michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public michael@0: * License, v. 2.0. If a copy of the MPL was not distributed with this michael@0: * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ michael@0: /* michael@0: * Deal with PKCS #11 Slots. michael@0: */ michael@0: #include "seccomon.h" michael@0: #include "secmod.h" michael@0: #include "nssilock.h" michael@0: #include "secmodi.h" michael@0: #include "secmodti.h" michael@0: #include "pkcs11t.h" michael@0: #include "pk11func.h" michael@0: #include "secitem.h" michael@0: #include "secerr.h" michael@0: michael@0: #include "dev.h" michael@0: #include "dev3hack.h" michael@0: #include "pkim.h" michael@0: #include "utilpars.h" michael@0: michael@0: michael@0: /************************************************************* michael@0: * local static and global data michael@0: *************************************************************/ michael@0: michael@0: /* michael@0: * This array helps parsing between names, mechanisms, and flags. michael@0: * to make the config files understand more entries, add them michael@0: * to this table. michael@0: */ michael@0: const PK11DefaultArrayEntry PK11_DefaultArray[] = { michael@0: { "RSA", SECMOD_RSA_FLAG, CKM_RSA_PKCS }, michael@0: { "DSA", SECMOD_DSA_FLAG, CKM_DSA }, michael@0: { "ECC", SECMOD_ECC_FLAG, CKM_ECDSA }, michael@0: { "DH", SECMOD_DH_FLAG, CKM_DH_PKCS_DERIVE }, michael@0: { "RC2", SECMOD_RC2_FLAG, CKM_RC2_CBC }, michael@0: { "RC4", SECMOD_RC4_FLAG, CKM_RC4 }, michael@0: { "DES", SECMOD_DES_FLAG, CKM_DES_CBC }, michael@0: { "AES", SECMOD_AES_FLAG, CKM_AES_CBC }, michael@0: { "Camellia", SECMOD_CAMELLIA_FLAG, CKM_CAMELLIA_CBC }, michael@0: { "SEED", SECMOD_SEED_FLAG, CKM_SEED_CBC }, michael@0: { "RC5", SECMOD_RC5_FLAG, CKM_RC5_CBC }, michael@0: { "SHA-1", SECMOD_SHA1_FLAG, CKM_SHA_1 }, michael@0: /* { "SHA224", SECMOD_SHA256_FLAG, CKM_SHA224 }, */ michael@0: { "SHA256", SECMOD_SHA256_FLAG, CKM_SHA256 }, michael@0: /* { "SHA384", SECMOD_SHA512_FLAG, CKM_SHA384 }, */ michael@0: { "SHA512", SECMOD_SHA512_FLAG, CKM_SHA512 }, michael@0: { "MD5", SECMOD_MD5_FLAG, CKM_MD5 }, michael@0: { "MD2", SECMOD_MD2_FLAG, CKM_MD2 }, michael@0: { "SSL", SECMOD_SSL_FLAG, CKM_SSL3_PRE_MASTER_KEY_GEN }, michael@0: { "TLS", SECMOD_TLS_FLAG, CKM_TLS_MASTER_KEY_DERIVE }, michael@0: { "SKIPJACK", SECMOD_FORTEZZA_FLAG, CKM_SKIPJACK_CBC64 }, michael@0: { "Publicly-readable certs", SECMOD_FRIENDLY_FLAG, CKM_INVALID_MECHANISM }, michael@0: { "Random Num Generator", SECMOD_RANDOM_FLAG, CKM_FAKE_RANDOM }, michael@0: }; michael@0: const int num_pk11_default_mechanisms = michael@0: sizeof(PK11_DefaultArray) / sizeof(PK11_DefaultArray[0]); michael@0: michael@0: const PK11DefaultArrayEntry * michael@0: PK11_GetDefaultArray(int *size) michael@0: { michael@0: if (size) { michael@0: *size = num_pk11_default_mechanisms; michael@0: } michael@0: return PK11_DefaultArray; michael@0: } michael@0: michael@0: /* michael@0: * These slotlists are lists of modules which provide default support for michael@0: * a given algorithm or mechanism. michael@0: */ michael@0: static PK11SlotList michael@0: pk11_seedSlotList, michael@0: pk11_camelliaSlotList, michael@0: pk11_aesSlotList, michael@0: pk11_desSlotList, michael@0: pk11_rc4SlotList, michael@0: pk11_rc2SlotList, michael@0: pk11_rc5SlotList, michael@0: pk11_sha1SlotList, michael@0: pk11_md5SlotList, michael@0: pk11_md2SlotList, michael@0: pk11_rsaSlotList, michael@0: pk11_dsaSlotList, michael@0: pk11_dhSlotList, michael@0: pk11_ecSlotList, michael@0: pk11_ideaSlotList, michael@0: pk11_sslSlotList, michael@0: pk11_tlsSlotList, michael@0: pk11_randomSlotList, michael@0: pk11_sha256SlotList, michael@0: pk11_sha512SlotList; /* slots do SHA512 and SHA384 */ michael@0: michael@0: /************************************************************ michael@0: * Generic Slot List and Slot List element manipulations michael@0: ************************************************************/ michael@0: michael@0: /* michael@0: * allocate a new list michael@0: */ michael@0: PK11SlotList * michael@0: PK11_NewSlotList(void) michael@0: { michael@0: PK11SlotList *list; michael@0: michael@0: list = (PK11SlotList *)PORT_Alloc(sizeof(PK11SlotList)); michael@0: if (list == NULL) return NULL; michael@0: list->head = NULL; michael@0: list->tail = NULL; michael@0: list->lock = PZ_NewLock(nssILockList); michael@0: if (list->lock == NULL) { michael@0: PORT_Free(list); michael@0: return NULL; michael@0: } michael@0: michael@0: return list; michael@0: } michael@0: michael@0: /* michael@0: * free a list element when all the references go away. michael@0: */ michael@0: SECStatus michael@0: PK11_FreeSlotListElement(PK11SlotList *list, PK11SlotListElement *le) michael@0: { michael@0: PRBool freeit = PR_FALSE; michael@0: michael@0: if (list == NULL || le == NULL) { michael@0: PORT_SetError(SEC_ERROR_INVALID_ARGS); michael@0: return SECFailure; michael@0: } michael@0: michael@0: PZ_Lock(list->lock); michael@0: if (le->refCount-- == 1) { michael@0: freeit = PR_TRUE; michael@0: } michael@0: PZ_Unlock(list->lock); michael@0: if (freeit) { michael@0: PK11_FreeSlot(le->slot); michael@0: PORT_Free(le); michael@0: } michael@0: return SECSuccess; michael@0: } michael@0: michael@0: static void michael@0: pk11_FreeSlotListStatic(PK11SlotList *list) michael@0: { michael@0: PK11SlotListElement *le, *next ; michael@0: if (list == NULL) return; michael@0: michael@0: for (le = list->head ; le; le = next) { michael@0: next = le->next; michael@0: PK11_FreeSlotListElement(list,le); michael@0: } michael@0: if (list->lock) { michael@0: PZ_DestroyLock(list->lock); michael@0: } michael@0: list->lock = NULL; michael@0: list->head = NULL; michael@0: } michael@0: michael@0: /* michael@0: * if we are freeing the list, we must be the only ones with a pointer michael@0: * to the list. michael@0: */ michael@0: void michael@0: PK11_FreeSlotList(PK11SlotList *list) michael@0: { michael@0: pk11_FreeSlotListStatic(list); michael@0: PORT_Free(list); michael@0: } michael@0: michael@0: /* michael@0: * add a slot to a list michael@0: * "slot" is the slot to be added. Ownership is not transferred. michael@0: * "sorted" indicates whether or not the slot should be inserted according to michael@0: * cipherOrder of the associated module. PR_FALSE indicates that the slot michael@0: * should be inserted to the head of the list. michael@0: */ michael@0: SECStatus michael@0: PK11_AddSlotToList(PK11SlotList *list,PK11SlotInfo *slot, PRBool sorted) michael@0: { michael@0: PK11SlotListElement *le; michael@0: PK11SlotListElement *element; michael@0: michael@0: le = (PK11SlotListElement *) PORT_Alloc(sizeof(PK11SlotListElement)); michael@0: if (le == NULL) return SECFailure; michael@0: michael@0: le->slot = PK11_ReferenceSlot(slot); michael@0: le->prev = NULL; michael@0: le->refCount = 1; michael@0: PZ_Lock(list->lock); michael@0: element = list->head; michael@0: /* Insertion sort, with higher cipherOrders are sorted first in the list */ michael@0: while (element && sorted && (element->slot->module->cipherOrder > michael@0: le->slot->module->cipherOrder)) { michael@0: element = element->next; michael@0: } michael@0: if (element) { michael@0: le->prev = element->prev; michael@0: element->prev = le; michael@0: le->next = element; michael@0: } else { michael@0: le->prev = list->tail; michael@0: le->next = NULL; michael@0: list->tail = le; michael@0: } michael@0: if (le->prev) le->prev->next = le; michael@0: if (list->head == element) list->head = le; michael@0: PZ_Unlock(list->lock); michael@0: michael@0: return SECSuccess; michael@0: } michael@0: michael@0: /* michael@0: * remove a slot entry from the list michael@0: */ michael@0: SECStatus michael@0: PK11_DeleteSlotFromList(PK11SlotList *list,PK11SlotListElement *le) michael@0: { michael@0: PZ_Lock(list->lock); michael@0: if (le->prev) le->prev->next = le->next; else list->head = le->next; michael@0: if (le->next) le->next->prev = le->prev; else list->tail = le->prev; michael@0: le->next = le->prev = NULL; michael@0: PZ_Unlock(list->lock); michael@0: PK11_FreeSlotListElement(list,le); michael@0: return SECSuccess; michael@0: } michael@0: michael@0: /* michael@0: * Move a list to the end of the target list. michael@0: * NOTE: There is no locking here... This assumes BOTH lists are private copy michael@0: * lists. It also does not re-sort the target list. michael@0: */ michael@0: SECStatus michael@0: pk11_MoveListToList(PK11SlotList *target,PK11SlotList *src) michael@0: { michael@0: if (src->head == NULL) return SECSuccess; michael@0: michael@0: if (target->tail == NULL) { michael@0: target->head = src->head; michael@0: } else { michael@0: target->tail->next = src->head; michael@0: } michael@0: src->head->prev = target->tail; michael@0: target->tail = src->tail; michael@0: src->head = src->tail = NULL; michael@0: return SECSuccess; michael@0: } michael@0: michael@0: /* michael@0: * get an element from the list with a reference. You must own the list. michael@0: */ michael@0: PK11SlotListElement * michael@0: PK11_GetFirstRef(PK11SlotList *list) michael@0: { michael@0: PK11SlotListElement *le; michael@0: michael@0: le = list->head; michael@0: if (le != NULL) (le)->refCount++; michael@0: return le; michael@0: } michael@0: michael@0: /* michael@0: * get the next element from the list with a reference. You must own the list. michael@0: */ michael@0: PK11SlotListElement * michael@0: PK11_GetNextRef(PK11SlotList *list, PK11SlotListElement *le, PRBool restart) michael@0: { michael@0: PK11SlotListElement *new_le; michael@0: new_le = le->next; michael@0: if (new_le) new_le->refCount++; michael@0: PK11_FreeSlotListElement(list,le); michael@0: return new_le; michael@0: } michael@0: michael@0: /* michael@0: * get an element safely from the list. This just makes sure that if michael@0: * this element is not deleted while we deal with it. michael@0: */ michael@0: PK11SlotListElement * michael@0: PK11_GetFirstSafe(PK11SlotList *list) michael@0: { michael@0: PK11SlotListElement *le; michael@0: michael@0: PZ_Lock(list->lock); michael@0: le = list->head; michael@0: if (le != NULL) (le)->refCount++; michael@0: PZ_Unlock(list->lock); michael@0: return le; michael@0: } michael@0: michael@0: /* michael@0: * NOTE: if this element gets deleted, we can no longer safely traverse using michael@0: * it's pointers. We can either terminate the loop, or restart from the michael@0: * beginning. This is controlled by the restart option. michael@0: */ michael@0: PK11SlotListElement * michael@0: PK11_GetNextSafe(PK11SlotList *list, PK11SlotListElement *le, PRBool restart) michael@0: { michael@0: PK11SlotListElement *new_le; michael@0: PZ_Lock(list->lock); michael@0: new_le = le->next; michael@0: if (le->next == NULL) { michael@0: /* if the prev and next fields are NULL then either this element michael@0: * has been removed and we need to walk the list again (if