michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public michael@0: * License, v. 2.0. If a copy of the MPL was not distributed with this michael@0: * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ michael@0: /* michael@0: * Internal data structures and functions used by pkcs11.c michael@0: */ michael@0: #ifndef _PKCS11I_H_ michael@0: #define _PKCS11I_H_ 1 michael@0: michael@0: #include "nssilock.h" michael@0: #include "seccomon.h" michael@0: #include "secoidt.h" michael@0: #include "lowkeyti.h" michael@0: #include "pkcs11t.h" michael@0: michael@0: #include "sftkdbt.h" michael@0: #include "hasht.h" michael@0: michael@0: /* michael@0: * Configuration Defines michael@0: * michael@0: * The following defines affect the space verse speed trade offs of michael@0: * the PKCS #11 module. For the most part the current settings are optimized michael@0: * for web servers, where we want faster speed and lower lock contention at michael@0: * the expense of space. michael@0: */ michael@0: michael@0: /* michael@0: * The attribute allocation strategy is static allocation: michael@0: * Attributes are pre-allocated as part of the session object and used from michael@0: * the object array. michael@0: */ michael@0: #define MAX_OBJS_ATTRS 45 /* number of attributes to preallocate in michael@0: * the object (must me the absolute max) */ michael@0: #define ATTR_SPACE 50 /* Maximum size of attribute data before extra michael@0: * data needs to be allocated. This is set to michael@0: * enough space to hold an SSL MASTER secret */ michael@0: michael@0: #define NSC_STRICT PR_FALSE /* forces the code to do strict template michael@0: * matching when doing C_FindObject on token michael@0: * objects. This will slow down search in michael@0: * NSS. */ michael@0: /* default search block allocations and increments */ michael@0: #define NSC_CERT_BLOCK_SIZE 50 michael@0: #define NSC_SEARCH_BLOCK_SIZE 5 michael@0: #define NSC_SLOT_LIST_BLOCK_SIZE 10 michael@0: michael@0: #define NSC_FIPS_MODULE 1 michael@0: #define NSC_NON_FIPS_MODULE 0 michael@0: michael@0: /* these are data base storage hashes, not cryptographic hashes.. The define michael@0: * the effective size of the various object hash tables */ michael@0: /* clients care more about memory usage than lookup performance on michael@0: * cyrptographic objects. Clients also have less objects around to play with michael@0: * michael@0: * we eventually should make this configurable at runtime! Especially now that michael@0: * NSS is a shared library. michael@0: */ michael@0: #define SPACE_ATTRIBUTE_HASH_SIZE 32 michael@0: #define SPACE_SESSION_OBJECT_HASH_SIZE 32 michael@0: #define SPACE_SESSION_HASH_SIZE 32 michael@0: #define TIME_ATTRIBUTE_HASH_SIZE 32 michael@0: #define TIME_SESSION_OBJECT_HASH_SIZE 1024 michael@0: #define TIME_SESSION_HASH_SIZE 1024 michael@0: #define MAX_OBJECT_LIST_SIZE 800 michael@0: /* how many objects to keep on the free list michael@0: * before we start freeing them */ michael@0: #define MAX_KEY_LEN 256 /* maximum symmetric key length in bytes */ michael@0: michael@0: /* michael@0: * LOG2_BUCKETS_PER_SESSION_LOCK must be a prime number. michael@0: * With SESSION_HASH_SIZE=1024, LOG2 can be 9, 5, 1, or 0. michael@0: * With SESSION_HASH_SIZE=4096, LOG2 can be 11, 9, 5, 1, or 0. michael@0: * michael@0: * HASH_SIZE LOG2_BUCKETS_PER BUCKETS_PER_LOCK NUMBER_OF_BUCKETS michael@0: * 1024 9 512 2 michael@0: * 1024 5 32 32 michael@0: * 1024 1 2 512 michael@0: * 1024 0 1 1024 michael@0: * 4096 11 2048 2 michael@0: * 4096 9 512 8 michael@0: * 4096 5 32 128 michael@0: * 4096 1 2 2048 michael@0: * 4096 0 1 4096 michael@0: */ michael@0: #define LOG2_BUCKETS_PER_SESSION_LOCK 1 michael@0: #define BUCKETS_PER_SESSION_LOCK (1 << (LOG2_BUCKETS_PER_SESSION_LOCK)) michael@0: /* NOSPREAD sessionID to hash table index macro has been slower. */ michael@0: michael@0: /* define typedefs, double as forward declarations as well */ michael@0: typedef struct