Skip to content

Commit 9910908

Browse files
author
Andrei Benea
committed
Allow token name instead of slot ID for PKCS#11
1 parent 6efabf4 commit 9910908

File tree

4 files changed

+89
-28
lines changed

4 files changed

+89
-28
lines changed

‎pdns/dnssecinfra.cc

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,7 @@ DNSCryptoKeyEngine* DNSCryptoKeyEngine::makeFromISCString(DNSKEYRecordContent& d
6060
pkcs11=true;
6161
continue;
6262
} else if (pdns_iequals(key,"slot")) {
63-
int slot = atoi(value.c_str());
64-
stormap["slot"]=lexical_cast<string>(slot);
63+
stormap["slot"]=value;
6564
continue;
6665
} else if (pdns_iequals(key,"label")) {
6766
stormap["label"]=value;

‎pdns/pdnssec.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2034,7 +2034,7 @@ try
20342034
std::vector<DNSBackend::KeyData> keys;
20352035

20362036
if (cmds.size() < 9) {
2037-
std::cout << "Usage: pdnssec hsm assign zone algorithm ksk|zsk module slot pin label" << std::endl;
2037+
std::cout << "Usage: pdnssec hsm assign zone algorithm ksk|zsk module token pin label" << std::endl;
20382038
return 1;
20392039
}
20402040

‎pdns/pkcs11signers.cc

Lines changed: 85 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,7 @@ class Pkcs11Slot {
213213
L<<Logger::Error<< msg << endl;
214214
}
215215
}
216+
216217
public:
217218
Pkcs11Slot(CK_FUNCTION_LIST* functions, const CK_SLOT_ID& slot) {
218219
CK_TOKEN_INFO tokenInfo;
@@ -260,6 +261,9 @@ class Pkcs11Slot {
260261
CK_FUNCTION_LIST* f() { return d_functions; }
261262

262263
pthread_mutex_t *m() { return &d_m; }
264+
265+
static boost::shared_ptr<Pkcs11Slot> GetSlot(const std::string& module, const string& tokenId);
266+
static CK_RV HuntSlot(const string& tokenId, CK_SLOT_ID &slotId, _CK_SLOT_INFO* info, CK_FUNCTION_LIST* functions);
263267
};
264268

265269
class Pkcs11Token {
@@ -607,31 +611,72 @@ class Pkcs11Token {
607611
return d_bits;
608612
}
609613

610-
static boost::shared_ptr<Pkcs11Token> GetToken(const std::string& module, const CK_SLOT_ID& slotId, const std::string& label);
614+
static boost::shared_ptr<Pkcs11Token> GetToken(const std::string& module, const string& tokenId, const std::string& label);
611615
};
612616

613617
static std::map<std::string, boost::shared_ptr<Pkcs11Slot> > pkcs11_slots;
614618
static std::map<std::string, boost::shared_ptr<Pkcs11Token> > pkcs11_tokens;
615619

