1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #ifndef _METAGLOBAL_H
27 #define	_METAGLOBAL_H
28 
29 
30 /*
31  * This file contains all the data structures used for the meta slot
32  */
33 
34 #ifdef	__cplusplus
35 extern "C" {
36 #endif
37 
38 #include <assert.h>
39 #include <pthread.h>
40 #include <synch.h>
41 #include <unistd.h>
42 #include <security/cryptoki.h>
43 #include <stdio.h>
44 #include <cryptoutil.h>
45 #include <pkcs11Session.h>
46 #include <pkcs11Slot.h>
47 #include <sys/crypto/ioctl.h>
48 
49 /*
50  * In "generic_attr_t", attributes that are not CK_BBOOL and
51  * CK_ULONG, the data will be stored in generic_data.
52  * Currently, 16 bytes will be pre-allocated for this.
53  * This is just a _WILD_ guess.  If actual
54  * experience shows that 16 bytes is too small for most of the
55  * data that will be stored here, and cause this
56  * memory to be reallocated all the time, this should be increased.
57  */
58 #define	INITIAL_ATTR_LEN	16
59 
60 /* We provide one slot, with the following arbitrary identifier. */
61 #define	METASLOT_SLOTID	42
62 
63 /* Metaslot is always the first slot in the framdwork, with slotID=0 */
64 #define	METASLOT_FRAMEWORK_ID	0
65 
66 /*
67  * These are the 2 acceptable string values for ${METASLOT_ENABLE} and
68  * ${METASLOT_AUTO_KEY_MIGRATE} environment variable
69  */
70 #define	TRUE_STRING	"true"
71 #define	FALSE_STRING	"false"
72 
73 /* Magic values for different data structures */
74 #define	METASLOT_SESSION_MAGIC		0xECF00004
75 #define	METASLOT_SESSION_BADMAGIC	0xBAD00004
76 #define	METASLOT_OBJECT_MAGIC		0xECF0B004
77 #define	METASLOT_OBJECT_BADMAGIC	0xBAD0B004
78 #define	METASLOT_OPSTATE_MAGIC		0xECF09004
79 #define	METASLOT_OPSTATE_BADMAGIC	0xBAD09004
80 
81 #define	IS_READ_ONLY_SESSION(session_flag) \
82 	(!(session_flag & CKF_RW_SESSION))
83 
84 /*
85  * Operation modes passed to meta_do_operation()
86  * MODE_UPDATE_WITHKEY is only used for C_DigestKey.
87  */
88 #define	MODE_SINGLE		0x0100
89 #define	MODE_UPDATE		0x0200
90 #define	MODE_UPDATE_WITHKEY	0x0400
91 #define	MODE_FINAL		0x1000
92 
93 
94 /* CK_INFO: Information about cryptoki */
95 #define	METASLOT_CRYPTOKI_VERSION_MAJOR	2
96 #define	METASLOT_CRYPTOKI_VERSION_MINOR	40
97 #define	METASLOT_MANUFACTURER_ID	"Sun Microsystems, Inc.          "
98 #define	METASLOT_LIBRARY_DESCRIPTION	"Sun Metaslot                    "
99 #define	METASLOT_LIBRARY_VERSION_MAJOR	1
100 #define	METASLOT_LIBRARY_VERSION_MINOR	1
101 
102 /* CK_SLOT_INFO */
103 #define	METASLOT_SLOT_DESCRIPTION	"Sun Metaslot                    " \
104 				"                                "
105 #define	METASLOT_HARDWARE_VERSION_MAJOR	0
106 #define	METASLOT_HARDWARE_VERSION_MINOR	0
107 #define	METASLOT_FIRMWARE_VERSION_MAJOR	0
108 #define	METASLOT_FIRMWARE_VERSION_MINOR	0
109 
110 /* CK_TOKEN_INFO: More information about token */
111 #define	METASLOT_TOKEN_LABEL		"Sun Metaslot                    "
112 #define	METASLOT_TOKEN_MODEL		"1.0             "
113 
114 /*
115  * Maximum number of objects and sessions to queue up before actually
116  * freeing them using the free() system.  This is necessary to workaround
117  * a problem in which applications re-uses handles that are no longer valid
118  */
119 #define	MAX_OBJ_TO_BE_FREED	300
120 #define	MAX_SESSION_TO_BE_FREED	300
121 
122 /*
123  * The following 2 functions deals with inserting and deleting
124  * from double linked lists.  It can work with any data structure
125  * that have "prev" and "next" defined.
