Added more gnutls errors to map closer to PKCS11 actual errors.

diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c
index 3a27da8b955ae2d7e2eeb6d6fc44f223e8cc58bd..97d5386c22bf3b3ffc55af79ea26fe6f119c0fdd 100644 (file)
--- a/lib/gnutls_errors.c
+++ b/lib/gnutls_errors.c
@@ -286,7 +286,32 @@ static const gnutls_error_entry error_algorithms[] = {
               GNUTLS_E_PKCS11_PIN_SAVE, 1),
   ERROR_ENTRY (N_("PKCS #11 error"),
               GNUTLS_E_PKCS11_ERROR, 1),
-
+  ERROR_ENTRY (N_("PKCS #11 error in slot"),
+       GNUTLS_E_PKCS11_SLOT_ERROR, 1),
+  ERROR_ENTRY (N_("PKCS #11 locking error"),
+       GNUTLS_E_PKCS11_LOCKING_ERROR, 1),
+  ERROR_ENTRY (N_("PKCS #11 error in attribute"),
+    GNUTLS_E_PKCS11_ATTRIBUTE_ERROR, 1),
+  ERROR_ENTRY (N_("PKCS #11 error in device"),
+       GNUTLS_E_PKCS11_DEVICE_ERROR, 1),
+  ERROR_ENTRY (N_("PKCS #11 error in data"),
+       GNUTLS_E_PKCS11_DATA_ERROR, 1),
+  ERROR_ENTRY (N_("PKCS #11 unsupported feature"),
+       GNUTLS_E_PKCS11_UNSUPPORTED_FEATURE_ERROR, 1),
+  ERROR_ENTRY (N_("PKCS #11 error in key"),
+       GNUTLS_E_PKCS11_KEY_ERROR, 1),
+  ERROR_ENTRY (N_("PKCS #11 PIN expired"),
+       GNUTLS_E_PKCS11_PIN_EXPIRED, 1),
+  ERROR_ENTRY (N_("PKCS #11 PIN locked"),
+       GNUTLS_E_PKCS11_PIN_LOCKED, 1),
+  ERROR_ENTRY (N_("PKCS #11 error in session"),
+       GNUTLS_E_PKCS11_SESSION_ERROR, 1),
+  ERROR_ENTRY (N_("PKCS #11 error in signature"),
+       GNUTLS_E_PKCS11_SIGNATURE_ERROR, 1),
+  ERROR_ENTRY (N_("PKCS #11 error in token"),
+       GNUTLS_E_PKCS11_TOKEN_ERROR, 1),
+  ERROR_ENTRY (N_("PKCS #11 user error"),
+       GNUTLS_E_PKCS11_USER_ERROR, 1),
   {NULL, NULL, 0, 0}
 };
 

diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
index e03e7b308e318832ed4d6751905da301e8625a79..37b91e9d0816ea9b268de35305db08e399ef9e4c 100644 (file)
--- a/lib/includes/gnutls/gnutls.h.in
+++ b/lib/includes/gnutls/gnutls.h.in
@@ -1757,6 +1757,20 @@ extern "C"
 #define GNUTLS_E_PKCS11_PIN_ERROR -303
 #define GNUTLS_E_PKCS11_PIN_SAVE -304
 
+#define GNUTLS_E_PKCS11_SLOT_ERROR -305
+#define GNUTLS_E_PKCS11_LOCKING_ERROR -306
+#define GNUTLS_E_PKCS11_ATTRIBUTE_ERROR -307
+#define GNUTLS_E_PKCS11_DEVICE_ERROR -308
+#define GNUTLS_E_PKCS11_DATA_ERROR -309
+#define GNUTLS_E_PKCS11_UNSUPPORTED_FEATURE_ERROR -310
+#define GNUTLS_E_PKCS11_KEY_ERROR -311
+#define GNUTLS_E_PKCS11_PIN_EXPIRED -312
+#define GNUTLS_E_PKCS11_PIN_LOCKED -313
+#define GNUTLS_E_PKCS11_SESSION_ERROR -314
+#define GNUTLS_E_PKCS11_SIGNATURE_ERROR -315
+#define GNUTLS_E_PKCS11_TOKEN_ERROR -316
+#define GNUTLS_E_PKCS11_USER_ERROR -317
+
 #define GNUTLS_E_UNIMPLEMENTED_FEATURE -1250
 
 

diff --git a/lib/pkcs11.c b/lib/pkcs11.c
index 590db80f79e0f0ff6493836aff3c2877b6799579..0941c395ad096313cf18eb5e696d152feeff3626 100644 (file)
--- a/lib/pkcs11.c
+++ b/lib/pkcs11.c
@@ -5,7 +5,7 @@
  * Author: Nikos Mavrogiannopoulos
  *
  * Inspired and some parts based on neon PKCS #11 support by Joe Orton.
- * More ideas came from the pkcs11-helper library.
+ * More ideas came from the pkcs11-helper library by Alon Bar-Lev.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -69,6 +69,91 @@ static void* pin_data;
 gnutls_pkcs11_token_callback_t token_func;
 void* token_data;
 
