1 // SPDX-License-Identifier: BSD-2-Clause
2 /*
3 * Copyright (c) 2018-2020, Linaro Limited
4 */
5
6 #include <pkcs11_ta.h>
7 #include <string.h>
8 #include <tee_internal_api.h>
9 #include <util.h>
10
11 #include "attributes.h"
12 #include "object.h"
13 #include "pkcs11_attributes.h"
14 #include "pkcs11_helpers.h"
15 #include "processing.h"
16
17 static const char __maybe_unused unknown[] = "<unknown-identifier>";
18
19 struct attr_size {
20 uint32_t id;
21 uint32_t size;
22 #if CFG_TEE_TA_LOG_LEVEL > 0
23 const char *string;
24 #endif
25 };
26
27 #if CFG_TEE_TA_LOG_LEVEL > 0
28 #define PKCS11_ID_SZ(_id, _sz) \
29 { .id = (uint32_t)(_id), .size = (_sz), .string = #_id }
30 #else
31 #define PKCS11_ID_SZ(_id, _sz) \
32 { .id = (uint32_t)(_id), .size = (_sz) }
33 #endif
34
35 static const struct attr_size attr_ids[] = {
36 PKCS11_ID_SZ(PKCS11_CKA_CLASS, 4),
37 PKCS11_ID_SZ(PKCS11_CKA_KEY_TYPE, 4),
38 PKCS11_ID_SZ(PKCS11_CKA_VALUE, 0),
39 PKCS11_ID_SZ(PKCS11_CKA_VALUE_LEN, 4),
40 PKCS11_ID_SZ(PKCS11_CKA_KEY_GEN_MECHANISM, 4),
41 PKCS11_ID_SZ(PKCS11_CKA_LABEL, 0),
42 PKCS11_ID_SZ(PKCS11_CKA_CERTIFICATE_TYPE, 4),
43 PKCS11_ID_SZ(PKCS11_CKA_ISSUER, 0),
44 PKCS11_ID_SZ(PKCS11_CKA_SERIAL_NUMBER, 0),
45 PKCS11_ID_SZ(PKCS11_CKA_CERTIFICATE_CATEGORY, 4),
46 PKCS11_ID_SZ(PKCS11_CKA_URL, 0),
47 PKCS11_ID_SZ(PKCS11_CKA_HASH_OF_SUBJECT_PUBLIC_KEY, 0),
48 PKCS11_ID_SZ(PKCS11_CKA_HASH_OF_ISSUER_PUBLIC_KEY, 0),
49 PKCS11_ID_SZ(PKCS11_CKA_JAVA_MIDP_SECURITY_DOMAIN, 4),
50 PKCS11_ID_SZ(PKCS11_CKA_NAME_HASH_ALGORITHM, 4),
51 PKCS11_ID_SZ(PKCS11_CKA_CHECK_VALUE, 0),
52 PKCS11_ID_SZ(PKCS11_CKA_WRAP_TEMPLATE, 0),
53 PKCS11_ID_SZ(PKCS11_CKA_UNWRAP_TEMPLATE, 0),
54 PKCS11_ID_SZ(PKCS11_CKA_DERIVE_TEMPLATE, 0),
55 PKCS11_ID_SZ(PKCS11_CKA_START_DATE, 4),
56 PKCS11_ID_SZ(PKCS11_CKA_END_DATE, 4),
57 PKCS11_ID_SZ(PKCS11_CKA_OBJECT_ID, 0),
58 PKCS11_ID_SZ(PKCS11_CKA_APPLICATION, 0),
59 PKCS11_ID_SZ(PKCS11_CKA_MECHANISM_TYPE, 4),
60 PKCS11_ID_SZ(PKCS11_CKA_ID, 0),
61 PKCS11_ID_SZ(PKCS11_CKA_ALLOWED_MECHANISMS, 0),
62 PKCS11_ID_SZ(PKCS11_CKA_EC_POINT, 0),
63 PKCS11_ID_SZ(PKCS11_CKA_EC_PARAMS, 0),
64 PKCS11_ID_SZ(PKCS11_CKA_MODULUS, 0),
65 PKCS11_ID_SZ(PKCS11_CKA_MODULUS_BITS, 4),
66 PKCS11_ID_SZ(PKCS11_CKA_PUBLIC_EXPONENT, 0),
67 PKCS11_ID_SZ(PKCS11_CKA_PRIVATE_EXPONENT, 0),
68 PKCS11_ID_SZ(PKCS11_CKA_PRIME_1, 0),
69 PKCS11_ID_SZ(PKCS11_CKA_PRIME_2, 0),
70 PKCS11_ID_SZ(PKCS11_CKA_EXPONENT_1, 0),
71 PKCS11_ID_SZ(PKCS11_CKA_EXPONENT_2, 0),
72 PKCS11_ID_SZ(PKCS11_CKA_COEFFICIENT, 0),
73 PKCS11_ID_SZ(PKCS11_CKA_SUBJECT, 0),
74 PKCS11_ID_SZ(PKCS11_CKA_PUBLIC_KEY_INFO, 0),
75 PKCS11_ID_SZ(PKCS11_CKA_KEY_GEN_MECHANISM, 4),
76 /* Below are boolean attributes */
77 PKCS11_ID_SZ(PKCS11_CKA_TOKEN, 1),
78 PKCS11_ID_SZ(PKCS11_CKA_PRIVATE, 1),
79 PKCS11_ID_SZ(PKCS11_CKA_TRUSTED, 1),
80 PKCS11_ID_SZ(PKCS11_CKA_SENSITIVE, 1),
81 PKCS11_ID_SZ(PKCS11_CKA_ENCRYPT, 1),
82 PKCS11_ID_SZ(PKCS11_CKA_DECRYPT, 1),
83 PKCS11_ID_SZ(PKCS11_CKA_WRAP, 1),
84 PKCS11_ID_SZ(PKCS11_CKA_UNWRAP, 1),
85 PKCS11_ID_SZ(PKCS11_CKA_SIGN, 1),
86 PKCS11_ID_SZ(PKCS11_CKA_SIGN_RECOVER, 1),
87 PKCS11_ID_SZ(PKCS11_CKA_VERIFY, 1),
88 PKCS11_ID_SZ(PKCS11_CKA_VERIFY_RECOVER, 1),
89 PKCS11_ID_SZ(PKCS11_CKA_DERIVE, 1),
90 PKCS11_ID_SZ(PKCS11_CKA_EXTRACTABLE, 1),
91 PKCS11_ID_SZ(PKCS11_CKA_LOCAL, 1),
92 PKCS11_ID_SZ(PKCS11_CKA_NEVER_EXTRACTABLE, 1),
93 PKCS11_ID_SZ(PKCS11_CKA_ALWAYS_SENSITIVE, 1),
