Coverage Report

Created: 2025-08-26 06:31

/src/FreeRDP/winpr/libwinpr/ncrypt/ncrypt_pkcs11.c
Line
Count
Source (jump to first uncovered line)
1
/**
2
 * WinPR: Windows Portable Runtime
3
 * NCrypt pkcs11 provider
4
 *
5
 * Copyright 2021 David Fort <contact@hardening-consulting.com>
6
 *
7
 * Licensed under the Apache License, Version 2.0 (the "License");
8
 * you may not use this file except in compliance with the License.
9
 * You may obtain a copy of the License at
10
 *
11
 *     http://www.apache.org/licenses/LICENSE-2.0
12
 *
13
 * Unless required by applicable law or agreed to in writing, software
14
 * distributed under the License is distributed on an "AS IS" BASIS,
15
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16
 * See the License for the specific language governing permissions and
17
 * limitations under the License.
18
 */
19
20
#include <stdlib.h>
21
22
#include <winpr/library.h>
23
#include <winpr/assert.h>
24
#include <winpr/spec.h>
25
#include <winpr/smartcard.h>
26
#include <winpr/asn1.h>
27
28
#include "../log.h"
29
#include "ncrypt.h"
30
31
/* https://github.com/latchset/pkcs11-headers/blob/main/public-domain/3.1/pkcs11.h */
32
#include "pkcs11-headers/pkcs11.h"
33
34
#define TAG WINPR_TAG("ncryptp11")
35
36
0
#define MAX_SLOTS 64
37
#define MAX_KEYS 64
38
#define MAX_KEYS_PER_SLOT 64
39
40
/** @brief ncrypt provider handle */
41
typedef struct
42
{
43
  NCryptBaseProvider baseProvider;
44
45
  HANDLE library;
46
  CK_FUNCTION_LIST_PTR p11;
47
  char* modulePath;
48
} NCryptP11ProviderHandle;
49
50
/** @brief a handle returned by NCryptOpenKey */
51
typedef struct
52
{
53
  NCryptBaseHandle base;
54
  NCryptP11ProviderHandle* provider;
55
  CK_SLOT_ID slotId;
56
  CK_BYTE keyCertId[64];
57
  CK_ULONG keyCertIdLen;
58
} NCryptP11KeyHandle;
59
60
typedef struct
61
{
62
  CK_SLOT_ID slotId;
63
  CK_SLOT_INFO slotInfo;
64
  CK_KEY_TYPE keyType;
65
  CK_CHAR keyLabel[256];
66
  CK_ULONG idLen;
67
  CK_BYTE id[64];
68
} NCryptKeyEnum;
69
70
typedef struct
71
{
72
  CK_ULONG nslots;
73
  CK_SLOT_ID slots[MAX_SLOTS];
74
  CK_ULONG nKeys;
75
  NCryptKeyEnum keys[MAX_KEYS];
76
  CK_ULONG keyIndex;
77
} P11EnumKeysState;
78
79
typedef struct
80
{
81
  const char* label;
82
  BYTE tag[3];
83
} piv_cert_tags_t;
84
static const piv_cert_tags_t piv_cert_tags[] = {
85
  { "Certificate for PIV Authentication", "\x5F\xC1\x05" },
86
  { "Certificate for Digital Signature", "\x5F\xC1\x0A" },
87
  { "Certificate for Key Management", "\x5F\xC1\x0B" },
88
  { "Certificate for Card Authentication", "\x5F\xC1\x01" },
89
};
90
91
static const BYTE APDU_PIV_SELECT_AID[] = { 0x00, 0xA4, 0x04, 0x00, 0x09, 0xA0, 0x00, 0x00,
92
                                          0x03, 0x08, 0x00, 0x00, 0x10, 0x00, 0x00 };
93
static const BYTE APDU_PIV_GET_CHUID[] = { 0x00, 0xCB, 0x3F, 0xFF, 0x05, 0x5C,
94
                                         0x03, 0x5F, 0xC1, 0x02, 0x00 };
95
0
#define PIV_CONTAINER_NAME_LEN 36
96
97
static CK_OBJECT_CLASS object_class_public_key = CKO_PUBLIC_KEY;
98
static CK_BBOOL object_verify = CK_TRUE;
99
static CK_KEY_TYPE object_ktype_rsa = CKK_RSA;
100
101
static CK_ATTRIBUTE public_key_filter[] = {
102
  { CKA_CLASS, &object_class_public_key, sizeof(object_class_public_key) },
103
  { CKA_VERIFY, &object_verify, sizeof(object_verify) },
104
  { CKA_KEY_TYPE, &object_ktype_rsa, sizeof(object_ktype_rsa) }
105
};
106
107
static const char* CK_RV_error_string(CK_RV rv);
108
109
static SECURITY_STATUS NCryptP11StorageProvider_dtor(NCRYPT_HANDLE handle)
110
0
{
111
0
  NCryptP11ProviderHandle* provider = (NCryptP11ProviderHandle*)handle;
112
0
  CK_RV rv = CKR_OK;
113
114
0
  if (provider)
115
0
  {
116
0
    if (provider->p11 && provider->p11->C_Finalize)
117
0
      rv = provider->p11->C_Finalize(NULL);
118
0
    if (rv != CKR_OK)
119
0
      WLog_WARN(TAG, "C_Finalize failed with %s [0x%08" PRIx32 "]", CK_RV_error_string(rv),
120
0
                rv);
121
122
0
    free(provider->modulePath);
123
124
0
    if (provider->library)
125
0
      FreeLibrary(provider->library);
126
0
  }
127
128
0
  return winpr_NCryptDefault_dtor(handle);
129
0
}
130
131
static void fix_padded_string(char* str, size_t maxlen)
132
0
{
133
0
  if (maxlen == 0)
134
0
    return;
135
136
0
  WINPR_ASSERT(str);
137
0
  char* ptr = &str[maxlen - 1];
138
139
0
  while ((ptr > str) && (*ptr == ' '))
140
0
  {
141
0
    *ptr = '\0';
142
0
    ptr--;
143
0
  }
144
0
}
145
146
static BOOL attributes_have_unallocated_buffers(CK_ATTRIBUTE_PTR attributes, CK_ULONG count)
147
0
{
148
0
  for (CK_ULONG i = 0; i < count; i++)
149
0
  {
150
0
    if (!attributes[i].pValue && (attributes[i].ulValueLen != CK_UNAVAILABLE_INFORMATION))
151
0
      return TRUE;
152
0
  }
153
154
0
  return FALSE;
155
0
}
156
157
static BOOL attribute_allocate_attribute_array(CK_ATTRIBUTE_PTR attribute)
158
0
{
159
0
  WINPR_ASSERT(attribute);
160
0
  attribute->pValue = calloc(attribute->ulValueLen, sizeof(void*));
161
0
  return !!attribute->pValue;
162
0
}
163
164
static BOOL attribute_allocate_ulong_array(CK_ATTRIBUTE_PTR attribute)
165
0
{
166
0
  attribute->pValue = calloc(attribute->ulValueLen, sizeof(CK_ULONG));
167
0
  return !!attribute->pValue;
168
0
}
169
170