616-
boost::shared_ptr<Pkcs11Token> Pkcs11Token::GetToken(const std::string& module, const CK_SLOT_ID& slotId, const std::string& label) {
620+
CK_RV Pkcs11Slot::HuntSlot(const string& tokenId, CK_SLOT_ID &slotId, _CK_SLOT_INFO* info, CK_FUNCTION_LIST* functions)
621+
{
622+
CK_RV err;
623+
unsigned long slots;
624+
_CK_TOKEN_INFO tinfo;
625+
626+
// go thru all slots
627+
// this is required by certain tokens, otherwise C_GetSlotInfo will not return a token
628+
err = functions->C_GetSlotList(CK_FALSE, NULL_PTR, &slots);
629+
if (err) {
630+
L<<Logger::Warning<<"C_GetSlotList(CK_FALSE, NULL_PTR, &slots) = " << err << std::endl;
631+
return err;
632+
}
633+
634+
// iterate all slots
635+
for(slotId=0;slotId<slots;slotId++) {
636+
if ((err = functions->C_GetSlotInfo(slotId, info))) {
637+
L<<Logger::Warning<<"C_GetSlotList("<<slotId<<", info) = " << err << std::endl;
638+
return err;
639+
}
640+
if ((err = functions->C_GetTokenInfo(slotId, &tinfo))) {
641+
L<<Logger::Warning<<"C_GetSlotList("<<slotId<<", &tinfo) = " << err << std::endl;
642+
return err;
643+
}
644+
std::string slotName;
645+
slotName.assign(reinterpret_cast<char*>(tinfo.label), 32);
646+
// trim it
647+
boost::trim(slotName);
648+
if (boost::iequals(slotName, tokenId)) {
649+
return 0;
650+
}
651+
}
652+
653+
// see if we can find it with slotId
654+
try {
655+
slotId = boost::lexical_cast<int>(tokenId);
656+
if ((err = functions->C_GetSlotInfo(slotId, info))) {
657+
L<<Logger::Warning<<"C_GetSlotList("<<slotId<<", info) = " << err << std::endl;
658+
return err;
659+
}
660+
L<<Logger::Warning<<"Specifying PKCS#11 token by SLOT ID is deprecated and should not be used"<<std::endl;
661+
return 0;
662+
} catch (...) {
663+
return CK_UNAVAILABLE_INFORMATION;
664+
}
665+
return CK_UNAVAILABLE_INFORMATION;
666+
}
667+
668+
boost::shared_ptr<Pkcs11Slot> Pkcs11Slot::GetSlot(const std::string& module, const string& tokenId) {
617669
// see if we can find module
618-
std::string tidx = module;
619-
tidx.append("|");
620-
tidx.append(boost::lexical_cast<std::string>(slotId));
621-
std::string sidx = tidx;
622-
tidx.append("|");
623-
tidx.append(label);
624-
std::map<std::string, boost::shared_ptr<Pkcs11Token> >::iterator tokenIter;
670+
std::string sidx = module;
671+
sidx.append("|");
672+
sidx.append(tokenId);
625673
std::map<std::string, boost::shared_ptr<Pkcs11Slot> >::iterator slotIter;
626674
CK_RV err;
627675
CK_FUNCTION_LIST* functions;
628676

629-
if ((tokenIter = pkcs11_tokens.find(tidx)) != pkcs11_tokens.end()) return tokenIter->second;
630-
631677
// see if we have slot
632678
if ((slotIter = pkcs11_slots.find(sidx)) != pkcs11_slots.end()) {
633-
pkcs11_tokens[tidx] = boost::make_shared<Pkcs11Token>(slotIter->second, label);
634-
return pkcs11_tokens[tidx];
679+
return slotIter->second;
635680
}
636681

637682
#ifdef HAVE_P11KIT1_V2
@@ -644,23 +689,30 @@ boost::shared_ptr<Pkcs11Token> Pkcs11Token::GetToken(const std::string& module,
644689

645690
// try to locate a slot
646691
_CK_SLOT_INFO info;
647-
unsigned long slots;
692+
CK_SLOT_ID slotId;
648693

649-
// this is required by certain tokens, otherwise C_GetSlotInfo will not return a token
650-
err = functions->C_GetSlotList(CK_FALSE, NULL_PTR, &slots);
651-
if (err)
652-
L<<Logger::Warning<<"C_GetSlotList(CK_FALSE, NULL_PTR, &slots) = " << err << std::endl;
653-
654-
if ((err = functions->C_GetSlotInfo(slotId, &info))) {
655-
throw PDNSException(std::string("Cannot find PKCS#11 slot ") + boost::lexical_cast<std::string>(slotId) + std::string(" on module ") + module + std::string(": error code ") + boost::lexical_cast<std::string>(err));
694+
if ((err = Pkcs11Slot::HuntSlot(tokenId, slotId, &info, functions))) {
695+
throw PDNSException(std::string("Cannot find PKCS#11 token ") + tokenId + std::string(" on module ") + module + std::string(": error code ") + boost::lexical_cast<std::string>(err));
656696
}
657697