SFTKAttributeStr SFTKAttribute; michael@0: typedef struct SFTKObjectListStr SFTKObjectList; michael@0: typedef struct SFTKObjectFreeListStr SFTKObjectFreeList; michael@0: typedef struct SFTKObjectListElementStr SFTKObjectListElement; michael@0: typedef struct SFTKObjectStr SFTKObject; michael@0: typedef struct SFTKSessionObjectStr SFTKSessionObject; michael@0: typedef struct SFTKTokenObjectStr SFTKTokenObject; michael@0: typedef struct SFTKSessionStr SFTKSession; michael@0: typedef struct SFTKSlotStr SFTKSlot; michael@0: typedef struct SFTKSessionContextStr SFTKSessionContext; michael@0: typedef struct SFTKSearchResultsStr SFTKSearchResults; michael@0: typedef struct SFTKHashVerifyInfoStr SFTKHashVerifyInfo; michael@0: typedef struct SFTKHashSignInfoStr SFTKHashSignInfo; michael@0: typedef struct SFTKOAEPEncryptInfoStr SFTKOAEPEncryptInfo; michael@0: typedef struct SFTKOAEPDecryptInfoStr SFTKOAEPDecryptInfo; michael@0: typedef struct SFTKSSLMACInfoStr SFTKSSLMACInfo; michael@0: typedef struct SFTKItemTemplateStr SFTKItemTemplate; michael@0: michael@0: /* define function pointer typdefs for pointer tables */ michael@0: typedef void (*SFTKDestroy)(void *, PRBool); michael@0: typedef void (*SFTKBegin)(void *); michael@0: typedef SECStatus (*SFTKCipher)(void *,void *,unsigned int *,unsigned int, michael@0: void *, unsigned int); michael@0: typedef SECStatus (*SFTKVerify)(void *,void *,unsigned int,void *,unsigned int); michael@0: typedef void (*SFTKHash)(void *,void *,unsigned int); michael@0: typedef void (*SFTKEnd)(void *,void *,unsigned int *,unsigned int); michael@0: typedef void (*SFTKFree)(void *); michael@0: michael@0: /* Value to tell if an attribute is modifiable or not. michael@0: * NEVER: attribute is only set on creation. michael@0: * ONCOPY: attribute is set on creation and can only be changed on copy. michael@0: * SENSITIVE: attribute can only be changed to TRUE. michael@0: * ALWAYS: attribute can always be changed. michael@0: */ michael@0: typedef enum { michael@0: SFTK_NEVER = 0, michael@0: SFTK_ONCOPY = 1, michael@0: SFTK_SENSITIVE = 2, michael@0: SFTK_ALWAYS = 3 michael@0: } SFTKModifyType; michael@0: michael@0: /* michael@0: * Free Status Enum... tell us more information when we think we're michael@0: * deleting an object. michael@0: */ michael@0: typedef enum { michael@0: SFTK_DestroyFailure, michael@0: SFTK_Destroyed, michael@0: SFTK_Busy michael@0: } SFTKFreeStatus; michael@0: michael@0: /* michael@0: * attribute values of an object. michael@0: */ michael@0: struct SFTKAttributeStr { michael@0: SFTKAttribute *next; michael@0: SFTKAttribute *prev; michael@0: PRBool freeAttr; michael@0: PRBool freeData; michael@0: /*must be called handle to make sftkqueue_find work */ michael@0: CK_ATTRIBUTE_TYPE handle; michael@0: CK_ATTRIBUTE attrib; michael@0: unsigned char space[ATTR_SPACE]; michael@0: }; michael@0: michael@0: michael@0: /* michael@0: * doubly link list of objects michael@0: */ michael@0: struct SFTKObjectListStr { michael@0: SFTKObjectList *next; michael@0: SFTKObjectList *prev; michael@0: SFTKObject *parent; michael@0: }; michael@0: michael@0: struct SFTKObjectFreeListStr { michael@0: SFTKObject *head; michael@0: PZLock *lock; michael@0: int count; michael@0: }; michael@0: michael@0: /* michael@0: * PKCS 11 crypto object structure michael@0: */ michael@0: struct SFTKObjectStr { michael@0: SFTKObject *next; michael@0: SFTKObject *prev; michael@0: CK_OBJECT_CLASS objclass; michael@0: CK_OBJECT_HANDLE handle; michael@0: int refCount; michael@0: PZLock *refLock; michael@0: SFTKSlot *slot; michael@0: void *objectInfo; michael@0: SFTKFree infoFree; michael@0: }; michael@0: michael@0: struct SFTKTokenObjectStr { michael@0: SFTKObject obj; michael@0: SECItem dbKey; michael@0: }; michael@0: michael@0: struct SFTKSessionObjectStr { michael@0: SFTKObject obj; michael@0: SFTKObjectList sessionList; michael@0: PZLock *attributeLock; michael@0: SFTKSession *session; michael@0: PRBool wasDerived; michael@0: int nextAttr; michael@0: SFTKAttribute attrList[MAX_OBJS_ATTRS]; michael@0: PRBool optimizeSpace; michael@0: unsigned int hashSize; michael@0: SFTKAttribute *head[1]; michael@0: }; michael@0: michael@0: /* michael@0: * struct to deal with a temparary list of objects michael@0: */ michael@0: struct SFTKObjectListElementStr { michael@0: SFTKObjectListElement *next; michael@0: SFTKObject *object; michael@0: }; michael@0: michael@0: /* michael@0: * Area to hold Search results michael@0: */ michael@0: struct SFTKSearchResultsStr { michael@0: CK_OBJECT_HANDLE *handles; michael@0: int size; michael@0: int index; michael@0: int array_size; michael@0: }; michael@0: michael@0: michael@0: /* michael@0: * the universal crypto/hash/sign/verify context structure michael@0: */ michael@0: typedef enum { michael@0: SFTK_ENCRYPT, michael@0: SFTK_DECRYPT, michael@0: SFTK_HASH, michael@0: SFTK_SIGN, michael@0: SFTK_SIGN_RECOVER, michael@0: SFTK_VERIFY, michael@0: SFTK_VERIFY_RECOVER michael@0: } SFTKContextType; michael@0: michael@0: /** max block size of supported block ciphers */ michael@0: #define SFTK_MAX_BLOCK_SIZE 16 michael@0: /** currently SHA512 is the biggest hash length */ michael@0: #define SFTK_MAX_MAC_LENGTH 64 michael@0: #define SFTK_INVALID_MAC_SIZE 0xffffffff michael@0: michael@0: /** Particular ongoing operation in session (sign/verify/digest/encrypt/...) michael@0: * michael@0: * Understanding sign/verify context: michael@0: * multi=1 hashInfo=0 block (symmetric) cipher MACing michael@0: * multi=1 hashInfo=X PKC S/V with prior hashing michael@0: * multi=0 hashInfo=0 PKC S/V one shot (w/o hashing) michael@0: * multi=0 hashInfo=X *** shouldn't happen *** michael@0: */ michael@0: struct SFTKSessionContextStr { michael@0: SFTKContextType type; michael@0: PRBool multi; /* is multipart */ michael@0: PRBool rsa; /* is rsa */ michael@0: PRBool doPad; /* use PKCS padding for block ciphers */ michael@0: unsigned int blockSize; /* blocksize for padding */ michael@0: unsigned int padDataLength; /* length of the valid data in padbuf */ michael@0: /** latest incomplete block of data for block cipher */ michael@0: unsigned char padBuf[SFTK_MAX_BLOCK_SIZE]; michael@0: /** result of MAC'ing of latest full block of data with block cipher */ michael@0: unsigned char macBuf[SFTK_MAX_BLOCK_SIZE]; michael@0: CK_ULONG macSize; /* size of a general block cipher mac*/ michael@0: void *cipherInfo; michael@0: void *hashInfo; michael@0: unsigned int cipherInfoLen; michael@0: CK_MECHANISM_TYPE currentMech; michael@0: SFTKCipher update; michael@0: SFTKHash hashUpdate; michael@0: SFTKEnd end; michael@0: SFTKDestroy destroy; michael@0: SFTKDestroy hashdestroy; michael@0: SFTKVerify verify; michael@0: unsigned int maxLen; michael@0: SFTKObject *key; michael@0: }; michael@0: michael@0: /* michael@0: * Sessions (have objects) michael@0: */ michael@0: struct SFTKSessionStr { michael@0: SFTKSession *next; michael@0: SFTKSession *prev; michael@0: CK_SESSION_HANDLE handle; michael@0: int refCount; michael@0: PZLock *objectLock; michael@0: int objectIDCount; michael@0: CK_SESSION_INFO info; michael@0: CK_NOTIFY notify; michael@0: CK_VOID_PTR appData; michael@0: SFTKSlot *slot; michael@0: SFTKSearchResults *search; michael@0: SFTKSessionContext *enc_context; michael@0: SFTKSessionContext *hash_context; michael@0: SFTKSessionContext *sign_context; michael@0: SFTKObjectList *objects[1]; michael@0: }; michael@0: michael@0: /* michael@0: * slots (have sessions and objects) michael@0: * michael@0: * The array of sessionLock's protect the session hash table (head[]) michael@0: * as well as the reference count of session objects in that bucket michael@0: * (head[]->refCount), objectLock protects all elements of the slot's michael@0: * object hash tables (sessObjHashTable[] and tokObjHashTable), and michael@0: * sessionObjectHandleCount. michael@0: * slotLock protects the remaining protected