94 PKCS11_ID_SZ(PKCS11_CKA_MODIFIABLE, 1),
95 PKCS11_ID_SZ(PKCS11_CKA_COPYABLE, 1),
96 PKCS11_ID_SZ(PKCS11_CKA_DESTROYABLE, 1),
97 PKCS11_ID_SZ(PKCS11_CKA_ALWAYS_AUTHENTICATE, 1),
98 PKCS11_ID_SZ(PKCS11_CKA_WRAP_WITH_TRUSTED, 1),
99 /* Specific PKCS11 TA internal attribute ID */
100 PKCS11_ID_SZ(PKCS11_CKA_OPTEE_HIDDEN_EC_POINT, 0),
101 PKCS11_ID_SZ(PKCS11_CKA_UNDEFINED_ID, 0),
102 };
103
104 struct any_id {
105 uint32_t id;
106 #if CFG_TEE_TA_LOG_LEVEL > 0
107 const char *string;
108 #endif
109 };
110
111 /*
112 * Macro PKCS11_ID() can be used to define cells in ID list arrays
113 * or ID/string conversion arrays.
114 */
115 #if CFG_TEE_TA_LOG_LEVEL > 0
116 #define PKCS11_ID(_id) { .id = _id, .string = #_id }
117 #else
118 #define PKCS11_ID(_id) { .id = _id }
119 #endif
120
121 #define ID2STR(id, table, prefix) \
122 id2str(id, table, ARRAY_SIZE(table), prefix)
123
124 #if CFG_TEE_TA_LOG_LEVEL > 0
125 /* Convert a PKCS11 ID into its label string */
id2str(uint32_t id,const struct any_id * table,size_t count,const char * prefix)126 static const char *id2str(uint32_t id, const struct any_id *table,
127 size_t count, const char *prefix)
128 {
129 size_t n = 0;
130 const char *str = NULL;
131
132 for (n = 0; n < count; n++) {
133 if (id != table[n].id)
134 continue;
135
136 str = table[n].string;
137
138 /* Skip prefix provided matches found */
139 if (prefix && !TEE_MemCompare(str, prefix, strlen(prefix)))
140 str += strlen(prefix);
141
142 return str;
143 }
144
145 return unknown;
146 }
147 #endif /* CFG_TEE_TA_LOG_LEVEL > 0 */
148
149 /*
150 * TA command IDs: used only as ID/string conversion for debug trace support
151 */
152 static const struct any_id __maybe_unused string_ta_cmd[] = {
153 PKCS11_ID(PKCS11_CMD_PING),
154 PKCS11_ID(PKCS11_CMD_SLOT_LIST),
155 PKCS11_ID(PKCS11_CMD_SLOT_INFO),
156 PKCS11_ID(PKCS11_CMD_TOKEN_INFO),
157 PKCS11_ID(PKCS11_CMD_MECHANISM_IDS),
158 PKCS11_ID(PKCS11_CMD_MECHANISM_INFO),
159 PKCS11_ID(PKCS11_CMD_OPEN_SESSION),
160 PKCS11_ID(PKCS11_CMD_SESSION_INFO),
161 PKCS11_ID(PKCS11_CMD_CLOSE_SESSION),
162 PKCS11_ID(PKCS11_CMD_CLOSE_ALL_SESSIONS),
163 PKCS11_ID(PKCS11_CMD_INIT_TOKEN),
164 PKCS11_ID(PKCS11_CMD_INIT_PIN),
165 PKCS11_ID(PKCS11_CMD_SET_PIN),
166 PKCS11_ID(PKCS11_CMD_LOGIN),
167 PKCS11_ID(PKCS11_CMD_LOGOUT),
168 PKCS11_ID(PKCS11_CMD_CREATE_OBJECT),
169 PKCS11_ID(PKCS11_CMD_DESTROY_OBJECT),
170 PKCS11_ID(PKCS11_CMD_ENCRYPT_INIT),
171 PKCS11_ID(PKCS11_CMD_DECRYPT_INIT),
172 PKCS11_ID(PKCS11_CMD_ENCRYPT_UPDATE),
173 PKCS11_ID(PKCS11_CMD_DECRYPT_UPDATE),
174 PKCS11_ID(PKCS11_CMD_ENCRYPT_FINAL),
175 PKCS11_ID(PKCS11_CMD_DECRYPT_FINAL),
176 PKCS11_ID(PKCS11_CMD_ENCRYPT_ONESHOT),
177 PKCS11_ID(PKCS11_CMD_DECRYPT_ONESHOT),
178 PKCS11_ID(PKCS11_CMD_SIGN_INIT),
179 PKCS11_ID(PKCS11_CMD_VERIFY_INIT),
180 PKCS11_ID(PKCS11_CMD_SIGN_UPDATE),
181 PKCS11_ID(PKCS11_CMD_VERIFY_UPDATE),
182 PKCS11_ID(PKCS11_CMD_SIGN_FINAL),
183 PKCS11_ID(PKCS11_CMD_VERIFY_FINAL),
184 PKCS11_ID(PKCS11_CMD_SIGN_ONESHOT),
185 PKCS11_ID(PKCS11_CMD_VERIFY_ONESHOT),
186 PKCS11_ID(PKCS11_CMD_GENERATE_KEY),
187 PKCS11_ID(PKCS11_CMD_FIND_OBJECTS_INIT),
188 PKCS11_ID(PKCS11_CMD_FIND_OBJECTS),
189 PKCS11_ID(PKCS11_CMD_FIND_OBJECTS_FINAL),
190 PKCS11_ID(PKCS11_CMD_GET_OBJECT_SIZE),
191 PKCS11_ID(PKCS11_CMD_GET_ATTRIBUTE_VALUE),
192 PKCS11_ID(PKCS11_CMD_SET_ATTRIBUTE_VALUE),
