1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2018-2020, Linaro Limited 4 */ 5 6 #include <pkcs11_ta.h> 7 #include <string.h> 8 #include <tee_internal_api.h> 9 #include <util.h> 10 11 #include "attributes.h" 12 #include "object.h" 13 #include "pkcs11_attributes.h" 14 #include "pkcs11_helpers.h" 15 #include "processing.h" 16 17 static const char __maybe_unused unknown[] = "<unknown-identifier>"; 18 19 struct attr_size { 20 uint32_t id; 21 uint32_t size; 22 #if CFG_TEE_TA_LOG_LEVEL > 0 23 const char *string; 24 #endif 25 }; 26 27 #if CFG_TEE_TA_LOG_LEVEL > 0 28 #define PKCS11_ID_SZ(_id, _sz) \ 29 { .id = (uint32_t)(_id), .size = (_sz), .string = #_id } 30 #else 31 #define PKCS11_ID_SZ(_id, _sz) \ 32 { .id = (uint32_t)(_id), .size = (_sz) } 33 #endif 34 35 static const struct attr_size attr_ids[] = { 36 PKCS11_ID_SZ(PKCS11_CKA_CLASS, 4), 37 PKCS11_ID_SZ(PKCS11_CKA_KEY_TYPE, 4), 38 PKCS11_ID_SZ(PKCS11_CKA_VALUE, 0), 39 PKCS11_ID_SZ(PKCS11_CKA_VALUE_LEN, 4), 40 PKCS11_ID_SZ(PKCS11_CKA_KEY_GEN_MECHANISM, 4), 41 PKCS11_ID_SZ(PKCS11_CKA_LABEL, 0), 42 PKCS11_ID_SZ(PKCS11_CKA_WRAP_TEMPLATE, 0), 43 PKCS11_ID_SZ(PKCS11_CKA_UNWRAP_TEMPLATE, 0), 44 PKCS11_ID_SZ(PKCS11_CKA_DERIVE_TEMPLATE, 0), 45 PKCS11_ID_SZ(PKCS11_CKA_START_DATE, 4), 46 PKCS11_ID_SZ(PKCS11_CKA_END_DATE, 4), 47 PKCS11_ID_SZ(PKCS11_CKA_OBJECT_ID, 0), 48 PKCS11_ID_SZ(PKCS11_CKA_APPLICATION, 0), 49 PKCS11_ID_SZ(PKCS11_CKA_MECHANISM_TYPE, 4), 50 PKCS11_ID_SZ(PKCS11_CKA_ID, 0), 51 PKCS11_ID_SZ(PKCS11_CKA_ALLOWED_MECHANISMS, 0), 52 PKCS11_ID_SZ(PKCS11_CKA_EC_POINT, 0), 53 PKCS11_ID_SZ(PKCS11_CKA_EC_PARAMS, 0), 54 PKCS11_ID_SZ(PKCS11_CKA_MODULUS, 0), 55 PKCS11_ID_SZ(PKCS11_CKA_MODULUS_BITS, 4), 56 PKCS11_ID_SZ(PKCS11_CKA_PUBLIC_EXPONENT, 0), 57 PKCS11_ID_SZ(PKCS11_CKA_PRIVATE_EXPONENT, 0), 58 PKCS11_ID_SZ(PKCS11_CKA_PRIME_1, 0), 59 PKCS11_ID_SZ(PKCS11_CKA_PRIME_2, 0), 60 PKCS11_ID_SZ(PKCS11_CKA_EXPONENT_1, 0), 61 PKCS11_ID_SZ(PKCS11_CKA_EXPONENT_2, 0), 62 PKCS11_ID_SZ(PKCS11_CKA_COEFFICIENT, 0), 63 PKCS11_ID_SZ(PKCS11_CKA_SUBJECT, 0), 64 PKCS11_ID_SZ(PKCS11_CKA_PUBLIC_KEY_INFO, 0), 65 PKCS11_ID_SZ(PKCS11_CKA_KEY_GEN_MECHANISM, 4), 66 /* Below are boolean attributes */ 67 PKCS11_ID_SZ(PKCS11_CKA_TOKEN, 1), 68 PKCS11_ID_SZ(PKCS11_CKA_PRIVATE, 1), 69 PKCS11_ID_SZ(PKCS11_CKA_TRUSTED, 1), 70 PKCS11_ID_SZ(PKCS11_CKA_SENSITIVE, 1), 71 PKCS11_ID_SZ(PKCS11_CKA_ENCRYPT, 1), 72 PKCS11_ID_SZ(PKCS11_CKA_DECRYPT, 1), 73 PKCS11_ID_SZ(PKCS11_CKA_WRAP, 1), 74 PKCS11_ID_SZ(PKCS11_CKA_UNWRAP, 1), 75 PKCS11_ID_SZ(PKCS11_CKA_SIGN, 1), 76 PKCS11_ID_SZ(PKCS11_CKA_SIGN_RECOVER, 1), 77 PKCS11_ID_SZ(PKCS11_CKA_VERIFY, 1), 78 PKCS11_ID_SZ(PKCS11_CKA_VERIFY_RECOVER, 1), 79 PKCS11_ID_SZ(PKCS11_CKA_DERIVE, 1), 80 PKCS11_ID_SZ(PKCS11_CKA_EXTRACTABLE, 1), 81 PKCS11_ID_SZ(PKCS11_CKA_LOCAL, 1), 82 PKCS11_ID_SZ(PKCS11_CKA_NEVER_EXTRACTABLE, 1), 83 PKCS11_ID_SZ(PKCS11_CKA_ALWAYS_SENSITIVE, 1), 84 PKCS11_ID_SZ(PKCS11_CKA_MODIFIABLE, 1), 85 PKCS11_ID_SZ(PKCS11_CKA_COPYABLE, 