restart michael@0: * is true) or this was the only element on the list */ michael@0: if ((le->prev == NULL) && restart && (list->head != le)) { michael@0: new_le = list->head; michael@0: } michael@0: } michael@0: if (new_le) new_le->refCount++; michael@0: PZ_Unlock(list->lock); michael@0: PK11_FreeSlotListElement(list,le); michael@0: return new_le; michael@0: } michael@0: michael@0: michael@0: /* michael@0: * Find the element that holds this slot michael@0: */ michael@0: PK11SlotListElement * michael@0: PK11_FindSlotElement(PK11SlotList *list,PK11SlotInfo *slot) michael@0: { michael@0: PK11SlotListElement *le; michael@0: michael@0: for (le = PK11_GetFirstSafe(list); le; michael@0: le = PK11_GetNextSafe(list,le,PR_TRUE)) { michael@0: if (le->slot == slot) return le; michael@0: } michael@0: return NULL; michael@0: } michael@0: michael@0: /************************************************************ michael@0: * Generic Slot Utilities michael@0: ************************************************************/ michael@0: /* michael@0: * Create a new slot structure michael@0: */ michael@0: PK11SlotInfo * michael@0: PK11_NewSlotInfo(SECMODModule *mod) michael@0: { michael@0: PK11SlotInfo *slot; michael@0: michael@0: slot = (PK11SlotInfo *)PORT_Alloc(sizeof(PK11SlotInfo)); michael@0: if (slot == NULL) return slot; michael@0: michael@0: slot->sessionLock = mod->isThreadSafe ? michael@0: PZ_NewLock(nssILockSession) : mod->refLock; michael@0: if (slot->sessionLock == NULL) { michael@0: PORT_Free(slot); michael@0: return NULL; michael@0: } michael@0: slot->freeListLock = PZ_NewLock(nssILockFreelist); michael@0: if (slot->freeListLock == NULL) { michael@0: if (mod->isThreadSafe) { michael@0: PZ_DestroyLock(slot->sessionLock); michael@0: } michael@0: PORT_Free(slot); michael@0: return NULL; michael@0: } michael@0: slot->freeSymKeysWithSessionHead = NULL; michael@0: slot->freeSymKeysHead = NULL; michael@0: slot->keyCount = 0; michael@0: slot->maxKeyCount = 0; michael@0: slot->functionList = NULL; michael@0: slot->needTest = PR_TRUE; michael@0: slot->isPerm = PR_FALSE; michael@0: slot->isHW = PR_FALSE; michael@0: slot->isInternal = PR_FALSE; michael@0: slot->isThreadSafe = PR_FALSE; michael@0: slot->disabled = PR_FALSE; michael@0: slot->series = 1; michael@0: slot->wrapKey = 0; michael@0: slot->wrapMechanism = CKM_INVALID_MECHANISM; michael@0: slot->refKeys[0] = CK_INVALID_HANDLE; michael@0: slot->reason = PK11_DIS_NONE; michael@0: slot->readOnly = PR_TRUE; michael@0: slot->needLogin = PR_FALSE; michael@0: slot->hasRandom = PR_FALSE; michael@0: slot->defRWSession = PR_FALSE; michael@0: slot->protectedAuthPath = PR_FALSE; michael@0: slot->flags = 0; michael@0: slot->session = CK_INVALID_SESSION; michael@0: slot->slotID = 0; michael@0: slot->defaultFlags = 0; michael@0: slot->refCount = 1; michael@0: slot->askpw = 0; michael@0: slot->timeout = 0; michael@0: slot->mechanismList = NULL; michael@0: slot->mechanismCount = 0; michael@0: slot->cert_array = NULL; michael@0: slot->cert_count = 0; michael@0: slot->slot_name[0] = 0; michael@0: slot->token_name[0] = 0; michael@0: PORT_Memset(slot->serial,' ',sizeof(slot->serial)); michael@0: slot->module = NULL; michael@0: slot->authTransact = 0; michael@0: slot->authTime = LL_ZERO; michael@0: slot->minPassword = 0; michael@0: slot->maxPassword = 0; michael@0: slot->hasRootCerts = PR_FALSE; michael@0: slot->nssToken = NULL; michael@0: return slot; michael@0: } michael@0: michael@0: /* create a new reference to a slot so it doesn't go away */ michael@0: PK11SlotInfo * michael@0: PK11_ReferenceSlot(PK11SlotInfo *slot) michael@0: { michael@0: PR_ATOMIC_INCREMENT(&slot->refCount); michael@0: return slot; michael@0: } michael@0: michael@0: /* Destroy all info on a slot we have built up */ michael@0: void michael@0: PK11_DestroySlot(PK11SlotInfo *slot) michael@0: { michael@0: /* free up the cached keys and sessions */ michael@0: PK11_CleanKeyList(slot); michael@0: michael@0: /* free up all the sessions on this slot */ michael@0: if (slot->functionList) { michael@0: PK11_GETTAB(slot)->C_CloseAllSessions(slot->slotID); michael@0: } michael@0: michael@0: if (slot->mechanismList) { michael@0: PORT_Free(slot->mechanismList); michael@0: } michael@0: if (slot->isThreadSafe && slot->sessionLock) { michael@0: PZ_DestroyLock(slot->sessionLock); michael@0: } michael@0: slot->sessionLock = NULL; michael@0: if (slot->freeListLock) { michael@0: PZ_DestroyLock(slot->freeListLock); michael@0: slot->freeListLock = NULL; michael@0: } michael@0: michael@0: /* finally Tell our parent module that we've gone away so it can unload */ michael@0: if (slot->module) { michael@0: SECMOD_SlotDestroyModule(slot->module,PR_TRUE); michael@0: } michael@0: michael@0: /* ok, well not quit finally... now we free the memory */ michael@0: PORT_Free(slot); michael@0: } michael@0: michael@0: michael@0: /* We're all done with the slot, free it */ michael@0: void michael@0: PK11_FreeSlot(PK11SlotInfo *slot) michael@0: { michael@0: if (PR_ATOMIC_DECREMENT(&slot->refCount) == 0) { michael@0: PK11_DestroySlot(slot); michael@0: } michael@0: } michael@0: michael@0: void michael@0: PK11_EnterSlotMonitor(PK11SlotInfo *slot) { michael@0: PZ_Lock(slot->sessionLock); michael@0: } michael@0: michael@0: void michael@0: PK11_ExitSlotMonitor(PK11SlotInfo *slot) { michael@0: PZ_Unlock(slot->sessionLock); michael@0: } michael@0: michael@0: /*********************************************************** michael@0: * Functions to find specific slots. michael@0: ***********************************************************/ michael@0: PRBool michael@0: SECMOD_HasRootCerts(void) michael@0: { michael@0: SECMODModuleList *mlp; michael@0: SECMODModuleList *modules; michael@0: SECMODListLock *moduleLock = SECMOD_GetDefaultModuleListLock(); michael@0: int i; michael@0: PRBool found = PR_FALSE; michael@0: michael@0: if (!moduleLock) { michael@0: PORT_SetError(SEC_ERROR_NOT_INITIALIZED); michael@0: return found; michael@0: } michael@0: michael@0: /* work through all the slots */ michael@0: SECMOD_GetReadLock(moduleLock); michael@0: modules = SECMOD_GetDefaultModuleList(); michael@0: for(mlp = modules; mlp != NULL; mlp = mlp->next) { michael@0: for (i=0; i < mlp->module->slotCount; i++) { michael@0: PK11SlotInfo *tmpSlot = mlp->module->slots[i]; michael@0: if (PK11_IsPresent(tmpSlot)) { michael@0: if (tmpSlot->hasRootCerts) { michael@0: found = PR_TRUE; michael@0: break; michael@0: } michael@0: } michael@0: } michael@0: if (found) break; michael@0: } michael@0: SECMOD_ReleaseReadLock(moduleLock); michael@0: michael@0: return found; michael@0: } michael@0: michael@0: /*********************************************************** michael@0: * Functions to find specific slots. michael@0: ***********************************************************/ michael@0: PK11SlotList * michael@0: PK11_FindSlotsByNames(const char *dllName, const char* slotName, michael@0: const char* tokenName, PRBool presentOnly) michael@0: { michael@0: SECMODModuleList *mlp; michael@0: SECMODModuleList *modules; michael@0: SECMODListLock *moduleLock = SECMOD_GetDefaultModuleListLock(); michael@0: int i; michael@0: PK11SlotList* slotList = NULL; michael@0: PRUint32 slotcount = 0; michael@0: SECStatus rv = SECSuccess; michael@0: michael@0: if (!moduleLock) { michael@0: PORT_SetError(SEC_ERROR_NOT_INITIALIZED); michael@0: return slotList; michael@0: } michael@0: michael@0: slotList = PK11_NewSlotList(); michael@0: if (!slotList) { michael@0: PORT_SetError(SEC_ERROR_NO_MEMORY); michael@0: return slotList; michael@0: } michael@0: michael@0: if ( ((NULL == dllName) || (0 == *dllName)) && michael@0: ((NULL == slotName) || (0 == *slotName)) && michael@0: ((NULL == tokenName) || (0 == *tokenName)) ) { michael@0: /* default to softoken */ michael@0: PK11_AddSlotToList(slotList, PK11_GetInternalKeySlot(), PR_TRUE); michael@0: return slotList; michael@0: } michael@0: michael@0: /* work through all the slots */ michael@0: SECMOD_GetReadLock(moduleLock); michael@0: modules = SECMOD_GetDefaultModuleList(); michael@0: for (mlp = modules; mlp != NULL; mlp = mlp->next) { michael@0: PORT_Assert(mlp->module); michael@0: if (!mlp->module) { michael@0: rv = SECFailure; michael@0: break; michael@0: } michael@0: if ((!dllName) || (mlp->module->dllName && michael@0: (0 == PORT_Strcmp(mlp->module->dllName, dllName)))) { michael@0: for (i=0; i < mlp->module->slotCount; i++) { michael@0: PK11SlotInfo *tmpSlot = (mlp->module->slots?mlp->module->slots[i]:NULL); michael@0: PORT_Assert(tmpSlot); michael@0: if (!tmpSlot) { michael@0: rv = SECFailure; michael@0: break; michael@0: } michael@0: if ((PR_FALSE == presentOnly || PK11_IsPresent(tmpSlot)) && michael@0: ( (!tokenName) || (tmpSlot->token_name && michael@0: (0==PORT_Strcmp(tmpSlot->token_name, tokenName)))) && michael@0: ( (!slotName) || (tmpSlot->slot_name && michael@0: (0==PORT_Strcmp(tmpSlot->slot_name, slotName)))) ) { michael@0: if (tmpSlot) { michael@0: PK11_AddSlotToList(slotList, tmpSlot, PR_TRUE); michael@0: slotcount++; michael@0: } michael@0: } michael@0: } michael@0: } michael@0: } michael@0: SECMOD_ReleaseReadLock(moduleLock); michael@0: michael@0: if ( (0 == slotcount) || (SECFailure == rv) ) { michael@0: PORT_SetError(SEC_ERROR_NO_TOKEN); michael@0: PK11_FreeSlotList(slotList); michael@0: slotList = NULL; michael@0: } michael@0: michael@0: if (SECFailure == rv) { michael@0: PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); michael@0: } michael@0: michael@0: return slotList; michael@0: } michael@0: michael@0: PK11SlotInfo * michael@0: PK11_FindSlotByName(const char *name) michael@0: { michael@0: SECMODModuleList *mlp; michael@0: SECMODModuleList *modules; michael@0: SECMODListLock *moduleLock = SECMOD_GetDefaultModuleListLock(); michael@0: int i; michael@0: PK11SlotInfo *slot = NULL; michael@0: michael@0: if (!moduleLock) { michael@0: PORT_SetError(SEC_ERROR_NOT_INITIALIZED); michael@0: return slot; michael@0: } michael@0: if ((name == NULL) || (*name == 0)) { michael@0: return PK11_GetInternalKeySlot(); michael@0: } michael@0: michael@0: /* work through all the slots */ michael@0: SECMOD_GetReadLock(moduleLock); michael@0: modules = SECMOD_GetDefaultModuleList(); michael@0: for(mlp = modules; mlp != NULL; mlp = mlp->next) { michael@0: for (i=0; i < mlp->module->slotCount; i++) { michael@0: PK11SlotInfo *tmpSlot = mlp->module->slots[i]; michael@0: if (PK11_IsPresent(tmpSlot)) { michael@0: if (PORT_Strcmp(tmpSlot->token_name,name) == 0) { michael@0: slot = PK11_ReferenceSlot(tmpSlot); michael@0: break; michael@0: } michael@0: } michael@0: } michael@0: if (slot != NULL) break; michael@0: } michael@0: SECMOD_ReleaseReadLock(moduleLock); michael@0: michael@0: if (slot == NULL) { michael@0: PORT_SetError(SEC_ERROR_NO_TOKEN); michael@0: } michael@0: michael@0: return slot; michael@0: } michael@0: michael@0: michael@0: PK11SlotInfo * michael@0: PK11_FindSlotBySerial(char *serial) michael@0: { michael@0: SECMODModuleList *mlp; michael@0: SECMODModuleList *modules; michael@0: SECMODListLock *moduleLock = SECMOD_GetDefaultModuleListLock(); michael@0: int i; michael@0: PK11SlotInfo *slot = NULL; michael@0: michael@0: if (!moduleLock) { michael@0: PORT_SetError(SEC_ERROR_NOT_INITIALIZED); michael@0: return slot; michael@0: } michael@0: /* work through all the slots */ michael@0: SECMOD_GetReadLock(moduleLock); michael@0: modules = SECMOD_GetDefaultModuleList(); michael@0: for(mlp = modules; mlp != NULL; mlp = mlp->next) { michael@0: for (i=0; i < mlp->module->slotCount; i++) { michael@0: PK11SlotInfo *tmpSlot = mlp->module->slots[i]; michael@0: if (PK11_IsPresent(tmpSlot)) { michael@0: if (PORT_Memcmp(tmpSlot->serial,serial, michael@0: sizeof(tmpSlot->serial)) == 0) { michael@0: slot = PK11_ReferenceSlot(tmpSlot); michael@0: break; michael@0: } michael@0: } michael@0: } michael@0: if (slot != NULL) break; michael@0: } michael@0: SECMOD_ReleaseReadLock(moduleLock); michael@0: michael@0: if (slot == NULL) { michael@0: PORT_SetError(SEC_ERROR_NO_TOKEN); michael@0: } michael@0: michael@0: return slot; michael@0: } michael@0: michael@0: /* michael@0: * notification stub. If we ever get interested in any events that michael@0: * the pkcs11 functions may pass back to use, we can catch them here... michael@0: * currently pdata is a slotinfo structure. michael@0: */ michael@0: CK_RV pk11_notify(CK_SESSION_HANDLE session, CK_NOTIFICATION event, michael@0: CK_VOID_PTR pdata) michael@0: { michael@0: return CKR_OK; michael@0: } michael@0: michael@0: /* michael@0: * grab a new RW session michael@0: * !!! has a side effect of grabbing the Monitor if either the slot's default michael@0: * session is RW or the slot is not thread safe. Monitor is release in function michael@0: * below michael@0: */ michael@0: CK_SESSION_HANDLE PK11_GetRWSession(PK11SlotInfo *slot) michael@0: { michael@0: CK_SESSION_HANDLE rwsession; michael@0: CK_RV crv; michael@0: PRBool haveMonitor = PR_FALSE; michael@0: michael@0: if (!slot->isThreadSafe || slot->defRWSession) { michael@0: PK11_EnterSlotMonitor(slot); michael@0: haveMonitor = PR_TRUE; michael@0: } michael@0: if (slot->defRWSession) { michael@0: PORT_Assert(slot->session != CK_INVALID_SESSION); michael@0: if (slot->session != CK_INVALID_SESSION) michael@0: return slot->session; michael@0: } michael@0: michael@0: crv = PK11_GETTAB(slot)->C_OpenSession(slot->slotID, michael@0: CKF_RW_SESSION|CKF_SERIAL_SESSION, michael@0: slot, pk11_notify,&rwsession); michael@0: PORT_Assert(rwsession != CK_INVALID_SESSION || crv != CKR_OK); michael@0: if (crv != CKR_OK || rwsession == CK_INVALID_SESSION) { michael@0: if (crv == CKR_OK) michael@0: crv = CKR_DEVICE_ERROR; michael@0: if (haveMonitor) michael@0: PK11_ExitSlotMonitor(slot); michael@0: PORT_SetError(PK11_MapError(crv)); michael@0: return CK_INVALID_SESSION; michael@0: } michael@0: if (slot->defRWSession) { /* we have the monitor */ michael@0: slot->session = rwsession; michael@0: } michael@0: return rwsession; michael@0: } michael@0: michael@0: PRBool michael@0: PK11_RWSessionHasLock(PK11SlotInfo *slot,CK_SESSION_HANDLE session_handle) michael@0: { michael@0: PRBool hasLock; michael@0: hasLock = (PRBool)(!slot->isThreadSafe || michael@0: (slot->defRWSession && slot->session != CK_INVALID_SESSION)); michael@0: return hasLock; michael@0: } michael@0: michael@0: static PRBool michael@0: pk11_RWSessionIsDefault(PK11SlotInfo *slot,CK_SESSION_HANDLE rwsession) michael@0: { michael@0: PRBool isDefault; michael@0: isDefault = (PRBool)(slot->session == rwsession && michael@0: slot->defRWSession && michael@0: slot->session != CK_INVALID_SESSION); michael@0: return isDefault; michael@0: } michael@0: michael@0: /* michael@0: * close the rwsession and restore our readonly session michael@0: * !!! has a side effect of releasing the Monitor if either the slot's default michael@0: * session is RW or the slot is not thread safe. michael@0: */ michael@0: void michael@0: PK11_RestoreROSession(PK11SlotInfo *slot,CK_SESSION_HANDLE rwsession) michael@0: { michael@0: PORT_Assert(rwsession != CK_INVALID_SESSION); michael@0: if (rwsession != CK_INVALID_SESSION) { michael@0: PRBool doExit = PK11_RWSessionHasLock(slot, rwsession); michael@0: if (!pk11_RWSessionIsDefault(slot, rwsession)) michael@0: PK11_GETTAB(slot)->C_CloseSession(rwsession); michael@0: if (doExit) michael@0: PK11_ExitSlotMonitor(slot); michael@0: } michael@0: } michael@0: michael@0: /************************************************************ michael@0: * Manage the built-In Slot Lists michael@0: ************************************************************/ michael@0: michael@0: /* Init the static built int slot list (should actually integrate michael@0: * with PK11_NewSlotList */ michael@0: static void michael@0: pk11_InitSlotListStatic(PK11SlotList *list) michael@0: { michael@0: list->lock = PZ_NewLock(nssILockList); michael@0: list->head = NULL; michael@0: } michael@0: michael@0: michael@0: /* initialize the system slotlists */ michael@0: SECStatus michael@0: PK11_InitSlotLists(void) michael@0: { michael@0: pk11_InitSlotListStatic(&pk11_seedSlotList); michael@0: pk11_InitSlotListStatic(&pk11_camelliaSlotList); michael@0: pk11_InitSlotListStatic(&pk11_aesSlotList); michael@0: pk11_InitSlotListStatic(&pk11_desSlotList); michael@0: pk11_InitSlotListStatic(&pk11_rc4SlotList); michael@0: pk11_InitSlotListStatic(&pk11_rc2SlotList); michael@0: pk11_InitSlotListStatic(&pk11_rc5SlotList); michael@0: pk11_InitSlotListStatic(&pk11_md5SlotList); michael@0: pk11_InitSlotListStatic(&pk11_md2SlotList); michael@0: pk11_InitSlotListStatic(&pk11_sha1SlotList); michael@0: pk11_InitSlotListStatic(&pk11_rsaSlotList); michael@0: pk11_InitSlotListStatic(&pk11_dsaSlotList); michael@0: pk11_InitSlotListStatic(&pk11_dhSlotList); michael@0: pk11_InitSlotListStatic(&pk11_ecSlotList); michael@0: pk11_InitSlotListStatic(&pk11_ideaSlotList); michael@0: pk11_InitSlotListStatic(&pk11_sslSlotList); michael@0: pk11_InitSlotListStatic(&pk11_tlsSlotList); michael@0: pk11_InitSlotListStatic(&pk11_randomSlotList); michael@0: pk11_InitSlotListStatic(&pk11_sha256SlotList); michael@0: pk11_InitSlotListStatic(&pk11_sha512SlotList); michael@0: return SECSuccess; michael@0: } michael@0: michael@0: void michael@0: PK11_DestroySlotLists(void) michael@0: { michael@0: pk11_FreeSlotListStatic(&pk11_seedSlotList); michael@0: pk11_FreeSlotListStatic(&pk11_camelliaSlotList); michael@0: pk11_FreeSlotListStatic(&pk11_aesSlotList); michael@0: pk11_FreeSlotListStatic(&pk11_desSlotList); michael@0: pk11_FreeSlotListStatic(&pk11_rc4SlotList); michael@0: pk11_FreeSlotListStatic(&pk11_rc2SlotList); michael@0: pk11_FreeSlotListStatic(&pk11_rc5SlotList); michael@0: pk11_FreeSlotListStatic(&pk11_md5SlotList); michael@0: pk11_FreeSlotListStatic(&pk11_md2SlotList); michael@0: pk11_FreeSlotListStatic(&pk11_sha1SlotList); michael@0: pk11_FreeSlotListStatic(&pk11_rsaSlotList); michael@0: pk11_FreeSlotListStatic(&pk11_dsaSlotList); michael@0: pk11_FreeSlotListStatic(&pk11_dhSlotList); michael@0: pk11_FreeSlotListStatic(&pk11_ecSlotList); michael@0: pk11_FreeSlotListStatic(&pk11_ideaSlotList); michael@0: pk11_FreeSlotListStatic(&pk11_sslSlotList); michael@0: pk11_FreeSlotListStatic(&pk11_tlsSlotList); michael@0: pk11_FreeSlotListStatic(&pk11_randomSlotList); michael@0: pk11_FreeSlotListStatic(&pk11_sha256SlotList); michael@0: pk11_FreeSlotListStatic(&pk11_sha512SlotList); michael@0: return; michael@0: } michael@0: michael@0: /* return a system slot list based on mechanism */ michael@0: PK11SlotList * michael@0: PK11_GetSlotList(CK_MECHANISM_TYPE type) michael@0: { michael@0: /* XXX a workaround for Bugzilla bug #55267 */ michael@0: #if defined(HPUX) && defined(__LP64__) michael@0: if (CKM_INVALID_MECHANISM == type) michael@0: return NULL; michael@0: #endif michael@0: switch (type) { michael@0: case CKM_SEED_CBC: michael@0: case CKM_SEED_ECB: michael@0: return &pk11_seedSlotList; michael@0: case CKM_CAMELLIA_CBC: michael@0: case CKM_CAMELLIA_ECB: michael@0: return &pk11_camelliaSlotList; michael@0: case CKM_AES_CBC: michael@0: case CKM_AES_CCM: michael@0: case CKM_AES_CTR: michael@0: case CKM_AES_CTS: michael@0: case CKM_AES_GCM: michael@0: case CKM_AES_ECB: michael@0: return &pk11_aesSlotList; michael@0: case CKM_DES_CBC: michael@0: case CKM_DES_ECB: michael@0: case CKM_DES3_ECB: michael@0: case CKM_DES3_CBC: michael@0: return &pk11_desSlotList; michael@0: case CKM_RC4: michael@0: return &pk11_rc4SlotList; michael@0: case CKM_RC5_CBC: michael@0: return &pk11_rc5SlotList; michael@0: case CKM_SHA_1: michael@0: return &pk11_sha1SlotList; michael@0: case CKM_SHA224: michael@0: case CKM_SHA256: michael@0: return &pk11_sha256SlotList; michael@0: case CKM_SHA384: michael@0: case CKM_SHA512: michael@0: return &pk11_sha512SlotList; michael@0: case CKM_MD5: michael@0: return &pk11_md5SlotList; michael@0: case CKM_MD2: michael@0: return &pk11_md2SlotList; michael@0: case CKM_RC2_ECB: michael@0: case CKM_RC2_CBC: michael@0: return &pk11_rc2SlotList; michael@0: case CKM_RSA_PKCS: michael@0: case CKM_RSA_PKCS_KEY_PAIR_GEN: michael@0: case CKM_RSA_X_509: michael@0: return &pk11_rsaSlotList; michael@0: case CKM_DSA: michael@0: return &pk11_dsaSlotList; michael@0: case CKM_DH_PKCS_KEY_PAIR_GEN: michael@0: case CKM_DH_PKCS_DERIVE: michael@0: return &pk11_dhSlotList; michael@0: case CKM_ECDSA: michael@0: case CKM_ECDSA_SHA1: michael@0: case CKM_EC_KEY_PAIR_GEN: /* aka CKM_ECDSA_KEY_PAIR_GEN */ michael@0: case CKM_ECDH1_DERIVE: michael@0: return &pk11_ecSlotList; michael@0: case CKM_SSL3_PRE_MASTER_KEY_GEN: michael@0: case CKM_SSL3_MASTER_KEY_DERIVE: michael@0: case CKM_SSL3_SHA1_MAC: michael@0: case CKM_SSL3_MD5_MAC: michael@0: return &pk11_sslSlotList; michael@0: case CKM_TLS_MASTER_KEY_DERIVE: michael@0: case CKM_TLS_KEY_AND_MAC_DERIVE: michael@0: case CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256: michael@0: return &pk11_tlsSlotList; michael@0: case CKM_IDEA_CBC: michael@0: case CKM_IDEA_ECB: michael@0: return &pk11_ideaSlotList; michael@0: case CKM_FAKE_RANDOM: michael@0: return &pk11_randomSlotList; michael@0: } michael@0: return NULL; michael@0: } michael@0: michael@0: /* michael@0: * load the static SlotInfo structures used to select a PKCS11 slot. michael@0: * preSlotInfo has a list of all the default flags for the slots on this michael@0: * module. michael@0: */ michael@0: void michael@0: PK11_LoadSlotList(PK11SlotInfo *slot, PK11PreSlotInfo *psi, int count) michael@0: { michael@0: int i; michael@0: michael@0: for (i=0; i < count; i++) { michael@0: if (psi[i].slotID == slot->slotID) michael@0: break; michael@0: } michael@0: michael@0: if (i == count) return; michael@0: michael@0: slot->defaultFlags = psi[i].defaultFlags; michael@0: slot->askpw = psi[i].askpw; michael@0: slot->timeout = psi[i].timeout; michael@0: slot->hasRootCerts = psi[i].hasRootCerts; michael@0: michael@0: /* if the slot is already disabled, don't load them into the michael@0: * default slot lists. We get here so we can save the default michael@0: * list value. */ michael@0: if (slot->disabled) return; michael@0: michael@0: /* if the user has disabled us, don't load us in */ michael@0: if (slot->defaultFlags & PK11_DISABLE_FLAG) { michael@0: slot->disabled = PR_TRUE; michael@0: slot->reason = PK11_DIS_USER_SELECTED; michael@0: /* free up sessions and things?? */ michael@0: return; michael@0: } michael@0: michael@0: for (i=0; i < num_pk11_default_mechanisms; i++) { michael@0: if (slot->defaultFlags & PK11_DefaultArray[i].flag) { michael@0: CK_MECHANISM_TYPE mechanism = PK11_DefaultArray[i].mechanism; michael@0: PK11SlotList *slotList = PK11_GetSlotList(mechanism); michael@0: michael@0: if (slotList) PK11_AddSlotToList(slotList,slot,PR_FALSE); michael@0: } michael@0: } michael@0: michael@0: return; michael@0: } michael@0: michael@0: michael@0: /* michael@0: * update a slot to its new attribute according to the slot list michael@0: * returns: SECSuccess if nothing to do or add/delete is successful michael@0: */ michael@0: SECStatus michael@0: PK11_UpdateSlotAttribute(PK11SlotInfo *slot, michael@0: const PK11DefaultArrayEntry *entry, michael@0: PRBool add) michael@0: /* add: PR_TRUE if want to turn on */ michael@0: { michael@0: SECStatus result = SECSuccess; michael@0: PK11SlotList *slotList = PK11_GetSlotList(entry->mechanism); michael@0: michael@0: if (add) { /* trying to turn on a mechanism */ michael@0: michael@0: /* turn on the default flag in the slot */ michael@0: slot->defaultFlags |= entry->flag; michael@0: michael@0: /* add this slot to the list */ michael@0: if (slotList!=NULL) michael@0: result = PK11_AddSlotToList(slotList, slot, PR_FALSE); michael@0: michael@0: } else { /* trying to turn off */ michael@0: michael@0: /* turn OFF the flag in the slot */ michael@0: slot->defaultFlags &= ~entry->flag; michael@0: michael@0: if (slotList) { michael@0: /* find the element in the list & delete it */ michael@0: PK11SlotListElement *le = PK11_FindSlotElement(slotList, slot); michael@0: michael@0: /* remove the slot from the list */ michael@0: if (le) michael@0: result = PK11_DeleteSlotFromList(slotList, le); michael@0: } michael@0: } michael@0: return result; michael@0: } michael@0: michael@0: /* michael@0: * clear a slot off of all of it's default list michael@0: */ michael@0: void michael@0: PK11_ClearSlotList(PK11SlotInfo *slot) michael@0: { michael@0: int i; michael@0: michael@0: if (slot->disabled) return; michael@0: if (slot->defaultFlags == 0) return; michael@0: michael@0: for (i=0; i < num_pk11_default_mechanisms; i++) { michael@0: if (slot->defaultFlags & PK11_DefaultArray[i].flag) { michael@0: CK_MECHANISM_TYPE mechanism = PK11_DefaultArray[i].mechanism; michael@0: PK11SlotList *slotList = PK11_GetSlotList(mechanism); michael@0: PK11SlotListElement *le = NULL; michael@0: michael@0: if (slotList) le = PK11_FindSlotElement(slotList,slot); michael@0: michael@0: if (le) { michael@0: PK11_DeleteSlotFromList(slotList,le); michael@0: PK11_FreeSlotListElement(slotList,le); michael@0: } michael@0: } michael@0: } michael@0: } michael@0: michael@0: michael@0: /****************************************************************** michael@0: * Slot initialization michael@0: ******************************************************************/ michael@0: /* michael@0: * turn a PKCS11 Static Label into a string michael@0: */ michael@0: char * michael@0: PK11_MakeString(PLArenaPool *arena,char *space, michael@0: char *staticString,int stringLen) michael@0: { michael@0: int i; michael@0: char *newString; michael@0: for(i=(stringLen-1); i >= 0; i--) { michael@0: if (staticString[i] != ' ') break; michael@0: } michael@0: /* move i to point to the last space */ michael@0: i++; michael@0: if (arena) { michael@0: newString = (char*)PORT_ArenaAlloc(arena,i+1 /* space for NULL */); michael@0: } else if (space) { michael@0: newString = space; michael@0: } else { michael@0: newString = (char*)PORT_Alloc(i+1 /* space for NULL */); michael@0: } michael@0: if (newString == NULL) return NULL; michael@0: michael@0: if (i) PORT_Memcpy(newString,staticString, i); michael@0: newString[i] = 0; michael@0: michael@0: return newString; michael@0: } michael@0: michael@0: /* michael@0: * Reads in the slots mechanism list for later use michael@0: */ michael@0: SECStatus michael@0: PK11_ReadMechanismList(PK11SlotInfo *slot) michael@0: { michael@0: CK_ULONG count; michael@0: CK_RV crv; michael@0: PRUint32 i; michael@0: michael@0: if (slot->mechanismList) { michael@0: PORT_Free(slot->mechanismList); michael@0: slot->mechanismList = NULL; michael@0: } michael@0: slot->mechanismCount = 0; michael@0: michael@0: if (!slot->isThreadSafe) PK11_EnterSlotMonitor(slot); michael@0: crv = PK11_GETTAB(slot)->C_GetMechanismList(slot->slotID,NULL,&count); michael@0: if (crv != CKR_OK) { michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: PORT_SetError(PK11_MapError(crv)); michael@0: return SECFailure; michael@0: } michael@0: michael@0: slot->mechanismList = (CK_MECHANISM_TYPE *) michael@0: PORT_Alloc(count *sizeof(CK_MECHANISM_TYPE)); michael@0: if (slot->mechanismList == NULL) { michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: return SECFailure; michael@0: } michael@0: crv = PK11_GETTAB(slot)->C_GetMechanismList(slot->slotID, michael@0: slot->mechanismList, &count); michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: if (crv != CKR_OK) { michael@0: PORT_Free(slot->mechanismList); michael@0: slot->mechanismList = NULL; michael@0: PORT_SetError(PK11_MapError(crv)); michael@0: return SECSuccess; michael@0: } michael@0: slot->mechanismCount = count; michael@0: PORT_Memset(slot->mechanismBits, 0, sizeof(slot->mechanismBits)); michael@0: michael@0: for (i=0; i < count; i++) { michael@0: CK_MECHANISM_TYPE mech = slot->mechanismList[i]; michael@0: if (mech < 0x7ff) { michael@0: slot->mechanismBits[mech & 0xff] |= 1 << (mech >> 8); michael@0: } michael@0: } michael@0: return SECSuccess; michael@0: } michael@0: michael@0: /* michael@0: * initialize a new token michael@0: * unlike initialize slot, this can be called multiple times in the lifetime michael@0: * of NSS. It reads the information associated with a card or token, michael@0: * that is not going to change unless the card or token changes. michael@0: */ michael@0: SECStatus michael@0: PK11_InitToken(PK11SlotInfo *slot, PRBool loadCerts) michael@0: { michael@0: CK_TOKEN_INFO tokenInfo; michael@0: CK_RV crv; michael@0: char *tmp; michael@0: SECStatus rv; michael@0: PRStatus status; michael@0: michael@0: /* set the slot flags to the current token values */ michael@0: if (!slot->isThreadSafe) PK11_EnterSlotMonitor(slot); michael@0: crv = PK11_GETTAB(slot)->C_GetTokenInfo(slot->slotID,&tokenInfo); michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: if (crv != CKR_OK) { michael@0: PORT_SetError(PK11_MapError(crv)); michael@0: return SECFailure; michael@0: } michael@0: michael@0: /* set the slot flags to the current token values */ michael@0: slot->series++; /* allow other objects to detect that the michael@0: * slot is different */ michael@0: slot->flags = tokenInfo.flags; michael@0: slot->needLogin = ((tokenInfo.flags & CKF_LOGIN_REQUIRED) ? michael@0: PR_TRUE : PR_FALSE); michael@0: slot->readOnly = ((tokenInfo.flags & CKF_WRITE_PROTECTED) ? michael@0: PR_TRUE : PR_FALSE); michael@0: michael@0: michael@0: slot->hasRandom = ((tokenInfo.flags & CKF_RNG) ? PR_TRUE : PR_FALSE); michael@0: slot->protectedAuthPath = michael@0: ((tokenInfo.flags & CKF_PROTECTED_AUTHENTICATION_PATH) michael@0: ? PR_TRUE : PR_FALSE); michael@0: slot->lastLoginCheck = 0; michael@0: slot->lastState = 0; michael@0: /* on some platforms Active Card incorrectly sets the michael@0: * CKF_PROTECTED_AUTHENTICATION_PATH bit when it doesn't mean to. */ michael@0: if (slot->isActiveCard) { michael@0: slot->protectedAuthPath = PR_FALSE; michael@0: } michael@0: tmp = PK11_MakeString(NULL,slot->token_name, michael@0: (char *)tokenInfo.label, sizeof(tokenInfo.label)); michael@0: slot->minPassword = tokenInfo.ulMinPinLen; michael@0: slot->maxPassword = tokenInfo.ulMaxPinLen; michael@0: PORT_Memcpy(slot->serial,tokenInfo.serialNumber,sizeof(slot->serial)); michael@0: michael@0: nssToken_UpdateName(slot->nssToken); michael@0: michael@0: slot->defRWSession = (PRBool)((!slot->readOnly) && michael@0: (tokenInfo.ulMaxSessionCount == 1)); michael@0: rv = PK11_ReadMechanismList(slot); michael@0: if (rv != SECSuccess) return rv; michael@0: michael@0: slot->hasRSAInfo = PR_FALSE; michael@0: slot->RSAInfoFlags = 0; michael@0: michael@0: /* initialize the maxKeyCount value */ michael@0: if (tokenInfo.ulMaxSessionCount == 0) { michael@0: slot->maxKeyCount = 800; /* should be #define or a config param */ michael@0: } else if (tokenInfo.ulMaxSessionCount < 20) { michael@0: /* don't have enough sessions to keep that many keys around */ michael@0: slot->maxKeyCount = 0; michael@0: } else { michael@0: slot->maxKeyCount = tokenInfo.ulMaxSessionCount/2; michael@0: } michael@0: michael@0: /* Make sure our session handle is valid */ michael@0: if (slot->session == CK_INVALID_SESSION) { michael@0: /* we know we don't have a valid session, go get one */ michael@0: CK_SESSION_HANDLE session; michael@0: michael@0: /* session should be Readonly, serial */ michael@0: if (!slot->isThreadSafe) PK11_EnterSlotMonitor(slot); michael@0: crv = PK11_GETTAB(slot)->C_OpenSession(slot->slotID, michael@0: (slot->defRWSession ? CKF_RW_SESSION : 0) | CKF_SERIAL_SESSION, michael@0: slot,pk11_notify,&session); michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: if (crv != CKR_OK) { michael@0: PORT_SetError(PK11_MapError(crv)); michael@0: return SECFailure; michael@0: } michael@0: slot->session = session; michael@0: } else { michael@0: /* The session we have may be defunct (the token associated with it) michael@0: * has been removed */ michael@0: CK_SESSION_INFO sessionInfo; michael@0: michael@0: if (!slot->isThreadSafe) PK11_EnterSlotMonitor(slot); michael@0: crv = PK11_GETTAB(slot)->C_GetSessionInfo(slot->session,&sessionInfo); michael@0: if (crv == CKR_DEVICE_ERROR) { michael@0: PK11_GETTAB(slot)->C_CloseSession(slot->session); michael@0: crv = CKR_SESSION_CLOSED; michael@0: } michael@0: if ((crv==CKR_SESSION_CLOSED) || (crv==CKR_SESSION_HANDLE_INVALID)) { michael@0: crv =PK11_GETTAB(slot)->C_OpenSession(slot->slotID, michael@0: (slot->defRWSession ? CKF_RW_SESSION : 0) | CKF_SERIAL_SESSION, michael@0: slot,pk11_notify,&slot->session); michael@0: if (crv != CKR_OK) { michael@0: PORT_SetError(PK11_MapError(crv)); michael@0: slot->session = CK_INVALID_SESSION; michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: return SECFailure; michael@0: } michael@0: } michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: } michael@0: michael@0: status = nssToken_Refresh(slot->nssToken); michael@0: if (status != PR_SUCCESS) michael@0: return SECFailure; michael@0: michael@0: if (!