diff --git a/configure.ac b/configure.ac
index 0840042..c9c9fdc 100644
--- a/configure.ac
+++ b/configure.ac
@@ -447,6 +447,9 @@ if test "$with_p11_kit" != "no"; then
if ! $PKG_CONFIG --atleast-version=0.22.0 p11-kit-1; then
with_buggy_p11_kit=yes
fi
+ if $PKG_CONFIG --atleast-version=0.23.1 p11-kit-1; then
+ AC_DEFINE([P11_KIT_HAS_PIN_VALUE], 1, [p11-kit supports p11_kit_uri_get_pin_value()])
+ fi
else
with_p11_kit=no
AC_MSG_WARN([[
diff --git a/lib/pkcs11.c b/lib/pkcs11.c
index f5cf99d..26d88e5 100644
--- a/lib/pkcs11.c
+++ b/lib/pkcs11.c
@@ -2367,6 +2367,25 @@ retrieve_pin(struct pin_info_st *pin_info, struct p11_kit_uri *info,
*pin = NULL;
+#ifdef P11_KIT_HAS_PIN_VALUE
+ /* First check for pin-value field */
+ pinfile = p11_kit_uri_get_pin_value(info);
+ if (pinfile != NULL) {
+ _gnutls_debug_log("p11: Using pin-value to retrieve PIN\n");
+ *pin = p11_kit_pin_new_for_string(pinfile);
+ if (*pin != NULL)
+ ret = 0;
+ } else { /* try pin-source */
+ /* Check if a pinfile is specified, and use that if possible */
+ pinfile = p11_kit_uri_get_pin_source(info);
+ if (pinfile != NULL) {
+ _gnutls_debug_log("p11: Using pin-source to retrieve PIN\n");
+ ret =
+ retrieve_pin_from_source(pinfile, token_info, attempts,
+ user_type, pin);
+ }
+ }
+#else
/* Check if a pinfile is specified, and use that if possible */
pinfile = p11_kit_uri_get_pinfile(info);
if (pinfile != NULL) {
@@ -2375,6 +2394,7 @@ retrieve_pin(struct pin_info_st *pin_info, struct p11_kit_uri *info,
retrieve_pin_from_source(pinfile, token_info, attempts,
user_type, pin);
}
+#endif
/* The global gnutls pin callback */
if (ret < 0)
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 5b60899..20ed79c 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -36,7 +36,7 @@ EXTRA_DIST = suppressions.valgrind eagain-common.h test-chains.h \
certs/cert-rsa-2432.pem certs/ecc384.pem certs/ecc.pem \
certs/ca-ecc.pem certs/cert-ecc384.pem certs/cert-ecc.pem certs/ecc256.pem \
certs/ecc521.pem certs/rsa-2432.pem x509cert-dir/ca.pem \
- cert-common.h pkcs11/softhsm.h
+ cert-common.h pkcs11/softhsm.h pkcs11/pkcs11-pubkey-import.c
AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS)
AM_CPPFLAGS = \
@@ -113,7 +113,8 @@ pkcs11_import_url_privkey_LDADD = $(LDADD) $(LIBDL)
ctests += pkcs11-cert-import-url-exts pkcs11-get-exts pkcs11-get-raw-issuer-exts \
pkcs11/pkcs11-chainverify pkcs11/pkcs11-get-issuer pkcs11/pkcs11-is-known \
- pkcs11/pkcs11-combo pkcs11-import-url-privkey
+ pkcs11/pkcs11-combo pkcs11-import-url-privkey pkcs11/pkcs11-pubkey-import-rsa \
+ pkcs11/pkcs11-import-with-pin
endif
endif
diff --git a/tests/pkcs11/pkcs11-import-with-pin.c b/tests/pkcs11/pkcs11-import-with-pin.c
new file mode 100644
index 0000000..e435919
--- /dev/null
+++ b/tests/pkcs11/pkcs11-import-with-pin.c
@@ -0,0 +1,198 @@
+/*
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+#include <unistd.h>
+
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+#include <gnutls/abstract.h>
