denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pkcs11: Instead of a mutex use a new session to do multipart operations.

Browse Source
This commit is contained in:
Tobias Brunner
2011-11-02 20:27:54 +01:00
parent c198525104
commit b0319fe860
2 changed files with 67 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/pkcs11/pkcs11_private_key.c
+40 -22
View File
@@ -1,4 +1,7 @@
/*
* Copyright (C) 2011 Tobias Brunner
* Hochschule fuer Technik Rapperswil
*
* Copyright (C) 2010 Martin Willi
* Copyright (C) 2010 revosec AG
*
@@ -19,7 +22,6 @@
#include "pkcs11_manager.h"
#include <debug.h>
#include <threading/mutex.h>
typedef struct private_pkcs11_private_key_t private_pkcs11_private_key_t;
@@ -38,16 +40,16 @@ struct private_pkcs11_private_key_t {
*/
pkcs11_library_t *lib;
/**
* Slot the token is in
*/
CK_SLOT_ID slot;
/**
* Token session
*/
CK_SESSION_HANDLE session;
/**
* Mutex to lock session
*/
mutex_t *mutex;
/**
* Key object on the token
*/
@@ -141,7 +143,8 @@ CK_MECHANISM_PTR pkcs11_encryption_scheme_to_mech(encryption_scheme_t scheme)
/**
* Reauthenticate to do a signature
*/
static bool reauth(private_pkcs11_private_key_t *this)
static bool reauth(private_pkcs11_private_key_t *this,
CK_SESSION_HANDLE session)
{
enumerator_t *enumerator;
shared_key_t *shared;
@@ -155,7 +158,7 @@ static bool reauth(private_pkcs11_private_key_t *this)
{
found = TRUE;
pin = shared->get_key(shared);
rv = this->lib->f->C_Login(this->session, CKU_CONTEXT_SPECIFIC,
rv = this->lib->f->C_Login(session, CKU_CONTEXT_SPECIFIC,
pin.ptr, pin.len);
if (rv == CKR_OK)
{
@@ -179,6 +182,7 @@ METHOD(private_key_t, sign, bool,
chunk_t data, chunk_t *signature)
{
CK_MECHANISM_PTR mechanism;
CK_SESSION_HANDLE session;
CK_BYTE_PTR buf;
CK_ULONG len;
CK_RV rv;
@@ -190,22 +194,29 @@ METHOD(private_key_t, sign, bool,
signature_scheme_names, scheme);
return FALSE;
}
this->mutex->lock(this->mutex);
rv = this->lib->f->C_SignInit(this->session, mechanism, this->object);
if (this->reauth && !reauth(this))
rv = this->lib->f->C_OpenSession(this->slot, CKF_SERIAL_SESSION, NULL, NULL,
&session);
if (rv != CKR_OK)
{
DBG1(DBG_CFG, "opening PKCS#11 session failed: %N", ck_rv_names, rv);
return FALSE;
}
rv = this->lib->f->C_SignInit(session, mechanism, this->object);
if (this->reauth && !reauth(this, session))
{
this->lib->f->C_CloseSession(session);
return FALSE;
}
if (rv != CKR_OK)
{
this->mutex->unlock(this->mutex);
this->lib->f->C_CloseSession(session);
DBG1(DBG_LIB, "C_SignInit() failed: %N", ck_rv_names, rv);
return FALSE;
}
len = (get_keysize(this) + 7) / 8;
buf = malloc(len);
rv = this->lib->f->C_Sign(this->session, data.ptr, data.len, buf, &len);
this->mutex->unlock(this->mutex);
rv = this->lib->f->C_Sign(session, data.ptr, data.len, buf, &len);
this->lib->f->C_CloseSession(session);
if (rv != CKR_OK)
{
DBG1(DBG_LIB, "C_Sign() failed: %N", ck_rv_names, rv);
@@ -221,6 +232,7 @@ METHOD(private_key_t, decrypt, bool,
chunk_t crypt, chunk_t *plain)
{
CK_MECHANISM_PTR mechanism;
CK_SESSION_HANDLE session;
CK_BYTE_PTR buf;
CK_ULONG len;
CK_RV rv;
@@ -232,22 +244,29 @@ METHOD(private_key_t, decrypt, bool,
encryption_scheme_names, scheme);
return FALSE;
}
this->mutex->lock(this->mutex);
rv = this->lib->f->C_DecryptInit(this->session, mechanism, this->object);
if (this->reauth && !reauth(this))
rv = this->lib->f->C_OpenSession(this->slot, CKF_SERIAL_SESSION, NULL, NULL,
&session);
if (rv != CKR_OK)
{
DBG1(DBG_CFG, "opening PKCS#11 session failed: %N", ck_rv_names, rv);
return FALSE;
}
rv = this->lib->f->C_DecryptInit(session, mechanism, this->object);
if (this->reauth && !reauth(this, session))
{
this->lib->f->C_CloseSession(session);
return FALSE;
}
if (rv != CKR_OK)
{
this->mutex->unlock(this->mutex);
this->lib->f->C_CloseSession(session);
DBG1(DBG_LIB, "C_DecryptInit() failed: %N", ck_rv_names, rv);
return FALSE;
}
len = (get_keysize(this) + 7) / 8;
buf = malloc(len);
rv = this->lib->f->C_Decrypt(this->session, crypt.ptr, crypt.len, buf, &len);
this->mutex->unlock(this->mutex);
rv = this->lib->f->C_Decrypt(session, crypt.ptr, crypt.len, buf, &len);
this->lib->f->C_CloseSession(session);
if (rv != CKR_OK)
{
DBG1(DBG_LIB, "C_Decrypt() failed: %N", ck_rv_names, rv);
@@ -294,7 +313,6 @@ METHOD(private_key_t, destroy, void,
{
this->pubkey->destroy(this->pubkey);
}
this->mutex->destroy(this->mutex);
this->keyid->destroy(this->keyid);
this->lib->f->C_CloseSession(this->session);
free(this);
@@ -587,7 +605,7 @@ pkcs11_private_key_t *pkcs11_private_key_connect(key_type_t type, va_list args)
return NULL;
}
this->mutex = mutex_create(MUTEX_TYPE_DEFAULT);
this->slot = slot;
this->keyid = identification_create_from_encoding(ID_KEY_ID, keyid);
if (!login(this, slot))
src/libstrongswan/plugins/pkcs11/pkcs11_public_key.c
+27 -19
View File
@@ -1,4 +1,7 @@
/*
* Copyright (C) 2011 Tobias Brunner
* Hochschule fuer Technik Rapperswil
*
* Copyright (C) 2010 Martin Willi
* Copyright (C) 2010 revosec AG
*
@@ -20,7 +23,6 @@
#include "pkcs11_manager.h"
#include <debug.h>
#include <threading/mutex.h>
typedef struct private_pkcs11_public_key_t private_pkcs11_public_key_t;
@@ -64,11 +66,6 @@ struct private_pkcs11_public_key_t {
*/
CK_OBJECT_HANDLE object;
/**
* Mutex to lock session
*/
mutex_t *mutex;
/**
* References to this key
*/
@@ -92,6 +89,7 @@ METHOD(public_key_t, verify, bool,
chunk_t data, chunk_t sig)
{
CK_MECHANISM_PTR mechanism;
CK_SESSION_HANDLE session;
CK_RV rv;
mechanism = pkcs11_signature_scheme_to_mech(scheme);
@@ -105,17 +103,22 @@ METHOD(public_key_t, verify, bool,
{ /* trim leading zero byte in sig */
sig = chunk_skip(sig, 1);
}
this->mutex->lock(this->mutex);
rv = this->lib->f->C_VerifyInit(this->session, mechanism, this->object);
rv = this->lib->f->C_OpenSession(this->slot, CKF_SERIAL_SESSION, NULL, NULL,
&session);
if (rv != CKR_OK)
{
this->mutex->unlock(this->mutex);
DBG1(DBG_CFG, "opening PKCS#11 session failed: %N", ck_rv_names, rv);
return FALSE;
}
rv = this->lib->f->C_VerifyInit(session, mechanism, this->object);
if (rv != CKR_OK)
{
this->lib->f->C_CloseSession(session);
DBG1(DBG_LIB, "C_VerifyInit() failed: %N", ck_rv_names, rv);
return FALSE;
}
rv = this->lib->f->C_Verify(this->session, data.ptr, data.len,
sig.ptr, sig.len);
this->mutex->unlock(this->mutex);
rv = this->lib->f->C_Verify(session, data.ptr, data.len, sig.ptr, sig.len);
this->lib->f->C_CloseSession(session);
if (rv != CKR_OK)
{
DBG1(DBG_LIB, "C_Verify() failed: %N", ck_rv_names, rv);
@@ -129,6 +132,7 @@ METHOD(public_key_t, encrypt, bool,
chunk_t plain, chunk_t *crypt)
{
CK_MECHANISM_PTR mechanism;
CK_SESSION_HANDLE session;
CK_BYTE_PTR buf;
CK_ULONG len;
CK_RV rv;
@@ -140,18 +144,24 @@ METHOD(public_key_t, encrypt, bool,
encryption_scheme_names, scheme);
return FALSE;
}
this->mutex->lock(this->mutex);
rv = this->lib->f->C_EncryptInit(this->session, mechanism, this->object);
rv = this->lib->f->C_OpenSession(this->slot, CKF_SERIAL_SESSION, NULL, NULL,
&session);
if (rv != CKR_OK)
{
this->mutex->unlock(this->mutex);
DBG1(DBG_CFG, "opening PKCS#11 session failed: %N", ck_rv_names, rv);
return FALSE;
}
rv = this->lib->f->C_EncryptInit(session, mechanism, this->object);
if (rv != CKR_OK)
{
this->lib->f->C_CloseSession(session);
DBG1(DBG_LIB, "C_EncryptInit() failed: %N", ck_rv_names, rv);
return FALSE;
}
len = (get_keysize(this) + 7) / 8;
buf = malloc(len);
rv = this->lib->f->C_Encrypt(this->session, plain.ptr, plain.len, buf, &len);
this->mutex->unlock(this->mutex);
rv = this->lib->f->C_Encrypt(session, plain.ptr, plain.len, buf, &len);
this->lib->f->C_CloseSession(session);
if (rv != CKR_OK)
{
DBG1(DBG_LIB, "C_Encrypt() failed: %N", ck_rv_names, rv);
@@ -243,7 +253,6 @@ METHOD(public_key_t, destroy, void,
{
lib->encoding->clear_cache(lib->encoding, this);
this->lib->f->C_CloseSession(this->session);
this->mutex->destroy(this->mutex);
free(this);
}
}
@@ -278,7 +287,6 @@ static private_pkcs11_public_key_t *create(key_type_t type, size_t k,
.slot = slot,
.session = session,
.object = object,
.mutex = mutex_create(MUTEX_TYPE_DEFAULT),
.ref = 1,
);