(slot->isInternal) && (slot->hasRandom)) { michael@0: /* if this slot has a random number generater, use it to add entropy michael@0: * to the internal slot. */ michael@0: PK11SlotInfo *int_slot = PK11_GetInternalSlot(); michael@0: michael@0: if (int_slot) { michael@0: unsigned char random_bytes[32]; michael@0: michael@0: /* if this slot can issue random numbers, get some entropy from michael@0: * that random number generater and give it to our internal token. michael@0: */ michael@0: PK11_EnterSlotMonitor(slot); michael@0: crv = PK11_GETTAB(slot)->C_GenerateRandom michael@0: (slot->session,random_bytes, sizeof(random_bytes)); michael@0: PK11_ExitSlotMonitor(slot); michael@0: if (crv == CKR_OK) { michael@0: PK11_EnterSlotMonitor(int_slot); michael@0: PK11_GETTAB(int_slot)->C_SeedRandom(int_slot->session, michael@0: random_bytes, sizeof(random_bytes)); michael@0: PK11_ExitSlotMonitor(int_slot); michael@0: } michael@0: michael@0: /* Now return the favor and send entropy to the token's random michael@0: * number generater */ michael@0: PK11_EnterSlotMonitor(int_slot); michael@0: crv = PK11_GETTAB(int_slot)->C_GenerateRandom(int_slot->session, michael@0: random_bytes, sizeof(random_bytes)); michael@0: PK11_ExitSlotMonitor(int_slot); michael@0: if (crv == CKR_OK) { michael@0: PK11_EnterSlotMonitor(slot); michael@0: crv = PK11_GETTAB(slot)->C_SeedRandom(slot->session, michael@0: random_bytes, sizeof(random_bytes)); michael@0: PK11_ExitSlotMonitor(slot); michael@0: } michael@0: PK11_FreeSlot(int_slot); michael@0: } michael@0: } michael@0: /* work around a problem in softoken where it incorrectly michael@0: * reports databases opened read only as read/write. */ michael@0: if (slot->isInternal && !slot->readOnly) { michael@0: CK_SESSION_HANDLE session = CK_INVALID_SESSION; michael@0: michael@0: /* try to open a R/W session */ michael@0: crv =PK11_GETTAB(slot)->C_OpenSession(slot->slotID, michael@0: CKF_RW_SESSION|CKF_SERIAL_SESSION, slot, pk11_notify ,&session); michael@0: /* what a well behaved token should return if you open michael@0: * a RW session on a read only token */ michael@0: if (crv == CKR_TOKEN_WRITE_PROTECTED) { michael@0: slot->readOnly = PR_TRUE; michael@0: } else if (crv == CKR_OK) { michael@0: CK_SESSION_INFO sessionInfo; michael@0: michael@0: /* Because of a second bug in softoken, which silently returns michael@0: * a RO session, we need to check what type of session we got. */ michael@0: crv = PK11_GETTAB(slot)->C_GetSessionInfo(session, &sessionInfo); michael@0: if (crv == CKR_OK) { michael@0: if ((sessionInfo.flags & CKF_RW_SESSION) == 0) { michael@0: /* session was readonly, so this softoken slot must be * readonly */ michael@0: slot->readOnly = PR_TRUE; michael@0: } michael@0: } michael@0: PK11_GETTAB(slot)->C_CloseSession(session); michael@0: } michael@0: } michael@0: michael@0: return SECSuccess; michael@0: } michael@0: michael@0: /* michael@0: * initialize a new token michael@0: * unlike initialize slot, this can be called multiple times in the lifetime michael@0: * of NSS. It reads the information associated with a card or token, michael@0: * that is not going to change unless the card or token changes. michael@0: */ michael@0: SECStatus michael@0: PK11_TokenRefresh(PK11SlotInfo *slot) michael@0: { michael@0: CK_TOKEN_INFO tokenInfo; michael@0: CK_RV crv; michael@0: michael@0: /* set the slot flags to the current token values */ michael@0: if (!slot->isThreadSafe) PK11_EnterSlotMonitor(slot); michael@0: crv = PK11_GETTAB(slot)->C_GetTokenInfo(slot->slotID,&tokenInfo); michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: if (crv != CKR_OK) { michael@0: PORT_SetError(PK11_MapError(crv)); michael@0: return SECFailure; michael@0: } michael@0: michael@0: slot->flags = tokenInfo.flags; michael@0: slot->needLogin = ((tokenInfo.flags & CKF_LOGIN_REQUIRED) ? michael@0: PR_TRUE : PR_FALSE); michael@0: slot->readOnly = ((tokenInfo.flags & CKF_WRITE_PROTECTED) ? michael@0: PR_TRUE : PR_FALSE); michael@0: slot->hasRandom = ((tokenInfo.flags & CKF_RNG) ? PR_TRUE : PR_FALSE); michael@0: slot->protectedAuthPath = michael@0: ((tokenInfo.flags & CKF_PROTECTED_AUTHENTICATION_PATH) michael@0: ? PR_TRUE : PR_FALSE); michael@0: /* on some platforms Active Card incorrectly sets the michael@0: * CKF_PROTECTED_AUTHENTICATION_PATH bit when it doesn't mean to. */ michael@0: if (slot->isActiveCard) { michael@0: slot->protectedAuthPath = PR_FALSE; michael@0: } michael@0: return SECSuccess; michael@0: } michael@0: michael@0: static PRBool michael@0: pk11_isRootSlot(PK11SlotInfo *slot) michael@0: { michael@0: CK_ATTRIBUTE findTemp[1]; michael@0: CK_ATTRIBUTE *attrs; michael@0: CK_OBJECT_CLASS oclass = CKO_NETSCAPE_BUILTIN_ROOT_LIST; michael@0: int tsize; michael@0: CK_OBJECT_HANDLE handle; michael@0: michael@0: attrs = findTemp; michael@0: PK11_SETATTRS(attrs, CKA_CLASS, &oclass, sizeof(oclass)); attrs++; michael@0: tsize = attrs - findTemp; michael@0: PORT_Assert(tsize <= sizeof(findTemp)/sizeof(CK_ATTRIBUTE)); michael@0: michael@0: handle = pk11_FindObjectByTemplate(slot,findTemp,tsize); michael@0: if (handle == CK_INVALID_HANDLE) { michael@0: return PR_FALSE; michael@0: } michael@0: return PR_TRUE; michael@0: } michael@0: michael@0: /* michael@0: * Initialize the slot : michael@0: * This initialization code is called on each slot a module supports when michael@0: * it is loaded. It does the bringup initialization. The difference between michael@0: * this and InitToken is Init slot does those one time initialization stuff, michael@0: * usually associated with the reader, while InitToken may get called multiple michael@0: * times as tokens are removed and re-inserted. michael@0: */ michael@0: void michael@0: PK11_InitSlot(SECMODModule *mod, CK_SLOT_ID slotID, PK11SlotInfo *slot) michael@0: { michael@0: SECStatus rv; michael@0: char *tmp; michael@0: CK_SLOT_INFO slotInfo; michael@0: michael@0: slot->functionList = mod->functionList; michael@0: slot->isInternal = mod->internal; michael@0: slot->slotID = slotID; michael@0: slot->isThreadSafe = mod->isThreadSafe; michael@0: slot->hasRSAInfo = PR_FALSE; michael@0: michael@0: if (PK11_GETTAB(slot)->C_GetSlotInfo(slotID,&slotInfo) != CKR_OK) { michael@0: slot->disabled = PR_TRUE; michael@0: slot->reason = PK11_DIS_COULD_NOT_INIT_TOKEN; michael@0: return; michael@0: } michael@0: michael@0: /* test to make sure claimed mechanism work */ michael@0: slot->needTest = mod->internal ? PR_FALSE : PR_TRUE; michael@0: slot->module = mod; /* NOTE: we don't make a reference here because michael@0: * modules have references to their slots. This michael@0: * works because modules keep implicit references michael@0: * from their slots, and won't unload and disappear michael@0: * until all their slots have been freed */ michael@0: tmp = PK11_MakeString(NULL,slot->slot_name, michael@0: (char *)slotInfo.slotDescription, sizeof(slotInfo.slotDescription)); michael@0: slot->isHW = (PRBool)((slotInfo.flags & CKF_HW_SLOT) == CKF_HW_SLOT); michael@0: #define ACTIVE_CARD "ActivCard SA" michael@0: slot->isActiveCard = (PRBool)(PORT_Strncmp((char *)slotInfo.manufacturerID, michael@0: ACTIVE_CARD, sizeof(ACTIVE_CARD)-1) == 0); michael@0: if ((slotInfo.flags & CKF_REMOVABLE_DEVICE) == 0) { michael@0: slot->isPerm = PR_TRUE; michael@0: /* permanment slots must have the token present always */ michael@0: if ((slotInfo.flags & CKF_TOKEN_PRESENT) == 0) { michael@0: slot->disabled = PR_TRUE; michael@0: slot->reason = PK11_DIS_TOKEN_NOT_PRESENT; michael@0: return; /* nothing else to do */ michael@0: } michael@0: } michael@0: /* if the token is present, initialize it */ michael@0: if ((slotInfo.flags & CKF_TOKEN_PRESENT) != 0) { michael@0: rv = PK11_InitToken(slot,PR_TRUE); michael@0: /* the only hard failures are on permanent devices, or function michael@0: * verify failures... function verify failures are already handled michael@0: * by tokenInit */ michael@0: if ((rv != SECSuccess) && (slot->isPerm) && (!slot->disabled)) { michael@0: slot->disabled = PR_TRUE; michael@0: slot->reason = PK11_DIS_COULD_NOT_INIT_TOKEN; michael@0: } michael@0: if (rv == SECSuccess && pk11_isRootSlot(slot)) { michael@0: if (!slot->hasRootCerts) { michael@0: slot->module->trustOrder = 100; michael@0: } michael@0: slot->hasRootCerts= PR_TRUE; michael@0: } michael@0: } michael@0: } michael@0: michael@0: michael@0: michael@0: /********************************************************************* michael@0: * Slot mapping utility functions. michael@0: *********************************************************************/ michael@0: michael@0: /* michael@0: * determine if the token is present. If the token is present, make sure michael@0: * we have a valid session handle. Also set the value of needLogin michael@0: * appropriately. michael@0: */ michael@0: static PRBool michael@0: pk11_IsPresentCertLoad(PK11SlotInfo *slot, PRBool loadCerts) michael@0: { michael@0: CK_SLOT_INFO slotInfo; michael@0: CK_SESSION_INFO sessionInfo; michael@0: CK_RV crv; michael@0: michael@0: /* disabled slots are never present */ michael@0: if (slot->disabled) { michael@0: return PR_FALSE; michael@0: } michael@0: michael@0: /* permanent slots are always present */ michael@0: if (slot->isPerm && (slot->session != CK_INVALID_SESSION)) { michael@0: return PR_TRUE; michael@0: } michael@0: michael@0: if (slot->nssToken) { michael@0: return nssToken_IsPresent(slot->nssToken); michael@0: } michael@0: michael@0: /* removable slots have a flag that says they are present */ michael@0: if (!slot->isThreadSafe) PK11_EnterSlotMonitor(slot); michael@0: if (PK11_GETTAB(slot)->C_GetSlotInfo(slot->slotID,&slotInfo) != CKR_OK) { michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: return PR_FALSE; michael@0: } michael@0: if ((slotInfo.flags & CKF_TOKEN_PRESENT) == 0) { michael@0: /* if the slot is no longer present, close the session */ michael@0: if (slot->session != CK_INVALID_SESSION) { michael@0: PK11_GETTAB(slot)->C_CloseSession(slot->session); michael@0: slot->session = CK_INVALID_SESSION; michael@0: } michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: return PR_FALSE; michael@0: } michael@0: michael@0: /* use the session Info to determine if the card has been removed and then michael@0: * re-inserted */ michael@0: if (slot->session != CK_INVALID_SESSION) { michael@0: if (slot->isThreadSafe) PK11_EnterSlotMonitor(slot); michael@0: crv = PK11_GETTAB(slot)->C_GetSessionInfo(slot->session, &sessionInfo); michael@0: if (crv != CKR_OK) { michael@0: PK11_GETTAB(slot)->C_CloseSession(slot->session); michael@0: slot->session = CK_INVALID_SESSION; michael@0: } michael@0: if (slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: } michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: michael@0: /* card has not been removed, current token info is correct */ michael@0: if (slot->session != CK_INVALID_SESSION) return PR_TRUE; michael@0: michael@0: /* initialize the token info state */ michael@0: if (PK11_InitToken(slot,loadCerts) != SECSuccess) { michael@0: return PR_FALSE; michael@0: } michael@0: michael@0: return PR_TRUE; michael@0: } michael@0: michael@0: /* michael@0: * old version of the routine michael@0: */ michael@0: PRBool michael@0: PK11_IsPresent(PK11SlotInfo *slot) { michael@0: return pk11_IsPresentCertLoad(slot,PR_TRUE); michael@0: } michael@0: michael@0: /* is the slot disabled? */ michael@0: PRBool michael@0: PK11_IsDisabled(PK11SlotInfo *slot) michael@0: { michael@0: return slot->disabled; michael@0: } michael@0: michael@0: /* and why? */ michael@0: PK11DisableReasons michael@0: PK11_GetDisabledReason(PK11SlotInfo *slot) michael@0: { michael@0: return slot->reason; michael@0: } michael@0: michael@0: /* returns PR_TRUE if successfully disable the slot */ michael@0: /* returns PR_FALSE otherwise */ michael@0: PRBool PK11_UserDisableSlot(PK11SlotInfo *slot) { michael@0: michael@0: /* Prevent users from disabling the internal module. */ michael@0: if (slot->isInternal) { michael@0: PORT_SetError(SEC_ERROR_INVALID_ARGS); michael@0: return PR_FALSE; michael@0: } michael@0: michael@0: slot->defaultFlags |= PK11_DISABLE_FLAG; michael@0: slot->disabled = PR_TRUE; michael@0: slot->reason = PK11_DIS_USER_SELECTED; michael@0: michael@0: return PR_TRUE; michael@0: } michael@0: michael@0: PRBool PK11_UserEnableSlot(PK11SlotInfo *slot) { michael@0: michael@0: slot->defaultFlags &= ~PK11_DISABLE_FLAG; michael@0: slot->disabled = PR_FALSE; michael@0: slot->reason = PK11_DIS_NONE; michael@0: return PR_TRUE; michael@0: } michael@0: michael@0: PRBool PK11_HasRootCerts(PK11SlotInfo *slot) { michael@0: return slot->hasRootCerts; michael@0: } michael@0: michael@0: /* Get the module this slot is attached to */ michael@0: SECMODModule * michael@0: PK11_GetModule(PK11SlotInfo *slot) michael@0: { michael@0: return slot->module; michael@0: } michael@0: michael@0: /* return the default flags of a slot */ michael@0: unsigned long michael@0: PK11_GetDefaultFlags(PK11SlotInfo *slot) michael@0: { michael@0: return slot->defaultFlags; michael@0: } michael@0: michael@0: /* michael@0: * The following wrapper functions allow us to export an opaque slot michael@0: * function to the rest of libsec and the world... */ michael@0: PRBool michael@0: PK11_IsReadOnly(PK11SlotInfo *slot) michael@0: { michael@0: return slot->readOnly; michael@0: } michael@0: michael@0: PRBool michael@0: PK11_IsHW(PK11SlotInfo *slot) michael@0: { michael@0: return slot->isHW; michael@0: } michael@0: michael@0: PRBool michael@0: PK11_IsRemovable(PK11SlotInfo *slot) michael@0: { michael@0: return !slot->isPerm; michael@0: } michael@0: michael@0: PRBool michael@0: PK11_IsInternal(PK11SlotInfo *slot) michael@0: { michael@0: return slot->isInternal; michael@0: } michael@0: michael@0: PRBool michael@0: PK11_IsInternalKeySlot(PK11SlotInfo *slot) michael@0: { michael@0: PK11SlotInfo *int_slot; michael@0: PRBool result; michael@0: michael@0: if (!slot->isInternal) { michael@0: return PR_FALSE; michael@0: } michael@0: michael@0: int_slot = PK11_GetInternalKeySlot(); michael@0: result = (int_slot == slot) ? PR_TRUE : PR_FALSE; michael@0: PK11_FreeSlot(int_slot); michael@0: return result; michael@0: } michael@0: michael@0: PRBool michael@0: PK11_NeedLogin(PK11SlotInfo *slot) michael@0: { michael@0: return slot->needLogin; michael@0: } michael@0: michael@0: PRBool michael@0: PK11_IsFriendly(PK11SlotInfo *slot) michael@0: { michael@0: /* internal slot always has public readable certs */ michael@0: return (PRBool)(slot->isInternal || michael@0: ((slot->defaultFlags & SECMOD_FRIENDLY_FLAG) == michael@0: SECMOD_FRIENDLY_FLAG)); michael@0: } michael@0: michael@0: char * michael@0: PK11_GetTokenName(PK11SlotInfo *slot) michael@0: { michael@0: return slot->token_name; michael@0: } michael@0: michael@0: char * michael@0: PK11_GetSlotName(PK11SlotInfo *slot) michael@0: { michael@0: return slot->slot_name; michael@0: } michael@0: michael@0: int michael@0: PK11_GetSlotSeries(PK11SlotInfo *slot) michael@0: { michael@0: return slot->series; michael@0: } michael@0: michael@0: int michael@0: PK11_GetCurrentWrapIndex(PK11SlotInfo *slot) michael@0: { michael@0: return slot->wrapKey; michael@0: } michael@0: michael@0: CK_SLOT_ID michael@0: PK11_GetSlotID(PK11SlotInfo *slot) michael@0: { michael@0: return slot->slotID; michael@0: } michael@0: michael@0: SECMODModuleID michael@0: PK11_GetModuleID(PK11SlotInfo *slot) michael@0: { michael@0: return slot->module->moduleID; michael@0: } michael@0: michael@0: static void michael@0: pk11_zeroTerminatedToBlankPadded(CK_CHAR *buffer, size_t buffer_size) michael@0: { michael@0: CK_CHAR *walk = buffer; michael@0: CK_CHAR *end = buffer + buffer_size; michael@0: michael@0: /* find the NULL */ michael@0: while (walk < end && *walk != '\0') { michael@0: walk++; michael@0: } michael@0: michael@0: /* clear out the buffer */ michael@0: while (walk < end) { michael@0: *walk++ = ' '; michael@0: } michael@0: } michael@0: michael@0: /* return the slot info structure */ michael@0: SECStatus michael@0: PK11_GetSlotInfo(PK11SlotInfo *slot, CK_SLOT_INFO *info) michael@0: { michael@0: CK_RV crv; michael@0: michael@0: if (!slot->isThreadSafe) PK11_EnterSlotMonitor(slot); michael@0: /* michael@0: * some buggy drivers do not fill the buffer completely, michael@0: * erase the buffer first michael@0: */ michael@0: PORT_Memset(info->slotDescription,' ',sizeof(info->slotDescription)); michael@0: PORT_Memset(info->manufacturerID,' ',sizeof(info->manufacturerID)); michael@0: crv = PK11_GETTAB(slot)->C_GetSlotInfo(slot->slotID,info); michael@0: pk11_zeroTerminatedToBlankPadded(info->slotDescription, michael@0: sizeof(info->slotDescription)); michael@0: pk11_zeroTerminatedToBlankPadded(info->manufacturerID, michael@0: sizeof(info->manufacturerID)); michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: if (crv != CKR_OK) { michael@0: PORT_SetError(PK11_MapError(crv)); michael@0: return SECFailure; michael@0: } michael@0: return SECSuccess; michael@0: } michael@0: michael@0: /* return the token info structure */ michael@0: SECStatus michael@0: PK11_GetTokenInfo(PK11SlotInfo *slot, CK_TOKEN_INFO *info) michael@0: { michael@0: CK_RV crv; michael@0: if (!slot->isThreadSafe) PK11_EnterSlotMonitor(slot); michael@0: /* michael@0: * some buggy drivers do not fill the buffer completely, michael@0: * erase the buffer first michael@0: */ michael@0: PORT_Memset(info->label,' ',sizeof(info->label)); michael@0: PORT_Memset(info->manufacturerID,' ',sizeof(info->manufacturerID)); michael@0: PORT_Memset(info->model,' ',sizeof(info->model)); michael@0: PORT_Memset(info->serialNumber,' ',sizeof(info->serialNumber)); michael@0: crv = PK11_GETTAB(slot)->C_GetTokenInfo(slot->slotID,info); michael@0: pk11_zeroTerminatedToBlankPadded(info->label,sizeof(info->label)); michael@0: pk11_zeroTerminatedToBlankPadded(info->manufacturerID, michael@0: sizeof(info->manufacturerID)); michael@0: pk11_zeroTerminatedToBlankPadded(info->model,sizeof(info->model)); michael@0: pk11_zeroTerminatedToBlankPadded(info->serialNumber, michael@0: sizeof(info->serialNumber)); michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: if (crv != CKR_OK) { michael@0: PORT_SetError(PK11_MapError(crv)); michael@0: return SECFailure; michael@0: } michael@0: return SECSuccess; michael@0: } michael@0: michael@0: /* Find out if we need to initialize the user's pin */ michael@0: PRBool michael@0: PK11_NeedUserInit(PK11SlotInfo *slot) michael@0: { michael@0: PRBool needUserInit = (PRBool) ((slot->flags & CKF_USER_PIN_INITIALIZED) michael@0: == 0); michael@0: michael@0: if (needUserInit) { michael@0: CK_TOKEN_INFO info; michael@0: SECStatus rv; michael@0: michael@0: /* see if token has been initialized off line */ michael@0: rv = PK11_GetTokenInfo(slot, &info); michael@0: if (rv == SECSuccess) { michael@0: slot->flags = info.flags; michael@0: } michael@0: } michael@0: return (PRBool)((slot->flags & CKF_USER_PIN_INITIALIZED) == 0); michael@0: } michael@0: michael@0: static PK11SlotInfo *pk11InternalKeySlot = NULL; michael@0: michael@0: /* michael@0: * Set a new default internal keyslot. If one has already been set, clear it. michael@0: * Passing NULL falls back to the NSS normally selected default internal key michael@0: * slot. michael@0: */ michael@0: void michael@0: pk11_SetInternalKeySlot(PK11SlotInfo *slot) michael@0: { michael@0: if (pk11InternalKeySlot) { michael@0: PK11_FreeSlot(pk11InternalKeySlot); michael@0: } michael@0: pk11InternalKeySlot = slot ? PK11_ReferenceSlot(slot) : NULL; michael@0: } michael@0: michael@0: /* michael@0: * Set a new default internal keyslot if the normal key slot has not already michael@0: * been overridden. Subsequent calls to this function will be ignored unless michael@0: * pk11_SetInternalKeySlot is used to clear the current default. michael@0: */ michael@0: void michael@0: pk11_SetInternalKeySlotIfFirst(PK11SlotInfo *slot) michael@0: { michael@0: if (pk11InternalKeySlot) { michael@0: return; michael@0: } michael@0: pk11InternalKeySlot = slot ? PK11_ReferenceSlot(slot) : NULL; michael@0: } michael@0: michael@0: /* michael@0: * Swap out a default internal keyslot. Caller owns the Slot Reference michael@0: */ michael@0: PK11SlotInfo * michael@0: pk11_SwapInternalKeySlot(PK11SlotInfo *slot) michael@0: { michael@0: PK11SlotInfo *swap = pk11InternalKeySlot; michael@0: michael@0: pk11InternalKeySlot = slot ? PK11_ReferenceSlot(slot) : NULL; michael@0: return swap; michael@0: } michael@0: michael@0: michael@0: /* get the internal key slot. FIPS has only one slot for both key slots and michael@0: * default slots */ michael@0: PK11SlotInfo * michael@0: PK11_GetInternalKeySlot(void) michael@0: { michael@0: SECMODModule *mod; michael@0: michael@0: if (pk11InternalKeySlot) { michael@0: return PK11_ReferenceSlot(pk11InternalKeySlot); michael@0: } michael@0: michael@0: mod = SECMOD_GetInternalModule(); michael@0: PORT_Assert(mod != NULL); michael@0: if (!mod) { michael@0: PORT_SetError( SEC_ERROR_NO_MODULE ); michael@0: return NULL; michael@0: } michael@0: return PK11_ReferenceSlot(mod->isFIPS ? mod->slots[0] : mod->slots[1]); michael@0: } michael@0: michael@0: /* get the internal default slot */ michael@0: PK11SlotInfo * michael@0: PK11_GetInternalSlot(void) michael@0: { michael@0: SECMODModule * mod = SECMOD_GetInternalModule(); michael@0: PORT_Assert(mod != NULL); michael@0: if (!mod) { michael@0: PORT_SetError( SEC_ERROR_NO_MODULE ); michael@0: return NULL; michael@0: } michael@0: if (mod->isFIPS) { michael@0: return PK11_GetInternalKeySlot(); michael@0: } michael@0: return PK11_ReferenceSlot(mod->slots[0]); michael@0: } michael@0: michael@0: /* michael@0: * check if a given slot supports the requested mechanism michael@0: */ michael@0: PRBool michael@0: PK11_DoesMechanism(PK11SlotInfo *slot, CK_MECHANISM_TYPE type) michael@0: { michael@0: int i; michael@0: michael@0: /* CKM_FAKE_RANDOM is not a real PKCS mechanism. It's a marker to michael@0: * tell us we're looking form someone that has implemented get michael@0: * random bits */ michael@0: if (type == CKM_FAKE_RANDOM) { michael@0: return slot->hasRandom; michael@0: } michael@0: michael@0: /* for most mechanism, bypass the linear lookup */ michael@0: if (type < 0x7ff) { michael@0: return (slot->mechanismBits[type & 0xff] & (1 << (type >> 8))) ? michael@0: PR_TRUE : PR_FALSE; michael@0: } michael@0: michael@0: for (i=0; i < (int) slot->mechanismCount; i++) { michael@0: if (slot->mechanismList[i] == type) return PR_TRUE; michael@0: } michael@0: return PR_FALSE; michael@0: } michael@0: michael@0: /* michael@0: * Return true if a token that can do the desired mechanism exists. michael@0: * This allows us to have hardware tokens that can do function XYZ magically michael@0: * allow SSL Ciphers to appear if they are plugged in. michael@0: */ michael@0: PRBool michael@0: PK11_TokenExists(CK_MECHANISM_TYPE type) michael@0: { michael@0: SECMODModuleList *mlp; michael@0: SECMODModuleList *modules; michael@0: SECMODListLock *moduleLock = SECMOD_GetDefaultModuleListLock(); michael@0: PK11SlotInfo *slot; michael@0: PRBool found = PR_FALSE; michael@0: int i; michael@0: michael@0: if (!moduleLock) { michael@0: PORT_SetError(SEC_ERROR_NOT_INITIALIZED); michael@0: return found; michael@0: } michael@0: /* we only need to know if there is a token that does this mechanism. michael@0: * check the internal module first because it's fast, and supports michael@0: * almost everything. */ michael@0: slot = PK11_GetInternalSlot(); michael@0: if (slot) { michael@0: found = PK11_DoesMechanism(slot,type); michael@0: PK11_FreeSlot(slot); michael@0: } michael@0: if (found) return PR_TRUE; /* bypass getting module locks */ michael@0: michael@0: SECMOD_GetReadLock(moduleLock); michael@0: modules = SECMOD_GetDefaultModuleList(); michael@0: for(mlp = modules; mlp != NULL && (!found); mlp = mlp->next) { michael@0: for (i=0; i < mlp->module->slotCount; i++) { michael@0: slot = mlp->module->slots[i]; michael@0: if (PK11_IsPresent(slot)) { michael@0: if (PK11_DoesMechanism(slot,type)) { michael@0: found = PR_TRUE; michael@0: break; michael@0: } michael@0: } michael@0: } michael@0: } michael@0: SECMOD_ReleaseReadLock(moduleLock); michael@0: return found; michael@0: } michael@0: michael@0: /* michael@0: * get all the currently available tokens in a list. michael@0: * that can perform the given mechanism. If mechanism is CKM_INVALID_MECHANISM, michael@0: * get all the tokens. Make sure tokens that need authentication are put at michael@0: * the end of this list. michael@0: */ michael@0: PK11SlotList * michael@0: PK11_GetAllTokens(CK_MECHANISM_TYPE type, PRBool needRW, PRBool loadCerts, michael@0: void *wincx) michael@0: { michael@0: PK11SlotList * list; michael@0: PK11SlotList * loginList; michael@0: PK11SlotList * friendlyList; michael@0: SECMODModuleList * mlp; michael@0: SECMODModuleList * modules; michael@0: SECMODListLock * moduleLock; michael@0: int i; michael@0: #if defined( XP_WIN32 ) michael@0: int j = 0; michael@0: PRInt32 waste[16]; michael@0: #endif michael@0: michael@0: moduleLock = SECMOD_GetDefaultModuleListLock(); michael@0: if (!moduleLock) { michael@0: PORT_SetError(SEC_ERROR_NOT_INITIALIZED); michael@0: return NULL; michael@0: } michael@0: michael@0: list = PK11_NewSlotList(); michael@0: loginList = PK11_NewSlotList(); michael@0: friendlyList = PK11_NewSlotList(); michael@0: if ((list == NULL) || (loginList == NULL) || (friendlyList == NULL)) { michael@0: if (list) PK11_FreeSlotList(list); michael@0: if (loginList) PK11_FreeSlotList(loginList); michael@0: if (friendlyList) PK11_FreeSlotList(friendlyList); michael@0: return NULL; michael@0: } michael@0: michael@0: SECMOD_GetReadLock(moduleLock); michael@0: michael@0: modules = SECMOD_GetDefaultModuleList(); michael@0: for(mlp = modules; mlp != NULL; mlp = mlp->next) { michael@0: michael@0: #if defined( XP_WIN32 ) michael@0: /* This is works around some horrible cache/page thrashing problems michael@0: ** on Win32. Without this, this loop can take up to 6 seconds at michael@0: ** 100% CPU on a Pentium-Pro 200. The thing this changes is to michael@0: ** increase the size of the stack frame and modify it. michael@0: ** Moving the loop code itself seems to have no effect. michael@0: ** Dunno why this combination makes a difference, but it does. michael@0: */ michael@0: waste[ j & 0xf] = j++; michael@0: #endif michael@0: michael@0: for (i = 0; i < mlp->module->slotCount; i++) { michael@0: PK11SlotInfo *slot = mlp->module->slots[i]; michael@0: michael@0: if (pk11_IsPresentCertLoad(slot, loadCerts)) { michael@0: if (needRW && slot->readOnly) continue; michael@0: if ((type == CKM_INVALID_MECHANISM) michael@0: || PK11_DoesMechanism(slot, type)) { michael@0: if (pk11_LoginStillRequired(slot,wincx)) { michael@0: if (PK11_IsFriendly(slot)) { michael@0: PK11_AddSlotToList(friendlyList, slot, PR_TRUE); michael@0: } else { michael@0: PK11_AddSlotToList(loginList, slot, PR_TRUE); michael@0: } michael@0: } else { michael@0: PK11_AddSlotToList(list, slot, PR_TRUE); michael@0: } michael@0: } michael@0: } michael@0: } michael@0: } michael@0: SECMOD_ReleaseReadLock(moduleLock); michael@0: michael@0: pk11_MoveListToList(list,friendlyList); michael@0: PK11_FreeSlotList(friendlyList); michael@0: pk11_MoveListToList(list,loginList); michael@0: PK11_FreeSlotList(loginList); michael@0: michael@0: return list; michael@0: } michael@0: michael@0: /* michael@0: * NOTE: This routine is working from a private List generated by michael@0: * PK11_GetAllTokens. That is why it does not need to lock. michael@0: */ michael@0: PK11SlotList * michael@0: PK11_GetPrivateKeyTokens(CK_MECHANISM_TYPE type,PRBool needRW,void *wincx) michael@0: { michael@0: PK11SlotList *list = PK11_GetAllTokens(type,needRW,PR_TRUE,wincx); michael@0: PK11SlotListElement *le, *next ; michael@0: SECStatus rv; michael@0: michael@0: if (list == NULL) return list; michael@0: michael@0: for (le = list->head ; le; le = next) { michael@0: next = le->next; /* save the pointer here in case we have to michael@0: * free the element later */ michael@0: rv = PK11_Authenticate(le->slot,PR_TRUE,wincx); michael@0: if (rv != SECSuccess) { michael@0: PK11_DeleteSlotFromList(list,le); michael@0: continue; michael@0: } michael@0: } michael@0: return list; michael@0: } michael@0: michael@0: /* michael@0: * returns true if the slot doesn't conform to the requested attributes michael@0: */ michael@0: PRBool michael@0: pk11_filterSlot(PK11SlotInfo *slot, CK_MECHANISM_TYPE mechanism, michael@0: CK_FLAGS mechanismInfoFlags, unsigned int keySize) michael@0: { michael@0: CK_MECHANISM_INFO mechanism_info; michael@0: CK_RV crv = CKR_OK; michael@0: michael@0: /* handle the only case where we don't actually fetch the mechanisms michael@0: * on the fly */ michael@0: if ((keySize == 0) && (mechanism == CKM_RSA_PKCS) && (slot->hasRSAInfo)) { michael@0: mechanism_info.flags = slot->RSAInfoFlags; michael@0: } else { michael@0: if (!slot->isThreadSafe) PK11_EnterSlotMonitor(slot); michael@0: crv = PK11_GETTAB(slot)->C_GetMechanismInfo(slot->slotID, mechanism, michael@0: &mechanism_info); michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: /* if we were getting the RSA flags, save them */ michael@0: if ((crv == CKR_OK) && (mechanism == CKM_RSA_PKCS) michael@0: && (!slot->hasRSAInfo)) { michael@0: slot->RSAInfoFlags = mechanism_info.flags; michael@0: slot->hasRSAInfo = PR_TRUE; michael@0: } michael@0: } michael@0: /* couldn't get the mechanism info */ michael@0: if (crv != CKR_OK ) { michael@0: return PR_TRUE; michael@0: } michael@0: if (keySize && ((mechanism_info.ulMinKeySize > keySize) michael@0: || (mechanism_info.ulMaxKeySize < keySize)) ) { michael@0: /* Token can do mechanism, but not at the key size we michael@0: * want */ michael@0: return PR_TRUE; michael@0: } michael@0: if (mechanismInfoFlags && ((mechanism_info.flags & mechanismInfoFlags) != michael@0: mechanismInfoFlags) ) { michael@0: return PR_TRUE; michael@0: } michael@0: return PR_FALSE; michael@0: } michael@0: michael@0: michael@0: /* michael@0: * Find the best slot which supports the given set of mechanisms and key sizes. michael@0: * In normal cases this should grab the first slot on the list with no fuss. michael@0: * The size array is presumed to match one for one with the mechanism type michael@0: * array, which allows you to specify the required key size for each michael@0: * mechanism in the list. Whether key size is in bits or bytes is mechanism michael@0: * dependent. Typically asymetric keys are in bits and symetric keys are in michael@0: * bytes. michael@0: */ michael@0: PK11SlotInfo * michael@0: PK11_GetBestSlotMultipleWithAttributes(CK_MECHANISM_TYPE *type, michael@0: CK_FLAGS *mechanismInfoFlags, unsigned int *keySize, michael@0: unsigned int mech_count, void *wincx) michael@0: { michael@0: PK11SlotList *list = NULL; michael@0: PK11SlotListElement *le ; michael@0: PK11SlotInfo *slot = NULL; michael@0: PRBool freeit = PR_FALSE; michael@0: PRBool listNeedLogin = PR_FALSE; michael@0: int i; michael@0: SECStatus rv; michael@0: michael@0: list = PK11_GetSlotList(type[0]); michael@0: michael@0: if ((list == NULL) || (list->head == NULL)) { michael@0: /* We need to look up all the tokens for the mechanism */ michael@0: list = PK11_GetAllTokens(type[0],PR_FALSE,PR_TRUE,wincx); michael@0: freeit = PR_TRUE; michael@0: } michael@0: michael@0: /* no one can do it! */ michael@0: if (list == NULL) { michael@0: PORT_SetError(SEC_ERROR_NO_TOKEN); michael@0: return NULL; michael@0: } michael@0: michael@0: PORT_SetError(0); michael@0: michael@0: michael@0: listNeedLogin = PR_FALSE; michael@0: for (i=0; i < mech_count; i++) { michael@0: if ((type[i] != CKM_FAKE_RANDOM) && michael@0: (type[i] != CKM_SHA_1) && michael@0: (type[i] != CKM_SHA224) && michael@0: (type[i] != CKM_SHA256) && michael@0: (type[i] != CKM_SHA384) && michael@0: (type[i] != CKM_SHA512) && michael@0: (type[i] != CKM_MD5) && michael@0: (type[i] != CKM_MD2)) { michael@0: listNeedLogin = PR_TRUE; michael@0: break; michael@0: } michael@0: } michael@0: michael@0: for (le = PK11_GetFirstSafe(list); le; michael@0: le = PK11_GetNextSafe(list,le,PR_TRUE)) { michael@0: if (PK11_IsPresent(le->slot)) { michael@0: PRBool doExit = PR_FALSE; michael@0: for (i=0; i < mech_count; i++) { michael@0: if (!PK11_DoesMechanism(le->slot,type[i])) { michael@0: doExit = PR_TRUE; michael@0: break; michael@0: } michael@0: if ((mechanismInfoFlags && mechanismInfoFlags[i]) || michael@0: (keySize && keySize[i])) { michael@0: if (pk11_filterSlot(le->slot, type[i], michael@0: mechanismInfoFlags ? mechanismInfoFlags[i] : 0, michael@0: keySize ? keySize[i] : 0)) { michael@0: doExit = PR_TRUE; michael@0: break; michael@0: } michael@0: } michael@0: } michael@0: michael@0: if (doExit) continue; michael@0: michael@0: if (listNeedLogin && le->slot->needLogin) { michael@0: rv = PK11_Authenticate(le->slot,PR_TRUE,wincx); michael@0: if (rv != SECSuccess) continue; michael@0: } michael@0: slot = le->slot; michael@0: PK11_ReferenceSlot(slot); michael@0: PK11_FreeSlotListElement(list,le); michael@0: if (freeit) { PK11_FreeSlotList(list); } michael@0: return slot; michael@0: } michael@0: } michael@0: if (freeit) { PK11_FreeSlotList(list); } michael@0: if (PORT_GetError() == 0) { michael@0: PORT_SetError(SEC_ERROR_NO_TOKEN); michael@0: } michael@0: return NULL; michael@0: } michael@0: michael@0: PK11SlotInfo * michael@0: PK11_GetBestSlotMultiple(CK_MECHANISM_TYPE *type, michael@0: unsigned int mech_count, void *wincx) michael@0: { michael@0: return PK11_GetBestSlotMultipleWithAttributes(type, NULL, NULL, michael@0: mech_count, wincx); michael@0: } michael@0: michael@0: /* original get best slot now calls the multiple version with only one type */ michael@0: PK11SlotInfo * michael@0: PK11_GetBestSlot(CK_MECHANISM_TYPE type, void *wincx) michael@0: { michael@0: return PK11_GetBestSlotMultipleWithAttributes(&type, NULL, NULL, 1, wincx); michael@0: } michael@0: michael@0: PK11SlotInfo * michael@0: PK11_GetBestSlotWithAttributes(CK_MECHANISM_TYPE type, CK_FLAGS mechanismFlags, michael@0: unsigned int keySize, void *wincx) michael@0: { michael@0: return PK11_GetBestSlotMultipleWithAttributes(&type, &mechanismFlags, michael@0: &keySize, 1, wincx); michael@0: } michael@0: michael@0: int michael@0: PK11_GetBestKeyLength(PK11SlotInfo *slot,CK_MECHANISM_TYPE mechanism) michael@0: { michael@0: CK_MECHANISM_INFO mechanism_info; michael@0: CK_RV crv; michael@0: michael@0: if (!slot->isThreadSafe) PK11_EnterSlotMonitor(slot); michael@0: crv = PK11_GETTAB(slot)->C_GetMechanismInfo(slot->slotID, michael@0: mechanism,&mechanism_info); michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: if (crv != CKR_OK) return 0; michael@0: michael@0: if (mechanism_info.ulMinKeySize == mechanism_info.ulMaxKeySize) michael@0: return 0; michael@0: return mechanism_info.ulMaxKeySize; michael@0: } michael@0: michael@0: michael@0: /* michael@0: * This function uses the existing PKCS #11 module to find the michael@0: * longest supported key length in the preferred token for a mechanism. michael@0: * This varies from the above function in that 1) it returns the key length michael@0: * even for fixed key algorithms, and 2) it looks through the tokens michael@0: * generally rather than for a specific token. This is used in liu of michael@0: * a PK11_GetKeyLength function in pk11mech.c since we can actually read michael@0: * supported key lengths from PKCS #11. michael@0: * michael@0: * For symmetric key operations the length is returned in bytes. michael@0: */ michael@0: int michael@0: PK11_GetMaxKeyLength(CK_MECHANISM_TYPE mechanism) michael@0: { michael@0: CK_MECHANISM_INFO mechanism_info; michael@0: PK11SlotList *list = NULL; michael@0: PK11SlotListElement *le ; michael@0: PRBool freeit = PR_FALSE; michael@0: int keyLength = 0; michael@0: michael@0: list = PK11_GetSlotList(mechanism); michael@0: michael@0: if ((list == NULL) || (list->head == NULL)) { michael@0: /* We need to look up all the tokens for the mechanism */ michael@0: list = PK11_GetAllTokens(mechanism,PR_FALSE,PR_FALSE,NULL); michael@0: freeit = PR_TRUE; michael@0: } michael@0: michael@0: /* no tokens recognize this mechanism */ michael@0: if (list == NULL) { michael@0: PORT_SetError(SEC_ERROR_INVALID_ALGORITHM); michael@0: return 0; michael@0: } michael@0: michael@0: for (le = PK11_GetFirstSafe(list); le; michael@0: le = PK11_GetNextSafe(list,le,PR_TRUE)) { michael@0: PK11SlotInfo *slot = le->slot; michael@0: CK_RV crv; michael@0: if (PK11_IsPresent(slot)) { michael@0: if (!slot->isThreadSafe) PK11_EnterSlotMonitor(slot); michael@0: crv = PK11_GETTAB(slot)->C_GetMechanismInfo(slot->slotID, michael@0: mechanism,&mechanism_info); michael@0: if (!slot->isThreadSafe) PK11_ExitSlotMonitor(slot); michael@0: if ((crv == CKR_OK) && (mechanism_info.ulMaxKeySize != 0) michael@0: && (mechanism_info.ulMaxKeySize != 0xffffffff)) { michael@0: keyLength = mechanism_info.ulMaxKeySize; michael@0: break; michael@0: } michael@0: } michael@0: } michael@0: if (le) michael@0: PK11_FreeSlotListElement(list, le); michael@0: if (freeit) michael@0: PK11_FreeSlotList(list); michael@0: return keyLength; michael@0: } michael@0: michael@0: SECStatus michael@0: PK11_SeedRandom(PK11SlotInfo *slot, unsigned char *data, int len) { michael@0: CK_RV crv; michael@0: michael@0: PK11_EnterSlotMonitor(slot); michael@0: crv = PK11_GETTAB(slot)->C_SeedRandom(slot->session, data, (CK_ULONG)len); michael@0: PK11_ExitSlotMonitor(slot); michael@0: if (crv != CKR_OK) { michael@0: PORT_SetError(PK11_MapError(crv)); michael@0: return SECFailure; michael@0: } michael@0: return SECSuccess; michael@0: } michael@0: michael@0: michael@0: SECStatus michael@0: PK11_GenerateRandomOnSlot(PK11SlotInfo *slot, unsigned char *data, int len) { michael@0: CK_RV crv; michael@0: michael@0: if (!slot->isInternal) PK11_EnterSlotMonitor(slot); michael@0: crv = PK11_GETTAB(slot)->C_GenerateRandom(slot->session,data, michael@0: (CK_ULONG)len); michael@0: if (!slot->isInternal) PK11_ExitSlotMonitor(slot); michael@0: if (crv != CKR_OK) { michael@0: PORT_SetError(PK11_MapError(crv)); michael@0: return SECFailure; michael@0: } michael@0: return SECSuccess; michael@0: } michael@0: michael@0: /* Attempts to update the Best Slot for "FAKE RANDOM" generation. michael@0: ** If that's not the internal slot, then it also attempts to update the michael@0: ** internal slot. michael@0: ** The return value indicates if the INTERNAL slot was updated OK. michael@0: */ michael@0: SECStatus michael@0: PK11_RandomUpdate(void *data, size_t bytes) michael@0: { michael@0: PK11SlotInfo *slot; michael@0: PRBool bestIsInternal; michael@0: SECStatus status; michael@0: michael@0: slot = PK11_GetBestSlot(CKM_FAKE_RANDOM, NULL); michael@0: if (slot == NULL) { michael@0: slot = PK11_GetInternalSlot(); michael@0: if (!slot) michael@0: return SECFailure; michael@0: } michael@0: michael@0: bestIsInternal = PK11_IsInternal(slot); michael@0: status = PK11_SeedRandom(slot, data, bytes); michael@0: PK11_FreeSlot(slot); michael@0: michael@0: if (!bestIsInternal) { michael@0: /* do internal slot, too. */ michael@0: slot = PK11_GetInternalSlot(); /* can't fail */ michael@0: status = PK11_SeedRandom(slot, data, bytes); michael@0: PK11_FreeSlot(slot); michael@0: } michael@0: return status; michael@0: } michael@0: michael@0: michael@0: SECStatus michael@0: PK11_GenerateRandom(unsigned char *data,int len) { michael@0: PK11SlotInfo *slot; michael@0: SECStatus rv; michael@0: michael@0: slot = PK11_GetBestSlot(CKM_FAKE_RANDOM,NULL); michael@0: if (slot == NULL) return SECFailure; michael@0: michael@0: rv = PK11_GenerateRandomOnSlot(slot, data, len); michael@0: PK11_FreeSlot(slot); michael@0: return rv; michael@0: } michael@0: michael@0: /* michael@0: * Reset the token to it's initial state. For the internal module, this will michael@0: * Purge your keydb, and reset your cert db certs to USER_INIT. michael@0: */ michael@0: SECStatus michael@0: PK11_ResetToken(PK11SlotInfo *slot, char *sso_pwd) michael@0: { michael@0: unsigned char tokenName[32]; michael@0: int tokenNameLen; michael@0: CK_RV crv; michael@0: michael@0: /* reconstruct the token name */ michael@0: tokenNameLen = PORT_Strlen(slot->token_name); michael@0: if (tokenNameLen > sizeof(tokenName)) { michael@0: tokenNameLen = sizeof(tokenName); michael@0: } michael@0: michael@0: PORT_Memcpy(tokenName,slot->token_name,tokenNameLen); michael@0: if (tokenNameLen < sizeof(tokenName)) { michael@0: PORT_Memset(&tokenName[tokenNameLen],' ', michael@0: sizeof(tokenName)-tokenNameLen); michael@0: } michael@0: michael@0: /* initialize the token */ michael@0: PK11_EnterSlotMonitor(slot); michael@0: michael@0: /* first shutdown the token. Existing sessions will get closed here */ michael@0: PK11_GETTAB(slot)->C_CloseAllSessions(slot->slotID); michael@0: slot->session = CK_INVALID_SESSION; michael@0: michael@0: /* now re-init the token */ michael@0: crv = PK11_GETTAB(slot)->C_InitToken(slot->slotID, michael@0: (unsigned char *)sso_pwd, sso_pwd ? PORT_Strlen(sso_pwd): 0, tokenName); michael@0: michael@0: /* finally bring the token back up */ michael@0: PK11_InitToken(slot,PR_TRUE); michael@0: PK11_ExitSlotMonitor(slot); michael@0: if (crv != CKR_OK) { michael@0: PORT_SetError(PK11_MapError(crv)); michael@0: return SECFailure; michael@0: } michael@0: nssTrustDomain_UpdateCachedTokenCerts(slot->nssToken->trustDomain, michael@0: slot->nssToken); michael@0: return SECSuccess; michael@0: } michael@0: void michael@0: PK11Slot_SetNSSToken(PK11SlotInfo *sl, NSSToken *nsst) michael@0: { michael@0: sl->nssToken = nsst; michael@0: } michael@0: michael@0: NSSToken * michael@0: PK11Slot_GetNSSToken(PK11SlotInfo *sl) michael@0: { michael@0: return sl->nssToken; michael@0: } michael@0: michael@0: /* michael@0: * wait for a token to change it's state. The application passes in the expected michael@0: * new state in event. michael@0: */ michael@0: PK11TokenStatus michael@0: PK11_WaitForTokenEvent(PK11SlotInfo *slot, PK11TokenEvent event, michael@0: PRIntervalTime timeout, PRIntervalTime latency, int series) michael@0: { michael@0: PRIntervalTime first_time = 0; michael@0: PRBool first_time_set = PR_FALSE; michael@0: PRBool waitForRemoval; michael@0: michael@0: if (slot->isPerm) { michael@0: return PK11TokenNotRemovable; michael@0: } michael@0: if (latency == 0) { michael@0: latency = PR_SecondsToInterval(5); michael@0: } michael@0: waitForRemoval = (PRBool) (event == PK11TokenRemovedOrChangedEvent); michael@0: michael@0: if (series == 0) { michael@0: series = PK11_GetSlotSeries(slot); michael@0: } michael@0: while (PK11_IsPresent(slot) == waitForRemoval ) { michael@0: PRIntervalTime interval; michael@0: michael@0: if (waitForRemoval && series != PK11_GetSlotSeries(slot)) { michael@0: return PK11TokenChanged; michael@0: } michael@0: if (timeout == PR_INTERVAL_NO_WAIT) { michael@0: return waitForRemoval ? PK11TokenPresent : PK11TokenRemoved; michael@0: } michael@0: if (timeout != PR_INTERVAL_NO_TIMEOUT ) { michael@0: interval = PR_IntervalNow(); michael@0: if (!first_time_set) { michael@0: first_time = interval; michael@0: first_time_set = PR_TRUE; michael@0: } michael@0: if ((interval-first_time) > timeout) { michael@0: return waitForRemoval ? PK11TokenPresent : PK11TokenRemoved; michael@0: } michael@0: } michael@0: PR_Sleep(latency); michael@0: } michael@0: return waitForRemoval ? PK11TokenRemoved : PK11TokenPresent; michael@0: }