[unleashed/tickless.git] / usr / src / lib / pkcs11 / pkcs11_softtoken / common / softAttributeUtil.c
| blob | d6e77c80165893b0dda9ca370f4b29deb94fa3a3 |
1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 * Copyright 2012 Milan Jurik. All rights reserved.
25 */
27 #include <stdlib.h>
28 #include <string.h>
29 #include <security/cryptoki.h>
30 #include <sys/crypto/common.h>
31 #include <arcfour.h>
32 #include <aes_impl.h>
33 #include <blowfish_impl.h>
34 #include <bignum.h>
35 #include <des_impl.h>
36 #include <rsa_impl.h>
45 /*
46 * This attribute table is used by the soft_lookup_attr()
47 * to validate the attributes.
48 */
49 CK_ATTRIBUTE_TYPE attr_map[] = {
50 CKA_PRIVATE,
51 CKA_LABEL,
52 CKA_APPLICATION,
53 CKA_OBJECT_ID,
54 CKA_CERTIFICATE_TYPE,
55 CKA_ISSUER,
56 CKA_SERIAL_NUMBER,
57 CKA_AC_ISSUER,
58 CKA_OWNER,
59 CKA_ATTR_TYPES,
60 CKA_SUBJECT,
61 CKA_ID,
62 CKA_SENSITIVE,
63 CKA_START_DATE,
64 CKA_END_DATE,
65 CKA_MODULUS,
66 CKA_MODULUS_BITS,
67 CKA_PUBLIC_EXPONENT,
68 CKA_PRIVATE_EXPONENT,
69 CKA_PRIME_1,
70 CKA_PRIME_2,
71 CKA_EXPONENT_1,
72 CKA_EXPONENT_2,
73 CKA_COEFFICIENT,
74 CKA_PRIME,
75 CKA_SUBPRIME,
76 CKA_BASE,
77 CKA_EXTRACTABLE,
78 CKA_LOCAL,
79 CKA_NEVER_EXTRACTABLE,
80 CKA_ALWAYS_SENSITIVE,
81 CKA_MODIFIABLE,
82 CKA_ECDSA_PARAMS,
83 CKA_EC_PARAMS,
84 CKA_EC_POINT,
85 CKA_SECONDARY_AUTH,
86 CKA_AUTH_PIN_FLAGS,
87 CKA_HW_FEATURE_TYPE,
88 CKA_RESET_ON_INIT,
89 CKA_HAS_RESET
90 };
92 /*
93 * attributes that exists only in public key objects
94 * Note: some attributes may also exist in one or two
95 * other object classes, but they are also listed
96 * because not all object have them.
97 */
98 CK_ATTRIBUTE_TYPE PUB_KEY_ATTRS[] =
99 {
100 CKA_SUBJECT,
101 CKA_ENCRYPT,
102 CKA_WRAP,
103 CKA_VERIFY,
104 CKA_VERIFY_RECOVER,
105 CKA_MODULUS,
106 CKA_MODULUS_BITS,
107 CKA_PUBLIC_EXPONENT,
108 CKA_PRIME,
109 CKA_SUBPRIME,
110 CKA_BASE,
111 CKA_TRUSTED,
112 CKA_ECDSA_PARAMS,
113 CKA_EC_PARAMS,
114 CKA_EC_POINT
115 };
117 /*
118 * attributes that exists only in private key objects
119 * Note: some attributes may also exist in one or two
120 * other object classes, but they are also listed
121 * because not all object have them.
122 */
123 CK_ATTRIBUTE_TYPE PRIV_KEY_ATTRS[] =
124 {
125 CKA_DECRYPT,
126 CKA_UNWRAP,
127 CKA_SIGN,
128 CKA_SIGN_RECOVER,
129 CKA_MODULUS,
130 CKA_PUBLIC_EXPONENT,
131 CKA_PRIVATE_EXPONENT,
132 CKA_PRIME,
133 CKA_SUBPRIME,
134 CKA_BASE,
135 CKA_PRIME_1,
136 CKA_PRIME_2,
137 CKA_EXPONENT_1,
138 CKA_EXPONENT_2,
139 CKA_COEFFICIENT,
140 CKA_VALUE_BITS,
141 CKA_SUBJECT,
142 CKA_SENSITIVE,
143 CKA_EXTRACTABLE,
144 CKA_NEVER_EXTRACTABLE,
145 CKA_ALWAYS_SENSITIVE,
146 CKA_EC_PARAMS
147 };
149 /*
150 * attributes that exists only in secret key objects
151 * Note: some attributes may also exist in one or two
152 * other object classes, but they are also listed
153 * because not all object have them.
154 */
155 CK_ATTRIBUTE_TYPE SECRET_KEY_ATTRS[] =
156 {
157 CKA_VALUE_LEN,
158 CKA_ENCRYPT,
159 CKA_DECRYPT,
160 CKA_WRAP,
161 CKA_UNWRAP,
162 CKA_SIGN,
163 CKA_VERIFY,
164 CKA_SENSITIVE,
165 CKA_EXTRACTABLE,
166 CKA_NEVER_EXTRACTABLE,
167 CKA_ALWAYS_SENSITIVE
168 };
170 /*
171 * attributes that exists only in domain parameter objects
172 * Note: some attributes may also exist in one or two
173 * other object classes, but they are also listed
174 * because not all object have them.
175 */
176 CK_ATTRIBUTE_TYPE DOMAIN_ATTRS[] =
177 {
178 CKA_PRIME,
179 CKA_SUBPRIME,
180 CKA_BASE,
181 CKA_PRIME_BITS,
182 CKA_SUBPRIME_BITS,
183 CKA_SUB_PRIME_BITS
184 };
186 /*
187 * attributes that exists only in hardware feature objects
188 *
189 */
190 CK_ATTRIBUTE_TYPE HARDWARE_ATTRS[] =
191 {
192 CKA_HW_FEATURE_TYPE,
193 CKA_RESET_ON_INIT,
194 CKA_HAS_RESET
195 };
197 /*
198 * attributes that exists only in certificate objects
199 */
200 CK_ATTRIBUTE_TYPE CERT_ATTRS[] =
201 {
202 CKA_CERTIFICATE_TYPE,
203 CKA_TRUSTED,
204 CKA_SUBJECT,
205 CKA_ID,
206 CKA_ISSUER,
207 CKA_AC_ISSUER,
208 CKA_SERIAL_NUMBER,
209 CKA_OWNER,
210 CKA_ATTR_TYPES
211 };
214 /*
215 * Validate the attribute by using binary search algorithm.
216 */
217 CK_RV
219 {
227 /* Always starts from middle. */
231 /* Adjust the lower bound to upper half. */
234 }
237 /* Found it. */
239 }
242 /* Adjust the upper bound to lower half. */
245 }
246 }
248 /* Failed to find the matching attribute from the attribute table. */
250 }
253 /*
254 * Validate the attribute by using the following search algorithm:
255 *
256 * 1) Search for the most frequently used attributes first.