static BOOL attribute_allocate_buffer(CK_ATTRIBUTE_PTR attribute)
171
0
{
172
0
  attribute->pValue = calloc(attribute->ulValueLen, 1);
173
0
  return !!attribute->pValue;
174
0
}
175
176
static BOOL attributes_allocate_buffers(CK_ATTRIBUTE_PTR attributes, CK_ULONG count)
177
0
{
178
0
  BOOL ret = TRUE;
179
180
0
  for (CK_ULONG i = 0; i < count; i++)
181
0
  {
182
0
    if (attributes[i].pValue || (attributes[i].ulValueLen == CK_UNAVAILABLE_INFORMATION))
183
0
      continue;
184
185
0
    switch (attributes[i].type)
186
0
    {
187
0
      case CKA_WRAP_TEMPLATE:
188
0
      case CKA_UNWRAP_TEMPLATE:
189
0
        ret &= attribute_allocate_attribute_array(&attributes[i]);
190
0
        break;
191
192
0
      case CKA_ALLOWED_MECHANISMS:
193
0
        ret &= attribute_allocate_ulong_array(&attributes[i]);
194
0
        break;
195
196
0
      default:
197
0
        ret &= attribute_allocate_buffer(&attributes[i]);
198
0
        break;
199
0
    }
200
0
  }
201
202
0
  return ret;
203
0
}
204
205
static CK_RV object_load_attributes(NCryptP11ProviderHandle* provider, CK_SESSION_HANDLE session,
206
                                    CK_OBJECT_HANDLE object, CK_ATTRIBUTE_PTR attributes,
207
                                    CK_ULONG count)
208
0
{
209
0
  WINPR_ASSERT(provider);
210
0
  WINPR_ASSERT(provider->p11);
211
0
  WINPR_ASSERT(provider->p11->C_GetAttributeValue);
212
213
0
  CK_RV rv = provider->p11->C_GetAttributeValue(session, object, attributes, count);
214
215
0
  switch (rv)
216
0
  {
217
0
    case CKR_OK:
218
0
      if (!attributes_have_unallocated_buffers(attributes, count))
219
0
        return rv;
220
      /* fallthrough */
221
0
      WINPR_FALLTHROUGH
222
0
    case CKR_ATTRIBUTE_SENSITIVE:
223
0
    case CKR_ATTRIBUTE_TYPE_INVALID:
224
0
    case CKR_BUFFER_TOO_SMALL:
225
      /* attributes need some buffers for the result value */
226
0
      if (!attributes_allocate_buffers(attributes, count))
227
0
        return CKR_HOST_MEMORY;
228
229
0
      rv = provider->p11->C_GetAttributeValue(session, object, attributes, count);
230
0
      if (rv != CKR_OK)
231
0
        WLog_WARN(TAG, "C_GetAttributeValue failed with %s [0x%08" PRIx32 "]",
232
0
                  CK_RV_error_string(rv), rv);
233
0
      break;
234
0
    default:
235
0
      WLog_WARN(TAG, "C_GetAttributeValue failed with %s [0x%08" PRIx32 "]",
236
0
                CK_RV_error_string(rv), rv);
237
0
      return rv;
238
0
  }
239
240
0
  switch (rv)
241
0
  {
242
0
    case CKR_ATTRIBUTE_SENSITIVE:
243
0
    case CKR_ATTRIBUTE_TYPE_INVALID:
244
0
    case CKR_BUFFER_TOO_SMALL:
245
0
      WLog_ERR(TAG,
246
0
               "C_GetAttributeValue failed with %s [0x%08" PRIx32
247
0
               "] even after buffer allocation",
248
0
               CK_RV_error_string(rv), rv);
249
0
      break;
250
0
    default:
251
0
      break;
252
0
  }
253
0
  return rv;
254
0
}
255
256
static const char* CK_RV_error_string(CK_RV rv)
257
0
{
258
0
  static char generic_buffer[200];
259
0
#define ERR_ENTRY(X) \
260
0
  case X:          \
261
0
    return #X
262
263
0
  switch (rv)
264
0
  {
265
0
    ERR_ENTRY(CKR_OK);
266
0
    ERR_ENTRY(CKR_CANCEL);
267
0
    ERR_ENTRY(CKR_HOST_MEMORY);
268
0
    ERR_ENTRY(CKR_SLOT_ID_INVALID);
269
0
    ERR_ENTRY(CKR_GENERAL_ERROR);
270
0
    ERR_ENTRY(CKR_FUNCTION_FAILED);
271
0
    ERR_ENTRY(CKR_ARGUMENTS_BAD);
272
0
    ERR_ENTRY(CKR_NO_EVENT);
273
0
    ERR_ENTRY(CKR_NEED_TO_CREATE_THREADS);
274
0
    ERR_ENTRY(CKR_CANT_LOCK);
275
0
    ERR_ENTRY(CKR_ATTRIBUTE_READ_ONLY);
276
0
    ERR_ENTRY(CKR_ATTRIBUTE_SENSITIVE);
277
0
    ERR_ENTRY(CKR_ATTRIBUTE_TYPE_INVALID);
278
0
    ERR_ENTRY(CKR_ATTRIBUTE_VALUE_INVALID);
279
0
    ERR_ENTRY(CKR_DATA_INVALID);
280
0
    ERR_ENTRY(CKR_DATA_LEN_RANGE);
281
0
    ERR_ENTRY(CKR_DEVICE_ERROR);
282
0
    ERR_ENTRY(CKR_DEVICE_MEMORY);
283
0
    ERR_ENTRY(CKR_DEVICE_REMOVED);
284
0
    ERR_ENTRY(CKR_ENCRYPTED_DATA_INVALID);
285
0
    ERR_ENTRY(CKR_ENCRYPTED_DATA_LEN_RANGE);
286
0
    ERR_ENTRY(CKR_FUNCTION_CANCELED);
287
0
    ERR_ENTRY(CKR_FUNCTION_NOT_PARALLEL);
288
0
    ERR_ENTRY(CKR_FUNCTION_NOT_SUPPORTED);
289
0
    ERR_ENTRY(CKR_KEY_HANDLE_INVALID);
290
0
    ERR_ENTRY(CKR_KEY_SIZE_RANGE);
291
0
    ERR_ENTRY(CKR_KEY_TYPE_INCONSISTENT);
292
0
    ERR_ENTRY(CKR_KEY_NOT_NEEDED);
293
0
    ERR_ENTRY(CKR_KEY_CHANGED);
294
0
    ERR_ENTRY(CKR_KEY_NEEDED);
295
0
    ERR_ENTRY(CKR_KEY_INDIGESTIBLE);
296
0
    ERR_ENTRY(CKR_KEY_FUNCTION_NOT_PERMITTED);
297
0
    ERR_ENTRY(CKR_KEY_NOT_WRAPPABLE);
298
0
    ERR_ENTRY(CKR_KEY_UNEXTRACTABLE);
299
0
    ERR_ENTRY(CKR_MECHANISM_INVALID);
300
0
    ERR_ENTRY(CKR_MECHANISM_PARAM_INVALID);
301
0
    ERR_ENTRY(CKR_OBJECT_HANDLE_INVALID);
302
0
    ERR_ENTRY(CKR_OPERATION_ACTIVE);
303
0
    ERR_ENTRY(CKR_OPERATION_NOT_INITIALIZED);
304
0
    ERR_ENTRY(CKR_PIN_INCORRECT);
305
0
    ERR_ENTRY(CKR_PIN_INVALID);
306
0
    ERR_ENTRY(CKR_PIN_LEN_RANGE);
307
0
    ERR_ENTRY(CKR_PIN_EXPIRED);
308
0
    ERR_ENTRY(CKR_PIN_LOCKED);
309
0
    ERR_ENTRY(CKR_SESSION_CLOSED);
310
0
    ERR_ENTRY(CKR_SESSION_COUNT);
311
0
    ERR_ENTRY(CKR_SESSION_HANDLE_INVALID);
312
0
    ERR_ENTRY(CKR_SESSION_PARALLEL_NOT_SUPPORTED);
313
0
    ERR_ENTRY(CKR_SESSION_READ_ONLY);
314
0
