the PKCS11 class. + +PKCS11_Prototypes = ( + ("C_Initialize", [CK_VOID_PTR]), + ("C_Finalize", [CK_VOID_PTR]), + ("C_GetInfo", [CK_INFO_PTR]), +# ("C_GetFunctionList", [CK_FUNCTION_LIST_PTR_PTR]), + ("C_GetSlotList", [CK_BBOOL, CK_SLOT_ID_PTR, CK_ULONG_PTR]), + ("C_GetSlotInfo", [CK_SLOT_ID, CK_SLOT_INFO_PTR]), + ("C_GetTokenInfo", [CK_SLOT_ID, CK_TOKEN_INFO_PTR]), + ("C_GetMechanismList", [CK_SLOT_ID, CK_MECHANISM_TYPE_PTR, CK_ULONG_PTR]), + ("C_GetMechanismInfo", [CK_SLOT_ID, CK_MECHANISM_TYPE, CK_MECHANISM_INFO_PTR]), + ("C_InitToken", [CK_SLOT_ID, CK_UTF8CHAR_PTR, CK_ULONG, CK_UTF8CHAR_PTR]), + ("C_InitPIN", [CK_SESSION_HANDLE, CK_UTF8CHAR_PTR, CK_ULONG]), + ("C_SetPIN", [CK_SESSION_HANDLE, CK_UTF8CHAR_PTR, CK_ULONG, CK_UTF8CHAR_PTR, CK_ULONG]), + ("C_OpenSession", [CK_SLOT_ID, CK_FLAGS, CK_VOID_PTR, CK_NOTIFY, CK_SESSION_HANDLE_PTR]), + ("C_CloseSession", [CK_SESSION_HANDLE]), + ("C_CloseAllSessions", [CK_SLOT_ID]), + ("C_GetSessionInfo", [CK_SESSION_HANDLE, CK_SESSION_INFO_PTR]), + ("C_GetOperationState", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_SetOperationState", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_OBJECT_HANDLE, CK_OBJECT_HANDLE]), + ("C_Login", [CK_SESSION_HANDLE, CK_USER_TYPE, CK_UTF8CHAR_PTR, CK_ULONG]), + ("C_Logout", [CK_SESSION_HANDLE]), + ("C_CreateObject", [CK_SESSION_HANDLE, CK_ATTRIBUTE_PTR, CK_ULONG, CK_OBJECT_HANDLE_PTR]), + ("C_CopyObject", [CK_SESSION_HANDLE, CK_OBJECT_HANDLE, CK_ATTRIBUTE_PTR, CK_ULONG, CK_OBJECT_HANDLE_PTR]), + ("C_DestroyObject", [CK_SESSION_HANDLE, CK_OBJECT_HANDLE]), + ("C_GetObjectSize", [CK_SESSION_HANDLE, CK_OBJECT_HANDLE, CK_ULONG_PTR]), + ("C_GetAttributeValue", [CK_SESSION_HANDLE, CK_OBJECT_HANDLE, CK_ATTRIBUTE_PTR, CK_ULONG]), + ("C_SetAttributeValue", [CK_SESSION_HANDLE, CK_OBJECT_HANDLE, CK_ATTRIBUTE_PTR, CK_ULONG]), + ("C_FindObjectsInit", [CK_SESSION_HANDLE, CK_ATTRIBUTE_PTR, CK_ULONG]), + ("C_FindObjects", [CK_SESSION_HANDLE, CK_OBJECT_HANDLE_PTR, CK_ULONG, CK_ULONG_PTR]), + ("C_FindObjectsFinal", [CK_SESSION_HANDLE]), + ("C_EncryptInit", [CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_OBJECT_HANDLE]), + ("C_Encrypt", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_EncryptUpdate", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_EncryptFinal", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_DecryptInit", [CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_OBJECT_HANDLE]), + ("C_Decrypt", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_DecryptUpdate", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_DecryptFinal", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_DigestInit", [CK_SESSION_HANDLE, CK_MECHANISM_PTR]), + ("C_Digest", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_DigestUpdate", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG]), + ("C_DigestKey", [CK_SESSION_HANDLE, CK_OBJECT_HANDLE]), + ("C_DigestFinal", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_SignInit", [CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_OBJECT_HANDLE]), + ("C_Sign", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_SignUpdate", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG]), + ("C_SignFinal", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_SignRecoverInit", [CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_OBJECT_HANDLE]), + ("C_SignRecover", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_VerifyInit", [CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_OBJECT_HANDLE]), + ("C_Verify", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, CK_ULONG]), + ("C_VerifyUpdate", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG]), + ("C_VerifyFinal", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG]), + ("C_VerifyRecoverInit", [CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_OBJECT_HANDLE]), + ("C_VerifyRecover", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_DigestEncryptUpdate", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_DecryptDigestUpdate", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_SignEncryptUpdate", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_DecryptVerifyUpdate", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_GenerateKey", [CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_ATTRIBUTE_PTR, CK_ULONG, CK_OBJECT_HANDLE_PTR]), + ("C_GenerateKeyPair", [CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