1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 */
25
26 #include <strings.h>
27 #include <errno.h>
28 #include <cryptoutil.h>
29 #include <unistd.h> /* for pid_t */
30 #include <pthread.h>
31 #include <security/cryptoki.h>
32 #include "softGlobal.h"
33 #include "softSession.h"
34 #include "softObject.h"
35 #include "softKeystore.h"
36 #include "softKeystoreUtil.h"
37
38 #pragma init(softtoken_init)
39 #pragma fini(softtoken_fini)
40
41 extern soft_session_t token_session; /* for fork handler */
42
43 static struct CK_FUNCTION_LIST functionList = {
44 { 2, 20 }, /* version */
45 C_Initialize,
46 C_Finalize,
47 C_GetInfo,
48 C_GetFunctionList,
49 C_GetSlotList,
50 C_GetSlotInfo,
51 C_GetTokenInfo,
52 C_GetMechanismList,
53 C_GetMechanismInfo,
54 C_InitToken,
55 C_InitPIN,
56 C_SetPIN,
57 C_OpenSession,
58 C_CloseSession,
59 C_CloseAllSessions,
60 C_GetSessionInfo,
61 C_GetOperationState,
62 C_SetOperationState,
63 C_Login,
64 C_Logout,
65 C_CreateObject,
66 C_CopyObject,
67 C_DestroyObject,
68 C_GetObjectSize,
69 C_GetAttributeValue,
70 C_SetAttributeValue,
71 C_FindObjectsInit,
72 C_FindObjects,
73 C_FindObjectsFinal,
74 C_EncryptInit,
75 C_Encrypt,
76 C_EncryptUpdate,
77 C_EncryptFinal,
78 C_DecryptInit,
79 C_Decrypt,
80 C_DecryptUpdate,
81 C_DecryptFinal,
82 C_DigestInit,
83 C_Digest,
84 C_DigestUpdate,
85 C_DigestKey,
86 C_DigestFinal,
87 C_SignInit,
88 C_Sign,
89 C_SignUpdate,
90 C_SignFinal,
91 C_SignRecoverInit,
92 C_SignRecover,
93 C_VerifyInit,
94 C_Verify,
95 C_VerifyUpdate,
96 C_VerifyFinal,
97 C_VerifyRecoverInit,
98 C_VerifyRecover,
99 C_DigestEncryptUpdate,
100 C_DecryptDigestUpdate,
101 C_SignEncryptUpdate,
102 C_DecryptVerifyUpdate,
103 C_GenerateKey,
104 C_GenerateKeyPair,
105 C_WrapKey,
106 C_UnwrapKey,
107 C_DeriveKey,
108 C_SeedRandom,
109 C_GenerateRandom,
110 C_GetFunctionStatus,
111 C_CancelFunction,
112 C_WaitForSlotEvent
113 };
114
115 boolean_t softtoken_initialized = B_FALSE;
116
117 static pid_t softtoken_pid = 0;
118
119 /* This mutex protects soft_session_list, all_sessions_closing */
120 pthread_mutex_t soft_sessionlist_mutex;
121 soft_session_t *soft_session_list = NULL;
122
123 int all_sessions_closing = 0;
124
125 slot_t soft_slot;
126 obj_to_be_freed_list_t obj_delay_freed;
127 ses_to_be_freed_list_t ses_delay_freed;
128
129 /* protects softtoken_initialized and access to C_Initialize/C_Finalize */
130 pthread_mutex_t soft_giant_mutex = PTHREAD_MUTEX_INITIALIZER;
131
132 static CK_RV finalize_common(boolean_t force, CK_VOID_PTR pReserved);
133 static void softtoken_init();
134 static void softtoken_fini();
135 static void softtoken_fork_prepare();
136 static void softtoken_fork_after();
137
138 CK_RV
139 C_Initialize(CK_VOID_PTR pInitArgs)
140 {
141
142 int initialize_pid;
143 boolean_t supplied_ok;
144 CK_RV rv;
145
146 /*
147 * Get lock to insure only one thread enters this
148 * function at a time.
149 */
150 (void) pthread_mutex_lock(&soft_giant_mutex);
151
152 initialize_pid = getpid();
153
154 if (softtoken_initialized) {
155 if (initialize_pid == softtoken_pid) {
156 /*
157 * This process has called C_Initialize already
158 */
159 (void) pthread_mutex_unlock(&soft_giant_mutex);
160 return (CKR_CRYPTOKI_ALREADY_INITIALIZED);
161 } else {
162 /*
163 * A fork has happened and the child is
164 * reinitializing. Do a finalize_common to close
165 * out any state from the parent, and then
166 * continue on.
