usr/src/lib/pkcs11/pkcs11_softtoken/common/softSlotToken.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21
  22 /*
  23  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  24  */
  25
  26 #include <strings.h>
  27 #include <cryptoutil.h>
  28 #include <security/cryptoki.h>
  29 #include <sys/crypto/common.h>
  30 #include <arcfour.h>
  31 #include "softGlobal.h"
  32 #include "softSession.h"
  33 #include <aes_impl.h>
  34 #include <blowfish_impl.h>
  35 #include <des_impl.h>
  36 #include <ecc_impl.h>
  37 #include "softDH.h"
  38 #include "softObject.h"
  39 #include "softKeystore.h"
  40 #include "softKeystoreUtil.h"
  41
  42
  43 static CK_MECHANISM_TYPE soft_mechanisms[] = {
  44         CKM_DES_CBC,
  45         CKM_DES_CBC_PAD,
  46         CKM_DES_ECB,
  47         CKM_DES_KEY_GEN,
  48         CKM_DES_MAC_GENERAL,
  49         CKM_DES_MAC,
  50         CKM_DES3_CBC,
  51         CKM_DES3_CBC_PAD,
  52         CKM_DES3_ECB,
  53         CKM_DES2_KEY_GEN,
  54         CKM_DES3_KEY_GEN,
  55         CKM_AES_CBC,
  56         CKM_AES_CBC_PAD,
  57         CKM_AES_CTR,
  58         CKM_AES_ECB,
  59         CKM_AES_KEY_GEN,
  60         CKM_BLOWFISH_CBC,
  61         CKM_BLOWFISH_KEY_GEN,
  62         CKM_SHA_1,
  63         CKM_SHA_1_HMAC,
  64         CKM_SHA_1_HMAC_GENERAL,
  65         CKM_SHA256,
  66         CKM_SHA256_HMAC,
  67         CKM_SHA256_HMAC_GENERAL,
  68         CKM_SHA384,
  69         CKM_SHA384_HMAC,
  70         CKM_SHA384_HMAC_GENERAL,
  71         CKM_SHA512,
  72         CKM_SHA512_HMAC,
  73         CKM_SHA512_HMAC_GENERAL,
  74         CKM_SSL3_SHA1_MAC,
  75         CKM_MD5,
  76         CKM_MD5_HMAC,
  77         CKM_MD5_HMAC_GENERAL,
  78         CKM_SSL3_MD5_MAC,
  79         CKM_RC4,
  80         CKM_RC4_KEY_GEN,
  81         CKM_DSA,
  82         CKM_DSA_SHA1,
  83         CKM_DSA_KEY_PAIR_GEN,
  84         CKM_RSA_PKCS,
  85         CKM_RSA_PKCS_KEY_PAIR_GEN,
  86         CKM_RSA_X_509,
  87         CKM_MD5_RSA_PKCS,
  88         CKM_SHA1_RSA_PKCS,
  89         CKM_SHA256_RSA_PKCS,
  90         CKM_SHA384_RSA_PKCS,
  91         CKM_SHA512_RSA_PKCS,
  92         CKM_DH_PKCS_KEY_PAIR_GEN,
  93         CKM_DH_PKCS_DERIVE,
  94         CKM_MD5_KEY_DERIVATION,
  95         CKM_SHA1_KEY_DERIVATION,
  96         CKM_SHA256_KEY_DERIVATION,
  97         CKM_SHA384_KEY_DERIVATION,
  98         CKM_SHA512_KEY_DERIVATION,
  99         CKM_PBE_SHA1_RC4_128,
 100         CKM_PKCS5_PBKD2,
 101         CKM_SSL3_PRE_MASTER_KEY_GEN,
 102         CKM_TLS_PRE_MASTER_KEY_GEN,
 103         CKM_SSL3_MASTER_KEY_DERIVE,
 104         CKM_TLS_MASTER_KEY_DERIVE,
 105         CKM_SSL3_MASTER_KEY_DERIVE_DH,
 106         CKM_TLS_MASTER_KEY_DERIVE_DH,
 107         CKM_SSL3_KEY_AND_MAC_DERIVE,
 108         CKM_TLS_KEY_AND_MAC_DERIVE,
 109         CKM_TLS_PRF,
 110         CKM_EC_KEY_PAIR_GEN,
 111         CKM_ECDSA,
 112         CKM_ECDSA_SHA1,
 113         CKM_ECDH1_DERIVE
 114 };
 115
 116 /*
 117  * This is the table of CK_MECHANISM_INFO structs for the supported mechanisms.
