/*
* Get RSA key material
*/
static RSA *pkcs11_get_rsa(PKCS11_KEY *key)
{
RSA *rsa;
PKCS11_KEY *keys = NULL;
unsigned int i, count = 0;
BIGNUM *rsa_n=NULL, *rsa_e=NULL;
rsa = RSA_new();
if (rsa == NULL)
return NULL;
/* Retrieve the modulus and the public exponent */
if (key_getattr_bn(key, CKA_MODULUS, &rsa_n) ||
key_getattr_bn(key, CKA_PUBLIC_EXPONENT, &rsa_e))
goto failure;
if (!BN_is_zero(rsa_e)) /* The public exponent was retrieved */
goto success;
BN_clear_free(rsa_e);
rsa_e = NULL;
/* The public exponent was not found in the private key:
* retrieve it from the corresponding public key */
if (!PKCS11_enumerate_public_keys(KEY2TOKEN(key), &keys, &count)) {
for(i = 0; i < count; i++) {
BIGNUM *pubmod;
if (key_getattr_bn(&keys[i], CKA_MODULUS, &pubmod))
continue; /* Failed to retrieve the modulus */
if (BN_cmp(rsa_n, pubmod) == 0) { /* The key was found */
BN_clear_free(pubmod);
if (key_getattr_bn(&keys[i], CKA_PUBLIC_EXPONENT, &rsa_e))
continue; /* Failed to retrieve the public exponent */
goto success;
} else {
BN_clear_free(pubmod);
}
}
}
/* Last resort: use the most common default */
rsa_e = BN_new();
if (rsa_e && BN_set_word(rsa_e, RSA_F4))
goto success;
failure:
RSA_free(rsa);
return NULL;
success:
#if OPENSSL_VERSION_NUMBER >= 0x10100005L
RSA_set0_key(rsa, rsa_n, rsa_e, NULL);
#else
rsa->n=rsa_n;
rsa->e=rsa_e;
#endif
return rsa;
}
int main(int argc, char *argv[])
{
PKCS11_CTX *ctx=NULL;
PKCS11_SLOT *slots=NULL, *slot;
PKCS11_KEY *keys;
unsigned int nslots, nkeys;
char password[20];
int rc = 0;
if (argc < 2) {
fprintf(stderr,
"usage: %s /usr/lib/opensc-pkcs11.so [PIN]\n",
argv[0]);
return 1;
}
ctx = PKCS11_CTX_new();
error_queue("PKCS11_CTX_new");
/* load pkcs #11 module */
rc = PKCS11_CTX_load(ctx, argv[1]);
error_queue("PKCS11_CTX_load");
CHECK_ERR(rc < 0, "loading pkcs11 engine failed", 1);
/* get information on all slots */
rc = PKCS11_enumerate_slots(ctx, &slots, &nslots);
error_queue("PKCS11_enumerate_slots");
CHECK_ERR(rc < 0, "no slots available", 2);
/* get first slot with a token */
slot = PKCS11_find_token(ctx, slots, nslots);
error_queue("PKCS11_find_token");
CHECK_ERR(!slot || !slot->token, "no token available", 3);
printf("Slot manufacturer......: %s\n", slot->manufacturer);
printf("Slot description.......: %s\n", slot->description);
printf("Slot token label.......: %s\n", slot->token->label);
printf("Slot token manufacturer: %s\n", slot->token->manufacturer);
printf("Slot token model.......: %s\n", slot->token->model);
printf("Slot token serialnr....: %s\n", slot->token->serialnr);
/* get public keys */
rc = PKCS11_enumerate_public_keys(slot->token, &keys, &nkeys);
error_queue("PKCS11_enumerate_public_keys");
CHECK_ERR(rc < 0, "PKCS11_enumerate_public_keys failed", 4);
CHECK_ERR(nkeys == 0, "No public keys found", 5);
list_keys("Public keys", keys, nkeys);
if (slot->token->loginRequired && argc > 2) {
strcpy(password, argv[2]);
/* perform pkcs #11 login */
rc = PKCS11_login(slot, 0, password);
error_queue("PKCS11_login");
memset(password, 0, strlen(password));
CHECK_ERR(rc < 0, "PKCS11_login failed", 6);
}
/* get private keys */
rc = PKCS11_enumerate_keys(slot->token, &keys, &nkeys);
error_queue("PKCS11_enumerate_keys");
CHECK_ERR(rc < 0, "PKCS11_enumerate_keys failed", 7);
CHECK_ERR(nkeys == 0, "No private keys found", 8);
