From a7a704d42be72cc7e58b2c24e9d151e00eca318d Mon Sep 17 00:00:00 2001 From: Alexander Sosedkin Date: Fri, 22 Sep 2023 18:57:21 +0200 Subject: [PATCH] list-mechanisms: initial implementation Resolves: #563 Signed-off-by: Alexander Sosedkin --- bash-completion/p11-kit | 2 +- doc/manual/p11-kit.xml | 16 ++ p11-kit/Makefile.am | 4 + p11-kit/list-mechanisms.c | 285 ++++++++++++++++++++++++++++++++ p11-kit/meson.build | 5 + p11-kit/p11-kit.c | 4 + p11-kit/test-list-mechanisms.sh | 47 ++++++ po/POTFILES.in | 1 + 8 files changed, 363 insertions(+), 1 deletion(-) create mode 100644 p11-kit/list-mechanisms.c create mode 100755 p11-kit/test-list-mechanisms.sh diff --git a/bash-completion/p11-kit b/bash-completion/p11-kit index 00dd694c..94ebd0fa 100644 --- a/bash-completion/p11-kit +++ b/bash-completion/p11-kit @@ -10,7 +10,7 @@ _p11-kit() COMPREPLY=( $(compgen -W "$opts" -- "$cur") ) return elif [[ $cword -eq 1 ]]; then - local commands='generate-keypair export-object delete-object list-objects add-profile delete-profile list-profiles list-modules print-config extract server remote' + local commands='list-mechanisms generate-keypair export-object delete-object list-objects add-profile delete-profile list-profiles list-modules print-config extract server remote' COMPREPLY=( $(compgen -W "$commands" -- "$cur") ) fi } && diff --git a/doc/manual/p11-kit.xml b/doc/manual/p11-kit.xml index b323d1c3..bb27640f 100644 --- a/doc/manual/p11-kit.xml +++ b/doc/manual/p11-kit.xml @@ -53,6 +53,9 @@ p11-kit delete-profile ... + + p11-kit list-mechanisms ... + p11-kit print-config @@ -222,6 +225,19 @@ $ p11-kit delete-profile --profile profile pkcs11:token + + List Mechanisms + + List PKCS#11 mechanisms supported by the token. + + +$ p11-kit list-mechanisms pkcs11:token + + + This lists all available mechanimsms for a PKCS#11 token + + + Print Config diff --git a/p11-kit/Makefile.am b/p11-kit/Makefile.am index 4cdc51b6..47f9ed26 100644 --- a/p11-kit/Makefile.am +++ b/p11-kit/Makefile.am @@ -270,6 +270,7 @@ p11_kit_p11_kit_SOURCES = \ p11-kit/generate-keypair.c \ p11-kit/list-objects.c \ p11-kit/list-profiles.c \ + p11-kit/list-mechanisms.c \ p11-kit/lists.c \ p11-kit/p11-kit.c \ p11-kit/print-config.c \ @@ -301,6 +302,7 @@ p11_kit_p11_kit_testable_SOURCES = \ p11-kit/generate-keypair.c \ p11-kit/list-objects.c \ p11-kit/list-profiles.c \ + p11-kit/list-mechanisms.c \ p11-kit/lists.c \ p11-kit/p11-kit.c \ p11-kit/print-config.c \ @@ -425,6 +427,7 @@ sh_tests += \ p11-kit/test-objects.sh \ p11-kit/test-lists.sh \ p11-kit/test-server.sh \ + p11-kit/test-list-mechanisms.sh \ $(NULL) if WITH_ASN1 @@ -618,4 +621,5 @@ EXTRA_DIST += \ p11-kit/test-messages.sh \ p11-kit/test-server.sh \ p11-kit/test-export-public.sh \ + p11-kit/test-list-mechanisms.sh \ $(NULL) diff --git a/p11-kit/list-mechanisms.c b/p11-kit/list-mechanisms.c new file mode 100644 index 00000000..0739964a --- /dev/null +++ b/p11-kit/list-mechanisms.c @@ -0,0 +1,285 @@ +/* + * Copyright (c) 2023, Red Hat Inc. + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * * Redistributions of source code must retain