257 * 2) If not found, search for the usage-purpose attributes - these
258 * attributes have dense set of values, therefore compiler will
259 * optimize it with a branch table and branch to the appropriate
260 * case.
261 * 3) If still not found, use binary search for the rest of the
262 * attributes in the attr_map[] table.
263 */
264 CK_RV
267 {
269 CK_ULONG i;
273 /* First tier search */
289 /* Second tier search */
310 /* Third tier search */
315 }
317 }
318 }
320 }
322 static void
324 {
329 }
332 }
333 }
335 static CK_RV
337 {
346 /* free memory if its already allocated */
354 }
364 }
369 }
372 }
374 void
376 {
388 }
393 }
400 }
405 }
407 }
408 }
410 /*
411 * Clean up and release all the storage in the extra attribute list
412 * of an object.
413 */
414 void
416 {
418 CK_ATTRIBUTE_INFO_PTR extra_attr;
419 CK_ATTRIBUTE_INFO_PTR tmp;
425 /*
426 * All extra attributes in the extra attribute
427 * list have pValue points to the value of the
428 * attribute (with simple byte array type).
429 * Free the storage for the value of the attribute.
430 */
433 /* Free the storage for the attribute_info struct. */
436 }
439 }
442 /*
443 * Create the attribute_info struct to hold the object's attribute,
444 * and add it to the extra attribute list of an object.
445 */
446 CK_RV
448 {
450 CK_ATTRIBUTE_INFO_PTR attrp;
452 /* Allocate the storage for the attribute_info struct. */
456 }
458 /* Set up attribute_info struct. */
464 /* Allocate storage for the value of the attribute. */
469 }
475 }
477 /* Insert the new attribute in front of extra attribute list. */
484 }
487 }
489 CK_RV
491 CK_CERTIFICATE_TYPE type)
492 {
495 x509_cert_t x509;
496 x509_attr_cert_t x509_attr;
501 }
524 /* wrong certificate type */
526 }
530 }
532 /*
533 * Copy the attribute_info struct from the old object to a new attribute_info
534 * struct, and add that new struct to the extra attribute list of the new
535 * object.
536 */
537 CK_RV
539 {
540 CK_ATTRIBUTE_INFO_PTR attrp;
542 /* Allocate attribute_info struct. */
546 }
557 }
563 }
565 /* Insert the new attribute in front of extra attribute list */
572 }
575 }
578 /*
579 * Get the attribute triple from the extra attribute list in the object
580 * (if the specified attribute type is found), and copy it to a template.
581 * Note the type of the attribute to be copied is specified by the template,
582 * and the storage is pre-allocated for the atrribute value in the template
583 * for doing the copy.
584 */
585 CK_RV
587 {
589 CK_ATTRIBUTE_INFO_PTR extra_attr;
596 /* Found it. */
599 /* Does not match, try next one. */
601 }
602 }
605 /* A valid but un-initialized attribute. */
608 }
610 /*
611 * We found the attribute in the extra attribute list.
612 */
616 }
619 /*
620 * The buffer provided by the application is large
621 * enough to hold the value of the attribute.
622 */
628 /*
629 * The buffer provided by the application does
630 * not have enough space to hold the value.
631 */
634 }
635 }
638 /*
639 * Modify the attribute triple in the extra attribute list of the object
640 * if the specified attribute type is found. Otherwise, just add it to
641 * list.
642 */
643 CK_RV
646 {
648 CK_ATTRIBUTE_INFO_PTR extra_attr;
654 /* Found it. */
657 /* Does not match, try next one. */
659 }
660 }
663 /*
664 * This attribute is a new one, go ahead adding it to
665 * the extra attribute list.
666 */
668 }
670 /* We found the attribute in the extra attribute list. */
674 /* The old buffer is too small to hold the new value. */
676 /* Free storage for the old attribute value. */
679 /* Allocate storage for the new attribute value. */
683 }
684 }
686 /* Replace the attribute with new value. */
692 }
695 }
698 /*
699 * Copy the big integer attribute value from template to a biginteger_t struct.
700 */
701 CK_RV
703 {
707 /* Allocate storage for the value of the attribute. */
711 }
719 }
722 }
725 /*
726 * Copy the big integer attribute value from a biginteger_t struct in the
727 * object to a template.
728 */
729 CK_RV
731 {
736 }
741 }
744 /*
745 * The buffer provided by the application is large
746 * enough to hold the value of the attribute.
747 */
753 /*
754 * The buffer provided by the application does
755 * not have enough space to hold the value.
756 */
759 }
760 }
763 /*
764 * Copy the boolean data type attribute value from an object for the
765 * specified attribute to the template.
766 */
767 CK_RV
770 {
775 }
778 /*
779 * The buffer provided by the application is large
780 * enough to hold the value of the attribute.
781 */
786 }
791 /*
792 * The buffer provided by the application does
793 * not have enough space to hold the value.
794 */
797 }
798 }
800 /*
801 * Set the boolean data type attribute value in the object.
802 */
803 CK_RV
806 {
810 else
814 }
817 /*
818 * Copy the CK_ULONG data type attribute value from an object to the
819 * template.
820 */
821 CK_RV
823 {
828 }
831 /*
832 * The buffer provided by the application is large
833 * enough to hold the value of the attribute.
834 * It is also assumed to be correctly aligned.
835 */
840 /*
841 * The buffer provided by the application does
842 * not have enough space to hold the value.
843 */
846 }
847 }
850 /*
851 * Copy the CK_ULONG data type attribute value from a template to the
852 * object.
853 */
854 static CK_RV
856 {
865 }
868 }
870 /*
871 * Copy the big integer attribute value from source's biginteger_t to
872 * destination's biginteger_t.
873 */
874 void
876 {
880 /*
881 * To do the copy, just have dst's big_value points
882 * to src's.
883 */
887 /*
888 * After the copy, nullify the src's big_value pointer.
889 * It prevents any double freeing the value.
890 */
896 }
897 }
899 CK_RV
901 {
904 /* Allocate storage for the value of the attribute. */
908 }
918 }
922 }
924 CK_RV
926 {
928 /*
929 * If the attribute was already set, clear out the
930 * existing value and release the memory.
931 */
937 }
942 }
944 }
950 }
953 }
956 }
958 /*
959 * Copy the certificate attribute information to the template.
960 * If the template attribute is not big enough, set the ulValueLen=-1
961 * and return CKR_BUFFER_TOO_SMALL.
962 */
963 static CK_RV
965 {
970 /*
971 * The buffer provided by the application is large
972 * enough to hold the value of the attribute.
973 */
978 /*
979 * The buffer provided by the application does
980 * not have enough space to hold the value.
981 */
984 }
985 }
987 void
989 {
995 }
996 }
998 /*
999 * Release the storage allocated for object attribute with big integer
1000 * value.
1001 */
1002 void
1004 {
1014 }
1015 }
1018 /*
1019 * Clean up and release all the storage allocated to hold the big integer
1020 * attributes associated with the type (i.e. class) of the object. Also,
1021 * release the storage allocated to the type of the object.