list_keys("Private keys", keys, nkeys);
end:
if (slots)
PKCS11_release_all_slots(ctx, slots, nslots);
if (ctx) {
PKCS11_CTX_unload(ctx);
PKCS11_CTX_free(ctx);
}
CRYPTO_cleanup_all_ex_data();
ERR_free_strings();
if (rc)
printf("Failed (error code %d).\n", rc);
else
printf("Success.\n");
return rc;
}
static EVP_PKEY *pkcs11_load_key(ENGINE_CTX *ctx, const char *s_slot_key_id,
UI_METHOD * ui_method, void *callback_data, int isPrivate)
{
PKCS11_SLOT *slot;
PKCS11_SLOT *found_slot = NULL;
PKCS11_TOKEN *tok, *match_tok = NULL;
PKCS11_KEY *keys, *selected_key = NULL;
PKCS11_CERT *certs;
EVP_PKEY *pk;
unsigned int cert_count, key_count, n, m;
unsigned char key_id[MAX_VALUE_LEN / 2];
size_t key_id_len = sizeof(key_id);
char *key_label = NULL;
int slot_nr = -1;
char tmp_pin[MAX_PIN_LENGTH];
size_t tmp_pin_len = sizeof(tmp_pin);
char flags[64];
if (pkcs11_init_libp11(ctx)) /* Delayed libp11 initialization */
return NULL;
if (ctx->verbose)
fprintf(stderr, "Loading %s key \"%s\"\n",
(char *)(isPrivate ? "private" : "public"),
s_slot_key_id);
if (s_slot_key_id && *s_slot_key_id) {
if (!strncmp(s_slot_key_id, "pkcs11:", 7)) {
n = parse_pkcs11_uri(s_slot_key_id, &match_tok,
key_id, &key_id_len,
tmp_pin, &tmp_pin_len, &key_label);
if (n && tmp_pin_len > 0 && tmp_pin[0] != 0) {
destroy_pin(ctx);
ctx->pin = OPENSSL_malloc(MAX_PIN_LENGTH * sizeof(char));
if (ctx->pin != NULL) {
memset(ctx->pin, 0, MAX_PIN_LENGTH * sizeof(char));
memcpy(ctx->pin, tmp_pin, tmp_pin_len);
ctx->pin_length = tmp_pin_len;
}
}
if (!n) {
fprintf(stderr,
"The certificate ID is not a valid PKCS#11 URI\n"
"The PKCS#11 URI format is defined by RFC7512\n");
return NULL;
}
} else {
n = parse_slot_id_string(s_slot_key_id, &slot_nr,
key_id, &key_id_len, &key_label);
if (!n) {
fprintf(stderr,
"The certificate ID is not a valid PKCS#11 URI\n"
"The PKCS#11 URI format is defined by RFC7512\n"
"The legacy ENGINE_pkcs11 ID format is also "
"still accepted for now\n");
return NULL;
}
}
if (ctx->verbose) {
fprintf(stderr, "Looking in slot %d for key: ",
slot_nr);
if (key_label == NULL) {
for (n = 0; n < key_id_len; n++)
fprintf(stderr, "%02x", key_id[n]);
fprintf(stderr, "\n");
} else
fprintf(stderr, "label: %s\n", key_label);
}
}
for (n = 0; n < ctx->slot_count; n++) {
slot = ctx->slot_list + n;
flags[0] = '\0';
if (slot->token) {
if (!slot->token->initialized)
strcat(flags, "uninitialized, ");
else if (!slot->token->userPinSet)
strcat(flags, "no pin, ");
if (slot->token->loginRequired)
strcat(flags, "login, ");
if (slot->token->readOnly)
strcat(flags, "ro, ");
} else {
strcpy(flags, "no token");
}
if ((m = strlen(flags)) != 0) {
flags[m - 2] = '\0';
}
if (slot_nr != -1 &&
slot_nr == (int)PKCS11_get_slotid_from_slot(slot)) {
found_slot = slot;
}
if (match_tok && slot->token &&
(match_tok->label == NULL ||
!strcmp(match_tok->label, slot->token->label)) &&
(match_tok->manufacturer == NULL ||
!strcmp(match_tok->manufacturer, slot->token->manufacturer)) &&
(match_tok->serialnr == NULL ||
!strcmp(match_tok->serialnr, slot->token->serialnr)) &&
(match_tok->model == NULL ||
!strcmp(match_tok->model, slot->token->model))) {
found_slot = slot;
}
if (ctx->verbose) {
fprintf(stderr, "[%lu] %-25.25s %-16s",
PKCS11_get_slotid_from_slot(slot),
slot->description, flags);
if (slot->token) {
fprintf(stderr, " (%s)",
slot->token->label[0] ?