    ERR_ENTRY(CKR_SESSION_EXISTS);
315
0
    ERR_ENTRY(CKR_SESSION_READ_ONLY_EXISTS);
316
0
    ERR_ENTRY(CKR_SESSION_READ_WRITE_SO_EXISTS);
317
0
    ERR_ENTRY(CKR_SIGNATURE_INVALID);
318
0
    ERR_ENTRY(CKR_SIGNATURE_LEN_RANGE);
319
0
    ERR_ENTRY(CKR_TEMPLATE_INCOMPLETE);
320
0
    ERR_ENTRY(CKR_TEMPLATE_INCONSISTENT);
321
0
    ERR_ENTRY(CKR_TOKEN_NOT_PRESENT);
322
0
    ERR_ENTRY(CKR_TOKEN_NOT_RECOGNIZED);
323
0
    ERR_ENTRY(CKR_TOKEN_WRITE_PROTECTED);
324
0
    ERR_ENTRY(CKR_UNWRAPPING_KEY_HANDLE_INVALID);
325
0
    ERR_ENTRY(CKR_UNWRAPPING_KEY_SIZE_RANGE);
326
0
    ERR_ENTRY(CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT);
327
0
    ERR_ENTRY(CKR_USER_ALREADY_LOGGED_IN);
328
0
    ERR_ENTRY(CKR_USER_NOT_LOGGED_IN);
329
0
    ERR_ENTRY(CKR_USER_PIN_NOT_INITIALIZED);
330
0
    ERR_ENTRY(CKR_USER_TYPE_INVALID);
331
0
    ERR_ENTRY(CKR_USER_ANOTHER_ALREADY_LOGGED_IN);
332
0
    ERR_ENTRY(CKR_USER_TOO_MANY_TYPES);
333
0
    ERR_ENTRY(CKR_WRAPPED_KEY_INVALID);
334
0
    ERR_ENTRY(CKR_WRAPPED_KEY_LEN_RANGE);
335
0
    ERR_ENTRY(CKR_WRAPPING_KEY_HANDLE_INVALID);
336
0
    ERR_ENTRY(CKR_WRAPPING_KEY_SIZE_RANGE);
337
0
    ERR_ENTRY(CKR_WRAPPING_KEY_TYPE_INCONSISTENT);
338
0
    ERR_ENTRY(CKR_RANDOM_SEED_NOT_SUPPORTED);
339
0
    ERR_ENTRY(CKR_RANDOM_NO_RNG);
340
0
    ERR_ENTRY(CKR_DOMAIN_PARAMS_INVALID);
341
0
    ERR_ENTRY(CKR_BUFFER_TOO_SMALL);
342
0
    ERR_ENTRY(CKR_SAVED_STATE_INVALID);
343
0
    ERR_ENTRY(CKR_INFORMATION_SENSITIVE);
344
0
    ERR_ENTRY(CKR_STATE_UNSAVEABLE);
345
0
    ERR_ENTRY(CKR_CRYPTOKI_NOT_INITIALIZED);
346
0
    ERR_ENTRY(CKR_CRYPTOKI_ALREADY_INITIALIZED);
347
0
    ERR_ENTRY(CKR_MUTEX_BAD);
348
0
    ERR_ENTRY(CKR_MUTEX_NOT_LOCKED);
349
0
    ERR_ENTRY(CKR_FUNCTION_REJECTED);
350
0
    default:
351
0
      (void)snprintf(generic_buffer, sizeof(generic_buffer), "unknown 0x%lx", rv);
352
0
      return generic_buffer;
353
0
  }
354
0
#undef ERR_ENTRY
355
0
}
356
357
#define loge(tag, msg, rv, index, slot) \
358
0
  log_((tag), (msg), (rv), (index), (slot), __FILE__, __func__, __LINE__)
359
static void log_(const char* tag, const char* msg, CK_RV rv, CK_ULONG index, CK_SLOT_ID slot,
360
                 const char* file, const char* fkt, size_t line)
361
0
{
362
0
  const DWORD log_level = WLOG_ERROR;
363
0
  static wLog* log_cached_ptr = NULL;
364
0
  if (!log_cached_ptr)
365
0
    log_cached_ptr = WLog_Get(tag);
366
0
  if (!WLog_IsLevelActive(log_cached_ptr, log_level))
367
0
    return;
368
369
0
  WLog_PrintTextMessage(log_cached_ptr, log_level, line, file, fkt,
370
0
                        "%s for slot #%lu(%lu), rv=%s", msg, index, slot, CK_RV_error_string(rv));
371
0
}
372
373
static SECURITY_STATUS collect_keys(NCryptP11ProviderHandle* provider, P11EnumKeysState* state)
374
0
{
375
0
  CK_OBJECT_HANDLE slotObjects[MAX_KEYS_PER_SLOT] = { 0 };
376
377
0
  WINPR_ASSERT(provider);
378
379
0
  CK_FUNCTION_LIST_PTR p11 = provider->p11;
380
0
  WINPR_ASSERT(p11);
381
382
0
  WLog_DBG(TAG, "checking %" PRIu32 " slots for valid keys...", state->nslots);
383
0
  state->nKeys = 0;
384
0
  for (CK_ULONG i = 0; i < state->nslots; i++)
385
0
  {
386
0
    CK_SESSION_HANDLE session = (CK_SESSION_HANDLE)NULL;
387
0
    CK_SLOT_INFO slotInfo = { 0 };
388
0
    CK_TOKEN_INFO tokenInfo = { 0 };
389
390
0
    WINPR_ASSERT(p11->C_GetSlotInfo);
391
0
    CK_RV rv = p11->C_GetSlotInfo(state->slots[i], &slotInfo);
392
0
    if (rv != CKR_OK)
393
0
    {
394
0
      loge(TAG, "unable to retrieve information", rv, i, state->slots[i]);
395
0
      continue;
396
0
    }
397
398
0
    fix_padded_string((char*)slotInfo.slotDescription, sizeof(slotInfo.slotDescription));
399
0
    WLog_DBG(TAG, "collecting keys for slot #%" PRIu32 "(%" PRIu32 ") descr='%s' flags=0x%x", i,
400
0
             state->slots[i], slotInfo.slotDescription, slotInfo.flags);
401
402
    /* this is a safety guard as we're supposed to have listed only readers with tokens in them
403
     */
404
0
    if (!(slotInfo.flags & CKF_TOKEN_PRESENT))
405
0
    {
406
0
      WLog_INFO(TAG, "token not present for slot #%" PRIu32 "(%" PRIu32 ")", i,
407
0
                state->slots[i]);
408
0
      continue;
409
0
    }
410
411
0
    WINPR_ASSERT(p11->C_GetTokenInfo);
412
0
    rv = p11->C_GetTokenInfo(state->slots[i], &tokenInfo);
413
0
    if (rv != CKR_OK)
414
0
      loge(TAG, "unable to retrieve token info", rv, i, state->slots[i]);
415
0
    else
416
0
    {
417
0
      fix_padded_string((char*)tokenInfo.label, sizeof(tokenInfo.label));
418
0
      WLog_DBG(TAG, "token, label='%s' flags=0x%x", tokenInfo.label, tokenInfo.flags);
419
0
    }
420
421
0
    WINPR_ASSERT(p11->C_OpenSession);
422
0
    rv = p11->C_OpenSession(state->slots[i], CKF_SERIAL_SESSION, NULL, NULL, &session);
423
0
    if (rv != CKR_OK)
424
0
    {
425
0
      WLog_ERR(TAG,
426
0
               "unable to openSession for slot #%" PRIu32 "(%" PRIu32 "), session=%p rv=%s",
427
0
               i, state->slots[i], session, CK_RV_error_string(rv));
428
0
      continue;
429
0
    }
430
431
0
    WINPR_ASSERT(p11->C_FindObjectsInit);
432
0
    rv = p11->C_FindObjectsInit(session, public_key_filter, ARRAYSIZE(public_key_filter));
433
0
    if (rv != CKR_OK)
434
0
    {
435
      // TODO: shall it be fatal ?