1022 */
1023 void
1025 {
1037 object_p));
1039 object_p));
1044 object_p));
1046 object_p));
1048 object_p));
1050 object_p));
1055 object_p));
1057 object_p));
1059 object_p));
1064 object_p));
1066 object_p));
1068 object_p));
1070 object_p));
1074 object_p));
1076 }
1078 /* Release Public Key Object struct */
1081 }
1089 object_p));
1091 object_p));
1093 object_p));
1095 object_p));
1097 object_p));
1099 object_p));
1101 object_p));
1103 object_p));
1108 object_p));
1110 object_p));
1112 object_p));
1114 object_p));
1119 object_p));
1121 object_p));
1123 object_p));
1128 object_p));
1130 object_p));
1132 object_p));
1134 object_p));
1139 object_p));
1141 }
1143 /* Release Private Key Object struct. */
1146 }
1151 /* cleanup key data area */
1157 }
1158 /* cleanup key schedule data area */
1164 }
1166 /* Release Secret Key Object struct. */
1169 }
1177 object_p));
1179 object_p));
1181 object_p));
1186 object_p));
1188 object_p));
1193 object_p));
1195 object_p));
1197 object_p));
1199 }
1201 /* Release Domain Parameters Object struct. */
1204 }
1206 }
1207 }
1210 /*
1211 * Parse the common attributes. Return to caller with appropriate return
1212 * value to indicate if the supplied template specifies a valid attribute
1213 * with a valid value.
1214 */
1215 CK_RV
1217 {
1225 /* default boolean attributes */
1231 }
1238 /*
1239 * Check if this is the special case when
1240 * the PIN is never initialized in the keystore.
1241 * If true, we will let it pass here and let
1242 * it fail with CKR_PIN_EXPIRED later on.
1243 */
1248 }
1249 }
1252 }
1260 }
1263 }
1266 /*
1267 * Build a Public Key Object.
1268 *
1269 * - Parse the object's template, and when an error is detected such as
1270 * invalid attribute type, invalid attribute value, etc., return
1271 * with appropriate return value.
1272 * - Set up attribute mask field in the object for the supplied common
1273 * attributes that have boolean type.
1274 * - Build the attribute_info struct to hold the value of each supplied
1275 * attribute that has byte array type. Link attribute_info structs
1276 * together to form the extra attribute list of the object.
1277 * - Allocate storage for the Public Key object.
1278 * - Build the Public Key object according to the key type. Allocate
1279 * storage to hold the big integer value for the supplied attributes
1280 * that are required for a certain key type.
1281 *
1282 */
1283 CK_RV
1286 {
1288 ulong_t i;
1293 /* Must set flags */
1302 /* Must not set flags */
1306 biginteger_t modulus;
1307 biginteger_t pubexpo;
1308 biginteger_t prime;
1309 biginteger_t subprime;
1310 biginteger_t base;
1311 biginteger_t value;
1312 biginteger_t point;
1313 CK_ATTRIBUTE string_tmp;
1314 CK_ATTRIBUTE param_tmp;
1322 BIGNUM n;
1324 /* prevent bigint_attr_cleanup from freeing invalid attr value */
1337 /* Public Key Object Attributes */
1340 /* common key attributes */
1349 /* common public key attribute */
1351 /*
1352 * Allocate storage to hold the attribute
1353 * value with byte array type, and add it to
1354 * the extra attribute list of the object.
1355 */
1357 new_object);
1360 }
1363 /*
1364 * The following key related attribute types must
1365 * not be specified by C_CreateObject, C_GenerateKey(Pair).
1366 */
1372 /* Key related boolean attributes */
1381 else
1388 else
1395 else
1402 else
1416 /*
1417 * The following key related attribute types must
1418 * be specified according to the key type by
1419 * C_CreateObject.
1420 */
1424 /*
1425 * Copyin big integer attribute from template
1426 * to a local variable.
1427 */
1433 /*
1434 * Modulus length needs to be between min key length and
1435 * max key length.
1436 */
1438 MIN_RSA_KEYLENGTH_IN_BYTES) ||
1440 MAX_RSA_KEYLENGTH_IN_BYTES)) {
1443 }
1485 }
1486 }
1531 }
1534 /* Allocate storage for Public Key Object. */
1539 }
1547 }
1551 }
1554 /*
1555 * The key type specified in the template does not
1556 * match the implied key type based on the mechanism.
1557 */
1560 }
1564 /* Supported key types of the Public Key Object */
1573 }
1576 /*
1577 * Derive modulus_bits attribute from modulus.
1578 * Save modulus_bits integer value to the
1579 * designated place in the public key object.
1580 */
1582 #ifdef __sparcv9
1592 }
1600 /*
1601 * After modulus_bits has been computed,
1602 * it is safe to move modulus and pubexpo
1603 * big integer attribute value to the
1604 * designated place in the public key object.
1605 */
1614 }
1616 /* mode is SOFT_GEN_KEY */
1622 }
1626 /*
1627 * Copy big integer attribute value to the
1628 * designated place in the public key object.
1629 */
1634 }
1636 /*
1637 * Use PKCS#11 default 0x010001 for public exponent
1638 * if not not specified in attribute template.
1639 */
1646 }
1647 /*
1648 * Copy big integer attribute value to the
1649 * designated place in the public key object.
1650 */
1652 }
1661 }
1669 }
1672 isValue) {
1675 }
1680 }
1681 }
1694 isSubprime) {
1697 }
1705 }
1711 }
1716 }
1717 }
1730 }
1738 }
1741 isValue) {
1744 }
1749 }
1750 }
1770 }
1780 }
1781 }
1785 }
1795 }
1797 /* Set up object. */
1805 }
1809 fail_cleanup:
1810 /*
1811 * cleanup the storage allocated to the local variables.
1812 */
1823 /*
1824 * cleanup the storage allocated inside the object itself.
1825 */
1829 }
1832 /*
1833 * Build a Private Key Object.
1834 *
1835 * - Parse the object's template, and when an error is detected such as
1836 * invalid attribute type, invalid attribute value, etc., return
1837 * with appropriate return value.
1838 * - Set up attribute mask field in the object for the supplied common
1839 * attributes that have boolean type.
1840 * - Build the attribute_info struct to hold the value of each supplied
1841 * attribute that has byte array type. Link attribute_info structs
1842 * together to form the extra attribute list of the object.
1843 * - Allocate storage for the Private Key object.
1844 * - Build the Private Key object according to the key type. Allocate
1845 * storage to hold the big integer value for the supplied attributes
1846 * that are required for a certain key type.
1847 *
1848 */
1849 CK_RV
1852 {
1853 ulong_t i;
1859 /* Must set flags unless mode == SOFT_UNWRAP_KEY */
1865 /* Must set flags if mode == SOFT_GEN_KEY */
1867 /* Must not set flags */
1871 /* Private Key RSA optional */
1879 biginteger_t modulus;
1880 biginteger_t priexpo;
1881 biginteger_t prime;
1882 biginteger_t subprime;
1883 biginteger_t base;
1884 biginteger_t value;
1886 biginteger_t pubexpo;
1887 biginteger_t prime1;
1888 biginteger_t prime2;
1889 biginteger_t expo1;
1890 biginteger_t expo2;
1891 biginteger_t coef;
1892 CK_ATTRIBUTE string_tmp;
1893 CK_ATTRIBUTE param_tmp;
1899 /* prevent bigint_attr_cleanup from freeing invalid attr value */
1919 /* Private Key Object Attributes */
1921 /* common key attributes */
1930 /* common private key attribute */
1932 /*
1933 * Allocate storage to hold the attribute
1934 * value with byte array type, and add it to
1935 * the extra attribute list of the object.