elements: michael@0: * password, isLoggedIn, ssoLoggedIn, and sessionCount, michael@0: * and pwCheckLock serializes the key database password checks in michael@0: * NSC_SetPIN and NSC_Login. michael@0: * michael@0: * Each of the fields below has the following lifetime as commented michael@0: * next to the fields: michael@0: * invariant - This value is set when the slot is first created and michael@0: * never changed until it is destroyed. michael@0: * per load - This value is set when the slot is first created, or michael@0: * when the slot is used to open another directory. Between open and close michael@0: * this field does not change. michael@0: * variable - This value changes through the normal process of slot operation. michael@0: * - reset. The value of this variable is cleared during an open/close michael@0: * cycles. michael@0: * - preserved. The value of this variable is preserved over open/close michael@0: * cycles. michael@0: */ michael@0: struct SFTKSlotStr { michael@0: CK_SLOT_ID slotID; /* invariant */ michael@0: PZLock *slotLock; /* invariant */ michael@0: PZLock **sessionLock; /* invariant */ michael@0: unsigned int numSessionLocks; /* invariant */ michael@0: unsigned long sessionLockMask; /* invariant */ michael@0: PZLock *objectLock; /* invariant */ michael@0: PRLock *pwCheckLock; /* invariant */ michael@0: PRBool present; /* variable -set */ michael@0: PRBool hasTokens; /* per load */ michael@0: PRBool isLoggedIn; /* variable - reset */ michael@0: PRBool ssoLoggedIn; /* variable - reset */ michael@0: PRBool needLogin; /* per load */ michael@0: PRBool DB_loaded; /* per load */ michael@0: PRBool readOnly; /* per load */ michael@0: PRBool optimizeSpace; /* invariant */ michael@0: SFTKDBHandle *certDB; /* per load */ michael@0: SFTKDBHandle *keyDB; /* per load */ michael@0: int minimumPinLen; /* per load */ michael@0: PRInt32 sessionIDCount; /* atomically incremented */ michael@0: /* (preserved) */ michael@0: int sessionIDConflict; /* not protected by a lock */ michael@0: /* (preserved) */ michael@0: int sessionCount; /* variable - reset */ michael@0: PRInt32 rwSessionCount; /* set by atomic operations */ michael@0: /* (reset) */ michael@0: int sessionObjectHandleCount;/* variable - perserved */ michael@0: int index; /* invariant */ michael@0: PLHashTable *tokObjHashTable; /* invariant */ michael@0: SFTKObject **sessObjHashTable; /* variable - reset */ michael@0: unsigned int sessObjHashSize; /* invariant */ michael@0: SFTKSession **head; /* variable -reset */ michael@0: unsigned int sessHashSize; /* invariant */ michael@0: char tokDescription[33]; /* per load */ michael@0: char updateTokDescription[33]; /* per load */ michael@0: char slotDescription[65]; /* invariant */ michael@0: }; michael@0: michael@0: /* michael@0: * special joint operations Contexts michael@0: */ michael@0: struct SFTKHashVerifyInfoStr { michael@0: SECOidTag hashOid; michael@0: void *params; michael@0: NSSLOWKEYPublicKey *key; michael@0: }; michael@0: michael@0: struct SFTKHashSignInfoStr { michael@0: SECOidTag hashOid; michael@0: void *params; michael@0: NSSLOWKEYPrivateKey *key; michael@0: }; michael@0: michael@0: /** michael@0: * Contexts for RSA-OAEP michael@0: */ michael@0: struct SFTKOAEPEncryptInfoStr { michael@0: CK_RSA_PKCS_OAEP_PARAMS *params; michael@0: NSSLOWKEYPublicKey *key; michael@0: }; michael@0: michael@0: struct SFTKOAEPDecryptInfoStr { michael@0: CK_RSA_PKCS_OAEP_PARAMS *params; michael@0: NSSLOWKEYPrivateKey *key; michael@0: }; michael@0: michael@0: /* context for the Final SSLMAC message */ michael@0: struct SFTKSSLMACInfoStr { michael@0: void *hashContext; michael@0: SFTKBegin begin; michael@0: SFTKHash update; michael@0: SFTKEnd end; michael@0: CK_ULONG macSize; michael@0: int padSize; michael@0: unsigned char key[MAX_KEY_LEN]; michael@0: unsigned int keySize; michael@0: }; michael@0: michael@0: /* michael@0: * Template based on SECItems, suitable for passing as arrays