Skip to content

Commit 4fe7685

Browse files
LeucaLeuca
committed
Fix pkcs11 module information output about token and objects
At the end we will have a nike uri like this: pkcs11:model=CIE%203.0;manufacturer=Gemalto2;serial=123456789012;token=CIE Signed-off-by: Luca Magrone <luca@magrone.cc>
1 parent 038ff91 commit 4fe7685

2 files changed

Lines changed: 178 additions & 0 deletions

File tree

‎cie-middleware-fix-pkcs11-info-output.patch‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
From dc322649354738b86c7103aff16086c040d42970 Mon Sep 17 00:00:00 2001
2+
From: Luca Magrone <luca@magrone.cc>
3+
Date: Tue, 15 Oct 2024 00:16:58 +0200
4+
Subject: [PATCH] cie-pkcs11: Fix token (and its objects) info
5+
6+
The module does not correctly populate information about the smart card.
7+
Set the manufacturer. Actually pad data with blanks (instead of using
8+
zeroes). So on and so forth.
9+
10+
At the end we will have a nike uri like this: pkcs11:model=CIE%203.0;manufacturer=Gemalto2;serial=123456789012;token=CIE
11+
12+
Signed-off-by: Luca Magrone <luca@magrone.cc>
13+
---
14+
cie-pkcs11/PKCS11/CIEP11Template.cpp | 35 ++++++++++++++++++---------
15+
cie-pkcs11/PKCS11/PKCS11Functions.cpp | 8 +++---
16+
cie-pkcs11/PKCS11/Slot.cpp | 11 ++++-----
17+
3 files changed, 32 insertions(+), 22 deletions(-)
18+
19+
diff --git a/cie-pkcs11/PKCS11/CIEP11Template.cpp b/cie-pkcs11/PKCS11/CIEP11Template.cpp
20+
index a4b2c3b..5ed271e 100755
21+
--- a/cie-pkcs11/PKCS11/CIEP11Template.cpp
22+
+++ b/cie-pkcs11/PKCS11/CIEP11Template.cpp
23+
@@ -137,7 +137,6 @@ ByteArray SkipZero(ByteArray &ba) {
24+
return ByteArray();
25+
}
26+
27+
-BYTE label[] = { 'C','I','E','0' };
28+
void CIEtemplateInitSession(void *pTemplateData){
29+
CIEData* cie=(CIEData*)pTemplateData;
30+
31+
@@ -161,29 +160,33 @@ void CIEtemplateInitSession(void *pTemplateData){
32+
33+
CK_BBOOL vtrue = TRUE;
34+
CK_BBOOL vfalse = FALSE;
35+
+ BYTE labelCert[] = "CIE Certificate";
36+
+ BYTE labelPriv[] = "CIE Private Key";
37+
+ BYTE labelPub[] = "CIE Public Key";
38+
+ CK_BYTE objId = 0x01; // For simplicity we only need one (numbered '1')
39+
40+
cie->pubKey = std::make_shared<CP11PublicKey>(cie);
41+
cie->privKey = std::make_shared<CP11PrivateKey>(cie);
42+
cie->cert = std::make_shared<CP11Certificate>(cie);
43+
44+
- cie->pubKey->addAttribute(CKA_LABEL, VarToByteArray(label));
45+
- cie->pubKey->addAttribute(CKA_ID, VarToByteArray(label));
46+
+ cie->pubKey->addAttribute(CKA_LABEL, VarToByteArray(labelPub));
47+
+ cie->pubKey->addAttribute(CKA_ID, VarToByteArray(objId));
48+
cie->pubKey->addAttribute(CKA_PRIVATE, VarToByteArray(vfalse));
49+
cie->pubKey->addAttribute(CKA_TOKEN, VarToByteArray(vtrue));
50+
cie->pubKey->addAttribute(CKA_VERIFY, VarToByteArray(vtrue));
51+
CK_KEY_TYPE keyrsa = CKK_RSA;
52+
cie->pubKey->addAttribute(CKA_KEY_TYPE, VarToByteArray(keyrsa));
53+
54+
- cie->privKey->addAttribute(CKA_LABEL, VarToByteArray(label));
55+
- cie->privKey->addAttribute(CKA_ID, VarToByteArray(label));