1936 */
1938 new_object);
1941 }
1944 /*
1945 * The following key related attribute types must
1946 * not be specified by C_CreateObject or C_GenerateKey(Pair).
1947 */
1956 /* Key related boolean attributes */
1971 }
1977 else
1984 else
1991 else
1998 else
2005 else
2014 /*
2015 * The following key related attribute types must
2016 * be specified according to the key type by
2017 * C_CreateObject.
2018 */
2022 /*
2023 * Copyin big integer attribute from template
2024 * to a local variable.
2025 */
2031 /*
2032 * Modulus length needs to be between min key length and
2033 * max key length.
2034 */
2036 MIN_RSA_KEYLENGTH_IN_BYTES) ||
2038 MAX_RSA_KEYLENGTH_IN_BYTES)) {
2041 }
2133 }
2134 }
2173 }
2176 /* Allocate storage for Private Key Object. */
2181 }
2189 }
2192 /*
2193 * The key type is not specified in the application's
2194 * template, so we use the implied key type based on
2195 * the mechanism.
2196 */
2199 }
2201 /* If still unspecified, template is incomplete */
2205 }
2207 /*
2208 * The key type specified in the template does not
2209 * match the implied key type based on the mechanism.
2210 */
2214 }
2215 }
2218 /*
2219 * Note that, for mode SOFT_UNWRAP_KEY, key type is not
2220 * implied by the mechanism (key_type), so if it is not
2221 * specified from the attribute template (keytype), it is
2222 * incomplete.
2223 */
2227 }
2228 }
2232 /* Supported key types of the Private Key Object */
2236 isValueBits) {
2239 }
2248 }
2251 /*
2252 * Copy big integer attribute value to the
2253 * designated place in the Private Key object.
2254 */
2261 }
2263 /* The following attributes are optional. */
2266 }
2270 }
2274 }
2278 }
2282 }
2286 }
2292 isValueBits) {
2295 }
2303 }
2306 /*
2307 * The private value x must be less than subprime q.
2308 * Size for big_init is in BIG_CHUNK_TYPE words.
2309 */
2310 #ifdef __sparcv9
2321 }
2322 #ifdef __sparcv9
2333 }
2342 }
2354 }
2360 isSubprime) {
2363 }
2365 /* CKA_VALUE_BITS is for key gen but not unwrap */
2373 }
2374 }
2382 }
2387 }
2398 }
2404 isValueBits) {
2407 }
2415 }
2429 }
2444 }
2447 }
2453 }
2455 /* Set up object. */
2463 }
2469 fail_cleanup:
2470 /*
2471 * cleanup the storage allocated to the local variables.
2472 */
2490 /*
2491 * cleanup the storage allocated inside the object itself.
2492 */
2496 }
2499 /*
2500 * Build a Secret Key Object.
2501 *
2502 * - Parse the object's template, and when an error is detected such as
2503 * invalid attribute type, invalid attribute value, etc., return
2504 * with appropriate return value.
2505 * - Set up attribute mask field in the object for the supplied common
2506 * attributes that have boolean type.
2507 * - Build the attribute_info struct to hold the value of each supplied
2508 * attribute that has byte array type. Link attribute_info structs
2509 * together to form the extra attribute list of the object.
2510 * - Allocate storage for the Secret Key object.
2511 * - Build the Secret Key object. Allocate storage to hold the big integer
2512 * value for the attribute CKA_VALUE that is required for all the key
2513 * types supported by secret key object.
2514 * This function is called internally with mode = SOFT_CREATE_OBJ_INT.
2515 *
2516 */
2517 CK_RV
2520 CK_KEY_TYPE key_type)
2521 {
2523 ulong_t i;
2528 /* Must set flags if mode != SOFT_UNWRAP_KEY, else must not set */
2530 /* Must not set flags if mode != SOFT_UNWRAP_KEY, else optional */
2533 CK_ATTRIBUTE string_tmp;
2540 /* Allocate storage for Secret Key Object. */
2545 }
2552 /* Secret Key Object Attributes */
2555 /* common key attributes */
2563 /*
2564 * Allocate storage to hold the attribute
2565 * value with byte array type, and add it to
2566 * the extra attribute list of the object.
2567 */
2569 new_object);
2572 }
2575 /*
2576 * The following key related attribute types must
2577 * not be specified by C_CreateObject and C_GenerateKey.
2578 */
2586 /* Key related boolean attributes */
2600 else
2607 else
2614 else
2621 else
2628 else
2635 else
2642 else
2658 }
2659 }
2661 /*
2662 * Copyin attribute from template
2663 * to a local variable.
2664 */
2694 }
2701 /*
2702 * The key type must be specified in the application's
2703 * template. Otherwise, returns error.
2704 */
2708 }
2713 /*
2714 * The key type is not specified in the application's
2715 * template, so we use the implied key type based on
2716 * the mechanism.
2717 */
2721 /*
2722 * The key type specified in the template
2723 * does not match the implied key type based
2724 * on the mechanism.
2725 */
2728 }
2729 }
2731 /*
2732 * If a key_len is passed as a parameter, it has to
2733 * match the one found in the template.
2734 */
2739 }
2742 }
2746 /*
2747 * Note that, for mode SOFT_UNWRAP_KEY, key type is not
2748 * implied by the mechanism (key_type), so if it is not
2749 * specified from the attribute template (keytype), it is
2750 * incomplete.
2751 */
2755 }
2759 /*
2760 * For CKM_MD5_KEY_DERIVATION & CKM_SHA1_KEY_DERIVATION, the
2761 * key type is optional.
2762 */
2765 }
2767 }
2777 }
2782 }
2789 }
2796 }
2802 }
2809 }
2814 }
2822 }
2826 }
2833 }
2837 }
2844 }
2848 }
2854 }
2857 /*
2858 * Templates for internal object creation come from
2859 * applications calls to C_DeriveKey(), for which it
2860 * is OKey to pass a CKA_VALUE_LEN attribute, as
2861 * long as it does not conflict with the length of the
2862 * CKA_VALUE attribute.
2863 */
2868 }
2869 }
2873 /* CKA_VALUE must not be specified */
2877 }
2880 /*
2881 * CKA_VALUE_LEN must be specified by C_GenerateKey
2882 * if mech is CKK_RC4, CKK_AES, CKK_GENERIC_SECRET.