 118  * The index for this table is the same as the one above for the same
 119  * mechanism.
 120  * The minimum and maximum sizes of the key for the mechanism can be measured
 121  * in bits or in bytes (i.e. mechanism-dependent). This table specifies the
 122  * supported range of key sizes in bytes; unless noted as in bits.
 123  */
 124 static CK_MECHANISM_INFO soft_mechanism_info[] = {
 125         {DES_MINBYTES, DES_MAXBYTES,
 126                 CKF_ENCRYPT|CKF_DECRYPT|
 127                 CKF_WRAP|CKF_UNWRAP},           /* CKM_DES_CBC */
 128         {DES_MINBYTES, DES_MAXBYTES,
 129                 CKF_ENCRYPT|CKF_DECRYPT|
 130                 CKF_WRAP|CKF_UNWRAP},           /* CKM_DES_CBC_PAD */
 131         {DES_MINBYTES, DES_MAXBYTES,
 132                 CKF_ENCRYPT|CKF_DECRYPT|
 133                 CKF_WRAP|CKF_UNWRAP},           /* CKM_DES_ECB */
 134         {DES_MINBYTES, DES_MAXBYTES,
 135                 CKF_GENERATE},                  /* CKM_DES_KEY_GEN */
 136         {DES_MINBYTES, DES_MAXBYTES,
 137                 CKF_SIGN|CKF_VERIFY},           /* CKM_DES_MAC_GENERAL */
 138         {DES_MINBYTES, DES_MAXBYTES,
 139                 CKF_SIGN|CKF_VERIFY},           /* CKM_DES_MAC */
 140         {DES3_MINBYTES, DES3_MAXBYTES,
 141                 CKF_ENCRYPT|CKF_DECRYPT|
 142                 CKF_WRAP|CKF_UNWRAP},           /* CKM_DES3_CBC */
 143         {DES3_MINBYTES, DES3_MAXBYTES,
 144                 CKF_ENCRYPT|CKF_DECRYPT|
 145                 CKF_WRAP|CKF_UNWRAP},           /* CKM_DES3_CBC_PAD */
 146         {DES3_MINBYTES, DES3_MAXBYTES,
 147                 CKF_ENCRYPT|CKF_DECRYPT|
 148                 CKF_WRAP|CKF_UNWRAP},           /* CKM_DES3_ECB */
 149         {DES2_MAXBYTES, DES2_MAXBYTES,
 150                 CKF_GENERATE},                  /* CKM_DES2_KEY_GEN */
 151         {DES3_MAXBYTES, DES3_MAXBYTES,          /* CKK_DES3 only */
 152                 CKF_GENERATE},                  /* CKM_DES3_KEY_GEN */
 153         {AES_MINBYTES, AES_MAXBYTES,
 154                 CKF_ENCRYPT|CKF_DECRYPT|
 155                 CKF_WRAP|CKF_UNWRAP},           /* CKM_AES_CBC */
 156         {AES_MINBYTES, AES_MAXBYTES,
 157                 CKF_ENCRYPT|CKF_DECRYPT|
 158                 CKF_WRAP|CKF_UNWRAP},           /* CKM_AES_CBC_PAD */
 159         {AES_MINBYTES, AES_MAXBYTES,
 160                 CKF_ENCRYPT|CKF_DECRYPT|
 161                 CKF_WRAP|CKF_UNWRAP},           /* CKM_AES_CTR */
 162         {AES_MINBYTES, AES_MAXBYTES,
 163                 CKF_ENCRYPT|CKF_DECRYPT|
 164                 CKF_WRAP|CKF_UNWRAP},           /* CKM_AES_ECB */
 165         {AES_MINBYTES, AES_MAXBYTES,
