src/shared/pkcs11-util.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <fcntl.h>
   4
   5 #include "ask-password-api.h"
   6 #include "dlfcn-util.h"
   7 #include "env-util.h"
   8 #include "escape.h"
   9 #include "fd-util.h"
  10 #include "format-table.h"
  11 #include "io-util.h"
  12 #include "memory-util.h"
  13 #if HAVE_OPENSSL
  14 #include "openssl-util.h"
  15 #endif
  16 #include "pkcs11-util.h"
  17 #include "random-util.h"
  18 #include "string-util.h"
  19 #include "strv.h"
  20
  21 bool pkcs11_uri_valid(const char *uri) {
  22         const char *p;
  23
  24         /* A very superficial checker for RFC7512 PKCS#11 URI syntax */
  25
  26         if (isempty(uri))
  27                 return false;
  28
  29         p = startswith(uri, "pkcs11:");
  30         if (!p)
  31                 return false;
  32
  33         if (isempty(p))
  34                 return false;
  35
  36         if (!in_charset(p, ALPHANUMERICAL ".~/-_?;&%="))
  37                 return false;
  38
  39         return true;
  40 }
  41
  42 #if HAVE_P11KIT
  43
  44 static void *p11kit_dl = NULL;
  45
  46 char *(*sym_p11_kit_module_get_name)(CK_FUNCTION_LIST *module);
  47 void (*sym_p11_kit_modules_finalize_and_release)(CK_FUNCTION_LIST **modules);
  48 CK_FUNCTION_LIST **(*sym_p11_kit_modules_load_and_initialize)(int flags);
  49 const char *(*sym_p11_kit_strerror)(CK_RV rv);
  50 int (*sym_p11_kit_uri_format)(P11KitUri *uri, P11KitUriType uri_type, char **string);
  51 void (*sym_p11_kit_uri_free)(P11KitUri *uri);
  52 CK_ATTRIBUTE_PTR (*sym_p11_kit_uri_get_attributes)(P11KitUri *uri, CK_ULONG *n_attrs);
  53 CK_INFO_PTR (*sym_p11_kit_uri_get_module_info)(P11KitUri *uri);
  54 CK_SLOT_INFO_PTR (*sym_p11_kit_uri_get_slot_info)(P11KitUri *uri);
  55 CK_TOKEN_INFO_PTR (*sym_p11_kit_uri_get_token_info)(P11KitUri *uri);
  56 int (*sym_p11_kit_uri_match_token_info)(const P11KitUri *uri, const CK_TOKEN_INFO *token_info);
  57 const char *(*sym_p11_kit_uri_message)(int code);
  58 P11KitUri *(*sym_p11_kit_uri_new)(void);
  59 int (*sym_p11_kit_uri_parse)(const char *string, P11KitUriType uri_type, P11KitUri *uri);
  60
  61 int dlopen_p11kit(void) {
  62         return dlopen_many_sym_or_warn(
  63                         &p11kit_dl,
  64                         "libp11-kit.so.0", LOG_DEBUG,
  65                         DLSYM_ARG(p11_kit_module_get_name),
  66                         DLSYM_ARG(p11_kit_modules_finalize_and_release),
  67                         DLSYM_ARG(p11_kit_modules_load_and_initialize),
  68                         DLSYM_ARG(p11_kit_strerror),
  69                         DLSYM_ARG(p11_kit_uri_format),
  70                         DLSYM_ARG(p11_kit_uri_free),
  71                         DLSYM_ARG(p11_kit_uri_get_attributes),
  72                         DLSYM_ARG(p11_kit_uri_get_module_info),
  73                         DLSYM_ARG(p11_kit_uri_get_slot_info),
  74                         DLSYM_ARG(p11_kit_uri_get_token_info),
  75                         DLSYM_ARG(p11_kit_uri_match_token_info),
  76                         DLSYM_ARG(p11_kit_uri_message),
  77                         DLSYM_ARG(p11_kit_uri_new),
  78                         DLSYM_ARG(p11_kit_uri_parse));
  79 }
  80
  81 int uri_from_string(const char *p, P11KitUri **ret) {
  82         _cleanup_(sym_p11_kit_uri_freep) P11KitUri *uri = NULL;
  83         int r;
  84
  85         assert(p);
  86         assert(ret);
  87
  88         r = dlopen_p11kit();
  89         if (r < 0)
  90                 return r;
  91
  92         uri = sym_p11_kit_uri_new();
  93         if (!uri)
  94                 return -ENOMEM;
  95
  96         if (sym_p11_kit_uri_parse(p, P11_KIT_URI_FOR_ANY, uri) != P11_KIT_URI_OK)
  97                 return -EINVAL;
  98
  99         *ret = TAKE_PTR(uri);
 100         return 0;
 101 }
 102
 103 P11KitUri *uri_from_module_info(const CK_INFO *info) {
 104         P11KitUri *uri;
 105
 106         assert(info);
 107
 108         if (dlopen_p11kit() < 0)
 109                 return NULL;
 110
 111         uri = sym_p11_kit_uri_new();
 112         if (!uri)
 113                 return NULL;
 114
 115         *sym_p11_kit_uri_get_module_info(uri) = *info;
 116         return uri;
 117 }
 118
 119 P11KitUri *uri_from_slot_info(const CK_SLOT_INFO *slot_info) {
 120         P11KitUri *uri;
 121
 122         assert(slot_info);
 123
 124         if (dlopen_p11kit() < 0)
 125                 return NULL;
 126
 127         uri = sym_p11_kit_uri_new();
 128         if (!uri)
 129                 return NULL;
 130
 131         *sym_p11_kit_uri_get_slot_info(uri) = *slot_info;
 132         return uri;
 133 }
 134
 135 P11KitUri *uri_from_token_info(const CK_TOKEN_INFO *token_info) {
 136         P11KitUri *uri;
 137
 138         assert(token_info);
 139
 140         if (dlopen_p11kit() < 0)
 141                 return NULL;
 142
 143         uri = sym_p11_kit_uri_new();
 144         if (!uri)
 145                 return NULL;
 146
 147         *sym_p11_kit_uri_get_token_info(uri) = *token_info;
 148         return uri;
 149 }
 150
 151 CK_RV pkcs11_get_slot_list_malloc(
 152                 CK_FUNCTION_LIST *m,
 153                 CK_SLOT_ID **ret_slotids,
 154                 CK_ULONG *ret_n_slotids) {
 155
 156         CK_RV rv;
 157
 158         assert(m);
 159         assert(ret_slotids);
 160         assert(ret_n_slotids);
 161
 162         for (unsigned tries = 0; tries < 16; tries++) {
 163                 _cleanup_free_ CK_SLOT_ID *slotids = NULL;
 164                 CK_ULONG n_slotids = 0;
 165
 166                 rv = m->C_GetSlotList(0, NULL, &n_slotids);
 167                 if (rv != CKR_OK)
 168                         return rv;
 169                 if (n_slotids == 0) {
 170                         *ret_slotids = NULL;
 171                         *ret_n_slotids = 0;
 172                         return CKR_OK;
 173                 }
 174
 175                 slotids = new(CK_SLOT_ID, n_slotids);
 176                 if (!slotids)
 177                         return CKR_HOST_MEMORY;
 178
 179                 rv = m->C_GetSlotList(0, slotids, &n_slotids);
 180                 if (rv == CKR_OK) {
 181                         *ret_slotids = TAKE_PTR(slotids);
 182                         *ret_n_slotids = n_slotids;
 183                         return CKR_OK;
 184                 }
 185
 186                 if (rv != CKR_BUFFER_TOO_SMALL)
 187                         return rv;
 188
 189                 /* Hu? Maybe somebody plugged something in and things changed? Let's try again */
 190         }
 191
 192         return CKR_BUFFER_TOO_SMALL;
 193 }
 194
 195 char *pkcs11_token_label(const CK_TOKEN_INFO *token_info) {
 196         char *t;
 197
 198         /* The label is not NUL terminated and likely padded with spaces, let's make a copy here, so that we
 199          * can strip that. */
 200         t = strndup((char*) token_info->label, sizeof(token_info->label));
 201         if (!t)
 202                 return NULL;
 203
 204         strstrip(t);