167 */
168 (void) finalize_common(B_TRUE, NULL);
169 }
170 }
171
172 if (pInitArgs != NULL) {
173 CK_C_INITIALIZE_ARGS *initargs1 =
174 (CK_C_INITIALIZE_ARGS *) pInitArgs;
175
176 /* pReserved must be NULL */
177 if (initargs1->pReserved != NULL) {
178 (void) pthread_mutex_unlock(&soft_giant_mutex);
179 return (CKR_ARGUMENTS_BAD);
180 }
181
182 /*
183 * ALL supplied function pointers need to have the value
184 * either NULL or non-NULL.
185 */
186 supplied_ok = (initargs1->CreateMutex == NULL &&
187 initargs1->DestroyMutex == NULL &&
188 initargs1->LockMutex == NULL &&
189 initargs1->UnlockMutex == NULL) ||
190 (initargs1->CreateMutex != NULL &&
191 initargs1->DestroyMutex != NULL &&
192 initargs1->LockMutex != NULL &&
193 initargs1->UnlockMutex != NULL);
194
195 if (!supplied_ok) {
196 (void) pthread_mutex_unlock(&soft_giant_mutex);
197 return (CKR_ARGUMENTS_BAD);
198 }
199
200 /*
201 * When the CKF_OS_LOCKING_OK flag isn't set and mutex
202 * function pointers are supplied by an application,
203 * return an error. We must be able to use our own primitives.
204 */
205 if (!(initargs1->flags & CKF_OS_LOCKING_OK) &&
206 (initargs1->CreateMutex != NULL)) {
207 (void) pthread_mutex_unlock(&soft_giant_mutex);
208 return (CKR_CANT_LOCK);
209 }
210 }
211
212 /* Initialize the session list lock */
213 if (pthread_mutex_init(&soft_sessionlist_mutex, NULL) != 0) {
214 (void) pthread_mutex_unlock(&soft_giant_mutex);
215 return (CKR_CANT_LOCK);
216 }
217
218 /*
219 * token object related initialization
220 */
221 soft_slot.authenticated = 0;
222 soft_slot.userpin_change_needed = 0;
223 soft_slot.token_object_list = NULL;
224 soft_slot.keystore_load_status = KEYSTORE_UNINITIALIZED;
225
226 if ((rv = soft_init_token_session()) != CKR_OK) {
227 (void) pthread_mutex_destroy(&soft_sessionlist_mutex);
228 (void) pthread_mutex_unlock(&soft_giant_mutex);
229 return (rv);
230 }
231
232 /* Initialize the slot lock */
233 if (pthread_mutex_init(&soft_slot.slot_mutex, NULL) != 0) {
234 (void) pthread_mutex_destroy(&soft_sessionlist_mutex);
235 (void) soft_destroy_token_session();
236 (void) pthread_mutex_unlock(&soft_giant_mutex);
237 return (CKR_CANT_LOCK);
238 }
239
240 /* Initialize the keystore lock */
241 if (pthread_mutex_init(&soft_slot.keystore_mutex, NULL) != 0) {
242 (void) pthread_mutex_destroy(&soft_slot.slot_mutex);
243 (void) pthread_mutex_destroy(&soft_sessionlist_mutex);
244 (void) soft_destroy_token_session();
245 (void) pthread_mutex_unlock(&soft_giant_mutex);
246 return (CKR_CANT_LOCK);
247 }
248
249 /* Initialize the object_to_be_freed list */
250 if (pthread_mutex_init(&obj_delay_freed.obj_to_be_free_mutex, NULL)
251 != 0) {
252 (void) pthread_mutex_destroy(&soft_slot.keystore_mutex);
253 (void) pthread_mutex_destroy(&soft_slot.slot_mutex);
254 (void) pthread_mutex_destroy(&soft_sessionlist_mutex);
255 (void) soft_destroy_token_session();
256 (void) pthread_mutex_unlock(&soft_giant_mutex);
257 return (CKR_CANT_LOCK);
258 }
259 obj_delay_freed.count = 0;
260 obj_delay_freed.first = NULL;
261 obj_delay_freed.last = NULL;
262
263 if (pthread_mutex_init(&ses_delay_freed.ses_to_be_free_mutex, NULL)
264 != 0) {
265 (void) pthread_mutex_destroy(
266 &obj_delay_freed.obj_to_be_free_mutex);
267 (void) pthread_mutex_destroy(&soft_slot.keystore_mutex);
268 (void) pthread_mutex_destroy(&soft_slot.slot_mutex);
269 (void) pthread_mutex_destroy(&soft_sessionlist_mutex);
270 (void) soft_destroy_token_session();
271 (void) pthread_mutex_unlock(&soft_giant_mutex);
272 return (CKR_CANT_LOCK);
273 }
274 ses_delay_freed.count = 0;
275 ses_delay_freed.first = NULL;
276 ses_delay_freed.last = NULL;
277
278 if (rv != CKR_OK) {
279 (void) pthread_mutex_destroy(
280 &ses_delay_freed.ses_to_be_free_mutex);
281 (void) pthread_mutex_destroy(
282 &obj_delay_freed.obj_to_be_free_mutex);
283 (void) pthread_mutex_destroy(&soft_slot.keystore_mutex);
284 (void) pthread_mutex_destroy(&soft_slot.slot_mutex);
285 (void) pthread_mutex_destroy(&soft_sessionlist_mutex);
286 (void) soft_destroy_token_session();
287 (void) pthread_mutex_unlock(&soft_giant_mutex);
288 return (CKR_FUNCTION_FAILED);
289 }
290
291 softtoken_pid = initialize_pid;
292 softtoken_initialized = B_TRUE;
293 (void) pthread_mutex_unlock(&soft_giant_mutex);
294
295 return (CKR_OK);
296 }
297
298 /*
299 * C_Finalize is a wrapper around finalize_common. The
300 * soft_giant_mutex should be locked by C_Finalize().