 166                 CKF_GENERATE},                  /* CKM_AES_KEY_GEN */
 167         {BLOWFISH_MINBYTES, BLOWFISH_MAXBYTES,
 168                 CKF_ENCRYPT|CKF_DECRYPT|
 169                 CKF_WRAP|CKF_UNWRAP},           /* CKM_BLOWFISH_ECB */
 170         {BLOWFISH_MINBYTES, BLOWFISH_MAXBYTES,
 171                 CKF_GENERATE},                  /* CKM_BLOWFISH_KEY_GEN */
 172         {0, 0, CKF_DIGEST},                     /* CKM_SHA_1 */
 173         {1, 64, CKF_SIGN|CKF_VERIFY},           /* CKM_SHA_1_HMAC */
 174         {1, 64, CKF_SIGN|CKF_VERIFY},           /* CKM_SHA_1_HMAC_GENERAL */
 175         {0, 0, CKF_DIGEST},                     /* CKM_SHA256 */
 176         {1, 64, CKF_SIGN|CKF_VERIFY},           /* CKM_SHA256_HMAC */
 177         {1, 64, CKF_SIGN|CKF_VERIFY},           /* CKM_SHA256_HMAC_GENERAL */
 178         {0, 0, CKF_DIGEST},                     /* CKM_SHA384 */
 179         {1, 128, CKF_SIGN|CKF_VERIFY},          /* CKM_SHA384_HMAC */
 180         {1, 128, CKF_SIGN|CKF_VERIFY},          /* CKM_SHA384_HMAC_GENERAL */
 181         {0, 0, CKF_DIGEST},                     /* CKM_SHA512 */
 182         {1, 128, CKF_SIGN|CKF_VERIFY},          /* CKM_SHA512_HMAC */
 183         {1, 128, CKF_SIGN|CKF_VERIFY},          /* CKM_SHA512_HMAC_GENERAL */
 184         {1, 512, CKF_SIGN|CKF_VERIFY},          /* CKM_SSL3_SHA1_MAC */
 185         {0, 0, CKF_DIGEST},                     /* CKM_MD5 */
 186         {1, 64, CKF_SIGN|CKF_VERIFY},           /* CKM_MD5_HMAC */
 187         {1, 64, CKF_SIGN|CKF_VERIFY},           /* CKM_MD5_HMAC_GENERAL */
 188         {1, 512, CKF_SIGN|CKF_VERIFY},          /* CKM_SSL3_MD5_MAC */
 189         {8, ARCFOUR_MAX_KEY_BITS, CKF_ENCRYPT|CKF_DECRYPT}, /* CKM_RC4; */
 190                                                             /* in bits  */
 191         {8, ARCFOUR_MAX_KEY_BITS, CKF_GENERATE }, /* CKM_RC4_KEY_GEN; in bits */
 192         {512, 1024, CKF_SIGN|CKF_VERIFY},       /* CKM_DSA; in bits */
 193         {512, 1024, CKF_SIGN|CKF_VERIFY},       /* CKM_DSA_SHA1; in bits */
 194         {512, 1024, CKF_GENERATE_KEY_PAIR},     /* CKM_DSA_KEY_PAIR_GEN; */
 195                                                 /* in bits */
 196         {256, 4096, CKF_ENCRYPT|CKF_DECRYPT|
 197                 CKF_SIGN|CKF_SIGN_RECOVER|
 198                 CKF_WRAP|CKF_UNWRAP|
 199                 CKF_VERIFY|CKF_VERIFY_RECOVER}, /* CKM_RSA_PKCS; in bits */
 200         {256, 4096, CKF_GENERATE_KEY_PAIR},     /* CKM_RSA_PKCS_KEY_PAIR_GEN; */
 201                                                 /* in bits */
 202         {256, 4096, CKF_ENCRYPT|CKF_DECRYPT|
 203                 CKF_SIGN|CKF_SIGN_RECOVER|