 205         return t;
 206 }
 207
 208 char *pkcs11_token_manufacturer_id(const CK_TOKEN_INFO *token_info) {
 209         char *t;
 210
 211         t = strndup((char*) token_info->manufacturerID, sizeof(token_info->manufacturerID));
 212         if (!t)
 213                 return NULL;
 214
 215         strstrip(t);
 216         return t;
 217 }
 218
 219 char *pkcs11_token_model(const CK_TOKEN_INFO *token_info) {
 220         char *t;
 221
 222         t = strndup((char*) token_info->model, sizeof(token_info->model));
 223         if (!t)
 224                 return NULL;
 225
 226         strstrip(t);
 227         return t;
 228 }
 229
 230 int pkcs11_token_login_by_pin(
 231                 CK_FUNCTION_LIST *m,
 232                 CK_SESSION_HANDLE session,
 233                 const CK_TOKEN_INFO *token_info,
 234                 const char *token_label,
 235                 const void *pin,
 236                 size_t pin_size) {
 237
 238         CK_RV rv;
 239         int r;
 240
 241         assert(m);
 242         assert(token_info);
 243
 244         r = dlopen_p11kit();
 245         if (r < 0)
 246                 return r;
 247
 248         if (FLAGS_SET(token_info->flags, CKF_PROTECTED_AUTHENTICATION_PATH)) {
 249                 rv = m->C_Login(session, CKU_USER, NULL, 0);
 250                 if (rv != CKR_OK)
 251                         return log_error_errno(SYNTHETIC_ERRNO(EIO),
 252                                                "Failed to log into security token '%s': %s", token_label, sym_p11_kit_strerror(rv));
 253
 254                 log_info("Successfully logged into security token '%s' via protected authentication path.", token_label);
 255                 return 0;
 256         }
 257
 258         if (!FLAGS_SET(token_info->flags, CKF_LOGIN_REQUIRED)) {
 259                 log_info("No login into security token '%s' required.", token_label);
 260                 return 0;
 261         }
 262
 263         if (!pin)
 264                 return -ENOANO;
 265
 266         rv = m->C_Login(session, CKU_USER, (CK_UTF8CHAR*) pin, pin_size);
 267         if (rv == CKR_OK)  {
 268                 log_info("Successfully logged into security token '%s'.", token_label);
 269                 return 0;
 270         }
 271
 272         if (rv == CKR_PIN_LOCKED)
 273                 return log_error_errno(SYNTHETIC_ERRNO(EPERM),
 274                                        "PIN has been locked, please reset PIN of security token '%s'.", token_label);
 275         if (!IN_SET(rv, CKR_PIN_INCORRECT, CKR_PIN_LEN_RANGE))
 276                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
 277                                        "Failed to log into security token '%s': %s", token_label, sym_p11_kit_strerror(rv));
 278
 279         return log_notice_errno(SYNTHETIC_ERRNO(ENOLCK),
 280                                 "PIN for token '%s' is incorrect, please try again.",
 281                                 token_label);
 282 }
 283
 284 int pkcs11_token_login(
 285                 CK_FUNCTION_LIST *m,
 286                 CK_SESSION_HANDLE session,
 287                 CK_SLOT_ID slotid,
 288                 const CK_TOKEN_INFO *token_info,
 289                 const char *friendly_name,
 290                 const char *icon_name,
 291                 const char *key_name,
 292                 const char *credential_name,
 293                 usec_t until,
 294                 AskPasswordFlags ask_password_flags,
 295                 bool headless,
 296                 char **ret_used_pin) {
 297
 298         _cleanup_free_ char *token_uri_string = NULL, *token_uri_escaped = NULL, *id = NULL, *token_label = NULL;
 299         _cleanup_(sym_p11_kit_uri_freep) P11KitUri *token_uri = NULL;
 300         CK_TOKEN_INFO updated_token_info;
 301         int uri_result, r;
 302         CK_RV rv;
 303
 304         assert(m);
 305         assert(token_info);
 306
 307         r = dlopen_p11kit();
 308         if (r < 0)
 309                 return r;
 310
 311         token_label = pkcs11_token_label(token_info);
 312         if (!token_label)
 313                 return log_oom();
 314
 315         token_uri = uri_from_token_info(token_info);
 316         if (!token_uri)
 317                 return log_oom();
 318
 319         uri_result = sym_p11_kit_uri_format(token_uri, P11_KIT_URI_FOR_ANY, &token_uri_string);
 320         if (uri_result != P11_KIT_URI_OK)
 321                 return log_warning_errno(SYNTHETIC_ERRNO(EAGAIN), "Failed to format slot URI: %s", sym_p11_kit_uri_message(uri_result));
 322
 323         r = pkcs11_token_login_by_pin(m, session, token_info, token_label, /* pin= */ NULL, 0);
 324         if (r == 0 && ret_used_pin)
 325                 *ret_used_pin = NULL;
 326
 327         if (r != -ENOANO) /* pin required */
 328                 return r;
 329
 330         token_uri_escaped = cescape(token_uri_string);
 331         if (!token_uri_escaped)
 332                 return log_oom();
 333
 334         id = strjoin("pkcs11:", token_uri_escaped);
 335         if (!id)
 336                 return log_oom();
 337
 338         for (unsigned tries = 0; tries < 3; tries++) {
 339                 _cleanup_strv_free_erase_ char **passwords = NULL;
 340                 _cleanup_(erase_and_freep) char *envpin = NULL;
 341
 342                 r = getenv_steal_erase("PIN", &envpin);
 343                 if (r < 0)
 344                         return log_error_errno(r, "Failed to acquire PIN from environment: %m");
 345                 if (r > 0) {
 346                         passwords = strv_new(envpin);
 347                         if (!passwords)
 348                                 return log_oom();
 349
 350                 } else if (headless)
 351                         return log_error_errno(SYNTHETIC_ERRNO(ENOPKG), "PIN querying disabled via 'headless' option. Use the 'PIN' environment variable.");
 352                 else {
 353                         _cleanup_free_ char *text = NULL;
 354
 355                         if (FLAGS_SET(token_info->flags, CKF_USER_PIN_FINAL_TRY))
 356                                 r = asprintf(&text,
 357                                              "Please enter correct PIN for security token '%s' in order to unlock %s (final try):",
 358                                              token_label, friendly_name);
 359                         else if (FLAGS_SET(token_info->flags, CKF_USER_PIN_COUNT_LOW))
 360                                 r = asprintf(&text,
 361                                              "PIN has been entered incorrectly previously, please enter correct PIN for security token '%s' in order to unlock %s:",
 362                                              token_label, friendly_name);
 363                         else if (tries == 0)
 364                                 r = asprintf(&text,
 365                                              "Please enter PIN for security token '%s' in order to unlock %s:",
 366                                              token_label, friendly_name);