+
+#include "../utils.h"
+#include "softhsm.h"
+
+/* Tests whether a protected object is imported with PIN obtained using
+ * pin-value or pin-source. */
+
+#define CONFIG_NAME "softhsm-import-with-pin"
+#define CONFIG CONFIG_NAME".config"
+
+#include "../cert-common.h"
+
+#define PIN "1234"
+
+static const gnutls_datum_t testdata = {(void*)"test test", 9};
+
+static void tls_log_func(int level, const char *str)
+{
+ fprintf(stderr, "|<%d>| %s", level, str);
+}
+
+static
+int pin_func(void* userdata, int attempt, const char* url, const char *label,
+ unsigned flags, char *pin, size_t pin_max)
+{
+ if (attempt == 0) {
+ strcpy(pin, PIN);
+ return 0;
+ }
+ return -1;
+}
+
+static void write_pin(const char *file, const char *pin)
+{
+ FILE *fp = fopen(file, "w");
+ assert(fp != NULL);
+ fputs(pin, fp);
+ fclose(fp);
+}
+
+void doit()
+{
+ char buf[512];
+ int ret, pk;
+ const char *lib, *bin;
+ gnutls_x509_privkey_t key;
+ gnutls_datum_t tmp, sig;
+ gnutls_privkey_t pkey;
+ char file[TMPNAME_SIZE];
+
+#ifndef P11_KIT_HAS_PIN_VALUE
+ exit(77);
+#endif
+
+ bin = softhsm_bin();
+
+ lib = softhsm_lib();
+
+ ret = global_init();
+ if (ret != 0) {
+ fail("%d: %s\n", ret, gnutls_strerror(ret));
+ exit(1);
+ }
+
+ gnutls_pkcs11_set_pin_function(pin_func, NULL);
+ gnutls_global_set_log_function(tls_log_func);
+ if (debug)
+ gnutls_global_set_log_level(4711);
+
+ set_softhsm_conf(CONFIG);
+ snprintf(buf, sizeof(buf), "%s --init-token --slot 0 --label test --so-pin "PIN" --pin "PIN, bin);
+ system(buf);
+
+ ret = gnutls_pkcs11_add_provider(lib, "trusted");
+ if (ret < 0) {
+ fprintf(stderr, "add_provider: %s\n",
+ gnutls_strerror(ret));
+ exit(1);
+ }
+
+ ret = gnutls_x509_privkey_init(&key);
+ if (ret < 0) {
+ fprintf(stderr,
+ "gnutls_x509_privkey_init: %s\n",
+ gnutls_strerror(ret));
+ exit(1);
+ }
+
+ ret =
+ gnutls_x509_privkey_import(key, &server_key,
+ GNUTLS_X509_FMT_PEM);
+ if (ret < 0) {
+ fprintf(stderr,
+ "gnutls_x509_privkey_import: %s\n",
+ gnutls_strerror(ret));
+ exit(1);
+ }
+
+ /* initialize softhsm token */
+ ret = gnutls_pkcs11_token_init(SOFTHSM_URL, PIN, "test");
+ if (ret < 0) {
+ fail("gnutls_pkcs11_token_init: %s\n", gnutls_strerror(ret));
+ exit(1);
+ }
+
+ ret = gnutls_pkcs11_token_set_pin(SOFTHSM_URL, NULL, PIN, GNUTLS_PIN_USER);
+ if (ret < 0) {
+ fail("gnutls_pkcs11_token_set_pin: %s\n", gnutls_strerror(ret));
+ exit(1);
+ }
+
+ ret = gnutls_pkcs11_copy_x509_privkey(SOFTHSM_URL, key, "cert", GNUTLS_KEY_DIGITAL_SIGNATURE|GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE|GNUTLS_PKCS11_OBJ_FLAG_MARK_SENSITIVE|GNUTLS_PKCS11_OBJ_FLAG_LOGIN);
+ if (ret < 0) {
+ fail("gnutls_pkcs11_copy_x509_privkey: %s\n", gnutls_strerror(ret));
+ exit(1);
+ }
+
+ gnutls_x509_privkey_deinit(key);
+ gnutls_pkcs11_set_pin_function(NULL, NULL);
+
+ assert(gnutls_privkey_init(&pkey) == 0);
+
+ /* Test 1
+ * Try importing with pin-value */