126  */
127 
128 /* This always inserts into the head of the list */
129 #define	INSERT_INTO_LIST(list, item)			\
130 {							\
131 	if ((list) == NULL) {				\
132 		(item)->prev = NULL;			\
133 		(item)->next = NULL;			\
134 		(list) = (item);			\
135 	} else {					\
136 		(item)->next = (list);			\
137 		(item)->prev = NULL;			\
138 		(list)->prev = (item);			\
139 		(list) = (item);			\
140 	}						\
141 }
142 
143 
144 /*
145  * Remove item from list
146  */
147 #define	REMOVE_FROM_LIST(list, item) 				\
148 {								\
149 	/* item is at the beginning of the list */		\
150 	if ((list) == item) {					\
151 		if ((item)->next == NULL) {			\
152 			(list) = NULL;				\
153 		} else {					\
154 			(item)->next->prev = NULL;		\
155 			(list) = (item)->next;			\
156 		}						\
157 	} else {						\
158 		/*						\
159 		 * let the items which are initialized and not	\
160 		 * connected to the list trip over the asserts	\
161 		 */						\
162 		if ((item)->next) {				\
163 			(item)->next->prev = item->prev;	\
164 			assert((item)->prev != NULL);		\
165 			(item)->prev->next = (item)->next;	\
166 		} else {					\
167 			assert((item)->prev != NULL);		\
168 			(item)->prev->next = NULL;		\
169 		}						\
170 	}							\
171 }
172 
173 /*
174  * OBJRELEASE
175  *
176  * Signal that a metaobject is no longer in use (but is still valid).
177  */
178 #define	OBJRELEASE(object)						\
179 	if (object != NULL) {						\
180 		(void) pthread_rwlock_unlock(&object->object_lock);	\
181 	}
182 
183 /*
184  * REFRELEASE
185  *
186  * Signal that a metasession is no longer in use (but is still valid).
187  *
188  */
189 #define	REFRELEASE(session)						\
190 	if (session != NULL) {						\
191 		(void) pthread_rwlock_unlock(&session->session_lock);	\
192 	}
193 
194 /* FreeObject/FreeToken Enumeration */
195 typedef enum {
196 	FREE_UNCHECKED = 0,	/* Has not been checked */
197 	FREE_DISABLED = 1,	/* No supported provider or key type */
198 	FREE_ALLOWED_KEY = 2,	/* Supported key type */
199 	FREE_ENABLED = 3	/* FreeObject/Token enabled */
200 } freeobject_state_t;
201 
202 
203 /* Generic attribute type, for storing and managing PKCS#11 attributes. */
204 typedef struct _attr {
205 	CK_ATTRIBUTE attribute;
206 
207 	boolean_t isMalloced;
208 
209 	/* attr is necessary for creating a clone of the object */
210 	boolean_t isCloneAttr;
211 
212 	/*
213 	 * depends on the PKCS#11 implementation, this attr might or might
214 	 * not have a value.  It's OK for it to not have a value
215 	 * (ie: the default value is empty)
216 	 */
217 	boolean_t canBeEmptyValue;
218 
219 	boolean_t hasValueForClone;
220 
221 	CK_BBOOL generic_bbool;
222 	CK_ULONG generic_ulong;
223 	CK_BYTE generic_data[INITIAL_ATTR_LEN];
224 } generic_attr_t;
225 
226 /*
227  * These need to be defined here before the actual structures are defined
228  * because they are used in some of the structure definitions.
229  */
230 typedef struct slotobject slot_object_t;
231 typedef struct metasession meta_session_t;
232 typedef struct metaobject meta_object_t;
233 typedef struct metaopstate meta_opstate_t;
234 
235 /*
236  * slot_session_t
237  *
238  * Wrapper for a session on a provider. This structure is only used internally
239  * in metaslot; it is never revealed to applications.
240  */
241 typedef struct slotsession {
242 	CK_ULONG slotnum;
243 	CK_SLOT_ID fw_st_id; /* used for accessing framework's slottable */
244 	CK_SESSION_HANDLE hSession;
245 
246 	boolean_t is_dualop_capable;
247 	CK_FLAGS session_flags;	/* what type of session */
248 
249 	struct slotsession *next;
250 	struct slotsession *prev;
251 
252 	pthread_rwlock_t object_list_lock;
253 	slot_object_t *object_list_head;
254 } slot_session_t;
255 
256 
257 /*
258  * slot_object_t
259  *
260  * Wrapper for an object on a provider. This structure is only used internally
261  * in metaslot; it is never revealed to applications.
262  */
263 struct slotobject {
264 	CK_OBJECT_HANDLE hObject;
265 
266 	struct slotobject *next;
267 	struct slotobject *prev;
268 
269 	slot_session_t *creator_session;
270 
271 	boolean_t isToken;
272 };
273 
274 
275 /*
276  * mechinfo_t
277  *
278  * A mechinfo_t is created for each mechanism on a slot.
279  *
280  * This information is used for selecting which slots support the given
281  * mechanism for a crypto operation.
282  *
283  */
284 typedef struct mechinfo {
285 	CK_ULONG slotnum;
286 
287 	boolean_t initialized;
288 	boolean_t supported;
289 	CK_MECHANISM_INFO mechanism_info;
290 } mechinfo_t;
291 
292 
293 /*
294  * operation_info_t
295  *
296  * Part of a meta_session_t, used to track active operations.