193 PKCS11_ID(PKCS11_CMD_COPY_OBJECT),
194 PKCS11_ID(PKCS11_CMD_SEED_RANDOM),
195 PKCS11_ID(PKCS11_CMD_GENERATE_RANDOM),
196 PKCS11_ID(PKCS11_CMD_DERIVE_KEY),
197 PKCS11_ID(PKCS11_CMD_RELEASE_ACTIVE_PROCESSING),
198 PKCS11_ID(PKCS11_CMD_DIGEST_INIT),
199 PKCS11_ID(PKCS11_CMD_DIGEST_UPDATE),
200 PKCS11_ID(PKCS11_CMD_DIGEST_KEY),
201 PKCS11_ID(PKCS11_CMD_DIGEST_ONESHOT),
202 PKCS11_ID(PKCS11_CMD_DIGEST_FINAL),
203 PKCS11_ID(PKCS11_CMD_GENERATE_KEY_PAIR),
204 PKCS11_ID(PKCS11_CMD_WRAP_KEY),
205 PKCS11_ID(PKCS11_CMD_UNWRAP_KEY),
206 };
207
208 static const struct any_id __maybe_unused string_slot_flags[] = {
209 PKCS11_ID(PKCS11_CKFS_TOKEN_PRESENT),
210 PKCS11_ID(PKCS11_CKFS_REMOVABLE_DEVICE),
211 PKCS11_ID(PKCS11_CKFS_HW_SLOT),
212 };
213
214 static const struct any_id __maybe_unused string_token_flags[] = {
215 PKCS11_ID(PKCS11_CKFT_RNG),
216 PKCS11_ID(PKCS11_CKFT_WRITE_PROTECTED),
217 PKCS11_ID(PKCS11_CKFT_LOGIN_REQUIRED),
218 PKCS11_ID(PKCS11_CKFT_USER_PIN_INITIALIZED),
219 PKCS11_ID(PKCS11_CKFT_RESTORE_KEY_NOT_NEEDED),
220 PKCS11_ID(PKCS11_CKFT_CLOCK_ON_TOKEN),
221 PKCS11_ID(PKCS11_CKFT_PROTECTED_AUTHENTICATION_PATH),
222 PKCS11_ID(PKCS11_CKFT_DUAL_CRYPTO_OPERATIONS),
223 PKCS11_ID(PKCS11_CKFT_TOKEN_INITIALIZED),
224 PKCS11_ID(PKCS11_CKFT_USER_PIN_COUNT_LOW),
225 PKCS11_ID(PKCS11_CKFT_USER_PIN_FINAL_TRY),
226 PKCS11_ID(PKCS11_CKFT_USER_PIN_LOCKED),
227 PKCS11_ID(PKCS11_CKFT_USER_PIN_TO_BE_CHANGED),
228 PKCS11_ID(PKCS11_CKFT_SO_PIN_COUNT_LOW),
229 PKCS11_ID(PKCS11_CKFT_SO_PIN_FINAL_TRY),
230 PKCS11_ID(PKCS11_CKFT_SO_PIN_LOCKED),
231 PKCS11_ID(PKCS11_CKFT_SO_PIN_TO_BE_CHANGED),
232 PKCS11_ID(PKCS11_CKFT_ERROR_STATE),
233 };
234
235 static const struct any_id __maybe_unused string_session_flags[] = {
236 PKCS11_ID(PKCS11_CKFSS_RW_SESSION),
237 PKCS11_ID(PKCS11_CKFSS_SERIAL_SESSION),
238 };
239
240 static const struct any_id __maybe_unused string_session_state[] = {
241 PKCS11_ID(PKCS11_CKS_RO_PUBLIC_SESSION),
242 PKCS11_ID(PKCS11_CKS_RO_USER_FUNCTIONS),
243 PKCS11_ID(PKCS11_CKS_RW_PUBLIC_SESSION),
244 PKCS11_ID(PKCS11_CKS_RW_USER_FUNCTIONS),
245 PKCS11_ID(PKCS11_CKS_RW_SO_FUNCTIONS),
246 };
247
248 static const struct any_id __maybe_unused string_rc[] = {
249 PKCS11_ID(PKCS11_CKR_OK),
250 PKCS11_ID(PKCS11_CKR_SLOT_ID_INVALID),
251 PKCS11_ID(PKCS11_CKR_GENERAL_ERROR),
252 PKCS11_ID(PKCS11_CKR_FUNCTION_FAILED),
253 PKCS11_ID(PKCS11_CKR_ARGUMENTS_BAD),
254 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_READ_ONLY),
255 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_SENSITIVE),
256 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_TYPE_INVALID),
257 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_VALUE_INVALID),
258 PKCS11_ID(PKCS11_CKR_ACTION_PROHIBITED),
259 PKCS11_ID(PKCS11_CKR_DATA_INVALID),
260 PKCS11_ID(PKCS11_CKR_DATA_LEN_RANGE),
261 PKCS11_ID(PKCS11_CKR_DEVICE_MEMORY),
262 PKCS11_ID(PKCS11_CKR_ENCRYPTED_DATA_INVALID),
263 PKCS11_ID(PKCS11_CKR_ENCRYPTED_DATA_LEN_RANGE),
264 PKCS11_ID(PKCS11_CKR_KEY_HANDLE_INVALID),
265 PKCS11_ID(PKCS11_CKR_KEY_SIZE_RANGE),
266 PKCS11_ID(PKCS11_CKR_KEY_TYPE_INCONSISTENT),
267 PKCS11_ID(PKCS11_CKR_KEY_INDIGESTIBLE),
268 PKCS11_ID(PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED),
269 PKCS11_ID(PKCS11_CKR_KEY_NOT_WRAPPABLE),
270 PKCS11_ID(PKCS11_CKR_KEY_UNEXTRACTABLE),
271 PKCS11_ID(PKCS11_CKR_MECHANISM_INVALID),
