ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

[master] better error output when initializing pkcs11

Browse Source 
3786.	[func]		Provide more detailed error codes when using
			native PKCS#11. "pkcs11-tokens" now fails robustly
			rather than asserting when run against an HSM with
			an incomplete PCKS#11 API implementation. [RT #35479]
This commit is contained in:
Evan Hunt
2014-03-12 20:52:01 -07:00
parent 3911e7610f
commit acbb301e64
55 changed files with 651 additions and 185 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
bin/tests/pkcs11/benchmarks/create.c
View File

@@ -58,6 +58,7 @@
#include <isc/types.h>
#include <pk11/pk11.h>
#include <pk11/result.h>
#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
#define getpassphrase(x) getpass(x)
@@ -155,6 +156,8 @@ main(int argc, char *argv[]) {
exit(1);
}
pk11_result_register();
/* Allocate hanles */
hKey = (CK_SESSION_HANDLE *)
malloc(count * sizeof(CK_SESSION_HANDLE));
@@ -173,8 +176,11 @@ main(int argc, char *argv[]) {
pin = getpassphrase("Enter Pin: ");
result = pk11_get_session(&pctx, OP_ANY, ISC_TRUE, ISC_TRUE,
(const char *) pin, slot);
if (result != ISC_R_SUCCESS) {
ISC_TRUE, (const char *) pin, slot);
if ((result != ISC_R_SUCCESS) &&
(result != PK11_R_NORANDOMSERVICE) &&
(result != PK11_R_NODIGESTSERVICE) &&
(result != PK11_R_NOAESSERVICE)) {
fprintf(stderr, "Error initializing PKCS#11: %s\n",
isc_result_totext(result));
exit(1);
@@ -249,7 +255,7 @@ main(int argc, char *argv[]) {
free(hKey);
pk11_return_session(&pctx);
pk11_shutdown();
(void) pk11_finalize();
exit(error);
}

16
bin/tests/pkcs11/benchmarks/find.c
View File

@@ -55,6 +55,7 @@
#include <isc/types.h>
#include <pk11/pk11.h>
#include <pk11/result.h>
#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
#define getpassphrase(x) getpass(x)
@@ -95,6 +96,7 @@ main(int argc, char *argv[]) {
CK_OBJECT_HANDLE sKey = CK_INVALID_HANDLE;
CK_ULONG found = 0;
pk11_context_t pctx;
pk11_optype_t op_type = OP_RSA;
char *lib_name = NULL;
char *pin = NULL;
int error = 0;
@@ -111,6 +113,7 @@ main(int argc, char *argv[]) {
break;
case 's':
slot = atoi(isc_commandline_argument);
op_type = OP_ANY;
break;
case 'p':
pin = isc_commandline_argument;
@@ -139,6 +142,8 @@ main(int argc, char *argv[]) {
exit(1);
}
pk11_result_register();
/* Initialize the CRYPTOKI library */
if (lib_name != NULL)
pk11_set_lib_name(lib_name);
@@ -146,9 +151,12 @@ main(int argc, char *argv[]) {
if (pin == NULL)
pin = getpassphrase("Enter Pin: ");
result = pk11_get_session(&pctx, OP_ANY, ISC_FALSE, ISC_TRUE,
(const char *) pin, slot);
if (result != ISC_R_SUCCESS) {
result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_FALSE,
ISC_TRUE, (const char *) pin, slot);
if ((result != ISC_R_SUCCESS) &&
(result != PK11_R_NORANDOMSERVICE) &&
(result != PK11_R_NODIGESTSERVICE) &&
(result != PK11_R_NOAESSERVICE)) {
fprintf(stderr, "Error initializing PKCS#11: %s\n",
isc_result_totext(result));
exit(1);
@@ -213,7 +221,7 @@ main(int argc, char *argv[]) {
exit_objects:
pk11_return_session(&pctx);
pk11_shutdown();
(void) pk11_finalize();
exit(error);
}