1), 86 PKCS11_ID_SZ(PKCS11_CKA_DESTROYABLE, 1), 87 PKCS11_ID_SZ(PKCS11_CKA_ALWAYS_AUTHENTICATE, 1), 88 PKCS11_ID_SZ(PKCS11_CKA_WRAP_WITH_TRUSTED, 1), 89 /* Specific PKCS11 TA internal attribute ID */ 90 PKCS11_ID_SZ(PKCS11_CKA_UNDEFINED_ID, 0), 91 }; 92 93 struct any_id { 94 uint32_t id; 95 #if CFG_TEE_TA_LOG_LEVEL > 0 96 const char *string; 97 #endif 98 }; 99 100 /* 101 * Macro PKCS11_ID() can be used to define cells in ID list arrays 102 * or ID/string conversion arrays. 103 */ 104 #if CFG_TEE_TA_LOG_LEVEL > 0 105 #define PKCS11_ID(_id) { .id = _id, .string = #_id } 106 #else 107 #define PKCS11_ID(_id) { .id = _id } 108 #endif 109 110 #define ID2STR(id, table, prefix) \ 111 id2str(id, table, ARRAY_SIZE(table), prefix) 112 113 #if CFG_TEE_TA_LOG_LEVEL > 0 114 /* Convert a PKCS11 ID into its label string */ 115 static const char *id2str(uint32_t id, const struct any_id *table, 116 size_t count, const char *prefix) 117 { 118 size_t n = 0; 119 const char *str = NULL; 120 121 for (n = 0; n < count; n++) { 122 if (id != table[n].id) 123 continue; 124 125 str = table[n].string; 126 127 /* Skip prefix provided matches found */ 128 if (prefix && !TEE_MemCompare(str, prefix, strlen(prefix))) 129 str += strlen(prefix); 130 131 return str; 132 } 133 134 return unknown; 135 } 136 #endif /* CFG_TEE_TA_LOG_LEVEL > 0 */ 137 138 /* 139 * TA command IDs: used only as ID/string conversion for debug trace support 140 */ 141 static const struct any_id __maybe_unused string_ta_cmd[] = { 142 PKCS11_ID(PKCS11_CMD_PING), 143 PKCS11_ID(PKCS11_CMD_SLOT_LIST), 144 PKCS11_ID(PKCS11_CMD_SLOT_INFO), 145 PKCS11_ID(PKCS11_CMD_TOKEN_INFO), 146 PKCS11_ID(PKCS11_CMD_MECHANISM_IDS), 147 PKCS11_ID(PKCS11_CMD_MECHANISM_INFO), 148 PKCS11_ID(PKCS11_CMD_OPEN_SESSION), 149 PKCS11_ID(PKCS11_CMD_SESSION_INFO), 150 PKCS11_ID(PKCS11_CMD_CLOSE_SESSION), 151 PKCS11_ID(PKCS11_CMD_CLOSE_ALL_SESSIONS), 152 PKCS11_ID(PKCS11_CMD_INIT_TOKEN), 153 PKCS11_ID(PKCS11_CMD_INIT_PIN), 154 PKCS11_ID(PKCS11_CMD_SET_PIN), 155 PKCS11_ID(PKCS11_CMD_LOGIN), 156 PKCS11_ID(PKCS11_CMD_LOGOUT), 157 PKCS11_ID(PKCS11_CMD_CREATE_OBJECT), 158 PKCS11_ID(PKCS11_CMD_DESTROY_OBJECT), 159 PKCS11_ID(PKCS11_CMD_ENCRYPT_INIT), 160 PKCS11_ID(PKCS11_CMD_DECRYPT_INIT), 161 PKCS11_ID(PKCS11_CMD_ENCRYPT_UPDATE), 162 PKCS11_ID(PKCS11_CMD_DECRYPT_UPDATE), 163 PKCS11_ID(PKCS11_CMD_ENCRYPT_FINAL), 164 PKCS11_ID(PKCS11_CMD_DECRYPT_FINAL), 165 PKCS11_ID(PKCS11_CMD_ENCRYPT_ONESHOT), 166 PKCS11_ID(PKCS11_CMD_DECRYPT_ONESHOT), 167 PKCS11_ID(PKCS11_CMD_SIGN_INIT), 168 PKCS11_ID(PKCS11_CMD_VERIFY_INIT), 169 PKCS11_ID(PKCS11_CMD_SIGN_UPDATE), 170 PKCS11_ID(PKCS11_CMD_VERIFY_UPDATE), 171 PKCS11_ID(PKCS11_CMD_SIGN_FINAL), 172 PKCS11_ID(PKCS11_CMD_VERIFY_FINAL), 173 PKCS11_ID(PKCS11_CMD_SIGN_ONESHOT), 174 PKCS11_ID(PKCS11_CMD_VERIFY_ONESHOT), 175 PKCS11_ID(PKCS11_CMD_GENERATE_KEY), 176 PKCS11_ID(PKCS11_CMD_FIND_OBJECTS_INIT), 177 PKCS11_ID(PKCS11_CMD_FIND_OBJECTS), 178 