michael@0: */ michael@0: struct SFTKItemTemplateStr { michael@0: CK_ATTRIBUTE_TYPE type; michael@0: SECItem *item; michael@0: }; michael@0: michael@0: /* macro for setting SFTKTemplates. */ michael@0: #define SFTK_SET_ITEM_TEMPLATE(templ, count, itemPtr, attr) \ michael@0: templ[count].type = attr; \ michael@0: templ[count].item = itemPtr michael@0: michael@0: #define SFTK_MAX_ITEM_TEMPLATE 10 michael@0: michael@0: /* michael@0: * session handle modifiers michael@0: */ michael@0: #define SFTK_SESSION_SLOT_MASK 0xff000000L michael@0: michael@0: /* michael@0: * object handle modifiers michael@0: */ michael@0: #define SFTK_TOKEN_MASK 0x80000000L michael@0: #define SFTK_TOKEN_MAGIC 0x80000000L michael@0: #define SFTK_TOKEN_TYPE_MASK 0x70000000L michael@0: /* keydb (high bit == 0) */ michael@0: #define SFTK_TOKEN_TYPE_PRIV 0x10000000L michael@0: #define SFTK_TOKEN_TYPE_PUB 0x20000000L michael@0: #define SFTK_TOKEN_TYPE_KEY 0x30000000L michael@0: /* certdb (high bit == 1) */ michael@0: #define SFTK_TOKEN_TYPE_TRUST 0x40000000L michael@0: #define SFTK_TOKEN_TYPE_CRL 0x50000000L michael@0: #define SFTK_TOKEN_TYPE_SMIME 0x60000000L michael@0: #define SFTK_TOKEN_TYPE_CERT 0x70000000L michael@0: michael@0: #define SFTK_TOKEN_KRL_HANDLE (SFTK_TOKEN_MAGIC|SFTK_TOKEN_TYPE_CRL|1) michael@0: /* how big (in bytes) a password/pin we can deal with */ michael@0: #define SFTK_MAX_PIN 255 michael@0: /* minimum password/pin length (in Unicode characters) in FIPS mode */ michael@0: #define FIPS_MIN_PIN 7 michael@0: michael@0: /* slot ID's */ michael@0: #define NETSCAPE_SLOT_ID 1 michael@0: #define PRIVATE_KEY_SLOT_ID 2 michael@0: #define FIPS_SLOT_ID 3 michael@0: michael@0: /* slot helper macros */ michael@0: #define sftk_SlotFromSession(sp) ((sp)->slot) michael@0: #define sftk_isToken(id) (((id) & SFTK_TOKEN_MASK) == SFTK_TOKEN_MAGIC) michael@0: michael@0: /* the session hash multiplier (see bug 201081) */ michael@0: #define SHMULTIPLIER 1791398085 michael@0: michael@0: /* queueing helper macros */ michael@0: #define sftk_hash(value,size) \ michael@0: ((PRUint32)((value) * SHMULTIPLIER) & (size-1)) michael@0: #define sftkqueue_add(element,id,head,hash_size) \ michael@0: { int tmp = sftk_hash(id,hash_size); \ michael@0: (element)->next = (head)[tmp]; \ michael@0: (element)->prev = NULL; \ michael@0: if ((head)[tmp]) (head)[tmp]->prev = (element); \ michael@0: (head)[tmp] = (element); } michael@0: #define sftkqueue_find(element,id,head,hash_size) \ michael@0: for( (element) = (head)[sftk_hash(id,hash_size)]; (element) != NULL; \ michael@0: (element) = (element)->next) { \ michael@0: if ((element)->handle == (id)) { break; } } michael@0: #define sftkqueue_is_queued(element,id,head,hash_size) \ michael@0: ( ((element)->next) || ((element)->prev) || \ michael@0: ((head)[sftk_hash(id,hash_size)] == (element)) ) michael@0: #define sftkqueue_delete(element,id,head,hash_size) \ michael@0: if ((element)->next) (element)->next->prev = (element)->prev; \ michael@0: if ((element)->prev) (element)->prev->next = (element)->next; \ michael@0: else (head)[sftk_hash(id,hash_size)] = ((element)->next); \ michael@0: (element)->next = NULL; \ michael@0: (element)->prev = NULL; \ michael@0: michael@0: #define sftkqueue_init_element(element) \ michael@0: (element)->prev = NULL; michael@0: michael@0: #define sftkqueue_add2(element, id, index, head) \ michael@0: { \ michael@0: (element)->next = (head)[index]; \ michael@0: if ((head)[index]) \ michael@0: (head)[index]->prev = (element); \ michael@0: (head)[index] = (element); \ michael@0: } michael@0: michael@0: #define sftkqueue_find2(element, id, index, head) \ michael@0: for ( (element) = (head)[index]; \ michael@0: (element) != NULL; \ michael@0: (element) = (element)->next) { \ michael@0: if ((element)->handle == (id)) { break; } \ michael@0: } michael@0: michael@0: #define sftkqueue_delete2(element, id, index, head) \ michael@0: if ((element)->next) (element)->next->prev = (element)->prev; \ michael@0: if ((element)->prev) (element)->prev->next = (element)->next; \ michael@0: else (head)[index] = ((element)->next); michael@0: michael@0: #define sftkqueue_clear_deleted_element(element) \ michael@0: (element)->next = NULL; \ michael@0: (element)->prev = NULL; \ michael@0: michael@0: michael@0: /* sessionID (handle) is used to determine session lock bucket */ michael@0: #ifdef NOSPREAD michael@0: /* NOSPREAD: (ID>>L2LPB) & (perbucket-1) */ michael@0: #define SFTK_SESSION_LOCK(slot,handle) \ michael@0: ((slot)->sessionLock[((handle) >> LOG2_BUCKETS_PER_SESSION_LOCK) \ michael@0: & (slot)->sessionLockMask]) michael@0: #else michael@0: /* SPREAD: ID & (perbucket-1) */ michael@0: #define SFTK_SESSION_LOCK(slot,handle) \ michael@0: ((slot)->sessionLock[(handle) & (slot)->sessionLockMask]) michael@0: #endif michael@0: michael@0: /* expand an attribute & secitem structures out */ michael@0: #define sftk_attr_expand(ap) (ap)->type,(ap)->pValue,(ap)->ulValueLen michael@0: #define sftk_item_expand(ip) (ip)->data,(ip)->len michael@0: michael@0: typedef struct sftk_token_parametersStr { michael@0: CK_SLOT_ID slotID; michael@0: char *configdir; michael@0: char *certPrefix; michael@0: char *keyPrefix; michael@0: char *updatedir; michael@0: char *updCertPrefix; michael@0: char *updKeyPrefix; michael@0: char *updateID; michael@0: char *tokdes; michael@0: char *slotdes; michael@0: char *updtokdes; michael@0: int minPW; michael@0: PRBool readOnly; michael@0: PRBool noCertDB; michael@0: PRBool noKeyDB; michael@0: PRBool forceOpen; michael@0: PRBool pwRequired; michael@0: PRBool optimizeSpace; michael@0: } sftk_token_parameters; michael@0: michael@0: typedef struct sftk_parametersStr { michael@0: char *configdir; michael@0: char *updatedir; michael@0: char *updateID; michael@0: char *secmodName; michael@0: char *man; michael@0: char *libdes; michael@0: PRBool readOnly; michael@0: PRBool noModDB; michael@0: PRBool noCertDB; michael@0: PRBool forceOpen; michael@0: PRBool pwRequired; michael@0: PRBool optimizeSpace; michael@0: sftk_token_parameters *tokens; michael@0: int token_count; michael@0: } sftk_parameters; michael@0: michael@0: michael@0: /* path stuff (was machine dependent) used by dbinit.c and pk11db.c */ michael@0: #define CERT_DB_FMT "%scert%s.db" michael@0: #define KEY_DB_FMT "%skey%s.db" michael@0: michael@0: SEC_BEGIN_PROTOS michael@0: michael@0: /* shared functions between pkcs11.c and fipstokn.c */ michael@0: extern PRBool nsf_init; michael@0: extern CK_RV nsc_CommonInitialize(CK_VOID_PTR pReserved, PRBool isFIPS); michael@0: extern CK_RV nsc_CommonFinalize(CK_VOID_PTR pReserved, PRBool isFIPS); michael@0: extern PRBool sftk_ForkReset(CK_VOID_PTR pReserved, CK_RV* crv); michael@0: extern CK_RV nsc_CommonGetSlotList(CK_BBOOL tokPresent, michael@0: CK_SLOT_ID_PTR pSlotList, CK_ULONG_PTR pulCount, int moduleIndex); michael@0: michael@0: /* slot initialization, reinit, shutdown and destruction */ michael@0: extern CK_RV SFTK_SlotInit(char *configdir, char *updatedir, char *updateID, michael@0: sftk_token_parameters *params, int moduleIndex); michael@0: extern CK_RV SFTK_SlotReInit(SFTKSlot *slot, char *configdir, michael@0: char *updatedir, char *updateID, michael@0: sftk_token_parameters *params, int moduleIndex); michael@0: extern CK_RV SFTK_DestroySlotData(SFTKSlot *slot); michael@0: extern CK_RV SFTK_ShutdownSlot(SFTKSlot *slot); michael@0: extern CK_RV sftk_CloseAllSessions(SFTKSlot *slot, PRBool logout); michael@0: michael@0: michael@0: /* internal utility functions used by pkcs11.c */ michael@0: extern SFTKAttribute *sftk_FindAttribute(SFTKObject *object, michael@0: CK_ATTRIBUTE_TYPE type); michael@0: extern void sftk_FreeAttribute(SFTKAttribute *attribute); michael@0: extern CK_RV sftk_AddAttributeType(SFTKObject *object, CK_ATTRIBUTE_TYPE type, michael@0: const void *valPtr, CK_ULONG length); michael@0: extern CK_RV sftk_Attribute2SecItem(PLArenaPool *arena, SECItem *item, michael@0: SFTKObject *object, CK_ATTRIBUTE_TYPE type); michael@0: extern CK_RV sftk_MultipleAttribute2SecItem(PLArenaPool *arena, michael@0: SFTKObject *object, SFTKItemTemplate *templ, int count); michael@0: extern unsigned int sftk_GetLengthInBits(unsigned char *buf, michael@0: unsigned int bufLen); michael@0: extern CK_RV sftk_ConstrainAttribute(SFTKObject *object, michael@0: CK_ATTRIBUTE_TYPE type, int minLength, int maxLength, int minMultiple); michael@0: extern PRBool sftk_hasAttribute(SFTKObject *object, CK_ATTRIBUTE_TYPE type); michael@0: extern PRBool sftk_isTrue(SFTKObject *object, CK_ATTRIBUTE_TYPE type); michael@0: extern void sftk_DeleteAttributeType(SFTKObject *object, michael@0: CK_ATTRIBUTE_TYPE type); michael@0: extern CK_RV sftk_Attribute2SecItem(PLArenaPool *arena, SECItem *item, michael@0: SFTKObject *object, CK_ATTRIBUTE_TYPE type); michael@0: extern CK_RV sftk_Attribute2SSecItem(PLArenaPool *arena, SECItem *item, michael@0: SFTKObject *object, michael@0: CK_ATTRIBUTE_TYPE type); michael@0: extern SFTKModifyType sftk_modifyType(CK_ATTRIBUTE_TYPE type, michael@0: CK_OBJECT_CLASS inClass); michael@0: extern PRBool sftk_isSensitive(CK_ATTRIBUTE_TYPE type, CK_OBJECT_CLASS inClass); michael@0: extern char *sftk_getString(SFTKObject *object, CK_ATTRIBUTE_TYPE type); michael@0: extern void sftk_nullAttribute(SFTKObject *object,CK_ATTRIBUTE_TYPE type); michael@0: extern CK_RV sftk_GetULongAttribute(SFTKObject *object, CK_ATTRIBUTE_TYPE type, michael@0: CK_ULONG *longData); michael@0: extern CK_RV sftk_forceAttribute(SFTKObject *object, CK_ATTRIBUTE_TYPE type, michael@0: const void *value, unsigned int len); michael@0: extern CK_RV sftk_defaultAttribute(SFTKObject *object, CK_ATTRIBUTE_TYPE type, michael@0: const void *value, unsigned int len); michael@0: extern unsigned int sftk_MapTrust(CK_TRUST trust, PRBool clientAuth); michael@0: michael@0: extern SFTKObject *sftk_NewObject(SFTKSlot *slot); michael@0: extern CK_RV sftk_CopyObject(SFTKObject *destObject, SFTKObject *srcObject); michael@0: extern SFTKFreeStatus sftk_FreeObject(SFTKObject *object); michael@0: extern CK_RV sftk_DeleteObject(SFTKSession *session, SFTKObject *object); michael@0: extern void sftk_ReferenceObject(SFTKObject *object); michael@0: extern SFTKObject *sftk_ObjectFromHandle(CK_OBJECT_HANDLE handle, michael@0: SFTKSession *session); michael@0: extern void sftk_AddSlotObject(SFTKSlot *slot, SFTKObject *object); michael@0: extern void sftk_AddObject(SFTKSession *session, SFTKObject *object); michael@0: /* clear out all the existing object ID to database key mappings. michael@0: * used to reinit a token */ michael@0: extern CK_RV SFTK_ClearTokenKeyHashTable(SFTKSlot *slot); michael@0: michael@0: extern CK_RV sftk_searchObjectList(SFTKSearchResults *search, michael@0: SFTKObject **head, unsigned int size, michael@0: PZLock *lock, CK_ATTRIBUTE_PTR inTemplate, michael@0: int count, PRBool isLoggedIn); michael@0: extern SFTKObjectListElement *sftk_FreeObjectListElement( michael@0: SFTKObjectListElement *objectList); michael@0: extern void sftk_FreeObjectList(SFTKObjectListElement *objectList); michael@0: extern void sftk_FreeSearch(SFTKSearchResults *search); michael@0: extern CK_RV sftk_handleObject(SFTKObject *object, SFTKSession *session); michael@0: michael@0: extern SFTKSlot *sftk_SlotFromID(CK_SLOT_ID slotID, PRBool all); michael@0: extern SFTKSlot *sftk_SlotFromSessionHandle(CK_SESSION_HANDLE handle); michael@0: extern SFTKSession *sftk_SessionFromHandle(CK_SESSION_HANDLE handle); michael@0: extern void sftk_FreeSession(SFTKSession *session); michael@0: extern SFTKSession *sftk_NewSession(CK_SLOT_ID slotID, CK_NOTIFY notify, michael@0: CK_VOID_PTR pApplication, CK_FLAGS flags); michael@0: extern void sftk_update_state(SFTKSlot *slot,SFTKSession *session); michael@0: extern void sftk_update_all_states(SFTKSlot *slot); michael@0: extern void sftk_FreeContext(SFTKSessionContext *context); michael@0: extern void sftk_InitFreeLists(void); michael@0: extern void sftk_CleanupFreeLists(void); michael@0: michael@0: extern NSSLOWKEYPublicKey *sftk_GetPubKey(SFTKObject *object, michael@0: CK_KEY_TYPE key_type, CK_RV *crvp); michael@0: extern NSSLOWKEYPrivateKey *sftk_GetPrivKey(SFTKObject *object, michael@0: CK_KEY_TYPE key_type, CK_RV *crvp); michael@0: extern void sftk_FormatDESKey(unsigned char *key, int length); michael@0: extern PRBool sftk_CheckDESKey(unsigned char *key); michael@0: extern PRBool sftk_IsWeakKey(unsigned char *key,CK_KEY_TYPE key_type); michael@0: michael@0: /* mechanism allows this operation */ michael@0: extern CK_RV sftk_MechAllowsOperation(CK_MECHANISM_TYPE type, CK_ATTRIBUTE_TYPE op); michael@0: michael@0: /* helper function which calls nsslowkey_FindKeyByPublicKey after safely michael@0: * acquiring a reference to the keydb from the slot */ michael@0: NSSLOWKEYPrivateKey *sftk_FindKeyByPublicKey(SFTKSlot *slot, SECItem *dbKey); michael@0: michael@0: /* michael@0: * parameter parsing functions michael@0: */ michael@0: CK_RV sftk_parseParameters(char *param, sftk_parameters *parsed, PRBool isFIPS); michael@0: void sftk_freeParams(sftk_parameters *params); michael@0: michael@0: michael@0: /* michael@0: * narrow objects michael@0: */ michael@0: SFTKSessionObject * sftk_narrowToSessionObject(SFTKObject *); michael@0: SFTKTokenObject * sftk_narrowToTokenObject(SFTKObject *); michael@0: michael@0: /* michael@0: * token object utilities michael@0: */ michael@0: void sftk_addHandle(SFTKSearchResults *search, CK_OBJECT_HANDLE handle); michael@0: PRBool sftk_poisonHandle(SFTKSlot *slot, SECItem *dbkey, michael@0: CK_OBJECT_HANDLE handle); michael@0: SFTKObject * sftk_NewTokenObject(SFTKSlot *slot, SECItem *dbKey, michael@0: CK_OBJECT_HANDLE handle); michael@0: SFTKTokenObject *sftk_convertSessionToToken(SFTKObject *so); michael@0: michael@0: michael@0: /* J-PAKE (jpakesftk.c) */ michael@0: extern michael@0: CK_RV jpake_Round1(HASH_HashType hashType, michael@0: CK_NSS_JPAKERound1Params * params, michael@0: SFTKObject * key); michael@0: extern michael@0: CK_RV jpake_Round2(HASH_HashType hashType, michael@0: CK_NSS_JPAKERound2Params * params, michael@0: SFTKObject * sourceKey, SFTKObject * key); michael@0: extern michael@0: CK_RV jpake_Final(HASH_HashType hashType, michael@0: const CK_NSS_JPAKEFinalParams * params, michael@0: SFTKObject * sourceKey, SFTKObject * key); michael@0: michael@0: /* Constant time MAC functions (hmacct.c) */ michael@0: michael@0: struct sftk_MACConstantTimeCtxStr { michael@0: const SECHashObject *hash; michael@0: unsigned char mac[64]; michael@0: unsigned char secret[64]; michael@0: unsigned int headerLength; michael@0: unsigned int secretLength; michael@0: unsigned int totalLength; michael@0: unsigned char header[75]; michael@0: }; michael@0: typedef struct sftk_MACConstantTimeCtxStr sftk_MACConstantTimeCtx; michael@0: sftk_MACConstantTimeCtx* sftk_HMACConstantTime_New( michael@0: CK_MECHANISM_PTR mech, SFTKObject *key); michael@0: sftk_MACConstantTimeCtx* sftk_SSLv3MACConstantTime_New( michael@0: CK_MECHANISM_PTR mech, SFTKObject *key); michael@0: void sftk_HMACConstantTime_Update(void *pctx, void *data, unsigned int len); michael@0: void sftk_SSLv3MACConstantTime_Update(void *pctx, void *data, unsigned int len); michael@0: void sftk_MACConstantTime_EndHash( michael@0: void *pctx, void *out, unsigned int *outLength, unsigned int maxLength); michael@0: void sftk_MACConstantTime_DestroyContext(void *pctx, PRBool); michael@0: michael@0: /**************************************** michael@0: * implement TLS Pseudo Random Function (PRF) michael@0: */ michael@0: michael@0: extern CK_RV michael@0: sftk_TLSPRFInit(SFTKSessionContext *context, michael@0: SFTKObject * key, michael@0: CK_KEY_TYPE key_type, michael@0: HASH_HashType hash_alg); michael@0: michael@0: SEC_END_PROTOS michael@0: michael@0: #endif /* _PKCS11I_H_ */