From c721f940bae96feb95c4cc3e041b2552ac07a794 Mon Sep 17 00:00:00 2001 From: Alexander Sosedkin Date: Fri, 22 Sep 2023 18:57:21 +0200 Subject: [PATCH] WIP: list-mechanisms: initial implementation Resolves: #563 --- bash-completion/p11-kit | 2 +- doc/manual/p11-kit.xml | 16 ++ p11-kit/Makefile.am | 1 + p11-kit/list-mechanisms.c | 303 ++++++++++++++++++++++++++++++++++++++ p11-kit/meson.build | 1 + p11-kit/p11-kit.c | 4 + po/POTFILES.in | 1 + 7 files changed, 327 insertions(+), 1 deletion(-) create mode 100644 p11-kit/list-mechanisms.c diff --git a/bash-completion/p11-kit b/bash-completion/p11-kit index 00dd694c..94ebd0fa 100644 --- a/bash-completion/p11-kit +++ b/bash-completion/p11-kit @@ -10,7 +10,7 @@ _p11-kit() COMPREPLY=( $(compgen -W "$opts" -- "$cur") ) return elif [[ $cword -eq 1 ]]; then - local commands='generate-keypair export-object delete-object list-objects add-profile delete-profile list-profiles list-modules print-config extract server remote' + local commands='list-mechanisms generate-keypair export-object delete-object list-objects add-profile delete-profile list-profiles list-modules print-config extract server remote' COMPREPLY=( $(compgen -W "$commands" -- "$cur") ) fi } && diff --git a/doc/manual/p11-kit.xml b/doc/manual/p11-kit.xml index b323d1c3..bb27640f 100644 --- a/doc/manual/p11-kit.xml +++ b/doc/manual/p11-kit.xml @@ -53,6 +53,9 @@ p11-kit delete-profile ... + + p11-kit list-mechanisms ... + p11-kit print-config @@ -222,6 +225,19 @@ $ p11-kit delete-profile --profile profile pkcs11:token + + List Mechanisms + + List PKCS#11 mechanisms supported by the token. + + +$ p11-kit list-mechanisms pkcs11:token + + + This lists all available mechanimsms for a PKCS#11 token + + + Print Config diff --git a/p11-kit/Makefile.am b/p11-kit/Makefile.am index b5195bee..083b867e 100644 --- a/p11-kit/Makefile.am +++ b/p11-kit/Makefile.am @@ -270,6 +270,7 @@ p11_kit_p11_kit_SOURCES = \ p11-kit/generate-keypair.c \ p11-kit/list-objects.c \ p11-kit/list-profiles.c \ + p11-kit/list-mechanisms.c \ p11-kit/lists.c \ p11-kit/p11-kit.c \ p11-kit/print-config.c \ diff --git a/p11-kit/list-mechanisms.c b/p11-kit/list-mechanisms.c new file mode 100644 index 00000000..3f1475b0 --- /dev/null +++ b/p11-kit/list-mechanisms.c @@ -0,0 +1,303 @@ +/* + * Copyright (c) 2023, Red Hat Inc. + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * * Redistributions of source code must retain the above + * copyright notice, this list of conditions and the + * following disclaimer. + * * Redistributions in binary form must reproduce the + * above copyright notice, this list of conditions and + * the following disclaimer in the documentation and/or + * other materials provided with the distribution. + * * The names of contributors to this software may not be + * used to endorse or promote products derived from this + * software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF + * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH + * DAMAGE. + * + * Author: Alexander Sosedkin + */ + +#include "config.h" + +#include "constants.h" +#include "debug.h" +#include "iter.h" +#include "message.h" +#include "pkcs11.h" +#include "print.h" +#include "tool.h" +#include "uri.h" + +#include +#include +#include + +#ifdef ENABLE_NLS +#include +#define _(x) dgettext(PACKAGE_NAME, x) +#else +#define _(x) (x) +#endif + +int +p11_kit_list_mechanisms (int argc, + char *argv[]); + +static void +print_mechanism_with_info(CK_MECHANISM_TYPE mechanism, + CK_MECHANISM_INFO info) +{ + const char *mechanism_nick = NULL; + + mechanism_nick = p11_constant_nick (p11_constant_mechanisms, mechanism); + if (mechanism_nick == NULL) + printf ("0x%lX (unknown):", mechanism); + else + printf ("%s:", mechanism_nick); + + if (info.flags & CKF_HW) + printf (" hw"); + if (info.flags & CKF_MESSAGE_ENCRYPT) + printf (" message-encrypt"); + if (info.flags & CKF_MESSAGE_DECRYPT) + printf (" message-decrypt"); + if (info.flags & CKF_MESSAGE_SIGN) + printf (" message-sign"); + if (info.flags & CKF_MESSAGE_VERIFY) + printf (" message-verify"); + if (info.flags & CKF_MULTI_MESSAGE) + printf (" multi-message"); + if (info.flags & CKF_FIND_OBJECTS) + printf (" find-objects"); + if (info.flags & CKF_ENCRYPT) + printf (" encrypt"); + if (info.flags & CKF_DECRYPT) + printf (" decrypt"); + if (info.flags & CKF_DIGEST) + printf (" digest"); + if (info.flags & CKF_SIGN) + printf (" sign"); + if (info.flags & CKF_SIGN_RECOVER) + printf (" sign-recover"); + if (info.flags & CKF_VERIFY) + printf (" verify"); + if (info.flags & CKF_SIGN_RECOVER) + printf (" verify-recover"); + if (info.flags & CKF_GENERATE) + printf (" generate"); + if (info.flags & CKF_GENERATE_KEY_PAIR) + printf (" generate-key-pair"); + if (info.flags & CKF_WRAP) + printf (" wrap"); + if (info.flags & CKF_UNWRAP) + printf (" unwrap"); + if (info.flags & CKF_DERIVE) + printf (" derive"); + if (info.flags & CKF_EXTENSION) + printf (" extension"); + + if (info.ulMaxKeySize) + printf (" key-size=%ld-%ld", info.ulMinKeySize, info.ulMaxKeySize); + printf ("\n"); +} + +static int +list_mechanisms (const char *token_str) +{ + int ret = 1; + CK_FUNCTION_LIST **modules = NULL; + CK_FUNCTION_LIST *module = NULL; + P11KitUri *uri = NULL; + P11KitIter *iter = NULL; + CK_SESSION_HANDLE session = 0; + CK_SLOT_ID slot = 0; + CK_MECHANISM_INFO mechanism_info; + CK_MECHANISM_TYPE_PTR mechanisms = NULL; + CK_MECHANISM_TYPE mechanism = CKP_INVALID_ID; + unsigned long mechanisms_count = 0; + unsigned long i; + p11_list_printer printer; + CK_RV rv; + + uri = p11_kit_uri_new (); + if (uri == NULL) { + p11_message (_("failed to allocate memory")); + goto cleanup; + } + + if (p11_kit_uri_parse (token_str, P11_KIT_URI_FOR_OBJECT_ON_TOKEN, uri) != P11_KIT_URI_OK) { + p11_message (_("failed to parse URI")); + goto cleanup; + } + + modules = p11_kit_modules_load_and_initialize (0); + if (modules == NULL) { + p11_message (_("failed to load and initialize modules")); + goto cleanup; + } + + iter = p11_kit_iter_new (uri, P11_KIT_ITER_WITH_LOGIN); + if (iter == NULL) { + p11_message (_("failed to initialize iterator")); + goto cleanup; + } + + p11_list_printer_init (&printer, stdout, 0); + + uri = p11_kit_uri_new (); + if (uri == NULL) { + p11_message (_("failed to allocate memory")); + goto cleanup; + } + + if (p11_kit_uri_parse (token_str, P11_KIT_URI_FOR_TOKEN, uri) != P11_KIT_URI_OK) { + p11_message (_("failed to parse URI")); + goto cleanup; + } + + modules = p11_kit_modules_load_and_initialize (0); + if (modules == NULL) { + p11_message (_("failed to load and initialize modules")); + goto cleanup; + } + + iter = p11_kit_iter_new (uri, P11_KIT_ITER_WITH_LOGIN | P11_KIT_ITER_WITH_TOKENS | P11_KIT_ITER_WITHOUT_OBJECTS); + if (iter == NULL) { + p11_message (_("failed to initialize iterator")); + goto cleanup; + } + + p11_list_printer_init (&printer, stdout, 0); + p11_kit_iter_begin (iter, modules); + while ((rv = p11_kit_iter_next (iter)) == CKR_OK) { + module = p11_kit_iter_get_module (iter); + if (module == NULL) { + p11_message (_("failed to obtain module")); + goto cleanup; + } + + slot = p11_kit_iter_get_slot (iter); + if (slot == 0) { + p11_message (_("failed to obtain slot")); + goto cleanup; + } + p11_list_printer_start_section (&printer, "Token", "#%lu", slot); + + rv = module->C_GetMechanismList (slot, NULL, &mechanisms_count); + if (rv != CKR_OK) { + p11_message (_("querying amount of mechanisms failed: %s"), p11_kit_strerror (rv)); + goto cleanup; + } + + mechanisms = malloc(sizeof(CK_MECHANISM_TYPE) * mechanisms_count); + if (mechanisms == NULL) { + p11_message (_("failed to allocate memory")); + goto cleanup; + } + + rv = module->C_GetMechanismList (slot, mechanisms, &mechanisms_count); + if (rv != CKR_OK) { + p11_message (_("querying mechanisms failed: %s"), p11_kit_strerror (rv)); + goto cleanup; + } + + for (i = 0; i < mechanisms_count; i++) { + mechanism = mechanisms[i]; + + rv = module->C_GetMechanismInfo (slot, mechanism, &mechanism_info); + if (rv != CKR_OK) { + p11_message (_("querying mechanism info failed: %s"), p11_kit_strerror (rv)); + goto cleanup; + } + + print_mechanism_with_info(mechanism, mechanism_info); + } + p11_list_printer_end_section (&printer); + } + assert (rv == CKR_CANCEL); + + ret = 0; + +cleanup: + if (session) + module->C_CloseSession (session); + if (mechanisms) + free(mechanisms); + p11_kit_iter_free (iter); + p11_kit_uri_free (uri); + if (modules != NULL) + p11_kit_modules_finalize_and_release (modules); + + return ret; +} + +int +p11_kit_list_mechanisms (int argc, + char *argv[]) +{ + int opt; + + enum { + opt_verbose = 'v', + opt_quiet = 'q', + opt_help = 'h', + }; + + struct option options[] = { + { "verbose", no_argument, NULL, opt_verbose }, + { "quiet", no_argument, NULL, opt_quiet }, + { "help", no_argument, NULL, opt_help }, + { 0 }, + }; + + p11_tool_desc usages[] = { + { 0, "usage: p11-kit list-mechanisms pkcs11:token" }, + { 0 }, + }; + + while ((opt = p11_tool_getopt (argc, argv, options)) != -1) { + switch (opt) { + case opt_verbose: + p11_kit_be_loud (); + break; + case opt_quiet: + p11_kit_be_quiet (); + break; + case opt_help: + p11_tool_usage (usages, options); + return 0; + case '?': + return 2; + default: + assert_not_reached (); + break; + } + } + + argc -= optind; + argv += optind; + + if (argc != 1) { + p11_tool_usage (usages, options); + return 2; + } + + return list_mechanisms (*argv); +} diff --git a/p11-kit/meson.build b/p11-kit/meson.build index 79190cc9..afc7a657 100644 --- a/p11-kit/meson.build +++ b/p11-kit/meson.build @@ -217,6 +217,7 @@ p11_kit_sources = [ 'generate-keypair.c', 'list-objects.c', 'list-profiles.c', + 'list-mechanisms.c', 'lists.c', 'p11-kit.c', 'print-config.c' diff --git a/p11-kit/p11-kit.c b/p11-kit/p11-kit.c index 359a8c0b..04a55f1e 100644 --- a/p11-kit/p11-kit.c +++ b/p11-kit/p11-kit.c @@ -83,6 +83,9 @@ int p11_kit_add_profile (int argc, int p11_kit_delete_profile (int argc, char *argv[]); +int p11_kit_list_mechanisms (int argc, + char *argv[]); + int p11_kit_print_config (int argc, char *argv[]); @@ -102,6 +105,7 @@ static const p11_tool_command commands[] = { { "add-profile", p11_kit_add_profile, N_("Add PKCS#11 profile to the token") }, { "delete-profile", p11_kit_delete_profile, N_("Delete PKCS#11 profile from the token") }, { "print-config", p11_kit_print_config, N_("Print merged configuration") }, + { "list-mechanisms", p11_kit_list_mechanisms, N_("List supported mechanisms") }, { "remote", p11_kit_external, N_("Run a specific PKCS#11 module remotely") }, { "server", p11_kit_external, N_("Run a server process that exposes PKCS#11 module remotely") }, { P11_TOOL_FALLBACK, p11_kit_external, NULL }, diff --git a/po/POTFILES.in b/po/POTFILES.in index c902f33a..11333ac6 100644 --- a/po/POTFILES.in +++ b/po/POTFILES.in @@ -9,6 +9,7 @@ p11-kit/filter.c p11-kit/generate-keypair.c p11-kit/list-objects.c p11-kit/list-profiles.c +p11-kit/list-mechanisms.c p11-kit/lists.c p11-kit/messages.c p11-kit/modules.c