/*
* Find all certs of a given type (public or private)
*/
static int pkcs11_find_certs(PKCS11_TOKEN * token)
{
PKCS11_SLOT *slot = TOKEN2SLOT(token);
PKCS11_CTX *ctx = TOKEN2CTX(token);
CK_SESSION_HANDLE session;
int rv, res = -1;
/* Make sure we have a session */
if (!PRIVSLOT(slot)->haveSession && PKCS11_open_session(slot, 0))
return -1;
session = PRIVSLOT(slot)->session;
/* Tell the PKCS11 lib to enumerate all matching objects */
cert_search_class = CKO_CERTIFICATE;
rv = CRYPTOKI_call(ctx, C_FindObjectsInit(session, cert_search_attrs,
numof(cert_search_attrs)));
CRYPTOKI_checkerr(PKCS11_F_PKCS11_ENUM_CERTS, rv);
do {
res = pkcs11_next_cert(ctx, token, session);
} while (res == 0);
CRYPTOKI_call(ctx, C_FindObjectsFinal(session));
return (res < 0) ? -1 : 0;
}
/*
* Find all keys of a given type (public or private)
*/
static int pkcs11_find_keys(PKCS11_TOKEN *token, unsigned int type)
{
PKCS11_SLOT *slot = TOKEN2SLOT(token);
PKCS11_CTX *ctx = TOKEN2CTX(token);
PKCS11_TOKEN_private *tpriv = PRIVTOKEN(token);
PKCS11_SLOT_private *spriv = PRIVSLOT(slot);
PKCS11_keys *keys = (type == CKO_PRIVATE_KEY) ? &tpriv->prv : &tpriv->pub;
CK_OBJECT_CLASS key_search_class;
CK_ATTRIBUTE key_search_attrs[1] = {
{CKA_CLASS, &key_search_class, sizeof(key_search_class)},
};
int rv, res = -1;
/* Tell the PKCS11 lib to enumerate all matching objects */
key_search_class = type;
rv = CRYPTOKI_call(ctx,
C_FindObjectsInit(spriv->session, key_search_attrs, 1));
CRYPTOKI_checkerr(PKCS11_F_PKCS11_ENUM_KEYS, rv);
keys->num = 0;
do {
res = pkcs11_next_key(ctx, token, spriv->session, type);
} while (res == 0);
CRYPTOKI_call(ctx, C_FindObjectsFinal(spriv->session));
return (res < 0) ? -1 : 0;
}
/*
* Reopens the object associated with the key
*/
int pkcs11_reload_key(PKCS11_KEY *key)
{
PKCS11_KEY_private *kpriv = PRIVKEY(key);
PKCS11_SLOT *slot = KEY2SLOT(key);
PKCS11_SLOT_private *spriv = PRIVSLOT(slot);
PKCS11_CTX *ctx = SLOT2CTX(slot);
CK_OBJECT_CLASS key_search_class =
key->isPrivate ? CKO_PRIVATE_KEY : CKO_PUBLIC_KEY;
CK_ATTRIBUTE key_search_attrs[2] = {
{CKA_CLASS, &key_search_class, sizeof(key_search_class)},
{CKA_ID, kpriv->id, kpriv->id_len},
};
CK_ULONG count;
int rv;
/* this is already covered with a per-ctx lock */
rv = CRYPTOKI_call(ctx,
C_FindObjectsInit(spriv->session, key_search_attrs, 2));
CRYPTOKI_checkerr(PKCS11_F_PKCS11_ENUM_KEYS, rv);
rv = CRYPTOKI_call(ctx,
C_FindObjects(spriv->session, &kpriv->object, 1, &count));
CRYPTOKI_checkerr(PKCS11_F_PKCS11_ENUM_KEYS, rv);
CRYPTOKI_call(ctx, C_FindObjectsFinal(spriv->session));
return 0;
}
/*
* Find all certs of a given type (public or private)
*/
static int pkcs11_find_certs(PKCS11_TOKEN *token)