PKCS11_ID(PKCS11_CMD_FIND_OBJECTS_FINAL), 179 PKCS11_ID(PKCS11_CMD_GET_OBJECT_SIZE), 180 PKCS11_ID(PKCS11_CMD_GET_ATTRIBUTE_VALUE), 181 PKCS11_ID(PKCS11_CMD_SET_ATTRIBUTE_VALUE), 182 PKCS11_ID(PKCS11_CMD_COPY_OBJECT), 183 PKCS11_ID(PKCS11_CMD_SEED_RANDOM), 184 PKCS11_ID(PKCS11_CMD_GENERATE_RANDOM), 185 PKCS11_ID(PKCS11_CMD_DERIVE_KEY), 186 PKCS11_ID(PKCS11_CMD_RELEASE_ACTIVE_PROCESSING), 187 PKCS11_ID(PKCS11_CMD_DIGEST_INIT), 188 PKCS11_ID(PKCS11_CMD_DIGEST_UPDATE), 189 PKCS11_ID(PKCS11_CMD_DIGEST_KEY), 190 PKCS11_ID(PKCS11_CMD_DIGEST_ONESHOT), 191 PKCS11_ID(PKCS11_CMD_DIGEST_FINAL), 192 PKCS11_ID(PKCS11_CMD_GENERATE_KEY_PAIR), 193 }; 194 195 static const struct any_id __maybe_unused string_slot_flags[] = { 196 PKCS11_ID(PKCS11_CKFS_TOKEN_PRESENT), 197 PKCS11_ID(PKCS11_CKFS_REMOVABLE_DEVICE), 198 PKCS11_ID(PKCS11_CKFS_HW_SLOT), 199 }; 200 201 static const struct any_id __maybe_unused string_token_flags[] = { 202 PKCS11_ID(PKCS11_CKFT_RNG), 203 PKCS11_ID(PKCS11_CKFT_WRITE_PROTECTED), 204 PKCS11_ID(PKCS11_CKFT_LOGIN_REQUIRED), 205 PKCS11_ID(PKCS11_CKFT_USER_PIN_INITIALIZED), 206 PKCS11_ID(PKCS11_CKFT_RESTORE_KEY_NOT_NEEDED), 207 PKCS11_ID(PKCS11_CKFT_CLOCK_ON_TOKEN), 208 PKCS11_ID(PKCS11_CKFT_PROTECTED_AUTHENTICATION_PATH), 209 PKCS11_ID(PKCS11_CKFT_DUAL_CRYPTO_OPERATIONS), 210 PKCS11_ID(PKCS11_CKFT_TOKEN_INITIALIZED), 211 PKCS11_ID(PKCS11_CKFT_USER_PIN_COUNT_LOW), 212 PKCS11_ID(PKCS11_CKFT_USER_PIN_FINAL_TRY), 213 PKCS11_ID(PKCS11_CKFT_USER_PIN_LOCKED), 214 PKCS11_ID(PKCS11_CKFT_USER_PIN_TO_BE_CHANGED), 215 PKCS11_ID(PKCS11_CKFT_SO_PIN_COUNT_LOW), 216 PKCS11_ID(PKCS11_CKFT_SO_PIN_FINAL_TRY), 217 PKCS11_ID(PKCS11_CKFT_SO_PIN_LOCKED), 218 PKCS11_ID(PKCS11_CKFT_SO_PIN_TO_BE_CHANGED), 219 PKCS11_ID(PKCS11_CKFT_ERROR_STATE), 220 }; 221 222 static const struct any_id __maybe_unused string_session_flags[] = { 223 PKCS11_ID(PKCS11_CKFSS_RW_SESSION), 224 PKCS11_ID(PKCS11_CKFSS_SERIAL_SESSION), 225 }; 226 227 static const struct any_id __maybe_unused string_session_state[] = { 228 PKCS11_ID(PKCS11_CKS_RO_PUBLIC_SESSION), 229 PKCS11_ID(PKCS11_CKS_RO_USER_FUNCTIONS), 230 PKCS11_ID(PKCS11_CKS_RW_PUBLIC_SESSION), 231 PKCS11_ID(PKCS11_CKS_RW_USER_FUNCTIONS), 232 PKCS11_ID(PKCS11_CKS_RW_SO_FUNCTIONS), 233 }; 234 235 static const struct any_id __maybe_unused string_rc[] = { 236 PKCS11_ID(PKCS11_CKR_OK), 237 PKCS11_ID(PKCS11_CKR_GENERAL_ERROR), 238 PKCS11_ID(PKCS11_CKR_DEVICE_MEMORY), 239 PKCS11_ID(PKCS11_CKR_ARGUMENTS_BAD), 240 PKCS11_ID(PKCS11_CKR_BUFFER_TOO_SMALL), 241 PKCS11_ID(PKCS11_CKR_FUNCTION_FAILED), 242 PKCS11_ID(PKCS11_CKR_SIGNATURE_INVALID), 243 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_SENSITIVE), 244 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_TYPE_INVALID), 245 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_VALUE_INVALID), 246 PKCS11_ID(PKCS11_CKR_OBJECT_HANDLE_INVALID), 247 PKCS11_ID(PKCS11_CKR_KEY_HANDLE_INVALID), 248 PKCS11_ID(PKCS11_CKR_MECHANISM_INVALID), 