+ ret = gnutls_privkey_import_pkcs11_url(pkey, SOFTHSM_URL";object=cert;object-type=private;pin-value="PIN);
+ if (ret < 0) {
+ fprintf(stderr, "error in %d: %s\n", __LINE__, gnutls_strerror(ret));
+ exit(1);
+ }
+
+ /* check whether privkey is operational by signing */
+ assert(gnutls_privkey_sign_data(pkey, GNUTLS_DIG_SHA256, 0, &testdata, &sig) == 0);
+ gnutls_free(sig.data);
+ gnutls_privkey_deinit(pkey);
+
+ /* Test 2
+ * Try importing with pin-source */
+ track_temp_files();
+ get_tmpname(file);
+
+ write_pin(file, PIN);
+
+
+ assert(gnutls_privkey_init(&pkey) == 0);
+ snprintf(buf, sizeof(buf), "%s;object=cert;object-type=private;pin-source=%s", SOFTHSM_URL, file);
+ ret = gnutls_privkey_import_pkcs11_url(pkey, buf);
+ if (ret < 0) {
+ fprintf(stderr, "error in %d: %s\n", __LINE__, gnutls_strerror(ret));
+ exit(1);
+ }
+
+ /* check whether privkey is operational by signing */
+ assert(gnutls_privkey_sign_data(pkey, GNUTLS_DIG_SHA256, 0, &testdata, &sig) == 0);
+ gnutls_free(sig.data);
+ gnutls_privkey_deinit(pkey);
+
+ gnutls_global_deinit();
+ delete_temp_files();
+
+ remove(CONFIG);
+}
+
diff --git a/tests/pkcs11/pkcs11-pubkey-import-rsa.c b/tests/pkcs11/pkcs11-pubkey-import-rsa.c
new file mode 100644
index 0000000..d304c4f
--- /dev/null
+++ b/tests/pkcs11/pkcs11-pubkey-import-rsa.c
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2015 Nikos Mavrogiannopoulos
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define CONFIG_NAME "softhsm-pubkey-import-rsa"
+#define CONFIG CONFIG_NAME".config"
+
+#include "pkcs11-pubkey-import.c"
+
+void doit(void)
+{
+ success("Testing RSA key\n");
+ try(1);
+}
diff --git a/tests/pkcs11/pkcs11-pubkey-import.c b/tests/pkcs11/pkcs11-pubkey-import.c
new file mode 100644
index 0000000..7513aad
--- /dev/null
+++ b/tests/pkcs11/pkcs11-pubkey-import.c
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) 2015 Nikos Mavrogiannopoulos
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+#include <unistd.h>
+
+#include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
+#include <gnutls/abstract.h>
+
+#include "../utils.h"
+#include "softhsm.h"
+
+/* Tests whether gnutls_pubkey_import_privkey works well for
+ * RSA keys under PKCS #11 */
+
+
+#include "../cert-common.h"
+
+#define PIN "1234"
+
+static const gnutls_datum_t testdata = {(void*)"test test", 9};
+
+static void tls_log_func(int level, const char *str)
+{
+ fprintf(stderr, "|<%d>| %s", level, str);
+}
+
+static
+int pin_func(void* userdata, int attempt, const char* url, const char *label,
+ unsigned flags, char *pin, size_t pin_max)
+{
+ if (attempt == 0) {
+ strcpy(pin, PIN);
+ return 0;
+ }
+ return -1;
+}
+
+static void try(int rsa)
+{
+ char buf[128];
+ int ret, pk;
+ const char *lib, *bin;
+ gnutls_x509_crt_t crt;
+ gnutls_x509_privkey_t key;
+ gnutls_datum_t tmp, sig;
+ gnutls_privkey_t pkey;
+ gnutls_pubkey_t pubkey;
+ gnutls_pubkey_t pubkey2;
+
+#ifndef P11_KIT_HAS_PIN_VALUE
+ exit(77);
+#endif
+
+ bin = softhsm_bin();