436
0
      loge(TAG, "unable to initiate search", rv, i, state->slots[i]);
437
0
      goto cleanup_FindObjectsInit;
438
0
    }
439
440
0
    CK_ULONG nslotObjects = 0;
441
0
    WINPR_ASSERT(p11->C_FindObjects);
442
0
    rv = p11->C_FindObjects(session, &slotObjects[0], ARRAYSIZE(slotObjects), &nslotObjects);
443
0
    if (rv != CKR_OK)
444
0
    {
445
0
      loge(TAG, "unable to findObjects", rv, i, state->slots[i]);
446
0
      goto cleanup_FindObjects;
447
0
    }
448
449
0
    WLog_DBG(TAG, "slot has %d objects", nslotObjects);
450
0
    for (CK_ULONG j = 0; j < nslotObjects; j++)
451
0
    {
452
0
      NCryptKeyEnum* key = &state->keys[state->nKeys];
453
0
      CK_OBJECT_CLASS dataClass = CKO_PUBLIC_KEY;
454
0
      CK_ATTRIBUTE key_or_certAttrs[] = {
455
0
        { CKA_ID, &key->id, sizeof(key->id) },
456
0
        { CKA_CLASS, &dataClass, sizeof(dataClass) },
457
0
        { CKA_LABEL, &key->keyLabel, sizeof(key->keyLabel) },
458
0
        { CKA_KEY_TYPE, &key->keyType, sizeof(key->keyType) }
459
0
      };
460
461
0
      rv = object_load_attributes(provider, session, slotObjects[j], key_or_certAttrs,
462
0
                                  ARRAYSIZE(key_or_certAttrs));
463
0
      if (rv != CKR_OK)
464
0
      {
465
0
        WLog_ERR(TAG, "error getting attributes, rv=%s", CK_RV_error_string(rv));
466
0
        continue;
467
0
      }
468
469
0
      key->idLen = key_or_certAttrs[0].ulValueLen;
470
0
      key->slotId = state->slots[i];
471
0
      key->slotInfo = slotInfo;
472
0
      state->nKeys++;
473
0
    }
474
475
0
  cleanup_FindObjects:
476
0
    WINPR_ASSERT(p11->C_FindObjectsFinal);
477
0
    rv = p11->C_FindObjectsFinal(session);
478
0
    if (rv != CKR_OK)
479
0
      loge(TAG, "error during C_FindObjectsFinal", rv, i, state->slots[i]);
480
0
  cleanup_FindObjectsInit:
481
0
    WINPR_ASSERT(p11->C_CloseSession);
482
0
    rv = p11->C_CloseSession(session);
483
0
    if (rv != CKR_OK)
484
0
      loge(TAG, "error closing session", rv, i, state->slots[i]);
485
0
  }
486
487
0
  return ERROR_SUCCESS;
488
0
}
489
490
static BOOL convertKeyType(CK_KEY_TYPE k, LPWSTR dest, DWORD len, DWORD* outlen)
491
0
{
492
0
  const WCHAR* r = NULL;
493
0
  size_t retLen = 0;
494
495
0
#define ALGO_CASE(V, S)                         \
496
0
  case V:                                     \
497
0
    r = S;                                  \
498
0
    retLen = _wcsnlen((S), ARRAYSIZE((S))); \
499
0
    break
500
0
  switch (k)
501
0
  {
502
0
    ALGO_CASE(CKK_RSA, BCRYPT_RSA_ALGORITHM);
503
0
    ALGO_CASE(CKK_DSA, BCRYPT_DSA_ALGORITHM);
504
0
    ALGO_CASE(CKK_DH, BCRYPT_DH_ALGORITHM);
505
0
    ALGO_CASE(CKK_EC, BCRYPT_ECDSA_ALGORITHM);
506
0
    ALGO_CASE(CKK_RC2, BCRYPT_RC2_ALGORITHM);
507
0
    ALGO_CASE(CKK_RC4, BCRYPT_RC4_ALGORITHM);
508
0
    ALGO_CASE(CKK_DES, BCRYPT_DES_ALGORITHM);
509
0
    ALGO_CASE(CKK_DES3, BCRYPT_3DES_ALGORITHM);
510
0
    case CKK_DES2:
511
0
    case CKK_X9_42_DH:
512
0
    case CKK_KEA:
513
0
    case CKK_GENERIC_SECRET:
514
0
    case CKK_CAST:
515
0
    case CKK_CAST3:
516
0
    case CKK_CAST128:
517
0
    case CKK_RC5:
518
0
    case CKK_IDEA:
519
0
    case CKK_SKIPJACK:
520
0
    case CKK_BATON:
521
0
    case CKK_JUNIPER:
522
0
    case CKK_CDMF:
523
0
    case CKK_AES:
524
0
    case CKK_BLOWFISH:
525
0
    case CKK_TWOFISH:
526
0
    default:
527
0
      break;
528
0
  }
529
0
#undef ALGO_CASE
530
531
0
  if (retLen > UINT32_MAX)
532
0
    return FALSE;
533
534
0
  if (outlen)
535
0
    *outlen = (UINT32)retLen;
536
537
0
  if (!r)
538
0
  {
539
0
    if (dest && len > 0)
540
0
      dest[0] = 0;
541
0
    return FALSE;
542
0
  }
543
544
0
  if (dest)
545
0
  {
546
0
    if (retLen + 1 > len)
547
0
    {
548
0
      WLog_ERR(TAG, "target buffer is too small for algo name");
549
0
      return FALSE;
550
0
    }
551
552
0
    memcpy(dest, r, sizeof(WCHAR) * retLen);
553
0
    dest[retLen] = 0;
554
0
  }
555
556
0
  return TRUE;
557
0
}
558
559
static void wprintKeyName(LPWSTR str, CK_SLOT_ID slotId, CK_BYTE* id, CK_ULONG idLen)
560
0
{
561
0
  char asciiName[128] = { 0 };
562
0
  char* ptr = asciiName;
563
0
  const CK_BYTE* bytePtr = NULL;
564
565
0
  *ptr = '\\';
566
0
  ptr++;
567
568
0
  bytePtr = ((CK_BYTE*)&slotId);
569
0
  for (CK_ULONG i = 0; i < sizeof(slotId); i++, bytePtr++, ptr += 2)
570
0
    (void)snprintf(ptr, 3, "%.2x", *bytePtr);
571
572
0
  *ptr = '\\';
573
0
  ptr++;
574
575
0
  for (CK_ULONG i = 0; i < idLen; i++, id++, ptr += 2)
576
0
    (void)snprintf(ptr, 3, "%.2x", *id);
577
578
0
  (void)ConvertUtf8NToWChar(asciiName, ARRAYSIZE(asciiName), str,
579
0
                            strnlen(asciiName, ARRAYSIZE(asciiName)) + 1);
580
0
}
581
582
static size_t parseHex(const char* str, const char* end, CK_BYTE* target)
583
0
{
584
0
  size_t ret = 0;
585
586
0
  for (; str != end && *str; str++, ret++, target++)
587
0
  {
588
0
    int v = 0;
589
0
    if (*str <= '9' && *str >= '0')
590
0
    {
591
0
      v = (*str - '0');
592
0
    }
593
0
    else if (*str <= 'f' && *str >= 'a')
594
0
    {
595
0
      v = (10 + *str - 'a');
596
0
    }
597
0
    else if (*str <= 'F' && *str >= 'A')
598
0
    {
599
0
      v |= (10 + *str - 'A');
600
0
    }
601
0
    else
602
0
    {
603
0
      return 0;
604
0
    }
605
0
    v <<= 4;
606
0
    str++;
607
608
0
    if (!*str || str == end)
609
0
      return 0;
610
611
0
    if (*str <= '9' && *str >= '0')
612
0
    {
613
0
      v |= (*str - '0');
614
0
    }
615
0
    else if (*str <= 'f' && *str >= 'a')
616
0
    {
617
0
      v |= (10 + *str - 'a');
618
0
    }
619
0
    else if (*str <= 'F' && *str >= 'A')
620
0
    {
621
0
      v |= (10 + *str - 'A');
622
0
    }
623
0
    else
624
0
    {
625
0
      return 0;
626
0
    }
627
628
0
    *target = v & 0xFF;
629
0
  }
630
0
  return ret;
631
0
}
632
633
static SECURITY_STATUS parseKeyName(LPCWSTR pszKeyName, CK_SLOT_ID* slotId, CK_BYTE* id,
634
                                    CK_ULONG* idLen)
635
0
{
636
0
  char asciiKeyName[128] = { 0 };
637
0
  char* pos = NULL;
638
639
0
  if (ConvertWCharToUtf8(pszKeyName, asciiKeyName, ARRAYSIZE(asciiKeyName)) < 0)
640
0
    return NTE_BAD_KEY;
641
642
0
  if (*asciiKeyName != '\\')
643
0
    return NTE_BAD_KEY;
644
645
0
  pos = strchr(&asciiKeyName[1], '\\');
646
0
  if (!pos)
647
0
    return NTE_BAD_KEY;
648
649
0
  if ((size_t)(pos - &asciiKeyName[1]) > sizeof(CK_SLOT_ID) * 2ull)
650
0
    return NTE_BAD_KEY;