272 PKCS11_ID(PKCS11_CKR_MECHANISM_PARAM_INVALID),
273 PKCS11_ID(PKCS11_CKR_OBJECT_HANDLE_INVALID),
274 PKCS11_ID(PKCS11_CKR_OPERATION_ACTIVE),
275 PKCS11_ID(PKCS11_CKR_OPERATION_NOT_INITIALIZED),
276 PKCS11_ID(PKCS11_CKR_PIN_INCORRECT),
277 PKCS11_ID(PKCS11_CKR_PIN_INVALID),
278 PKCS11_ID(PKCS11_CKR_PIN_LEN_RANGE),
279 PKCS11_ID(PKCS11_CKR_PIN_EXPIRED),
280 PKCS11_ID(PKCS11_CKR_PIN_LOCKED),
281 PKCS11_ID(PKCS11_CKR_SESSION_HANDLE_INVALID),
282 PKCS11_ID(PKCS11_CKR_SESSION_PARALLEL_NOT_SUPPORTED),
283 PKCS11_ID(PKCS11_CKR_SESSION_READ_ONLY),
284 PKCS11_ID(PKCS11_CKR_SESSION_EXISTS),
285 PKCS11_ID(PKCS11_CKR_SESSION_READ_ONLY_EXISTS),
286 PKCS11_ID(PKCS11_CKR_SESSION_READ_WRITE_SO_EXISTS),
287 PKCS11_ID(PKCS11_CKR_SIGNATURE_INVALID),
288 PKCS11_ID(PKCS11_CKR_SIGNATURE_LEN_RANGE),
289 PKCS11_ID(PKCS11_CKR_TEMPLATE_INCOMPLETE),
290 PKCS11_ID(PKCS11_CKR_TEMPLATE_INCONSISTENT),
291 PKCS11_ID(PKCS11_CKR_TOKEN_NOT_PRESENT),
292 PKCS11_ID(PKCS11_CKR_TOKEN_NOT_RECOGNIZED),
293 PKCS11_ID(PKCS11_CKR_TOKEN_WRITE_PROTECTED),
294 PKCS11_ID(PKCS11_CKR_UNWRAPPING_KEY_HANDLE_INVALID),
295 PKCS11_ID(PKCS11_CKR_UNWRAPPING_KEY_SIZE_RANGE),
296 PKCS11_ID(PKCS11_CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT),
297 PKCS11_ID(PKCS11_CKR_USER_ALREADY_LOGGED_IN),
298 PKCS11_ID(PKCS11_CKR_USER_NOT_LOGGED_IN),
299 PKCS11_ID(PKCS11_CKR_USER_PIN_NOT_INITIALIZED),
300 PKCS11_ID(PKCS11_CKR_USER_TYPE_INVALID),
301 PKCS11_ID(PKCS11_CKR_USER_ANOTHER_ALREADY_LOGGED_IN),
302 PKCS11_ID(PKCS11_CKR_USER_TOO_MANY_TYPES),
303 PKCS11_ID(PKCS11_CKR_WRAPPED_KEY_INVALID),
304 PKCS11_ID(PKCS11_CKR_WRAPPED_KEY_LEN_RANGE),
305 PKCS11_ID(PKCS11_CKR_WRAPPING_KEY_HANDLE_INVALID),
306 PKCS11_ID(PKCS11_CKR_WRAPPING_KEY_SIZE_RANGE),
307 PKCS11_ID(PKCS11_CKR_WRAPPING_KEY_TYPE_INCONSISTENT),
308 PKCS11_ID(PKCS11_CKR_RANDOM_SEED_NOT_SUPPORTED),
309 PKCS11_ID(PKCS11_CKR_RANDOM_NO_RNG),
310 PKCS11_ID(PKCS11_CKR_DOMAIN_PARAMS_INVALID),
311 PKCS11_ID(PKCS11_CKR_CURVE_NOT_SUPPORTED),
312 PKCS11_ID(PKCS11_CKR_BUFFER_TOO_SMALL),
313 PKCS11_ID(PKCS11_CKR_PIN_TOO_WEAK),
314 PKCS11_ID(PKCS11_RV_NOT_FOUND),
315 PKCS11_ID(PKCS11_RV_NOT_IMPLEMENTED),
316 };
317
318 static const struct any_id __maybe_unused string_class[] = {
319 PKCS11_ID(PKCS11_CKO_SECRET_KEY),
320 PKCS11_ID(PKCS11_CKO_PUBLIC_KEY),
321 PKCS11_ID(PKCS11_CKO_PRIVATE_KEY),
322 PKCS11_ID(PKCS11_CKO_OTP_KEY),
323 PKCS11_ID(PKCS11_CKO_CERTIFICATE),
324 PKCS11_ID(PKCS11_CKO_DATA),
325 PKCS11_ID(PKCS11_CKO_DOMAIN_PARAMETERS),
326 PKCS11_ID(PKCS11_CKO_HW_FEATURE),
327 PKCS11_ID(PKCS11_CKO_MECHANISM),
328 PKCS11_ID(PKCS11_CKO_UNDEFINED_ID)
329 };
330
331 static const struct any_id __maybe_unused string_key_type[] = {
332 PKCS11_ID(PKCS11_CKK_AES),
333 PKCS11_ID(PKCS11_CKK_GENERIC_SECRET),
334 PKCS11_ID(PKCS11_CKK_MD5_HMAC),
335 PKCS11_ID(PKCS11_CKK_SHA_1_HMAC),
336 PKCS11_ID(PKCS11_CKK_SHA224_HMAC),
337 PKCS11_ID(PKCS11_CKK_SHA256_HMAC),
338 PKCS11_ID(PKCS11_CKK_SHA384_HMAC),
339 PKCS11_ID(PKCS11_CKK_SHA512_HMAC),
340 PKCS11_ID(PKCS11_CKK_EC),
341 PKCS11_ID(PKCS11_CKK_EC_EDWARDS),
342 PKCS11_ID(PKCS11_CKK_EDDSA),
343 PKCS11_ID(PKCS11_CKK_RSA),
344 PKCS11_ID(PKCS11_CKK_UNDEFINED_ID)
345 };
346
347 static const struct any_id __maybe_unused string_certificate_type[] = {
348 PKCS11_ID(PKCS11_CKC_X_509),
349 PKCS11_ID(PKCS11_CKC_X_509_ATTR_CERT),
350 PKCS11_ID(PKCS11_CKC_WTLS),
351 PKCS11_ID(PKCS11_CKC_UNDEFINED_ID)
