From 0cc1b0a7b5605d86d8a8639651987e25fdb3bdc9 Mon Sep 17 00:00:00 2001 From: Rob Austein Date: Thu, 4 May 2017 02:33:40 -0400 Subject: Support using C_GetFunctionList() instead of library symbols. The Python ctypes library allows us direct access to the public symbols of a shared library, so we never bothered to implement support for using the dispatch vector returned by C_GetFunctionList(). Well, it turns out that there are useful debugging tools like pkcs11-spy which require the dispatch vector support, so refactor to add it. --- cryptech/py11/__init__.py | 109 +++++++++++++++++++++++++++------------------- 1 file changed, 63 insertions(+), 46 deletions(-) (limited to 'cryptech/py11/__init__.py') diff --git a/cryptech/py11/__init__.py b/cryptech/py11/__init__.py index 46b62d6..fb9af7e 100644 --- a/cryptech/py11/__init__.py +++ b/cryptech/py11/__init__.py @@ -11,7 +11,6 @@ from .exceptions import * from .types import * from .constants import * from .attributes import * -from .prototypes import * class PKCS11 (object): @@ -44,20 +43,37 @@ class PKCS11 (object): raw PKCS #11 API, which map the API into something a bit more Pythonic. """ + # Whether to use C_GetFunctionList() instead of dynamic link symbols. + use_C_GetFunctionList = False + def __init__(self, so_name = "libpkcs11.so"): self.so_name = so_name self.so = CDLL(so_name) - def raise_on_failure(rv): - if rv != CKR_OK: - raise CKR_Exception.ckr_map[rv] - for name, args in Prototypes.iteritems(): - func = getattr(self.so, name) - func.restype = raise_on_failure - func.argtypes = args + self.d = type("Dispatch", (object,), {})() + for name, args in Prototypes: + try: + func = getattr(self.so, name) + except AttributeError: + self.use_C_GetFunctionList = True + else: + func.restype = CK_RV + func.argtypes = args + func.errcheck = CKR_Exception.raise_on_failure + setattr(self.d, name, func) + if self.use_C_GetFunctionList: + functions = CK_FUNCTION_LIST_PTR() + self.so.C_GetFunctionList(byref(functions)) + for name, args in Prototypes: + func = getattr(functions.contents, name) + func.errcheck = CKR_Exception.raise_on_failure + setattr(self.d, name, func) self.adb = AttributeDB() def __getattr__(self, name): - return getattr(self.so, name) + try: + return getattr(self.d, name) + except AttributeError: + return getattr(self.so, name) def C_GetFunctionList(self): return self @@ -65,7 +81,7 @@ class PKCS11 (object): @property def version(self): info = CK_INFO() - self.so.C_GetInfo(byref(info)) + self.d.C_GetInfo(byref(info)) return info.cryptokiVersion # Be very careful if you try to provide your own locking functions. @@ -81,52 +97,53 @@ class PKCS11 (object): def C_Initialize(self, flags = 0, create_mutex = None, destroy_mutex = None, lock_mutex = None, unlock_mutex = None): if flags == 0 and create_mutex is None and destroy_mutex is None and lock_mutex is None and unlock_mutex is None: self._C_Initialize_args = None - self.so.C_Initialize(None) + self.d.C_Initialize(None) else: create_mutex = CK_CREATEMUTEX() if create_mutex is None else CK_CREATEMUTEX(create_mutex) destroy_mutex = CK_DESTROYMUTEX() if destroy_mutex is None else CK_DESTROYMUTEX(destroy_mutex) lock_mutex = CK_LOCKMUTEX() if lock_mutex is None else CK_LOCKMUTEX(lock_mutex) unlock_mutex = CK_UNLOCKMUTEX() if unlock_mutex is None else CK_UNLOCKMUTEX(unlock_mutex) - self._C_Initialize_args = CK_C_INITIALIZE_ARGS(create_mutex, destroy_mutex, lock_mutex, unlock_mutex, flags, None) - self.so.C_Initialize(cast(byref(self._C_Initialize_args), CK_VOID_PTR)) + self._C_Initialize_args = CK_C_INITIALIZE_ARGS(create_mutex, destroy_mutex, + lock_mutex, unlock_mutex, flags, None) + self.d.C_Initialize(cast(byref(self._C_Initialize_args), CK_VOID_PTR)) def C_Finalize(self): - self.so.C_Finalize(None) + self.d.C_Finalize(None) self._C_Initialize_args = None def C_GetSlotList(self): count = CK_ULONG() - self.so.C_GetSlotList(CK_TRUE, None, byref(count)) + self.d.C_GetSlotList(CK_TRUE, None, byref(count)) slots = (CK_SLOT_ID * count.value)() - self.so.C_GetSlotList(CK_TRUE, slots, byref(count)) + self.d.C_GetSlotList(CK_TRUE, slots, byref(count)) return tuple(slots[i] for i in xrange(count.value)) def C_GetTokenInfo(self, slot_id): token_info = CK_TOKEN_INFO() - self.so.C_GetTokenInfo(slot_id, byref(token_info)) + self.d.C_GetTokenInfo(slot_id, byref(token_info)) return token_info def C_OpenSession(self, slot, flags = CKF_RW_SESSION, application = None, notify = CK_NOTIFY()): flags |= CKF_SERIAL_SESSION handle = CK_SESSION_HANDLE() - self.so.C_OpenSession(slot, flags, application, notify, byref(handle)) + self.d.C_OpenSession(slot, flags, application, notify, byref(handle)) return handle.value def C_GenerateRandom(self, session, n): buffer = create_string_buffer(n) - self.so.C_GenerateRandom(session, buffer, sizeof(buffer)) + self.d.C_GenerateRandom(session, buffer, sizeof(buffer)) return buffer.raw def C_Login(self, session, user, pin): - self.so.C_Login(session, user, pin, len(pin)) + self.d.C_Login(session, user, pin, len(pin)) def