+int pkcs11_rv_to_err(ck_rv_t rv)
+{
+    switch(rv) {
+        case CKR_OK:
+            return 0;
+        case CKR_HOST_MEMORY:
+            return GNUTLS_E_MEMORY_ERROR;
+        case CKR_SLOT_ID_INVALID:
+            return GNUTLS_E_PKCS11_SLOT_ERROR;
+        case CKR_ARGUMENTS_BAD:
+        case CKR_MECHANISM_PARAM_INVALID:
+            return GNUTLS_E_INVALID_REQUEST;
+        case CKR_NEED_TO_CREATE_THREADS:
+        case CKR_CANT_LOCK:
+        case CKR_FUNCTION_NOT_PARALLEL:
+        case CKR_MUTEX_BAD:
+        case CKR_MUTEX_NOT_LOCKED:
+            return GNUTLS_E_PKCS11_LOCKING_ERROR;
+        case CKR_ATTRIBUTE_READ_ONLY:
+        case CKR_ATTRIBUTE_SENSITIVE:
+        case CKR_ATTRIBUTE_TYPE_INVALID:
+        case CKR_ATTRIBUTE_VALUE_INVALID:
+            return GNUTLS_E_PKCS11_ATTRIBUTE_ERROR;
+        case CKR_DEVICE_ERROR:
+        case CKR_DEVICE_MEMORY:
+        case CKR_DEVICE_REMOVED:
+            return GNUTLS_E_PKCS11_DEVICE_ERROR;
+        case CKR_DATA_INVALID:
+        case CKR_DATA_LEN_RANGE:
+        case CKR_ENCRYPTED_DATA_INVALID:
+        case CKR_ENCRYPTED_DATA_LEN_RANGE:
+        case CKR_OBJECT_HANDLE_INVALID:
+            return GNUTLS_E_PKCS11_DATA_ERROR;
+        case CKR_FUNCTION_NOT_SUPPORTED:
+        case CKR_MECHANISM_INVALID:
+            return GNUTLS_E_PKCS11_UNSUPPORTED_FEATURE_ERROR;
+        case CKR_KEY_HANDLE_INVALID:
+        case CKR_KEY_SIZE_RANGE:
+        case CKR_KEY_TYPE_INCONSISTENT:
+        case CKR_KEY_NOT_NEEDED:
+        case CKR_KEY_CHANGED:
+        case CKR_KEY_NEEDED:
+        case CKR_KEY_INDIGESTIBLE:
+        case CKR_KEY_FUNCTION_NOT_PERMITTED:
+        case CKR_KEY_NOT_WRAPPABLE:
+        case CKR_KEY_UNEXTRACTABLE:
+            return GNUTLS_E_PKCS11_KEY_ERROR;
+        case CKR_PIN_INCORRECT:
+        case CKR_PIN_INVALID:
+        case CKR_PIN_LEN_RANGE:
+            return GNUTLS_E_PKCS11_PIN_ERROR;
+        case CKR_PIN_EXPIRED:
+            return GNUTLS_E_PKCS11_PIN_EXPIRED;
+        case CKR_PIN_LOCKED:
+            return GNUTLS_E_PKCS11_PIN_LOCKED;
+        case CKR_SESSION_CLOSED:
+        case CKR_SESSION_COUNT:
+        case CKR_SESSION_HANDLE_INVALID:
+        case CKR_SESSION_PARALLEL_NOT_SUPPORTED:
+        case CKR_SESSION_READ_ONLY:
+        case CKR_SESSION_EXISTS:
+        case CKR_SESSION_READ_ONLY_EXISTS:
+        case CKR_SESSION_READ_WRITE_SO_EXISTS:
+            return GNUTLS_E_PKCS11_SESSION_ERROR;
+        case CKR_SIGNATURE_INVALID:
+        case CKR_SIGNATURE_LEN_RANGE:
+            return GNUTLS_E_PKCS11_SIGNATURE_ERROR;
+        case CKR_TOKEN_NOT_PRESENT:
+        case CKR_TOKEN_NOT_RECOGNIZED:
+        case CKR_TOKEN_WRITE_PROTECTED:
+            return GNUTLS_E_PKCS11_TOKEN_ERROR;
+        case CKR_USER_ALREADY_LOGGED_IN:
+        case CKR_USER_NOT_LOGGED_IN:
+        case CKR_USER_PIN_NOT_INITIALIZED:
+        case CKR_USER_TYPE_INVALID:
+        case CKR_USER_ANOTHER_ALREADY_LOGGED_IN:
+        case CKR_USER_TOO_MANY_TYPES:
+            return GNUTLS_E_PKCS11_USER_ERROR;
+        case CKR_BUFFER_TOO_SMALL:
+            return GNUTLS_E_SHORT_MEMORY_BUFFER;
+        default:
+            return GNUTLS_E_PKCS11_ERROR;
+    }
+}
+
 /* Fake scan */
 void pkcs11_rescan_slots(void)
 {
@@ -765,7 +850,7 @@ ck_rv_t rv;
        if (rv != CKR_OK) {
                gnutls_assert();
                _gnutls_debug_log("pk11: FindObjectsInit failed.\n");
-               ret = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+               ret = pkcs11_rv_to_err(rv);
                goto fail;
        }
 