2883 */
2888 }
2889 ;
2894 }
2898 /* arbitrary key length - no length checking */
2902 }
2909 }
2916 }
2924 }
2929 }
2936 /* CKA_VALUE_LEN attribute does not apply to DES<n> */
2940 }
2946 }
2950 /*
2951 * According to v2.11 of PKCS#11 spec, neither CKA_VALUE nor
2952 * CKA_VALUE_LEN can be be specified; however v2.20 has this
2953 * restriction removed, perhaps because it makes it hard to
2954 * determine variable-length key sizes. This case statement
2955 * complied with v2.20.
2956 */
2960 }
2963 /*
2964 * CKA_VALUE_LEN is optional
2965 * if key is CKK_RC4, CKK_AES, CKK_GENERIC_SECRET
2966 * and the unwrapping mech is *_CBC_PAD.
2967 *
2968 * CKA_VALUE_LEN is required
2969 * if key is CKK_RC4, CKK_AES, CKK_GENERIC_SECRET
2970 * and the unwrapping mech is *_ECB or *_CBC.
2971 *
2972 * since mech is not known at this point, CKA_VALUE_LEN is
2973 * treated as optional and the caller needs to enforce it.
2974 */
2978 ARCFOUR_MIN_KEY_BYTES) ||
2980 ARCFOUR_MAX_KEY_BYTES)) {
2983 }
2984 }
2988 /* arbitrary key length - no length checking */
2998 }
2999 }
3008 }
3014 /* CKA_VALUE_LEN attribute does not apply to DES<n> */
3018 }
3024 }
3028 /* CKA_VALUE must not be specified */
3032 }
3035 /*
3036 * CKA_VALUE_LEN is optional
3037 * if mech is CKK_RC4, CKK_AES, CKK_GENERIC_SECRET.
3038 */
3042 ARCFOUR_MIN_KEY_BYTES) ||
3044 ARCFOUR_MAX_KEY_BYTES)) {
3047 }
3048 }
3052 /* arbitrary key length - no length checking */
3062 }
3063 }
3073 }
3079 /* CKA_VALUE_LEN attribute does not apply to DES<n> */
3083 }
3089 }
3093 /* CKA_VALUE must not be specified */
3097 }
3100 /*
3101 * CKA_VALUE_LEN is an optional attribute for
3102 * CKM_SHA1_KEY_DERIVATION and CKM_MD5_KEY_DERIVATION
3103 * if mech is CKK_RC4, CKK_AES, CKK_GENERIC_SECRET.
3104 */
3109 /*
3110 * No need to check key length value here, it will be
3111 * validated later in soft_key_derive_check_length().
3112 */
3118 /* CKA_VALUE_LEN attribute does not apply to DES<n> */
3122 }
3128 }
3130 }
3132 /* Set up object. */
3141 }
3144 fail_cleanup:
3145 /*
3146 * cleanup the storage allocated to the local variables.
3147 */
3151 /*
3152 * cleanup the storage allocated inside the object itself.
3153 */
3157 }
3160 /*
3161 * Build a Domain Parameter Object.
3162 *
3163 * - Parse the object's template, and when an error is detected such as
3164 * invalid attribute type, invalid attribute value, etc., return
3165 * with appropriate return value.
3166 * - Allocate storage for the Domain Parameter object.
3167 * - Build the Domain Parameter object according to the key type. Allocate
3168 * storage to hold the big integer value for the supplied attributes
3169 * that are required for a certain key type.
3170 *
3171 */
3172 CK_RV
3175 {
3177 ulong_t i;
3181 /* Must set flags */
3185 /* Must not set flags */
3189 biginteger_t prime;
3190 biginteger_t subprime;
3191 biginteger_t base;
3192 CK_ATTRIBUTE string_tmp;
3197 /* prevent bigint_attr_cleanup from freeing invalid attr value */
3205 /* Domain Parameters Object Attributes */
3208 /* common domain parameter attribute */
3213 /*
3214 * The following common domain parameter attribute
3215 * must not be specified by C_CreateObject.
3216 */
3221 /*
3222 * The following domain parameter attributes must be
3223 * specified according to the key type by
3224 * C_CreateObject.
3225 */
3228 /*
3229 * Copyin big integer attribute from template
3230 * to a local variable.
3231 */
3277 }
3280 /* Allocate storage for Domain Parameters Object. */
3285 }
3293 }
3297 /* Supported key types of the Domain Parameters Object */
3303 }
3306 /*
3307 * Copy big integer attribute value to the
3308 * designated place in the domain parameter
3309 * object.
3310 */
3319 }
3326 }
3335 }
3342 }
3354 }
3360 }
3369 }
3373 fail_cleanup:
3374 /*
3375 * cleanup the storage allocated to the local variables.
3376 */
3382 /*
3383 * cleanup the storage allocated inside the object itself.
3384 */
3388 }
3390 /*
3391 * Build a Certificate Object
3392 *
3393 * - Parse the object's template, and when an error is detected such as
3394 * invalid attribute type, invalid attribute value, etc., return
3395 * with appropriate return value.
3396 * - Allocate storage for the Certificate object
3397 */
3398 static CK_RV
3401 CK_CERTIFICATE_TYPE cert_type)
3402 {
3405 CK_ULONG i;
3410 /* certificate type defaults to the value given as a parameter */
3412 CK_ATTRIBUTE string_tmp;
3416 /*
3417 * Look for the certificate type attribute and do some
3418 * sanity checking before creating the structures.
3419 */
3421 /* Certificate Object Attributes */
3424 certtype =
3436 }
3437 }
3439 /* The certificate type MUST be specified */
3443 /*
3444 * For X.509 certs, the CKA_SUBJECT and CKA_VALUE
3445 * must be present at creation time.
3446 */
3451 /*
3452 * For X.509 Attribute certs, the CKA_OWNER and CKA_VALUE
3453 * must be present at creation time.
3454 */
3463 }
3467 /* Certificate Object Attributes */
3493 new_object);
3497 B_FALSE)
3498 attr_mask |=
3499 NOT_MODIFIABLE_BOOL_ON;
3508 }
3533 new_object);
3538 B_FALSE)
3539 attr_mask |=
3540 NOT_MODIFIABLE_BOOL_ON;
3550 }
3555 }
3556 }
3569 }
3570 }
3572 fail_cleanup:
3575 }
3577 }
3580 /*
3581 * Validate the attribute types in the object's template. Then,
3582 * call the appropriate build function according to the class of
3583 * the object specified in the template.
3584 *
3585 * Note: The following classes of objects are supported:
3586 * - CKO_PUBLIC_KEY
3587 * - CKO_PRIVATE_KEY
3588 * - CKO_SECRET_KEY
3589 * - CKO_DOMAIN_PARAMETERS
3590 * - CKO_CERTIFICATE
3591 *
3592 */
3593 CK_RV
3596 {
3603 }
3605 /* Validate the attribute type in the template. */
3609 /*
3610 * CKA_CLASS is a mandatory attribute for C_CreateObject
3611 */
3615 /*
3616 * Call the appropriate function based on the supported class
3617 * of the object.
3618 */
3637 new_object);
3650 }
3653 }
3655 /*
3656 * Validate the attribute types in the object's template. Then,
3657 * call the appropriate build function according to the class of
3658 * the object specified in the template.