249 PKCS11_ID(PKCS11_CKR_SESSION_HANDLE_INVALID), 250 PKCS11_ID(PKCS11_CKR_SLOT_ID_INVALID), 251 PKCS11_ID(PKCS11_CKR_MECHANISM_PARAM_INVALID), 252 PKCS11_ID(PKCS11_CKR_TEMPLATE_INCONSISTENT), 253 PKCS11_ID(PKCS11_CKR_TEMPLATE_INCOMPLETE), 254 PKCS11_ID(PKCS11_CKR_PIN_INCORRECT), 255 PKCS11_ID(PKCS11_CKR_PIN_LOCKED), 256 PKCS11_ID(PKCS11_CKR_PIN_EXPIRED), 257 PKCS11_ID(PKCS11_CKR_PIN_INVALID), 258 PKCS11_ID(PKCS11_CKR_PIN_LEN_RANGE), 259 PKCS11_ID(PKCS11_CKR_SESSION_EXISTS), 260 PKCS11_ID(PKCS11_CKR_SESSION_PARALLEL_NOT_SUPPORTED), 261 PKCS11_ID(PKCS11_CKR_SESSION_READ_ONLY), 262 PKCS11_ID(PKCS11_CKR_SESSION_READ_WRITE_SO_EXISTS), 263 PKCS11_ID(PKCS11_CKR_OPERATION_ACTIVE), 264 PKCS11_ID(PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED), 265 PKCS11_ID(PKCS11_CKR_OPERATION_NOT_INITIALIZED), 266 PKCS11_ID(PKCS11_CKR_TOKEN_WRITE_PROTECTED), 267 PKCS11_ID(PKCS11_CKR_TOKEN_NOT_PRESENT), 268 PKCS11_ID(PKCS11_CKR_TOKEN_NOT_RECOGNIZED), 269 PKCS11_ID(PKCS11_CKR_ACTION_PROHIBITED), 270 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_READ_ONLY), 271 PKCS11_ID(PKCS11_CKR_PIN_TOO_WEAK), 272 PKCS11_ID(PKCS11_CKR_CURVE_NOT_SUPPORTED), 273 PKCS11_ID(PKCS11_CKR_DOMAIN_PARAMS_INVALID), 274 PKCS11_ID(PKCS11_CKR_USER_ALREADY_LOGGED_IN), 275 PKCS11_ID(PKCS11_CKR_USER_ANOTHER_ALREADY_LOGGED_IN), 276 PKCS11_ID(PKCS11_CKR_USER_NOT_LOGGED_IN), 277 PKCS11_ID(PKCS11_CKR_USER_PIN_NOT_INITIALIZED), 278 PKCS11_ID(PKCS11_CKR_USER_TOO_MANY_TYPES), 279 PKCS11_ID(PKCS11_CKR_USER_TYPE_INVALID), 280 PKCS11_ID(PKCS11_CKR_KEY_SIZE_RANGE), 281 PKCS11_ID(PKCS11_CKR_KEY_INDIGESTIBLE), 282 PKCS11_ID(PKCS11_CKR_SESSION_READ_ONLY_EXISTS), 283 PKCS11_ID(PKCS11_CKR_SIGNATURE_LEN_RANGE), 284 PKCS11_ID(PKCS11_RV_NOT_FOUND), 285 PKCS11_ID(PKCS11_RV_NOT_IMPLEMENTED), 286 }; 287 288 static const struct any_id __maybe_unused string_class[] = { 289 PKCS11_ID(PKCS11_CKO_SECRET_KEY), 290 PKCS11_ID(PKCS11_CKO_PUBLIC_KEY), 291 PKCS11_ID(PKCS11_CKO_PRIVATE_KEY), 292 PKCS11_ID(PKCS11_CKO_OTP_KEY), 293 PKCS11_ID(PKCS11_CKO_CERTIFICATE), 294 PKCS11_ID(PKCS11_CKO_DATA), 295 PKCS11_ID(PKCS11_CKO_DOMAIN_PARAMETERS), 296 PKCS11_ID(PKCS11_CKO_HW_FEATURE), 297 PKCS11_ID(PKCS11_CKO_MECHANISM), 298 PKCS11_ID(PKCS11_CKO_UNDEFINED_ID) 299 }; 300 301 static const struct any_id __maybe_unused string_key_type[] = { 302 PKCS11_ID(PKCS11_CKK_AES), 303 PKCS11_ID(PKCS11_CKK_GENERIC_SECRET), 304 PKCS11_ID(PKCS11_CKK_MD5_HMAC), 305 PKCS11_ID(PKCS11_CKK_SHA_1_HMAC), 306 PKCS11_ID(PKCS11_CKK_SHA224_HMAC), 307 PKCS11_ID(PKCS11_CKK_SHA256_HMAC), 308 PKCS11_ID(PKCS11_CKK_SHA384_HMAC), 309 PKCS11_ID(PKCS11_CKK_SHA512_HMAC), 310 PKCS11_ID(PKCS11_CKK_EC), 311 PKCS11_ID(PKCS11_CKK_RSA), 312 PKCS11_ID(PKCS11_CKK_UNDEFINED_ID) 313 }; 314 315 /* 316 * Processing IDs not exported in the TA API. 317 * PKCS11_CKM_* mechanism IDs are looked up from mechanism_string_id(). 