297  */
298 typedef struct opinfo {
299 	CK_FLAGS type;
300 	slot_session_t *session;
301 	mechinfo_t *stats;
302 } operation_info_t;
303 
304 typedef struct find_objs_info {
305 	boolean_t op_active;	/* Indicate whether FindObjects is active */
306 	meta_object_t **matched_objs;
307 	int num_matched_objs;
308 	int next_result_index;	/* index of next object to be returned */
309 } find_objs_info_t;
310 
311 typedef struct mech_support_info {
312 	CK_MECHANISM_TYPE mech;
313 	/* Array of mechinfo_t allocated based on number of slots */
314 	mechinfo_t **supporting_slots;
315 	unsigned long num_supporting_slots;
316 } mech_support_info_t;
317 
318 typedef struct	crypto_init {
319 	CK_FLAGS optype;		/* place holder for init parameters */
320 	struct metasession *session;	/* place holder for init parameters */
321 	CK_MECHANISM *pMech;		/* place holder for init parameters */
322 	struct metaobject *key;		/* place holder for init parameters */
323 	CK_ULONG slotnum;	/* slot where the init operation took place */
324 	boolean_t done;		/* set when the real init is done */
325 	boolean_t app;		/* set when C_xxxInit is called by app */
326 } crypto_init_t;
327 
328 /*
329  * meta_session_t
330  *
331  * The internal state for a meta-session is kept here. The session handles
332  * given to applications are always pointers to a structure of this type.
333  *
334  */
335 struct metasession {
336 	ulong_t magic_marker;
337 	pthread_rwlock_t session_lock;
338 
339 	pthread_mutex_t isClosingSession_lock;
340 	boolean_t isClosingSession;
341 
342 	struct metasession *next;
343 	struct metasession *prev;
344 
345 	CK_FLAGS session_flags;
346 
347 	/*
348 	 * Could have just declared this as "op", but declaring it as
349 	 * op1 so that "op2" can be easily added when dual-op support
350 	 * is implemented in the future
351 	 */
352 	operation_info_t op1;
353 
354 	/*
355 	 * This is for keeping track of which slots support a particular
356 	 * mechanism.  This information doesn't
357 	 * have to be kept on a per session bases, but having the
358 	 * memory pre-allocated per session would make things much simpiler,
359 	 * because memory doesn't need to be allocated/deallocated everytime
360 	 * we do an operation.
361 	 */
362 	mech_support_info_t mech_support_info;
363 
364 
365 	/* Session objects created by this session. */
366 	pthread_rwlock_t object_list_lock;
367 	meta_object_t *object_list_head;
368 
369 	/* C_FindObjects support. */
370 	find_objs_info_t find_objs_info;
371 
372 	/* deferred init to be used by digest, encrypt, decrypt */
373 	crypto_init_t	init;
374 };
375 
376 
377 /*
378  * meta_object_t
379  *
380  * The internal state for a meta-object is kept here. The object handles
381  * given to applications are always pointers to a structure of this type.
382  */
383 struct metaobject {
384 	ulong_t magic_marker;
385 	pthread_rwlock_t object_lock;
386 
387 	pthread_mutex_t isClosingObject_lock;
388 	boolean_t isClosingObject;
389 
390 	struct metaobject *next;
391 	struct metaobject *prev;
392 
393 	meta_session_t *creator_session; /* Only set for session objects */
394 
395 	boolean_t isToken;		/* alias for CKA_TOKEN */
396 	boolean_t isPrivate;		/* alias for CKA_PRIVATE */
397 	boolean_t isSensitive;		/* alias for CKA_SENSITIVE */
398 	boolean_t isExtractable;	/* alias for CKA_EXTRACTABLE */
399 
400 	freeobject_state_t isFreeToken;
401 	freeobject_state_t isFreeObject;
402 
403 	CK_ULONG master_clone_slotnum; /* set when object is created */
404 	slot_object_t **clones;
405 	/* indicate if tried to create clone object in a slot */
406 	boolean_t	*tried_create_clone;
407 
408 	pthread_rwlock_t attribute_lock;
409 	size_t num_attributes;
410 	generic_attr_t *attributes;
411 
412 	pthread_mutex_t clone_create_lock;
413 	size_t clone_template_size;	/* 0 if not yet known. */
414 	CK_ATTRIBUTE *clone_template; /* NULL if not yet known. */
415 };
416 
417 
418 /*
419  * struct metaopstate
420  *
421  * Used as the format for the operation state returned via
422  * C_GetOperationState.
423  */
424 typedef struct opstate_data {
425 	CK_FLAGS	op_type;
426 	CK_ULONG	op_slotnum;
427 	CK_ULONG	op_state_len;
428 	boolean_t	op_init_app;
429 	boolean_t	op_init_done;
430 } opstate_data_t;
431 
432 struct metaopstate {
433 	ulong_t magic_marker;
434 	/*
435 	 * Could have just declared this as "state", but declaring it like this
436 	 * so that when dual-op support is implemented in the future, the
437 	 * changes will be simplier.
