Print this page
1667 pkcs11 may deadlock when multi-threaded consumers fork
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/lib/libcryptoutil/common/cryptoutil.h
+++ new/usr/src/lib/libcryptoutil/common/cryptoutil.h
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
|
↓ open down ↓ |
14 lines elided |
↑ open up ↑ |
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 *
21 21 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
22 22 */
23 23 /*
24 24 * Copyright 2010 Nexenta Systems, Inc. All rights reserved.
25 + * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
25 26 */
26 27
27 28 #ifndef _CRYPTOUTIL_H
28 29 #define _CRYPTOUTIL_H
29 30
30 31 #ifdef __cplusplus
31 32 extern "C" {
32 33 #endif
33 34
34 35 #include <sys/types.h>
35 36 #include <syslog.h>
36 37 #include <security/cryptoki.h>
37 38 #include <sys/param.h>
38 39
39 40 #define LOG_STDERR -1
40 41 #define SUCCESS 0
41 42 #define FAILURE 1
42 43 #define MECH_ID_HEX_LEN 11 /* length of mechanism id in hex form */
43 44
44 45 #define _PATH_PKCS11_CONF "/etc/crypto/pkcs11.conf"
45 46 #define _PATH_KCF_CONF "/etc/crypto/kcf.conf"
46 47 #define _PATH_KCFD_LOCK "/var/run/kcfd.lock"
47 48
48 49 /* $ISA substitution for parsing pkcs11.conf data */
49 50 #define PKCS11_ISA "/$ISA/"
50 51 #if defined(_LP64)
51 52 #define PKCS11_ISA_DIR "/64/"
52 53 #else /* !_LP64 */
53 54 #define PKCS11_ISA_DIR "/"
54 55 #endif
55 56
56 57 /* keywords and delimiters for parsing configuration files */
57 58 #define SEP_COLON ":"
58 59 #define SEP_SEMICOLON ";"
59 60 #define SEP_EQUAL "="
60 61 #define SEP_COMMA ","
61 62 #define METASLOT_KEYWORD "metaslot"
62 63 #define FIPS_KEYWORD "fips-140"
63 64 #define EF_DISABLED "disabledlist="
64 65 #define EF_ENABLED "enabledlist="
65 66 #define EF_NORANDOM "NO_RANDOM"
66 67 #define METASLOT_TOKEN "metaslot_token="
67 68 #define METASLOT_SLOT "metaslot_slot="
68 69 #define METASLOT_STATUS "metaslot_status="
69 70 #define EF_FIPS_STATUS "fips_status="
70 71 #define METASLOT_AUTO_KEY_MIGRATE "metaslot_auto_key_migrate="
71 72 #define ENABLED_KEYWORD "enabled"
72 73 #define DISABLED_KEYWORD "disabled"
73 74 #define SLOT_DESCRIPTION_SIZE 64
74 75 #define TOKEN_LABEL_SIZE 32
75 76 #define TOKEN_MANUFACTURER_SIZE 32
76 77 #define TOKEN_SERIAL_SIZE 16
77 78 #define CRYPTO_FIPS_MODE_DISABLED 0
78 79 #define CRYPTO_FIPS_MODE_ENABLED 1
79 80
80 81 /*
81 82 * Define the following softtoken values that are used by softtoken
82 83 * library, cryptoadm and pktool command.