{
PKCS11_SLOT *slot = TOKEN2SLOT(token);
PKCS11_CTX *ctx = SLOT2CTX(slot);
PKCS11_TOKEN_private *tpriv = PRIVTOKEN(token);
PKCS11_SLOT_private *spriv = PRIVSLOT(slot);
CK_OBJECT_CLASS cert_search_class;
CK_ATTRIBUTE cert_search_attrs[] = {
{CKA_CLASS, &cert_search_class, sizeof(cert_search_class)},
};
int rv, res = -1;
/* Tell the PKCS11 lib to enumerate all matching objects */
cert_search_class = CKO_CERTIFICATE;
rv = CRYPTOKI_call(ctx, C_FindObjectsInit(spriv->session, cert_search_attrs, 1));
CRYPTOKI_checkerr(PKCS11_F_PKCS11_ENUM_CERTS, rv);
tpriv->ncerts = 0;
do {
res = pkcs11_next_cert(ctx, token, spriv->session);
} while (res == 0);
CRYPTOKI_call(ctx, C_FindObjectsFinal(spriv->session));
return (res < 0) ? -1 : 0;
}
static CK_OBJECT_HANDLE get_dukpt_ikey(CK_SESSION_HANDLE hSession, char *label,
uint16_t id)
{
CK_OBJECT_HANDLE hKey = CK_INVALID_HANDLE;
CK_OBJECT_CLASS dukptClass = CKO_DUKPT_IKEY;
CK_KEY_TYPE dukptKeyType = CKK_DES2;
CK_ATTRIBUTE attrs_dukpt_key[] = {
{ CKA_CLASS, &dukptClass, sizeof(dukptClass) },
{ CKA_KEY_TYPE, &dukptKeyType, sizeof(dukptKeyType) },
{ CKA_LABEL, label, strlen(label) },
{ CKA_ID, &id, sizeof(id) }
};
CK_ULONG ulObjectCount = 0;
CK_RV rv = CKR_OK;
rv = C_FindObjectsInit(hSession, attrs_dukpt_key,
ARRAY_SIZE(attrs_dukpt_key));
assert(rv == CKR_OK);
rv = C_FindObjects(hSession, &hKey, 1, &ulObjectCount);
assert(rv == CKR_OK);
rv = C_FindObjectsFinal(hSession);
assert(rv == CKR_OK);
return hKey;
}
HRESULT Library_security_pkcs11_native_Microsoft_SPOT_Cryptoki_FindObjectEnum::FindObjectsInit___VOID__SZARRAY_MicrosoftSPOTCryptokiCryptokiAttribute( CLR_RT_StackFrame& stack )
{
TINYCLR_HEADER();
CLR_RT_HeapBlock* pThis = stack.This();
CLR_RT_HeapBlock_Array* pAttribs = stack.Arg1().DereferenceArray();
CLR_RT_HeapBlock* pAttrib;
CLR_RT_HeapBlock* pSession = pThis[Library_security_pkcs11_native_Microsoft_SPOT_Cryptoki_FindObjectEnum::FIELD__m_session].Dereference();
CK_SESSION_HANDLE hSession;
CK_ATTRIBUTE attribs[20];
CLR_UINT32 i;
FAULT_ON_NULL_ARG(pAttribs);
FAULT_ON_NULL(pSession);
if(pAttribs->m_numOfElements > ARRAYSIZE(attribs)) TINYCLR_SET_AND_LEAVE(CLR_E_OUT_OF_RANGE);
hSession = pSession[Library_security_pkcs11_native_Microsoft_SPOT_Cryptoki_Session::FIELD__m_handle].NumericByRef().u4;
pAttrib = (CLR_RT_HeapBlock*)pAttribs->GetFirstElement();
for(i=0; i<pAttribs->m_numOfElements; i++)
{
CLR_RT_HeapBlock* pElement = pAttrib->Dereference(); FAULT_ON_NULL(pElement);
CLR_RT_HeapBlock_Array* pValueArray = pElement[Library_security_pkcs11_native_Microsoft_SPOT_Cryptoki_CryptokiAttribute::FIELD__Value].DereferenceArray(); FAULT_ON_NULL(pValueArray);
