From: Nikos Mavrogiannopoulos Date: Thu, 17 Jun 2010 23:04:16 +0000 (+0200) Subject: Added more gnutls errors to map closer to PKCS11 actual errors. X-Git-Tag: gnutls_2_11_3~175 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6d112bcd452001274e2df7662d1c7aa30ee60d9e;p=thirdparty%2Fgnutls.git Added more gnutls errors to map closer to PKCS11 actual errors. --- diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c index 3a27da8b95..97d5386c22 100644 --- a/lib/gnutls_errors.c +++ b/lib/gnutls_errors.c @@ -286,7 +286,32 @@ static const gnutls_error_entry error_algorithms[] = { GNUTLS_E_PKCS11_PIN_SAVE, 1), ERROR_ENTRY (N_("PKCS #11 error"), GNUTLS_E_PKCS11_ERROR, 1), - + ERROR_ENTRY (N_("PKCS #11 error in slot"), + GNUTLS_E_PKCS11_SLOT_ERROR, 1), + ERROR_ENTRY (N_("PKCS #11 locking error"), + GNUTLS_E_PKCS11_LOCKING_ERROR, 1), + ERROR_ENTRY (N_("PKCS #11 error in attribute"), + GNUTLS_E_PKCS11_ATTRIBUTE_ERROR, 1), + ERROR_ENTRY (N_("PKCS #11 error in device"), + GNUTLS_E_PKCS11_DEVICE_ERROR, 1), + ERROR_ENTRY (N_("PKCS #11 error in data"), + GNUTLS_E_PKCS11_DATA_ERROR, 1), + ERROR_ENTRY (N_("PKCS #11 unsupported feature"), + GNUTLS_E_PKCS11_UNSUPPORTED_FEATURE_ERROR, 1), + ERROR_ENTRY (N_("PKCS #11 error in key"), + GNUTLS_E_PKCS11_KEY_ERROR, 1), + ERROR_ENTRY (N_("PKCS #11 PIN expired"), + GNUTLS_E_PKCS11_PIN_EXPIRED, 1), + ERROR_ENTRY (N_("PKCS #11 PIN locked"), + GNUTLS_E_PKCS11_PIN_LOCKED, 1), + ERROR_ENTRY (N_("PKCS #11 error in session"), + GNUTLS_E_PKCS11_SESSION_ERROR, 1), + ERROR_ENTRY (N_("PKCS #11 error in signature"), + GNUTLS_E_PKCS11_SIGNATURE_ERROR, 1), + ERROR_ENTRY (N_("PKCS #11 error in token"), + GNUTLS_E_PKCS11_TOKEN_ERROR, 1), + ERROR_ENTRY (N_("PKCS #11 user error"), + GNUTLS_E_PKCS11_USER_ERROR, 1), {NULL, NULL, 0, 0} }; diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in index e03e7b308e..37b91e9d08 100644 --- a/lib/includes/gnutls/gnutls.h.in +++ b/lib/includes/gnutls/gnutls.h.in @@ -1757,6 +1757,20 @@ extern "C" #define GNUTLS_E_PKCS11_PIN_ERROR -303 #define GNUTLS_E_PKCS11_PIN_SAVE -304 +#define GNUTLS_E_PKCS11_SLOT_ERROR -305 +#define GNUTLS_E_PKCS11_LOCKING_ERROR -306 +#define GNUTLS_E_PKCS11_ATTRIBUTE_ERROR -307 +#define GNUTLS_E_PKCS11_DEVICE_ERROR -308 +#define GNUTLS_E_PKCS11_DATA_ERROR -309 +#define GNUTLS_E_PKCS11_UNSUPPORTED_FEATURE_ERROR -310 +#define GNUTLS_E_PKCS11_KEY_ERROR -311 +#define GNUTLS_E_PKCS11_PIN_EXPIRED -312 +#define GNUTLS_E_PKCS11_PIN_LOCKED -313 +#define GNUTLS_E_PKCS11_SESSION_ERROR -314 +#define GNUTLS_E_PKCS11_SIGNATURE_ERROR -315 +#define GNUTLS_E_PKCS11_TOKEN_ERROR -316 +#define GNUTLS_E_PKCS11_USER_ERROR -317 + #define GNUTLS_E_UNIMPLEMENTED_FEATURE -1250 diff --git a/lib/pkcs11.c b/lib/pkcs11.c index 590db80f79..0941c395ad 100644 --- a/lib/pkcs11.c +++ b/lib/pkcs11.c @@ -5,7 +5,7 @@ * Author: Nikos Mavrogiannopoulos * * Inspired and some parts based on neon PKCS #11 support by Joe Orton. - * More ideas came from the pkcs11-helper library. + * More ideas came from the pkcs11-helper library by Alon Bar-Lev. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Library General Public @@ -69,6 +69,91 @@ static void* pin_data; gnutls_pkcs11_token_callback_t token_func; void* token_data; +int pkcs11_rv_to_err(ck_rv_t rv) +{ + switch(rv) { + case CKR_OK: + return 0; + case CKR_HOST_MEMORY: + return GNUTLS_E_MEMORY_ERROR; + case CKR_SLOT_ID_INVALID: + return GNUTLS_E_PKCS11_SLOT_ERROR; + case CKR_ARGUMENTS_BAD: + case CKR_MECHANISM_PARAM_INVALID: + return GNUTLS_E_INVALID_REQUEST; + case CKR_NEED_TO_CREATE_THREADS: + case CKR_CANT_LOCK: + case CKR_FUNCTION_NOT_PARALLEL: + case CKR_MUTEX_BAD: + case CKR_MUTEX_NOT_LOCKED: + return GNUTLS_E_PKCS11_LOCKING_ERROR; + case CKR_ATTRIBUTE_READ_ONLY: + case CKR_ATTRIBUTE_SENSITIVE: + case CKR_ATTRIBUTE_TYPE_INVALID: + case CKR_ATTRIBUTE_VALUE_INVALID: + return GNUTLS_E_PKCS11_ATTRIBUTE_ERROR; + case CKR_DEVICE_ERROR: + case CKR_DEVICE_MEMORY: + case CKR_DEVICE_REMOVED: + return GNUTLS_E_PKCS11_DEVICE_ERROR; + case CKR_DATA_INVALID: + case CKR_DATA_LEN_RANGE: + case CKR_ENCRYPTED_DATA_INVALID: + case CKR_ENCRYPTED_DATA_LEN_RANGE: + case CKR_OBJECT_HANDLE_INVALID: + return GNUTLS_E_PKCS11_DATA_ERROR; + case CKR_FUNCTION_NOT_SUPPORTED: + case CKR_MECHANISM_INVALID: + return GNUTLS_E_PKCS11_UNSUPPORTED_FEATURE_ERROR; + case CKR_KEY_HANDLE_INVALID: + case CKR_KEY_SIZE_RANGE: + case CKR_KEY_TYPE_INCONSISTENT: + case CKR_KEY_NOT_NEEDED: + case CKR_KEY_CHANGED: + case CKR_KEY_NEEDED: + case CKR_KEY_INDIGESTIBLE: + case CKR_KEY_FUNCTION_NOT_PERMITTED: + case CKR_KEY_NOT_WRAPPABLE: + case CKR_KEY_UNEXTRACTABLE: + return GNUTLS_E_PKCS11_KEY_ERROR; + case CKR_PIN_INCORRECT: + case CKR_PIN_INVALID: + case CKR_PIN_LEN_RANGE: + return GNUTLS_E_PKCS11_PIN_ERROR; + case CKR_PIN_EXPIRED: + return GNUTLS_E_PKCS11_PIN_EXPIRED; + case CKR_PIN_LOCKED: + return GNUTLS_E_PKCS11_PIN_LOCKED; + case CKR_SESSION_CLOSED: + case CKR_SESSION_COUNT: + case CKR_SESSION_HANDLE_INVALID: + case CKR_SESSION_PARALLEL_NOT_SUPPORTED: + case CKR_SESSION_READ_ONLY: + case CKR_SESSION_EXISTS: + case CKR_SESSION_READ_ONLY_EXISTS: + case CKR_SESSION_READ_WRITE_SO_EXISTS: + return GNUTLS_E_PKCS11_SESSION_ERROR; + case CKR_SIGNATURE_INVALID: + case CKR_SIGNATURE_LEN_RANGE: + return GNUTLS_E_PKCS11_SIGNATURE_ERROR; + case CKR_TOKEN_NOT_PRESENT: + case CKR_TOKEN_NOT_RECOGNIZED: + case CKR_TOKEN_WRITE_PROTECTED: + return GNUTLS_E_PKCS11_TOKEN_ERROR; + case CKR_USER_ALREADY_LOGGED_IN: + case CKR_USER_NOT_LOGGED_IN: + case CKR_USER_PIN_NOT_INITIALIZED: + case CKR_USER_TYPE_INVALID: + case CKR_USER_ANOTHER_ALREADY_LOGGED_IN: + case CKR_USER_TOO_MANY_TYPES: + return GNUTLS_E_PKCS11_USER_ERROR; + case CKR_BUFFER_TOO_SMALL: + return GNUTLS_E_SHORT_MEMORY_BUFFER; + default: + return GNUTLS_E_PKCS11_ERROR; + } +} + /* Fake scan */ void pkcs11_rescan_slots(void) { @@ -765,7 +850,7 @@ ck_rv_t rv; if (rv != CKR_OK) { gnutls_assert(); _gnutls_debug_log("pk11: FindObjectsInit failed.