 367                         else
 368                                 r = asprintf(&text,
 369                                              "Please enter PIN for security token '%s' in order to unlock %s (try #%u):",
 370                                              token_label, friendly_name, tries+1);
 371                         if (r < 0)
 372                                 return log_oom();
 373
 374                         /* We never cache PINs, simply because it's fatal if we use wrong PINs, since usually there are only 3 tries */
 375                         r = ask_password_auto(text, icon_name, id, key_name, credential_name, until, ask_password_flags, &passwords);
 376                         if (r < 0)
 377                                 return log_error_errno(r, "Failed to query PIN for security token '%s': %m", token_label);
 378                 }
 379
 380                 STRV_FOREACH(i, passwords) {
 381                         r = pkcs11_token_login_by_pin(m, session, token_info, token_label, *i, strlen(*i));
 382                         if (r == 0 && ret_used_pin) {
 383                                 char *c;
 384
 385                                 c = strdup(*i);
 386                                 if (!c)
 387                                         return log_oom();
 388
 389                                 *ret_used_pin = c;
 390                         }
 391
 392                         if (r != -ENOLCK)
 393                                 return r;
 394
 395                         /* Refresh the token info, so that we can prompt knowing the new flags if they changed. */
 396                         rv = m->C_GetTokenInfo(slotid, &updated_token_info);
 397                         if (rv != CKR_OK)
 398                                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
 399                                                        "Failed to acquire updated security token information for slot %lu: %s",
 400                                                        slotid, sym_p11_kit_strerror(rv));
 401
 402                         token_info = &updated_token_info;
 403                 }
 404         }
 405
 406         return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Too many attempts to log into token '%s'.", token_label);
 407 }
 408
 409 int pkcs11_token_find_x509_certificate(
 410                 CK_FUNCTION_LIST *m,
 411                 CK_SESSION_HANDLE session,
 412                 P11KitUri *search_uri,
 413                 CK_OBJECT_HANDLE *ret_object) {
 414
 415         bool found_class = false, found_certificate_type = false;
 416         _cleanup_free_ CK_ATTRIBUTE *attributes_buffer = NULL;
 417         CK_ULONG n_attributes, a, n_objects;
 418         CK_ATTRIBUTE *attributes = NULL;
 419         CK_OBJECT_HANDLE objects[2];
 420         CK_RV rv, rv2;
 421         int r;
 422
 423         assert(m);
 424         assert(search_uri);
 425         assert(ret_object);
 426
 427         r = dlopen_p11kit();
 428         if (r < 0)
 429                 return r;
 430
 431         attributes = sym_p11_kit_uri_get_attributes(search_uri, &n_attributes);
 432         for (a = 0; a < n_attributes; a++) {
 433
 434                 /* We use the URI's included match attributes, but make them more strict. This allows users
 435                  * to specify a token URL instead of an object URL and the right thing should happen if
 436                  * there's only one suitable key on the token. */
 437
 438                 switch (attributes[a].type) {
 439
 440                 case CKA_CLASS: {
 441                         CK_OBJECT_CLASS c;
 442
 443                         if (attributes[a].ulValueLen != sizeof(c))
 444                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid PKCS#11 CKA_CLASS attribute size.");
 445
 446                         memcpy(&c, attributes[a].pValue, sizeof(c));
 447                         if (c != CKO_CERTIFICATE)
 448                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Selected PKCS#11 object is not an X.509 certificate, refusing.");
 449
 450                         found_class = true;
 451                         break;
 452                 }
 453
 454                 case CKA_CERTIFICATE_TYPE: {
 455                         CK_CERTIFICATE_TYPE t;
 456
 457                         if (attributes[a].ulValueLen != sizeof(t))
 458                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid PKCS#11 CKA_CERTIFICATE_TYPE attribute size.");
 459
 460                         memcpy(&t, attributes[a].pValue, sizeof(t));
 461                         if (t != CKC_X_509)
 462                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Selected PKCS#11 object is not an X.509 certificate, refusing.");
 463
 464                         found_certificate_type = true;
 465                         break;
 466                 }}
 467         }
 468
 469         if (!found_class || !found_certificate_type) {
 470                 /* Hmm, let's slightly extend the attribute list we search for */
 471
 472                 attributes_buffer = new(CK_ATTRIBUTE, n_attributes + !found_class + !found_certificate_type);
 473                 if (!attributes_buffer)
 474                         return log_oom();
 475
 476                 memcpy(attributes_buffer, attributes, sizeof(CK_ATTRIBUTE) * n_attributes);
 477
 478                 if (!found_class) {
 479                         static const CK_OBJECT_CLASS class = CKO_CERTIFICATE;
 480
 481                         attributes_buffer[n_attributes++] = (CK_ATTRIBUTE) {
 482                                 .type = CKA_CLASS,
 483                                 .pValue = (CK_OBJECT_CLASS*) &class,
 484                                 .ulValueLen = sizeof(class),
 485                         };
 486                 }
 487
 488                 if (!found_certificate_type) {
 489                         static const CK_CERTIFICATE_TYPE type = CKC_X_509;
 490
 491                         attributes_buffer[n_attributes++] = (CK_ATTRIBUTE) {
 492                                 .type = CKA_CERTIFICATE_TYPE,
 493                                 .pValue = (CK_CERTIFICATE_TYPE*) &type,
 494                                 .ulValueLen = sizeof(type),
 495                         };
 496                 }
 497
 498                 attributes = attributes_buffer;
 499         }
 500
 501         rv = m->C_FindObjectsInit(session, attributes, n_attributes);
 502         if (rv != CKR_OK)
 503                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
 504                                        "Failed to initialize object find call: %s", sym_p11_kit_strerror(rv));
 505
 506         rv = m->C_FindObjects(session, objects, ELEMENTSOF(objects), &n_objects);
 507         rv2 = m->C_FindObjectsFinal(session);
 508         if (rv != CKR_OK)
 509                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
 510                                        "Failed to find objects: %s", sym_p11_kit_strerror(rv));