3659 *
3660 */
3661 CK_RV
3665 {
3670 /* Validate the attribute type in the template. */
3675 }
3677 /*
3678 * If either the class from the parameter list ("class") or
3679 * the class from the template ("temp_class") is not specified,
3680 * try to use the other one.
3681 */
3686 }
3688 /* If object class is still not specified, template is incomplete. */
3692 /* Class should match if specified in both parameters and template. */
3696 /*
3697 * Call the appropriate function based on the supported class
3698 * of the object.
3699 */
3703 /* Unwrapping public keys is not supported. */
3707 }
3727 /* Unwrapping domain parameters is not supported. */
3731 }
3734 new_object);
3743 }
3746 }
3749 /*
3750 * Get the value of a requested attribute that is common to all supported
3751 * classes (i.e. public key, private key, secret key, domain parameters,
3752 * and certificate classes).
3753 */
3754 CK_RV
3756 uchar_t object_type)
3757 {
3767 /* default boolean attributes */
3772 }
3775 else
3784 }
3787 else
3795 }
3798 else
3807 /*
3808 * The specified attribute for the object is invalid.
3809 * (the object does not possess such an attribute.)
3810 */
3813 }
3816 }
3818 /*
3819 * Get the value of a requested attribute that is common to all key objects
3820 * (i.e. public key, private key and secret key).
3821 */
3822 CK_RV
3824 {
3835 /*
3836 * The above extra attributes have byte array type.
3837 */
3841 /* Key related boolean attributes */
3856 }
3857 }
3859 /*
3860 * Get the value of a requested attribute of a Public Key Object.
3861 *
3862 * Rule: All the attributes in the public key object can be revealed.
3863 */
3864 CK_RV
3867 {
3876 /*
3877 * The above extra attributes have byte array type.
3878 */
3882 /* Key related boolean attributes */
3904 /*
3905 * This attribute is valid only for RSA public key
3906 * object.
3907 */
3914 }
3923 }
3932 }
3951 }
3966 }
3985 }
4008 }
4011 /*
4012 * First, get the value of the request attribute defined
4013 * in the list of common key attributes. If the request
4014 * attribute is not found in that list, then get the
4015 * attribute from the list of common attributes.
4016 */
4021 }
4023 }
4026 }
4029 /*
4030 * Get the value of a requested attribute of a Private Key Object.
4031 *
4032 * Rule: All the attributes in the private key object can be revealed
4033 * except those marked with footnote number "7" when the object
4034 * has its CKA_SENSITIVE attribute set to TRUE or its
4035 * CKA_EXTRACTABLE attribute set to FALSE (p.88 in PKCS11 spec.).
4036 */
4037 CK_RV
4040 {
4046 /*
4047 * If the following specified attributes for the private key
4048 * object cannot be revealed because the object is sensitive
4049 * or unextractable, then the ulValueLen is set to -1.
4050 */
4064 }
4065 }
4071 /*
4072 * The above extra attributes have byte array type.
4073 */
4077 /* Key related boolean attributes */
4122 }
4132 }
4142 }
4152 }
4162 }
4172 }
4182 }
4192 }
4202 }
4221 }
4236 }
4255 }
4278 }
4281 /*
4282 * First, get the value of the request attribute defined
4283 * in the list of common key attributes. If the request
4284 * attribute is not found in that list, then get the
4285 * attribute from the list of common attributes.
4286 */
4291 }
4293 }
4296 }
4299 /*
4300 * Get the value of a requested attribute of a Secret Key Object.
4301 *
4302 * Rule: All the attributes in the secret key object can be revealed
4303 * except those marked with footnote number "7" when the object
4304 * has its CKA_SENSITIVE attribute set to TRUE or its
4305 * CKA_EXTRACTABLE attribute set to FALSE (p.88 in PKCS11 spec.).
4306 */
4307 CK_RV
4310 {
4317 /* Key related boolean attributes */
4360 /*
4361 * If the specified attribute for the secret key object
4362 * cannot be revealed because the object is sensitive
4363 * or unextractable, then the ulValueLen is set to -1.
4364 */
4369 }
4389 }
4394 }
4398 /*
4399 * First, get the value of the request attribute defined
4400 * in the list of common key attributes. If the request
4401 * attribute is not found in that list, then get the
4402 * attribute from the list of common attributes.
4403 */
4408 }
4410 }
4413 }
4416 /*
4417 * Get the value of a requested attribute of a Domain Parameters Object.
4418 *
4419 * Rule: All the attributes in the domain parameters object can be revealed.
4420 */
4421 CK_RV
4424 {
4456 }
4471 }
4490 }
4509 }
4520 }
4523 /*
4524 * Get the value of a common attribute.
4525 */
4529 }
4532 }
4534 /*
4535 * Get certificate attributes from an object.
4536 * return CKR_ATTRIBUTE_TYPE_INVALID if the requested type
4537 * does not exist in the certificate.
4538 */
4539 CK_RV
4542 {
4544 cert_attr_t src;
4551 }
4560 }
4566 }
4585 }
4587 /*
4588 * If we got this far, then the combination of certificate type
4589 * and requested attribute is invalid.
4590 */
4592 }
4594 CK_RV
4597 {
4603 /* SUBJECT attr cannot be modified. */
4605 }
4609 /* OWNER attr cannot be modified. */
4611 }
4614 /* VALUE attr cannot be modified. */
4621 }
4628 }
4637 }
4639 /*
4640 * If we got this far, then the combination of certificate type
4641 * and requested attribute is invalid.
4642 */
4644 }
4646 /*
4647 * Call the appropriate get attribute function according to the class
4648 * of object.
4649 *
4650 * The caller of this function holds the lock on the object.
4651 */
4652 CK_RV
4654 {
4681 /*
4682 * If the specified attribute for the object is invalid
4683 * (the object does not possess such as attribute), then
4684 * the ulValueLen is modified to hold the value -1.
4685 */
4688 }
4692 }
4694 CK_RV
4697 {
4709 }
4712 }
4721 /*
4722 * Check if this is the special case
4723 * when the PIN is never initialized
4724 * in the keystore. If true, we will
4725 * let it pass here and let it fail
4726 * with CKR_PIN_EXPIRED later on.
4727 */
4732 }
4733 }
4736 }
4739 }
4747 else
4749 NOT_MODIFIABLE_BOOL_ON;
4752 }
4761 }
4764 }
4766 /*
4767 * Set the value of an attribute that is common to all key objects
4768 * (i.e. public key, private key and secret key).
4769 */
4770 CK_RV
4773 {
4778 /*
4779 * Only the LABEL can be modified in the common storage
4780 * object attributes after the object is created.
4781 */
4810 }
4812 }
4815 /*
4816 * Set the value of an attribute of a Public Key Object.
4817 *
4818 * Rule: The attributes marked with footnote number "8" in the PKCS11
4819 * spec may be modified (p.88 in PKCS11 spec.).
4820 */
4821 CK_RV
4824 {
4872 /*
4873 * Set the value of a common key attribute.
