src/shared/pkcs11-util.h

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2 #pragma once
   3
   4 #if HAVE_OPENSSL
   5 #  include <openssl/evp.h>
   6 #  include <openssl/x509.h>
   7 #endif
   8 #include <stdbool.h>
   9
  10 #if HAVE_P11KIT
  11 #  include <p11-kit/p11-kit.h>
  12 #  include <p11-kit/uri.h>
  13 #endif
  14
  15 #include "ask-password-api.h"
  16 #include "dlfcn-util.h"
  17 #include "macro.h"
  18 #include "time-util.h"
  19
  20 bool pkcs11_uri_valid(const char *uri);
  21
  22 #if HAVE_P11KIT
  23 DLSYM_PROTOTYPE(p11_kit_module_get_name);
  24 DLSYM_PROTOTYPE(p11_kit_modules_finalize_and_release);
  25 DLSYM_PROTOTYPE(p11_kit_modules_load_and_initialize);
  26 DLSYM_PROTOTYPE(p11_kit_strerror);
  27 DLSYM_PROTOTYPE(p11_kit_uri_format);
  28 DLSYM_PROTOTYPE(p11_kit_uri_free);
  29 DLSYM_PROTOTYPE(p11_kit_uri_get_attributes);
  30 DLSYM_PROTOTYPE(p11_kit_uri_get_attribute);
  31 DLSYM_PROTOTYPE(p11_kit_uri_set_attribute);
  32 DLSYM_PROTOTYPE(p11_kit_uri_get_module_info);
  33 DLSYM_PROTOTYPE(p11_kit_uri_get_slot_info);
  34 DLSYM_PROTOTYPE(p11_kit_uri_get_token_info);
  35 DLSYM_PROTOTYPE(p11_kit_uri_match_token_info);
  36 DLSYM_PROTOTYPE(p11_kit_uri_message);
  37 DLSYM_PROTOTYPE(p11_kit_uri_new);
  38 DLSYM_PROTOTYPE(p11_kit_uri_parse);
  39
  40 int uri_from_string(const char *p, P11KitUri **ret);
  41
  42 P11KitUri *uri_from_module_info(const CK_INFO *info);
  43 P11KitUri *uri_from_slot_info(const CK_SLOT_INFO *slot_info);
  44 P11KitUri *uri_from_token_info(const CK_TOKEN_INFO *token_info);
  45
  46 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(P11KitUri*, sym_p11_kit_uri_free, NULL);
  47 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(CK_FUNCTION_LIST**, sym_p11_kit_modules_finalize_and_release, NULL);
  48
  49 CK_RV pkcs11_get_slot_list_malloc(CK_FUNCTION_LIST *m, CK_SLOT_ID **ret_slotids, CK_ULONG *ret_n_slotids);
  50
  51 char *pkcs11_token_label(const CK_TOKEN_INFO *token_info);
  52 char *pkcs11_token_manufacturer_id(const CK_TOKEN_INFO *token_info);
  53 char *pkcs11_token_model(const CK_TOKEN_INFO *token_info);
  54
  55 int pkcs11_token_login_by_pin(CK_FUNCTION_LIST *m, CK_SESSION_HANDLE session, const CK_TOKEN_INFO *token_info, const char *token_label, const void *pin, size_t pin_size);
  56 int pkcs11_token_login(CK_FUNCTION_LIST *m, CK_SESSION_HANDLE session, CK_SLOT_ID slotid, const CK_TOKEN_INFO *token_info, const char *friendly_name, const char *icon_name, const char *key_name, const char *credential_name, usec_t until, AskPasswordFlags ask_password_flags, char **ret_used_pin);
  57
  58 int pkcs11_token_find_related_object(CK_FUNCTION_LIST *m, CK_SESSION_HANDLE session, CK_OBJECT_HANDLE prototype, CK_OBJECT_CLASS class, CK_OBJECT_HANDLE *ret_object);
  59 int pkcs11_token_find_x509_certificate(CK_FUNCTION_LIST *m, CK_SESSION_HANDLE session, P11KitUri *search_uri, CK_OBJECT_HANDLE *ret_object);
  60 #if HAVE_OPENSSL
  61 int pkcs11_token_read_public_key(CK_FUNCTION_LIST *m, CK_SESSION_HANDLE session, CK_OBJECT_HANDLE object, EVP_PKEY **ret_pkey);
  62 int pkcs11_token_read_x509_certificate(CK_FUNCTION_LIST *m, CK_SESSION_HANDLE session, CK_OBJECT_HANDLE object, X509 **ret_cert);
  63 #endif
  64
  65 int pkcs11_token_find_private_key(CK_FUNCTION_LIST *m, CK_SESSION_HANDLE session, P11KitUri *search_uri, CK_OBJECT_HANDLE *ret_object);
  66 int pkcs11_token_decrypt_data(CK_FUNCTION_LIST *m, CK_SESSION_HANDLE session, CK_OBJECT_HANDLE object, const void *encrypted_data, size_t encrypted_data_size, void **ret_decrypted_data, size_t *ret_decrypted_data_size);
  67
  68 int pkcs11_token_acquire_rng(CK_FUNCTION_LIST *m, CK_SESSION_HANDLE session);
  69
  70 typedef int (*pkcs11_find_token_callback_t)(CK_FUNCTION_LIST *m, CK_SESSION_HANDLE session, CK_SLOT_ID slotid, const CK_SLOT_INFO *slot_info, const CK_TOKEN_INFO *token_info, P11KitUri *uri, void *userdata);
  71 int pkcs11_find_token(const char *pkcs11_uri, pkcs11_find_token_callback_t callback, void *userdata);
  72
  73 #if HAVE_OPENSSL
  74 int pkcs11_acquire_public_key(const char *uri, const char *askpw_friendly_name, const char *askpw_icon, const char *askpw_credential, AskPasswordFlags askpw_flags, EVP_PKEY **ret_pkey, char **ret_pin_used);
  75 #endif
  76
  77 typedef struct {
  78         const char *friendly_name;
  79         usec_t until;
  80         void *encrypted_key;
  81         size_t encrypted_key_size;
  82         void *decrypted_key;
  83         size_t decrypted_key_size;
  84         bool free_encrypted_key;
  85         const char *askpw_credential;
  86         AskPasswordFlags askpw_flags;
  87 } pkcs11_crypt_device_callback_data;
  88
  89 void pkcs11_crypt_device_callback_data_release(pkcs11_crypt_device_callback_data *data);
  90
  91 int pkcs11_crypt_device_callback(
  92                 CK_FUNCTION_LIST *m,
  93                 CK_SESSION_HANDLE session,
  94                 CK_SLOT_ID slot_id,
  95                 const CK_SLOT_INFO *slot_info,
  96                 const CK_TOKEN_INFO *token_info,
  97                 P11KitUri *uri,
  98                 void *userdata);
  99
 100 int dlopen_p11kit(void);
 101
 102 #else
 103
 104 static inline int dlopen_p11kit(void) {
 105         return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "p11kit support is not compiled in.");
 106 }
 107
 108 #endif
 109
 110 typedef struct {
 111         const char *friendly_name;
 112         usec_t until;
 113         const char *askpw_credential;
 114         AskPasswordFlags askpw_flags;
 115 } systemd_pkcs11_plugin_params;
 116
 117 int pkcs11_list_tokens(void);
 118 int pkcs11_find_token_auto(char **ret);