658698
// store slot
659699
pkcs11_slots[sidx] = boost::make_shared<Pkcs11Slot>(functions, slotId);
660700

661-
// looks ok to me.
662-
pkcs11_tokens[tidx] = boost::make_shared<Pkcs11Token>(pkcs11_slots[sidx], label);
701+
return pkcs11_slots[sidx];
702+
}
703+
704+
boost::shared_ptr<Pkcs11Token> Pkcs11Token::GetToken(const std::string& module, const string& tokenId, const std::string& label) {
705+
// see if we can find module
706+
std::string tidx = module;
707+
tidx.append("|");
708+
tidx.append(boost::lexical_cast<std::string>(tokenId));
709+
tidx.append("|");
710+
tidx.append(label);
711+
std::map<std::string, boost::shared_ptr<Pkcs11Token> >::iterator tokenIter;
712+
if ((tokenIter = pkcs11_tokens.find(tidx)) != pkcs11_tokens.end()) return tokenIter->second;
663713

714+
boost::shared_ptr<Pkcs11Slot> slot = Pkcs11Slot::GetSlot(module, tokenId);
715+
pkcs11_tokens[tidx] = boost::make_shared<Pkcs11Token>(slot, label);
664716
return pkcs11_tokens[tidx];
665717
}
666718

@@ -677,6 +729,14 @@ Pkcs11Token::Pkcs11Token(const boost::shared_ptr<Pkcs11Slot>& slot, const std::s
677729
Pkcs11Token::~Pkcs11Token() {
678730
}
679731

732+
bool PKCS11ModuleSlotLogin(const std::string& module, const string& tokenId, const std::string& pin)
733+
{
734+
boost::shared_ptr<Pkcs11Slot> slot;
735+
slot = Pkcs11Slot::GetSlot(module, tokenId);
736+
if (slot->LoggedIn()) return true; // no point failing
737+
return slot->Login(pin);
738+
}
739+
680740
PKCS11DNSCryptoKeyEngine::PKCS11DNSCryptoKeyEngine(unsigned int algorithm): DNSCryptoKeyEngine(algorithm) {}
681741
PKCS11DNSCryptoKeyEngine::~PKCS11DNSCryptoKeyEngine() {}
682742
PKCS11DNSCryptoKeyEngine::PKCS11DNSCryptoKeyEngine(const PKCS11DNSCryptoKeyEngine& orig) : DNSCryptoKeyEngine(orig.d_algorithm) {}
@@ -875,7 +935,8 @@ DNSCryptoKeyEngine::storvector_t PKCS11DNSCryptoKeyEngine::convertToISCVector()
875935
void PKCS11DNSCryptoKeyEngine::fromISCMap(DNSKEYRecordContent& drc, stormap_t& stormap) {
876936
drc.d_algorithm = atoi(stormap["algorithm"].c_str());
877937
d_module = stormap["engine"];
878-
d_slot_id = atoi(stormap["slot"].c_str());
938+
d_slot_id = stormap["slot"];
939+
boost::trim(d_slot_id);
879940
d_pin = stormap["pin"];
880941
d_label = stormap["label"];
881942
// validate parameters

‎pdns/pkcs11signers.hh

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ class PKCS11DNSCryptoKeyEngine : public DNSCryptoKeyEngine
22
{
33
protected:
44
std::string d_module;
5-
unsigned long d_slot_id;
5+
std::string d_slot_id;
66
std::string d_pin;
77
std::string d_label;
88

@@ -41,3 +41,4 @@ class PKCS11DNSCryptoKeyEngine : public DNSCryptoKeyEngine
4141
static DNSCryptoKeyEngine* maker(unsigned int algorithm);
4242
};
4343

44+
bool PKCS11ModuleSlotLogin(const std::string& module, const string& tokenId, const std::string& pin);

0 commit comments

Comments
 (0)