From 3a6977d24520e2749039077a8d6f460d43f8ad7b Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Fri, 5 Jan 2024 15:07:52 +0100 Subject: [PATCH] Add option to specify CKA_ID in generate-keypair and import-object Signed-off-by: Zoltan Fridrich --- common/hex.c | 43 +++++++++++++++++++++ common/hex.h | 9 ++++- doc/manual/p11-kit.xml | 12 +++++- p11-kit/generate-keypair.c | 46 ++++++++++++++++++++-- p11-kit/import-object.c | 73 +++++++++++++++++++++++++++++++---- p11-kit/test-import-public.sh | 12 +++--- 6 files changed, 175 insertions(+), 20 deletions(-) diff --git a/common/hex.c b/common/hex.c index 4cecf4b4d..371c617a1 100644 --- a/common/hex.c +++ b/common/hex.c @@ -35,8 +35,10 @@ #include "config.h" #include "hex.h" +#include #include #include +#include static const char HEXC_LOWER[] = "0123456789abcdef"; @@ -64,3 +66,44 @@ hex_encode (const unsigned char *data, result[o] = 0; return result; } + +unsigned char * +hex_decode (const char *hex, + size_t *bin_len) +{ + size_t i, j; + unsigned long val; + unsigned char *bin; + char hex2[3] = { 0 }; + size_t hex_len = strlen (hex); + + bin = malloc (hex_len / 2); + if (bin == NULL) + return NULL; + + for (i = j = 0; i < hex_len;) { + if (hex[i] == ':') { + ++i; + continue; + } + + if (i + 1 >= hex_len) { + free (bin); + return NULL; + } + + hex2[0] = hex[i++]; + hex2[1] = hex[i++]; + + val = strtoul (hex2, NULL, 16); + if (val == ULONG_MAX) { + free (bin); + return NULL; + } + + bin[j++] = val; + } + + *bin_len = j; + return bin; +} diff --git a/common/hex.h b/common/hex.h index 2d7232860..43303b116 100644 --- a/common/hex.h +++ b/common/hex.h @@ -38,7 +38,12 @@ #include -char *hex_encode (const unsigned char *data, - size_t n_data); +char * +hex_encode (const unsigned char *data, + size_t n_data); + +unsigned char * +hex_decode (const char *hex, + size_t *bin_len); #endif /* P11_HEX_H */ diff --git a/doc/manual/p11-kit.xml b/doc/manual/p11-kit.xml index 4d78976b5..137bee1fd 100644 --- a/doc/manual/p11-kit.xml +++ b/doc/manual/p11-kit.xml @@ -176,7 +176,7 @@ $ pkg-config p11-kit-1 --variable p11_module_path Import object into PKCS#11 token. -$ p11-kit import-object --file=file.pem [--label=label] pkcs11:token +$ p11-kit import-object --file=file.pem [--label=label] [--id=object_id] pkcs11:token Takes either an X.509 certificate or a public key in the form of a PEM file @@ -199,6 +199,10 @@ $ p11-kit import-object --file=file.pem [--label=label] pkcs11:token Assigns label to the imported object. + + + Assigns ID to the imported object. The ID should be specified in hexadecimal format without '0x' prefix. + Authenticate to the token before enumerating objects. The PIN value is read from either the pin-value attribute in the URI or from the terminal. @@ -276,7 +280,7 @@ $ pkg-config p11-kit-1 --variable p11_module_path Generate key-pair on a PKCS#11 token. -$ p11-kit generate-keypair --type=algorithm {--bits=n|--curve=name} [--label=label] pkcs11:token +$ p11-kit generate-keypair --type=algorithm {--bits=n|--curve=name} [--label=label] [--id=object_id] pkcs11:token Generate private-public key-pair of given type on the first @@ -311,6 +315,10 @@ $ p11-kit generate-keypair --type=algorithm {--bits=n|--curve=name} &l Assigns label to the generated key-pair objects. + + + Assigns ID to the generated key-pair objects. The ID should be specified in hexadecimal format without '0x' prefix. + Authenticate to the token before enumerating objects. The PIN value is read from either the pin-value attribute in the URI or from the terminal. diff --git a/p11-kit/generate-keypair.c b/p11-kit/generate-keypair.c index bcb94fa01..847d775db 100644 --- a/p11-kit/generate-keypair.c +++ b/p11-kit/generate-keypair.c @@ -39,6 +39,7 @@ #include "attrs.h" #include "compat.h" #include "debug.h" +#include "hex.h" #include "iter.h" #include "message.h" #include "options.h" @@ -160,6 +161,7 @@ check_args (CK_MECHANISM_TYPE type, static bool get_templates (const char *label, + const char *id, CK_MECHANISM_TYPE type, CK_ULONG bits, const uint8_t *ec_params, @@ -207,6 +209,36 @@ get_templates (const char *label, priv = tmp; } + if (id != NULL) { + size_t bin_len = 0; + unsigned char *bin = NULL; + CK_ATTRIBUTE attr_id = { CKA_ID, NULL, 0 }; + + bin = hex_decode (id, &bin_len); + if (bin == NULL) { + p11_message (_("failed to decode hex value: %s"), id); + goto error; + } + + attr_id.pValue = (void *)bin; + attr_id.ulValueLen = bin_len; + + tmp = p11_attrs_build (pub, &attr_id, NULL); + if (tmp == NULL) { + free (bin); + p11_message (_("failed to allocate memory")); + goto error; + } + pub = tmp; + tmp = p11_attrs_build (priv, &attr_id, NULL); + free (bin); + if (tmp == NULL) { + p11_message (_("failed to allocate memory")); + goto error; + } + priv = tmp; + } + switch (type) { #ifdef P11_KIT_TESTABLE case CKM_MOCK_GENERATE: @@ -254,6 +286,7 @@ get_templates (const char *label, static int generate_keypair (p11_tool *tool, const char *label, + const char *id, CK_MECHANISM mechanism, CK_ULONG bits, const uint8_t *ec_params, @@ -267,7 +300,7 @@ generate_keypair (p11_tool *tool, CK_ATTRIBUTE *pubkey = NULL, *privkey = NULL; CK_OBJECT_HANDLE pubkey_obj, privkey_obj; - if (!get_templates (label, mechanism.mechanism, bits, + if (!get_templates (label, id, mechanism.mechanism, bits, ec_params, ec_params_len, &pubkey, &privkey)) { p11_message (_("failed to create key templates")); return 1; @@ -318,7 +351,8 @@ p11_kit_generate_keypair (int argc, char *argv[]) { int opt, ret = 2; - char *label = NULL; + const char *label = NULL; + const char *id = NULL; CK_ULONG bits = 0; const uint8_t *ec_params = NULL; size_t ec_params_len = 0; @@ -332,6 +366,7 @@ p11_kit_generate_keypair (int argc, opt_quiet = 'q', opt_help = 'h', opt_label = 'L', + opt_id = CHAR_MAX + 3, opt_type = 't', opt_bits = 'b', opt_curve = 'c', @@ -344,6 +379,7 @@ p11_kit_generate_keypair (int argc, { "quiet", no_argument, NULL, opt_quiet }, { "help", no_argument, NULL, opt_help }, { "label", required_argument, NULL, opt_label }, + { "id", required_argument, NULL, opt_id }, { "type", required_argument, NULL, opt_type }, { "bits", required_argument, NULL, opt_bits }, { "curve", required_argument, NULL, opt_curve }, @@ -356,6 +392,7 @@ p11_kit_generate_keypair (int argc, { 0, "usage: p11-kit generate-keypair [--label=