slot->token->label : "no label");
}
fprintf(stderr, "\n");
}
}
if (match_tok) {
OPENSSL_free(match_tok->model);
OPENSSL_free(match_tok->manufacturer);
OPENSSL_free(match_tok->serialnr);
OPENSSL_free(match_tok->label);
OPENSSL_free(match_tok);
}
if (found_slot) {
slot = found_slot;
} else if (match_tok) {
fprintf(stderr, "Specified object not found\n");
return NULL;
} else if (slot_nr == -1) {
if (!(slot = PKCS11_find_token(ctx->pkcs11_ctx,
ctx->slot_list, ctx->slot_count))) {
fprintf(stderr, "No tokens found\n");
return NULL;
}
} else {
fprintf(stderr, "Invalid slot number: %d\n", slot_nr);
return NULL;
}
tok = slot->token;
if (tok == NULL) {
fprintf(stderr, "Found empty token\n");
return NULL;
}
/* The following check is non-critical to ensure interoperability
* with some other (which ones?) PKCS#11 libraries */
if (!tok->initialized)
fprintf(stderr, "Found uninitialized token\n");
if (isPrivate && !tok->userPinSet && !tok->readOnly) {
fprintf(stderr, "Found slot without user PIN\n");
return NULL;
}
if (ctx->verbose) {
fprintf(stderr, "Found slot: %s\n", slot->description);
fprintf(stderr, "Found token: %s\n", slot->token->label);
}
if (PKCS11_enumerate_certs(tok, &certs, &cert_count)) {
fprintf(stderr, "Unable to enumerate certificates\n");
return NULL;
}
if (ctx->verbose) {
fprintf(stderr, "Found %u certificate%s:\n", cert_count,
(cert_count <= 1) ? "" : "s");
for (n = 0; n < cert_count; n++) {
PKCS11_CERT *c = certs + n;
char *dn = NULL;
fprintf(stderr, " %2u %s", n + 1, c->label);
if (c->x509)
dn = X509_NAME_oneline(X509_get_subject_name(c->x509), NULL, 0);
if (dn) {
fprintf(stderr, " (%s)", dn);
OPENSSL_free(dn);
}
fprintf(stderr, "\n");
}
}
if (isPrivate) {
/* Perform login to the token if required */
if (!pkcs11_login(ctx, slot, tok, ui_method, callback_data)) {
fprintf(stderr, "login to token failed, returning NULL...\n");
return NULL;
}
/* Make sure there is at least one private key on the token */
if (PKCS11_enumerate_keys(tok, &keys, &key_count)) {
fprintf(stderr, "Unable to enumerate private keys\n");
return NULL;
}
} else {
/* Make sure there is at least one public key on the token */
if (PKCS11_enumerate_public_keys(tok, &keys, &key_count)) {
fprintf(stderr, "Unable to enumerate public keys\n");
return NULL;
}
}
if (key_count == 0) {
fprintf(stderr, "No %s keys found.\n",
(char *)(isPrivate ? "private" : "public"));
return NULL;
}
if (ctx->verbose)
fprintf(stderr, "Found %u %s key%s:\n", key_count,
(char *)(isPrivate ? "private" : "public"),
(key_count == 1) ? "" : "s");
if (s_slot_key_id && *s_slot_key_id &&
(key_id_len != 0 || key_label != NULL)) {
for (n = 0; n < key_count; n++) {
PKCS11_KEY *k = keys + n;
if (ctx->verbose) {
fprintf(stderr, " %2u %c%c %s\n", n + 1,
k->isPrivate ? 'P' : ' ',
k->needLogin ? 'L' : ' ', k->label);
}
if (key_label == NULL) {
if (key_id_len != 0 && k->id_len == key_id_len
&& memcmp(k->id, key_id, key_id_len) == 0) {
selected_key = k;
}
} else {
if (strcmp(k->label, key_label) == 0) {
selected_key = k;
}
}
}
} else {
selected_key = keys; /* Use the first key */
}
if (selected_key == NULL) {
fprintf(stderr, "Key not found.\n");
return NULL;
}
pk = isPrivate ?
PKCS11_get_private_key(selected_key) :
PKCS11_get_public_key(selected_key);
if (key_label != NULL)
OPENSSL_free(key_label);
return pk;
}