the above + * copyright notice, this list of conditions and the + * following disclaimer. + * * Redistributions in binary form must reproduce the + * above copyright notice, this list of conditions and + * the following disclaimer in the documentation and/or + * other materials provided with the distribution. + * * The names of contributors to this software may not be + * used to endorse or promote products derived from this + * software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF + * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH + * DAMAGE. + * + * Author: Alexander Sosedkin + */ + +#include "config.h" + +#include "constants.h" +#define P11_DEBUG_FLAG P11_DEBUG_LIB +#include "debug.h" +#include "iter.h" +#include "message.h" +#include "pkcs11.h" +#include "print.h" +#include "tool.h" +#include "uri.h" + +#include +#include +#include + +#ifdef ENABLE_NLS +#include +#define _(x) dgettext(PACKAGE_NAME, x) +#else +#define _(x) (x) +#endif + +int +p11_kit_list_mechanisms (int argc, + char *argv[]); + +static void +print_mechanism_with_info (CK_MECHANISM_TYPE mechanism, + CK_MECHANISM_INFO info) +{ + const char *mechanism_nick = NULL; + + mechanism_nick = p11_constant_nick (p11_constant_mechanisms, mechanism); + if (mechanism_nick == NULL) + printf ("0x%lX (unknown):", mechanism); + else + printf ("%s:", mechanism_nick); + + if (info.flags & CKF_HW) + printf (" hw"); + if (info.flags & CKF_MESSAGE_ENCRYPT) + printf (" message-encrypt"); + if (info.flags & CKF_MESSAGE_DECRYPT) + printf (" message-decrypt"); + if (info.flags & CKF_MESSAGE_SIGN) + printf (" message-sign"); + if (info.flags & CKF_MESSAGE_VERIFY) + printf (" message-verify"); + if (info.flags & CKF_MULTI_MESSAGE) + printf (" multi-message"); + if (info.flags & CKF_FIND_OBJECTS) + printf (" find-objects"); + if (info.flags & CKF_ENCRYPT) + printf (" encrypt"); + if (info.flags & CKF_DECRYPT) + printf (" decrypt"); + if (info.flags & CKF_DIGEST) + printf (" digest"); + if (info.flags & CKF_SIGN) + printf (" sign"); + if (info.flags & CKF_SIGN_RECOVER) + printf (" sign-recover"); + if (info.flags & CKF_VERIFY) + printf (" verify"); + if (info.flags & CKF_SIGN_RECOVER) + printf (" verify-recover"); + if (info.flags & CKF_GENERATE) + printf (" generate"); + if (info.flags & CKF_GENERATE_KEY_PAIR) + printf (" generate-key-pair"); + if (info.flags & CKF_WRAP) + printf (" wrap"); + if (info.flags & CKF_UNWRAP) + printf (" unwrap"); + if (info.flags & CKF_DERIVE) + printf (" derive"); + if (info.flags & CKF_EXTENSION) + printf (" extension"); + + if (info.ulMaxKeySize) + printf (" key-size=%lu-%lu", info.ulMinKeySize, info.ulMaxKeySize); + printf ("\n"); +} + +static int +list_mechanisms (const char *token_str) +{ + int ret = 1; + CK_FUNCTION_LIST **modules = NULL; + CK_FUNCTION_LIST *module = NULL; + P11KitUri *uri = NULL; + P11KitIter *iter = NULL; + CK_SESSION_HANDLE session = 0; + CK_SLOT_ID slot = 0; + CK_TOKEN_INFO token_info; + char *label = NULL; + CK_MECHANISM_INFO mechanism_info; + CK_MECHANISM_TYPE_PTR mechanisms = NULL; + CK_MECHANISM_TYPE_PTR mechanisms_new = NULL; + unsigned long mechanisms_count = 0; + unsigned long i; + p11_list_printer printer; + CK_RV rv; + + uri = p11_kit_uri_new (); + if (uri == NULL) { + p11_message (_("failed to allocate memory")); + goto cleanup; + } + + if (p11_kit_uri_parse (token_str, P11_KIT_URI_FOR_OBJECT_ON_TOKEN, uri) != P11_KIT_URI_OK) { + p11_message (_("failed to parse URI")); + goto cleanup; + } + + modules = p11_kit_modules_load_and_initialize (0); + if (modules == NULL) { + p11_message (_("failed to load and initialize modules")); + goto cleanup; + } + + iter = p11_kit_iter_new (uri, P11_KIT_ITER_WITH_LOGIN | P11_KIT_ITER_WITH_TOKENS | P11_KIT_ITER_WITHOUT_OBJECTS); + if (iter == NULL) { + p11_debug ("failed to initialize iterator"); + goto cleanup; + } + + p11_list_printer_init (&printer, stdout, 0); + p11_kit_iter_begin (iter, modules); + while ((rv = p11_kit_iter_next (iter)) == CKR_OK) { + module = p11_kit_iter_get_module (iter); + if (module == NULL) { + p11_message (_("failed to obtain module")); + goto cleanup; + } + + slot = p11_kit_iter_get_slot (iter); + + rv = module->C_GetTokenInfo (slot, &token_info); + if (rv != CKR_OK) { + p11_message (_("couldn't load token info: %s"), p11_kit_strerror (rv)); + goto cleanup; + } + + label = p11_kit_space_strdup (token_info.label, sizeof (token_info.label)); + p11_list_printer_start_section (&printer, "token", "%s", label); + free (label); + + rv = module->C_GetMechanismList (slot, NULL, &mechanisms_count); + if (rv != CKR_OK) { + p11_message (_("querying amount of mechanisms failed: %s"), p11_kit_strerror (rv)); + goto cleanup; + } + + mechanisms_new = reallocarray (mechanisms, mechanisms_count, sizeof (CK_MECHANISM_TYPE)); + if (mechanisms_new == NULL) { + p11_message (_("failed to allocate memory")); + goto cleanup; + } + mechanisms = mechanisms_new; + + rv = module->C_GetMechanismList (slot, mechanisms, &mechanisms_count); + if (rv != CKR_OK) { + p11_message (_("querying mechanisms failed: %s"), p11_kit_strerror (rv)); + goto cleanup; + } + + for (i = 0; i < mechanisms_count; i++) { + rv = module->C_GetMechanismInfo (slot, mechanisms[i], &mechanism_info); + if (rv != CKR_OK) { + p11_message (_("querying mechanism info failed: %s"), p11_kit_strerror (rv)); + goto cleanup; + } + + print_mechanism_with_info (mechanisms[i], mechanism_info); + } + p11_list_printer_end_section (&printer); + } + assert (rv == CKR_CANCEL); + + ret = 0; + +cleanup: + if (session) + module->C_CloseSession (session); + if (mechanisms) + free (mechanisms); + p11_kit_iter_free (iter); + p11_kit_uri_free (uri); + if (modules != NULL) + p11_kit_modules_finalize_and_release (modules); + + return ret; +} + +int +p11_kit_list_mechanisms (int argc, + char *argv[]) +{ + int opt; + + enum { + opt_verbose = 'v', + opt_quiet = 'q', + opt_help = 'h', + }; + + struct option options[] = { + { "verbose", no_argument, NULL, opt_verbose }, + { "quiet", no_argument, NULL, opt_quiet }, + { "help", no_argument, NULL, opt_help }, + { 0 }, + }; + + p11_tool_desc usages[] = { + { 0, "usage: p11-kit list-mechanisms pkcs11:token" }, + { 0 }, + }; + + while ((opt = p11_tool_getopt (argc, argv, options)) != -1) { + switch (opt) { + case opt_verbose: + p11_kit_be_loud (); + break; + case opt_quiet: + p11_kit_be_quiet (); + break; + case opt_help: + p11_tool_usage (usages, options); + return 0; + case '?': + return 2; + default: + assert_not_reached (); + break; + } + } + + argc -= optind; + argv += optind; + + if (argc != 1) { + p11_tool_usage (usages, options); + return 2; + } + + return list_mechanisms (*argv); +} diff --git a/p11-kit/meson.build b/p11-kit/meson.build index 6bf9bcf3..21b7c353 100644 --- a/p11-kit/meson.build +++ b/p11-kit/meson.build @@ -217,6 +217,7 @@ p11_kit_sources = [ 'generate-keypair.c', 'list-objects.c', 'list-profiles.c', + 'list-mechanisms.c', 'lists.c', 'p11-kit.c', 'print-config.c' @@ -401,6 +402,10 @@ if get_option('test') test('test-server.sh', find_program('test-server.sh'), env: p11_kit_tests_env) + + test('test-lists-mechanisms.sh', + find_program('test-list-mechanisms.sh'), + env: p11_kit_tests_env) endif if with_asn1 and host_system != 'windows' diff --git a/p11-kit/p11-kit.c b/p11-kit/p11-kit.c index 359a8c0b..04a55f1e 100644 --- a/p11-kit/p11-kit.c +++ b/p11-kit/p11-kit.c @@ -83,6 +83,9 @@ int p11_kit_add_profile (int argc, int p11_kit_delete_profile (int argc, char *argv[]); +int p11_kit_list_mechanisms (int argc, + char *argv[]); + int p11_kit_print_config (int argc, char *argv[]); @@ -102,6 +105,7 @@ static const p11_tool_command commands[] = { { "add-profile", p11_kit_add_profile, N_("Add PKCS#11 profile to the token") }, { "delete-profile", p11_kit_delete_profile, N_("Delete PKCS#11 profile from the token") }, { "print-config", p11_kit_print_config, N_("Print merged configuration") }, + { "list-mechanisms", p11_kit_list_mechanisms, N_("List supported mechanisms") }, { "remote", p11_kit_external, N_("Run a specific PKCS#11 module remotely") }, { "server", p11_kit_external, N_("Run a server process that exposes PKCS#11 module remotely") }, { P11_TOOL_FALLBACK, p11_kit_external, NULL }, diff --git a/p11-kit/test-list-mechanisms.sh b/p11-kit/test-list-mechanisms.sh new file mode 100755 index 00000000..a964c7f7 --- /dev/null +++ b/p11-kit/test-list-mechanisms.sh @@ -0,0 +1,47 @@ +#!/bin/sh + +test "${abs_top_builddir+set}" = set || { + echo "set abs_top_builddir" 1>&2 + exit 1 +} + +. "$abs_top_builddir/common/test-init.sh" + +setup() { + testdir=$PWD/test-mechanisms-$$ + test -d "$testdir" || mkdir "$testdir" + cd "$testdir" +} + +teardown() { + rm -rf "$testdir" +} + +test_list_mechanisms() { + cat > list.exp < list.out; then + assert_fail "unable to run: p11-kit list-mechanisms" + fi + + : ${DIFF=diff} + if ! ${DIFF} list.exp list.out > list.diff; then + sed 's/^/# /' list.diff + assert_fail "output contains wrong results" + fi +} + +run test_list_mechanisms diff --git a/po/POTFILES.in b/po/POTFILES.in index c902f33a..11333ac6 100644 --- a/po/POTFILES.in +++ b/po/POTFILES.in @@ -9,6 +9,7 @@ p11-kit/filter.c p11-kit/generate-keypair.c p11-kit/list-objects.c p11-kit/list-profiles.c +p11-kit/list-mechanisms.c p11-kit/lists.c p11-kit/messages.c p11-kit/modules.c