56+
+ cie->privKey->addAttribute(CKA_LABEL, VarToByteArray(labelPriv));
57+
+ cie->privKey->addAttribute(CKA_ID, VarToByteArray(objId));
58+
cie->privKey->addAttribute(CKA_PRIVATE, VarToByteArray(vtrue));
59+
cie->privKey->addAttribute(CKA_TOKEN, VarToByteArray(vtrue));
60+
cie->privKey->addAttribute(CKA_KEY_TYPE, VarToByteArray(keyrsa));
61+
62+
cie->privKey->addAttribute(CKA_SIGN, VarToByteArray(vtrue));
63+
64+
- cie->cert->addAttribute(CKA_LABEL, VarToByteArray(label));
65+
- cie->cert->addAttribute(CKA_ID, VarToByteArray(label));
66+
+ cie->cert->addAttribute(CKA_LABEL, VarToByteArray(labelCert));
67+
+ cie->cert->addAttribute(CKA_ID, VarToByteArray(objId));
68+
cie->cert->addAttribute(CKA_PRIVATE, VarToByteArray(vfalse));
69+
cie->cert->addAttribute(CKA_TOKEN, VarToByteArray(vtrue));
70+
71+
@@ -289,10 +292,18 @@ void CIEtemplateInitSession(void *pTemplateData){
72+
73+
CK_DATE start, end;
74+
75+
- SYSTEMTIME sFrom, sTo;
76+
- sFrom = convertStringToSystemTime(notBefore.c_str());
77+
- sTo = convertStringToSystemTime(notAfter.c_str());
78+
-
79+
+ char sFrom[8], sTo[8];
80+
+ memcpy(sFrom, notBefore.c_str(), 8);
81+
+ memcpy(sTo, notAfter.c_str(), 8);
82+
+
83+
+ VarToByteArray(start.year).copy(ByteArray((BYTE*)sFrom, 4));
84+
+ VarToByteArray(start.month).copy(ByteArray((BYTE*)&sFrom[4], 2));
85+
+ VarToByteArray(start.day).copy(ByteArray((BYTE*)&sFrom[6], 2));
86+
+
87+
+ VarToByteArray(end.year).copy(ByteArray((BYTE*)sTo, 4));
88+
+ VarToByteArray(end.month).copy(ByteArray((BYTE*)&sTo[4], 2));
89+
+ VarToByteArray(end.day).copy(ByteArray((BYTE*)&sTo[6], 2));
90+
+
91+
cie->cert->addAttribute(CKA_START_DATE, VarToByteArray(start));
92+
cie->cert->addAttribute(CKA_END_DATE, VarToByteArray(end));
93+
94+
@@ -354,7 +365,7 @@ ByteDynArray CIEtemplateGetSerial(CSlot &pSlot) {
95+
}
96+
}
97+
void CIEtemplateGetModel(CSlot &pSlot, std::string &szModel){
98+
- szModel = "";
99+
+ szModel = "CIE 3.0";
100+
}
101+
void CIEtemplateGetTokenFlags(CSlot &pSlot, CK_FLAGS &dwFlags){
102+
dwFlags = CKF_LOGIN_REQUIRED | CKF_USER_PIN_INITIALIZED | CKF_TOKEN_INITIALIZED | CKF_REMOVABLE_DEVICE;
103+
diff --git a/cie-pkcs11/PKCS11/PKCS11Functions.cpp b/cie-pkcs11/PKCS11/PKCS11Functions.cpp
104+
index 4135729..a4a7213 100755
105+
--- a/cie-pkcs11/PKCS11/PKCS11Functions.cpp
106+
+++ b/cie-pkcs11/PKCS11/PKCS11Functions.cpp
107+
@@ -589,13 +589,13 @@ CK_RV CK_ENTRY C_GetInfo(CK_INFO_PTR pInfo /* location that receives information
108+
throw p11_error(CKR_CRYPTOKI_NOT_INITIALIZED);
109+
110+
pInfo->cryptokiVersion.major = 2; /* Cryptoki interface ver */
111+
- pInfo->cryptokiVersion.minor = 10; //12345678901234567890123456789012
112+
- CryptoPP::memcpy_s((char*)pInfo->manufacturerID,32,"IPZS\0 ", 32);
113+
+ pInfo->cryptokiVersion.minor = 11; //12345678901234567890123456789012
114+
+ CryptoPP::memcpy_s((char*)pInfo->manufacturerID,32,"IPZS ", 32);
115+
116+
pInfo->flags = 0; /* must be zero */
117+
118+
/* libraryDescription and libraryVersion are new for v2.0 */