 511         if (rv2 != CKR_OK)
 512                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
 513                                        "Failed to finalize object find call: %s", sym_p11_kit_strerror(rv));
 514         if (n_objects == 0)
 515                 return log_error_errno(SYNTHETIC_ERRNO(ENOENT),
 516                                        "Failed to find selected X509 certificate on token.");
 517         if (n_objects > 1)
 518                 return log_error_errno(SYNTHETIC_ERRNO(ENOTUNIQ),
 519                                        "Configured URI matches multiple certificates, refusing.");
 520
 521         *ret_object = objects[0];
 522         return 0;
 523 }
 524
 525 #if HAVE_OPENSSL
 526 int pkcs11_token_read_x509_certificate(
 527                 CK_FUNCTION_LIST *m,
 528                 CK_SESSION_HANDLE session,
 529                 CK_OBJECT_HANDLE object,
 530                 X509 **ret_cert) {
 531
 532         _cleanup_free_ void *buffer = NULL;
 533         _cleanup_free_ char *t = NULL;
 534         CK_ATTRIBUTE attribute = {
 535                 .type = CKA_VALUE
 536         };
 537         CK_RV rv;
 538         _cleanup_(X509_freep) X509 *x509 = NULL;
 539         X509_NAME *name = NULL;
 540         const unsigned char *p;
 541         int r;
 542
 543         r = dlopen_p11kit();
 544         if (r < 0)
 545                 return r;
 546
 547         rv = m->C_GetAttributeValue(session, object, &attribute, 1);
 548         if (rv != CKR_OK)
 549                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
 550                                        "Failed to read X.509 certificate size off token: %s", sym_p11_kit_strerror(rv));
 551
 552         buffer = malloc(attribute.ulValueLen);
 553         if (!buffer)
 554                 return log_oom();
 555
 556         attribute.pValue = buffer;
 557
 558         rv = m->C_GetAttributeValue(session, object, &attribute, 1);
 559         if (rv != CKR_OK)
 560                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
 561                                        "Failed to read X.509 certificate data off token: %s", sym_p11_kit_strerror(rv));
 562
 563         p = attribute.pValue;
 564         x509 = d2i_X509(NULL, &p, attribute.ulValueLen);
 565         if (!x509)
 566                 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Failed parse X.509 certificate.");
 567
 568         name = X509_get_subject_name(x509);
 569         if (!name)
 570                 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Failed to acquire X.509 subject name.");
 571
 572         t = X509_NAME_oneline(name, NULL, 0);
 573         if (!t)
 574                 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to format X.509 subject name as string.");
 575
 576         log_debug("Using X.509 certificate issued for '%s'.", t);
 577
 578         *ret_cert = TAKE_PTR(x509);
 579         return 0;
 580 }
 581 #endif
 582
 583 int pkcs11_token_find_private_key(
 584                 CK_FUNCTION_LIST *m,
 585                 CK_SESSION_HANDLE session,
 586                 P11KitUri *search_uri,
 587                 CK_OBJECT_HANDLE *ret_object) {
 588
 589         bool found_decrypt = false, found_class = false, found_key_type = false;
 590         _cleanup_free_ CK_ATTRIBUTE *attributes_buffer = NULL;
 591         CK_ULONG n_attributes, a, n_objects;
 592         CK_ATTRIBUTE *attributes = NULL;
 593         CK_OBJECT_HANDLE objects[2];
 594         CK_RV rv, rv2;
 595         int r;
 596
 597         assert(m);
 598         assert(search_uri);
 599         assert(ret_object);
 600
 601         r = dlopen_p11kit();
 602         if (r < 0)
 603                 return r;
 604
 605         attributes = sym_p11_kit_uri_get_attributes(search_uri, &n_attributes);
 606         for (a = 0; a < n_attributes; a++) {
 607
 608                 /* We use the URI's included match attributes, but make them more strict. This allows users
 609                  * to specify a token URL instead of an object URL and the right thing should happen if
 610                  * there's only one suitable key on the token. */
 611
 612                 switch (attributes[a].type) {
 613
 614                 case CKA_CLASS: {
 615                         CK_OBJECT_CLASS c;
 616
 617                         if (attributes[a].ulValueLen != sizeof(c))
 618                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid PKCS#11 CKA_CLASS attribute size.");
 619
 620                         memcpy(&c, attributes[a].pValue, sizeof(c));
 621                         if (c != CKO_PRIVATE_KEY)
 622                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 623                                                        "Selected PKCS#11 object is not a private key, refusing.");
 624
 625                         found_class = true;
 626                         break;
 627                 }
 628
 629                 case CKA_DECRYPT: {
 630                         CK_BBOOL b;
 631
 632                         if (attributes[a].ulValueLen != sizeof(b))
 633                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid PKCS#11 CKA_DECRYPT attribute size.");
 634
 635                         memcpy(&b, attributes[a].pValue, sizeof(b));
 636                         if (!b)
 637                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 638                                                        "Selected PKCS#11 object is not suitable for decryption, refusing.");
 639
 640                         found_decrypt = true;
 641                         break;
 642                 }
 643
 644                 case CKA_KEY_TYPE: {
 645                         CK_KEY_TYPE t;
 646
 647                         if (attributes[a].ulValueLen != sizeof(t))
 648                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid PKCS#11 CKA_KEY_TYPE attribute size.");
 649
 650                         memcpy(&t, attributes[a].pValue, sizeof(t));
 651                         if (t != CKK_RSA)
 652                                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Selected PKCS#11 object is not an RSA key, refusing.");
 653
 654                         found_key_type = true;
 655                         break;
 656                 }}
 657         }
 658
 659         if (!found_decrypt || !found_class || !found_key_type) {
 660                 /* Hmm, let's slightly extend the attribute list we search for */
 661
 662                 attributes_buffer = new(CK_ATTRIBUTE, n_attributes + !found_decrypt + !found_class + !found_key_type);
 663                 if (!attributes_buffer)
 664                         return log_oom();
 665
 666                 memcpy(attributes_buffer, attributes, sizeof(CK_ATTRIBUTE) * n_attributes);
 667
 668                 if (!found_decrypt) {
 669                         static const CK_BBOOL yes = true;
 670
 671                         attributes_buffer[n_attributes++] = (CK_ATTRIBUTE) {
 672                                 .type = CKA_DECRYPT,