651
652
0
  *slotId = (CK_SLOT_ID)0;
653
0
  if (parseHex(&asciiKeyName[1], pos, (CK_BYTE*)slotId) != sizeof(CK_SLOT_ID))
654
0
    return NTE_BAD_KEY;
655
656
0
  *idLen = parseHex(pos + 1, NULL, id);
657
0
  if (!*idLen)
658
0
    return NTE_BAD_KEY;
659
660
0
  return ERROR_SUCCESS;
661
0
}
662
663
static SECURITY_STATUS NCryptP11EnumKeys(NCRYPT_PROV_HANDLE hProvider, LPCWSTR pszScope,
664
                                         NCryptKeyName** ppKeyName, PVOID* ppEnumState,
665
                                         WINPR_ATTR_UNUSED DWORD dwFlags)
666
0
{
667
0
  NCryptP11ProviderHandle* provider = (NCryptP11ProviderHandle*)hProvider;
668
0
  P11EnumKeysState* state = (P11EnumKeysState*)*ppEnumState;
669
0
  CK_RV rv = { 0 };
670
0
  CK_SLOT_ID currentSlot = { 0 };
671
0
  CK_SESSION_HANDLE currentSession = (CK_SESSION_HANDLE)NULL;
672
0
  char slotFilterBuffer[65] = { 0 };
673
0
  char* slotFilter = NULL;
674
0
  size_t slotFilterLen = 0;
675
676
0
  SECURITY_STATUS ret = checkNCryptHandle((NCRYPT_HANDLE)hProvider, WINPR_NCRYPT_PROVIDER);
677
0
  if (ret != ERROR_SUCCESS)
678
0
    return ret;
679
680
0
  if (pszScope)
681
0
  {
682
    /*
683
     * check whether pszScope is of the form \\.\<reader name>\ for filtering by
684
     * card reader
685
     */
686
0
    char asciiScope[128 + 6 + 1] = { 0 };
687
0
    size_t asciiScopeLen = 0;
688
689
0
    if (ConvertWCharToUtf8(pszScope, asciiScope, ARRAYSIZE(asciiScope) - 1) < 0)
690
0
    {
691
0
      WLog_WARN(TAG, "Invalid scope");
692
0
      return NTE_INVALID_PARAMETER;
693
0
    }
694
695
0
    if (strstr(asciiScope, "\\\\.\\") != asciiScope)
696
0
    {
697
0
      WLog_WARN(TAG, "Invalid scope '%s'", asciiScope);
698
0
      return NTE_INVALID_PARAMETER;
699
0
    }
700
701
0
    asciiScopeLen = strnlen(asciiScope, ARRAYSIZE(asciiScope));
702
0
    if ((asciiScopeLen < 1) || (asciiScope[asciiScopeLen - 1] != '\\'))
703
0
    {
704
0
      WLog_WARN(TAG, "Invalid scope '%s'", asciiScope);
705
0
      return NTE_INVALID_PARAMETER;
706
0
    }
707
708
0
    asciiScope[asciiScopeLen - 1] = 0;
709
710
0
    strncpy(slotFilterBuffer, &asciiScope[4], sizeof(slotFilterBuffer));
711
0
    slotFilter = slotFilterBuffer;
712
0
    slotFilterLen = asciiScopeLen - 5;
713
0
  }
714
715
0
  if (!state)
716
0
  {
717
0
    state = (P11EnumKeysState*)calloc(1, sizeof(*state));
718
0
    if (!state)
719
0
      return NTE_NO_MEMORY;
720
721
0
    WINPR_ASSERT(provider->p11->C_GetSlotList);
722
0
    rv = provider->p11->C_GetSlotList(CK_TRUE, NULL, &state->nslots);
723
0
    if (rv != CKR_OK)
724
0
    {
725
0
      free(state);
726
      /* TODO: perhaps convert rv to NTE_*** errors */
727
0
      WLog_WARN(TAG, "C_GetSlotList failed with %s [0x%08" PRIx32 "]", CK_RV_error_string(rv),
728
0
                rv);
729
0
      return NTE_FAIL;
730
0
    }
731
732
0
    if (state->nslots > MAX_SLOTS)
733
0
      state->nslots = MAX_SLOTS;
734
735
0
    rv = provider->p11->C_GetSlotList(CK_TRUE, state->slots, &state->nslots);
736
0
    if (rv != CKR_OK)
737
0
    {
738
0
      free(state);
739
      /* TODO: perhaps convert rv to NTE_*** errors */
740
0
      WLog_WARN(TAG, "C_GetSlotList failed with %s [0x%08" PRIx32 "]", CK_RV_error_string(rv),
741
0
                rv);
742
0
      return NTE_FAIL;
743
0
    }
744
745
0
    ret = collect_keys(provider, state);
746
0
    if (ret != ERROR_SUCCESS)
747
0
    {
748
0
      free(state);
749
0
      return ret;
750
0
    }
751
752
0
    *ppEnumState = state;
753
0
  }
754
755
0
  for (; state->keyIndex < state->nKeys; state->keyIndex++)
756
0
  {
757
0
    NCryptKeyName* keyName = NULL;
758
0
    NCryptKeyEnum* key = &state->keys[state->keyIndex];
759
0
    CK_OBJECT_CLASS oclass = CKO_CERTIFICATE;
760
0
    CK_CERTIFICATE_TYPE ctype = CKC_X_509;
761
0
    CK_ATTRIBUTE certificateFilter[] = { { CKA_CLASS, &oclass, sizeof(oclass) },
762
0
                                       { CKA_CERTIFICATE_TYPE, &ctype, sizeof(ctype) },
763
0
                                       { CKA_ID, key->id, key->idLen } };
764
0
    CK_ULONG ncertObjects = 0;
765
0
    CK_OBJECT_HANDLE certObject = 0;
766
767
    /* check the reader filter if any */
768
0
    if (slotFilter && memcmp(key->slotInfo.slotDescription, slotFilter, slotFilterLen) != 0)
769
0
      continue;
770
771
0
    if (!currentSession || (currentSlot != key->slotId))
772
0
    {
773
      /* if the current session doesn't match the current key's slot, open a new one
774
       */
775
0
      if (currentSession)
776
0
      {
777
0
        WINPR_ASSERT(provider->p11->C_CloseSession);
778
0
        rv = provider->p11->C_CloseSession(currentSession);
779
0
        if (rv != CKR_OK)
780
0
          WLog_WARN(TAG, "C_CloseSession failed with %s [0x%08" PRIx32 "]",
781
0
                    CK_RV_error_string(rv), rv);
782
0
        currentSession = (CK_SESSION_HANDLE)NULL;
783
0
      }
784
785
0
      WINPR_ASSERT(provider->p11->C_OpenSession);
786
0
      rv = provider->p11->C_OpenSession(key->slotId, CKF_SERIAL_SESSION, NULL, NULL,
787
0
                                        &currentSession);
788
0
      if (rv != CKR_OK)
789
0
      {
790
0
        WLog_ERR(TAG, "C_OpenSession failed with %s [0x%08" PRIx32 "] for slot %d",
791
0
                 CK_RV_error_string(rv), rv, key->slotId);
792
0
        continue;
793
0
      }
794
0
      currentSlot = key->slotId;
795
0
    }
796
797
    /* look if we can find a certificate that matches the key's id */
798
0
    WINPR_ASSERT(provider->p11->C_FindObjectsInit);
799
0
    rv = provider->p11->C_FindObjectsInit(currentSession, certificateFilter,
800
0
                                          ARRAYSIZE(certificateFilter));
801
0
    if (rv != CKR_OK)
802
0
    {
803
0
      WLog_ERR(TAG, "C_FindObjectsInit failed with %s [0x%08" PRIx32 "] for slot %d",
804
0
               CK_RV_error_string(rv), rv, key->slotId);
805
0
      continue;
806
0
    }
807
808
0
    WINPR_ASSERT(provider->p11->C_FindObjects);
809
0
    rv = provider->p11->C_FindObjects(currentSession, &certObject, 1, &ncertObjects);
810
0
    if (rv != CKR_OK)
811
0
    {
812
0
      WLog_ERR(TAG, "C_FindObjects failed with %s [0x%08" PRIx32 "] for slot %d",
813
0
               CK_RV_error_string(rv), rv, currentSlot);
814
0
      goto cleanup_FindObjects;
815
0
    }
816
817
0
    if (ncertObjects)
818
0
    {
819
      /* sizeof keyName struct + "\<slotId>\<certId>" + keyName->pszAlgid */
