[master] native PKCS#11 support
3705. [func] "configure --enable-native-pkcs11" enables BIND to use the PKCS#11 API for all cryptographic functions, so that it can drive a hardware service module directly without the need to use a modified OpenSSL as intermediary (so long as the HSM's vendor provides a complete-enough implementation of the PKCS#11 interface). This has been tested successfully with the Thales nShield HSM and with SoftHSMv2 from the OpenDNSSEC project. [RT #29031]
This commit is contained in:
Evan Hunt
185
bin/tests/pkcs11/benchmarks/random.c
Normal file
185
bin/tests/pkcs11/benchmarks/random.c
Normal file
@@ -0,0 +1,185 @@
|
||||
/*
|
||||
* Copyright (C) 2012 Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* Permission to use, copy, modify, and/or distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
* copyright notice and this permission notice appear in all copies.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
|
||||
* ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
|
||||
* WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE
|
||||
* FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
|
||||
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/*
|
||||
* Portions copyright (c) 2008 Nominet UK. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
||||
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
||||
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/* $Id$ */
|
||||
|
||||
/* random [-m module] [-s $slot] [-n count] */
|
||||
|
||||
/*! \file */
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <time.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <isc/commandline.h>
|
||||
#include <isc/result.h>
|
||||
#include <isc/types.h>
|
||||
|
||||
#include <iscpk11/pk11.h>
|
||||
|
||||
#ifndef HAVE_CLOCK_GETTIME
|
||||
#ifndef CLOCK_REALTIME
|
||||
#define CLOCK_REALTIME 0
|
||||
#endif
|
||||
|
||||
int
|
||||
clock_gettime(int32_t id, struct timespec *tp)
|
||||
{
|
||||
struct timeval tv;
|
||||
int result;
|
||||
|
||||
result = gettimeofday(&tv, NULL);
|
||||
if (result)
|
||||
return (result);
|
||||
tp->tv_sec = tv.tv_sec;
|
||||
tp->tv_nsec = (long) tv.tv_usec * 1000;
|
||||
return (result);
|
||||
}
|
||||
#endif
|
||||
|
||||
CK_BYTE buf[1024];
|
||||
|
||||
int
|
||||
main(int argc, char *argv[]) {
|
||||
isc_result_t result;
|
||||
CK_RV rv;
|
||||
CK_SLOT_ID slot = 0;
|
||||
CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE;
|
||||
CK_ULONG len = sizeof(buf);
|
||||
iscpk11_context_t pctx;
|
||||
char *lib_name = NULL;
|
||||
int error = 0;
|
||||
int c, errflg = 0;
|
||||
unsigned int count = 1000;
|
||||
unsigned int i;
|
||||
struct timespec starttime;
|
||||
struct timespec endtime;
|
||||
|
||||
while ((c = isc_commandline_parse(argc, argv, ":m:s:n:")) != -1) {
|
||||
switch (c) {
|
||||
case 'm':
|
||||
lib_name = isc_commandline_argument;
|
||||
break;
|
||||
case 's':
|
||||
slot = atoi(isc_commandline_argument);
|
||||
break;
|
||||
case 'n':
|
||||
count = atoi(isc_commandline_argument);
|
||||
break;
|
||||
case ':':
|
||||
fprintf(stderr,
|
||||
"Option -%c requires an operand\n",
|
||||
isc_commandline_option);
|
||||
errflg++;
|
||||
break;
|
||||
case '?':
|
||||
default:
|
||||
fprintf(stderr, "Unrecognised option: -%c\n",
|
||||
isc_commandline_option);
|
||||
errflg++;
|
||||
}
|
||||
}
|
||||
|
||||
if (errflg) {
|
||||
fprintf(stderr, "Usage:\n");
|
||||
fprintf(stderr,
|
||||
"\trandom [-m module] [-s slot] [-n count]\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/* Initialize the CRYPTOKI library */
|
||||
if (lib_name != NULL)
|
||||
pk11_set_lib_name(lib_name);
|
||||
|
||||
result = pk11_get_session(&pctx, OP_ANY, ISC_FALSE, ISC_FALSE,
|
||||
NULL, slot);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "Error initializing PKCS#11: %s\n",
|
||||
isc_result_totext(result));
|
||||
exit(1);
|
||||
}
|
||||
|
||||
hSession = pctx.session;
|
||||
|
||||
if (clock_gettime(CLOCK_REALTIME, &starttime) < 0) {
|
||||
perror("clock_gettime(start)");
|
||||
goto exit_session;
|
||||
}
|
||||
|
||||
for (i = 0; i < count; i++) {
|
||||
/* Get random bytes */
|
||||
rv = pkcs_C_GenerateRandom(hSession, buf, len);
|
||||
if (rv != CKR_OK) {
|
||||
fprintf(stderr,
|
||||
"C_GenerateRandom[%u]: Error = 0x%.8lX\n",
|
||||
i, rv);
|
||||
error = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (clock_gettime(CLOCK_REALTIME, &endtime) < 0) {
|
||||
perror("clock_gettime(end)");
|
||||
goto exit_session;
|
||||
}
|
||||
|
||||
endtime.tv_sec -= starttime.tv_sec;
|
||||
endtime.tv_nsec -= starttime.tv_nsec;
|
||||
while (endtime.tv_nsec < 0) {
|
||||
endtime.tv_sec -= 1;
|
||||
endtime.tv_nsec += 1000000000;
|
||||
}
|
||||
printf("%uK random bytes in %ld.%09lds\n", i,
|
||||
endtime.tv_sec, endtime.tv_nsec);
|
||||
if (i > 0)
|
||||
printf("%g random bytes/s\n",
|
||||
1024 * i / ((double) endtime.tv_sec +
|
||||
(double) endtime.tv_nsec / 1000000000.));
|
||||
|
||||
exit_session:
|
||||
pk11_return_session(&pctx);
|
||||
pk11_shutdown();
|
||||
|
||||
exit(error);
|
||||
}
|
||||
Reference in New Issue
Block a user