@@ -1248,7 +1333,7 @@ static int find_obj_url(pakchois_session_t *pks, struct token_info *info, void*
     if (rv != CKR_OK) {
         gnutls_assert();
         _gnutls_debug_log("pk11: FindObjectsInit failed.\n");
-        ret = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+        ret = pkcs11_rv_to_err(rv);
         goto cleanup;
     }
 
@@ -1594,7 +1679,7 @@ int pkcs11_login(pakchois_session_t *pks, struct token_info *info, token_creds_s
 
     _gnutls_debug_log("pk11: Login result = %lu\n", rv);
 
-    return (rv == CKR_OK || rv == CKR_USER_ALREADY_LOGGED_IN) ? 0 : GNUTLS_E_PKCS11_ERROR;
+    return (rv == CKR_OK || rv == CKR_USER_ALREADY_LOGGED_IN) ? 0 : pkcs11_rv_to_err(rv);
 }
 
 static int find_privkeys(pakchois_session_t *pks, struct token_info* info, struct pkey_list *list)
@@ -1618,7 +1703,7 @@ static int find_privkeys(pakchois_session_t *pks, struct token_info* info, struc
     rv = pakchois_find_objects_init(pks, a, 1);
     if (rv != CKR_OK) {
         gnutls_assert();
-        return GNUTLS_E_PKCS11_ERROR;
+        return pkcs11_rv_to_err(rv);
     }
 
     list->key_ids_size = 0;
@@ -1648,7 +1733,7 @@ static int find_privkeys(pakchois_session_t *pks, struct token_info* info, struc
     rv = pakchois_find_objects_init(pks, a, 1);
     if (rv != CKR_OK) {
         gnutls_assert();
-        return GNUTLS_E_PKCS11_ERROR;
+        return pkcs11_rv_to_err(rv);
     }
 
     current = 0;
@@ -1833,7 +1918,7 @@ static int find_objs(pakchois_session_t *pks, struct token_info *info, void* inp
     if (rv != CKR_OK) {
         gnutls_assert();
         _gnutls_debug_log("pk11: FindObjectsInit failed.\n");
-        return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+        return pkcs11_rv_to_err(rv);
     }
 
     while (pakchois_find_objects(pks, &obj, 1, &count) == CKR_OK

diff --git a/lib/pkcs11_int.h b/lib/pkcs11_int.h
index 04da57a407e33e7f2411d53a1dd8020f5f79241a..324da3441fcc3027ed2be33ad10fd8571df274c0 100644 (file)
--- a/lib/pkcs11_int.h
+++ b/lib/pkcs11_int.h
@@ -51,7 +51,7 @@ struct gnutls_pkcs11_obj_st {
  */
 typedef int (*find_func_t)(pakchois_session_t *pks, struct token_info* tinfo, void* input);
 
-
+int pkcs11_rv_to_err(ck_rv_t rv);
 int pkcs11_url_to_info(const char* url, struct pkcs11_url_info* info);
 
 int pkcs11_get_info(struct pkcs11_url_info *info, gnutls_pkcs11_obj_info_t itype, 

diff --git a/lib/pkcs11_privkey.c b/lib/pkcs11_privkey.c
index 67eddd90fb5083c57ee3c18fbc1bfb938ded87c3..8c8fdcdb2d971058d0c1351b6f12370d2b68ab82 100644 (file)
--- a/lib/pkcs11_privkey.c
+++ b/lib/pkcs11_privkey.c
@@ -170,11 +170,12 @@ gnutls_pkcs11_privkey_sign_data(gnutls_pkcs11_privkey_t signer,
 #define FIND_OBJECT(pks, obj, key) \
        do { \
                int retries = 0; \
+               int rret; \
                ret = pkcs11_find_object (&pks, &obj, &key->info, &key->creds, \
                        SESSION_LOGIN); \
                if (ret < 0) { \
-                       rv = token_func(token_data, key->info.label, retries++); \
-                       if (rv == 0) continue; \
+                       rret = token_func(token_data, key->info.label, retries++); \
+                       if (rret == 0) continue; \
                        gnutls_assert(); \
                        return ret; \
                } \
@@ -216,7 +217,7 @@ int gnutls_pkcs11_privkey_sign_hash(gnutls_pkcs11_privkey_t key,
        rv = pakchois_sign_init(pks, &mech, obj);
        if (rv != CKR_OK) {
                gnutls_assert();
-               ret = GNUTLS_E_PK_SIGN_FAILED;
+               ret = pkcs11_rv_to_err(rv);
                goto cleanup;
        }
 