4874 */
4878 }
4879 /*
4880 * If we got this far, then the combination of key type
4881 * and requested attribute is invalid.
4882 */
4884 }
4887 /*
4888 * Set the value of an attribute of a Private Key Object.
4889 *
4890 * Rule: The attributes marked with footnote number "8" in the PKCS11
4891 * spec may be modified (p.88 in PKCS11 spec.).
4892 */
4893 CK_RV
4896 {
4906 /*
4907 * Cannot set SENSITIVE to FALSE if it is already ON.
4908 */
4912 }
4935 /*
4936 * Cannot set EXTRACTABLE to TRUE if it is already OFF.
4937 */
4941 }
4957 }
4981 /*
4982 * Set the value of a common key attribute.
4983 */
4986 }
4988 /*
4989 * If we got this far, then the combination of key type
4990 * and requested attribute is invalid.
4991 */
4993 }
4995 /*
4996 * Set the value of an attribute of a Secret Key Object.
4997 *
4998 * Rule: The attributes marked with footnote number "8" in the PKCS11
4999 * spec may be modified (p.88 in PKCS11 spec.).
5000 */
5001 CK_RV
5004 {
5010 /*
5011 * Cannot set SENSITIVE to FALSE if it is already ON.
5012 */
5016 }
5047 /*
5048 * Cannot set EXTRACTABLE to TRUE if it is already OFF.
5049 */
5053 }
5071 /*
5072 * Set the value of a common key attribute.
5073 */
5077 }
5078 /*
5079 * If we got this far, then the combination of key type
5080 * and requested attribute is invalid.
5081 */
5083 }
5086 /*
5087 * Call the appropriate set attribute function according to the class
5088 * of object.
5089 *
5090 * The caller of this function does not hold the lock on the original
5091 * object, since this function is setting the attribute on the new object
5092 * that is being modified.
5093 *
5094 * Argument copy: TRUE when called by C_CopyObject,
5095 * FALSE when called by C_SetAttributeValue.
5096 */
5097 CK_RV
5099 boolean_t copy)
5100 {
5122 /*
5123 * Only the LABEL can be modified in the common
5124 * storage object attributes after the object is
5125 * created.
5126 */
5131 }
5137 /*
5138 * If the template specifies a value of an attribute
5139 * which is incompatible with other existing attributes
5140 * of the object, then fails with return code
5141 * CKR_TEMPLATE_INCONSISTENT.
5142 */
5145 }
5148 }
5150 CK_RV
5153 {
5157 /* The following attributes belong to RSA */
5159 #ifdef __sparcv9
5160 len =
5161 /* LINTED */
5165 len =
5169 /* This attribute MUST BE set */
5172 }
5182 #ifdef __sparcv9
5183 len =
5184 /* LINTED */
5188 len =
5192 /* This attribute MUST BE set */
5195 }
5204 /* The following attributes belong to DSA and DH */
5208 #ifdef __sparcv9
5209 len =
5210 /* LINTED */
5213 big_value_len;
5215 len =
5217 big_value_len;
5219 else
5220 #ifdef __sparcv9
5221 len =
5222 /* LINTED */
5225 big_value_len;
5227 len =
5229 big_value_len;
5232 /* This attribute MUST BE set */
5235 }
5242 else
5250 #ifdef __sparcv9
5251 len =
5252 /* LINTED */
5256 len =
5260 /* This attribute MUST BE set */
5263 }
5275 #ifdef __sparcv9
5276 len =
5277 /* LINTED */
5280 big_value_len;
5282 len =
5284 big_value_len;
5286 else
5287 #ifdef __sparcv9
5288 len =
5289 /* LINTED */
5292 big_value_len;
5294 len =
5296 big_value_len;
5299 /* This attribute MUST BE set */
5302 }
5309 else
5318 #ifdef __sparcv9
5319 len =
5320 /* LINTED */
5323 big_value_len;
5325 len =
5327 big_value_len;
5329 else
5330 #ifdef __sparcv9
5331 len =
5332 /* LINTED */
5335 big_value_len;
5337 len =
5339 big_value_len;
5342 /* This attribute MUST BE set */
5345 }
5352 else
5358 }
5361 }
5364 CK_RV
5367 {
5373 /* The following attributes belong to RSA */
5375 #ifdef __sparcv9
5376 len =
5377 /* LINTED */
5381 len =
5385 /* This attribute MUST BE set */
5388 }
5398 #ifdef __sparcv9
5399 len =
5400 /* LINTED */
5404 len =
5408 /* This attribute MUST BE set */
5411 }
5421 #ifdef __sparcv9
5422 len =
5423 /* LINTED */
5427 len =
5433 }
5438 }
5447 #ifdef __sparcv9
5448 len =
5449 /* LINTED */
5453 len =
5459 }
5464 }
5473 #ifdef __sparcv9
5474 len =
5475 /* LINTED */
5479 len =
5485 }
5490 }
5499 #ifdef __sparcv9
5500 len =
5501 /* LINTED */
5505 len =
5511 }
5516 }
5525 #ifdef __sparcv9
5526 len =
5527 /* LINTED */
5531 len =
5537 }
5542 }
5550 /* The following attributes belong to DSA and DH */
5554 #ifdef __sparcv9
5555 len =
5556 /* LINTED */
5559 big_value_len;
5561 len =
5563 big_value_len;
5565 else
5566 #ifdef __sparcv9
5567 len =
5568 /* LINTED */
5571 big_value_len;
5573 len =
5575 big_value_len;
5578 /* This attribute MUST BE set */
5581 }
5588 else
5596 #ifdef __sparcv9
5597 len =
5598 /* LINTED */
5602 len =
5606 /* This attribute MUST BE set */
5609 }
5621 #ifdef __sparcv9
5622 len =
5623 /* LINTED */
5626 big_value_len;
5628 len =
5630 big_value_len;
5632 else
5633 #ifdef __sparcv9
5634 len =
5635 /* LINTED */
5638 big_value_len;
5640 len =
5642 big_value_len;
5645 /* This attribute MUST BE set */
5648 }
5655 else
5664 #ifdef __sparcv9
5665 len =
5666 /* LINTED */
5669 big_value_len;
5671 len =
5673 big_value_len;
5676 #ifdef __sparcv9
5677 len =
5678 /* LINTED */
5681 big_value_len;
5683 len =
5685 big_value_len;
5688 #ifdef __sparcv9
5689 len =
5690 /* LINTED */
5693 big_value_len;
5695 len =
5697 big_value_len;
5699 }
5701 /* This attribute MUST BE set */
5704 }
5719 }
5722 }
5726 }
5728 static CK_RV
5730 {
5736 }
5742 }
5744 static void
5746 {
5749 }
5778 }
5780 }
5782 CK_RV
5785 {
5793 }
5800 /* copy modulus */
5806 }
5807 /* copy public exponent */
5813 }
5820 /* copy prime */
5826 }
5828 /* copy subprime */
5834 }
5836 /* copy base */
5842 }
5844 /* copy value */
5850 }
5857 /* copy prime */
5863 }
5865 /* copy base */
5871 }
5873 /* copy value */
5879 }
5886 /* copy point */
5892 }
5899 /* copy prime */
5905 }
5907 /* copy subprime */
5913 }
5915 /* copy base */
5921 }
5923 /* copy value */
5929 }
5933 }
5936 }
5938 static void
5940 {
5943 }
5978 }
5980 }
5982 CK_RV
5985 {
5992 }
5999 /* copy modulus */
6005 }
6006 /* copy public exponent */
6012 }
6013 /* copy private exponent */
6019 }
6020 /* copy prime_1 */
6026 }
6027 /* copy prime_2 */
6033 }
6034 /* copy exponent_1 */
6040 }
6041 /* copy exponent_2 */
6047 }
6048 /* copy coefficient */
6054 }
6061 /* copy prime */
6067 }
6069 /* copy subprime */
6075 }
6077 /* copy base */
6083 }
6085 /* copy value */
6091 }
6098 /* copy prime */
6104 }
6106 /* copy base */
6112 }
6114 /* copy value */
6120 }
6127 /* copy value */
6133 }
6140 /* copy prime */
6146 }
6148 /* copy subprime */
6154 }
6156 /* copy base */
6162 }
6164 /* copy value */
6170 }
6174 }
6177 }
6179 static void
6181 {
6184 }
6203 }
6205 }
6207 CK_RV
6210 {
6217 }
6225 /* copy prime */
6231 }
6233 /* copy subprime */
6239 }
6241 /* copy base */
6247 }
6255 /* copy prime */
6261 }
6263 /* copy base */
6269 }
6277 /* copy prime */
6283 }
6285 /* copy subprime */
6291 }
6293 /* copy base */
6299 }
6304 }
6307 }
6309 CK_RV
6312 {
6318 }
6321 /* copy the secret key value */
6326 }
6330 /*
6331 * Copy the pre-expanded key schedule.