16
bin/tests/pkcs11/benchmarks/genrsa.c
View File

@@ -57,6 +57,7 @@
#include <isc/types.h>
#include <pk11/pk11.h>
#include <pk11/result.h>
#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
#define getpassphrase(x) getpass(x)
@@ -118,6 +119,7 @@ main(int argc, char *argv[]) {
{ CKA_SIGN, &truevalue, (CK_ULONG) sizeof(truevalue) },
};
pk11_context_t pctx;
pk11_optype_t op_type = OP_RSA;
char *lib_name = NULL;
char *pin = NULL;
int error = 0;
@@ -135,6 +137,7 @@ main(int argc, char *argv[]) {
break;
case 's':
slot = atoi(isc_commandline_argument);
op_type = OP_ANY;
break;
case 'p':
pin = isc_commandline_argument;
@@ -170,6 +173,8 @@ main(int argc, char *argv[]) {
exit(1);
}
pk11_result_register();
/* Allocate hanles */
pubKey = (CK_SESSION_HANDLE *)
malloc(count * sizeof(CK_SESSION_HANDLE));
@@ -196,9 +201,12 @@ main(int argc, char *argv[]) {
if (pin == NULL)
pin = getpassphrase("Enter Pin: ");
result = pk11_get_session(&pctx, OP_ANY, ISC_TRUE, ISC_TRUE,
(const char *) pin, slot);
if (result != ISC_R_SUCCESS) {
result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_TRUE,
ISC_TRUE, (const char *) pin, slot);
if ((result != ISC_R_SUCCESS) &&
(result != PK11_R_NORANDOMSERVICE) &&
(result != PK11_R_NODIGESTSERVICE) &&
(result != PK11_R_NOAESSERVICE)) {
fprintf(stderr, "Error initializing PKCS#11: %s\n",
isc_result_totext(result));
exit(1);
@@ -281,7 +289,7 @@ main(int argc, char *argv[]) {
free(privKey);
pk11_return_session(&pctx);
pk11_shutdown();
(void) pk11_finalize();
exit(error);
}

16
bin/tests/pkcs11/benchmarks/privrsa.c
View File

@@ -58,6 +58,7 @@
#include <isc/types.h>
#include <pk11/pk11.h>
#include <pk11/result.h>
#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
#define getpassphrase(x) getpass(x)
@@ -209,6 +210,7 @@ main(int argc, char *argv[]) {
{ CKA_COEFFICIENT, coeff, (CK_ULONG) sizeof(coeff) }
};
pk11_context_t pctx;
pk11_optype_t op_type = OP_RSA;
char *lib_name = NULL;
char *pin = NULL;
int error = 0;
@@ -226,6 +228,7 @@ main(int argc, char *argv[]) {
break;
case 's':
slot = atoi(isc_commandline_argument);
op_type = OP_ANY;
break;
case 'p':
pin = isc_commandline_argument;
@@ -258,6 +261,8 @@ main(int argc, char *argv[]) {
exit(1);
}
pk11_result_register();
/* Allocate hanles */
hKey = (CK_SESSION_HANDLE *)
malloc(count * sizeof(CK_SESSION_HANDLE));
@@ -275,9 +280,12 @@ main(int argc, char *argv[]) {
if (pin == NULL)
pin = getpassphrase("Enter Pin: ");
result = pk11_get_session(&pctx, OP_ANY, ISC_TRUE, ISC_TRUE,
(const char *) pin, slot);
if (result != ISC_R_SUCCESS) {
result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_TRUE,
ISC_TRUE, (const char *) pin, slot);
if ((result != ISC_R_SUCCESS) &&
(result != PK11_R_NORANDOMSERVICE) &&
(result != PK11_R_NODIGESTSERVICE) &&
(result != PK11_R_NOAESSERVICE)) {
fprintf(stderr, "Error initializing PKCS#11: %s\n",
isc_result_totext(result));
free(hKey);
@@ -347,7 +355,7 @@ main(int argc, char *argv[]) {
free(hKey);
pk11_return_session(&pctx);
pk11_shutdown();
(void) pk11_finalize();
exit(error);
}