@@ -225,7 +226,7 @@ int gnutls_pkcs11_privkey_sign_hash(gnutls_pkcs11_privkey_t key,
                           &siglen);
        if (rv != CKR_OK) {
                gnutls_assert();
-               ret = GNUTLS_E_PK_SIGN_FAILED;
+               ret = pkcs11_rv_to_err(rv);
                goto cleanup;
        }
 
@@ -237,7 +238,7 @@ int gnutls_pkcs11_privkey_sign_hash(gnutls_pkcs11_privkey_t key,
        if (rv != CKR_OK) {
                gnutls_free(signature->data);
                gnutls_assert();
-               ret = GNUTLS_E_PK_SIGN_FAILED;
+               ret = pkcs11_rv_to_err(rv);
                goto cleanup;
        }
 
@@ -329,7 +330,7 @@ gnutls_pkcs11_privkey_decrypt_data(gnutls_pkcs11_privkey_t key,
        rv = pakchois_decrypt_init(pks, &mech, obj);
        if (rv != CKR_OK) {
                gnutls_assert();
-               ret = GNUTLS_E_PK_DECRYPTION_FAILED;
+               ret = pkcs11_rv_to_err(rv);
                goto cleanup;
        }
 
@@ -338,7 +339,7 @@ gnutls_pkcs11_privkey_decrypt_data(gnutls_pkcs11_privkey_t key,
                           &siglen);
        if (rv != CKR_OK) {
                gnutls_assert();
-               ret = GNUTLS_E_PK_DECRYPTION_FAILED;
+               ret = pkcs11_rv_to_err(rv);
                goto cleanup;
        }
 
@@ -350,7 +351,7 @@ gnutls_pkcs11_privkey_decrypt_data(gnutls_pkcs11_privkey_t key,
        if (rv != CKR_OK) {
                gnutls_free(plaintext->data);
                gnutls_assert();
-               ret = GNUTLS_E_PK_DECRYPTION_FAILED;
+               ret = pkcs11_rv_to_err(rv);
                goto cleanup;
        }
 

diff --git a/lib/pkcs11_write.c b/lib/pkcs11_write.c
index 3ab1b3a90d18958988a55b591eeb870d949f8344..b93623ab1cb434211d7396e1441f66105873b815 100644 (file)
--- a/lib/pkcs11_write.c
+++ b/lib/pkcs11_write.c
@@ -138,7 +138,7 @@ int gnutls_pkcs11_copy_x509_crt(const char* token_url, gnutls_x509_crt_t crt,
        if (rv != CKR_OK) {
                gnutls_assert();
                _gnutls_debug_log("pkcs11: %s\n", pakchois_error(rv));
-               ret = GNUTLS_E_PKCS11_ERROR;
+               ret = pkcs11_rv_to_err(rv);
                goto  cleanup;
        }
        
@@ -321,7 +321,7 @@ int gnutls_pkcs11_copy_x509_privkey(const char* token_url,
        if (rv != CKR_OK) {
                gnutls_assert();
                _gnutls_debug_log("pkcs11: %s\n", pakchois_error(rv));
-               ret = GNUTLS_E_PKCS11_ERROR;
+               ret = pkcs11_rv_to_err(rv);
                goto  cleanup;
        }
 
@@ -446,19 +446,18 @@ static int delete_obj_url(pakchois_session_t *pks, struct token_info *info, void
     if (rv != CKR_OK) {
         gnutls_assert();
         _gnutls_debug_log("pk11: FindObjectsInit failed.\n");
-        ret = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+        ret = pkcs11_rv_to_err(rv);
         goto cleanup;
     }
 
     while (pakchois_find_objects(pks, &obj, 1, &count) == CKR_OK
            && count == 1) {
-               
-               rv = pakchois_destroy_object(pks, obj);
-               if (rv != CKR_OK) {
-            _gnutls_debug_log("pkcs11: Cannot destroy object: %s\n", pakchois_error(rv));
-        } else {
-                       find_data->deleted++;
-               }
+       rv = pakchois_destroy_object(pks, obj);
+       if (rv != CKR_OK) {
+           _gnutls_debug_log("pkcs11: Cannot destroy object: %s\n", pakchois_error(rv));
+       } else {
+           find_data->deleted++;
+       }
         
         found = 1;
     }