 204                 CKF_WRAP|CKF_UNWRAP|
 205                 CKF_VERIFY|CKF_VERIFY_RECOVER}, /* CKM_RSA_X_509 in bits */
 206         {256, 4096, CKF_SIGN|CKF_VERIFY},       /* CKM_MD5_RSA_PKCS in bits */
 207         {256, 4096, CKF_SIGN|CKF_VERIFY},       /* CKM_SHA1_RSA_PKCS in bits */
 208         {256, 4096, CKF_SIGN|CKF_VERIFY}, /* CKM_SHA256_RSA_PKCS in bits */
 209         {256, 4096, CKF_SIGN|CKF_VERIFY}, /* CKM_SHA384_RSA_PKCS in bits */
 210         {256, 4096, CKF_SIGN|CKF_VERIFY}, /* CKM_SHA512_RSA_PKCS in bits */
 211         {DH_MIN_KEY_LEN, DH_MAX_KEY_LEN, CKF_GENERATE_KEY_PAIR},
 212                                                 /* CKM_DH_PKCS_KEY_PAIR_GEN */
 213                                                 /* in bits */
 214         {DH_MIN_KEY_LEN, DH_MAX_KEY_LEN, CKF_DERIVE},
 215                                                 /* CKM_DH_PKCS_DERIVE; */
 216                                                 /* in bits */
 217         {1, 16, CKF_DERIVE},                    /* CKM_MD5_KEY_DERIVATION */
 218         {1, 20, CKF_DERIVE},                    /* CKM_SHA1_KEY_DERIVATION */
 219         {1, 32, CKF_DERIVE},                    /* CKM_SHA256_KEY_DERIVATION */
 220         {1, 48, CKF_DERIVE},                    /* CKM_SHA384_KEY_DERIVATION */
 221         {1, 64, CKF_DERIVE},                    /* CKM_SHA512_KEY_DERIVATION */
 222         {0, 0, CKF_GENERATE},                   /* CKM_PBE_SHA1_RC4_128 */
 223         {0, 0, CKF_GENERATE},                   /* CKM_PKCS5_PBKD2 */
 224         {48, 48, CKF_GENERATE},         /* CKM_SSL3_PRE_MASTER_KEY_GEN */
 225         {48, 48, CKF_GENERATE},         /* CKM_TLS_PRE_MASTER_KEY_GEN */
 226         {48, 48, CKF_DERIVE},           /* CKM_SSL3_MASTER_KEY_DERIVE */
 227         {48, 48, CKF_DERIVE},           /* CKM_TLS_MASTER_KEY_DERIVE */
 228         {48, 48, CKF_DERIVE},           /* CKM_SSL3_MASTER_KEY_DERIVE_DH */
 229         {48, 48, CKF_DERIVE},           /* CKM_TLS_MASTER_KEY_DERIVE_DH */
 230         {0, 0, CKF_DERIVE},             /* CKM_SSL3_KEY_AND_MAC_DERIVE */
 231         {0, 0, CKF_DERIVE},             /* CKM_TLS_KEY_AND_MAC_DERIVE */
 232         {0, 0, CKF_DERIVE},             /* CKM_TLS_PRF */
 233         {EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CKF_GENERATE_KEY_PAIR},
 234         {EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CKF_SIGN|CKF_VERIFY},
 235         {EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CKF_SIGN|CKF_VERIFY},
 236         {EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CKF_DERIVE}
 237 };
 238
 239 /*
 240  * Slot ID for softtoken is always 1. tokenPresent is ignored.
 241  * Also, only one slot is used.