352 };
353
354 /*
355 * Processing IDs not exported in the TA API.
356 * PKCS11_CKM_* mechanism IDs are looked up from mechanism_string_id().
357 */
358 static const struct any_id __maybe_unused string_internal_processing[] = {
359 PKCS11_ID(PKCS11_PROCESSING_IMPORT),
360 };
361
362 static const struct any_id __maybe_unused string_functions[] = {
363 PKCS11_ID(PKCS11_FUNCTION_DIGEST),
364 PKCS11_ID(PKCS11_FUNCTION_IMPORT),
365 PKCS11_ID(PKCS11_FUNCTION_ENCRYPT),
366 PKCS11_ID(PKCS11_FUNCTION_DECRYPT),
367 PKCS11_ID(PKCS11_FUNCTION_SIGN),
368 PKCS11_ID(PKCS11_FUNCTION_VERIFY),
369 PKCS11_ID(PKCS11_FUNCTION_DERIVE),
370 PKCS11_ID(PKCS11_FUNCTION_WRAP),
371 PKCS11_ID(PKCS11_FUNCTION_UNWRAP),
372 };
373
374 /*
375 * Conversion between PKCS11 TA and GPD TEE return codes
376 */
tee2pkcs_error(TEE_Result res)377 enum pkcs11_rc tee2pkcs_error(TEE_Result res)
378 {
379 switch (res) {
380 case TEE_SUCCESS:
381 return PKCS11_CKR_OK;
382
383 case TEE_ERROR_BAD_PARAMETERS:
384 return PKCS11_CKR_ARGUMENTS_BAD;
385
386 case TEE_ERROR_CIPHERTEXT_INVALID:
387 return PKCS11_CKR_ENCRYPTED_DATA_INVALID;
388
389 case TEE_ERROR_OUT_OF_MEMORY:
390 return PKCS11_CKR_DEVICE_MEMORY;
391
392 case TEE_ERROR_SHORT_BUFFER:
393 return PKCS11_CKR_BUFFER_TOO_SMALL;
394
395 case TEE_ERROR_MAC_INVALID:
396 case TEE_ERROR_SIGNATURE_INVALID:
397 return PKCS11_CKR_SIGNATURE_INVALID;
398
399 default:
400 return PKCS11_CKR_GENERAL_ERROR;
401 }
402 }
403
404 /*
405 * Helper functions to analyse PKCS11 identifiers
406 */
407
408 /* Check attribute ID is known and size matches if fixed */
valid_pkcs11_attribute_id(uint32_t id,uint32_t size)409 bool valid_pkcs11_attribute_id(uint32_t id, uint32_t size)
410 {
411 size_t n = 0;
412
413 for (n = 0; n < ARRAY_SIZE(attr_ids); n++)
414 if (id == attr_ids[n].id)
415 return !attr_ids[n].size || size == attr_ids[n].size;
416
417 return false;
418 }
419
pkcs11_attr_is_type(uint32_t attribute_id)420 size_t pkcs11_attr_is_type(uint32_t attribute_id)
421 {
422 enum pkcs11_attr_id id = attribute_id;
423
424 switch (id) {
425 case PKCS11_CKA_KEY_TYPE:
426 case PKCS11_CKA_MECHANISM_TYPE:
427 case PKCS11_CKA_KEY_GEN_MECHANISM:
428 return sizeof(uint32_t);
429 default:
430 return 0;
431 }
432 }
433
pkcs11_attr_has_indirect_attributes(uint32_t attribute_id)434 bool pkcs11_attr_has_indirect_attributes(uint32_t attribute_id)
435 {
436 switch (attribute_id) {
437 case PKCS11_CKA_WRAP_TEMPLATE:
438 case PKCS11_CKA_UNWRAP_TEMPLATE:
439 case PKCS11_CKA_DERIVE_TEMPLATE:
440 return true;
441 default:
442 return false;
443 }
444 }
445
pkcs11_class_has_type(uint32_t class)446 bool pkcs11_class_has_type(uint32_t class)
447 {
448 enum pkcs11_class_id class_id = class;
449
450 switch (class_id) {
451 case PKCS11_CKO_CERTIFICATE:
452 case PKCS11_CKO_PUBLIC_KEY:
453 case PKCS11_CKO_PRIVATE_KEY:
454 case PKCS11_CKO_SECRET_KEY:
455 case PKCS11_CKO_MECHANISM:
456 case PKCS11_CKO_HW_FEATURE:
457 return true;
458 default:
459 return false;
460 }
461 }
462
pkcs11_attr_class_is_key(uint32_t class)463 bool pkcs11_attr_class_is_key(uint32_t class)
464 {
465 enum pkcs11_class_id class_id = class;
466
467 switch (class_id) {
468 case PKCS11_CKO_SECRET_KEY:
469 case PKCS11_CKO_PUBLIC_KEY:
470 case PKCS11_CKO_PRIVATE_KEY:
471 return true;
472 default:
473 return false;
474 }
475 }
476