83 84 */
84 85 #define SOFT_SLOT_DESCRIPTION \
85 86 "Sun Crypto Softtoken " \
86 87 " "
87 88 #define SOFT_TOKEN_LABEL "Sun Software PKCS#11 softtoken "
88 89 #define SOFT_TOKEN_SERIAL " "
89 90 #define SOFT_MANUFACTURER_ID "Sun Microsystems, Inc. "
90 91 #define SOFT_DEFAULT_PIN "changeme"
91 92
92 93 typedef char libname_t[MAXPATHLEN];
93 94 typedef char midstr_t[MECH_ID_HEX_LEN];
94 95
95 96 typedef struct umechlist {
96 97 midstr_t name; /* mechanism name in hex form */
97 98 struct umechlist *next;
98 99 } umechlist_t;
99 100
100 101 typedef struct uentry {
101 102 libname_t name;
102 103 boolean_t flag_norandom; /* TRUE if random is disabled */
103 104 boolean_t flag_enabledlist; /* TRUE if an enabledlist */
104 105 umechlist_t *policylist; /* disabledlist or enabledlist */
105 106 boolean_t flag_metaslot_enabled; /* TRUE if metaslot's enabled */
106 107 boolean_t flag_metaslot_auto_key_migrate;
107 108 CK_UTF8CHAR metaslot_ks_slot[SLOT_DESCRIPTION_SIZE + 1];
108 109 CK_UTF8CHAR metaslot_ks_token[TOKEN_LABEL_SIZE + 1];
109 110 int count;
110 111 boolean_t flag_fips_enabled;
111 112 } uentry_t;
112 113
113 114 typedef struct uentrylist {
114 115 uentry_t *puent;
115 116 struct uentrylist *next;
116 117 } uentrylist_t;
117 118
118 119 /* Return codes for pkcs11_parse_uri() */
119 120 #define PK11_URI_OK 0
120 121 #define PK11_URI_INVALID 1
121 122 #define PK11_MALLOC_ERROR 2
122 123 #define PK11_URI_VALUE_OVERFLOW 3
123 124 #define PK11_NOT_PKCS11_URI 4
124 125
125 126 /*
126 127 * There is no limit for the attribute length in the spec. 256 bytes should be
127 128 * enough for the object name.
128 129 */
129 130 #define PK11_MAX_OBJECT_LEN 256
130 131 /*
131 132 * CKA_ID is of type "byte array" which can be of arbitrary length. 256 bytes
132 133 * should be sufficient though.
133 134 */
134 135 #define PK11_MAX_ID_LEN 256
135 136
136 137 /* Structure for the PKCS#11 URI. */
137 138 typedef struct pkcs11_uri_t {
138 139 /* CKA_LABEL attribute to the C_FindObjectsInit function. */
139 140 CK_UTF8CHAR_PTR object;
140 141 /*
141 142 * CKA_CLASS attribute to the C_FindObjectsInit function. The
142 143 * "objecttype" URI attribute can have a value one of "private",
143 144 * "public", "cert", "secretkey", and "data". The "objecttype" field can
144 145 * have a value of CKO_PUBLIC_KEY, CKO_PRIVATE_KEY, CKO_CERTIFICATE,
145 146 * CKO_SECRET_KEY, and CKO_DATA. This attribute cannot be empty in the
146 147 * URI.
147 148 */
148 149 CK_ULONG objecttype;
149 150 /* CKO_DATA is 0 so we need this flag. Not part of the URI itself. */
150 151 boolean_t objecttype_present;
151 152 /*
152 153 * Token, manufufacturer, serial and model are of fixed size length in
153 154 * the specification. We allocate memory on the fly to distinguish
154 155 * between an attribute not present and an empty value. We check for
155 156 * overflows. We always terminate the string with '\0' even when that is
156 157 * not used in the PKCS#11's CK_TOKEN_INFO structure (fields are padded
157 158 * with spaces).
158 159 */
159 160 /* Token label from CK_TOKEN_INFO. */
160 161 CK_UTF8CHAR_PTR token;
161 162 /* ManufacturerID from CK_TOKEN_INFO. */
162 163 CK_UTF8CHAR_PTR manuf;
163 164 /* SerialNumber from CK_TOKEN_INFO. */
164 165 CK_CHAR_PTR serial;
165 166 /* Model from CK_TOKEN_INFO. */
166 167 CK_UTF8CHAR_PTR model;
167 168 /* This is a byte array, we need a length parameter as well. */
168 169 CK_BYTE_PTR id;
169 170 int id_len;
170 171 /*
171 172 * Location of the file with a token PIN. Application can overload this,
172 173 * eg. "/bin/askpass|" may mean to read the PIN from a command. However,
173 174 * the pkcs11_parse_uri() function does not interpret this field in any
174 175 * way.