C_GetAttributeValue(self, session_handle, object_handle, *attributes): if len(attributes) == 1 and isinstance(attributes[0], (list, tuple)): attributes = attributes[0] template = self.adb.getvalue_create_template(attributes) - self.so.C_GetAttributeValue(session_handle, object_handle, template, len(template)) + self.d.C_GetAttributeValue(session_handle, object_handle, template, len(template)) self.adb.getvalue_allocate_template(template) - self.so.C_GetAttributeValue(session_handle, object_handle, template, len(template)) + self.d.C_GetAttributeValue(session_handle, object_handle, template, len(template)) return self.adb.from_ctypes(template) def C_FindObjectsInit(self, session, template = None, **kwargs): @@ -134,15 +151,15 @@ class PKCS11 (object): assert not template template = kwargs if template: - self.so.C_FindObjectsInit(session, self.adb.to_ctypes(template), len(template)) + self.d.C_FindObjectsInit(session, self.adb.to_ctypes(template), len(template)) else: - self.so.C_FindObjectsInit(session, None, 0) + self.d.C_FindObjectsInit(session, None, 0) def C_FindObjects(self, session, chunk_size = 10): objects = (CK_OBJECT_HANDLE * chunk_size)() count = CK_ULONG(1) while count.value > 0: - self.so.C_FindObjects(session, objects, len(objects), byref(count)) + self.d.C_FindObjects(session, objects, len(objects), byref(count)) for i in xrange(count.value): yield objects[i] @@ -194,45 +211,45 @@ class PKCS11 (object): mechanism = CK_MECHANISM(mechanism_type, None, 0) public_handle = CK_OBJECT_HANDLE() private_handle = CK_OBJECT_HANDLE() - self.so.C_GenerateKeyPair(session, byref(mechanism), - public_template, len(public_template), - private_template, len(private_template), - byref(public_handle), byref(private_handle)) + self.d.C_GenerateKeyPair(session, byref(mechanism), + public_template, len(public_template), + private_template, len(private_template), + byref(public_handle), byref(private_handle)) return public_handle.value, private_handle.value def C_SignInit(self, session, mechanism_type, private_key): mechanism = CK_MECHANISM(mechanism_type, None, 0) - self.so.C_SignInit(session, byref(mechanism), private_key) + self.d.C_SignInit(session, byref(mechanism), private_key) def C_Sign(self, session, data): n = CK_ULONG() - self.so.C_Sign(session, data, len(data), None, byref(n)) + self.d.C_Sign(session, data, len(data), None, byref(n)) sig = create_string_buffer(n.value) - self.so.C_Sign(session, data, len(data), sig, byref(n)) + self.d.C_Sign(session, data, len(data), sig, byref(n)) return sig.raw def C_SignUpdate(self, session, data): - self.so.C_SignUpdate(session, data, len(data)) + self.d.C_SignUpdate(session, data, len(data)) def C_SignFinal(self, session): n = CK_ULONG() - self.so.C_SignFinal(session, None, byref(n)) + self.d.C_SignFinal(session, None, byref(n)) sig = create_string_buffer(n.value) - self.so.C_SignFinal(session, sig, byref(n)) + self.d.C_SignFinal(session, sig, byref(n)) return sig.raw def C_VerifyInit(self, session, mechanism_type, public_key): mechanism = CK_MECHANISM(mechanism_type, None, 0) - self.so.C_VerifyInit(session, byref(mechanism), public_key) + self.d.C_VerifyInit(session, byref(mechanism), public_key) def C_Verify(self, session, data, signature): - self.so.C_Verify(session, data, len(data), signature, len(signature)) + self.d.C_Verify(session, data, len(data), signature, len(signature)) def C_VerifyUpdate(self, session, data): - self.so.C_VerifyUpdate(session, data, len(data)) + self.d.C_VerifyUpdate(session, data, len(data)) def C_VerifyFinal(self, session, signature): - self.so.C_VerifyFinal(session, signature, len(signature)) + self.d.C_VerifyFinal(session, signature, len(signature)) def C_CreateObject(self, session, template = None, **kwargs): if kwargs: @@ -240,28 +257,28 @@ class PKCS11 (object): template = kwargs template = self.adb.to_ctypes(template) handle = CK_OBJECT_HANDLE() - self.so.C_CreateObject(session, template, len(template), byref(handle)) + self.d.C_CreateObject(session, template, len(template), byref(handle)) return handle.value def C_DigestInit(self, session, mechanism_type): mechanism = CK_MECHANISM(mechanism_type, None, 0) - self.so.C_DigestInit(session, byref(mechanism)) + self.d.C_DigestInit(session, byref(mechanism)) def C_Digest(self, session, data): n = CK_ULONG() - self.so.C_Digest(session, data, len(data), None, byref(n)) + self.d.C_Digest(session, data, len(data), None, byref(n)) hash = create_string_buffer(n.value) - self.so.C_Digest(session, data, len(data), hash, byref(n)) + self.d.C_Digest(session, data, len(data), hash, byref(n)) return hash.raw def C_DigestUpdate(self, session, data): - self.so.C_DigestUpdate(session, data, len(data)) + self.d.C_DigestUpdate(session, data, len(data)) def C_DigestFinal(self, session): n = CK_ULONG() - self.so.C_DigestFinal(session, None, byref(n)) + self.d.C_DigestFinal(session, None, byref(n)) hash = create_string_buffer(n.value) - self.so.C_DigestFinal(session, hash, byref(n)) + self.d.C_DigestFinal(session, hash, byref(n)) return hash.raw __all__ = ["PKCS11"] -- cgit v1.2.3