820
0
      DWORD algoSz = 0;
821
0
      size_t KEYNAME_SZ =
822
0
          (1 + (sizeof(key->slotId) * 2) /*slotId*/ + 1 + (key->idLen * 2) + 1) * 2;
823
824
0
      convertKeyType(key->keyType, NULL, 0, &algoSz);
825
0
      KEYNAME_SZ += (1ULL + algoSz) * 2ULL;
826
827
0
      keyName = calloc(1, sizeof(*keyName) + KEYNAME_SZ);
828
0
      if (!keyName)
829
0
      {
830
0
        WLog_ERR(TAG, "unable to allocate keyName");
831
0
        goto cleanup_FindObjects;
832
0
      }
833
0
      keyName->dwLegacyKeySpec = AT_KEYEXCHANGE | AT_SIGNATURE;
834
0
      keyName->dwFlags = NCRYPT_MACHINE_KEY_FLAG;
835
0
      keyName->pszName = (LPWSTR)(keyName + 1);
836
0
      wprintKeyName(keyName->pszName, key->slotId, key->id, key->idLen);
837
838
0
      keyName->pszAlgid = keyName->pszName + _wcslen(keyName->pszName) + 1;
839
0
      convertKeyType(key->keyType, keyName->pszAlgid, algoSz + 1, NULL);
840
0
    }
841
842
0
  cleanup_FindObjects:
843
0
    WINPR_ASSERT(provider->p11->C_FindObjectsFinal);
844
0
    rv = provider->p11->C_FindObjectsFinal(currentSession);
845
0
    if (rv != CKR_OK)
846
0
      WLog_ERR(TAG, "C_FindObjectsFinal failed with %s [0x%08" PRIx32 "]",
847
0
               CK_RV_error_string(rv), rv);
848
849
0
    if (keyName)
850
0
    {
851
0
      *ppKeyName = keyName;
852
0
      state->keyIndex++;
853
0
      return ERROR_SUCCESS;
854
0
    }
855
0
  }
856
857
0
  return NTE_NO_MORE_ITEMS;
858
0
}
859
860
static SECURITY_STATUS get_piv_container_name(NCryptP11KeyHandle* key, const BYTE* piv_tag,
861
                                              BYTE* output, size_t output_len)
862
0
{
863
0
  CK_SLOT_INFO slot_info = { 0 };
864
0
  CK_FUNCTION_LIST_PTR p11 = NULL;
865
0
  WCHAR* reader = NULL;
866
0
  SCARDCONTEXT context = 0;
867
0
  SCARDHANDLE card = 0;
868
0
  DWORD proto = 0;
869
0
  const SCARD_IO_REQUEST* pci = NULL;
870
0
  BYTE buf[258] = { 0 };
871
0
  char container_name[PIV_CONTAINER_NAME_LEN + 1] = { 0 };
872
0
  DWORD buf_len = 0;
873
0
  SECURITY_STATUS ret = NTE_BAD_KEY;
874
0
  WinPrAsn1Decoder dec = { 0 };
875
0
  WinPrAsn1Decoder dec2 = { 0 };
876
0
  size_t len = 0;
877
0
  BYTE tag = 0;
878
0
  BYTE* p = NULL;
879
0
  wStream s = { 0 };
880
881
0
  WINPR_ASSERT(key);
882
0
  WINPR_ASSERT(piv_tag);
883
884
0
  WINPR_ASSERT(key->provider);
885
0
  p11 = key->provider->p11;
886
0
  WINPR_ASSERT(p11);
887
888
  /* Get the reader the card is in */
889
0
  WINPR_ASSERT(p11->C_GetSlotInfo);
890
0
  if (p11->C_GetSlotInfo(key->slotId, &slot_info) != CKR_OK)
891
0
    return NTE_BAD_KEY;
892
893
0
  fix_padded_string((char*)slot_info.slotDescription, sizeof(slot_info.slotDescription));
894
0
  reader = ConvertUtf8NToWCharAlloc((char*)slot_info.slotDescription,
895
0
                                    ARRAYSIZE(slot_info.slotDescription), NULL);
896
0
  ret = NTE_NO_MEMORY;
897
0
  if (!reader)
898
0
    goto out;
899
900
0
  ret = NTE_BAD_KEY;
901
0
  if (SCardEstablishContext(SCARD_SCOPE_USER, NULL, NULL, &context) != SCARD_S_SUCCESS)
902
0
    goto out;
903
904
0
  if (SCardConnectW(context, reader, SCARD_SHARE_SHARED, SCARD_PROTOCOL_Tx, &card, &proto) !=
905
0
      SCARD_S_SUCCESS)
906
0
    goto out;
907
0
  pci = (proto == SCARD_PROTOCOL_T0) ? SCARD_PCI_T0 : SCARD_PCI_T1;
908
909
0
  buf_len = sizeof(buf);
910
0
  if (SCardTransmit(card, pci, APDU_PIV_SELECT_AID, sizeof(APDU_PIV_SELECT_AID), NULL, buf,
911
0
                    &buf_len) != SCARD_S_SUCCESS)
912
0
    goto out;
913
0
  if ((buf[buf_len - 2] != 0x90 || buf[buf_len - 1] != 0) && buf[buf_len - 2] != 0x61)
914
0
    goto out;
915
916
0
  buf_len = sizeof(buf);
917
0
  if (SCardTransmit(card, pci, APDU_PIV_GET_CHUID, sizeof(APDU_PIV_GET_CHUID), NULL, buf,
918
0
                    &buf_len) != SCARD_S_SUCCESS)
919
0
    goto out;
920
0
  if ((buf[buf_len - 2] != 0x90 || buf[buf_len - 1] != 0) && buf[buf_len - 2] != 0x61)
921
0
    goto out;
922
923
  /* Find the GUID field in the CHUID data object */
924
0
  WinPrAsn1Decoder_InitMem(&dec, WINPR_ASN1_BER, buf, buf_len);
925
0
  if (!WinPrAsn1DecReadTagAndLen(&dec, &tag, &len) || tag != 0x53)
926
0
    goto out;
927
0
  while (WinPrAsn1DecReadTagLenValue(&dec, &tag, &len, &dec2) && tag != 0x34)
928
0
    ;
929
0
  if (tag != 0x34 || len != 16)
930
0
    goto out;
931
932
0
  s = WinPrAsn1DecGetStream(&dec2);
933
0
  p = Stream_Buffer(&s);
934
935
  /* Construct the value Windows would use for a PIV key's container name */
936
0
  (void)snprintf(container_name, PIV_CONTAINER_NAME_LEN + 1,
937
0
                 "%.2x%.2x%.2x%.2x-%.2x%.2x-%.2x%.2x-%.2x%.2x-%.2x%.2x%.2x%.2x%.2x%.2x", p[3],
938
0
                 p[2], p[1], p[0], p[5], p[4], p[7], p[6], p[8], p[9], p[10], p[11], p[12],
939
0
                 piv_tag[0], piv_tag[1], piv_tag[2]);
940
941
  /* And convert it to UTF-16 */
942
0
  union
943
0
  {
944
0
    WCHAR* wc;
945
0
    BYTE* b;
946
0
  } cnv;
947
0
  cnv.b = output;
948
0
  if (ConvertUtf8NToWChar(container_name, ARRAYSIZE(container_name), cnv.wc,
949
0
                          output_len / sizeof(WCHAR)) > 0)
950
0
    ret = ERROR_SUCCESS;
951
952
0
out:
953
0
  free(reader);
954
0
  if (card)
955
0
    SCardDisconnect(card, SCARD_LEAVE_CARD);
956
0
  if (context)
957
0
    SCardReleaseContext(context);
958
0
  return ret;
959
0
}
960
961
static SECURITY_STATUS check_for_piv_container_name(NCryptP11KeyHandle* key, BYTE* pbOutput,
962
                                                    DWORD cbOutput, DWORD* pcbResult, char* label,
963
                                                    size_t label_len)
964
0
{
965
0
  for (size_t i = 0; i < ARRAYSIZE(piv_cert_tags); i++)
966
0
  {
967
0
    const piv_cert_tags_t* cur = &piv_cert_tags[i];
968
0
    if (strncmp(label, cur->label, label_len) == 0)
969
0
    {
970
0
      *pcbResult = (PIV_CONTAINER_NAME_LEN + 1) * sizeof(WCHAR);
971
0
      if (!pbOutput)
972
0
        return ERROR_SUCCESS;
973
0
      else if (cbOutput < (PIV_CONTAINER_NAME_LEN + 1) * sizeof(WCHAR))
974
0
        return NTE_NO_MEMORY;
975
0
      else
976
0
        return get_piv_container_name(key, cur->tag, pbOutput, cbOutput);
977
0
    }
978
0
  }
979
0
  return NTE_NOT_FOUND;
980
0
}
981
982
static SECURITY_STATUS NCryptP11KeyGetProperties(NCryptP11KeyHandle* keyHandle,
983
                                                 NCryptKeyGetPropertyEnum property, PBYTE pbOutput,
984