438 	 */
439 	struct opstate_data state[1];
440 };
441 
442 
443 /*
444  * session_pool_t
445  *
446  * Used to cache open sessions in a slot.
447  */
448 typedef struct sessionpool {
449 	pthread_mutex_t list_lock;
450 
451 	/* list of sessions that's currently in use */
452 	slot_session_t *active_list_head;
453 
454 	/*
455 	 * list of sessions that are not in use, but can't be deleted because
456 	 * either session/token objects are created using these sessions
457 	 * or we need to have one session left with the provider to maintain
458 	 * the logged in state.  Any of these sessions could be re-used if
459 	 * a session is needed to be established with a provider.
460 	 */
461 	slot_session_t *persist_list_head;
462 
463 	/*
464 	 * List of sessions that are not in use at the moment.  We keep
465 	 * a list of sessions with a particular provider instead of
466 	 * creating a new session everytime for efficiency
467 	 */
468 	slot_session_t *idle_list_head;
469 	boolean_t keep_one_alive;
470 	int num_idle_sessions; /* number of sessions in "idle_list_head" */
471 } session_pool_t;
472 
473 
474 /*
475  * slot_data_t
476  *
477  * Each slot has a session pool, a collection of persistant sessions to
478  * allow for more efficient operation. Specifically, to allow reuse of
479  * previously session objects (which need the creating session to stick
480  * around), as well as being frugal with creating/closing sessions.
481  */
482 typedef struct slotdata {
483 	CK_SLOT_ID fw_st_id; /* framework slot table ID */
484 
485 	session_pool_t session_pool;
486 
487 	pthread_rwlock_t tokenobject_list_lock;
488 	slot_object_t *tokenobject_list_head;
489 } slot_data_t;
490 
491 
492 typedef enum {
493 	ALL_TOKEN = 0,
494 	PUBLIC_TOKEN = 1,
495 	PRIVATE_TOKEN = 2
496 } token_obj_type_t;
497 
498 /*
499  * metaslot_config_t
500  *
501  * This holds the configuration information for meta slot.
502  * It will first be filled with values that users defined
503  * in environment variables.  Any value not defined by the user
504  * will be filled with values from the system wide configuration file.
505  */
506 typedef struct _metaslot_config {
507 	/* token to be used as the keystore for metaslot */
508 	boolean_t keystore_token_specified;
509 	CK_UTF8CHAR keystore_token[TOKEN_LABEL_SIZE + 1];
510 
511 	/* slot to be used as the keystore for metaslot */
512 	boolean_t keystore_slot_specified;
513 	CK_UTF8CHAR keystore_slot[SLOT_DESCRIPTION_SIZE + 1];
514 
515 	/* should meta slot be enabled or not */
516 	boolean_t enabled_specified;
517 	boolean_t enabled;
518 
519 	/* should auto migration of sensitive token objects be enabled or not */
520 	boolean_t auto_key_migrate_specified;
521 	boolean_t auto_key_migrate;
522 } metaslot_config_t;
523 
524 /*
525  * The following 2 structures are used to link the to-be-freed
526  * meta sessions and meta objects into linked lists.
527  * The items on these linked list have not yet been freed via free(); instead
528  * they are added to this list. The actual free will take place when
529  * the number of objects queued reaches MAX_OBJ_TO_BE_FREED or
530  * MAX_SESSION_TO_BE_FREED, at which time the first object in the
531  * list will be freed.