 673                                 .pValue = (CK_BBOOL*) &yes,
 674                                 .ulValueLen = sizeof(yes),
 675                         };
 676                 }
 677
 678                 if (!found_class) {
 679                         static const CK_OBJECT_CLASS class = CKO_PRIVATE_KEY;
 680
 681                         attributes_buffer[n_attributes++] = (CK_ATTRIBUTE) {
 682                                 .type = CKA_CLASS,
 683                                 .pValue = (CK_OBJECT_CLASS*) &class,
 684                                 .ulValueLen = sizeof(class),
 685                         };
 686                 }
 687
 688                 if (!found_key_type) {
 689                         static const CK_KEY_TYPE type = CKK_RSA;
 690
 691                         attributes_buffer[n_attributes++] = (CK_ATTRIBUTE) {
 692                                 .type = CKA_KEY_TYPE,
 693                                 .pValue = (CK_KEY_TYPE*) &type,
 694                                 .ulValueLen = sizeof(type),
 695                         };
 696                 }
 697
 698                 attributes = attributes_buffer;
 699         }
 700
 701         rv = m->C_FindObjectsInit(session, attributes, n_attributes);
 702         if (rv != CKR_OK)
 703                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
 704                                        "Failed to initialize object find call: %s", sym_p11_kit_strerror(rv));
 705
 706         rv = m->C_FindObjects(session, objects, ELEMENTSOF(objects), &n_objects);
 707         rv2 = m->C_FindObjectsFinal(session);
 708         if (rv != CKR_OK)
 709                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
 710                                        "Failed to find objects: %s", sym_p11_kit_strerror(rv));
 711         if (rv2 != CKR_OK)
 712                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
 713                                        "Failed to finalize object find call: %s", sym_p11_kit_strerror(rv));
 714         if (n_objects == 0)
 715                 return log_error_errno(SYNTHETIC_ERRNO(ENOENT),
 716                                        "Failed to find selected private key suitable for decryption on token.");
 717         if (n_objects > 1)
 718                 return log_error_errno(SYNTHETIC_ERRNO(ENOTUNIQ),
 719                                        "Configured private key URI matches multiple keys, refusing.");
 720
 721         *ret_object = objects[0];
 722         return 0;
 723 }
 724
 725 int pkcs11_token_decrypt_data(
 726                 CK_FUNCTION_LIST *m,
 727                 CK_SESSION_HANDLE session,
 728                 CK_OBJECT_HANDLE object,
 729                 const void *encrypted_data,
 730                 size_t encrypted_data_size,
 731                 void **ret_decrypted_data,
 732                 size_t *ret_decrypted_data_size) {
 733
 734         static const CK_MECHANISM mechanism = {
 735                  .mechanism = CKM_RSA_PKCS
 736         };
 737         _cleanup_(erase_and_freep) CK_BYTE *dbuffer = NULL;
 738         CK_ULONG dbuffer_size = 0;
 739         CK_RV rv;
 740         int r;
 741
 742         assert(m);
 743         assert(encrypted_data);
 744         assert(encrypted_data_size > 0);
 745         assert(ret_decrypted_data);
 746         assert(ret_decrypted_data_size);
 747
 748         r = dlopen_p11kit();
 749         if (r < 0)
 750                 return r;
 751
 752         rv = m->C_DecryptInit(session, (CK_MECHANISM*) &mechanism, object);
 753         if (rv != CKR_OK)
 754                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
 755                                        "Failed to initialize decryption on security token: %s", sym_p11_kit_strerror(rv));
 756
 757         dbuffer_size = encrypted_data_size; /* Start with something reasonable */
 758         dbuffer = malloc(dbuffer_size);
 759         if (!dbuffer)
 760                 return log_oom();
 761
 762         rv = m->C_Decrypt(session, (CK_BYTE*) encrypted_data, encrypted_data_size, dbuffer, &dbuffer_size);
 763         if (rv == CKR_BUFFER_TOO_SMALL) {
 764                 erase_and_free(dbuffer);
 765
 766                 dbuffer = malloc(dbuffer_size);
 767                 if (!dbuffer)
 768                         return log_oom();
 769
 770                 rv = m->C_Decrypt(session, (CK_BYTE*) encrypted_data, encrypted_data_size, dbuffer, &dbuffer_size);
 771         }
 772         if (rv != CKR_OK)
 773                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
 774                                        "Failed to decrypt key on security token: %s", sym_p11_kit_strerror(rv));
 775
 776         log_info("Successfully decrypted key with security token.");
 777
 778         *ret_decrypted_data = TAKE_PTR(dbuffer);
 779         *ret_decrypted_data_size = dbuffer_size;
 780         return 0;
 781 }
 782
 783 int pkcs11_token_acquire_rng(
 784                 CK_FUNCTION_LIST *m,
 785                 CK_SESSION_HANDLE session) {
 786
 787         _cleanup_free_ void *buffer = NULL;
 788         size_t rps;
 789         CK_RV rv;
 790         int r;
 791
 792         assert(m);
 793
 794         r = dlopen_p11kit();
 795         if (r < 0)
 796                 return r;
 797
 798         /* While we are at it, let's read some RNG data from the PKCS#11 token and pass it to the kernel
 799          * random pool. This should be cheap if we are talking to the device already. Note that we don't
 800          * credit any entropy, since we don't know about the quality of the pkcs#11 token's RNG. Why bother
 801          * at all? There are two sides to the argument whether to generate private keys on tokens or on the
 802          * host. By crediting some data from the token RNG to the host's pool we at least can say that any
 803          * key generated from it is at least as good as both sources individually. */
 804
 805         rps = random_pool_size();
 806
 807         buffer = malloc(rps);
 808         if (!buffer)
 809                 return log_oom();
 810
 811         rv = m->C_GenerateRandom(session, buffer, rps);
 812         if (rv != CKR_OK)
 813                 return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
 814                                        "Failed to generate RNG data on security token: %s", sym_p11_kit_strerror(rv));
 815
 816         r = random_write_entropy(-1, buffer, rps, false);
 817         if (r < 0)
 818                 return log_debug_errno(r, "Failed to write PKCS#11 acquired random data to /dev/urandom: %m");
 819
 820         log_debug("Successfully written %zu bytes random data acquired via PKCS#11 to kernel random pool.", rps);
 821
 822         return 0;
 823 }
 824
 825 static int token_process(
 826                 CK_FUNCTION_LIST *m,
 827                 CK_SLOT_ID slotid,
 828                 const CK_SLOT_INFO *slot_info,
 829                 const CK_TOKEN_INFO *token_info,
 830                 P11KitUri *search_uri,
