aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2023-12-06Version 1.1.0HEADv1.1.0masterJames Bottomley1-1/+1
* openssl3 support * check correct attributes for functions Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2023-12-06pkcs11: gate functions by attributesnextJames Bottomley1-0/+8
Make sure we have CKA_SIGN set to sign keys and CKA_DECRYPT set to decrypt from them. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2023-12-06openssl3 updatesJames Bottomley2-2/+5
Explicitly include bn.h and use get1 functions for EC_KEY operations because get0 requires a const return. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2023-12-06Add support for openssl-3James Bottomley3-3/+13
Detect being built with openssl-3 and build with the 1.1 API to prevent deprecation warnings breaking the build. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-07-01Version: 1.0.0v1.0.0James Bottomley1-1/+1
* Add man page * use public engine keys * fix crash on non-existent key Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-07-01add man pages for openssl-pkcs11.confJames Bottomley3-0/+247
This adds a man page which describes how to build your own configuration file and gives examples of using the PKCS#11 module. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-07-01Allow engine keys to be a public key fileJames Bottomley1-4/+18
Some engines have corresponding public key load methods, so use those if the normal load of the public key fails. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-07-01Fix non-existent public key/cert problemJames Bottomley2-5/+7
Right at the moment the token library segfaults if the public key isn't found. This is because the serial number gets set to NULL and the ATTRIB macro tries to do strlen(NULL). Fix this, but also ensure that any failure to load the public key/cert results in the token being removed from the exported list. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-06-25Version: 0.6.2v0.6.2James Bottomley1-1/+1
* Fix segfault on no config file * Fix elliptic curve signature * Fix C_Initialize and find Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-06-09Make manufacturer id and model config specifiableJames Bottomley9-27/+46
And update all the tests to reflect this. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-06-01tests: add tests for searching the keys using p11toolJames Bottomley1-0/+24
Since the result of the bug with find restrictions was for p11tool to produce "no objects" for every search, check that we can set search parameters using p11tool and verify the outputs look correct. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-06-01pkcs11.c: fix failing findJames Bottomley1-1/+2
p11tool --list-all isn't showing any keys. That's because it does its first search of the object with no parameters at all: looking for every object. However, there's a misplaced condition checking for a valid find that currently expects to see a type restriction. Fix this to allow no type restriction as valid. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-05-31pkcs11.c: fix C_InitializeJames Bottomley1-5/+16
C_Initialize is currently returning CKR_CANT_LOCK if the argument is not null, which is completely bogus. The problem we have is that we must use OS provided locking primitives because we rely on openssl which does. We're given permission to use OS locking primitives in three cases 1) The argument is NULL 2) The arg->flags contain CKF_OS_LOCKING_OK 3) Regardless of arg->flags, all four locking function are NULL So fix the check to look for these cases. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-05-29tests: add tests for EC signature with opensslJames Bottomley1-0/+7
This was failing before the EC signature module got fixed, so make sure it never fails again. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-05-29crypto-ec: fix output for EC signatureJames Bottomley1-2/+4
The size of the signature isn't getting set correctly. Apparently this doesn't matter for gnutls, but it does for the openssl pkcs11 engine, which otherwise gets the wrong size and thus the wrong format for the signature. Fix by always setting sig_len regardless of whether we're signing or not. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-05-29crypto.c: check that the password is correct for loginJames Bottomley1-1/+39
With PKCS11 tokens, if C_Login returns OK that confirms the password is correct. However, with engine keys, the password may or may not be checked in ENGINE_load_private_key() so try to perform a signing operation if that function returns a key. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-05-29Add test to make sure we don't get a segfault on a problem config fileJames Bottomley3-1/+11
Now the token should fail to initialize and p11tool should say so Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2020-05-29Fix segfault if config file is not present or unparseableJames Bottomley3-11/+13
Make parse_ini_file return a failure if the configuration could not be extracted and make C_Initialize return and error for this case. This prevents any correct PKCS11 token user from doing anything else with the token. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-03-04Version: 0.6.1v0.6.1James Bottomley1-1/+1
* Fix testing problems on older architectures Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-03-04Tests: shuffle tests around for gnutls failuresJames Bottomley2-8/+14
Apparently older versions of gnutls don't handle RSA-PSS or ECC keys very well, even though they seem to understand them. Move those tests to the p11tools_test_sign.sh test which isn't executed for older gnutls. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-03-04pkcs11.c: remove stray debugging printf in C_FindObjectsInitJames Bottomley1-1/+0