                                                 DWORD cbOutput, DWORD* pcbResult,
985
                                                 WINPR_ATTR_UNUSED DWORD dwFlags)
986
0
{
987
0
  SECURITY_STATUS ret = NTE_FAIL;
988
0
  CK_RV rv = 0;
989
0
  CK_SESSION_HANDLE session = 0;
990
0
  CK_OBJECT_HANDLE objectHandle = 0;
991
0
  CK_ULONG objectCount = 0;
992
0
  NCryptP11ProviderHandle* provider = NULL;
993
0
  CK_OBJECT_CLASS oclass = CKO_CERTIFICATE;
994
0
  CK_CERTIFICATE_TYPE ctype = CKC_X_509;
995
0
  CK_ATTRIBUTE certificateFilter[] = { { CKA_CLASS, &oclass, sizeof(oclass) },
996
0
                                     { CKA_CERTIFICATE_TYPE, &ctype, sizeof(ctype) },
997
0
                                     { CKA_ID, keyHandle->keyCertId,
998
0
                                       keyHandle->keyCertIdLen } };
999
0
  CK_ATTRIBUTE* objectFilter = certificateFilter;
1000
0
  CK_ULONG objectFilterLen = ARRAYSIZE(certificateFilter);
1001
1002
0
  WINPR_ASSERT(keyHandle);
1003
0
  provider = keyHandle->provider;
1004
0
  WINPR_ASSERT(provider);
1005
1006
0
  switch (property)
1007
1008
0
  {
1009
0
    case NCRYPT_PROPERTY_CERTIFICATE:
1010
0
    case NCRYPT_PROPERTY_NAME:
1011
0
      break;
1012
0
    case NCRYPT_PROPERTY_READER:
1013
0
    {
1014
0
      CK_SLOT_INFO slotInfo;
1015
1016
0
      WINPR_ASSERT(provider->p11->C_GetSlotInfo);
1017
0
      rv = provider->p11->C_GetSlotInfo(keyHandle->slotId, &slotInfo);
1018
0
      if (rv != CKR_OK)
1019
0
        return NTE_BAD_KEY;
1020
1021
0
#define SLOT_DESC_SZ sizeof(slotInfo.slotDescription)
1022
0
      fix_padded_string((char*)slotInfo.slotDescription, SLOT_DESC_SZ);
1023
0
      const size_t len = 2ULL * (strnlen((char*)slotInfo.slotDescription, SLOT_DESC_SZ) + 1);
1024
0
      if (len > UINT32_MAX)
1025
0
        return NTE_BAD_DATA;
1026
0
      *pcbResult = (UINT32)len;
1027
0
      if (pbOutput)
1028
0
      {
1029
0
        union
1030
0
        {
1031
0
          WCHAR* wc;
1032
0
          BYTE* b;
1033
0
        } cnv;
1034
0
        cnv.b = pbOutput;
1035
0
        if (cbOutput < *pcbResult)
1036
0
          return NTE_NO_MEMORY;
1037
1038
0
        if (ConvertUtf8ToWChar((char*)slotInfo.slotDescription, cnv.wc,
1039
0
                               cbOutput / sizeof(WCHAR)) < 0)
1040
0
          return NTE_NO_MEMORY;
1041
0
      }
1042
0
      return ERROR_SUCCESS;
1043
0
    }
1044
0
    case NCRYPT_PROPERTY_SLOTID:
1045
0
    {
1046
0
      *pcbResult = 4;
1047
0
      if (pbOutput)
1048
0
      {
1049
0
        UINT32* ptr = (UINT32*)pbOutput;
1050
1051
0
        if (cbOutput < 4)
1052
0
          return NTE_NO_MEMORY;
1053
0
        if (keyHandle->slotId > UINT32_MAX)
1054
0
        {
1055
0
          ret = NTE_BAD_DATA;
1056
0
          goto out_final;
1057
0
        }
1058
0
        *ptr = (UINT32)keyHandle->slotId;
1059
0
      }
1060
0
      return ERROR_SUCCESS;
1061
0
    }
1062
0
    case NCRYPT_PROPERTY_UNKNOWN:
1063
0
    default:
1064
0
      return NTE_NOT_SUPPORTED;
1065
0
  }
1066
1067
0
  WINPR_ASSERT(provider->p11->C_OpenSession);
1068
0
  rv = provider->p11->C_OpenSession(keyHandle->slotId, CKF_SERIAL_SESSION, NULL, NULL, &session);
1069
0
  if (rv != CKR_OK)
1070
0
  {
1071
0
    WLog_ERR(TAG, "error opening session on slot %d", keyHandle->slotId);
1072
0
    return NTE_FAIL;
1073
0
  }
1074
1075
0
  WINPR_ASSERT(provider->p11->C_FindObjectsInit);
1076
0
  rv = provider->p11->C_FindObjectsInit(session, objectFilter, objectFilterLen);
1077
0
  if (rv != CKR_OK)
1078
0
  {
1079
0
    WLog_ERR(TAG, "unable to initiate search for slot %d", keyHandle->slotId);
1080
0
    goto out;
1081
0
  }
1082
1083
0
  WINPR_ASSERT(provider->p11->C_FindObjects);
1084
0
  rv = provider->p11->C_FindObjects(session, &objectHandle, 1, &objectCount);
1085
0
  if (rv != CKR_OK)
1086
0
  {
1087
0
    WLog_ERR(TAG, "unable to findObjects for slot %d", keyHandle->slotId);
1088
0
    goto out_final;
1089
0
  }
1090
0
  if (!objectCount)
1091
0
  {
1092
0
    ret = NTE_NOT_FOUND;
1093
0
    goto out_final;
1094
0
  }
1095
1096
0
  switch (property)
1097
0
  {
1098
0
    case NCRYPT_PROPERTY_CERTIFICATE:
1099
0
    {
1100
0
      CK_ATTRIBUTE certValue = { CKA_VALUE, pbOutput, cbOutput };
1101
1102
0
      WINPR_ASSERT(provider->p11->C_GetAttributeValue);
1103
0
      rv = provider->p11->C_GetAttributeValue(session, objectHandle, &certValue, 1);
1104
0
      if (rv != CKR_OK)
1105
0
      {
1106
        // TODO: do a kind of translation from CKR_* to NTE_*
1107
0
      }
1108
1109
0
      if (certValue.ulValueLen > UINT32_MAX)
1110
0
      {
1111
0
        ret = NTE_BAD_DATA;
1112
0
        goto out_final;
1113
0
      }
1114
0
      *pcbResult = (UINT32)certValue.ulValueLen;
1115
0
      ret = ERROR_SUCCESS;
1116
0
      break;
1117
0
    }
1118
0
    case NCRYPT_PROPERTY_NAME:
1119
0
    {
1120
0
      CK_ATTRIBUTE attr = { CKA_LABEL, NULL, 0 };
1121
0
      char* label = NULL;
1122
1123
0
      WINPR_ASSERT(provider->p11->C_GetAttributeValue);
1124
0
      rv = provider->p11->C_GetAttributeValue(session, objectHandle, &attr, 1);
1125
0
      if (rv == CKR_OK)
1126
0
      {
1127
0
        label = calloc(1, attr.ulValueLen);
1128
0
        if (!label)
1129
0
        {
1130
0
          ret = NTE_NO_MEMORY;
1131
0
          break;
1132
0
        }
1133
1134
0
        attr.pValue = label;
1135
0
        rv = provider->p11->C_GetAttributeValue(session, objectHandle, &attr, 1);
1136
0
      }
1137
1138
0
      if (rv == CKR_OK)
1139
0
      {
1140
        /* Check if we have a PIV card */
1141
0
        ret = check_for_piv_container_name(keyHandle, pbOutput, cbOutput, pcbResult, label,
1142
0
                                           attr.ulValueLen);
1143
1144
        /* Otherwise, at least for GIDS cards the label will be the correct value */
1145
0
        if (ret == NTE_NOT_FOUND)
1146
0
        {
1147
0
          union
1148
0
          {
1149
0
            WCHAR* wc;
1150
0
            BYTE* b;
1151
0
          } cnv;
1152
0
          const size_t olen = pbOutput ? cbOutput / sizeof(WCHAR) : 0;
1153
0
          cnv.b = pbOutput;
1154
0
          SSIZE_T size = ConvertUtf8NToWChar(label, attr.ulValueLen, cnv.wc, olen);
1155
0
          if (size < 0)
1156
0
            ret = ERROR_CONVERT_TO_LARGE;
1157
0
          else
1158
0
            ret = ERROR_SUCCESS;
1159
0
        }
1160
0
      }
1161
1162
0
      free(label);
1163
0
      break;
1164
0
    }
1165
0