\n"); - ret = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE; + ret = pkcs11_rv_to_err(rv); goto fail; } @@ -1248,7 +1333,7 @@ static int find_obj_url(pakchois_session_t *pks, struct token_info *info, void* if (rv != CKR_OK) { gnutls_assert(); _gnutls_debug_log("pk11: FindObjectsInit failed.\n"); - ret = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE; + ret = pkcs11_rv_to_err(rv); goto cleanup; } @@ -1594,7 +1679,7 @@ int pkcs11_login(pakchois_session_t *pks, struct token_info *info, token_creds_s _gnutls_debug_log("pk11: Login result = %lu\n", rv); - return (rv == CKR_OK || rv == CKR_USER_ALREADY_LOGGED_IN) ? 0 : GNUTLS_E_PKCS11_ERROR; + return (rv == CKR_OK || rv == CKR_USER_ALREADY_LOGGED_IN) ? 0 : pkcs11_rv_to_err(rv); } static int find_privkeys(pakchois_session_t *pks, struct token_info* info, struct pkey_list *list) @@ -1618,7 +1703,7 @@ static int find_privkeys(pakchois_session_t *pks, struct token_info* info, struc rv = pakchois_find_objects_init(pks, a, 1); if (rv != CKR_OK) { gnutls_assert(); - return GNUTLS_E_PKCS11_ERROR; + return pkcs11_rv_to_err(rv); } list->key_ids_size = 0; @@ -1648,7 +1733,7 @@ static int find_privkeys(pakchois_session_t *pks, struct token_info* info, struc rv = pakchois_find_objects_init(pks, a, 1); if (rv != CKR_OK) { gnutls_assert(); - return GNUTLS_E_PKCS11_ERROR; + return pkcs11_rv_to_err(rv); } current = 0; @@ -1833,7 +1918,7 @@ static int find_objs(pakchois_session_t *pks, struct token_info *info, void* inp if (rv != CKR_OK) { gnutls_assert(); _gnutls_debug_log("pk11: FindObjectsInit failed.\n"); - return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE; + return pkcs11_rv_to_err(rv); } while (pakchois_find_objects(pks, &obj, 1, &count) == CKR_OK diff --git a/lib/pkcs11_int.h b/lib/pkcs11_int.h index 04da57a407..324da3441f 100644 --- a/lib/pkcs11_int.h +++ b/lib/pkcs11_int.h @@ -51,7 +51,7 @@ struct gnutls_pkcs11_obj_st { */ typedef int (*find_func_t)(pakchois_session_t *pks, struct token_info* tinfo, void* input); - +int pkcs11_rv_to_err(ck_rv_t rv); int pkcs11_url_to_info(const char* url, struct pkcs11_url_info* info); int pkcs11_get_info(struct pkcs11_url_info *info, gnutls_pkcs11_obj_info_t itype, diff --git a/lib/pkcs11_privkey.c b/lib/pkcs11_privkey.c index 67eddd90fb..8c8fdcdb2d 100644 --- a/lib/pkcs11_privkey.c +++ b/lib/pkcs11_privkey.c @@ -170,11 +170,12 @@ gnutls_pkcs11_privkey_sign_data(gnutls_pkcs11_privkey_t signer, #define FIND_OBJECT(pks, obj, key) \ do { \ int retries = 0; \ + int rret; \ ret = pkcs11_find_object (&pks, &obj, &key->info, &key->creds, \ SESSION_LOGIN); \ if (ret < 0) { \ - rv = token_func(token_data, key->info.label, retries++); \ - if (rv == 0) continue; \ + rret = token_func(token_data, key->info.label, retries++); \ + if (rret == 0) continue; \ gnutls_assert(); \ return ret; \ } \ @@ -216,7 +217,7 @@ int gnutls_pkcs11_privkey_sign_hash(gnutls_pkcs11_privkey_t key, rv = pakchois_sign_init(pks, &mech, obj); if (rv != CKR_OK) { gnutls_assert(); - ret = GNUTLS_E_PK_SIGN_FAILED; + ret = pkcs11_rv_to_err(rv); goto cleanup; } @@ -225,7 +226,7 @@ int gnutls_pkcs11_privkey_sign_hash(gnutls_pkcs11_privkey_t key, &siglen); if (rv != CKR_OK) { gnutls_assert(); - ret = GNUTLS_E_PK_SIGN_FAILED; + ret = pkcs11_rv_to_err(rv); goto cleanup; } @@ -237,7 +238,7 @@ int gnutls_pkcs11_privkey_sign_hash(gnutls_pkcs11_privkey_t key, if (rv != CKR_OK) { gnutls_free(signature->data); gnutls_assert(); - ret = GNUTLS_E_PK_SIGN_FAILED; + ret = pkcs11_rv_to_err(rv); goto cleanup; } @@ -329,7 +330,7 @@ gnutls_pkcs11_privkey_decrypt_data(gnutls_pkcs11_privkey_t key, rv = pakchois_decrypt_init(pks, &mech, obj); if (rv != CKR_OK) { gnutls_assert(); - ret = GNUTLS_E_PK_DECRYPTION_FAILED; + ret = pkcs11_rv_to_err(rv); goto cleanup; } @@ -338,7 +339,7 @@ gnutls_pkcs11_privkey_decrypt_data(gnutls_pkcs11_privkey_t key, &siglen); if (rv != CKR_OK) { gnutls_assert(); - ret = GNUTLS_E_PK_DECRYPTION_FAILED; + ret = pkcs11_rv_to_err(rv); goto cleanup; } @@ -350,7 +351,7 @@ gnutls_pkcs11_privkey_decrypt_data(gnutls_pkcs11_privkey_t key, if (rv != CKR_OK) { gnutls_free(plaintext->data); gnutls_assert(); - ret = GNUTLS_E_PK_DECRYPTION_FAILED; + ret = pkcs11_rv_to_err(rv); goto cleanup; } diff --git a/lib/pkcs11_write.c b/lib/pkcs11_write.c index 3ab1b3a90d..b93623ab1c 100644 --- a/lib/pkcs11_write.c +++ b/lib/pkcs11_write.c @@ -138,7 +138,7 @@ int gnutls_pkcs11_copy_x509_crt(const char* token_url, gnutls_x509_crt_t crt, if (rv != CKR_OK) { gnutls_assert(); _gnutls_debug_log("pkcs11: %s\n", pakchois_error(rv)); - ret = GNUTLS_E_PKCS11_ERROR; + ret = pkcs11_rv_to_err(rv); goto cleanup; } @@ -321,7 +321,7 @@ int gnutls_pkcs11_copy_x509_privkey(const char* token_url, if (rv != CKR_OK) { gnutls_assert(); _gnutls_debug_log("pkcs11: %s\n", pakchois_error(rv)); - ret = GNUTLS_E_PKCS11_ERROR; + ret = pkcs11_rv_to_err(rv); goto cleanup; } @@ -446,19 +446,18 @@ static int delete_obj_url(pakchois_session_t *pks, struct token_info *info, void if (rv != CKR_OK) { gnutls_assert(); _gnutls_debug_log("pk11: FindObjectsInit failed.\n"); - ret = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE; + ret = pkcs11_rv_to_err(rv); goto cleanup; } while (pakchois_find_objects(pks, &obj, 1, &count) == CKR_OK && count == 1) { - - rv = pakchois_destroy_object(pks, obj); - if (rv != CKR_OK) { - _gnutls_debug_log("pkcs11: Cannot destroy object: %s\n", pakchois_error(rv)); - } else { - find_data->deleted++; - } + rv = pakchois_destroy_object(pks, obj); + if (rv != CKR_OK) { + _gnutls_debug_log("pkcs11: Cannot destroy object: %s\n", pakchois_error(rv)); + } else { + find_data->deleted++; + } found = 1; }