 831                 pkcs11_find_token_callback_t callback,
 832                 void *userdata) {
 833
 834         _cleanup_free_ char *token_label = NULL;
 835         CK_SESSION_HANDLE session;
 836         CK_RV rv;
 837         int r;
 838
 839         assert(m);
 840         assert(slot_info);
 841         assert(token_info);
 842
 843         token_label = pkcs11_token_label(token_info);
 844         if (!token_label)
 845                 return log_oom();
 846
 847         rv = m->C_OpenSession(slotid, CKF_SERIAL_SESSION, NULL, NULL, &session);
 848         if (rv != CKR_OK)
 849                 return log_error_errno(SYNTHETIC_ERRNO(EIO),
 850                                        "Failed to create session for security token '%s': %s", token_label, sym_p11_kit_strerror(rv));
 851
 852         if (callback)
 853                 r = callback(m, session, slotid, slot_info, token_info, search_uri, userdata);
 854         else
 855                 r = 1; /* if not callback was specified, just say we found what we were looking for */
 856
 857         rv = m->C_CloseSession(session);
 858         if (rv != CKR_OK)
 859                 log_warning("Failed to close session on PKCS#11 token, ignoring: %s", sym_p11_kit_strerror(rv));
 860
 861         return r;
 862 }
 863
 864 static int slot_process(
 865                 CK_FUNCTION_LIST *m,
 866                 CK_SLOT_ID slotid,
 867                 P11KitUri *search_uri,
 868                 pkcs11_find_token_callback_t callback,
 869                 void *userdata) {
 870
 871         _cleanup_(sym_p11_kit_uri_freep) P11KitUri* slot_uri = NULL, *token_uri = NULL;
 872         _cleanup_free_ char *token_uri_string = NULL;
 873         CK_TOKEN_INFO token_info;
 874         CK_SLOT_INFO slot_info;
 875         int uri_result, r;
 876         CK_RV rv;
 877
 878         assert(m);
 879
 880         r = dlopen_p11kit();
 881         if (r < 0)
 882                 return r;
 883
 884         /* We return -EAGAIN for all failures we can attribute to a specific slot in some way, so that the
 885          * caller might try other slots before giving up. */
 886
 887         rv = m->C_GetSlotInfo(slotid, &slot_info);
 888         if (rv != CKR_OK) {
 889                 log_warning("Failed to acquire slot info for slot %lu, ignoring slot: %s", slotid, sym_p11_kit_strerror(rv));
 890                 return -EAGAIN;
 891         }
 892
 893         slot_uri = uri_from_slot_info(&slot_info);
 894         if (!slot_uri)
 895                 return log_oom();
 896
 897         if (DEBUG_LOGGING) {
 898                 _cleanup_free_ char *slot_uri_string = NULL;
 899
 900                 uri_result = sym_p11_kit_uri_format(slot_uri, P11_KIT_URI_FOR_ANY, &slot_uri_string);
 901                 if (uri_result != P11_KIT_URI_OK) {
 902                         log_warning("Failed to format slot URI, ignoring slot: %s", sym_p11_kit_uri_message(uri_result));
 903                         return -EAGAIN;
 904                 }
 905
 906                 log_debug("Found slot with URI %s", slot_uri_string);
 907         }
 908
 909         rv = m->C_GetTokenInfo(slotid, &token_info);
 910         if (rv == CKR_TOKEN_NOT_PRESENT) {
 911                 return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN),
 912                                        "Token not present in slot, ignoring.");
 913         } else if (rv != CKR_OK) {
 914                 log_warning("Failed to acquire token info for slot %lu, ignoring slot: %s", slotid, sym_p11_kit_strerror(rv));
 915                 return -EAGAIN;
 916         }
 917
 918         token_uri = uri_from_token_info(&token_info);
 919         if (!token_uri)
 920                 return log_oom();
 921
 922         uri_result = sym_p11_kit_uri_format(token_uri, P11_KIT_URI_FOR_ANY, &token_uri_string);
 923         if (uri_result != P11_KIT_URI_OK) {
 924                 log_warning("Failed to format slot URI: %s", sym_p11_kit_uri_message(uri_result));
 925                 return -EAGAIN;
 926         }
 927
 928         if (search_uri && !sym_p11_kit_uri_match_token_info(search_uri, &token_info))
 929                 return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN),
 930                                        "Found non-matching token with URI %s.",
 931                                        token_uri_string);
 932
 933         log_debug("Found matching token with URI %s.", token_uri_string);
 934
 935         return token_process(
 936                         m,
 937                         slotid,
 938                         &slot_info,
 939                         &token_info,
 940                         search_uri,
 941                         callback,
 942                         userdata);
 943 }
 944
 945 static int module_process(
 946                 CK_FUNCTION_LIST *m,
 947                 P11KitUri *search_uri,
 948                 pkcs11_find_token_callback_t callback,
 949                 void *userdata) {
 950
 951         _cleanup_(sym_p11_kit_uri_freep) P11KitUri* module_uri = NULL;
 952         _cleanup_free_ char *name = NULL, *module_uri_string = NULL;
 953         _cleanup_free_ CK_SLOT_ID *slotids = NULL;
 954         CK_ULONG n_slotids = 0;
 955         int uri_result;
 956         CK_INFO info;
 957         size_t k;
 958         CK_RV rv;
 959         int r;
 960
 961         assert(m);
 962
 963         r = dlopen_p11kit();
 964         if (r < 0)
 965                 return r;
 966
 967         /* We ignore most errors from modules here, in order to skip over faulty modules: one faulty module
 968          * should not have the effect that we don't try the others anymore. We indicate such per-module
 969          * failures with -EAGAIN, which let's the caller try the next module. */
 970
 971         name = sym_p11_kit_module_get_name(m);
 972         if (!name)
 973                 return log_oom();
 974
 975         log_debug("Trying PKCS#11 module %s.", name);
 976
 977         rv = m->C_GetInfo(&info);
 978         if (rv != CKR_OK) {
 979                 log_warning("Failed to get info on PKCS#11 module, ignoring module: %s", sym_p11_kit_strerror(rv));
 980                 return -EAGAIN;
 981         }
 982
 983         module_uri = uri_from_module_info(&info);
 984         if (!module_uri)
 985                 return log_oom();
 986
 987         uri_result = sym_p11_kit_uri_format(module_uri, P11_KIT_URI_FOR_ANY, &module_uri_string);
 988         if (uri_result != P11_KIT_URI_OK) {
 989                 log_warning("Failed to format module URI, ignoring module: %s", sym_p11_kit_uri_message(uri_result));
 990                 return -EAGAIN;
 991         }
 992
 993         log_debug("Found module with URI %s", module_uri_string);
 994
 995         rv = pkcs11_get_slot_list_malloc(m, &slotids, &n_slotids);
 996         if (rv != CKR_OK) {
 997                 log_warning("Failed to get slot list, ignoring module: %s", sym_p11_kit_strerror(rv));
 998                 return -EAGAIN;
 999         }
1000         if (n_slotids == 0)