    default:
1166
0
      ret = NTE_NOT_SUPPORTED;
1167
0
      break;
1168
0
  }
1169
1170
0
out_final:
1171
0
  WINPR_ASSERT(provider->p11->C_FindObjectsFinal);
1172
0
  rv = provider->p11->C_FindObjectsFinal(session);
1173
0
  if (rv != CKR_OK)
1174
0
  {
1175
0
    WLog_ERR(TAG, "error in C_FindObjectsFinal() for slot %d", keyHandle->slotId);
1176
0
  }
1177
0
out:
1178
0
  WINPR_ASSERT(provider->p11->C_CloseSession);
1179
0
  rv = provider->p11->C_CloseSession(session);
1180
0
  if (rv != CKR_OK)
1181
0
  {
1182
0
    WLog_ERR(TAG, "error in C_CloseSession() for slot %d", keyHandle->slotId);
1183
0
  }
1184
0
  return ret;
1185
0
}
1186
1187
static SECURITY_STATUS NCryptP11GetProperty(NCRYPT_HANDLE hObject, NCryptKeyGetPropertyEnum prop,
1188
                                            PBYTE pbOutput, DWORD cbOutput, DWORD* pcbResult,
1189
                                            DWORD dwFlags)
1190
0
{
1191
0
  NCryptBaseHandle* base = (NCryptBaseHandle*)hObject;
1192
1193
0
  WINPR_ASSERT(base);
1194
0
  switch (base->type)
1195
0
  {
1196
0
    case WINPR_NCRYPT_PROVIDER:
1197
0
      return ERROR_CALL_NOT_IMPLEMENTED;
1198
0
    case WINPR_NCRYPT_KEY:
1199
0
      return NCryptP11KeyGetProperties((NCryptP11KeyHandle*)hObject, prop, pbOutput, cbOutput,
1200
0
                                       pcbResult, dwFlags);
1201
0
    default:
1202
0
      return ERROR_INVALID_HANDLE;
1203
0
  }
1204
0
  return ERROR_SUCCESS;
1205
0
}
1206
1207
static SECURITY_STATUS NCryptP11OpenKey(NCRYPT_PROV_HANDLE hProvider, NCRYPT_KEY_HANDLE* phKey,
1208
                                        LPCWSTR pszKeyName, WINPR_ATTR_UNUSED DWORD dwLegacyKeySpec,
1209
                                        WINPR_ATTR_UNUSED DWORD dwFlags)
1210
0
{
1211
0
  SECURITY_STATUS ret = 0;
1212
0
  CK_SLOT_ID slotId = 0;
1213
0
  CK_BYTE keyCertId[64] = { 0 };
1214
0
  CK_ULONG keyCertIdLen = 0;
1215
0
  NCryptP11KeyHandle* keyHandle = NULL;
1216
1217
0
  ret = parseKeyName(pszKeyName, &slotId, keyCertId, &keyCertIdLen);
1218
0
  if (ret != ERROR_SUCCESS)
1219
0
    return ret;
1220
1221
0
  keyHandle = (NCryptP11KeyHandle*)ncrypt_new_handle(
1222
0
      WINPR_NCRYPT_KEY, sizeof(*keyHandle), NCryptP11GetProperty, winpr_NCryptDefault_dtor);
1223
0
  if (!keyHandle)
1224
0
    return NTE_NO_MEMORY;
1225
1226
0
  keyHandle->provider = (NCryptP11ProviderHandle*)hProvider;
1227
0
  keyHandle->slotId = slotId;
1228
0
  memcpy(keyHandle->keyCertId, keyCertId, sizeof(keyCertId));
1229
0
  keyHandle->keyCertIdLen = keyCertIdLen;
1230
0
  *phKey = (NCRYPT_KEY_HANDLE)keyHandle;
1231
0
  return ERROR_SUCCESS;
1232
0
}
1233
1234
static SECURITY_STATUS initialize_pkcs11(HANDLE handle,
1235
                                         CK_RV (*c_get_function_list)(CK_FUNCTION_LIST_PTR_PTR),
1236
                                         NCRYPT_PROV_HANDLE* phProvider)
1237
0
{
1238
0
  SECURITY_STATUS status = ERROR_SUCCESS;
1239
0
  NCryptP11ProviderHandle* ret = NULL;
1240
0
  CK_RV rv = 0;
1241
1242
0
  WINPR_ASSERT(c_get_function_list);
1243
0
  WINPR_ASSERT(phProvider);
1244
1245
0
  ret = (NCryptP11ProviderHandle*)ncrypt_new_handle(
1246
0
      WINPR_NCRYPT_PROVIDER, sizeof(*ret), NCryptP11GetProperty, NCryptP11StorageProvider_dtor);
1247
0
  if (!ret)
1248
0
    return NTE_NO_MEMORY;
1249
1250
0
  ret->library = handle;
1251
0
  ret->baseProvider.enumKeysFn = NCryptP11EnumKeys;
1252
0
  ret->baseProvider.openKeyFn = NCryptP11OpenKey;
1253
1254
0
  rv = c_get_function_list(&ret->p11);
1255
0
  if (rv != CKR_OK)
1256
0
  {
1257
0
    status = NTE_PROVIDER_DLL_FAIL;
1258
0
    goto fail;
1259
0
  }
1260
1261
0
  WINPR_ASSERT(ret->p11);
1262
0
  WINPR_ASSERT(ret->p11->C_Initialize);
1263
0
  rv = ret->p11->C_Initialize(NULL);
1264
0
  if (rv != CKR_OK)
1265
0
  {
1266
0
    status = NTE_PROVIDER_DLL_FAIL;
1267
0
    goto fail;
1268
0
  }
1269
1270
0
  *phProvider = (NCRYPT_PROV_HANDLE)ret;
1271
1272
0
fail:
1273
0
  if (status != ERROR_SUCCESS)
1274
0
    ret->baseProvider.baseHandle.releaseFn((NCRYPT_HANDLE)ret);
1275
0
  return status;
1276
0
}
1277
1278
SECURITY_STATUS NCryptOpenP11StorageProviderEx(NCRYPT_PROV_HANDLE* phProvider,
1279
                                               WINPR_ATTR_UNUSED LPCWSTR pszProviderName,
1280
                                               WINPR_ATTR_UNUSED DWORD dwFlags, LPCSTR* modulePaths)
1281
0
{
1282
0
  SECURITY_STATUS status = ERROR_INVALID_PARAMETER;
1283
0
  LPCSTR defaultPaths[] = { "p11-kit-proxy.so", "opensc-pkcs11.so", NULL };
1284
1285
0
  if (!phProvider)
1286
0
    return ERROR_INVALID_PARAMETER;
1287
1288
0
  if (!modulePaths)
1289
0
    modulePaths = defaultPaths;
1290
1291
0
  while (*modulePaths)
1292
0
  {
1293
0
    const char* modulePath = *modulePaths++;
1294
0
    HANDLE library = LoadLibrary(modulePath);
1295
0
    typedef CK_RV (*c_get_function_list_t)(CK_FUNCTION_LIST_PTR_PTR);
1296
0
    NCryptP11ProviderHandle* provider = NULL;
1297
1298
0
    WLog_DBG(TAG, "Trying pkcs11 module '%s'", modulePath);
1299
0
    if (!library)
1300
0
    {
1301
0
      status = NTE_PROV_DLL_NOT_FOUND;
1302
0
      goto out_load_library;
1303
0
    }
1304
1305
0
    c_get_function_list_t c_get_function_list =
1306
0
        GetProcAddressAs(library, "C_GetFunctionList", c_get_function_list_t);
1307
1308
0
    if (!c_get_function_list)
1309
0
    {
1310
0
      status = NTE_PROV_TYPE_ENTRY_BAD;
1311
0
      goto out_load_library;
1312
0
    }
1313
1314
0
    status = initialize_pkcs11(library, c_get_function_list, phProvider);
1315
0
    if (status != ERROR_SUCCESS)
1316
0
    {
1317
0
      status = NTE_PROVIDER_DLL_FAIL;
1318
0
      goto out_load_library;
1319
0
    }
1320
1321
0
    provider = (NCryptP11ProviderHandle*)*phProvider;
1322
0
    provider->modulePath = _strdup(modulePath);
1323
0
    if (!provider->modulePath)
1324
0
    {
1325
0
      status = NTE_NO_MEMORY;
1326
0
      goto out_load_library;
1327
0
    }
1328
1329
0
    WLog_DBG(TAG, "module '%s' loaded", modulePath);
1330
0
    return ERROR_SUCCESS;
1331
1332
0
  out_load_library:
1333
0
    if (library)
1334
0
      FreeLibrary(library);
1335
0
  }
1336
1337
0
  return status;
1338
0
}
1339
1340
const char* NCryptGetModulePath(NCRYPT_PROV_HANDLE phProvider)
1341
0
{
1342
0
  NCryptP11ProviderHandle* provider = (NCryptP11ProviderHandle*)phProvider;
1343
1344
0
  WINPR_ASSERT(provider);
1345
1346
0
  return provider->modulePath;
1347
0
}