318 */ 319 static const struct any_id __maybe_unused string_internal_processing[] = { 320 PKCS11_ID(PKCS11_PROCESSING_IMPORT), 321 }; 322 323 static const struct any_id __maybe_unused string_functions[] = { 324 PKCS11_ID(PKCS11_FUNCTION_DIGEST), 325 PKCS11_ID(PKCS11_FUNCTION_IMPORT), 326 PKCS11_ID(PKCS11_FUNCTION_ENCRYPT), 327 PKCS11_ID(PKCS11_FUNCTION_DECRYPT), 328 PKCS11_ID(PKCS11_FUNCTION_SIGN), 329 PKCS11_ID(PKCS11_FUNCTION_VERIFY), 330 }; 331 332 /* 333 * Conversion between PKCS11 TA and GPD TEE return codes 334 */ 335 enum pkcs11_rc tee2pkcs_error(TEE_Result res) 336 { 337 switch (res) { 338 case TEE_SUCCESS: 339 return PKCS11_CKR_OK; 340 341 case TEE_ERROR_BAD_PARAMETERS: 342 return PKCS11_CKR_ARGUMENTS_BAD; 343 344 case TEE_ERROR_OUT_OF_MEMORY: 345 return PKCS11_CKR_DEVICE_MEMORY; 346 347 case TEE_ERROR_SHORT_BUFFER: 348 return PKCS11_CKR_BUFFER_TOO_SMALL; 349 350 case TEE_ERROR_MAC_INVALID: 351 case TEE_ERROR_SIGNATURE_INVALID: 352 return PKCS11_CKR_SIGNATURE_INVALID; 353 354 default: 355 return PKCS11_CKR_GENERAL_ERROR; 356 } 357 } 358 359 /* 360 * Helper functions to analyse PKCS11 identifiers 361 */ 362 363 /* Check attribute ID is known and size matches if fixed */ 364 bool valid_pkcs11_attribute_id(uint32_t id, uint32_t size) 365 { 366 size_t n = 0; 367 368 for (n = 0; n < ARRAY_SIZE(attr_ids); n++) 369 if (id == attr_ids[n].id) 370 return !attr_ids[n].size || size == attr_ids[n].size; 371 372 return false; 373 } 374 375 size_t pkcs11_attr_is_type(uint32_t attribute_id) 376 { 377 enum pkcs11_attr_id id = attribute_id; 378 379 switch (id) { 380 case PKCS11_CKA_KEY_TYPE: 381 case PKCS11_CKA_MECHANISM_TYPE: 382 case PKCS11_CKA_KEY_GEN_MECHANISM: 383 return sizeof(uint32_t); 384 default: 385 return 0; 386 } 387 } 388 389 bool pkcs11_attr_has_indirect_attributes(uint32_t attribute_id) 390 { 391 switch (attribute_id) { 392 case PKCS11_CKA_WRAP_TEMPLATE: 393 case PKCS11_CKA_UNWRAP_TEMPLATE: 394 case PKCS11_CKA_DERIVE_TEMPLATE: 395 return true; 396 default: 397 return false; 398 } 399 } 400 401 bool pkcs11_class_has_type(uint32_t class) 402 { 403 enum pkcs11_class_id class_id = class; 404 405 switch (class_id) { 406 case PKCS11_CKO_CERTIFICATE: 407 case PKCS11_CKO_PUBLIC_KEY: 408 case PKCS11_CKO_PRIVATE_KEY: 409 case PKCS11_CKO_SECRET_KEY: 410 case PKCS11_CKO_MECHANISM: 411 case PKCS11_CKO_HW_FEATURE: 412 return true; 413 default: 414 return false; 415 } 416 } 417 418 bool pkcs11_attr_class_is_key(uint32_t class) 419 { 420 enum pkcs11_class_id class_id = class; 421 422 switch (class_id) { 423 case PKCS11_CKO_SECRET_KEY: 424 case PKCS11_CKO_PUBLIC_KEY: 425 case PKCS11_CKO_PRIVATE_KEY: 426 return true; 427 default: 428 return false; 429 } 430 } 431 432 bool key_type_is_symm_key(uint32_t id) 433 { 434 enum pkcs11_key_type key_type = id; 435 436 switch (key_type) { 437 case PKCS11_CKK_AES: 438 case PKCS11_CKK_GENERIC_SECRET: 439 case PKCS11_CKK_MD5_HMAC: 440 case PKCS11_CKK_SHA_1_HMAC: 441 case PKCS11_CKK_SHA224_HMAC: 442 case PKCS11_CKK_SHA256_HMAC: 443 case PKCS11_CKK_SHA384_HMAC: 444 case PKCS11_CKK_SHA512_HMAC: 445 return true; 446 default: 447 return false; 448 } 449 } 450 451 bool key_type_is_asymm_key(uint32_t id) 452 { 453 enum pkcs11_key_type key_type = id; 454 455 switch (key_type) { 456 case PKCS11_CKK_EC: 457 case PKCS11_CKK_RSA: 458 return true; 459 default: 460 return false; 461 } 462 } 463 464 /* 465 * Returns shift position or -1 on error. 