119+
- CryptoPP::memcpy_s((char*)pInfo->libraryDescription,32,"CIE PKCS11\0 ", 32);
120+
+ CryptoPP::memcpy_s((char*)pInfo->libraryDescription,32,"CIE PKCS11 ", 32);
121+
122+
pInfo->libraryVersion.major = 1; /* version of library */
123+
pInfo->libraryVersion.minor = 0; /* version of library */
124+
@@ -617,7 +617,7 @@ CK_RV CK_ENTRY C_GetFunctionList(CK_FUNCTION_LIST_PTR_PTR ppFunctionList)
125+
if (ppFunctionList == NULL)
126+
throw p11_error(CKR_ARGUMENTS_BAD);
127+
128+
- static CK_FUNCTION_LIST functionList = {{ 2, 20},
129+
+ static CK_FUNCTION_LIST functionList = {{ 2, 11},
130+
C_Initialize,
131+
C_Finalize,
132+
C_GetInfo,
133+
diff --git a/cie-pkcs11/PKCS11/Slot.cpp b/cie-pkcs11/PKCS11/Slot.cpp
134+
index 2110cdd..107ba8a 100755
135+
--- a/cie-pkcs11/PKCS11/Slot.cpp
136+
+++ b/cie-pkcs11/PKCS11/Slot.cpp
137+
@@ -397,7 +397,7 @@ namespace p11 {
138+
if (pTemplate == nullptr)
139+
throw p11_error(CKR_TOKEN_NOT_RECOGNIZED);
140+
141+
- memset(pInfo->label, 0, sizeof(pInfo->label));
142+
+ memset(pInfo->label, ' ', sizeof(pInfo->label));
143+
CryptoPP::memcpy_s((char*)pInfo->label, 32, pTemplate->szName.c_str(), min1(pTemplate->szName.length(), sizeof(pInfo->label)));
144+
memset(pInfo->manufacturerID, ' ', sizeof(pInfo->manufacturerID));
145+
146+
@@ -429,6 +429,7 @@ namespace p11 {
147+
manifacturer = "STM3";
148+
else
149+
throw p11_error(CKR_TOKEN_NOT_RECOGNIZED);
150+
+#endif
151+
152+
CryptoPP::memcpy_s((char*)pInfo->manufacturerID, 32, manifacturer.c_str(), manifacturer.size());
153+
154+
@@ -436,17 +437,15 @@ namespace p11 {
155+
pSerialTemplate = pTemplate;
156+
baSerial = pTemplate->FunctionList.templateGetSerial(*this);
157+
}
158+
-#endif
159+
+
160+
std::string model;
161+
pTemplate->FunctionList.templateGetModel(*this, model);
162+
163+
- memset(pInfo->serialNumber, 0, sizeof(pInfo->serialNumber));
164+
+ memset(pInfo->serialNumber, ' ', sizeof(pInfo->serialNumber));
165+
size_t UIDsize = min1(sizeof(pInfo->serialNumber), baSerial.size());
166+
CryptoPP::memcpy_s(pInfo->serialNumber, 16, baSerial.data(), UIDsize);
167+
168+
- CryptoPP::memcpy_s((char*)pInfo->label + pTemplate->szName.length() + 1, sizeof(pInfo->label) - pTemplate->szName.length() - 1, baSerial.data(), baSerial.size());
169+
-
170+
- memset(pInfo->model, 0, sizeof(pInfo->model));
171+
+ memset(pInfo->model, ' ', sizeof(pInfo->model));
172+
CryptoPP::memcpy_s(pInfo->model, 16, model.c_str(), min1(model.length(), sizeof(pInfo->model)));
173+
174+
CK_FLAGS dwFlags;
175+
--
176+
2.43.5
177+

‎cie-middleware.spec‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ Patch6: cie-middleware-fix-pkcs11.patch
2323
Patch7: cie-middleware-fix-openssl.patch
2424
Patch8: cie-middleware-fix-c++-std-headers.patch
2525
Patch9: cie-middleware-keyboard-shortcuts.patch
26+
Patch10: cie-middleware-fix-pkcs11-info-output.patch
2627

2728
%if 0%{?fedora} < 40 || (0%{?rhel} && 0%{?rhel} < 10)
2829
BuildRequires: maven-local-openjdk11

0 commit comments

Comments
 (0)