1001                 return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN),
1002                                        "This module has no slots? Ignoring module.");
1003
1004         for (k = 0; k < n_slotids; k++) {
1005                 r = slot_process(
1006                                 m,
1007                                 slotids[k],
1008                                 search_uri,
1009                                 callback,
1010                                 userdata);
1011                 if (r != -EAGAIN)
1012                         return r;
1013         }
1014
1015         return -EAGAIN;
1016 }
1017
1018 int pkcs11_find_token(
1019                 const char *pkcs11_uri,
1020                 pkcs11_find_token_callback_t callback,
1021                 void *userdata) {
1022
1023         _cleanup_(sym_p11_kit_modules_finalize_and_releasep) CK_FUNCTION_LIST **modules = NULL;
1024         _cleanup_(sym_p11_kit_uri_freep) P11KitUri *search_uri = NULL;
1025         int r;
1026
1027         r = dlopen_p11kit();
1028         if (r < 0)
1029                 return r;
1030
1031         /* Execute the specified callback for each matching token found. If nothing is found returns
1032          * -EAGAIN. Logs about all errors, except for EAGAIN, which the caller has to log about. */
1033
1034         if (pkcs11_uri) {
1035                 r = uri_from_string(pkcs11_uri, &search_uri);
1036                 if (r < 0)
1037                         return log_error_errno(r, "Failed to parse PKCS#11 URI '%s': %m", pkcs11_uri);
1038         }
1039
1040         modules = sym_p11_kit_modules_load_and_initialize(0);
1041         if (!modules)
1042                 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to initialize pkcs11 modules");
1043
1044         for (CK_FUNCTION_LIST **i = modules; *i; i++) {
1045                 r = module_process(
1046                                 *i,
1047                                 search_uri,
1048                                 callback,
1049                                 userdata);
1050                 if (r != -EAGAIN)
1051                         return r;
1052         }
1053
1054         return -EAGAIN;
1055 }
1056
1057 #if HAVE_OPENSSL
1058 struct pkcs11_acquire_certificate_callback_data {
1059         char *pin_used;
1060         X509 *cert;
1061         const char *askpw_friendly_name, *askpw_icon_name;
1062         AskPasswordFlags askpw_flags;
1063         bool headless;
1064 };
1065
1066 static void pkcs11_acquire_certificate_callback_data_release(struct pkcs11_acquire_certificate_callback_data *data) {
1067         erase_and_free(data->pin_used);
1068         X509_free(data->cert);
1069 }
1070
1071 static int pkcs11_acquire_certificate_callback(
1072                 CK_FUNCTION_LIST *m,
1073                 CK_SESSION_HANDLE session,
1074                 CK_SLOT_ID slot_id,
1075                 const CK_SLOT_INFO *slot_info,
1076                 const CK_TOKEN_INFO *token_info,
1077                 P11KitUri *uri,
1078                 void *userdata) {
1079
1080         _cleanup_(erase_and_freep) char *pin_used = NULL;
1081         struct pkcs11_acquire_certificate_callback_data *data = ASSERT_PTR(userdata);
1082         CK_OBJECT_HANDLE object;
1083         int r;
1084
1085         assert(m);
1086         assert(slot_info);
1087         assert(token_info);
1088         assert(uri);
1089
1090         /* Called for every token matching our URI */
1091
1092         r = pkcs11_token_login(
1093                         m,
1094                         session,
1095                         slot_id,
1096                         token_info,
1097                         data->askpw_friendly_name,
1098                         data->askpw_icon_name,
1099                         "pkcs11-pin",
1100                         "pkcs11-pin",
1101                         UINT64_MAX,
1102                         data->askpw_flags,
1103                         data->headless,
1104                         &pin_used);
1105         if (r < 0)
1106                 return r;
1107
1108         r = pkcs11_token_find_x509_certificate(m, session, uri, &object);
1109         if (r < 0)
1110                 return r;
1111
1112         r = pkcs11_token_read_x509_certificate(m, session, object, &data->cert);
1113         if (r < 0)
1114                 return r;
1115
1116         /* Let's read some random data off the token and write it to the kernel pool before we generate our
1117          * random key from it. This way we can claim the quality of the RNG is at least as good as the
1118          * kernel's and the token's pool */
1119         (void) pkcs11_token_acquire_rng(m, session);
1120
1121         data->pin_used = TAKE_PTR(pin_used);
1122         return 1;
1123 }
1124
1125 int pkcs11_acquire_certificate(
1126                 const char *uri,
1127                 const char *askpw_friendly_name,
1128                 const char *askpw_icon_name,
1129                 X509 **ret_cert,
1130                 char **ret_pin_used) {
1131
1132         _cleanup_(pkcs11_acquire_certificate_callback_data_release) struct pkcs11_acquire_certificate_callback_data data = {
1133                 .askpw_friendly_name = askpw_friendly_name,
1134                 .askpw_icon_name = askpw_icon_name,
1135         };
1136         int r;
1137
1138         assert(uri);
1139         assert(ret_cert);
1140
1141         r = pkcs11_find_token(uri, pkcs11_acquire_certificate_callback, &data);
1142         if (r == -EAGAIN) /* pkcs11_find_token() doesn't log about this error, but all others */
1143                 return log_error_errno(SYNTHETIC_ERRNO(ENXIO),
1144                                        "Specified PKCS#11 token with URI '%s' not found.",
1145                                        uri);
1146         if (r < 0)
1147                 return r;
1148
1149         *ret_cert = TAKE_PTR(data.cert);
1150
1151         if (ret_pin_used)
1152                 *ret_pin_used = TAKE_PTR(data.pin_used);
1153
1154         return 0;
1155 }
1156 #endif
1157
1158 static int list_callback(
1159                 CK_FUNCTION_LIST *m,
1160                 CK_SESSION_HANDLE session,
1161                 CK_SLOT_ID slot_id,
1162                 const CK_SLOT_INFO *slot_info,
1163                 const CK_TOKEN_INFO *token_info,
1164                 P11KitUri *uri,
1165                 void *userdata) {
1166
1167         _cleanup_free_ char *token_uri_string = NULL, *token_label = NULL, *token_manufacturer_id = NULL, *token_model = NULL;
1168         _cleanup_(sym_p11_kit_uri_freep) P11KitUri *token_uri = NULL;
1169         Table *t = userdata;
1170         int uri_result, r;
1171
1172         assert(slot_info);
1173         assert(token_info);
1174
1175         r = dlopen_p11kit();
1176         if (r < 0)
1177                 return r;
1178
1179         /* We only care about hardware devices here with a token inserted. Let's filter everything else
1180          * out. (Note that the user can explicitly specify non-hardware tokens if they like, but during