+
+ lib = softhsm_lib();
+
+ ret = global_init();
+ if (ret != 0) {
+ fail("%d: %s\n", ret, gnutls_strerror(ret));
+ exit(1);
+ }
+
+ gnutls_pkcs11_set_pin_function(pin_func, NULL);
+ gnutls_global_set_log_function(tls_log_func);
+ if (debug)
+ gnutls_global_set_log_level(4711);
+
+ set_softhsm_conf(CONFIG);
+ snprintf(buf, sizeof(buf), "%s --init-token --slot 0 --label test --so-pin "PIN" --pin "PIN, bin);
+ system(buf);
+
+ ret = gnutls_pkcs11_add_provider(lib, "trusted");
+ if (ret < 0) {
+ fprintf(stderr, "gnutls_x509_crt_init: %s\n",
+ gnutls_strerror(ret));
+ exit(1);
+ }
+
+ ret = gnutls_x509_crt_init(&crt);
+ if (ret < 0) {
+ fprintf(stderr,
+ "gnutls_x509_crt_init: %s\n",
+ gnutls_strerror(ret));
+ exit(1);
+ }
+
+ ret =
+ gnutls_x509_crt_import(crt, rsa?&server_cert:&server_ecc_cert,
+ GNUTLS_X509_FMT_PEM);
+ if (ret < 0) {
+ fprintf(stderr,
+ "gnutls_x509_crt_import: %s\n",
+ gnutls_strerror(ret));
+ exit(1);
+ }
+
+ if (debug) {
+ gnutls_x509_crt_print(crt,
+ GNUTLS_CRT_PRINT_ONELINE,
+ &tmp);
+
+ printf("\tCertificate: %.*s\n",
+ tmp.size, tmp.data);
+ gnutls_free(tmp.data);
+ }
+
+ ret = gnutls_x509_privkey_init(&key);
+ if (ret < 0) {
+ fprintf(stderr,
+ "gnutls_x509_privkey_init: %s\n",
+ gnutls_strerror(ret));
+ exit(1);
+ }
+
+ ret =
+ gnutls_x509_privkey_import(key, rsa?&server_key:&server_ecc_key,
+ GNUTLS_X509_FMT_PEM);
+ if (ret < 0) {
+ fprintf(stderr,
+ "gnutls_x509_privkey_import: %s\n",
+ gnutls_strerror(ret));
+ exit(1);
+ }
+
+ /* initialize softhsm token */
+ ret = gnutls_pkcs11_token_init(SOFTHSM_URL, PIN, "test");
+ if (ret < 0) {
+ fail("gnutls_pkcs11_token_init: %s\n", gnutls_strerror(ret));
+ exit(1);
+ }
+
+ ret = gnutls_pkcs11_token_set_pin(SOFTHSM_URL, NULL, PIN, GNUTLS_PIN_USER);
+ if (ret < 0) {
+ fail("gnutls_pkcs11_token_set_pin: %s\n", gnutls_strerror(ret));
+ exit(1);
+ }
+
+ ret = gnutls_pkcs11_copy_x509_crt(SOFTHSM_URL, crt, "cert",
+ GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE|GNUTLS_PKCS11_OBJ_FLAG_LOGIN);
+ if (ret < 0) {
+ fail("gnutls_pkcs11_copy_x509_crt: %s\n", gnutls_strerror(ret));
+ exit(1);
+ }
+
+ ret = gnutls_pkcs11_copy_x509_privkey(SOFTHSM_URL, key, "cert", GNUTLS_KEY_DIGITAL_SIGNATURE|GNUTLS_KEY_KEY_ENCIPHERMENT,
+ GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE|GNUTLS_PKCS11_OBJ_FLAG_MARK_SENSITIVE|GNUTLS_PKCS11_OBJ_FLAG_LOGIN);
+ if (ret < 0) {
+ fail("gnutls_pkcs11_copy_x509_privkey: %s\n", gnutls_strerror(ret));
+ exit(1);
+ }
+
+ gnutls_x509_crt_deinit(crt);
+ gnutls_x509_privkey_deinit(key);
+ gnutls_pkcs11_set_pin_function(NULL, NULL);
+
+ assert(gnutls_privkey_init(&pkey) == 0);
+
+ ret = gnutls_privkey_import_pkcs11_url(pkey, SOFTHSM_URL";object=cert;object-type=private;pin-value="PIN);
+ if (ret < 0) {
+ fprintf(stderr, "error in %d: %s\n", __LINE__, gnutls_strerror(ret));
+ exit(1);
+ }
+
+ assert(gnutls_pubkey_init(&pubkey) == 0);
+ assert(gnutls_pubkey_import_privkey(pubkey, pkey, 0, 0) == 0);
+