 242  */
 243 /*ARGSUSED*/
 244 CK_RV
 245 C_GetSlotList(CK_BBOOL tokenPresent, CK_SLOT_ID_PTR pSlotList,
 246     CK_ULONG_PTR pulCount)
 247 {
 248
 249         CK_RV rv;
 250
 251         if (!softtoken_initialized)
 252                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 253
 254         if (pulCount == NULL) {
 255                 return (CKR_ARGUMENTS_BAD);
 256         }
 257
 258         if (pSlotList == NULL) {
 259                 /*
 260                  * Application only wants to know the number of slots.
 261                  */
 262                 *pulCount = 1;
 263                 return (CKR_OK);
 264         }
 265
 266         if ((*pulCount < 1) && (pSlotList != NULL)) {
 267                 rv = CKR_BUFFER_TOO_SMALL;
 268         } else {
 269                 pSlotList[0] = SOFTTOKEN_SLOTID;
 270                 rv = CKR_OK;
 271         }
 272
 273         *pulCount = 1;
 274         return (rv);
 275 }
 276
 277
 278 CK_RV
 279 C_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo)
 280 {
 281
 282         if (!softtoken_initialized)
 283                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 284
 285         if (pInfo == NULL)
 286                 return (CKR_ARGUMENTS_BAD);
 287
 288         /* Make sure the slot ID is valid */
 289         if (slotID != SOFTTOKEN_SLOTID)
 290                 return (CKR_SLOT_ID_INVALID);
 291
 292         /* Provide information about the slot in the provided buffer */
 293         (void) strncpy((char *)pInfo->slotDescription, SOFT_SLOT_DESCRIPTION,
 294             64);
 295         (void) strncpy((char *)pInfo->manufacturerID, SOFT_MANUFACTURER_ID, 32);
 296         pInfo->flags = CKF_TOKEN_PRESENT;
 297         pInfo->hardwareVersion.major = HARDWARE_VERSION_MAJOR;
 298         pInfo->hardwareVersion.minor = HARDWARE_VERSION_MINOR;
 299         pInfo->firmwareVersion.major = FIRMWARE_VERSION_MAJOR;
 300         pInfo->firmwareVersion.minor = FIRMWARE_VERSION_MINOR;
 301
 302         return (CKR_OK);
 303 }
 304
 305 CK_RV
 306 C_GetTokenInfo(CK_SLOT_ID slotID, CK_TOKEN_INFO_PTR pInfo)
 307 {
 308         boolean_t pin_initialized = B_FALSE;
 309         char    *ks_cryptpin = NULL;
 310
 311         if (!softtoken_initialized)
 312                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 313
 314         /* Make sure the slot ID is valid */
 315         if (slotID != SOFTTOKEN_SLOTID)
 316                 return (CKR_SLOT_ID_INVALID);
 317
 318         if (pInfo == NULL)
 319                 return (CKR_ARGUMENTS_BAD);
 320
 321         /*
 322          * It is intentional that we don't forward the error code
 323          * returned from soft_keystore_pin_initialized() to the caller
 324          */
 325         pInfo->flags = SOFT_TOKEN_FLAGS;
 326         if (soft_slot.keystore_load_status == KEYSTORE_UNAVAILABLE) {
 327                 pInfo->flags |= CKF_WRITE_PROTECTED;
 328         } else {
 329                 if ((soft_keystore_pin_initialized(&pin_initialized,