532  */
533 typedef struct obj_to_be_freed_list {
534 	meta_object_t   *first; /* points to first obj in the list */
535 	meta_object_t   *last;  /* points to last obj in the list */
536 	uint32_t	count;  /* current total objs in the list */
537 	pthread_mutex_t	obj_to_be_free_mutex;
538 } object_to_be_freed_list_t;
539 
540 typedef struct ses_to_be_freed_list {
541 	meta_session_t *first; /* points to first session in the list */
542 	meta_session_t *last;  /* points to last session in the list */
543 	uint32_t	count;  /* current total session in the list */
544 	pthread_mutex_t ses_to_be_free_mutex;
545 } ses_to_be_freed_list_t;
546 
547 typedef struct cipher_mechs_threshold {
548 	int		mech_type;
549 	uint32_t	mech_threshold;
550 } cipher_mechs_threshold_t;
551 
552 /* Global variables */
553 extern metaslot_config_t metaslot_config;
554 extern boolean_t metaslot_enabled;
555 extern CK_SLOT_ID metaslot_keystore_slotid;
556 extern boolean_t metaslot_auto_key_migrate;
557 extern struct CK_FUNCTION_LIST metaslot_functionList;
558 extern pthread_mutex_t initmutex;
559 
560 extern ses_to_be_freed_list_t ses_delay_freed;
561 extern object_to_be_freed_list_t obj_delay_freed;
562 extern void (*Tmp_GetThreshold)(void *);
563 
564 extern CK_BBOOL falsevalue;
565 extern CK_BBOOL truevalue;
566 
567 /* --- Prototypes --- */
568 
569 CK_RV meta_slotManager_initialize();
570 void meta_slotManager_finalize();
571 void meta_slotManager_find_object_token();
572 CK_RV meta_get_slot_session(CK_ULONG slotnum, slot_session_t **session,
573     CK_FLAGS flags);
574 void meta_release_slot_session(slot_session_t *session);
575 
576 CK_RV meta_mechManager_initialize();
577 void meta_mechManager_finalize();
578 CK_RV meta_mechManager_get_mechs(CK_MECHANISM_TYPE *list, CK_ULONG *listsize);
579 CK_RV meta_mechManager_get_slots(mech_support_info_t  *mech_support_info,
580     boolean_t force_update, CK_MECHANISM_INFO *mech_info);
581 CK_RV meta_mechManager_slot_supports_mech(CK_MECHANISM_TYPE mechanism,
582     CK_ULONG slotnum, boolean_t *supports, mechinfo_t **slot_info,
583     boolean_t force_update, CK_MECHANISM_INFO *mech_info);
584 
585 CK_RV meta_operation_init(CK_FLAGS optype, meta_session_t *session,
586     CK_MECHANISM *pMechanism, meta_object_t *key);
587 CK_RV meta_operation_init_defer(CK_FLAGS optype, meta_session_t *session,
588     CK_MECHANISM *pMechanism, meta_object_t *key);
589 CK_RV meta_do_operation(CK_FLAGS optype, int mode,
590     meta_session_t *session, meta_object_t *object,
591     CK_BYTE *in, CK_ULONG inLen, CK_BYTE *out, CK_ULONG *outLen);
592 
593 void meta_operation_cleanup(meta_session_t *session, CK_FLAGS optype,
594     boolean_t finished_normally);
595 
596 CK_RV meta_generate_keys(meta_session_t *session, CK_MECHANISM *pMechanism,
597     CK_ATTRIBUTE *k1Template, CK_ULONG k1AttrCount, meta_object_t *key1,
598     CK_ATTRIBUTE *k2Template, CK_ULONG k2AttrCount, meta_object_t *key2);
599 
600 CK_RV meta_wrap_key(meta_session_t *session,
601     CK_MECHANISM *pMechanism, meta_object_t *wrappingkey,
602     meta_object_t *inputkey,
603     CK_BYTE *wrapped_key, CK_ULONG *wrapped_key_len);
604 
605 CK_RV meta_unwrap_key(meta_session_t *session,
606     CK_MECHANISM *pMechanism, meta_object_t *unwrapping_key,
607     CK_BYTE *wrapped_key, CK_ULONG wrapped_key_len,
608     CK_ATTRIBUTE *template, CK_ULONG template_size,
609     meta_object_t *unwrapped_key);
610 
611 CK_RV meta_derive_key(meta_session_t *session, CK_MECHANISM *pMech,
612     meta_object_t *basekey1, meta_object_t *basekey2,
613     CK_OBJECT_HANDLE *phBaseKey2,
614     CK_ATTRIBUTE *pTemplate, CK_ULONG ulAttributeCount,
615     meta_object_t *newKey1, meta_object_t *newKey2,
616     meta_object_t *newKey3, meta_object_t *newKey4);
617 
618 void get_user_metaslot_config();
619 
620 CK_RV meta_sessionManager_initialize();
621 void meta_sessionManager_finalize();
622 CK_RV meta_handle2session(CK_SESSION_HANDLE hSession,
623     meta_session_t **session_p);
