1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2018-2020, Linaro Limited 4 */ 5 6 #include <pkcs11_ta.h> 7 #include <string.h> 8 #include <tee_internal_api.h> 9 #include <util.h> 10 11 #include "attributes.h" 12 #include "object.h" 13 #include "pkcs11_attributes.h" 14 #include "pkcs11_helpers.h" 15 16 static const char __maybe_unused unknown[] = "<unknown-identifier>"; 17 18 struct attr_size { 19 uint32_t id; 20 uint32_t size; 21 #if CFG_TEE_TA_LOG_LEVEL > 0 22 const char *string; 23 #endif 24 }; 25 26 #if CFG_TEE_TA_LOG_LEVEL > 0 27 #define PKCS11_ID_SZ(_id, _sz) \ 28 { .id = (uint32_t)(_id), .size = (_sz), .string = #_id } 29 #else 30 #define PKCS11_ID_SZ(_id, _sz) \ 31 { .id = (uint32_t)(_id), .size = (_sz) } 32 #endif 33 34 static const struct attr_size attr_ids[] = { 35 PKCS11_ID_SZ(PKCS11_CKA_CLASS, 4), 36 PKCS11_ID_SZ(PKCS11_CKA_KEY_TYPE, 4), 37 PKCS11_ID_SZ(PKCS11_CKA_VALUE, 0), 38 PKCS11_ID_SZ(PKCS11_CKA_VALUE_LEN, 4), 39 PKCS11_ID_SZ(PKCS11_CKA_LABEL, 0), 40 PKCS11_ID_SZ(PKCS11_CKA_WRAP_TEMPLATE, 0), 41 PKCS11_ID_SZ(PKCS11_CKA_UNWRAP_TEMPLATE, 0), 42 PKCS11_ID_SZ(PKCS11_CKA_DERIVE_TEMPLATE, 0), 43 PKCS11_ID_SZ(PKCS11_CKA_START_DATE, 4), 44 PKCS11_ID_SZ(PKCS11_CKA_END_DATE, 4), 45 PKCS11_ID_SZ(PKCS11_CKA_OBJECT_ID, 0), 46 PKCS11_ID_SZ(PKCS11_CKA_APPLICATION, 0), 47 PKCS11_ID_SZ(PKCS11_CKA_MECHANISM_TYPE, 4), 48 PKCS11_ID_SZ(PKCS11_CKA_ID, 0), 49 PKCS11_ID_SZ(PKCS11_CKA_ALLOWED_MECHANISMS, 0), 50 PKCS11_ID_SZ(PKCS11_CKA_EC_POINT, 0), 51 PKCS11_ID_SZ(PKCS11_CKA_EC_PARAMS, 0), 52 PKCS11_ID_SZ(PKCS11_CKA_MODULUS, 0), 53 PKCS11_ID_SZ(PKCS11_CKA_MODULUS_BITS, 4), 54 PKCS11_ID_SZ(PKCS11_CKA_PUBLIC_EXPONENT, 0), 55 PKCS11_ID_SZ(PKCS11_CKA_PRIVATE_EXPONENT, 0), 56 PKCS11_ID_SZ(PKCS11_CKA_PRIME_1, 0), 57 PKCS11_ID_SZ(PKCS11_CKA_PRIME_2, 0), 58 PKCS11_ID_SZ(PKCS11_CKA_EXPONENT_1, 0), 59 PKCS11_ID_SZ(PKCS11_CKA_EXPONENT_2, 0), 60 PKCS11_ID_SZ(PKCS11_CKA_COEFFICIENT, 0), 61 PKCS11_ID_SZ(PKCS11_CKA_SUBJECT, 0), 62 PKCS11_ID_SZ(PKCS11_CKA_PUBLIC_KEY_INFO, 0), 63 PKCS11_ID_SZ(PKCS11_CKA_KEY_GEN_MECHANISM, 4), 64 /* Below are boolean attributes */ 65 PKCS11_ID_SZ(PKCS11_CKA_TOKEN, 1), 66 PKCS11_ID_SZ(PKCS11_CKA_PRIVATE, 1), 67 PKCS11_ID_SZ(PKCS11_CKA_TRUSTED, 1), 68 PKCS11_ID_SZ(PKCS11_CKA_SENSITIVE, 1), 69 PKCS11_ID_SZ(PKCS11_CKA_ENCRYPT, 1), 70 PKCS11_ID_SZ(PKCS11_CKA_DECRYPT, 1), 71 PKCS11_ID_SZ(PKCS11_CKA_WRAP, 1), 72 PKCS11_ID_SZ(PKCS11_CKA_UNWRAP, 1), 73 PKCS11_ID_SZ(PKCS11_CKA_SIGN, 1), 74 PKCS11_ID_SZ(PKCS11_CKA_SIGN_RECOVER, 1), 75 PKCS11_ID_SZ(PKCS11_CKA_VERIFY, 1), 76 PKCS11_ID_SZ(PKCS11_CKA_VERIFY_RECOVER, 1), 77 PKCS11_ID_SZ(PKCS11_CKA_DERIVE, 1), 78 PKCS11_ID_SZ(PKCS11_CKA_EXTRACTABLE, 1), 79 PKCS11_ID_SZ(PKCS11_CKA_LOCAL, 1), 80 PKCS11_ID_SZ(PKCS11_CKA_NEVER_EXTRACTABLE, 1), 81 PKCS11_ID_SZ(PKCS11_CKA_ALWAYS_SENSITIVE, 1), 82 PKCS11_ID_SZ(PKCS11_CKA_MODIFIABLE, 1), 83 PKCS11_ID_SZ(PKCS11_CKA_COPYABLE, 1), 84 PKCS11_ID_SZ(PKCS11_CKA_DESTROYABLE, 1), 85 PKCS11_ID_SZ(PKCS11_CKA_ALWAYS_AUTHENTICATE, 1), 86 PKCS11_ID_SZ(PKCS11_CKA_WRAP_WITH_TRUSTED, 1), 87 /* Specific PKCS11 TA internal attribute ID */ 88 PKCS11_ID_SZ(PKCS11_CKA_UNDEFINED_ID, 0), 89 }; 90 91 struct any_id { 92 uint32_t id; 93 #if CFG_TEE_TA_LOG_LEVEL > 0 94 const char *string; 95 #endif 96 }; 97 98 /* 99 * Macro PKCS11_ID() can be used to define cells in ID list arrays 100 * or ID/string conversion arrays. 101 */ 102 #if CFG_TEE_TA_LOG_LEVEL > 0 103 #define PKCS11_ID(_id) { .id = _id, .string = #_id } 104 #else 105 #define PKCS11_ID(_id) { .id = _id } 106 #endif 107 108 #define ID2STR(id, table, prefix) \ 109 id2str(id, table, ARRAY_SIZE(table), prefix) 110 111 #if CFG_TEE_TA_LOG_LEVEL > 0 112 /* Convert a PKCS11 ID into its label string */ 113 static const char *id2str(uint32_t id, const struct any_id *table, 114 size_t count, const char *prefix) 115 { 116 size_t n = 0; 117 const char *str = NULL; 118 119 for (n = 0; n < count; n++) { 120 if (id != table[n].id) 121 continue; 122 123 str = table[n].string; 124 125 /* Skip prefix provided matches found */ 126 if (prefix && !TEE_MemCompare(str, prefix, strlen(prefix))) 127 str += strlen(prefix); 128 129 return str; 130 } 131 132 return unknown; 133 } 134 #endif /* CFG_TEE_TA_LOG_LEVEL > 0 */ 135 136 /* 137 * TA command IDs: used only as ID/string conversion for debug trace support 138 */ 139 static const struct any_id __maybe_unused string_ta_cmd[] = { 140 PKCS11_ID(PKCS11_CMD_PING), 141 PKCS11_ID(PKCS11_CMD_SLOT_LIST), 142 PKCS11_ID(PKCS11_CMD_SLOT_INFO), 143 PKCS11_ID(PKCS11_CMD_TOKEN_INFO), 144 PKCS11_ID(PKCS11_CMD_MECHANISM_IDS), 145 PKCS11_ID(PKCS11_CMD_MECHANISM_INFO), 146 PKCS11_ID(PKCS11_CMD_OPEN_SESSION), 147 PKCS11_ID(PKCS11_CMD_SESSION_INFO), 148 PKCS11_ID(PKCS11_CMD_CLOSE_SESSION), 149 PKCS11_ID(PKCS11_CMD_CLOSE_ALL_SESSIONS), 150 PKCS11_ID(PKCS11_CMD_INIT_TOKEN), 151 PKCS11_ID(PKCS11_CMD_INIT_PIN), 152 PKCS11_ID(PKCS11_CMD_SET_PIN), 153 PKCS11_ID(PKCS11_CMD_LOGIN), 154 PKCS11_ID(PKCS11_CMD_LOGOUT), 155 PKCS11_ID(PKCS11_CMD_CREATE_OBJECT), 156 PKCS11_ID(PKCS11_CMD_DESTROY_OBJECT), 157 PKCS11_ID(PKCS11_CMD_ENCRYPT_INIT), 158 PKCS11_ID(PKCS11_CMD_DECRYPT_INIT), 159 PKCS11_ID(PKCS11_CMD_ENCRYPT_UPDATE), 160 PKCS11_ID(PKCS11_CMD_DECRYPT_UPDATE), 161 PKCS11_ID(PKCS11_CMD_ENCRYPT_FINAL), 162 PKCS11_ID(PKCS11_CMD_DECRYPT_FINAL), 163 PKCS11_ID(PKCS11_CMD_ENCRYPT_ONESHOT), 164 PKCS11_ID(PKCS11_CMD_DECRYPT_ONESHOT), 165 PKCS11_ID(PKCS11_CMD_SIGN_INIT), 166 PKCS11_ID(PKCS11_CMD_VERIFY_INIT), 167 PKCS11_ID(PKCS11_CMD_SIGN_UPDATE), 168 PKCS11_ID(PKCS11_CMD_VERIFY_UPDATE), 169 PKCS11_ID(PKCS11_CMD_SIGN_FINAL), 170 PKCS11_ID(PKCS11_CMD_VERIFY_FINAL), 171 PKCS11_ID(PKCS11_CMD_SIGN_ONESHOT), 172 PKCS11_ID(PKCS11_CMD_VERIFY_ONESHOT), 173 PKCS11_ID(PKCS11_CMD_GENERATE_KEY), 174 PKCS11_ID(PKCS11_CMD_FIND_OBJECTS_INIT), 175 PKCS11_ID(PKCS11_CMD_FIND_OBJECTS), 176 PKCS11_ID(PKCS11_CMD_FIND_OBJECTS_FINAL), 177 PKCS11_ID(PKCS11_CMD_GET_OBJECT_SIZE), 178 PKCS11_ID(PKCS11_CMD_GET_ATTRIBUTE_VALUE), 179 PKCS11_ID(PKCS11_CMD_SET_ATTRIBUTE_VALUE), 180 PKCS11_ID(PKCS11_CMD_COPY_OBJECT), 181 PKCS11_ID(PKCS11_CMD_SEED_RANDOM), 182 PKCS11_ID(PKCS11_CMD_GENERATE_RANDOM), 183 PKCS11_ID(PKCS11_CMD_DERIVE_KEY), 184 PKCS11_ID(PKCS11_CMD_RELEASE_ACTIVE_PROCESSING), 185 PKCS11_ID(PKCS11_CMD_DIGEST_INIT), 186 PKCS11_ID(PKCS11_CMD_DIGEST_UPDATE), 187 PKCS11_ID(PKCS11_CMD_DIGEST_KEY), 188 PKCS11_ID(PKCS11_CMD_DIGEST_ONESHOT), 189 PKCS11_ID(PKCS11_CMD_DIGEST_FINAL), 190 }; 191 192 static const struct any_id __maybe_unused string_slot_flags[] = { 193 PKCS11_ID(PKCS11_CKFS_TOKEN_PRESENT), 194 PKCS11_ID(PKCS11_CKFS_REMOVABLE_DEVICE), 195 PKCS11_ID(PKCS11_CKFS_HW_SLOT), 196 }; 197 198 static const struct any_id __maybe_unused string_token_flags[] = { 199 PKCS11_ID(PKCS11_CKFT_RNG), 200 PKCS11_ID(PKCS11_CKFT_WRITE_PROTECTED), 201 PKCS11_ID(PKCS11_CKFT_LOGIN_REQUIRED), 202 PKCS11_ID(PKCS11_CKFT_USER_PIN_INITIALIZED), 203 PKCS11_ID(PKCS11_CKFT_RESTORE_KEY_NOT_NEEDED), 204 PKCS11_ID(PKCS11_CKFT_CLOCK_ON_TOKEN), 205 PKCS11_ID(PKCS11_CKFT_PROTECTED_AUTHENTICATION_PATH), 206 PKCS11_ID(PKCS11_CKFT_DUAL_CRYPTO_OPERATIONS), 207 PKCS11_ID(PKCS11_CKFT_TOKEN_INITIALIZED), 208 PKCS11_ID(PKCS11_CKFT_USER_PIN_COUNT_LOW), 209 PKCS11_ID(PKCS11_CKFT_USER_PIN_FINAL_TRY), 210 PKCS11_ID(PKCS11_CKFT_USER_PIN_LOCKED), 211 PKCS11_ID(PKCS11_CKFT_USER_PIN_TO_BE_CHANGED), 212 PKCS11_ID(PKCS11_CKFT_SO_PIN_COUNT_LOW), 213 PKCS11_ID(PKCS11_CKFT_SO_PIN_FINAL_TRY), 214 PKCS11_ID(PKCS11_CKFT_SO_PIN_LOCKED), 215 PKCS11_ID(PKCS11_CKFT_SO_PIN_TO_BE_CHANGED), 216 PKCS11_ID(PKCS11_CKFT_ERROR_STATE), 217 }; 218 219 static const struct any_id __maybe_unused string_session_flags[] = { 220 PKCS11_ID(PKCS11_CKFSS_RW_SESSION), 221 PKCS11_ID(PKCS11_CKFSS_SERIAL_SESSION), 222 }; 223 224 static const struct any_id __maybe_unused string_session_state[] = { 225 PKCS11_ID(PKCS11_CKS_RO_PUBLIC_SESSION), 226 PKCS11_ID(PKCS11_CKS_RO_USER_FUNCTIONS), 227 PKCS11_ID(PKCS11_CKS_RW_PUBLIC_SESSION), 228 PKCS11_ID(PKCS11_CKS_RW_USER_FUNCTIONS), 229 PKCS11_ID(PKCS11_CKS_RW_SO_FUNCTIONS), 230 }; 231 232 static const struct any_id __maybe_unused string_rc[] = { 233 PKCS11_ID(PKCS11_CKR_OK), 234 PKCS11_ID(PKCS11_CKR_GENERAL_ERROR), 235 PKCS11_ID(PKCS11_CKR_DEVICE_MEMORY), 236 PKCS11_ID(PKCS11_CKR_ARGUMENTS_BAD), 237 PKCS11_ID(PKCS11_CKR_BUFFER_TOO_SMALL), 238 PKCS11_ID(PKCS11_CKR_FUNCTION_FAILED), 239 PKCS11_ID(PKCS11_CKR_SIGNATURE_INVALID), 240 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_SENSITIVE), 241 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_TYPE_INVALID), 242 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_VALUE_INVALID), 243 PKCS11_ID(PKCS11_CKR_OBJECT_HANDLE_INVALID), 244 PKCS11_ID(PKCS11_CKR_KEY_HANDLE_INVALID), 245 PKCS11_ID(PKCS11_CKR_MECHANISM_INVALID), 246 PKCS11_ID(PKCS11_CKR_SESSION_HANDLE_INVALID), 247 PKCS11_ID(PKCS11_CKR_SLOT_ID_INVALID), 248 PKCS11_ID(PKCS11_CKR_MECHANISM_PARAM_INVALID), 249 PKCS11_ID(PKCS11_CKR_TEMPLATE_INCONSISTENT), 250 PKCS11_ID(PKCS11_CKR_TEMPLATE_INCOMPLETE), 251 PKCS11_ID(PKCS11_CKR_PIN_INCORRECT), 252 PKCS11_ID(PKCS11_CKR_PIN_LOCKED), 253 PKCS11_ID(PKCS11_CKR_PIN_EXPIRED), 254 PKCS11_ID(PKCS11_CKR_PIN_INVALID), 255 PKCS11_ID(PKCS11_CKR_PIN_LEN_RANGE), 256 PKCS11_ID(PKCS11_CKR_SESSION_EXISTS), 257 PKCS11_ID(PKCS11_CKR_SESSION_PARALLEL_NOT_SUPPORTED), 258 PKCS11_ID(PKCS11_CKR_SESSION_READ_ONLY), 259 PKCS11_ID(PKCS11_CKR_SESSION_READ_WRITE_SO_EXISTS), 260 PKCS11_ID(PKCS11_CKR_OPERATION_ACTIVE), 261 PKCS11_ID(PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED), 262 PKCS11_ID(PKCS11_CKR_OPERATION_NOT_INITIALIZED), 263 PKCS11_ID(PKCS11_CKR_TOKEN_WRITE_PROTECTED), 264 PKCS11_ID(PKCS11_CKR_TOKEN_NOT_PRESENT), 265 PKCS11_ID(PKCS11_CKR_TOKEN_NOT_RECOGNIZED), 266 PKCS11_ID(PKCS11_CKR_ACTION_PROHIBITED), 267 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_READ_ONLY), 268 PKCS11_ID(PKCS11_CKR_PIN_TOO_WEAK), 269 PKCS11_ID(PKCS11_CKR_CURVE_NOT_SUPPORTED), 270 PKCS11_ID(PKCS11_CKR_DOMAIN_PARAMS_INVALID), 271 PKCS11_ID(PKCS11_CKR_USER_ALREADY_LOGGED_IN), 272 PKCS11_ID(PKCS11_CKR_USER_ANOTHER_ALREADY_LOGGED_IN), 273 PKCS11_ID(PKCS11_CKR_USER_NOT_LOGGED_IN), 274 PKCS11_ID(PKCS11_CKR_USER_PIN_NOT_INITIALIZED), 275 PKCS11_ID(PKCS11_CKR_USER_TOO_MANY_TYPES), 276 PKCS11_ID(PKCS11_CKR_USER_TYPE_INVALID), 277 PKCS11_ID(PKCS11_CKR_KEY_SIZE_RANGE), 278 PKCS11_ID(PKCS11_CKR_KEY_INDIGESTIBLE), 279 PKCS11_ID(PKCS11_CKR_SESSION_READ_ONLY_EXISTS), 280 PKCS11_ID(PKCS11_CKR_SIGNATURE_LEN_RANGE), 281 PKCS11_ID(PKCS11_RV_NOT_FOUND), 282 PKCS11_ID(PKCS11_RV_NOT_IMPLEMENTED), 283 }; 284 285 static const struct any_id __maybe_unused string_class[] = { 286 PKCS11_ID(PKCS11_CKO_SECRET_KEY), 287 PKCS11_ID(PKCS11_CKO_PUBLIC_KEY), 288 PKCS11_ID(PKCS11_CKO_PRIVATE_KEY), 289 PKCS11_ID(PKCS11_CKO_OTP_KEY), 290 PKCS11_ID(PKCS11_CKO_CERTIFICATE), 291 PKCS11_ID(PKCS11_CKO_DATA), 292 PKCS11_ID(PKCS11_CKO_DOMAIN_PARAMETERS), 293 PKCS11_ID(PKCS11_CKO_HW_FEATURE), 294 PKCS11_ID(PKCS11_CKO_MECHANISM), 295 PKCS11_ID(PKCS11_CKO_UNDEFINED_ID) 296 }; 297 298 static const struct any_id __maybe_unused string_key_type[] = { 299 PKCS11_ID(PKCS11_CKK_AES), 300 PKCS11_ID(PKCS11_CKK_GENERIC_SECRET), 301 PKCS11_ID(PKCS11_CKK_MD5_HMAC), 302 PKCS11_ID(PKCS11_CKK_SHA_1_HMAC), 303 PKCS11_ID(PKCS11_CKK_SHA224_HMAC), 304 PKCS11_ID(PKCS11_CKK_SHA256_HMAC), 305 PKCS11_ID(PKCS11_CKK_SHA384_HMAC), 306 PKCS11_ID(PKCS11_CKK_SHA512_HMAC), 307 PKCS11_ID(PKCS11_CKK_EC), 308 PKCS11_ID(PKCS11_CKK_RSA), 309 PKCS11_ID(PKCS11_CKK_UNDEFINED_ID) 310 }; 311 312 /* 313 * Processing IDs not exported in the TA API. 314 * PKCS11_CKM_* mechanism IDs are looked up from mechanism_string_id(). 315 */ 316 static const struct any_id __maybe_unused string_internal_processing[] = { 317 PKCS11_ID(PKCS11_PROCESSING_IMPORT), 318 }; 319 320 static const struct any_id __maybe_unused string_functions[] = { 321 PKCS11_ID(PKCS11_FUNCTION_DIGEST), 322 PKCS11_ID(PKCS11_FUNCTION_IMPORT), 323 PKCS11_ID(PKCS11_FUNCTION_ENCRYPT), 324 PKCS11_ID(PKCS11_FUNCTION_DECRYPT), 325 PKCS11_ID(PKCS11_FUNCTION_SIGN), 326 PKCS11_ID(PKCS11_FUNCTION_VERIFY), 327 }; 328 329 /* 330 * Conversion between PKCS11 TA and GPD TEE return codes 331 */ 332 enum pkcs11_rc tee2pkcs_error(TEE_Result res) 333 { 334 switch (res) { 335 case TEE_SUCCESS: 336 return PKCS11_CKR_OK; 337 338 case TEE_ERROR_BAD_PARAMETERS: 339 return PKCS11_CKR_ARGUMENTS_BAD; 340 341 case TEE_ERROR_OUT_OF_MEMORY: 342 return PKCS11_CKR_DEVICE_MEMORY; 343 344 case TEE_ERROR_SHORT_BUFFER: 345 return PKCS11_CKR_BUFFER_TOO_SMALL; 346 347 case TEE_ERROR_MAC_INVALID: 348 case TEE_ERROR_SIGNATURE_INVALID: 349 return PKCS11_CKR_SIGNATURE_INVALID; 350 351 default: 352 return PKCS11_CKR_GENERAL_ERROR; 353 } 354 } 355 356 /* 357 * Helper functions to analyse PKCS11 identifiers 358 */ 359 360 /* Check attribute ID is known and size matches if fixed */ 361 bool valid_pkcs11_attribute_id(uint32_t id, uint32_t size) 362 { 363 size_t n = 0; 364 365 for (n = 0; n < ARRAY_SIZE(attr_ids); n++) 366 if (id == attr_ids[n].id) 367 return !attr_ids[n].size || size == attr_ids[n].size; 368 369 return false; 370 } 371 372 size_t pkcs11_attr_is_type(uint32_t attribute_id) 373 { 374 enum pkcs11_attr_id id = attribute_id; 375 376 switch (id) { 377 case PKCS11_CKA_KEY_TYPE: 378 case PKCS11_CKA_MECHANISM_TYPE: 379 case PKCS11_CKA_KEY_GEN_MECHANISM: 380 return sizeof(uint32_t); 381 default: 382 return 0; 383 } 384 } 385 386 bool pkcs11_attr_has_indirect_attributes(uint32_t attribute_id) 387 { 388 switch (attribute_id) { 389 case PKCS11_CKA_WRAP_TEMPLATE: 390 case PKCS11_CKA_UNWRAP_TEMPLATE: 391 case PKCS11_CKA_DERIVE_TEMPLATE: 392 return true; 393 default: 394 return false; 395 } 396 } 397 398 bool pkcs11_class_has_type(uint32_t class) 399 { 400 enum pkcs11_class_id class_id = class; 401 402 switch (class_id) { 403 case PKCS11_CKO_CERTIFICATE: 404 case PKCS11_CKO_PUBLIC_KEY: 405 case PKCS11_CKO_PRIVATE_KEY: 406 case PKCS11_CKO_SECRET_KEY: 407 case PKCS11_CKO_MECHANISM: 408 case PKCS11_CKO_HW_FEATURE: 409 return true; 410 default: 411 return false; 412 } 413 } 414 415 bool pkcs11_attr_class_is_key(uint32_t class) 416 { 417 enum pkcs11_class_id class_id = class; 418 419 switch (class_id) { 420 case PKCS11_CKO_SECRET_KEY: 421 case PKCS11_CKO_PUBLIC_KEY: 422 case PKCS11_CKO_PRIVATE_KEY: 423 return true; 424 default: 425 return false; 426 } 427 } 428 429 bool key_type_is_symm_key(uint32_t id) 430 { 431 enum pkcs11_key_type key_type = id; 432 433 switch (key_type) { 434 case PKCS11_CKK_AES: 435 case PKCS11_CKK_GENERIC_SECRET: 436 case PKCS11_CKK_MD5_HMAC: 437 case PKCS11_CKK_SHA_1_HMAC: 438 case PKCS11_CKK_SHA224_HMAC: 439 case PKCS11_CKK_SHA256_HMAC: 440 case PKCS11_CKK_SHA384_HMAC: 441 case PKCS11_CKK_SHA512_HMAC: 442 return true; 443 default: 444 return false; 445 } 446 } 447 448 bool key_type_is_asymm_key(uint32_t id) 449 { 450 enum pkcs11_key_type key_type = id; 451 452 switch (key_type) { 453 case PKCS11_CKK_EC: 454 case PKCS11_CKK_RSA: 455 return true; 456 default: 457 return false; 458 } 459 } 460 461 /* 462 * Returns shift position or -1 on error. 463 * Mainly used when PKCS11_SHEAD_WITH_BOOLPROPS is enabled 464 */ 465 int pkcs11_attr2boolprop_shift(uint32_t attr) 466 { 467 static const uint32_t bpa[] = { 468 [BPA_TOKEN] = PKCS11_CKA_TOKEN, 469 [BPA_PRIVATE] = PKCS11_CKA_PRIVATE, 470 [BPA_TRUSTED] = PKCS11_CKA_TRUSTED, 471 [BPA_SENSITIVE] = PKCS11_CKA_SENSITIVE, 472 [BPA_ENCRYPT] = PKCS11_CKA_ENCRYPT, 473 [BPA_DECRYPT] = PKCS11_CKA_DECRYPT, 474 [BPA_WRAP] = PKCS11_CKA_WRAP, 475 [BPA_UNWRAP] = PKCS11_CKA_UNWRAP, 476 [BPA_SIGN] = PKCS11_CKA_SIGN, 477 [BPA_SIGN_RECOVER] = PKCS11_CKA_SIGN_RECOVER, 478 [BPA_VERIFY] = PKCS11_CKA_VERIFY, 479 [BPA_VERIFY_RECOVER] = PKCS11_CKA_VERIFY_RECOVER, 480 [BPA_DERIVE] = PKCS11_CKA_DERIVE, 481 [BPA_EXTRACTABLE] = PKCS11_CKA_EXTRACTABLE, 482 [BPA_LOCAL] = PKCS11_CKA_LOCAL, 483 [BPA_NEVER_EXTRACTABLE] = PKCS11_CKA_NEVER_EXTRACTABLE, 484 [BPA_ALWAYS_SENSITIVE] = PKCS11_CKA_ALWAYS_SENSITIVE, 485 [BPA_MODIFIABLE] = PKCS11_CKA_MODIFIABLE, 486 [BPA_COPYABLE] = PKCS11_CKA_COPYABLE, 487 [BPA_DESTROYABLE] = PKCS11_CKA_DESTROYABLE, 488 [BPA_ALWAYS_AUTHENTICATE] = PKCS11_CKA_ALWAYS_AUTHENTICATE, 489 [BPA_WRAP_WITH_TRUSTED] = PKCS11_CKA_WRAP_WITH_TRUSTED, 490 }; 491 size_t pos = 0; 492 493 for (pos = 0; pos < ARRAY_SIZE(bpa); pos++) 494 if (bpa[pos] == attr) 495 return (int)pos; 496 497 return -1; 498 } 499 500 /* Initialize a TEE attribute for a target PKCS11 TA attribute in an object */ 501 bool pkcs2tee_load_attr(TEE_Attribute *tee_ref, uint32_t tee_id, 502 struct pkcs11_object *obj, 503 enum pkcs11_attr_id pkcs11_id) 504 { 505 void *a_ptr = NULL; 506 uint32_t a_size = 0; 507 508 if (get_attribute_ptr(obj->attributes, pkcs11_id, &a_ptr, &a_size)) 509 return false; 510 511 TEE_InitRefAttribute(tee_ref, tee_id, a_ptr, a_size); 512 513 return true; 514 } 515 516 /* 517 * Initialize a TEE attribute with hash of a target PKCS11 TA attribute 518 * in an object. 519 */ 520 enum pkcs11_rc pkcs2tee_load_hashed_attr(TEE_Attribute *tee_ref, 521 uint32_t tee_id, 522 struct pkcs11_object *obj, 523 enum pkcs11_attr_id pkcs11_id, 524 uint32_t tee_algo, void *hash_ptr, 525 uint32_t *hash_size) 526 { 527 TEE_OperationHandle handle = TEE_HANDLE_NULL; 528 void *a_ptr = NULL; 529 uint32_t a_size = 0; 530 enum pkcs11_rc rc = PKCS11_CKR_OK; 531 TEE_Result res = TEE_ERROR_GENERIC; 532 533 rc = get_attribute_ptr(obj->attributes, pkcs11_id, &a_ptr, &a_size); 534 if (rc) 535 return rc; 536 537 res = TEE_AllocateOperation(&handle, tee_algo, TEE_MODE_DIGEST, 0); 538 if (res) { 539 EMSG("TEE_AllocateOperation() failed %#"PRIx32, tee_algo); 540 return tee2pkcs_error(res); 541 } 542 543 res = TEE_DigestDoFinal(handle, a_ptr, a_size, hash_ptr, hash_size); 544 TEE_FreeOperation(handle); 545 if (res) { 546 EMSG("TEE_DigestDoFinal() failed %#"PRIx32, tee_algo); 547 return PKCS11_CKR_FUNCTION_FAILED; 548 } 549 550 TEE_InitRefAttribute(tee_ref, tee_id, hash_ptr, *hash_size); 551 552 return PKCS11_CKR_OK; 553 } 554 555 /* Easy conversion between PKCS11 TA function of TEE crypto mode */ 556 void pkcs2tee_mode(uint32_t *tee_id, enum processing_func function) 557 { 558 switch (function) { 559 case PKCS11_FUNCTION_ENCRYPT: 560 *tee_id = TEE_MODE_ENCRYPT; 561 break; 562 case PKCS11_FUNCTION_DECRYPT: 563 *tee_id = TEE_MODE_DECRYPT; 564 break; 565 case PKCS11_FUNCTION_SIGN: 566 *tee_id = TEE_MODE_SIGN; 567 break; 568 case PKCS11_FUNCTION_VERIFY: 569 *tee_id = TEE_MODE_VERIFY; 570 break; 571 case PKCS11_FUNCTION_DERIVE: 572 *tee_id = TEE_MODE_DERIVE; 573 break; 574 case PKCS11_FUNCTION_DIGEST: 575 *tee_id = TEE_MODE_DIGEST; 576 break; 577 default: 578 TEE_Panic(function); 579 } 580 } 581 582 #if CFG_TEE_TA_LOG_LEVEL > 0 583 const char *id2str_rc(uint32_t id) 584 { 585 return ID2STR(id, string_rc, "PKCS11_CKR_"); 586 } 587 588 const char *id2str_ta_cmd(uint32_t id) 589 { 590 return ID2STR(id, string_ta_cmd, NULL); 591 } 592 593 const char *id2str_slot_flag(uint32_t id) 594 { 595 return ID2STR(id, string_slot_flags, "PKCS11_CKFS_"); 596 } 597 598 const char *id2str_token_flag(uint32_t id) 599 { 600 return ID2STR(id, string_token_flags, "PKCS11_CKFT_"); 601 } 602 603 const char *id2str_session_flag(uint32_t id) 604 { 605 return ID2STR(id, string_session_flags, "PKCS11_CKFSS_"); 606 } 607 608 const char *id2str_session_state(uint32_t id) 609 { 610 return ID2STR(id, string_session_state, "PKCS11_CKS_"); 611 } 612 613 const char *id2str_attr(uint32_t id) 614 { 615 size_t n = 0; 616 617 for (n = 0; n < ARRAY_SIZE(attr_ids); n++) { 618 if (id == attr_ids[n].id) { 619 /* Skip PKCS11_CKA_ prefix */ 620 return attr_ids[n].string + strlen("PKCS11_CKA_"); 621 } 622 } 623 624 return unknown; 625 } 626 627 const char *id2str_class(uint32_t id) 628 { 629 return ID2STR(id, string_class, "PKCS11_CKO_"); 630 } 631 632 const char *id2str_type(uint32_t id, uint32_t class) 633 { 634 enum pkcs11_class_id class_id = class; 635 enum pkcs11_key_type key_type = id; 636 637 switch (class_id) { 638 case PKCS11_CKO_SECRET_KEY: 639 case PKCS11_CKO_PUBLIC_KEY: 640 case PKCS11_CKO_PRIVATE_KEY: 641 return id2str_key_type(key_type); 642 default: 643 return unknown; 644 } 645 } 646 647 const char *id2str_key_type(uint32_t id) 648 { 649 return ID2STR(id, string_key_type, "PKCS11_CKK_"); 650 } 651 652 const char *id2str_attr_value(uint32_t id, size_t size, void *value) 653 { 654 static const char str_true[] = "TRUE"; 655 static const char str_false[] = "FALSE"; 656 static const char str_unknown[] = "*"; 657 uint32_t type = 0; 658 659 if (pkcs11_attr2boolprop_shift(id) >= 0) 660 return *(uint8_t *)value ? str_true : str_false; 661 662 if (size < sizeof(uint32_t)) 663 return str_unknown; 664 665 TEE_MemMove(&type, value, sizeof(uint32_t)); 666 667 switch (id) { 668 case PKCS11_CKA_CLASS: 669 return id2str_class(type); 670 case PKCS11_CKA_KEY_TYPE: 671 return id2str_key_type(type); 672 case PKCS11_CKA_MECHANISM_TYPE: 673 return id2str_mechanism(type); 674 default: 675 return str_unknown; 676 } 677 } 678 679 const char *id2str_proc(uint32_t id) 680 { 681 const char *str = ID2STR(id, string_internal_processing, 682 "PKCS11_PROCESSING_"); 683 684 if (str != unknown) 685 return str; 686 687 return id2str_mechanism(id); 688 } 689 690 const char *id2str_function(uint32_t id) 691 { 692 return ID2STR(id, string_functions, "PKCS11_FUNCTION_"); 693 } 694 #endif /*CFG_TEE_TA_LOG_LEVEL*/ 695