 330                     &ks_cryptpin, B_FALSE) == CKR_OK) && !pin_initialized)
 331                         pInfo->flags |= CKF_USER_PIN_TO_BE_CHANGED;
 332         }
 333
 334         if (ks_cryptpin)
 335                 free(ks_cryptpin);
 336
 337         /* Provide information about a token in the provided buffer */
 338         (void) strncpy((char *)pInfo->label, SOFT_TOKEN_LABEL, 32);
 339         (void) strncpy((char *)pInfo->manufacturerID, SOFT_MANUFACTURER_ID, 32);
 340         (void) strncpy((char *)pInfo->model, TOKEN_MODEL, 16);
 341         (void) strncpy((char *)pInfo->serialNumber, SOFT_TOKEN_SERIAL, 16);
 342
 343         pInfo->ulMaxSessionCount = CK_EFFECTIVELY_INFINITE;
 344         pInfo->ulSessionCount = soft_session_cnt;
 345         pInfo->ulMaxRwSessionCount = CK_EFFECTIVELY_INFINITE;
 346         pInfo->ulRwSessionCount = soft_session_rw_cnt;
 347         pInfo->ulMaxPinLen = MAX_PIN_LEN;
 348         pInfo->ulMinPinLen = MIN_PIN_LEN;
 349         pInfo->ulTotalPublicMemory = CK_UNAVAILABLE_INFORMATION;
 350         pInfo->ulFreePublicMemory = CK_UNAVAILABLE_INFORMATION;
 351         pInfo->ulTotalPrivateMemory = CK_UNAVAILABLE_INFORMATION;
 352         pInfo->ulFreePrivateMemory = CK_UNAVAILABLE_INFORMATION;
 353         pInfo->hardwareVersion.major = HARDWARE_VERSION_MAJOR;
 354         pInfo->hardwareVersion.minor = HARDWARE_VERSION_MINOR;
 355         pInfo->firmwareVersion.major = FIRMWARE_VERSION_MAJOR;
 356         pInfo->firmwareVersion.minor = FIRMWARE_VERSION_MINOR;
 357         (void) memset(pInfo->utcTime, ' ', 16);
 358
 359         return (CKR_OK);
 360 }
 361
 362 /*ARGSUSED*/
 363 CK_RV
 364 C_WaitForSlotEvent(CK_FLAGS flags, CK_SLOT_ID_PTR pSlot, CK_VOID_PTR pReserved)
 365 {
 366         if (!softtoken_initialized)
 367                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 368
 369         /*
 370          * This is currently not implemented, however we could cause this
 371          * to wait for the token files to appear if soft_token_present is
 372          * false.
 373          * However there is currently no polite and portable way to do that
 374          * because we might not even be able to get to an fd to the
 375          * parent directory, so instead we don't support any slot events.
 376          */
 377         return (CKR_FUNCTION_NOT_SUPPORTED);
 378 }
 379
 380
 381 CK_RV
 382 C_GetMechanismList(CK_SLOT_ID slotID, CK_MECHANISM_TYPE_PTR pMechanismList,
 383     CK_ULONG_PTR pulCount)
 384 {
 385
 386         ulong_t i;
 387         ulong_t mechnum;
 388
 389         if (!softtoken_initialized)
 390                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 391
 392         if (slotID != SOFTTOKEN_SLOTID)
 393                 return (CKR_SLOT_ID_INVALID);
 394
 395         mechnum = sizeof (soft_mechanisms) / sizeof (CK_MECHANISM_TYPE);
 396
 397         if (pMechanismList == NULL) {
 398                 /*
 399                  * Application only wants to know the number of
 400                  * supported mechanism types.