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-03-04crypto.c: add openssl initializationJames Bottomley1-0/+4
Earlier versions require this otherwise they can't read encrypted keys. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-03-03Version: 0.6.0v0.6.0James Bottomley1-1/+1
* Add certificates * Fix certificates for mozilla-nss Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-03-03Add certificate testsJames Bottomley6-1/+31
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-03-03Add ability to have key and certificateJames Bottomley4-37/+157
Firefox seems to require the token to store the private key and the certificate, so you can't simply use a token for a private key and an external certificate. Thus we add the ability to specify a certificate instead of a public key. In that case, the token will have three objects: the certificate, the public key (extracted from the certificate) and the private key. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-03-03pkcs11.c: abstract key type encodingJames Bottomley1-9/+57
At the moment we use a single bit to identify public/private key, so move this to accessors instead of open coding it in preparation for adding certificate types as well. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-03-03allow firefox to use engine filesJames Bottomley1-1/+4
In order to load dynamic engines, the builtin engines need to be loaded. Usually this happens automatically, but not when openssl-pkcs11-export is used by firefox, so do it whenever an engine is requested. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-03-03p11tool_checks: add tests for signatures using certtoolJames Bottomley1-0/+23
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-28Version: 0.5.1James Bottomley1-1/+1
* Fix builds for older gcc and openssl < 1.1.0 Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-28tests: cope with older versions of p11toolJames Bottomley4-14/+30
p11tool before version 3.4.4 didn't have the --test-sign option, which we use to test signatures. Split out test signing into a separate module and check that we can run it in configure.ac Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-28crypto-ec: Fix for OpenSSL versions < 1.1.0James Bottomley1-0/+28
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-28Fix for gcc-4.8.5James Bottomley1-1/+1
Apparently it gets confused by casting an initializer Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-28Version: 0.5.0v0.5.0James Bottomley1-1/+1
* Support for Elliptic Curve Keys (signing only) * fix bugs that cause problems in mozilla-nss Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-28Fix fedora build: brainpool not supportedJames Bottomley1-1/+1
For some unknown reason fedora doesn't have the brainpool curves, so use secp384r1 for parametrised testing instead. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-27pkcs11: Fill in missing C_ functionsJames Bottomley1-0/+12
It turns out Mozilla nss is keen on C_CreateObject, which is currently NULL, so identify all the other NULL C_ functions and fill them in with the unimplemented message. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-27Fix Mozilla slot problemJames Bottomley2-7/+12
mozilla NSS refers to slots by description only. Unfortunately, we currently use the same default description for every slot, confusing nss. Fix this by using the section name by default for the slot description and allowing a per-section override in the conf file. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-27Elliptic Curve Signature ChecksJames Bottomley2-3/+29
Apparently this is somewhat hard to do: the pkcs11 engine from libp11 0.4.9 has the C_Sign routines stubbed out, so the only way of checking is with gnutls p11tool and, apparently, gnutls doesn't understand parametrised curves. Therefore, signature testing is limited to named curves until I can find another test programme. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-27crypto-ec: add elliptic curve keysJames Bottomley6-7/+147
Just sign at the moment. It turns out there's a problem with the openssl sign routines in that they spit out an incompatible format from the one pkcs11 expects, so we have to intercept and convert. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-26crypto: split out RSA specific functionsJames Bottomley4-185/+261
In order to support more key types, first split out all the mechanism specific key handling into its own separate file. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-24Version: 0.4.1v0.4.1James Bottomley1-1/+1
* fix debian build Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-24get rid of libiberty.hJames Bottomley1-1/+2
It turns out to be a huge pain to find in a distro independent fashion and we only need the definition of ARRAY_SIZE. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-23Version: 0.4.0v0.4.0James Bottomley8-21/+21
* Effect rename to openssl-pkcs11-export for Fedora * Allow multiple sessions and finds per token Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-23Fix attribute check for gnutlsJames Bottomley1-0/+2
As of version 3.6.6 gnutls checks to see if we have the CKA_SIGN and CKA_DECRYPT attributes set for PSS signing and OAEP decryption keys. These are set in the cache but not processed by our attribute handling code, so add them. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-23Fix PIN passingJames Bottomley1-2/+8