_ATTRIBUTE_PTR, CK_ULONG, + CK_ATTRIBUTE_PTR, CK_ULONG, CK_OBJECT_HANDLE_PTR, CK_OBJECT_HANDLE_PTR]), + ("C_WrapKey", [CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_OBJECT_HANDLE, CK_OBJECT_HANDLE, + CK_BYTE_PTR, CK_ULONG_PTR]), + ("C_UnwrapKey", [CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_OBJECT_HANDLE, CK_BYTE_PTR, CK_ULONG, + CK_ATTRIBUTE_PTR, CK_ULONG, CK_OBJECT_HANDLE_PTR]), + ("C_DeriveKey", [CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_OBJECT_HANDLE, CK_ATTRIBUTE_PTR, CK_ULONG, + CK_OBJECT_HANDLE_PTR]), + ("C_SeedRandom", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG]), + ("C_GenerateRandom", [CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG]), + ("C_GetFunctionStatus", [CK_SESSION_HANDLE]), + ("C_CancelFunction", [CK_SESSION_HANDLE]), + ("C_WaitForSlotEvent", [CK_FLAGS, CK_SLOT_ID_PTR, CK_VOID_PTR])) + + +# Need to convert attributes between a sane Pythonic representation +# and something ctypes can handle. Pythoninc representation would be +# an iteraable of two element sequences, or perhaps a dict. + +def attributes_to_ctypes(dict_or_iterable): + if isinstance(dict_or_iterable, dict): + dict_or_iterable = dict_or_iterable.iteritems() + items = tuple(dict_or_iterable) + a = (CK_ATTRIBUTE * len(items))() + for i, kv in enumerate(items): + k, v = kv + if isinstance(v, bool): + v = pack("B", int(v)) + elif isinstance(v, (int, long)): + v = pack("L", v) + a[i].type = k + a[i].pValue = create_string_buffer(v) + a[i].ulValueLen = len(v) + return a + +class PKCS11 (object): + + def __init__(self, so_name = "libpkcs11.so"): + self.so_name = so_name + self.so = CDLL(so_name) + def raise_on_failure(rv): + if rv != CKR_OK: + raise CKR_Exception.ckr_map[rv] + for name, args in PKCS11_Prototypes: + func = getattr(self.so, name) + func.restype = raise_on_failure + func.argtypes = args + + def __getattr__(self, name): + return getattr(self.so, name) + + def C_GetFunctionList(self): + return self + + @property + def version(self): + info = CK_INFO() + self.so.C_GetInfo(byref(info)) + return info.cryptokiVersion + + def C_Initialize(self): + self.so.C_Initialize(None) + + def C_Finalize(self): + self.so.C_Finalize(None) + + def C_GetSlotList(self): + slots = (CK_SLOT_ID * 10)() + count = CK_ULONG(len(slots)) + self.so.C_GetSlotList(CK_TRUE, slots, byref(count)) + return [slots[i] for i in xrange(count.value)] + + def C_GetTokenInfo(self, slot_id): + token_info = CK_TOKEN_INFO() + self.so.C_GetTokenInfo(slot_id, byref(token_info)) + return token_info + + def C_OpenSession(self, slot, flags = CKF_SERIAL_SESSION | CKF_RW_SESSION, application = None, notify = CK_NOTIFY()): + handle = CK_SESSION_HANDLE() + self.so.C_OpenSession(slot, flags, application, notify, byref(handle)) + return handle.value + + def C_GenerateRandom(self, session, n): + buffer = create_string_buffer(n) + self.so.C_GenerateRandom(session, buffer, sizeof(buffer)) + return buffer.raw + + def C_Login(self, session, user, pin): + self.so.C_Login(session, user, pin, len(pin)) + + def C_GetAttributeValue(self, session_handle, object_handle, attributes): + if not isinstance(attributes, (list, tuple)): + attributes = tuple(attributes) + if not all(isinstance(a, (int, long)) for a in attributes): + raise TypeError + t = (CK_ATTRIBUTE * len(attributes))() + for i in xrange(len(attributes)): + t[i].type = attributes[i] + t[i].pValue = None + t[i].ulValueLen = 0 + self.so.C_GetAttributeValue(session_handle, object_handle, byref(t), len(t)) + for a in t: + a.pValue = create_string_buffer(a.ulValueLen) + self.so.C_GetAttributeValue(session_handle, object_handle, byref(t), len(t)) + return dict((a.type, a.pValue.raw) for a in t) + + def C_GenerateKeyPair(self, session, mechanism_type, public_template, private_template): + mechanism = CK_MECHANISM(mechanism_type, None, 0) + public_template = attributes_to_ctypes(public_template) + private_template = attributes_to_ctypes(private_template) + public_handle = CK_OBJECT_HANDLE() + private_handle = CK_OBJECT_HANDLE() + self.so.C_GenerateKeyPair(session, byref(mechanism), + public_template, len(public_template), + private_template, len(private_template), + byref(public_handle), byref(private_handle)) + return public_handle.value, private_handle.value + +__all__ = ["PKCS11"] +__all__.extend(name for name in globals() + if name.startswith("CK") + or name.startswith("CRYPTOKI_")) |