attribs[i].type = pElement[Library_security_pkcs11_native_Microsoft_SPOT_Cryptoki_CryptokiAttribute::FIELD__Type].NumericByRef().u4;
attribs[i].pValue = pValueArray->GetFirstElement();
attribs[i].ulValueLen = pValueArray->m_numOfElements;
pAttrib++;
}
CRYPTOKI_CHECK_RESULT(stack, C_FindObjectsInit(hSession, attribs, pAttribs->m_numOfElements));
TINYCLR_NOCLEANUP();
}
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
static bool initialized = false;
CK_SLOT_ID slot;
CK_ULONG count = 0, type;
CK_SLOT_ID_PTR slotlist = NULL;
CK_RV rv;
CK_SESSION_HANDLE session;
CK_ATTRIBUTE attrs[2];
CK_OBJECT_HANDLE object;
beid_set_fuzz_data(data, size, "3F00DF014031");
check_rv(C_Initialize(NULL));
do {
slotlist = realloc(slotlist, sizeof(CK_SLOT_ID) * count);
} while((rv = C_GetSlotList(CK_TRUE, slotlist, &count)) == CKR_BUFFER_TOO_SMALL);
check_rv_late("C_GetSlotList");
assert(count > 0);
check_rv(C_OpenSession(slotlist[0], CKF_SERIAL_SESSION, NULL, NULL, &session));
free(slotlist);
slotlist = NULL;
attrs[0].type = CKA_CLASS;
attrs[0].pValue = &type;
type = CKO_DATA;
attrs[0].ulValueLen = sizeof(CK_ULONG);
attrs[1].type = CKA_OBJECT_ID;
attrs[1].pValue = "id";
attrs[1].ulValueLen = strlen("id");
check_rv(C_FindObjectsInit(session, attrs, 2));
char *label_str = NULL;
char *value_str = NULL;
char *objid_str = NULL;
do {
char junk[1024];
CK_ATTRIBUTE data[3] = {
{CKA_LABEL, NULL_PTR, 0},
{CKA_VALUE, NULL_PTR, 0},
{CKA_OBJECT_ID, NULL_PTR, 0},
};
check_rv(C_FindObjects(session, &object, 1, &count));
if(!count) continue;
free(label_str);
free(value_str);
free(objid_str);
check_rv(C_GetAttributeValue(session, object, data, 3));
label_str = calloc(data[0].ulValueLen + 1, 1);
data[0].pValue = label_str;
value_str = calloc(data[1].ulValueLen + 1, 1);
data[1].pValue = value_str;
objid_str = calloc(data[2].ulValueLen + 1, 1);
data[2].pValue = objid_str;
check_rv(C_GetAttributeValue(session, object, data, 3));
snprintf(junk, sizeof(junk), "%s%s%s", label_str, value_str, objid_str);
} while(count);
printf("label: %s, objid: %s, value: %s\n", label_str, objid_str, value_str);
free(label_str);
free(value_str);
free(objid_str);
check_rv(C_CloseSession(session));
check_rv(C_Finalize(NULL));
return 0;
}
static CK_RV findObject(CK_SESSION_HANDLE hSession, CK_OBJECT_CLASS objClass, CK_CHAR* pObjLabel, CK_OBJECT_HANDLE* phObj){
CK_RV rv = CKR_OK;
/* This is the template used to search for the object. The C_FindObjects
* call matches all objects that have attributes matching all attributes
* within the search template.
*
* The attributes in the search template are :
* CKA_CLASS - Points to the objClass variable which contains the value
* CKO_SECRET_KEY, meaning this object is a secret key object.