+ pk = gnutls_pubkey_get_pk_algorithm(pubkey, NULL);
+
+ /* check whether privkey and pubkey are operational
+ * by signing and verifying */
+ assert(gnutls_privkey_sign_data(pkey, GNUTLS_DIG_SHA256, 0, &testdata, &sig) == 0);
+
+ /* verify against the raw pubkey */
+ assert(gnutls_pubkey_init(&pubkey2) == 0);
+ assert(gnutls_pubkey_import_x509_raw(pubkey2, rsa?&server_cert:&server_ecc_cert, GNUTLS_X509_FMT_PEM, 0) == 0);
+ assert(gnutls_pubkey_verify_data2(pubkey2, gnutls_pk_to_sign(pk, GNUTLS_DIG_SHA256), 0, &testdata, &sig) >= 0);
+
+ /* verify against the pubkey in PKCS #11 */
+ assert(gnutls_pubkey_verify_data2(pubkey, gnutls_pk_to_sign(pk, GNUTLS_DIG_SHA256), 0, &testdata, &sig) >= 0);
+
+ gnutls_free(sig.data);
+
+ gnutls_pubkey_deinit(pubkey2);
+ gnutls_pubkey_deinit(pubkey);
+ gnutls_privkey_deinit(pkey);
+
+ gnutls_global_deinit();
+
+ remove(CONFIG);
+}
+
diff --git a/tests/utils.c b/tests/utils.c
index 65ceafd..37345a6 100644
--- a/tests/utils.c
+++ b/tests/utils.c
@@ -30,6 +30,7 @@
#include <time.h>
#include <unistd.h>
#include <errno.h>
+#include <assert.h>
#ifndef _WIN32
# include <netinet/in.h>
# include <sys/socket.h>
@@ -39,6 +40,8 @@
# include <winbase.h>
#endif
#endif
+#include <gnutls/gnutls.h>
+#include <gnutls/crypto.h>
#include "utils.h"
@@ -183,3 +186,74 @@ int main(int argc, char *argv[])
return error_count ? 1 : 0;
}
+
+struct tmp_file_st {
+ char file[TMPNAME_SIZE];
+ struct tmp_file_st *next;
+};
+
+static struct tmp_file_st *temp_files = (void*)-1;
+
+static void append(const char *file)
+{
+ struct tmp_file_st *p;
+
+ if (temp_files == (void*)-1)
+ return;
+
+ p = calloc(1, sizeof(*p));
+
+ assert(p != NULL);
+ strcpy(p->file, file);
+ p->next = temp_files;
+ temp_files = p;
+}
+
+char *get_tmpname(char s[TMPNAME_SIZE])
+{
+ unsigned char rnd[6];
+ static char _s[TMPNAME_SIZE];
+ int ret;
+ char *p;
+ const char *path;
+
+ ret = gnutls_rnd(GNUTLS_RND_NONCE, rnd, sizeof(rnd));
+ if (ret < 0)
+ return NULL;
+
+ path = getenv("builddir");
+ if (path == NULL)
+ path = ".";
+
+ if (s == NULL)
+ p = _s;
+ else
+ p = s;
+
+ snprintf(p, TMPNAME_SIZE, "%s/tmpfile-%02x%02x%02x%02x%02x%02x.tmp", path, (unsigned)rnd[0], (unsigned)rnd[1],
+ (unsigned)rnd[2], (unsigned)rnd[3], (unsigned)rnd[4], (unsigned)rnd[5]);
+
+ append(p);
+
+ return p;
+}
+
+void track_temp_files(void)
+{
+ temp_files = NULL;
+}
+
+void delete_temp_files(void)
+{
+ struct tmp_file_st *p = temp_files;
+ struct tmp_file_st *next;
+
+ if (p == (void*)-1)
+ return;
+
+ while(p != NULL) {
+ next = p->next;
+ free(p);
+ p = next;
+ }
+}
diff --git a/tests/utils.h b/tests/utils.h
index 8f3ac3f..5c0afe7 100644
--- a/tests/utils.h
+++ b/tests/utils.h
@@ -61,4 +61,9 @@ extern void binprint(const void *str, size_t len);
extern void doit(void);
void sec_sleep(int sec);
+#define TMPNAME_SIZE 128
+char *get_tmpname(char s[TMPNAME_SIZE]);
+void track_temp_files(void);
+void delete_temp_files(void);
+
#endif /* UTILS_H */