1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
5 # include <openssl/x509.h>
10 # include <p11-kit/p11-kit.h>
11 # include <p11-kit/uri.h>
14 #include "ask-password-api.h"
16 #include "time-util.h"
18 bool pkcs11_uri_valid(const char *uri
);
22 extern char *(*sym_p11_kit_module_get_name
)(CK_FUNCTION_LIST
*module
);
23 extern void (*sym_p11_kit_modules_finalize_and_release
)(CK_FUNCTION_LIST
**modules
);
24 extern CK_FUNCTION_LIST
**(*sym_p11_kit_modules_load_and_initialize
)(int flags
);
25 extern const char *(*sym_p11_kit_strerror
)(CK_RV rv
);
26 extern int (*sym_p11_kit_uri_format
)(P11KitUri
*uri
, P11KitUriType uri_type
, char **string
);
27 extern void (*sym_p11_kit_uri_free
)(P11KitUri
*uri
);
28 extern CK_ATTRIBUTE_PTR (*sym_p11_kit_uri_get_attributes
)(P11KitUri
*uri
, CK_ULONG
*n_attrs
);
29 extern CK_ATTRIBUTE_PTR (*sym_p11_kit_uri_get_attribute
)(P11KitUri
*uri
, CK_ATTRIBUTE_TYPE attr_type
);
30 extern int (*sym_p11_kit_uri_set_attribute
)(P11KitUri
*uri
, CK_ATTRIBUTE_PTR attr
);
31 extern CK_INFO_PTR (*sym_p11_kit_uri_get_module_info
)(P11KitUri
*uri
);
32 extern CK_SLOT_INFO_PTR (*sym_p11_kit_uri_get_slot_info
)(P11KitUri
*uri
);
33 extern CK_TOKEN_INFO_PTR (*sym_p11_kit_uri_get_token_info
)(P11KitUri
*uri
);
34 extern int (*sym_p11_kit_uri_match_token_info
)(const P11KitUri
*uri
, const CK_TOKEN_INFO
*token_info
);
35 extern const char *(*sym_p11_kit_uri_message
)(int code
);
36 extern P11KitUri
*(*sym_p11_kit_uri_new
)(void);
37 extern int (*sym_p11_kit_uri_parse
)(const char *string
, P11KitUriType uri_type
, P11KitUri
*uri
);
39 int uri_from_string(const char *p
, P11KitUri
**ret
);
41 P11KitUri
*uri_from_module_info(const CK_INFO
*info
);
42 P11KitUri
*uri_from_slot_info(const CK_SLOT_INFO
*slot_info
);
43 P11KitUri
*uri_from_token_info(const CK_TOKEN_INFO
*token_info
);
45 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(P11KitUri
*, sym_p11_kit_uri_free
, NULL
);
46 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(CK_FUNCTION_LIST
**, sym_p11_kit_modules_finalize_and_release
, NULL
);
48 CK_RV
pkcs11_get_slot_list_malloc(CK_FUNCTION_LIST
*m
, CK_SLOT_ID
**ret_slotids
, CK_ULONG
*ret_n_slotids
);
50 char *pkcs11_token_label(const CK_TOKEN_INFO
*token_info
);
51 char *pkcs11_token_manufacturer_id(const CK_TOKEN_INFO
*token_info
);
52 char *pkcs11_token_model(const CK_TOKEN_INFO
*token_info
);
54 int pkcs11_token_login_by_pin(CK_FUNCTION_LIST
*m
, CK_SESSION_HANDLE session
, const CK_TOKEN_INFO
*token_info
, const char *token_label
, const void *pin
, size_t pin_size
);
55 int pkcs11_token_login(CK_FUNCTION_LIST
*m
, CK_SESSION_HANDLE session
, CK_SLOT_ID slotid
, const CK_TOKEN_INFO
*token_info
, const char *friendly_name
, const char *icon_name
, const char *key_name
, const char *credential_name
, usec_t until
, AskPasswordFlags ask_password_flags
, bool headless
, char **ret_used_pin
);
57 int pkcs11_token_find_related_object(CK_FUNCTION_LIST
*m
, CK_SESSION_HANDLE session
, CK_OBJECT_HANDLE prototype
, CK_OBJECT_CLASS
class, CK_OBJECT_HANDLE
*ret_object
);
58 int pkcs11_token_find_x509_certificate(CK_FUNCTION_LIST
*m
, CK_SESSION_HANDLE session
, P11KitUri
*search_uri
, CK_OBJECT_HANDLE
*ret_object
);
60 int pkcs11_token_read_x509_certificate(CK_FUNCTION_LIST
*m
, CK_SESSION_HANDLE session
, CK_OBJECT_HANDLE object
, X509
**ret_cert
);
63 int pkcs11_token_find_private_key(CK_FUNCTION_LIST
*m
, CK_SESSION_HANDLE session
, P11KitUri
*search_uri
, CK_OBJECT_HANDLE
*ret_object
);
64 int pkcs11_token_decrypt_data(CK_FUNCTION_LIST
*m
, CK_SESSION_HANDLE session
, CK_OBJECT_HANDLE object
, const void *encrypted_data
, size_t encrypted_data_size
, void **ret_decrypted_data
, size_t *ret_decrypted_data_size
);
66 int pkcs11_token_acquire_rng(CK_FUNCTION_LIST
*m
, CK_SESSION_HANDLE session
);
68 typedef int (*pkcs11_find_token_callback_t
)(CK_FUNCTION_LIST
*m
, CK_SESSION_HANDLE session
, CK_SLOT_ID slotid
, const CK_SLOT_INFO
*slot_info
, const CK_TOKEN_INFO
*token_info
, P11KitUri
*uri
, void *userdata
);
69 int pkcs11_find_token(const char *pkcs11_uri
, pkcs11_find_token_callback_t callback
, void *userdata
);
72 int pkcs11_acquire_certificate(const char *uri
, const char *askpw_friendly_name
, const char *askpw_icon_name
, X509
**ret_cert
, char **ret_pin_used
);
76 const char *friendly_name
;
79 size_t encrypted_key_size
;
81 size_t decrypted_key_size
;
82 bool free_encrypted_key
;
84 AskPasswordFlags askpw_flags
;
85 } pkcs11_crypt_device_callback_data
;
87 void pkcs11_crypt_device_callback_data_release(pkcs11_crypt_device_callback_data
*data
);
89 int pkcs11_crypt_device_callback(
91 CK_SESSION_HANDLE session
,
93 const CK_SLOT_INFO
*slot_info
,
94 const CK_TOKEN_INFO
*token_info
,
98 int dlopen_p11kit(void);
102 static inline int dlopen_p11kit(void) {
103 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP
), "p11kit support is not compiled in.");
109 const char *friendly_name
;
112 AskPasswordFlags askpw_flags
;
113 } systemd_pkcs11_plugin_params
;
115 int pkcs11_list_tokens(void);
116 int pkcs11_find_token_auto(char **ret
);