key_type_is_symm_key(uint32_t id)477 bool key_type_is_symm_key(uint32_t id)
478 {
479 enum pkcs11_key_type key_type = id;
480
481 switch (key_type) {
482 case PKCS11_CKK_AES:
483 case PKCS11_CKK_GENERIC_SECRET:
484 case PKCS11_CKK_MD5_HMAC:
485 case PKCS11_CKK_SHA_1_HMAC:
486 case PKCS11_CKK_SHA224_HMAC:
487 case PKCS11_CKK_SHA256_HMAC:
488 case PKCS11_CKK_SHA384_HMAC:
489 case PKCS11_CKK_SHA512_HMAC:
490 return true;
491 default:
492 return false;
493 }
494 }
495
key_type_is_asymm_key(uint32_t id)496 bool key_type_is_asymm_key(uint32_t id)
497 {
498 enum pkcs11_key_type key_type = id;
499
500 switch (key_type) {
501 case PKCS11_CKK_EC:
502 case PKCS11_CKK_EC_EDWARDS:
503 case PKCS11_CKK_RSA:
504 return true;
505 default:
506 return false;
507 }
508 }
509
510 /*
511 * Returns shift position or -1 on error.
512 * Mainly used when PKCS11_SHEAD_WITH_BOOLPROPS is enabled
513 */
pkcs11_attr2boolprop_shift(uint32_t attr)514 int pkcs11_attr2boolprop_shift(uint32_t attr)
515 {
516 static const uint32_t bpa[] = {
517 [BPA_TOKEN] = PKCS11_CKA_TOKEN,
518 [BPA_PRIVATE] = PKCS11_CKA_PRIVATE,
519 [BPA_TRUSTED] = PKCS11_CKA_TRUSTED,
520 [BPA_SENSITIVE] = PKCS11_CKA_SENSITIVE,
521 [BPA_ENCRYPT] = PKCS11_CKA_ENCRYPT,
522 [BPA_DECRYPT] = PKCS11_CKA_DECRYPT,
523 [BPA_WRAP] = PKCS11_CKA_WRAP,
524 [BPA_UNWRAP] = PKCS11_CKA_UNWRAP,
525 [BPA_SIGN] = PKCS11_CKA_SIGN,
526 [BPA_SIGN_RECOVER] = PKCS11_CKA_SIGN_RECOVER,
527 [BPA_VERIFY] = PKCS11_CKA_VERIFY,
528 [BPA_VERIFY_RECOVER] = PKCS11_CKA_VERIFY_RECOVER,
529 [BPA_DERIVE] = PKCS11_CKA_DERIVE,
530 [BPA_EXTRACTABLE] = PKCS11_CKA_EXTRACTABLE,
531 [BPA_LOCAL] = PKCS11_CKA_LOCAL,
532 [BPA_NEVER_EXTRACTABLE] = PKCS11_CKA_NEVER_EXTRACTABLE,
533 [BPA_ALWAYS_SENSITIVE] = PKCS11_CKA_ALWAYS_SENSITIVE,
534 [BPA_MODIFIABLE] = PKCS11_CKA_MODIFIABLE,
535 [BPA_COPYABLE] = PKCS11_CKA_COPYABLE,
536 [BPA_DESTROYABLE] = PKCS11_CKA_DESTROYABLE,
537 [BPA_ALWAYS_AUTHENTICATE] = PKCS11_CKA_ALWAYS_AUTHENTICATE,
538 [BPA_WRAP_WITH_TRUSTED] = PKCS11_CKA_WRAP_WITH_TRUSTED,
539 };
540 size_t pos = 0;
541
542 for (pos = 0; pos < ARRAY_SIZE(bpa); pos++)
543 if (bpa[pos] == attr)
544 return (int)pos;
545
546 return -1;
547 }
548
549 /* Initialize a TEE attribute for a target PKCS11 TA attribute in an object */
pkcs2tee_load_attr(TEE_Attribute * tee_ref,uint32_t tee_id,struct pkcs11_object * obj,enum pkcs11_attr_id pkcs11_id)550 bool pkcs2tee_load_attr(TEE_Attribute *tee_ref, uint32_t tee_id,
551 struct pkcs11_object *obj,
552 enum pkcs11_attr_id pkcs11_id)
553 {
554 void *a_ptr = NULL;
555 uint8_t *der_ptr = NULL;
556 uint32_t a_size = 0;
557 uint32_t data32 = 0;
558 size_t hsize = 0;
559 size_t qsize = 0;
560
561 switch (tee_id) {
562 case TEE_ATTR_ECC_PUBLIC_VALUE_X:
563 case TEE_ATTR_ECC_PUBLIC_VALUE_Y:
564 case TEE_ATTR_ECC_CURVE:
565 if (get_attribute_ptr(obj->attributes, PKCS11_CKA_EC_PARAMS,
566 &a_ptr, &a_size) || !a_ptr) {
567 EMSG("Missing EC_PARAMS attribute");
568 return false;
569 }
570
571 if (tee_id == TEE_ATTR_ECC_CURVE) {
572 data32 = ec_params2tee_curve(a_ptr, a_size);
573 TEE_InitValueAttribute(tee_ref, TEE_ATTR_ECC_CURVE,
574 data32, 0);
575 return true;
576 }
577
578 data32 = (ec_params2tee_keysize(a_ptr, a_size) + 7) / 8;
579
580 /*
581 * For private keys we need EC public key for TEE operations so
582 * first try to get hidden EC POINT and as backwards
583 * compatibility also check for CKA_EC_POINT.