466 * Mainly used when PKCS11_SHEAD_WITH_BOOLPROPS is enabled 467 */ 468 int pkcs11_attr2boolprop_shift(uint32_t attr) 469 { 470 static const uint32_t bpa[] = { 471 [BPA_TOKEN] = PKCS11_CKA_TOKEN, 472 [BPA_PRIVATE] = PKCS11_CKA_PRIVATE, 473 [BPA_TRUSTED] = PKCS11_CKA_TRUSTED, 474 [BPA_SENSITIVE] = PKCS11_CKA_SENSITIVE, 475 [BPA_ENCRYPT] = PKCS11_CKA_ENCRYPT, 476 [BPA_DECRYPT] = PKCS11_CKA_DECRYPT, 477 [BPA_WRAP] = PKCS11_CKA_WRAP, 478 [BPA_UNWRAP] = PKCS11_CKA_UNWRAP, 479 [BPA_SIGN] = PKCS11_CKA_SIGN, 480 [BPA_SIGN_RECOVER] = PKCS11_CKA_SIGN_RECOVER, 481 [BPA_VERIFY] = PKCS11_CKA_VERIFY, 482 [BPA_VERIFY_RECOVER] = PKCS11_CKA_VERIFY_RECOVER, 483 [BPA_DERIVE] = PKCS11_CKA_DERIVE, 484 [BPA_EXTRACTABLE] = PKCS11_CKA_EXTRACTABLE, 485 [BPA_LOCAL] = PKCS11_CKA_LOCAL, 486 [BPA_NEVER_EXTRACTABLE] = PKCS11_CKA_NEVER_EXTRACTABLE, 487 [BPA_ALWAYS_SENSITIVE] = PKCS11_CKA_ALWAYS_SENSITIVE, 488 [BPA_MODIFIABLE] = PKCS11_CKA_MODIFIABLE, 489 [BPA_COPYABLE] = PKCS11_CKA_COPYABLE, 490 [BPA_DESTROYABLE] = PKCS11_CKA_DESTROYABLE, 491 [BPA_ALWAYS_AUTHENTICATE] = PKCS11_CKA_ALWAYS_AUTHENTICATE, 492 [BPA_WRAP_WITH_TRUSTED] = PKCS11_CKA_WRAP_WITH_TRUSTED, 493 }; 494 size_t pos = 0; 495 496 for (pos = 0; pos < ARRAY_SIZE(bpa); pos++) 497 if (bpa[pos] == attr) 498 return (int)pos; 499 500 return -1; 501 } 502 503 /* Initialize a TEE attribute for a target PKCS11 TA attribute in an object */ 504 bool pkcs2tee_load_attr(TEE_Attribute *tee_ref, uint32_t tee_id, 505 struct pkcs11_object *obj, 506 enum pkcs11_attr_id pkcs11_id) 507 { 508 void *a_ptr = NULL; 509 uint8_t *der_ptr = NULL; 510 uint32_t a_size = 0; 511 uint32_t data32 = 0; 512 size_t hsize = 0; 513 size_t qsize = 0; 514 515 switch (tee_id) { 516 case TEE_ATTR_ECC_PUBLIC_VALUE_X: 517 case TEE_ATTR_ECC_PUBLIC_VALUE_Y: 518 case TEE_ATTR_ECC_CURVE: 519 if (get_attribute_ptr(obj->attributes, PKCS11_CKA_EC_PARAMS, 520 &a_ptr, &a_size) || !a_ptr) { 521 EMSG("Missing EC_PARAMS attribute"); 522 return false; 523 } 524 525 if (tee_id == TEE_ATTR_ECC_CURVE) { 526 data32 = ec_params2tee_curve(a_ptr, a_size); 527 TEE_InitValueAttribute(tee_ref, TEE_ATTR_ECC_CURVE, 528 data32, 0); 529 return true; 530 } 531 532 data32 = (ec_params2tee_keysize(a_ptr, a_size) + 7) / 8; 533 534 if (get_attribute_ptr(obj->attributes, PKCS11_CKA_EC_POINT, 535 &a_ptr, &a_size)) { 536 /* 537 * Public X/Y is required for both TEE keypair and 538 * public key, so abort if EC_POINT is not provided 539 * during object import. 540 */ 541 542 EMSG("Missing EC_POINT attribute"); 543 return false; 544 } 545 546 der_ptr = (uint8_t *)a_ptr; 547 548 if (der_ptr[0] != 0x04) { 549 EMSG("Unsupported DER type"); 550 return false; 551 } 552 553 if ((der_ptr[1] & 0x80) == 0) { 554 /* DER short definitive form up to 127 bytes */ 555 qsize = der_ptr[1] & 0x7F; 556 hsize = 2 /* der */ + 1 /* point compression */; 557 } else if (der_ptr[1] == 0x81) { 558 /* DER long definitive form up to 255 bytes */ 559 qsize = der_ptr[2]; 560 hsize = 3 /* der */ + 1 /* point compression */; 561 } else { 562 EMSG("Unsupported DER long form"); 563 return false; 564 } 565 566 if (der_ptr[hsize - 1] != 0x04) { 567 EMSG("Unsupported EC_POINT compression"); 568 return false; 569 } 570 571 if (a_size != (hsize - 1) + qsize) { 572 EMSG("Invalid EC_POINT attribute"); 573 return false; 574 } 575 576 if (a_size != hsize + 2 * data32) { 577 EMSG("Invalid EC_POINT attribute"); 578 return false; 579 } 580 581 if (tee_id == TEE_ATTR_ECC_PUBLIC_VALUE_X) 582 TEE_InitRefAttribute(tee_ref, tee_id, 583 der_ptr + hsize, data32); 584 else 585 TEE_InitRefAttribute(tee_ref, tee_id, 586 der_ptr + hsize + data32, 587 data32); 588 589 return true; 590 591 default: 592 break; 593 } 594 595 if (get_attribute_ptr(obj->attributes, pkcs11_id, &a_ptr, &a_size)) 596 return false; 597 598 TEE_InitRefAttribute(tee_ref, tee_id, a_ptr, a_size); 599 600 return true; 601 } 602 603 /* 604 * Initialize a TEE attribute with hash of a target PKCS11 TA attribute 605 * in an object. 606 */ 607 enum pkcs11_rc pkcs2tee_load_hashed_attr(TEE_Attribute *tee_ref, 608 uint32_t tee_id, 609 struct pkcs11_object *obj, 610 enum pkcs11_attr_id pkcs11_id, 611 uint32_t tee_algo, void *hash_ptr, 612 uint32_t *hash_size) 613 { 614 TEE_OperationHandle handle = TEE_HANDLE_NULL; 615 void *a_ptr = NULL; 616 uint32_t a_size = 0; 617 enum pkcs11_rc rc = PKCS11_CKR_OK; 618 TEE_Result res = TEE_ERROR_GENERIC; 619 620 rc = get_attribute_ptr(obj->attributes, pkcs11_id, &a_ptr, &a_size); 621 if (rc) 622 return rc; 623 624 res = TEE_AllocateOperation(&handle, tee_algo, TEE_MODE_DIGEST, 0); 625 if (res) { 626 EMSG("TEE_AllocateOperation() failed %#"PRIx32, tee_algo); 627 return tee2pkcs_error(res); 628 } 629 630 res = TEE_DigestDoFinal(handle, a_ptr, a_size, hash_ptr, hash_size); 631 TEE_FreeOperation(handle); 632 if (res) { 633 EMSG("TEE_DigestDoFinal() failed %#"PRIx32, tee_algo); 634 return PKCS11_CKR_FUNCTION_FAILED; 635 } 636 637 TEE_InitRefAttribute(tee_ref, tee_id, hash_ptr, *hash_size); 638 639 return PKCS11_CKR_OK; 640 } 641 642 /* Easy conversion between PKCS11 TA function of TEE crypto mode */ 643 void pkcs2tee_mode(uint32_t *tee_id, enum processing_func function) 644 { 645 switch (function) { 646 case PKCS11_FUNCTION_ENCRYPT: 647 *tee_id = TEE_MODE_ENCRYPT; 648 break; 649 case PKCS11_FUNCTION_DECRYPT: 650 *tee_id = TEE_MODE_DECRYPT; 651 break; 652 case PKCS11_FUNCTION_SIGN: 653 *tee_id = TEE_MODE_SIGN; 654 break; 655 case PKCS11_FUNCTION_VERIFY: 656 *tee_id = TEE_MODE_VERIFY; 657 break; 658 case PKCS11_FUNCTION_DERIVE: 659 *tee_id = TEE_MODE_DERIVE; 660 break; 661 case PKCS11_FUNCTION_DIGEST: 662 *tee_id = TEE_MODE_DIGEST; 663 break; 664 default: 665 TEE_Panic(function); 666 } 667 } 668 669 #if CFG_TEE_TA_LOG_LEVEL > 0 670 const char *id2str_rc(uint32_t id) 671 { 672 return ID2STR(id, string_rc, "PKCS11_CKR_"); 673 } 674 675 const char *id2str_ta_cmd(uint32_t id) 676 { 677 return ID2STR(id, string_ta_cmd, NULL); 678 } 679 680 const char *id2str_slot_flag(uint32_t id) 681 { 682 return ID2STR(id, string_slot_flags, "PKCS11_CKFS_"); 683 } 684 685 const char *id2str_token_flag(uint32_t id) 686 { 687 return ID2STR(id, string_token_flags, "PKCS11_CKFT_"); 688 } 689 690 const char *id2str_session_flag(uint32_t id) 691 { 692 return ID2STR(id, string_session_flags, "PKCS11_CKFSS_"); 693 } 694 695 const char *id2str_session_state(uint32_t id) 696 { 697 return ID2STR(id, string_session_state, "PKCS11_CKS_"); 698 } 699 700 const char *id2str_attr(uint32_t id) 701 { 702 size_t n = 0; 703 704 for (n = 0; n < ARRAY_SIZE(attr_ids); n++) { 705 if (id == attr_ids[n].id) { 706 /* Skip PKCS11_CKA_ prefix */ 707 return attr_ids[n].string + strlen("PKCS11_CKA_"); 708 } 709 } 710 711 return unknown; 712 } 713 714 const char *id2str_class(uint32_t id) 715 { 716 return ID2STR(id, string_class, "PKCS11_CKO_"); 717 } 718 719 const char *id2str_type(uint32_t id, uint32_t class) 720 { 721 enum pkcs11_class_id class_id = class; 722 enum pkcs11_key_type key_type = id; 723 724 switch (class_id) { 725 case PKCS11_CKO_SECRET_KEY: 726 case PKCS11_CKO_PUBLIC_KEY: 727 case PKCS11_CKO_PRIVATE_KEY: 728 return id2str_key_type(key_type); 729 default: 730 return unknown; 731 } 732 } 733 734 const char *id2str_key_type(uint32_t id) 735 { 736 return ID2STR(id, string_key_type, "PKCS11_CKK_"); 737 } 738 739 const char *id2str_attr_value(uint32_t id, size_t size, void *value) 740 { 741 static const char str_true[] = "TRUE"; 742 static const char str_false[] = "FALSE"; 743 static const char str_unknown[] = "*"; 744 uint32_t type = 0; 745 746 if (pkcs11_attr2boolprop_shift(id) >= 0) 747 return *(uint8_t *)value ? str_true : str_false; 748 749 if (size < sizeof(uint32_t)) 750 return str_unknown; 751 752 TEE_MemMove(&type, value, sizeof(uint32_t)); 753 754 switch (id) { 755 case PKCS11_CKA_CLASS: 756 return id2str_class(type); 757 case PKCS11_CKA_KEY_TYPE: 758 return id2str_key_type(type); 759 case PKCS11_CKA_MECHANISM_TYPE: 760 return id2str_mechanism(type); 761 default: 762 return str_unknown; 763 } 764 } 765 766 const char *id2str_proc(uint32_t id) 767 { 768 const char *str = ID2STR(id, string_internal_processing, 769 "PKCS11_PROCESSING_"); 770 771 if (str != unknown) 772 return str; 773 774 return id2str_mechanism(id); 775 } 776 777 const char *id2str_function(uint32_t id) 778 { 779 return ID2STR(id, string_functions, "PKCS11_FUNCTION_"); 780 } 781 #endif /*CFG_TEE_TA_LOG_LEVEL*/ 782