624 CK_RV meta_session_alloc(meta_session_t **newSession);
625 CK_RV meta_session_activate(meta_session_t *session);
626 CK_RV meta_session_deactivate(meta_session_t *session,
627     boolean_t have_sessionlist_lock);
628 void meta_session_dealloc(meta_session_t *session);
629 void meta_session_delay_free(meta_session_t *sp);
630 
631 CK_RV meta_objectManager_initialize();
632 void meta_objectManager_finalize();
633 CK_RV meta_handle2object(CK_OBJECT_HANDLE hObject, meta_object_t **object);
634 CK_RV meta_object_alloc(meta_session_t *session, meta_object_t **object);
635 CK_RV meta_object_get_attr(slot_session_t *slot_session,
636     CK_OBJECT_HANDLE hObject, meta_object_t *object);
637 void meta_object_activate(meta_object_t *object);
638 CK_RV meta_object_deactivate(meta_object_t *object, boolean_t have_list_lock,
639     boolean_t have_object_lock);
640 CK_RV meta_object_dealloc(meta_session_t *session, meta_object_t *object,
641     boolean_t nukeSourceObj);
642 CK_RV meta_slot_object_alloc(slot_object_t **object);
643 void meta_slot_object_activate(slot_object_t *object, slot_session_t *session,
644 	boolean_t isToken);
645 void meta_slot_object_deactivate(slot_object_t *object);
646 void meta_slot_object_dealloc(slot_object_t *object);
647 CK_RV meta_object_copyin(meta_object_t *object);
648 CK_RV meta_object_get_clone(meta_object_t *object,
649 	CK_ULONG slot_num, slot_session_t *slot_session,
650 	slot_object_t **clone);
651 meta_object_t *meta_object_find_by_handle(CK_OBJECT_HANDLE hObject,
652 	CK_ULONG slotnum, boolean_t token_only);
653 CK_RV meta_token_object_deactivate(token_obj_type_t token_type);
654 void meta_object_delay_free(meta_object_t *objp);
655 boolean_t meta_freeobject_set(meta_object_t *object, CK_ATTRIBUTE *tmpl,
656     CK_ULONG tmpl_len, boolean_t create);
657 CK_RV meta_freetoken_set(CK_ULONG slot_num, CK_BBOOL *current_value,
658     CK_ATTRIBUTE *tmpl, CK_ULONG tmpl_len);
659 boolean_t meta_freeobject_check(meta_session_t *session, meta_object_t *obj,
660     CK_MECHANISM *pMech, CK_ATTRIBUTE *tmpl, CK_ULONG tmpl_len,
661     CK_KEY_TYPE keytype);
662 boolean_t meta_freeobject_clone(meta_session_t *session, meta_object_t *object);
663 
664 CK_RV get_master_attributes_by_object(slot_session_t *session,
665     slot_object_t *slot_object, generic_attr_t **attributes,
666     size_t *num_attributes);
667 CK_RV get_master_attributes_by_template(
668 	CK_ATTRIBUTE *template, CK_ULONG template_size,
669 	generic_attr_t **attributes, size_t *num_attributes);
670 CK_RV get_master_template_by_type(CK_OBJECT_CLASS class, CK_ULONG subtype,
671 	generic_attr_t **attributes, size_t *num_attributes);
672 CK_RV get_master_attributes_by_type(CK_OBJECT_CLASS class, CK_ULONG subtype,
673 	generic_attr_t **attributes, size_t *num_attributes);
674 CK_RV get_master_attributes_by_duplication(
675 	generic_attr_t *src_attrs, size_t num_src_attrs,
676 	generic_attr_t **dst_attrs, size_t *num_dst_attrs);
677 void dealloc_attributes(generic_attr_t *attributes, size_t num_attributes);
678 CK_RV attribute_set_value(CK_ATTRIBUTE *new_attr,
679 	generic_attr_t *attributes, size_t num_attributes);
680 boolean_t get_template_ulong(CK_ATTRIBUTE_TYPE type, CK_ATTRIBUTE *attributes,
681 	CK_ULONG num_attributes, CK_ULONG *result);
682 boolean_t get_template_boolean(CK_ATTRIBUTE_TYPE type,
683     CK_ATTRIBUTE *attributes, CK_ULONG num_attributes, boolean_t *result);
684 int set_template_boolean(CK_ATTRIBUTE_TYPE type,
685     CK_ATTRIBUTE *attributes, CK_ULONG num_attributes, boolean_t local,
686     CK_BBOOL *value);
687 CK_ULONG get_keystore_slotnum(void);
688 CK_ULONG get_softtoken_slotnum(void);
689 CK_SLOT_ID meta_slotManager_get_framework_table_id(CK_ULONG slotnum);
690 CK_ULONG meta_slotManager_get_slotcount(void);
691 boolean_t meta_slotManager_token_write_protected(void);
692 boolean_t metaslot_logged_in();
693 void metaslot_set_logged_in_flag(boolean_t value);
694 
695 /*
696  * Prototypes for the various meta_Foo implementations of C_Foo.