16
bin/tests/pkcs11/benchmarks/pubrsa.c
View File

@@ -58,6 +58,7 @@
#include <isc/types.h>
#include <pk11/pk11.h>
#include <pk11/result.h>
#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
#define getpassphrase(x) getpass(x)
@@ -130,6 +131,7 @@ main(int argc, char *argv[]) {
{ CKA_PUBLIC_EXPONENT, exponent, (CK_ULONG) sizeof(exponent) }
};
pk11_context_t pctx;
pk11_optype_t op_type = OP_RSA;
char *lib_name = NULL;
char *pin = NULL;
int error = 0;
@@ -147,6 +149,7 @@ main(int argc, char *argv[]) {
break;
case 's':
slot = atoi(isc_commandline_argument);
op_type = OP_ANY;
break;
case 'p':
pin = isc_commandline_argument;
@@ -179,6 +182,8 @@ main(int argc, char *argv[]) {
exit(1);
}
pk11_result_register();
/* Allocate hanles */
hKey = (CK_SESSION_HANDLE *)
malloc(count * sizeof(CK_SESSION_HANDLE));
@@ -196,9 +201,12 @@ main(int argc, char *argv[]) {
if (pin == NULL)
pin = getpassphrase("Enter Pin: ");
result = pk11_get_session(&pctx, OP_ANY, ISC_TRUE, ISC_TRUE,
(const char *) pin, slot);
if (result != ISC_R_SUCCESS) {
result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_TRUE,
ISC_TRUE, (const char *) pin, slot);
if ((result != ISC_R_SUCCESS) &&
(result != PK11_R_NORANDOMSERVICE) &&
(result != PK11_R_NODIGESTSERVICE) &&
(result != PK11_R_NOAESSERVICE)) {
fprintf(stderr, "Error initializing PKCS#11: %s\n",
isc_result_totext(result));
free(hKey);
@@ -268,7 +276,7 @@ main(int argc, char *argv[]) {
free(hKey);
pk11_return_session(&pctx);
pk11_shutdown();
(void) pk11_finalize();
exit(error);
}

15
bin/tests/pkcs11/benchmarks/random.c
View File

@@ -57,6 +57,7 @@
#include <isc/types.h>
#include <pk11/pk11.h>
#include <pk11/result.h>
#ifndef HAVE_CLOCK_GETTIME
#ifndef CLOCK_REALTIME
@@ -88,6 +89,7 @@ main(int argc, char *argv[]) {
CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE;
CK_ULONG len = sizeof(buf);
pk11_context_t pctx;
pk11_optype_t op_type = OP_RAND;
char *lib_name = NULL;
int error = 0;
int c, errflg = 0;
@@ -103,6 +105,7 @@ main(int argc, char *argv[]) {
break;
case 's':
slot = atoi(isc_commandline_argument);
op_type = OP_ANY;
break;
case 'n':
count = atoi(isc_commandline_argument);
@@ -128,13 +131,17 @@ main(int argc, char *argv[]) {
exit(1);
}
pk11_result_register();
/* Initialize the CRYPTOKI library */
if (lib_name != NULL)
pk11_set_lib_name(lib_name);
result = pk11_get_session(&pctx, OP_ANY, ISC_FALSE, ISC_FALSE,
NULL, slot);
if (result != ISC_R_SUCCESS) {
result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_FALSE,
ISC_FALSE, NULL, slot);
if ((result != ISC_R_SUCCESS) &&
(result != PK11_R_NODIGESTSERVICE) &&
(result != PK11_R_NOAESSERVICE)) {
fprintf(stderr, "Error initializing PKCS#11: %s\n",
isc_result_totext(result));
exit(1);
@@ -179,7 +186,7 @@ main(int argc, char *argv[]) {
exit_session:
pk11_return_session(&pctx);
pk11_shutdown();
(void) pk11_finalize();
exit(error);
}

15
bin/tests/pkcs11/benchmarks/sha1.c
View File

@@ -57,6 +57,7 @@
#include <isc/types.h>
#include <pk11/pk11.h>
#include <pk11/result.h>
#ifndef HAVE_CLOCK_GETTIME
#ifndef CLOCK_REALTIME
@@ -89,6 +90,7 @@ main(int argc, char *argv[]) {
CK_MECHANISM mech = { CKM_SHA_1, NULL, 0 };
CK_ULONG len = sizeof(buf);
pk11_context_t pctx;
pk11_optype_t op_type = OP_DIGEST;
char *lib_name = NULL;
int error = 0;
int c, errflg = 0;
@@ -104,6 +106,7 @@ main(int argc, char *argv[]) {
break;
case 's':
slot = atoi(isc_commandline_argument);
op_type = OP_ANY;
break;
case 'n':
count = atoi(isc_commandline_argument);
@@ -129,13 +132,17 @@ main(int argc, char *argv[]) {
exit(1);
}
pk11_result_register();
/* Initialize the CRYPTOKI library */
if (lib_name != NULL)
pk11_set_lib_name(lib_name);
result = pk11_get_session(&pctx, OP_ANY, ISC_FALSE, ISC_FALSE,
NULL, slot);
if (result != ISC_R_SUCCESS) {
result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_FALSE,
ISC_FALSE, NULL, slot);
if ((result != ISC_R_SUCCESS) &&
(result != PK11_R_NORANDOMSERVICE) &&
(result != PK11_R_NOAESSERVICE)) {
fprintf(stderr, "Error initializing PKCS#11: %s\n",
isc_result_totext(result));
exit(1);
@@ -201,7 +208,7 @@ main(int argc, char *argv[]) {
exit_session:
pk11_return_session(&pctx);
pk11_shutdown();
(void) pk11_finalize();
exit(error);
}