1181          * enumeration we'll filter those, since software tokens are typically the system certificate store
1182          * and such, and it's typically not what people want to bind their home directories to.) */
1183         if (!FLAGS_SET(slot_info->flags, CKF_HW_SLOT|CKF_TOKEN_PRESENT))
1184                 return -EAGAIN;
1185
1186         token_label = pkcs11_token_label(token_info);
1187         if (!token_label)
1188                 return log_oom();
1189
1190         token_manufacturer_id = pkcs11_token_manufacturer_id(token_info);
1191         if (!token_manufacturer_id)
1192                 return log_oom();
1193
1194         token_model = pkcs11_token_model(token_info);
1195         if (!token_model)
1196                 return log_oom();
1197
1198         token_uri = uri_from_token_info(token_info);
1199         if (!token_uri)
1200                 return log_oom();
1201
1202         uri_result = sym_p11_kit_uri_format(token_uri, P11_KIT_URI_FOR_ANY, &token_uri_string);
1203         if (uri_result != P11_KIT_URI_OK)
1204                 return log_warning_errno(SYNTHETIC_ERRNO(EAGAIN), "Failed to format slot URI: %s", sym_p11_kit_uri_message(uri_result));
1205
1206         r = table_add_many(
1207                         t,
1208                         TABLE_STRING, token_uri_string,
1209                         TABLE_STRING, token_label,
1210                         TABLE_STRING, token_manufacturer_id,
1211                         TABLE_STRING, token_model);
1212         if (r < 0)
1213                 return table_log_add_error(r);
1214
1215         return -EAGAIN; /* keep scanning */
1216 }
1217 #endif
1218
1219 int pkcs11_list_tokens(void) {
1220 #if HAVE_P11KIT
1221         _cleanup_(table_unrefp) Table *t = NULL;
1222         int r;
1223
1224         t = table_new("uri", "label", "manufacturer", "model");
1225         if (!t)
1226                 return log_oom();
1227
1228         r = pkcs11_find_token(NULL, list_callback, t);
1229         if (r < 0 && r != -EAGAIN)
1230                 return r;
1231
1232         if (table_get_rows(t) <= 1) {
1233                 log_info("No suitable PKCS#11 tokens found.");
1234                 return 0;
1235         }
1236
1237         r = table_print(t, stdout);
1238         if (r < 0)
1239                 return log_error_errno(r, "Failed to show device table: %m");
1240
1241         return 0;
1242 #else
1243         return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
1244                                "PKCS#11 tokens not supported on this build.");
1245 #endif
1246 }
1247
1248 #if HAVE_P11KIT
1249 static int auto_callback(
1250                 CK_FUNCTION_LIST *m,
1251                 CK_SESSION_HANDLE session,
1252                 CK_SLOT_ID slot_id,
1253                 const CK_SLOT_INFO *slot_info,
1254                 const CK_TOKEN_INFO *token_info,
1255                 P11KitUri *uri,
1256                 void *userdata) {
1257
1258         _cleanup_(sym_p11_kit_uri_freep) P11KitUri *token_uri = NULL;
1259         char **t = userdata;
1260         int uri_result, r;
1261
1262         assert(slot_info);
1263         assert(token_info);
1264
1265         r = dlopen_p11kit();
1266         if (r < 0)
1267                 return r;
1268
1269         if (!FLAGS_SET(token_info->flags, CKF_HW_SLOT|CKF_TOKEN_PRESENT))
1270                 return -EAGAIN;
1271
1272         if (*t)
1273                 return log_error_errno(SYNTHETIC_ERRNO(ENOTUNIQ),
1274                                        "More than one suitable PKCS#11 token found.");
1275
1276         token_uri = uri_from_token_info(token_info);
1277         if (!token_uri)
1278                 return log_oom();
1279
1280         uri_result = sym_p11_kit_uri_format(token_uri, P11_KIT_URI_FOR_ANY, t);
1281         if (uri_result != P11_KIT_URI_OK)
1282                 return log_warning_errno(SYNTHETIC_ERRNO(EAGAIN), "Failed to format slot URI: %s", sym_p11_kit_uri_message(uri_result));
1283
1284         return 0;
1285 }
1286 #endif
1287
1288 int pkcs11_find_token_auto(char **ret) {
1289 #if HAVE_P11KIT
1290         int r;
1291
1292         r = pkcs11_find_token(NULL, auto_callback, ret);
1293         if (r == -EAGAIN)
1294                 return log_error_errno(SYNTHETIC_ERRNO(ENODEV), "No suitable PKCS#11 tokens found.");
1295         if (r < 0)
1296                 return r;
1297
1298         return 0;
1299 #else
1300         return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
1301                                "PKCS#11 tokens not supported on this build.");
1302 #endif
1303 }
1304
1305 #if HAVE_P11KIT
1306 void pkcs11_crypt_device_callback_data_release(pkcs11_crypt_device_callback_data *data) {
1307         erase_and_free(data->decrypted_key);
1308
1309         if (data->free_encrypted_key)
1310                 free(data->encrypted_key);
1311 }
1312
1313 int pkcs11_crypt_device_callback(
1314                 CK_FUNCTION_LIST *m,
1315                 CK_SESSION_HANDLE session,
1316                 CK_SLOT_ID slot_id,
1317                 const CK_SLOT_INFO *slot_info,
1318                 const CK_TOKEN_INFO *token_info,
1319                 P11KitUri *uri,
1320                 void *userdata) {
1321
1322         pkcs11_crypt_device_callback_data *data = ASSERT_PTR(userdata);
1323         CK_OBJECT_HANDLE object;
1324         int r;
1325
1326         assert(m);
1327         assert(slot_info);
1328         assert(token_info);
1329         assert(uri);
1330
1331         /* Called for every token matching our URI */
1332
1333         r = pkcs11_token_login(
1334                         m,
1335                         session,
1336                         slot_id,
1337                         token_info,
1338                         data->friendly_name,
1339                         "drive-harddisk",
1340                         "pkcs11-pin",
1341                         "cryptsetup.pkcs11-pin",
1342                         data->until,
1343                         data->askpw_flags,
1344                         data->headless,
1345                         NULL);
1346         if (r < 0)
1347                 return r;
1348
1349         /* We are likely called during early boot, where entropy is scarce. Mix some data from the PKCS#11
1350          * token, if it supports that. It should be cheap, given that we already are talking to it anyway and
1351          * shouldn't hurt. */
1352         (void) pkcs11_token_acquire_rng(m, session);
1353
1354         r = pkcs11_token_find_private_key(m, session, uri, &object);
1355         if (r < 0)
1356                 return r;
1357
1358         r = pkcs11_token_decrypt_data(
1359                         m,
1360                         session,
1361                         object,
1362                         data->encrypted_key,
1363                         data->encrypted_key_size,
1364                         &data->decrypted_key,
1365                         &data->decrypted_key_size);
1366         if (r < 0)
1367                 return r;
1368
1369         return 0;
1370 }
1371 #endif