p11tool may not NULL terminate the pin (as allowed by pkcs11) but openssl assumes it is, so copy it into a NULL terminated string to make sure. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-23Add p11tool based checksJames Bottomley2-1/+20
p11tool provides a number of useful token checks, so add them. This gives us a dependency on gnutls for testing only. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-23Fix C_GetMechanismInfoJames Bottomley3-14/+31
In spite of us listing multiple mechanisms it is hard coded only to accept CKM_RSA_PKCS. Apparently the openssl pkcs11 engine doesn't check this, but p11tool does, so return the correct information for all mechanisms. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-23Implement multiple sessionsJames Bottomley1-5/+12
It turns out that gnutls p11tool will open multiple sessions to the token when checking signatures. This looks like a bug in p11tool, but means we have to implement multiple sessions if we want to get the tool to check signatures on our keys. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-18Make find multi threadedJames Bottomley1-5/+33
Currently, there can only be one outstanding find at once, which violates the principles of pkcs11 operation because there may be one find per session outstanding. Fix this by running find state through the section cache. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-18Make sessions dynamicJames Bottomley1-8/+19
Remove the fixed session limit and now make every session have an entry in the cache. Keep to one allowable session per slot. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-18Version: 0.3.1v0.3.1James Bottomley1-1/+1
* Fix make check on openssl 1.1.1a Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-18Fix check testsJames Bottomley2-1/+6
The value of len must be set before being passed in to the signature routine because certain versions of openssl won't just blindly set the length. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-18Version: 0.3.0v0.3.0James Bottomley1-1/+1
* with per session logins, now seems to work in firefox pkcs11 Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-18Make logins per session instead of globalJames Bottomley1-5/+11
Having a global login parameter is a failure if we have more than one key, so make logins local to the session using the presence of the private key in the cache as an indicator of whether we are logged in or not. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-18Fix memory leak in EVP_PKEY elementsJames Bottomley3-0/+9
The cache assumes that all the memory is fixed, which is usually true because it's block allocated for the config file. However type CACHE_PKEY is an exception because they're dynamically allocated, so add a freeing function callback to make sure they're correctly freed when no longer in use. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-18Add C_LogoutJames Bottomley3-2/+16
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-17Add missing version information to CK_FUNCTION_LISTJames Bottomley1-0/+4
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-17Fill in all missing function definitionsJames Bottomley1-0/+91
PKCS#11 requires that all functions in the CK_FUNCTION_LIST have a value, so add dummy functions for all the missing ones. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-17Add C_CloseAllSessionsJames Bottomley1-0/+8
Seems that Mozilla uses this one Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-17Version: 0.2.0v0.2.0James Bottomley1-1/+1
* Now builds on a variety of platforms Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-15Fix -Werror=stringop-truncation, required for Fedora RawhideJames Bottomley1-2/+2
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-15Fix 32 bit buildsJames Bottomley2-6/+12
Problems over size_t vs unsigned long mismatches. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-08Version: 0.1.1v0.1.1James Bottomley1-1/+1
Fix builds on older versions of openSUSE Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-08crypto.c: remove stray serial number debug printJames Bottomley1-1/+0
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-08Fix openssl 1.0.2 incompatibilitiesJames Bottomley5-12/+29
openssl 1.0.2 has the following bugs and problems: - pkeyutls pss signature verification will say the signature verified OK but then returns a failure code - have to use BUF_memdup not OPENSSL_memdup - it will initialize and start any engine. This means the config file for the token must be in place before any use of openssl. This had the ancillary problem that pkcs11 doesn't like a module with no token slots, so set a dummy empty slot for that case. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-08Do autoconf magic for reallocarrayJames Bottomley2-0/+9
Since it's a comparatively recent addition to glibc and older OSs won't have it. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-07Version 0.1.0v0.1.0James Bottomley1-1/+1
It looks like we finally have enough functionality to make a release. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-07Add serial number to tokenJames Bottomley3-5/+44
All tokens usually have a serial number so make sure we have one to show as well. Ideally it is taken from the serial parameter of the config file, but failing that we'll construct one from the sha256 hash of the public key. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-07Update READMEJames Bottomley1-1/+77
Add details of the config file as well as use case examples. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-07Fixes for package buildingJames Bottomley2-2/+4