* CKA_LABEL - Points to a char array containing what will be the label
* of the data object.
*
* The search will hit on all objects with the given class and label. Note
* that it is possible to have multiple objects on a token with matching
* attributes, no matter what the attributes are. There is nothing
* precluding the existence of duplicate objects. In the case of duplicate
* objects, the first one found is returned
*/
CK_ATTRIBUTE objectTemplate[] =
{
{CKA_CLASS, NULL, 0},
{CKA_LABEL, NULL, 0},
};
CK_SIZE templateSize = sizeof(objectTemplate) / sizeof(CK_ATTRIBUTE);
CK_ULONG numObjectsToFind = 1;
CK_ULONG numObjectsFound = 0;
CK_ATTRIBUTE* pAttr = NULL;
/*
* Fill out the template with the values to search for
*/
/* First set the object class ... */
pAttr = FindAttribute(CKA_CLASS, objectTemplate, templateSize);
pAttr->pValue = &objClass;
pAttr->ulValueLen = sizeof(CK_OBJECT_CLASS);
/* Now set the label ... */
pAttr = FindAttribute(CKA_LABEL, objectTemplate, templateSize);
pAttr->pValue = pObjLabel;
pAttr->ulValueLen = strlen((char*)pObjLabel);
/*
* Now perform the search
*/
/* First initialise the search operation */
rv = C_FindObjectsInit(hSession, objectTemplate, templateSize);
CHECK_CK_RV_GOTO(rv, "C_FindObjectsInit", end);
/* Search */
rv = C_FindObjects(hSession,
phObj,
numObjectsToFind,
&numObjectsFound);
CHECK_CK_RV_GOTO(rv, "C_FindObjects", end);
/* Terminate the search */
rv = C_FindObjectsFinal(hSession);
CHECK_CK_RV_GOTO(rv, "C_FindObjects", end);
/* Check to see if we found a matching object */
if (numObjectsFound == 0)
{
fprintf(stderr, "Object not found.\n");
rv = CKR_GENERAL_ERROR;
}
end:
return rv;
}
int ssl_connect_internal(int sd, const char* szTargetHost, int sslContextHandle)
{
int err = SOCK_SOCKET_ERROR;
SSL *ssl = NULL;
int nonblock = 0;
// Retrieve SSL struct from g_SSL_Driver
if((sslContextHandle >= ARRAYSIZE(g_SSL_Driver.m_sslContextArray)) || (sslContextHandle < 0))
{
goto error;
}
// sd should already have been created
// Now do the SSL negotiation
ssl = (SSL*)g_SSL_Driver.m_sslContextArray[sslContextHandle].SslContext;
if (ssl == NULL) goto error;
if (!SSL_set_fd(ssl, sd))
{
goto error;
}
if(ssl->verify_mode != SSL_VERIFY_NONE)
{
SSL_CTX* pCtx = SSL_get_SSL_CTX(ssl);
if(pCtx != NULL)
{
X509_STORE *pStore = SSL_CTX_get_cert_store(pCtx);
if(sk_num(&pStore->objs->stack) == 0)
{
CryptokiSession* pSession;
CK_SLOT_ID slotID;
OBJECT_DATA* pObj;
CK_ATTRIBUTE attribs[2];
CK_OBJECT_CLASS cls = SwapEndianIfBEc32(CKO_CERTIFICATE);
LPSTR label = "CA";
CK_SESSION_HANDLE hSess;
if(CKR_OK == C_OpenSession(0, CKF_SERIAL_SESSION, NULL, NULL, &hSess) &&
CKR_OK == Cryptoki_GetSlotIDFromSession(hSess, &slotID, &pSession))
{
attribs[0].type = CKA_CLASS;
attribs[0].pValue = &cls;
attribs[0].ulValueLen = sizeof(cls);
attribs[1].type = CKA_LABEL;
attribs[1].pValue = label;
attribs[1].ulValueLen = 2;
if(CKR_OK == C_FindObjectsInit(hSess, attribs, ARRAYSIZE(attribs)))
{
CK_OBJECT_HANDLE hObjs[20];
CK_ULONG cnt = 0;
if(CKR_OK == C_FindObjects(hSess, hObjs, ARRAYSIZE(hObjs), &cnt) && cnt > 0)
{
for(int i=0; i<cnt; i++)
{
pObj = PKCS11_Objects_OpenSSL::GetObjectFromHandle(&pSession->Context, hObjs[i]);
if(pObj != NULL && pObj->Type == 3 /*CertificateType*/)
{
CERT_DATA* pCert = (CERT_DATA*)pObj->Data;
X509_STORE_add_cert(pStore, pCert->cert);
}
}
}
C_FindObjectsFinal(hSess);
}
}
if(pStore->objs == NULL || 0 == sk_num(&pStore->objs->stack))
{
ssl->verify_mode = SSL_VERIFY_NONE;
}
C_CloseSession(hSess);
}
}
}
if(szTargetHost != NULL && szTargetHost[0] != 0)
{
SSL_set_tlsext_host_name(ssl, szTargetHost);
}
SOCK_ioctl(sd, SOCK_FIONBIO, &nonblock);
err = SSL_connect (ssl);
nonblock = 1;
SOCK_ioctl(sd, SOCK_FIONBIO, &nonblock);
err = SSL_get_error(ssl,err);
if(err == SSL_ERROR_WANT_READ)
{
err = SOCK_EWOULDBLOCK;
#if !defined(TCPIP_LWIP) && !defined(TCPIP_LWIP_OS)
SOCKET_DRIVER.ClearStatusBitsForSocket( sd, FALSE );
#endif
}
else if(err == SSL_ERROR_WANT_WRITE)
{
err = SOCK_TRY_AGAIN;
#if !defined(TCPIP_LWIP) && !defined(TCPIP_LWIP_OS)
SOCKET_DRIVER.ClearStatusBitsForSocket( sd, TRUE );
#endif
}
SOCKET_DRIVER.SetSocketSslData(sd, (void*)ssl);
error:
return err;
}
int
main (int argc, char *argv[])
{
CK_RV err;
CK_SLOT_ID_PTR slots;
CK_ULONG slots_count;
unsigned int i;
(void) argc;
(void) argv;
if (argc > 1 && !strcmp ("--printable", argv[1]))
printable = true;
init_cryptoki ();
err = C_GetSlotList (true, NULL, &slots_count);
fail_if_err (err);
if (slots_count == 0)
{
printf ("Skipping test because no token is present.\n");
return 77;
}
printf ("Number of slots with tokens: %lu\n", slots_count);
slots = malloc (sizeof (CK_SLOT_ID) * slots_count);
if (!slots)
fail_if_err (CKR_HOST_MEMORY);
err = C_GetSlotList (true, slots, &slots_count);
fail_if_err (err);
for (i = 0; i < slots_count; i++)
{
CK_SESSION_HANDLE session;
CK_OBJECT_HANDLE object;
CK_ULONG count;
printf ("%2i. Slot ID %lu\n", i, slots[i]);
err = C_OpenSession (slots[i], CKF_SERIAL_SESSION, NULL, NULL,
&session);
fail_if_err (err);
printf (" Session ID: %lu\n", session);
err = C_FindObjectsInit (session, NULL, 0);
fail_if_err (err);
do
{
err = C_FindObjects (session, &object, 1, &count);
fail_if_err (err);
if (count)
{
printf (" Object Handle: %lu\n", object);
err = dump_object (session, object);
fail_if_err (err);
}
}
while (count);
err = C_FindObjectsFinal (session);
fail_if_err (err);
err = C_CloseSession (session);
fail_if_err (err);
}
return 0;
}