 401                  */
 402                 *pulCount = mechnum;
 403                 return (CKR_OK);
 404         }
 405
 406         if (*pulCount < mechnum) {
 407                 *pulCount = mechnum;
 408                 return (CKR_BUFFER_TOO_SMALL);
 409         }
 410
 411         for (i = 0; i < mechnum; i++) {
 412                 pMechanismList[i] = soft_mechanisms[i];
 413         }
 414
 415         *pulCount = mechnum;
 416
 417         return (CKR_OK);
 418 }
 419
 420
 421 CK_RV
 422 C_GetMechanismInfo(CK_SLOT_ID slotID, CK_MECHANISM_TYPE type,
 423     CK_MECHANISM_INFO_PTR pInfo)
 424 {
 425
 426         ulong_t i;
 427         ulong_t mechnum;
 428
 429         if (!softtoken_initialized)
 430                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 431
 432         if (slotID != SOFTTOKEN_SLOTID)
 433                 return (CKR_SLOT_ID_INVALID);
 434
 435         if (pInfo == NULL) {
 436                 return (CKR_ARGUMENTS_BAD);
 437         }
 438
 439         mechnum = sizeof (soft_mechanisms) / sizeof (CK_MECHANISM_TYPE);
 440         for (i = 0; i < mechnum; i++) {
 441                 if (soft_mechanisms[i] == type)
 442                         break;
 443         }
 444
 445         if (i == mechnum)
 446                 /* unsupported mechanism */
 447                 return (CKR_MECHANISM_INVALID);
 448
 449         pInfo->ulMinKeySize = soft_mechanism_info[i].ulMinKeySize;
 450         pInfo->ulMaxKeySize = soft_mechanism_info[i].ulMaxKeySize;
 451         pInfo->flags = soft_mechanism_info[i].flags;
 452
 453         return (CKR_OK);
 454 }
 455
 456
 457 /*ARGSUSED*/
 458 CK_RV
 459 C_InitToken(CK_SLOT_ID slotID, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen,
 460     CK_UTF8CHAR_PTR pLabel)
 461 {
 462         if (!softtoken_initialized)
 463                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 464
 465         if (create_keystore() != 0)
 466                 return (CKR_FUNCTION_FAILED);
 467
 468         return (CKR_OK);
 469 }
 470
 471 /*ARGSUSED*/
 472 CK_RV
 473 C_InitPIN(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen)
 474 {
 475         if (!softtoken_initialized)
 476                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 477
 478         return (CKR_FUNCTION_NOT_SUPPORTED);
 479 }
 480
 481
 482 CK_RV
 483 C_SetPIN(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pOldPin,
 484     CK_ULONG ulOldPinLen, CK_UTF8CHAR_PTR pNewPin, CK_ULONG ulNewPinLen)
 485 {
 486
 487         soft_session_t *session_p;
 488         CK_RV rv;
 489         boolean_t lock_held = B_FALSE;
 490
 491         if (!softtoken_initialized)
 492                 return (CKR_CRYPTOKI_NOT_INITIALIZED);
 493
 494         /*
 495          * Obtain the session pointer. Also, increment the session
 496          * reference count.
 497          */
 498         rv = handle2session(hSession, &session_p);
 499         if (rv != CKR_OK)
 500                 return (rv);
 501
 502         if (!soft_keystore_status(KEYSTORE_LOAD)) {
 503                 SES_REFRELE(session_p, lock_held);
 504                 return (CKR_DEVICE_REMOVED);
 505         }
 506
 507         if ((ulOldPinLen < MIN_PIN_LEN) || (ulOldPinLen > MAX_PIN_LEN) ||
 508             (ulNewPinLen < MIN_PIN_LEN) ||(ulNewPinLen > MAX_PIN_LEN)) {
 509                 SES_REFRELE(session_p, lock_held);
 510                 return (CKR_PIN_LEN_RANGE);
 511         }
 512
 513         if ((pOldPin == NULL_PTR) || (pNewPin == NULL_PTR)) {
 514                 /*
 515                  * We don't support CKF_PROTECTED_AUTHENTICATION_PATH
 516                  */
 517                 SES_REFRELE(session_p, lock_held);
 518                 return (CKR_ARGUMENTS_BAD);
 519         }
 520
 521         /* check the state of the session */
 522         if ((session_p->state != CKS_RW_PUBLIC_SESSION) &&
 523             (session_p->state != CKS_RW_USER_FUNCTIONS)) {
 524                 SES_REFRELE(session_p, lock_held);
 525                 return (CKR_SESSION_READ_ONLY);
 526         }
 527
 528         rv = soft_setpin(pOldPin, ulOldPinLen, pNewPin, ulNewPinLen);
 529
 530         SES_REFRELE(session_p, lock_held);
 531         return (rv);
 532 }