301 */
302 CK_RV
303 C_Finalize(CK_VOID_PTR pReserved)
304 {
305
306 CK_RV rv;
307
308 (void) pthread_mutex_lock(&soft_giant_mutex);
309
310 rv = finalize_common(B_FALSE, pReserved);
311
312 (void) pthread_mutex_unlock(&soft_giant_mutex);
313
314 return (rv);
315
316 }
317
318 /*
319 * finalize_common() does the work for C_Finalize. soft_giant_mutex
320 * must be held before calling this function.
321 */
322 static CK_RV
323 finalize_common(boolean_t force, CK_VOID_PTR pReserved) {
324
325 CK_RV rv = CKR_OK;
326 struct object *delay_free_obj, *tmpo;
327 struct session *delay_free_ses, *tmps;
328
329 if (!softtoken_initialized) {
330 return (CKR_CRYPTOKI_NOT_INITIALIZED);
331 }
332
333 /* Check to see if pReseved is NULL */
334 if (pReserved != NULL) {
335 return (CKR_ARGUMENTS_BAD);
336 }
337
338 (void) pthread_mutex_lock(&soft_sessionlist_mutex);
339 /*
340 * Set all_sessions_closing flag so any access to any
341 * existing sessions will be rejected.
342 */
343 all_sessions_closing = 1;
344 (void) pthread_mutex_unlock(&soft_sessionlist_mutex);
345
346 /* Delete all the sessions and release the allocated resources */
347 rv = soft_delete_all_sessions(force);
348
349 (void) pthread_mutex_lock(&soft_sessionlist_mutex);
350 /* Reset all_sessions_closing flag. */
351 all_sessions_closing = 0;
352 (void) pthread_mutex_unlock(&soft_sessionlist_mutex);
353
354 softtoken_initialized = B_FALSE;
355 softtoken_pid = 0;
356
357 pkcs11_close_urandom();
358 pkcs11_close_urandom_seed();
359 pkcs11_close_random();
360
361 /* Destroy the session list lock here */
362 (void) pthread_mutex_destroy(&soft_sessionlist_mutex);
363
364 /*
365 * Destroy token object related stuffs
366 * 1. Clean up the token object list
367 * 2. Destroy slot mutex
368 * 3. Destroy mutex in token_session
369 */
370 soft_delete_all_in_core_token_objects(ALL_TOKEN);
371 (void) pthread_mutex_destroy(&soft_slot.slot_mutex);
372 (void) pthread_mutex_destroy(&soft_slot.keystore_mutex);
373 (void) soft_destroy_token_session();
374
375 /*
376 * free all entries in the delay_freed list
377 */
378 delay_free_obj = obj_delay_freed.first;
379 while (delay_free_obj != NULL) {
380 tmpo = delay_free_obj->next;
381 free(delay_free_obj);
382 delay_free_obj = tmpo;
383 }
384
385 soft_slot.keystore_load_status = KEYSTORE_UNINITIALIZED;
386 (void) pthread_mutex_destroy(&obj_delay_freed.obj_to_be_free_mutex);
387
388 delay_free_ses = ses_delay_freed.first;
389 while (delay_free_ses != NULL) {
390 tmps = delay_free_ses->next;
391 free(delay_free_ses);
392 delay_free_ses = tmps;
393 }
394 (void) pthread_mutex_destroy(&ses_delay_freed.ses_to_be_free_mutex);
395
396 return (rv);
397 }
398
399 static void
400 softtoken_init()
401 {
402 /* Children inherit parent's atfork handlers */
403 (void) pthread_atfork(softtoken_fork_prepare,
404 softtoken_fork_after, softtoken_fork_after);
405 }
406
407 /*
408 * softtoken_fini() function required to make sure complete cleanup
409 * is done if softtoken is ever unloaded without a C_Finalize() call.