6332 */
6339 }
6343 }
6348 }
6350 /*
6351 * If CKA_CLASS not given, guess CKA_CLASS using
6352 * attributes on template .
6353 *
6354 * Some attributes are specific to an object class. If one or more
6355 * of these attributes are in the template, make a list of classes
6356 * that can have these attributes. This would speed up the search later,
6357 * because we can immediately skip an object if the class of that
6358 * object can not possibly contain one of the attributes.
6359 *
6360 */
6361 void
6364 CK_ULONG ulCount)
6365 {
6366 ulong_t i;
6381 /*
6382 * don't need to guess the class, it is specified.
6383 * Just record the class, and return.
6384 */
6389 }
6390 }
6392 num_pub_key_attrs =
6394 num_priv_key_attrs =
6396 num_secret_key_attrs =
6398 num_domain_attrs =
6400 num_hardware_attrs =
6402 num_cert_attrs =
6405 /*
6406 * Get the list of objects class that might contain
6407 * some attributes.
6408 */
6410 /*
6411 * only check if this attribute can belong to public key object
6412 * class if public key object isn't already in the list
6413 */
6419 CKO_PUBLIC_KEY;
6421 }
6422 }
6423 }
6430 CKO_PRIVATE_KEY;
6432 }
6433 }
6434 }
6441 CKO_SECRET_KEY;
6443 }
6444 }
6445 }
6452 CKO_DOMAIN_PARAMETERS;
6454 }
6455 }
6456 }
6463 CKO_HW_FEATURE;
6465 }
6466 }
6467 }
6474 CKO_CERTIFICATE;
6476 }
6477 }
6478 }
6479 }
6481 }
6483 boolean_t
6486 {
6487 ulong_t i;
6495 /*
6496 * Check if the class of this object match with any
6497 * of object classes that can possibly contain the
6498 * requested attributes.
6499 */
6504 }
6505 }
6507 /*
6508 * this object can't possibly contain one or
6509 * more attributes, don't need to check this object
6510 */
6512 }
6513 }
6515 /* need to examine everything */
6524 /* First, check the most common attributes */
6529 }
6535 }
6559 SIGN_RECOVER_BOOL_ON;
6568 VERIFY_RECOVER_BOOL_ON;
6585 SECONDARY_AUTH_BOOL_ON;
6594 EXTRACTABLE_BOOL_ON;
6599 ALWAYS_SENSITIVE_BOOL_ON;
6604 NEVER_EXTRACTABLE_BOOL_ON;
6616 {
6617 CK_BBOOL bval;
6619 NOT_MODIFIABLE_BOOL_ON;
6625 }
6628 }
6630 }
6632 /*
6633 * For X.509 attribute certificate object, get its
6634 * CKA_OWNER attribute from the x509_attr_cert_t struct.
6635 */
6640 }
6643 /*
6644 * For X.509 certificate object, get its CKA_SUBJECT
6645 * attribute from the x509_cert_t struct (not from
6646 * the extra_attrlistp).
6647 */
6653 }
6654 /*FALLTHRU*/
6664 /* find these attributes from extra_attrlistp */
6672 /* only secret key has this attribute */
6677 }
6680 }
6685 /*
6686 * secret_key_obj_t is the same as
6687 * biginteger_t
6688 */
6701 }
6713 }
6720 CKC_X_509_ATTR_CERT) {
6722 }
6727 }
6730 /* only RSA public and private key have this attr */
6738 }
6742 }
6745 /* only RSA public key has this attribute */
6752 }
6755 }
6758 /* only RSA public and private key have this attr */
6766 }
6770 }
6773 /* only RSA private key has this attribute */
6780 }
6783 /* only RSA private key has this attribute */
6790 }
6793 /* only RSA private key has this attribute */
6800 }
6803 /* only RSA private key has this attribute */
6810 }
6813 /* only RSA private key has this attribute */
6820 }
6823 /* only RSA private key has this attribute */
6830 }
6833 /* only Diffie-Hellman private key has this attr */
6840 }
6843 }
6859 }
6873 }
6887 }
6890 }
6904 }
6915 }
6926 }
6929 }
6946 }
6960 }
6974 }
6977 }
6982 CK_ULONG prime_bits;
6984 prime_bits =
6987 prime_bits =
6990 prime_bits =
6994 }
6998 }
7001 }
7006 CK_ULONG subprime_bits =
7011 }
7014 }
7017 /*
7018 * any other attributes are currently not supported.
7019 * so, it's not possible for them to be in the
7020 * object
7021 */
7023 }
7025 CK_BBOOL bval;
7031 }
7034 }
7038 }
7041 }
7045 }
7048 /*
7049 * The attribute type is valid, and its value
7050 * has not been initialized in the object. In
7051 * this case, it only matches the template's
7052 * attribute if the template's value length
7053 * is 0.
7054 */
7061 }
7065 }
7066 }
7069 /* specific attribute not found */
7071 }
7074 }
7078 }
7083 }
7084 }
7085 }
7087 }
7089 CK_ATTRIBUTE_PTR
7091 {
7092 CK_ATTRIBUTE_INFO_PTR tmp;
7098 }
7100 }
7101 /* if get there, the specified attribute is not found */
7103 }