175 176 */
176 177 char *pinfile;
177 178 } pkcs11_uri_t;
178 179
179 180 extern void cryptodebug(const char *fmt, ...);
180 181 extern void cryptoerror(int priority, const char *fmt, ...);
181 182 extern void cryptodebug_init(const char *prefix);
182 183 extern void cryptoerror_off();
183 184 extern void cryptoerror_on();
184 185
185 186 extern const char *pkcs11_mech2str(CK_MECHANISM_TYPE mech);
186 187 extern CK_RV pkcs11_str2mech(char *mech_str, CK_MECHANISM_TYPE_PTR mech);
187 188
188 189 extern int get_pkcs11conf_info(uentrylist_t **);
189 190 extern umechlist_t *create_umech(char *);
190 191 extern void free_umechlist(umechlist_t *);
191 192 extern void free_uentrylist(uentrylist_t *);
192 193 extern void free_uentry(uentry_t *);
193 194 extern uentry_t *getent_uef(char *);
194 195
195 196 extern void tohexstr(uchar_t *bytes, size_t blen, char *hexstr, size_t hexlen);
196 197 extern int hexstr_to_bytes(char *hexstr, size_t hexlen, uchar_t **bytes,
197 198 size_t *blen);
198 199 extern CK_RV pkcs11_mech2keytype(CK_MECHANISM_TYPE mech_type,
199 200 CK_KEY_TYPE *ktype);
200 201 extern CK_RV pkcs11_mech2keygen(CK_MECHANISM_TYPE mech_type,
201 202 CK_MECHANISM_TYPE *gen_mech);
202 203 extern char *pkcs11_strerror(CK_RV rv);
203 204
204 205 extern int
205 206 get_metaslot_info(boolean_t *status_enabled, boolean_t *migrate_enabled,
206 207 char **objectstore_slot_info, char **objectstore_token_info);
207 208
208 209 extern char *get_fullpath(char *dir, char *filepath);
|
↓ open down ↓ |
174 lines elided |
↑ open up ↑ |
209 210 extern int str2lifetime(char *ltimestr, uint32_t *ltime);
210 211
211 212 extern char *pkcs11_default_token(void);
212 213 extern int pkcs11_get_pass(char *token_name, char **pdata, size_t *psize,
213 214 size_t min_psize, boolean_t with_confirmation);
214 215
215 216 extern int pkcs11_seed_urandom(void *sbuf, size_t slen);
216 217 extern int pkcs11_get_random(void *dbuf, size_t dlen);
217 218 extern int pkcs11_get_urandom(void *dbuf, size_t dlen);
218 219 extern int pkcs11_get_nzero_urandom(void *dbuf, size_t dlen);
219 -extern void pkcs11_close_random(void);
220 -extern void pkcs11_close_urandom(void);
221 -extern void pkcs11_close_urandom_seed(void);
222 220 extern int pkcs11_read_data(char *filename, void **dbuf, size_t *dlen);
223 221
224 222 extern int open_nointr(const char *path, int oflag, ...);
225 223 extern ssize_t readn_nointr(int fd, void *dbuf, size_t dlen);
226 224 extern ssize_t writen_nointr(int fd, void *dbuf, size_t dlen);
227 225 extern int update_conf(char *conf_file, char *entry);
228 226
229 227 extern int pkcs11_parse_uri(const char *str, pkcs11_uri_t *uri);
230 228 extern void pkcs11_free_uri(pkcs11_uri_t *uri);
231 229
232 230 #ifdef __cplusplus
233 231 }
234 232 #endif
235 233
236 234 #endif /* _CRYPTOUTIL_H */
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX