1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2018-2020, Linaro Limited 4 */ 5 6 #include <pkcs11_ta.h> 7 #include <string.h> 8 #include <tee_internal_api.h> 9 #include <util.h> 10 11 #include "attributes.h" 12 #include "object.h" 13 #include "pkcs11_attributes.h" 14 #include "pkcs11_helpers.h" 15 #include "processing.h" 16 17 static const char __maybe_unused unknown[] = "<unknown-identifier>"; 18 19 struct attr_size { 20 uint32_t id; 21 uint32_t size; 22 #if CFG_TEE_TA_LOG_LEVEL > 0 23 const char *string; 24 #endif 25 }; 26 27 #if CFG_TEE_TA_LOG_LEVEL > 0 28 #define PKCS11_ID_SZ(_id, _sz) \ 29 { .id = (uint32_t)(_id), .size = (_sz), .string = #_id } 30 #else 31 #define PKCS11_ID_SZ(_id, _sz) \ 32 { .id = (uint32_t)(_id), .size = (_sz) } 33 #endif 34 35 static const struct attr_size attr_ids[] = { 36 PKCS11_ID_SZ(PKCS11_CKA_CLASS, 4), 37 PKCS11_ID_SZ(PKCS11_CKA_KEY_TYPE, 4), 38 PKCS11_ID_SZ(PKCS11_CKA_VALUE, 0), 39 PKCS11_ID_SZ(PKCS11_CKA_VALUE_LEN, 4), 40 PKCS11_ID_SZ(PKCS11_CKA_KEY_GEN_MECHANISM, 4), 41 PKCS11_ID_SZ(PKCS11_CKA_LABEL, 0), 42 PKCS11_ID_SZ(PKCS11_CKA_CERTIFICATE_TYPE, 4), 43 PKCS11_ID_SZ(PKCS11_CKA_ISSUER, 0), 44 PKCS11_ID_SZ(PKCS11_CKA_SERIAL_NUMBER, 0), 45 PKCS11_ID_SZ(PKCS11_CKA_CERTIFICATE_CATEGORY, 4), 46 PKCS11_ID_SZ(PKCS11_CKA_URL, 0), 47 PKCS11_ID_SZ(PKCS11_CKA_HASH_OF_SUBJECT_PUBLIC_KEY, 0), 48 PKCS11_ID_SZ(PKCS11_CKA_HASH_OF_ISSUER_PUBLIC_KEY, 0), 49 PKCS11_ID_SZ(PKCS11_CKA_JAVA_MIDP_SECURITY_DOMAIN, 4), 50 PKCS11_ID_SZ(PKCS11_CKA_NAME_HASH_ALGORITHM, 4), 51 PKCS11_ID_SZ(PKCS11_CKA_CHECK_VALUE, 0), 52 PKCS11_ID_SZ(PKCS11_CKA_WRAP_TEMPLATE, 0), 53 PKCS11_ID_SZ(PKCS11_CKA_UNWRAP_TEMPLATE, 0), 54 PKCS11_ID_SZ(PKCS11_CKA_DERIVE_TEMPLATE, 0), 55 PKCS11_ID_SZ(PKCS11_CKA_START_DATE, 4), 56 PKCS11_ID_SZ(PKCS11_CKA_END_DATE, 4), 57 PKCS11_ID_SZ(PKCS11_CKA_OBJECT_ID, 0), 58 PKCS11_ID_SZ(PKCS11_CKA_APPLICATION, 0), 59 PKCS11_ID_SZ(PKCS11_CKA_MECHANISM_TYPE, 4), 60 PKCS11_ID_SZ(PKCS11_CKA_ID, 0), 61 PKCS11_ID_SZ(PKCS11_CKA_ALLOWED_MECHANISMS, 0), 62 PKCS11_ID_SZ(PKCS11_CKA_EC_POINT, 0), 63 PKCS11_ID_SZ(PKCS11_CKA_EC_PARAMS, 0), 64 PKCS11_ID_SZ(PKCS11_CKA_MODULUS, 0), 65 PKCS11_ID_SZ(PKCS11_CKA_MODULUS_BITS, 4), 66 PKCS11_ID_SZ(PKCS11_CKA_PUBLIC_EXPONENT, 0), 67 PKCS11_ID_SZ(PKCS11_CKA_PRIVATE_EXPONENT, 0), 68 PKCS11_ID_SZ(PKCS11_CKA_PRIME_1, 0), 69 PKCS11_ID_SZ(PKCS11_CKA_PRIME_2, 0), 70 PKCS11_ID_SZ(PKCS11_CKA_EXPONENT_1, 0), 71 PKCS11_ID_SZ(PKCS11_CKA_EXPONENT_2, 0), 72 PKCS11_ID_SZ(PKCS11_CKA_COEFFICIENT, 0), 73 PKCS11_ID_SZ(PKCS11_CKA_SUBJECT, 0), 74 PKCS11_ID_SZ(PKCS11_CKA_PUBLIC_KEY_INFO, 0), 75 PKCS11_ID_SZ(PKCS11_CKA_KEY_GEN_MECHANISM, 4), 76 /* Below are boolean attributes */ 77 PKCS11_ID_SZ(PKCS11_CKA_TOKEN, 1), 78 PKCS11_ID_SZ(PKCS11_CKA_PRIVATE, 1), 79 PKCS11_ID_SZ(PKCS11_CKA_TRUSTED, 1), 80 PKCS11_ID_SZ(PKCS11_CKA_SENSITIVE, 1), 81 PKCS11_ID_SZ(PKCS11_CKA_ENCRYPT, 1), 82 PKCS11_ID_SZ(PKCS11_CKA_DECRYPT, 1), 83 PKCS11_ID_SZ(PKCS11_CKA_WRAP, 1), 84 PKCS11_ID_SZ(PKCS11_CKA_UNWRAP, 1), 85 PKCS11_ID_SZ(PKCS11_CKA_SIGN, 1), 86 PKCS11_ID_SZ(PKCS11_CKA_SIGN_RECOVER, 1), 87 PKCS11_ID_SZ(PKCS11_CKA_VERIFY, 1), 88 PKCS11_ID_SZ(PKCS11_CKA_VERIFY_RECOVER, 1), 89 PKCS11_ID_SZ(PKCS11_CKA_DERIVE, 1), 90 PKCS11_ID_SZ(PKCS11_CKA_EXTRACTABLE, 1), 91 PKCS11_ID_SZ(PKCS11_CKA_LOCAL, 1), 92 PKCS11_ID_SZ(PKCS11_CKA_NEVER_EXTRACTABLE, 1), 93 PKCS11_ID_SZ(PKCS11_CKA_ALWAYS_SENSITIVE, 1), 94 PKCS11_ID_SZ(PKCS11_CKA_MODIFIABLE, 1), 95 PKCS11_ID_SZ(PKCS11_CKA_COPYABLE, 1), 96 PKCS11_ID_SZ(PKCS11_CKA_DESTROYABLE, 1), 97 PKCS11_ID_SZ(PKCS11_CKA_ALWAYS_AUTHENTICATE, 1), 98 PKCS11_ID_SZ(PKCS11_CKA_WRAP_WITH_TRUSTED, 1), 99 /* Specific PKCS11 TA internal attribute ID */ 100 PKCS11_ID_SZ(PKCS11_CKA_OPTEE_HIDDEN_EC_POINT, 0), 101 PKCS11_ID_SZ(PKCS11_CKA_UNDEFINED_ID, 0), 102 }; 103 104 struct any_id { 105 uint32_t id; 106 #if CFG_TEE_TA_LOG_LEVEL > 0 107 const char *string; 108 #endif 109 }; 110 111 /* 112 * Macro PKCS11_ID() can be used to define cells in ID list arrays 113 * or ID/string conversion arrays. 114 */ 115 #if CFG_TEE_TA_LOG_LEVEL > 0 116 #define PKCS11_ID(_id) { .id = _id, .string = #_id } 117 #else 118 #define PKCS11_ID(_id) { .id = _id } 119 #endif 120 121 #define ID2STR(id, table, prefix) \ 122 id2str(id, table, ARRAY_SIZE(table), prefix) 123 124 #if CFG_TEE_TA_LOG_LEVEL > 0 125 /* Convert a PKCS11 ID into its label string */ 126 static const char *id2str(uint32_t id, const struct any_id *table, 127 size_t count, const char *prefix) 128 { 129 size_t n = 0; 130 const char *str = NULL; 131 132 for (n = 0; n < count; n++) { 133 if (id != table[n].id) 134 continue; 135 136 str = table[n].string; 137 138 /* Skip prefix provided matches found */ 139 if (prefix && !TEE_MemCompare(str, prefix, strlen(prefix))) 140 str += strlen(prefix); 141 142 return str; 143 } 144 145 return unknown; 146 } 147 #endif /* CFG_TEE_TA_LOG_LEVEL > 0 */ 148 149 /* 150 * TA command IDs: used only as ID/string conversion for debug trace support 151 */ 152 static const struct any_id __maybe_unused string_ta_cmd[] = { 153 PKCS11_ID(PKCS11_CMD_PING), 154 PKCS11_ID(PKCS11_CMD_SLOT_LIST), 155 PKCS11_ID(PKCS11_CMD_SLOT_INFO), 156 PKCS11_ID(PKCS11_CMD_TOKEN_INFO), 157 PKCS11_ID(PKCS11_CMD_MECHANISM_IDS), 158 PKCS11_ID(PKCS11_CMD_MECHANISM_INFO), 159 PKCS11_ID(PKCS11_CMD_OPEN_SESSION), 160 PKCS11_ID(PKCS11_CMD_SESSION_INFO), 161 PKCS11_ID(PKCS11_CMD_CLOSE_SESSION), 162 PKCS11_ID(PKCS11_CMD_CLOSE_ALL_SESSIONS), 163 PKCS11_ID(PKCS11_CMD_INIT_TOKEN), 164 PKCS11_ID(PKCS11_CMD_INIT_PIN), 165 PKCS11_ID(PKCS11_CMD_SET_PIN), 166 PKCS11_ID(PKCS11_CMD_LOGIN), 167 PKCS11_ID(PKCS11_CMD_LOGOUT), 168 PKCS11_ID(PKCS11_CMD_CREATE_OBJECT), 169 PKCS11_ID(PKCS11_CMD_DESTROY_OBJECT), 170 PKCS11_ID(PKCS11_CMD_ENCRYPT_INIT), 171 PKCS11_ID(PKCS11_CMD_DECRYPT_INIT), 172 PKCS11_ID(PKCS11_CMD_ENCRYPT_UPDATE), 173 PKCS11_ID(PKCS11_CMD_DECRYPT_UPDATE), 174 PKCS11_ID(PKCS11_CMD_ENCRYPT_FINAL), 175 PKCS11_ID(PKCS11_CMD_DECRYPT_FINAL), 176 PKCS11_ID(PKCS11_CMD_ENCRYPT_ONESHOT), 177 PKCS11_ID(PKCS11_CMD_DECRYPT_ONESHOT), 178 PKCS11_ID(PKCS11_CMD_SIGN_INIT), 179 PKCS11_ID(PKCS11_CMD_VERIFY_INIT), 180 PKCS11_ID(PKCS11_CMD_SIGN_UPDATE), 181 PKCS11_ID(PKCS11_CMD_VERIFY_UPDATE), 182 PKCS11_ID(PKCS11_CMD_SIGN_FINAL), 183 PKCS11_ID(PKCS11_CMD_VERIFY_FINAL), 184 PKCS11_ID(PKCS11_CMD_SIGN_ONESHOT), 185 PKCS11_ID(PKCS11_CMD_VERIFY_ONESHOT), 186 PKCS11_ID(PKCS11_CMD_GENERATE_KEY), 187 PKCS11_ID(PKCS11_CMD_FIND_OBJECTS_INIT), 188 PKCS11_ID(PKCS11_CMD_FIND_OBJECTS), 189 PKCS11_ID(PKCS11_CMD_FIND_OBJECTS_FINAL), 190 PKCS11_ID(PKCS11_CMD_GET_OBJECT_SIZE), 191 PKCS11_ID(PKCS11_CMD_GET_ATTRIBUTE_VALUE), 192 PKCS11_ID(PKCS11_CMD_SET_ATTRIBUTE_VALUE), 193 PKCS11_ID(PKCS11_CMD_COPY_OBJECT), 194 PKCS11_ID(PKCS11_CMD_SEED_RANDOM), 195 PKCS11_ID(PKCS11_CMD_GENERATE_RANDOM), 196 PKCS11_ID(PKCS11_CMD_DERIVE_KEY), 197 PKCS11_ID(PKCS11_CMD_RELEASE_ACTIVE_PROCESSING), 198 PKCS11_ID(PKCS11_CMD_DIGEST_INIT), 199 PKCS11_ID(PKCS11_CMD_DIGEST_UPDATE), 200 PKCS11_ID(PKCS11_CMD_DIGEST_KEY), 201 PKCS11_ID(PKCS11_CMD_DIGEST_ONESHOT), 202 PKCS11_ID(PKCS11_CMD_DIGEST_FINAL), 203 PKCS11_ID(PKCS11_CMD_GENERATE_KEY_PAIR), 204 PKCS11_ID(PKCS11_CMD_WRAP_KEY), 205 PKCS11_ID(PKCS11_CMD_UNWRAP_KEY), 206 }; 207 208 static const struct any_id __maybe_unused string_slot_flags[] = { 209 PKCS11_ID(PKCS11_CKFS_TOKEN_PRESENT), 210 PKCS11_ID(PKCS11_CKFS_REMOVABLE_DEVICE), 211 PKCS11_ID(PKCS11_CKFS_HW_SLOT), 212 }; 213 214 static const struct any_id __maybe_unused string_token_flags[] = { 215 PKCS11_ID(PKCS11_CKFT_RNG), 216 PKCS11_ID(PKCS11_CKFT_WRITE_PROTECTED), 217 PKCS11_ID(PKCS11_CKFT_LOGIN_REQUIRED), 218 PKCS11_ID(PKCS11_CKFT_USER_PIN_INITIALIZED), 219 PKCS11_ID(PKCS11_CKFT_RESTORE_KEY_NOT_NEEDED), 220 PKCS11_ID(PKCS11_CKFT_CLOCK_ON_TOKEN), 221 PKCS11_ID(PKCS11_CKFT_PROTECTED_AUTHENTICATION_PATH), 222 PKCS11_ID(PKCS11_CKFT_DUAL_CRYPTO_OPERATIONS), 223 PKCS11_ID(PKCS11_CKFT_TOKEN_INITIALIZED), 224 PKCS11_ID(PKCS11_CKFT_USER_PIN_COUNT_LOW), 225 PKCS11_ID(PKCS11_CKFT_USER_PIN_FINAL_TRY), 226 PKCS11_ID(PKCS11_CKFT_USER_PIN_LOCKED), 227 PKCS11_ID(PKCS11_CKFT_USER_PIN_TO_BE_CHANGED), 228 PKCS11_ID(PKCS11_CKFT_SO_PIN_COUNT_LOW), 229 PKCS11_ID(PKCS11_CKFT_SO_PIN_FINAL_TRY), 230 PKCS11_ID(PKCS11_CKFT_SO_PIN_LOCKED), 231 PKCS11_ID(PKCS11_CKFT_SO_PIN_TO_BE_CHANGED), 232 PKCS11_ID(PKCS11_CKFT_ERROR_STATE), 233 }; 234 235 static const struct any_id __maybe_unused string_session_flags[] = { 236 PKCS11_ID(PKCS11_CKFSS_RW_SESSION), 237 PKCS11_ID(PKCS11_CKFSS_SERIAL_SESSION), 238 }; 239 240 static const struct any_id __maybe_unused string_session_state[] = { 241 PKCS11_ID(PKCS11_CKS_RO_PUBLIC_SESSION), 242 PKCS11_ID(PKCS11_CKS_RO_USER_FUNCTIONS), 243 PKCS11_ID(PKCS11_CKS_RW_PUBLIC_SESSION), 244 PKCS11_ID(PKCS11_CKS_RW_USER_FUNCTIONS), 245 PKCS11_ID(PKCS11_CKS_RW_SO_FUNCTIONS), 246 }; 247 248 static const struct any_id __maybe_unused string_rc[] = { 249 PKCS11_ID(PKCS11_CKR_OK), 250 PKCS11_ID(PKCS11_CKR_SLOT_ID_INVALID), 251 PKCS11_ID(PKCS11_CKR_GENERAL_ERROR), 252 PKCS11_ID(PKCS11_CKR_FUNCTION_FAILED), 253 PKCS11_ID(PKCS11_CKR_ARGUMENTS_BAD), 254 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_READ_ONLY), 255 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_SENSITIVE), 256 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_TYPE_INVALID), 257 PKCS11_ID(PKCS11_CKR_ATTRIBUTE_VALUE_INVALID), 258 PKCS11_ID(PKCS11_CKR_ACTION_PROHIBITED), 259 PKCS11_ID(PKCS11_CKR_DATA_INVALID), 260 PKCS11_ID(PKCS11_CKR_DATA_LEN_RANGE), 261 PKCS11_ID(PKCS11_CKR_DEVICE_MEMORY), 262 PKCS11_ID(PKCS11_CKR_ENCRYPTED_DATA_INVALID), 263 PKCS11_ID(PKCS11_CKR_ENCRYPTED_DATA_LEN_RANGE), 264 PKCS11_ID(PKCS11_CKR_KEY_HANDLE_INVALID), 265 PKCS11_ID(PKCS11_CKR_KEY_SIZE_RANGE), 266 PKCS11_ID(PKCS11_CKR_KEY_TYPE_INCONSISTENT), 267 PKCS11_ID(PKCS11_CKR_KEY_INDIGESTIBLE), 268 PKCS11_ID(PKCS11_CKR_KEY_FUNCTION_NOT_PERMITTED), 269 PKCS11_ID(PKCS11_CKR_KEY_NOT_WRAPPABLE), 270 PKCS11_ID(PKCS11_CKR_KEY_UNEXTRACTABLE), 271 PKCS11_ID(PKCS11_CKR_MECHANISM_INVALID), 272 PKCS11_ID(PKCS11_CKR_MECHANISM_PARAM_INVALID), 273 PKCS11_ID(PKCS11_CKR_OBJECT_HANDLE_INVALID), 274 PKCS11_ID(PKCS11_CKR_OPERATION_ACTIVE), 275 PKCS11_ID(PKCS11_CKR_OPERATION_NOT_INITIALIZED), 276 PKCS11_ID(PKCS11_CKR_PIN_INCORRECT), 277 PKCS11_ID(PKCS11_CKR_PIN_INVALID), 278 PKCS11_ID(PKCS11_CKR_PIN_LEN_RANGE), 279 PKCS11_ID(PKCS11_CKR_PIN_EXPIRED), 280 PKCS11_ID(PKCS11_CKR_PIN_LOCKED), 281 PKCS11_ID(PKCS11_CKR_SESSION_HANDLE_INVALID), 282 PKCS11_ID(PKCS11_CKR_SESSION_PARALLEL_NOT_SUPPORTED), 283 PKCS11_ID(PKCS11_CKR_SESSION_READ_ONLY), 284 PKCS11_ID(PKCS11_CKR_SESSION_EXISTS), 285 PKCS11_ID(PKCS11_CKR_SESSION_READ_ONLY_EXISTS), 286 PKCS11_ID(PKCS11_CKR_SESSION_READ_WRITE_SO_EXISTS), 287 PKCS11_ID(PKCS11_CKR_SIGNATURE_INVALID), 288 PKCS11_ID(PKCS11_CKR_SIGNATURE_LEN_RANGE), 289 PKCS11_ID(PKCS11_CKR_TEMPLATE_INCOMPLETE), 290 PKCS11_ID(PKCS11_CKR_TEMPLATE_INCONSISTENT), 291 PKCS11_ID(PKCS11_CKR_TOKEN_NOT_PRESENT), 292 PKCS11_ID(PKCS11_CKR_TOKEN_NOT_RECOGNIZED), 293 PKCS11_ID(PKCS11_CKR_TOKEN_WRITE_PROTECTED), 294 PKCS11_ID(PKCS11_CKR_UNWRAPPING_KEY_HANDLE_INVALID), 295 PKCS11_ID(PKCS11_CKR_UNWRAPPING_KEY_SIZE_RANGE), 296 PKCS11_ID(PKCS11_CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT), 297 PKCS11_ID(PKCS11_CKR_USER_ALREADY_LOGGED_IN), 298 PKCS11_ID(PKCS11_CKR_USER_NOT_LOGGED_IN), 299 PKCS11_ID(PKCS11_CKR_USER_PIN_NOT_INITIALIZED), 300 PKCS11_ID(PKCS11_CKR_USER_TYPE_INVALID), 301 PKCS11_ID(PKCS11_CKR_USER_ANOTHER_ALREADY_LOGGED_IN), 302 PKCS11_ID(PKCS11_CKR_USER_TOO_MANY_TYPES), 303 PKCS11_ID(PKCS11_CKR_WRAPPED_KEY_INVALID), 304 PKCS11_ID(PKCS11_CKR_WRAPPED_KEY_LEN_RANGE), 305 PKCS11_ID(PKCS11_CKR_WRAPPING_KEY_HANDLE_INVALID), 306 PKCS11_ID(PKCS11_CKR_WRAPPING_KEY_SIZE_RANGE), 307 PKCS11_ID(PKCS11_CKR_WRAPPING_KEY_TYPE_INCONSISTENT), 308 PKCS11_ID(PKCS11_CKR_RANDOM_SEED_NOT_SUPPORTED), 309 PKCS11_ID(PKCS11_CKR_RANDOM_NO_RNG), 310 PKCS11_ID(PKCS11_CKR_DOMAIN_PARAMS_INVALID), 311 PKCS11_ID(PKCS11_CKR_CURVE_NOT_SUPPORTED), 312 PKCS11_ID(PKCS11_CKR_BUFFER_TOO_SMALL), 313 PKCS11_ID(PKCS11_CKR_PIN_TOO_WEAK), 314 PKCS11_ID(PKCS11_RV_NOT_FOUND), 315 PKCS11_ID(PKCS11_RV_NOT_IMPLEMENTED), 316 }; 317 318 static const struct any_id __maybe_unused string_class[] = { 319 PKCS11_ID(PKCS11_CKO_SECRET_KEY), 320 PKCS11_ID(PKCS11_CKO_PUBLIC_KEY), 321 PKCS11_ID(PKCS11_CKO_PRIVATE_KEY), 322 PKCS11_ID(PKCS11_CKO_OTP_KEY), 323 PKCS11_ID(PKCS11_CKO_CERTIFICATE), 324 PKCS11_ID(PKCS11_CKO_DATA), 325 PKCS11_ID(PKCS11_CKO_DOMAIN_PARAMETERS), 326 PKCS11_ID(PKCS11_CKO_HW_FEATURE), 327 PKCS11_ID(PKCS11_CKO_MECHANISM), 328 PKCS11_ID(PKCS11_CKO_UNDEFINED_ID) 329 }; 330 331 static const struct any_id __maybe_unused string_key_type[] = { 332 PKCS11_ID(PKCS11_CKK_AES), 333 PKCS11_ID(PKCS11_CKK_GENERIC_SECRET), 334 PKCS11_ID(PKCS11_CKK_MD5_HMAC), 335 PKCS11_ID(PKCS11_CKK_SHA_1_HMAC), 336 PKCS11_ID(PKCS11_CKK_SHA224_HMAC), 337 PKCS11_ID(PKCS11_CKK_SHA256_HMAC), 338 PKCS11_ID(PKCS11_CKK_SHA384_HMAC), 339 PKCS11_ID(PKCS11_CKK_SHA512_HMAC), 340 PKCS11_ID(PKCS11_CKK_EC), 341 PKCS11_ID(PKCS11_CKK_EC_EDWARDS), 342 PKCS11_ID(PKCS11_CKK_EDDSA), 343 PKCS11_ID(PKCS11_CKK_RSA), 344 PKCS11_ID(PKCS11_CKK_UNDEFINED_ID) 345 }; 346 347 static const struct any_id __maybe_unused string_certificate_type[] = { 348 PKCS11_ID(PKCS11_CKC_X_509), 349 PKCS11_ID(PKCS11_CKC_X_509_ATTR_CERT), 350 PKCS11_ID(PKCS11_CKC_WTLS), 351 PKCS11_ID(PKCS11_CKC_UNDEFINED_ID) 352 }; 353 354 /* 355 * Processing IDs not exported in the TA API. 356 * PKCS11_CKM_* mechanism IDs are looked up from mechanism_string_id(). 357 */ 358 static const struct any_id __maybe_unused string_internal_processing[] = { 359 PKCS11_ID(PKCS11_PROCESSING_IMPORT), 360 }; 361 362 static const struct any_id __maybe_unused string_functions[] = { 363 PKCS11_ID(PKCS11_FUNCTION_DIGEST), 364 PKCS11_ID(PKCS11_FUNCTION_IMPORT), 365 PKCS11_ID(PKCS11_FUNCTION_ENCRYPT), 366 PKCS11_ID(PKCS11_FUNCTION_DECRYPT), 367 PKCS11_ID(PKCS11_FUNCTION_SIGN), 368 PKCS11_ID(PKCS11_FUNCTION_VERIFY), 369 PKCS11_ID(PKCS11_FUNCTION_DERIVE), 370 PKCS11_ID(PKCS11_FUNCTION_WRAP), 371 PKCS11_ID(PKCS11_FUNCTION_UNWRAP), 372 }; 373 374 /* 375 * Conversion between PKCS11 TA and GPD TEE return codes 376 */ 377 enum pkcs11_rc tee2pkcs_error(TEE_Result res) 378 { 379 switch (res) { 380 case TEE_SUCCESS: 381 return PKCS11_CKR_OK; 382 383 case TEE_ERROR_BAD_PARAMETERS: 384 return PKCS11_CKR_ARGUMENTS_BAD; 385 386 case TEE_ERROR_CIPHERTEXT_INVALID: 387 return PKCS11_CKR_ENCRYPTED_DATA_INVALID; 388 389 case TEE_ERROR_OUT_OF_MEMORY: 390 return PKCS11_CKR_DEVICE_MEMORY; 391 392 case TEE_ERROR_SHORT_BUFFER: 393 return PKCS11_CKR_BUFFER_TOO_SMALL; 394 395 case TEE_ERROR_MAC_INVALID: 396 case TEE_ERROR_SIGNATURE_INVALID: 397 return PKCS11_CKR_SIGNATURE_INVALID; 398 399 default: 400 return PKCS11_CKR_GENERAL_ERROR; 401 } 402 } 403 404 /* 405 * Helper functions to analyse PKCS11 identifiers 406 */ 407 408 /* Check attribute ID is known and size matches if fixed */ 409 bool valid_pkcs11_attribute_id(uint32_t id, uint32_t size) 410 { 411 size_t n = 0; 412 413 for (n = 0; n < ARRAY_SIZE(attr_ids); n++) 414 if (id == attr_ids[n].id) 415 return !attr_ids[n].size || size == attr_ids[n].size; 416 417 return false; 418 } 419 420 size_t pkcs11_attr_is_type(uint32_t attribute_id) 421 { 422 enum pkcs11_attr_id id = attribute_id; 423 424 switch (id) { 425 case PKCS11_CKA_KEY_TYPE: 426 case PKCS11_CKA_MECHANISM_TYPE: 427 case PKCS11_CKA_KEY_GEN_MECHANISM: 428 return sizeof(uint32_t); 429 default: 430 return 0; 431 } 432 } 433 434 bool pkcs11_attr_has_indirect_attributes(uint32_t attribute_id) 435 { 436 switch (attribute_id) { 437 case PKCS11_CKA_WRAP_TEMPLATE: 438 case PKCS11_CKA_UNWRAP_TEMPLATE: 439 case PKCS11_CKA_DERIVE_TEMPLATE: 440 return true; 441 default: 442 return false; 443 } 444 } 445 446 bool pkcs11_class_has_type(uint32_t class) 447 { 448 enum pkcs11_class_id class_id = class; 449 450 switch (class_id) { 451 case PKCS11_CKO_CERTIFICATE: 452 case PKCS11_CKO_PUBLIC_KEY: 453 case PKCS11_CKO_PRIVATE_KEY: 454 case PKCS11_CKO_SECRET_KEY: 455 case PKCS11_CKO_MECHANISM: 456 case PKCS11_CKO_HW_FEATURE: 457 return true; 458 default: 459 return false; 460 } 461 } 462 463 bool pkcs11_attr_class_is_key(uint32_t class) 464 { 465 enum pkcs11_class_id class_id = class; 466 467 switch (class_id) { 468 case PKCS11_CKO_SECRET_KEY: 469 case PKCS11_CKO_PUBLIC_KEY: 470 case PKCS11_CKO_PRIVATE_KEY: 471 return true; 472 default: 473 return false; 474 } 475 } 476 477 bool key_type_is_symm_key(uint32_t id) 478 { 479 enum pkcs11_key_type key_type = id; 480 481 switch (key_type) { 482 case PKCS11_CKK_AES: 483 case PKCS11_CKK_GENERIC_SECRET: 484 case PKCS11_CKK_MD5_HMAC: 485 case PKCS11_CKK_SHA_1_HMAC: 486 case PKCS11_CKK_SHA224_HMAC: 487 case PKCS11_CKK_SHA256_HMAC: 488 case PKCS11_CKK_SHA384_HMAC: 489 case PKCS11_CKK_SHA512_HMAC: 490 return true; 491 default: 492 return false; 493 } 494 } 495 496 bool key_type_is_asymm_key(uint32_t id) 497 { 498 enum pkcs11_key_type key_type = id; 499 500 switch (key_type) { 501 case PKCS11_CKK_EC: 502 case PKCS11_CKK_EC_EDWARDS: 503 case PKCS11_CKK_RSA: 504 return true; 505 default: 506 return false; 507 } 508 } 509 510 /* 511 * Returns shift position or -1 on error. 512 * Mainly used when PKCS11_SHEAD_WITH_BOOLPROPS is enabled 513 */ 514 int pkcs11_attr2boolprop_shift(uint32_t attr) 515 { 516 static const uint32_t bpa[] = { 517 [BPA_TOKEN] = PKCS11_CKA_TOKEN, 518 [BPA_PRIVATE] = PKCS11_CKA_PRIVATE, 519 [BPA_TRUSTED] = PKCS11_CKA_TRUSTED, 520 [BPA_SENSITIVE] = PKCS11_CKA_SENSITIVE, 521 [BPA_ENCRYPT] = PKCS11_CKA_ENCRYPT, 522 [BPA_DECRYPT] = PKCS11_CKA_DECRYPT, 523 [BPA_WRAP] = PKCS11_CKA_WRAP, 524 [BPA_UNWRAP] = PKCS11_CKA_UNWRAP, 525 [BPA_SIGN] = PKCS11_CKA_SIGN, 526 [BPA_SIGN_RECOVER] = PKCS11_CKA_SIGN_RECOVER, 527 [BPA_VERIFY] = PKCS11_CKA_VERIFY, 528 [BPA_VERIFY_RECOVER] = PKCS11_CKA_VERIFY_RECOVER, 529 [BPA_DERIVE] = PKCS11_CKA_DERIVE, 530 [BPA_EXTRACTABLE] = PKCS11_CKA_EXTRACTABLE, 531 [BPA_LOCAL] = PKCS11_CKA_LOCAL, 532 [BPA_NEVER_EXTRACTABLE] = PKCS11_CKA_NEVER_EXTRACTABLE, 533 [BPA_ALWAYS_SENSITIVE] = PKCS11_CKA_ALWAYS_SENSITIVE, 534 [BPA_MODIFIABLE] = PKCS11_CKA_MODIFIABLE, 535 [BPA_COPYABLE] = PKCS11_CKA_COPYABLE, 536 [BPA_DESTROYABLE] = PKCS11_CKA_DESTROYABLE, 537 [BPA_ALWAYS_AUTHENTICATE] = PKCS11_CKA_ALWAYS_AUTHENTICATE, 538 [BPA_WRAP_WITH_TRUSTED] = PKCS11_CKA_WRAP_WITH_TRUSTED, 539 }; 540 size_t pos = 0; 541 542 for (pos = 0; pos < ARRAY_SIZE(bpa); pos++) 543 if (bpa[pos] == attr) 544 return (int)pos; 545 546 return -1; 547 } 548 549 /* Initialize a TEE attribute for a target PKCS11 TA attribute in an object */ 550 bool pkcs2tee_load_attr(TEE_Attribute *tee_ref, uint32_t tee_id, 551 struct pkcs11_object *obj, 552 enum pkcs11_attr_id pkcs11_id) 553 { 554 void *a_ptr = NULL; 555 uint8_t *der_ptr = NULL; 556 uint32_t a_size = 0; 557 uint32_t data32 = 0; 558 size_t hsize = 0; 559 size_t qsize = 0; 560 561 switch (tee_id) { 562 case TEE_ATTR_ECC_PUBLIC_VALUE_X: 563 case TEE_ATTR_ECC_PUBLIC_VALUE_Y: 564 case TEE_ATTR_ECC_CURVE: 565 if (get_attribute_ptr(obj->attributes, PKCS11_CKA_EC_PARAMS, 566 &a_ptr, &a_size) || !a_ptr) { 567 EMSG("Missing EC_PARAMS attribute"); 568 return false; 569 } 570 571 if (tee_id == TEE_ATTR_ECC_CURVE) { 572 data32 = ec_params2tee_curve(a_ptr, a_size); 573 TEE_InitValueAttribute(tee_ref, TEE_ATTR_ECC_CURVE, 574 data32, 0); 575 return true; 576 } 577 578 data32 = (ec_params2tee_keysize(a_ptr, a_size) + 7) / 8; 579 580 /* 581 * For private keys we need EC public key for TEE operations so 582 * first try to get hidden EC POINT and as backwards 583 * compatibility also check for CKA_EC_POINT. 584 * 585 * For public keys we only have CKA_EC_POINT but there is no 586 * harm to check for hidden one too. 587 */ 588 if (get_attribute_ptr(obj->attributes, 589 PKCS11_CKA_OPTEE_HIDDEN_EC_POINT, 590 &a_ptr, &a_size)) { 591 if (get_attribute_ptr(obj->attributes, 592 PKCS11_CKA_EC_POINT, 593 &a_ptr, &a_size)) { 594 /* 595 * Without EC public key we cannot proceed. 596 */ 597 EMSG("Missing EC_POINT attribute"); 598 return false; 599 } 600 } 601 602 der_ptr = (uint8_t *)a_ptr; 603 604 if (der_ptr[0] != 0x04) { 605 EMSG("Unsupported DER type"); 606 return false; 607 } 608 609 if ((der_ptr[1] & 0x80) == 0) { 610 /* DER short definitive form up to 127 bytes */ 611 qsize = der_ptr[1] & 0x7F; 612 hsize = 2 /* der */ + 1 /* point compression */; 613 } else if (der_ptr[1] == 0x81) { 614 /* DER long definitive form up to 255 bytes */ 615 qsize = der_ptr[2]; 616 hsize = 3 /* der */ + 1 /* point compression */; 617 } else { 618 EMSG("Unsupported DER long form"); 619 return false; 620 } 621 622 if (der_ptr[hsize - 1] != 0x04) { 623 EMSG("Unsupported EC_POINT compression"); 624 return false; 625 } 626 627 if (a_size != (hsize - 1) + qsize) { 628 EMSG("Invalid EC_POINT attribute"); 629 return false; 630 } 631 632 if (a_size != hsize + 2 * data32) { 633 EMSG("Invalid EC_POINT attribute"); 634 return false; 635 } 636 637 if (tee_id == TEE_ATTR_ECC_PUBLIC_VALUE_X) 638 TEE_InitRefAttribute(tee_ref, tee_id, 639 der_ptr + hsize, data32); 640 else 641 TEE_InitRefAttribute(tee_ref, tee_id, 642 der_ptr + hsize + data32, 643 data32); 644 645 return true; 646 647 default: 648 break; 649 } 650 651 if (get_attribute_ptr(obj->attributes, pkcs11_id, &a_ptr, &a_size)) 652 return false; 653 654 TEE_InitRefAttribute(tee_ref, tee_id, a_ptr, a_size); 655 656 return true; 657 } 658 659 /* 660 * Initialize a TEE attribute with hash of a target PKCS11 TA attribute 661 * in an object. 662 */ 663 enum pkcs11_rc pkcs2tee_load_hashed_attr(TEE_Attribute *tee_ref, 664 uint32_t tee_id, 665 struct pkcs11_object *obj, 666 enum pkcs11_attr_id pkcs11_id, 667 uint32_t tee_algo, void *hash_ptr, 668 uint32_t *hash_size) 669 { 670 TEE_OperationHandle handle = TEE_HANDLE_NULL; 671 void *a_ptr = NULL; 672 uint32_t a_size = 0; 673 enum pkcs11_rc rc = PKCS11_CKR_OK; 674 TEE_Result res = TEE_ERROR_GENERIC; 675 size_t tmp_sz = 0; 676 677 rc = get_attribute_ptr(obj->attributes, pkcs11_id, &a_ptr, &a_size); 678 if (rc) 679 return rc; 680 681 res = TEE_AllocateOperation(&handle, tee_algo, TEE_MODE_DIGEST, 0); 682 if (res) { 683 EMSG("TEE_AllocateOperation() failed %#"PRIx32, tee_algo); 684 return tee2pkcs_error(res); 685 } 686 687 tmp_sz = *hash_size; 688 res = TEE_DigestDoFinal(handle, a_ptr, a_size, hash_ptr, &tmp_sz); 689 *hash_size = tmp_sz; 690 TEE_FreeOperation(handle); 691 if (res) { 692 EMSG("TEE_DigestDoFinal() failed %#"PRIx32, tee_algo); 693 return PKCS11_CKR_FUNCTION_FAILED; 694 } 695 696 TEE_InitRefAttribute(tee_ref, tee_id, hash_ptr, *hash_size); 697 698 return PKCS11_CKR_OK; 699 } 700 701 /* Easy conversion between PKCS11 TA function of TEE crypto mode */ 702 void pkcs2tee_mode(uint32_t *tee_id, enum processing_func function) 703 { 704 switch (function) { 705 case PKCS11_FUNCTION_ENCRYPT: 706 *tee_id = TEE_MODE_ENCRYPT; 707 break; 708 case PKCS11_FUNCTION_DECRYPT: 709 *tee_id = TEE_MODE_DECRYPT; 710 break; 711 case PKCS11_FUNCTION_SIGN: 712 *tee_id = TEE_MODE_SIGN; 713 break; 714 case PKCS11_FUNCTION_VERIFY: 715 *tee_id = TEE_MODE_VERIFY; 716 break; 717 case PKCS11_FUNCTION_DERIVE: 718 *tee_id = TEE_MODE_DERIVE; 719 break; 720 case PKCS11_FUNCTION_DIGEST: 721 *tee_id = TEE_MODE_DIGEST; 722 break; 723 default: 724 TEE_Panic(function); 725 } 726 } 727 728 #if CFG_TEE_TA_LOG_LEVEL > 0 729 const char *id2str_rc(uint32_t id) 730 { 731 return ID2STR(id, string_rc, "PKCS11_CKR_"); 732 } 733 734 const char *id2str_ta_cmd(uint32_t id) 735 { 736 return ID2STR(id, string_ta_cmd, NULL); 737 } 738 739 const char *id2str_slot_flag(uint32_t id) 740 { 741 return ID2STR(id, string_slot_flags, "PKCS11_CKFS_"); 742 } 743 744 const char *id2str_token_flag(uint32_t id) 745 { 746 return ID2STR(id, string_token_flags, "PKCS11_CKFT_"); 747 } 748 749 const char *id2str_session_flag(uint32_t id) 750 { 751 return ID2STR(id, string_session_flags, "PKCS11_CKFSS_"); 752 } 753 754 const char *id2str_session_state(uint32_t id) 755 { 756 return ID2STR(id, string_session_state, "PKCS11_CKS_"); 757 } 758 759 const char *id2str_attr(uint32_t id) 760 { 761 size_t n = 0; 762 763 for (n = 0; n < ARRAY_SIZE(attr_ids); n++) { 764 if (id == attr_ids[n].id) { 765 /* Skip PKCS11_CKA_ prefix */ 766 return attr_ids[n].string + strlen("PKCS11_CKA_"); 767 } 768 } 769 770 return unknown; 771 } 772 773 const char *id2str_class(uint32_t id) 774 { 775 return ID2STR(id, string_class, "PKCS11_CKO_"); 776 } 777 778 const char *id2str_type(uint32_t id, uint32_t class) 779 { 780 enum pkcs11_class_id class_id = class; 781 enum pkcs11_key_type key_type = id; 782 783 switch (class_id) { 784 case PKCS11_CKO_SECRET_KEY: 785 case PKCS11_CKO_PUBLIC_KEY: 786 case PKCS11_CKO_PRIVATE_KEY: 787 return id2str_key_type(key_type); 788 default: 789 return unknown; 790 } 791 } 792 793 const char *id2str_key_type(uint32_t id) 794 { 795 return ID2STR(id, string_key_type, "PKCS11_CKK_"); 796 } 797 798 const char *id2str_certificate_type(uint32_t id) 799 { 800 return ID2STR(id, string_certificate_type, "PKCS11_CKC_"); 801 } 802 803 const char *id2str_attr_value(uint32_t id, size_t size, void *value) 804 { 805 static const char str_true[] = "TRUE"; 806 static const char str_false[] = "FALSE"; 807 static const char str_unknown[] = "*"; 808 uint32_t type = 0; 809 810 if (pkcs11_attr2boolprop_shift(id) >= 0) 811 return *(uint8_t *)value ? str_true : str_false; 812 813 if (size < sizeof(uint32_t)) 814 return str_unknown; 815 816 TEE_MemMove(&type, value, sizeof(uint32_t)); 817 818 switch (id) { 819 case PKCS11_CKA_CLASS: 820 return id2str_class(type); 821 case PKCS11_CKA_KEY_TYPE: 822 return id2str_key_type(type); 823 case PKCS11_CKA_MECHANISM_TYPE: 824 return id2str_mechanism(type); 825 default: 826 return str_unknown; 827 } 828 } 829 830 const char *id2str_proc(uint32_t id) 831 { 832 const char *str = ID2STR(id, string_internal_processing, 833 "PKCS11_PROCESSING_"); 834 835 if (str != unknown) 836 return str; 837 838 return id2str_mechanism(id); 839 } 840 841 const char *id2str_function(uint32_t id) 842 { 843 return ID2STR(id, string_functions, "PKCS11_FUNCTION_"); 844 } 845 #endif /*CFG_TEE_TA_LOG_LEVEL*/ 846