kmsGeneral.c revision 4f14b0f29aa144cc03efdde5508ae126ae197acf
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*
*/
#include <fcntl.h>
#include <pthread.h>
#include <strings.h>
#include <unistd.h> /* for pid */
#include <errno.h>
#include <security/cryptoki.h>
#include "kmsKeystoreUtil.h"
#include "kmsGlobal.h"
#include "kmsSession.h"
#include "kmsSlot.h"
/*
* PKCS#11 KMS Crypto provider module.
*
* This module provides access to a Key Management System (v 2.0)
* through the Solaris Cryptographic Framework interfaces (PKCS#11).
*
* PREREQUISITES
* =============
* 1. You must have access to a KMS on the network and you must
* know the IP address and name of the "Agent" assigned to
* you and the passphrase needed to access the Agent information.
*
* 2. The token configuration must be completed prior
* to using this provider using the kmscfg(1m) utility.
*
* This provider provides support for 3 AES mechanisms:
* CKM_AES_KEY_GEN (for 256 bit keys only)
*
* DETAILS
* =======
* Each user has their own local configuration for the KMS.
* The local configuration information is typically located
* The location may be overridden using an environment variable
* $KMSTOKEN_DIR. The user's private token namespace is configured
* using kmscfg(1M) which establishes the directory and populates
* it with a simple configuration file that this module later uses
* to access the KMS.
*
* INITIALIZING
* ============
* Once the token configuration is established, C_InitToken
* is used to initialize the first contact with the KMS. This
* will cause the provider to contact the KMS and download
* the profile configuration data, a server certificate, and a
* private entity key and certificate (in a PKCS#12 file).
* Once the above data is collected it is stored under $KMSTOKEN_DIR.
* The user may then proceed with normal PKCS#11 activity.
*
* LOGIN
* =====
* The concept of a "Login" is established when the user provides
* a PIN that will successfully unwrap the private data in the
* PKCS#12 file downloaded earlier when C_InitToken was called.
* If the PKCS#12 file is successfully opened, then the user
* is considered "logged in" and may use the private key and
* certificate to initiate secure communications with the KMS.
*
* CHANGE PIN
* ==========
* The C_SetPIN interface may be used to change the passphrase
* on the PKCS#12 file and thus effectively change the passphrase
* for the token itself (even though the wrapped private key and
* certificate do not change).
*
* KEY STORAGE
* ===========
* Keys generated in the KMS are always kept securely in the KMS.
* The local token area contains only a list of CKA_LABEL values
* for all successfully created keys, no sensitive key data
* is stored on the client system. When a key is "destroyed", the
* local references to that key's label is removed and it is no
* longer visible to the token provider.
*
* NOTE: The KMS itself does not have an interface for destroying
* keys, it only allows for the keys to be disassociated from
* a particular "DataUnit". Key labels should not be re-used.
*/
static struct CK_FUNCTION_LIST functionList = {
{ 2, 20 }, /* version */
};
/* protects kms_initialized and entrance to C_Initialize/Finalize */
static void kms_finalize_common();
static void kms_cleanup_library();
static void kms_init();
static void kms_fini();
static void kms_fork_prepare();
static void kms_fork_after();
{
int initialize_pid;
/*
* Grab lock to insure that only one thread enters this
* function at a time.
*/
(void) pthread_mutex_lock(&globalmutex);
initialize_pid = getpid();
if (kms_initialized) {
if (initialize_pid == kms_pid) {
/*
* This process has called C_Initialize already
*/
(void) pthread_mutex_unlock(&globalmutex);
return (CKR_CRYPTOKI_ALREADY_INITIALIZED);
} else {
/*
* A fork has happened and the child is
* reinitializing. Do a kms_cleanup_library to close
* out any state from the parent, and then
* continue on.
*/
}
}
/* pReserved must be NULL */
(void) pthread_mutex_unlock(&globalmutex);
return (CKR_ARGUMENTS_BAD);
}
/*
* ALL supplied function pointers need to have the value
* either NULL or non-NULL.
*/
if (!supplied_ok) {
(void) pthread_mutex_unlock(&globalmutex);
return (CKR_ARGUMENTS_BAD);
}
/*
* When the CKF_OS_LOCKING_OK flag isn't set and mutex
* function pointers are supplied by an application,
* return an error. We must be able to use our own locks.
*/
(void) pthread_mutex_unlock(&globalmutex);
return (CKR_CANT_LOCK);
}
}
/* Create the hash table */
if (kms_mechhash == NULL) {
(void) pthread_mutex_unlock(&globalmutex);
return (CKR_HOST_MEMORY);
}
/* Initialize the slot table */
rv = kms_slottable_init();
goto end;
}
/* Initialize the object_to_be_freed list */
obj_delay_freed.count = 0;
/* Initialize the session_to_be_freed list */
ses_delay_freed.count = 0;
rv = KMS_Initialize();
goto end;
}
end:
(void) pthread_mutex_unlock(&globalmutex);
return (CKR_OK);
}
/*
* C_Finalize is a wrapper around kms_finalize_common. The
* globalmutex should be locked by C_Finalize().
*/
{
(void) pthread_mutex_lock(&globalmutex);
if (!kms_initialized) {
(void) pthread_mutex_unlock(&globalmutex);
return (CKR_CRYPTOKI_NOT_INITIALIZED);
}
/* Check to see if pReseved is NULL */
(void) pthread_mutex_unlock(&globalmutex);
return (CKR_ARGUMENTS_BAD);
}
/*
* Delete all the sessions for each slot and release the allocated
* resources
*/
(void) pthread_mutex_unlock(&globalmutex);
return (CKR_OK);
}
/*
* kms_finalize_common() does the work for C_Finalize. globalmutex
* must be held before calling this function.
*/
static void
int i;
/* Walk the hash table and free all entries */
for (i = 0; i < KMECH_HASHTABLE_SIZE; i++) {
elem = kms_mechhash[i];
}
}
kms_mechhash = NULL;
kms_pid = 0;
/*
* free all entries in the delay_freed list
*/
while (delay_free_obj != NULL) {
}
obj_delay_freed.count = 0;
while (delay_free_ses != NULL) {
}
ses_delay_freed.count = 0;
}
/*
* This function cleans up all the resources in the library (user space only)
*/
static void
{
if (pslot)
/*
* Delete all the sessions for each slot and release the allocated
* resources from the library. The boolean argument TRUE indicates
* that we only wants to clean up the resource in the library only.
* We don't want to clean up the corresponding kernel part of
* resources, because they are used by the parent process still.
*/
}
static void
kms_init()
{
}
/*
* kms_fini() function required to make sure complete cleanup
* is done if pkcs11_kms is ever unloaded without
* a C_Finalize() call.
*/
static void
kms_fini()
{
(void) pthread_mutex_lock(&globalmutex);
(void) KMS_Finalize();
/* if we're not initilized, do not attempt to finalize */
if (!kms_initialized) {
(void) pthread_mutex_unlock(&globalmutex);
return;
}
(void) pthread_mutex_unlock(&globalmutex);
}
{
if (!kms_initialized)
return (CKR_CRYPTOKI_NOT_INITIALIZED);
return (CKR_ARGUMENTS_BAD);
}
/* Check if the cryptoki was initialized */
MANUFACTURER_ID, 32);
LIBRARY_DESCRIPTION, 32);
return (CKR_OK);
}
{
if (ppFunctionList == NULL) {
return (CKR_ARGUMENTS_BAD);
}
return (CKR_OK);
}
/*
* PKCS#11 states that C_GetFunctionStatus should always return
* CKR_FUNCTION_NOT_PARALLEL
*/
/*ARGSUSED*/
{
return (CKR_FUNCTION_NOT_PARALLEL);
}
/*
* Take out all mutexes before fork.
* Order:
* 1. globalmutex
* 2. all slots mutexes (and all their sessions) via
* kms_acquire_all_slots_mutexes()
* 3. obj_delay_freed.obj_to_be_free_mutex;
* 4. ses_delay_freed.ses_to_be_free_mutex
*/
void
{
(void) pthread_mutex_lock(&globalmutex);
if (kms_initialized) {
(void) pthread_mutex_lock(
(void) pthread_mutex_lock(
}
}
/*
* Release in opposite order to kms_fork_prepare().
* Function is used for parent and child.
*/
void
{
if (kms_initialized) {
(void) pthread_mutex_unlock(
(void) pthread_mutex_unlock(
}
(void) pthread_mutex_unlock(&globalmutex);
}
/*
* PKCS#11 states that C_CancelFunction should always return
* CKR_FUNCTION_NOT_PARALLEL
*/
/*ARGSUSED*/
{
return (CKR_FUNCTION_NOT_PARALLEL);
}