410 */
411 static void
412 softtoken_fini()
413 {
414 (void) pthread_mutex_lock(&soft_giant_mutex);
415
416 /* if we're not initilized, do not attempt to finalize */
417 if (!softtoken_initialized) {
418 (void) pthread_mutex_unlock(&soft_giant_mutex);
419 return;
420 }
421
422 (void) finalize_common(B_TRUE, NULL_PTR);
423
424 (void) pthread_mutex_unlock(&soft_giant_mutex);
425 }
426
427 CK_RV
428 C_GetInfo(CK_INFO_PTR pInfo)
429 {
430 if (!softtoken_initialized)
431 return (CKR_CRYPTOKI_NOT_INITIALIZED);
432
433 if (pInfo == NULL) {
434 return (CKR_ARGUMENTS_BAD);
435 }
436
437 /* Provide general information in the provided buffer */
438 pInfo->cryptokiVersion.major = CRYPTOKI_VERSION_MAJOR;
439 pInfo->cryptokiVersion.minor = CRYPTOKI_VERSION_MINOR;
440 (void) strncpy((char *)pInfo->manufacturerID,
441 SOFT_MANUFACTURER_ID, 32);
442 pInfo->flags = 0;
443 (void) strncpy((char *)pInfo->libraryDescription,
444 LIBRARY_DESCRIPTION, 32);
445 pInfo->libraryVersion.major = LIBRARY_VERSION_MAJOR;
446 pInfo->libraryVersion.minor = LIBRARY_VERSION_MINOR;
447
448 return (CKR_OK);
449 }
450
451 CK_RV
452 C_GetFunctionList(CK_FUNCTION_LIST_PTR_PTR ppFunctionList)
453 {
454 if (ppFunctionList == NULL) {
455 return (CKR_ARGUMENTS_BAD);
456 }
457
458 *ppFunctionList = &functionList;
459
460 return (CKR_OK);
461 }
462
463 /*
464 * PKCS#11 states that C_GetFunctionStatus should always return
465 * CKR_FUNCTION_NOT_PARALLEL
466 */
467 /*ARGSUSED*/
468 CK_RV
469 C_GetFunctionStatus(CK_SESSION_HANDLE hSession)
470 {
471 return (CKR_FUNCTION_NOT_PARALLEL);
472 }
473
474 /*
475 * PKCS#11 states that C_CancelFunction should always return
476 * CKR_FUNCTION_NOT_PARALLEL
477 */
478 /*ARGSUSED*/
479 CK_RV
480 C_CancelFunction(CK_SESSION_HANDLE hSession)
481 {
482 return (CKR_FUNCTION_NOT_PARALLEL);
483 }
484
485 /*
486 * Take out all mutexes before fork.
487 *
488 * Order:
489 * 1. soft_giant_mutex
490 * 2. soft_sessionlist_mutex
491 * 3. soft_slot.slot_mutex
492 * 4. soft_slot.keystore_mutex
493 * 5. token_session mutexes via soft_acquire_all_session_mutexes()
494 * 6. all soft_session_list mutexes via soft_acquire_all_session_mutexes()
495 * 7. obj_delay_freed.obj_to_be_free_mutex;
496 * 8. ses_delay_freed.ses_to_be_free_mutex
497 */
498 void
499 softtoken_fork_prepare()
500 {
501 (void) pthread_mutex_lock(&soft_giant_mutex);
502 if (softtoken_initialized) {
503 (void) pthread_mutex_lock(&soft_sessionlist_mutex);
504 (void) pthread_mutex_lock(&soft_slot.slot_mutex);
505 (void) pthread_mutex_lock(&soft_slot.keystore_mutex);
506 soft_acquire_all_session_mutexes(&token_session);
507 soft_acquire_all_session_mutexes(soft_session_list);
508 (void) pthread_mutex_lock(
509 &obj_delay_freed.obj_to_be_free_mutex);
510 (void) pthread_mutex_lock(
511 &ses_delay_freed.ses_to_be_free_mutex);
512 }
513 }
514
515 /*
516 * Release in opposite order to softtoken_fork_prepare().
517 * Function is used for parent and child.
518 */
519 void
520 softtoken_fork_after()
521 {
522 if (softtoken_initialized) {
523 (void) pthread_mutex_unlock(
524 &ses_delay_freed.ses_to_be_free_mutex);
525 (void) pthread_mutex_unlock(
526 &obj_delay_freed.obj_to_be_free_mutex);
527 soft_release_all_session_mutexes(soft_session_list);
528 soft_release_all_session_mutexes(&token_session);
529 (void) pthread_mutex_unlock(&soft_slot.keystore_mutex);
530 (void) pthread_mutex_unlock(&soft_slot.slot_mutex);
531 (void) pthread_mutex_unlock(&soft_sessionlist_mutex);
532 }
533 (void) pthread_mutex_unlock(&soft_giant_mutex);
534 }