697  *
698  */
699 CK_RV meta_GetFunctionList(CK_FUNCTION_LIST_PTR_PTR ppFunctionList);
700 CK_RV meta_Initialize(CK_VOID_PTR pInitArgs);
701 CK_RV meta_Finalize(CK_VOID_PTR pReserved);
702 CK_RV meta_GetInfo(CK_INFO_PTR pInfo);
703 CK_RV meta_GetSlotList(CK_BBOOL tokenPresent, CK_SLOT_ID_PTR pSlotList,
704     CK_ULONG_PTR pulCount);
705 CK_RV meta_GetSlotInfo(CK_SLOT_ID slotID, CK_SLOT_INFO_PTR pInfo);
706 CK_RV meta_GetTokenInfo(CK_SLOT_ID slotID, CK_TOKEN_INFO_PTR pInfo);
707 CK_RV meta_GetMechanismList(CK_SLOT_ID slotID,
708     CK_MECHANISM_TYPE_PTR pMechanismList, CK_ULONG_PTR pulCount);
709 CK_RV meta_GetMechanismInfo(CK_SLOT_ID slotID, CK_MECHANISM_TYPE type,
710     CK_MECHANISM_INFO_PTR pInfo);
711 CK_RV meta_InitToken(CK_SLOT_ID slotID, CK_UTF8CHAR_PTR pPin,
712     CK_ULONG ulPinLen, CK_UTF8CHAR_PTR pLabel);
713 CK_RV meta_InitPIN(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pPin,
714     CK_ULONG ulPinLen);
715 CK_RV meta_SetPIN(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pOldPin,
716     CK_ULONG ulOldPinLen, CK_UTF8CHAR_PTR pNewPin, CK_ULONG ulNewPinLen);
717 CK_RV meta_OpenSession(CK_SLOT_ID slotID, CK_FLAGS flags,
718     CK_VOID_PTR pApplication, CK_NOTIFY Notify,
719     CK_SESSION_HANDLE_PTR phSession);
720 CK_RV meta_CloseSession(CK_SESSION_HANDLE hSession);
721 CK_RV meta_CloseAllSessions(CK_SLOT_ID slotID);
722 CK_RV meta_GetSessionInfo(CK_SESSION_HANDLE hSession,
723     CK_SESSION_INFO_PTR pInfo);
724 CK_RV meta_GetOperationState(CK_SESSION_HANDLE hSession,
725     CK_BYTE_PTR pOperationState, CK_ULONG_PTR pulOperationStateLen);
726 CK_RV meta_SetOperationState(CK_SESSION_HANDLE hSession,
727     CK_BYTE_PTR pOperationState, CK_ULONG ulOperationStateLen,
728     CK_OBJECT_HANDLE hEncryptionKey, CK_OBJECT_HANDLE hAuthenticationKey);
729 CK_RV meta_Login(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType,
730     CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen);
731 CK_RV meta_Logout(CK_SESSION_HANDLE hSession);
732 CK_RV meta_CreateObject(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate,
733     CK_ULONG ulCount, CK_OBJECT_HANDLE_PTR phObject);
734 CK_RV meta_CopyObject(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject,
735     CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount,
736     CK_OBJECT_HANDLE_PTR phNewObject);
737 CK_RV meta_DestroyObject(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject);
738 CK_RV meta_GetObjectSize(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject,
739     CK_ULONG_PTR pulSize);
740 CK_RV meta_GetAttributeValue(CK_SESSION_HANDLE hSession,
741     CK_OBJECT_HANDLE hObject, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount);
742 CK_RV meta_SetAttributeValue(CK_SESSION_HANDLE hSession,
743     CK_OBJECT_HANDLE hObject, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount);
744 CK_RV meta_FindObjectsInit(CK_SESSION_HANDLE hSession,
745     CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount);
746 CK_RV meta_FindObjects(CK_SESSION_HANDLE hSession,
747     CK_OBJECT_HANDLE_PTR phObject, CK_ULONG ulMaxObjectCount,
748     CK_ULONG_PTR pulObjectCount);
749 CK_RV meta_FindObjectsFinal(CK_SESSION_HANDLE hSession);
750 CK_RV meta_EncryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
751     CK_OBJECT_HANDLE hKey);
752 CK_RV meta_Encrypt(CK_SESSION_HANDLE hSession,
753     CK_BYTE_PTR pData, CK_ULONG ulDataLen,
754     CK_BYTE_PTR pEncryptedData, CK_ULONG_PTR pulEncryptedDataLen);
755 CK_RV meta_EncryptUpdate(CK_SESSION_HANDLE hSession,
756     CK_BYTE_PTR pPart, CK_ULONG ulPartLen,
757     CK_BYTE_PTR pEncryptedPart, CK_ULONG_PTR pulEncryptedPartLen);
758 CK_RV meta_EncryptFinal(CK_SESSION_HANDLE hSession,
759     CK_BYTE_PTR pLastEncryptedPart, CK_ULONG_PTR pulLastEncryptedPartLen);
760 CK_RV meta_DecryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
761     CK_OBJECT_HANDLE hKey);
762 CK_RV meta_Decrypt(CK_SESSION_HANDLE hSession,
763     CK_BYTE_PTR pEncryptedData, CK_ULONG ulEncryptedDataLen,
764     CK_BYTE_PTR pData, CK_ULONG_PTR pulDataLen);
765 CK_RV meta_DecryptUpdate(CK_SESSION_HANDLE hSession,
766     CK_BYTE_PTR pEncryptedPart, CK_ULONG ulEncryptedPartLen,
767     CK_BYTE_PTR pPart, CK_ULONG_PTR pulPartLen);
768 CK_RV meta_DecryptFinal(CK_SESSION_HANDLE hSession,
769     CK_BYTE_PTR pLastPart, CK_ULONG_PTR pulLastPartLen);
770 CK_RV meta_DigestInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism);