- remove gnutls dependency (p11tool) it's only used for pretty output - make openssl.cnf find the openssl-pkcs11 module directly Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-06Add installation of p11 kit moduleJames Bottomley3-0/+10
p11-kit requires a <thing>.module file which at least points to the shared pkcs11 library to be installed in its module directory otherwise it won't include the token in any of its iterations. Install such a file for openssl-pkcs11. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-06add engine testsJames Bottomley5-2/+169
The difference between an engine and a PEM key is pretty minor: it's the password processing, so create a minimal simple engine that reads keys with a special guard and check that it gets the password right. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-06Add tests for PSS signatures and OAEP encryptionJames Bottomley2-0/+19
Add a suite of tests running through the relevant hashes for PSS and OAEP to detect that we're passing the parameters correctly. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-06Fix PSS signaturesJames Bottomley1-0/+1
Even though we never do a hash, we need to know what the hash of the signature was for the PSS algorithm to work correctly, so set that information. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-06Add rudimentary testingJames Bottomley7-1/+80
Simple key tests for with and without password of rsa encryption/decryption and sign/verify. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-05Add error reporting to key operationsJames Bottomley1-4/+12
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-04Add engine based keys and password handlingJames Bottomley1-10/+53
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-04move from opencryptoki to p11-kit include filesJames Bottomley5-7/+13
We already use p11-kit for the module path, so we might as well use it for the definitions. Add a pkgconf check for the right version and cope with a missing CKZ symbol (which was eventually added in a later p11-kit version). Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-04crypto: add support for PSS and OAEP signing and encryption schemesJames Bottomley1-1/+73
Somewhat problematic because various versions of openssl have different levels of support for this, but 1.1.0 supports them fully. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-03Add raw (x509) padding typeJames Bottomley3-31/+88
also redo signatures so we only return the size for a null destination argument. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-01Add RSA decrypt functionJames Bottomley3-0/+46
This completes the suite of functions necessary to make RSA private keys functional with openssl. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-01Fix p11tool --test-signJames Bottomley1-1/+4
It turns out p11tool forgets to close a session, so allow up to two concurrent sessions. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-01Fix key boolean attributesJames Bottomley3-15/+38
The most of the CKA_XX attributes are shared between public and private keys, but the booleans aren't because they mostly describe key properties. For instance CKA_PRIVATE should only be set on private keys. Fix this by updating the specification system to allow us to show whether a given attribute belongs to the public or private key (or both for some attributes). Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-02-01Get functionality up to private key signingJames Bottomley6-22/+189
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-29fix openssl rsa public key export from pkcs11 engineJames Bottomley1-0/+13
Apparently the openssl pkcs11 engine won't recognize us unless we populate the slot flags with CKF_TOKEN_PRESENT, so do this and add other slot info (the openssl engine prints out the slot strings not the token strings when debugging) With this, both openssl rsa -text -engine pkcs11 -inform engine -pubin -in <URI> and p11tool --export <URI> Work correctly on the public key URI to export the public key Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-29Add rudimentary support for public keysJames Bottomley4-7/+229
Make the library single threaded only, only allow one session and only loads and finds the public key. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-28Allow BIGNUMS to be put into the cacheJames Bottomley4-13/+79
So we can store quantities like CKA_MODULUS for public keys. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-28Add .gitignore for autoconfJames Bottomley1-0/+17
So git status shows us files we care about rather than all the autoconf created files Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-28Add cryptographic key loadingJames Bottomley6-10/+102
Still no key functionality. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-28Add ini file parser and LICENSE fileJames Bottomley6-11/+551
Add a simple ini file parser that builds the token information from the ini formatted config file. Still no key handling, but it does work with p11-kit and p11tool to list the URIs (will crash if you try to do any key functions). Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-28Rename files for functionJames Bottomley2-1/+1
No need to have an openssl- prefix the current file is simply a pkcs11 provider so call it pkcs11.c Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
2019-01-28Initial commit: static pkcs11 engine with enough functionality for p11-kitJames Bottomley4-0/+193
This commit represents just enough of pkcs11 to get p11-kit viably showing urls for the fake token. Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-17 06:17:45 +0000