16
bin/tests/pkcs11/benchmarks/sign.c
View File

@@ -57,6 +57,7 @@
#include <isc/types.h>
#include <pk11/pk11.h>
#include <pk11/result.h>
#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
#define getpassphrase(x) getpass(x)
@@ -211,6 +212,7 @@ main(int argc, char *argv[]) {
};
CK_MECHANISM mech = { CKM_SHA1_RSA_PKCS, NULL, 0 };
pk11_context_t pctx;
pk11_optype_t op_type = OP_RSA;
char *lib_name = NULL;
char *pin = NULL;
int error = 0;
@@ -228,6 +230,7 @@ main(int argc, char *argv[]) {
break;
case 's':
slot = atoi(isc_commandline_argument);
op_type = OP_ANY;
break;
case 'p':
pin = isc_commandline_argument;
@@ -260,6 +263,8 @@ main(int argc, char *argv[]) {
exit(1);
}
pk11_result_register();
/* Initialize the CRYPTOKI library */
if (lib_name != NULL)
pk11_set_lib_name(lib_name);
@@ -267,9 +272,12 @@ main(int argc, char *argv[]) {
if (pin == NULL)
pin = getpassphrase("Enter Pin: ");
result = pk11_get_session(&pctx, OP_ANY, ISC_TRUE, ISC_TRUE,
(const char *) pin, slot);
if (result != ISC_R_SUCCESS) {
result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_TRUE,
ISC_TRUE, (const char *) pin, slot);
if ((result != ISC_R_SUCCESS) &&
(result != PK11_R_NORANDOMSERVICE) &&
(result != PK11_R_NODIGESTSERVICE) &&
(result != PK11_R_NOAESSERVICE)) {
fprintf(stderr, "Error initializing PKCS#11: %s\n",
isc_result_totext(result));
exit(1);
@@ -354,7 +362,7 @@ main(int argc, char *argv[]) {
}
pk11_return_session(&pctx);
pk11_shutdown();
(void) pk11_finalize();
exit(error);
}

16
bin/tests/pkcs11/benchmarks/verify.c
View File

@@ -57,6 +57,7 @@
#include <isc/types.h>
#include <pk11/pk11.h>
#include <pk11/result.h>
#if !(defined(HAVE_GETPASSPHRASE) || (defined (__SVR4) && defined (__sun)))
#define getpassphrase(x) getpass(x)
@@ -132,6 +133,7 @@ main(int argc, char *argv[]) {
};
CK_MECHANISM mech = { CKM_SHA1_RSA_PKCS, NULL, 0 };
pk11_context_t pctx;
pk11_optype_t op_type = OP_RSA;
char *lib_name = NULL;
char *pin = NULL;
int error = 0;
@@ -149,6 +151,7 @@ main(int argc, char *argv[]) {
break;
case 's':
slot = atoi(isc_commandline_argument);
op_type = OP_ANY;
break;
case 'p':
pin = isc_commandline_argument;
@@ -181,6 +184,8 @@ main(int argc, char *argv[]) {
exit(1);
}
pk11_result_register();
/* Initialize the CRYPTOKI library */
if (lib_name != NULL)
pk11_set_lib_name(lib_name);
@@ -188,9 +193,12 @@ main(int argc, char *argv[]) {
if (pin == NULL)
pin = getpassphrase("Enter Pin: ");
result = pk11_get_session(&pctx, OP_ANY, ISC_TRUE, ISC_TRUE,
(const char *) pin, slot);
if (result != ISC_R_SUCCESS) {
result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_TRUE,
ISC_TRUE, (const char *) pin, slot);
if ((result != ISC_R_SUCCESS) &&
(result != PK11_R_NORANDOMSERVICE) &&
(result != PK11_R_NODIGESTSERVICE) &&
(result != PK11_R_NOAESSERVICE)) {
fprintf(stderr, "Error initializing PKCS#11: %s\n",
isc_result_totext(result));
exit(1);
@@ -278,7 +286,7 @@ main(int argc, char *argv[]) {
}
pk11_return_session(&pctx);
pk11_shutdown();
(void) pk11_finalize();
exit(error);
}