771 CK_RV meta_Digest(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
772     CK_ULONG ulDataLen, CK_BYTE_PTR pDigest, CK_ULONG_PTR pulDigestLen);
773 CK_RV meta_DigestUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
774     CK_ULONG ulPartLen);
775 CK_RV meta_DigestKey(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hKey);
776 CK_RV meta_DigestFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pDigest,
777     CK_ULONG_PTR pulDigestLen);
778 CK_RV meta_SignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
779     CK_OBJECT_HANDLE hKey);
780 CK_RV meta_Sign(CK_SESSION_HANDLE hSession,
781     CK_BYTE_PTR pData, CK_ULONG ulDataLen,
782     CK_BYTE_PTR pSignature, CK_ULONG_PTR pulSignatureLen);
783 CK_RV meta_SignUpdate(CK_SESSION_HANDLE hSession,
784     CK_BYTE_PTR pPart, CK_ULONG ulPartLen);
785 CK_RV meta_SignFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature,
786     CK_ULONG_PTR pulSignatureLen);
787 CK_RV meta_SignRecoverInit(CK_SESSION_HANDLE hSession,
788     CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey);
789 CK_RV meta_SignRecover(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
790     CK_ULONG ulDataLen, CK_BYTE_PTR pSignature, CK_ULONG_PTR pulSignatureLen);
791 CK_RV meta_VerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
792     CK_OBJECT_HANDLE hKey);
793 CK_RV meta_Verify(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
794     CK_ULONG ulDataLen, CK_BYTE_PTR pSignature, CK_ULONG ulSignatureLen);
795 CK_RV meta_VerifyUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
796     CK_ULONG ulPartLen);
797 CK_RV meta_VerifyFinal(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature,
798     CK_ULONG ulSignatureLen);
799 CK_RV meta_VerifyRecoverInit(CK_SESSION_HANDLE hSession,
800     CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey);
801 CK_RV meta_VerifyRecover(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSignature,
802     CK_ULONG ulSignatureLen, CK_BYTE_PTR pData, CK_ULONG_PTR pulDataLen);
803 CK_RV meta_DigestEncryptUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
804     CK_ULONG ulPartLen, CK_BYTE_PTR pEncryptedPart,
805     CK_ULONG_PTR pulEncryptedPartLen);
806 CK_RV meta_DecryptDigestUpdate(CK_SESSION_HANDLE hSession,
807     CK_BYTE_PTR pEncryptedPart, CK_ULONG ulEncryptedPartLen,
808     CK_BYTE_PTR pPart, CK_ULONG_PTR pulPartLen);
809 CK_RV meta_SignEncryptUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
810     CK_ULONG ulPartLen, CK_BYTE_PTR pEncryptedPart,
811     CK_ULONG_PTR pulEncryptedPartLen);
812 CK_RV meta_DecryptVerifyUpdate(CK_SESSION_HANDLE hSession,
813     CK_BYTE_PTR pEncryptedPart, CK_ULONG ulEncryptedPartLen,
814     CK_BYTE_PTR pPart, CK_ULONG_PTR pulPartLen);
815 CK_RV meta_GenerateKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
816     CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, CK_OBJECT_HANDLE_PTR phKey);
817 CK_RV meta_GenerateKeyPair(CK_SESSION_HANDLE hSession,
818     CK_MECHANISM_PTR pMechanism, CK_ATTRIBUTE_PTR pPublicKeyTemplate,
819     CK_ULONG ulPublicKeyAttributeCount, CK_ATTRIBUTE_PTR pPrivateKeyTemplate,
820     CK_ULONG ulPrivateKeyAttributeCount, CK_OBJECT_HANDLE_PTR phPublicKey,
821     CK_OBJECT_HANDLE_PTR phPrivateKey);
822 CK_RV meta_WrapKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
823     CK_OBJECT_HANDLE hWrappingKey, CK_OBJECT_HANDLE hKey,
824     CK_BYTE_PTR pWrappedKey, CK_ULONG_PTR pulWrappedKeyLen);
825 CK_RV meta_UnwrapKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
826     CK_OBJECT_HANDLE hUnwrappingKey, CK_BYTE_PTR pWrappedKey,
827     CK_ULONG ulWrappedKeyLen, CK_ATTRIBUTE_PTR pTemplate,
828     CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey);
829 CK_RV meta_DeriveKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
830     CK_OBJECT_HANDLE hBaseKey, CK_ATTRIBUTE_PTR pTemplate,
831     CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey);
832 CK_RV meta_SeedRandom(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pSeed,
833     CK_ULONG ulSeedLen);
834 CK_RV meta_GenerateRandom(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pRandomData,
835     CK_ULONG ulRandomLen);
836 CK_RV meta_GetFunctionStatus(CK_SESSION_HANDLE hSession);
837 CK_RV meta_CancelFunction(CK_SESSION_HANDLE hSession);
838 CK_RV meta_WaitForSlotEvent(CK_FLAGS flags, CK_SLOT_ID_PTR pSlot,
839     CK_VOID_PTR pReserved);
840 
841 #ifdef	__cplusplus
842 }
843 #endif
844 
845 #endif /* _METAGLOBAL_H */
846