584 *
585 * For public keys we only have CKA_EC_POINT but there is no
586 * harm to check for hidden one too.
587 */
588 if (get_attribute_ptr(obj->attributes,
589 PKCS11_CKA_OPTEE_HIDDEN_EC_POINT,
590 &a_ptr, &a_size)) {
591 if (get_attribute_ptr(obj->attributes,
592 PKCS11_CKA_EC_POINT,
593 &a_ptr, &a_size)) {
594 /*
595 * Without EC public key we cannot proceed.
596 */
597 EMSG("Missing EC_POINT attribute");
598 return false;
599 }
600 }
601
602 der_ptr = (uint8_t *)a_ptr;
603
604 if (der_ptr[0] != 0x04) {
605 EMSG("Unsupported DER type");
606 return false;
607 }
608
609 if ((der_ptr[1] & 0x80) == 0) {
610 /* DER short definitive form up to 127 bytes */
611 qsize = der_ptr[1] & 0x7F;
612 hsize = 2 /* der */ + 1 /* point compression */;
613 } else if (der_ptr[1] == 0x81) {
614 /* DER long definitive form up to 255 bytes */
615 qsize = der_ptr[2];
616 hsize = 3 /* der */ + 1 /* point compression */;
617 } else {
618 EMSG("Unsupported DER long form");
619 return false;
620 }
621
622 if (der_ptr[hsize - 1] != 0x04) {
623 EMSG("Unsupported EC_POINT compression");
624 return false;
625 }
626
627 if (a_size != (hsize - 1) + qsize) {
628 EMSG("Invalid EC_POINT attribute");
629 return false;
630 }
631
632 if (a_size != hsize + 2 * data32) {
633 EMSG("Invalid EC_POINT attribute");
634 return false;
635 }
636
637 if (tee_id == TEE_ATTR_ECC_PUBLIC_VALUE_X)
638 TEE_InitRefAttribute(tee_ref, tee_id,
639 der_ptr + hsize, data32);
640 else
641 TEE_InitRefAttribute(tee_ref, tee_id,
642 der_ptr + hsize + data32,
643 data32);
644
645 return true;
646
647 default:
648 break;
649 }
650
651 if (get_attribute_ptr(obj->attributes, pkcs11_id, &a_ptr, &a_size))
652 return false;
653
654 TEE_InitRefAttribute(tee_ref, tee_id, a_ptr, a_size);
655
656 return true;
657 }
658
659 /*
660 * Initialize a TEE attribute with hash of a target PKCS11 TA attribute
661 * in an object.
662 */
pkcs2tee_load_hashed_attr(TEE_Attribute * tee_ref,uint32_t tee_id,struct pkcs11_object * obj,enum pkcs11_attr_id pkcs11_id,uint32_t tee_algo,void * hash_ptr,uint32_t * hash_size)663 enum pkcs11_rc pkcs2tee_load_hashed_attr(TEE_Attribute *tee_ref,
664 uint32_t tee_id,
665 struct pkcs11_object *obj,
666 enum pkcs11_attr_id pkcs11_id,
667 uint32_t tee_algo, void *hash_ptr,
668 uint32_t *hash_size)
669 {
670 TEE_OperationHandle handle = TEE_HANDLE_NULL;
671 void *a_ptr = NULL;
672 uint32_t a_size = 0;
673 enum pkcs11_rc rc = PKCS11_CKR_OK;
674 TEE_Result res = TEE_ERROR_GENERIC;
675 size_t tmp_sz = 0;
676
677 rc = get_attribute_ptr(obj->attributes, pkcs11_id, &a_ptr, &a_size);
678 if (rc)
679 return rc;
680
681 res = TEE_AllocateOperation(&handle, tee_algo, TEE_MODE_DIGEST, 0);
682 if (res) {
683 EMSG("TEE_AllocateOperation() failed %#"PRIx32, tee_algo);
684 return tee2pkcs_error(res);
685 }
686
687 tmp_sz = *hash_size;
688 res = TEE_DigestDoFinal(handle, a_ptr, a_size, hash_ptr, &tmp_sz);
689 *hash_size = tmp_sz;
690 TEE_FreeOperation(handle);
691 if (res) {
692 EMSG("TEE_DigestDoFinal() failed %#"PRIx32, tee_algo);
693 return PKCS11_CKR_FUNCTION_FAILED;
694 }
695
696 TEE_InitRefAttribute(tee_ref, tee_id, hash_ptr, *hash_size);
697
698 return PKCS11_CKR_OK;
699 }
700
701 /* Easy conversion between PKCS11 TA function of TEE crypto mode */
pkcs2tee_mode(uint32_t * tee_id,enum processing_func function)702 void pkcs2tee_mode(uint32_t *tee_id, enum processing_func function)
703 {
704 switch (function) {
705 case PKCS11_FUNCTION_ENCRYPT:
706 *tee_id = TEE_MODE_ENCRYPT;
707 break;
708 case PKCS11_FUNCTION_DECRYPT:
709 *tee_id = TEE_MODE_DECRYPT;
710 break;
711 case PKCS11_FUNCTION_SIGN:
712 *tee_id = TEE_MODE_SIGN;
713 break;
714 case PKCS11_FUNCTION_VERIFY:
715 *tee_id = TEE_MODE_VERIFY;
716 break;
717 case PKCS11_FUNCTION_DERIVE:
718 *tee_id = TEE_MODE_DERIVE;
719 break;
720 case PKCS11_FUNCTION_DIGEST:
721 *tee_id = TEE_MODE_DIGEST;
722 break;
723 default:
724 TEE_Panic(function);
725 }
726 }
727
728 #if CFG_TEE_TA_LOG_LEVEL > 0
id2str_rc(uint32_t id)729 const char *id2str_rc(uint32_t id)
730 {
731 return ID2STR(id, string_rc, "PKCS11_CKR_");
732 }
733
id2str_ta_cmd(uint32_t id)734 const char *id2str_ta_cmd(uint32_t id)
735 {
736 return ID2STR(id, string_ta_cmd, NULL);
737 }
738
id2str_slot_flag(uint32_t id)739 const char *id2str_slot_flag(uint32_t id)
740 {
741 return ID2STR(id, string_slot_flags, "PKCS11_CKFS_");
742 }
743
id2str_token_flag(uint32_t id)744 const char *id2str_token_flag(uint32_t id)
745 {
746 return ID2STR(id, string_token_flags, "PKCS11_CKFT_");
747 }
748
id2str_session_flag(uint32_t id)749 const char *id2str_session_flag(uint32_t id)
750 {
751 return ID2STR(id, string_session_flags, "PKCS11_CKFSS_");
752 }
753
id2str_session_state(uint32_t id)754 const char *id2str_session_state(uint32_t id)
755 {
756 return ID2STR(id, string_session_state, "PKCS11_CKS_");
757 }
758
id2str_attr(uint32_t id)759 const char *id2str_attr(uint32_t id)
760 {
761 size_t n = 0;
762
763 for (n = 0; n < ARRAY_SIZE(attr_ids); n++) {
764 if (id == attr_ids[n].id) {
765 /* Skip PKCS11_CKA_ prefix */
766 return attr_ids[n].string + strlen("PKCS11_CKA_");
767 }
768 }
769
770 return unknown;
771 }
772
id2str_class(uint32_t id)773 const char *id2str_class(uint32_t id)
774 {
775 return ID2STR(id, string_class, "PKCS11_CKO_");
776 }
777
id2str_type(uint32_t id,uint32_t class)778 const char *id2str_type(uint32_t id, uint32_t class)
779 {
780 enum pkcs11_class_id class_id = class;
781 enum pkcs11_key_type key_type = id;
782
783 switch (class_id) {
784 case PKCS11_CKO_SECRET_KEY:
785 case PKCS11_CKO_PUBLIC_KEY:
786 case PKCS11_CKO_PRIVATE_KEY:
787 return id2str_key_type(key_type);
788 default:
789 return unknown;
790 }
791 }
792
id2str_key_type(uint32_t id)793 const char *id2str_key_type(uint32_t id)
794 {
795 return ID2STR(id, string_key_type, "PKCS11_CKK_");
796 }
797
id2str_certificate_type(uint32_t id)798 const char *id2str_certificate_type(uint32_t id)
799 {
800 return ID2STR(id, string_certificate_type, "PKCS11_CKC_");
801 }
802
id2str_attr_value(uint32_t id,size_t size,void * value)803 const char *id2str_attr_value(uint32_t id, size_t size, void *value)
804 {
805 static const char str_true[] = "TRUE";
806 static const char str_false[] = "FALSE";
807 static const char str_unknown[] = "*";
808 uint32_t type = 0;
809
810 if (pkcs11_attr2boolprop_shift(id) >= 0)
811 return *(uint8_t *)value ? str_true : str_false;
812
813 if (size < sizeof(uint32_t))
814 return str_unknown;
815
816 TEE_MemMove(&type, value, sizeof(uint32_t));
817
818 switch (id) {
819 case PKCS11_CKA_CLASS:
820 return id2str_class(type);
821 case PKCS11_CKA_KEY_TYPE:
822 return id2str_key_type(type);
823 case PKCS11_CKA_MECHANISM_TYPE:
824 return id2str_mechanism(type);
825 default:
826 return str_unknown;
827 }
828 }
829
id2str_proc(uint32_t id)830 const char *id2str_proc(uint32_t id)
831 {
832 const char *str = ID2STR(id, string_internal_processing,
833 "PKCS11_PROCESSING_");
834
835 if (str != unknown)
836 return str;
837
838 return id2str_mechanism(id);
839 }
840
id2str_function(uint32_t id)841 const char *id2str_function(uint32_t id)
842 {
843 return ID2STR(id, string_functions, "PKCS11_FUNCTION_");
844 }
845 #endif /*CFG_TEE_TA_LOG_LEVEL*/
846