From 3592c8bfb7afdb9224d69dc4267ccd08904fee5b Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sat, 17 Jun 2017 14:34:31 +0200 Subject: pkcs11: simplified pkcs11_login() By cleanups, as well as including the reauth flag in the flags option. That ensures that the function is close to the 3.5.x branch version. Signed-off-by: Nikos Mavrogiannopoulos --- lib/pkcs11.c | 37 +++++++++++++++++++++---------------- lib/pkcs11_int.h | 4 ++-- lib/pkcs11_privkey.c | 12 ++++++------ 3 files changed, 29 insertions(+), 24 deletions(-) diff --git a/lib/pkcs11.c b/lib/pkcs11.c index 429c8601a8..4fdd58f39c 100644 --- a/lib/pkcs11.c +++ b/lib/pkcs11.c @@ -1257,7 +1257,7 @@ pkcs11_open_session(struct pkcs11_session_info *sinfo, ret = pkcs11_login(sinfo, pin_info, info, - flags, 0); + flags); if (ret < 0) { gnutls_assert(); pkcs11_close_session(sinfo); @@ -1337,7 +1337,7 @@ _pkcs11_traverse_tokens(find_func_t find_func, void *input, ret = pkcs11_login(&sinfo, pin_info, - info, flags, 0); + info, flags); if (ret < 0) { gnutls_assert(); return ret; @@ -2415,8 +2415,7 @@ int pkcs11_login(struct pkcs11_session_info *sinfo, struct pin_info_st *pin_info, struct p11_kit_uri *info, - unsigned flags, - unsigned reauth) + unsigned flags) { struct ck_session_info session_info; int attempt = 0, ret; @@ -2428,18 +2427,18 @@ pkcs11_login(struct pkcs11_session_info *sinfo, return 0; } - if (!(flags & SESSION_SO)) { - if (reauth == 0) - user_type = CKU_USER; - else - user_type = CKU_CONTEXT_SPECIFIC; - } else + if (flags & SESSION_SO) { user_type = CKU_SO; + } else if (flags & SESSION_CONTEXT_SPECIFIC) { + user_type = CKU_CONTEXT_SPECIFIC; + } else { + user_type = CKU_USER; + } if (!(flags & (SESSION_FORCE_LOGIN|SESSION_SO)) && !(sinfo->tinfo.flags & CKF_LOGIN_REQUIRED)) { gnutls_assert(); - _gnutls_debug_log("p11: No login required.\n"); + _gnutls_debug_log("p11: No login required in token.\n"); return 0; } @@ -2470,11 +2469,17 @@ pkcs11_login(struct pkcs11_session_info *sinfo, /* Check whether the session is already logged in, and if so, just skip */ rv = (sinfo->module)->C_GetSessionInfo(sinfo->pks, &session_info); - if (rv == CKR_OK && reauth == 0 && - (session_info.state == CKS_RO_USER_FUNCTIONS - || session_info.state == CKS_RW_USER_FUNCTIONS)) { - ret = 0; - goto cleanup; + if (!(flags & SESSION_CONTEXT_SPECIFIC)) { + rv = (sinfo->module)->C_GetSessionInfo(sinfo->pks, + &session_info); + if (rv == CKR_OK && + (session_info.state == CKS_RO_USER_FUNCTIONS + || session_info.state == CKS_RW_USER_FUNCTIONS)) { + ret = 0; + _gnutls_debug_log + ("p11: Already logged in\n"); + goto cleanup; + } } /* If login has been attempted once already, check the token diff --git a/lib/pkcs11_int.h b/lib/pkcs11_int.h index 3d639d2e55..ee44737f6e 100644 --- a/lib/pkcs11_int.h +++ b/lib/pkcs11_int.h @@ -103,8 +103,7 @@ int pkcs11_get_info(struct p11_kit_uri *info, size_t * output_size); int pkcs11_login(struct pkcs11_session_info *sinfo, struct pin_info_st *pin_info, - struct p11_kit_uri *info, unsigned so, - unsigned reauth); + struct p11_kit_uri *info, unsigned flags); int pkcs11_call_token_func(struct p11_kit_uri *info, const unsigned retry); @@ -120,6 +119,7 @@ int pkcs11_info_to_url(struct p11_kit_uri *info, #define SESSION_SO (1<<2) /* security officer session */ #define SESSION_TRUSTED (1<<3) /* session on a marked as trusted (p11-kit) module */ #define SESSION_FORCE_LOGIN (1<<4) /* force login even when CFK_LOGIN_REQUIRED is not set */ +#define SESSION_CONTEXT_SPECIFIC (1<<5) int pkcs11_open_session(struct pkcs11_session_info *sinfo, struct pin_info_st *pin_info, diff --git a/lib/pkcs11_privkey.c b/lib/pkcs11_privkey.c index 5ce6e0ac4e..86c6e9c1ad 100644 --- a/lib/pkcs11_privkey.c +++ b/lib/pkcs11_privkey.c @@ -232,7 +232,7 @@ _gnutls_pkcs11_privkey_sign_hash(gnutls_pkcs11_privkey_t key, unsigned long siglen; struct pkcs11_session_info *sinfo; unsigned req_login = 0; - unsigned login_flags = SESSION_LOGIN; + unsigned login_flags = SESSION_LOGIN|SESSION_CONTEXT_SPECIFIC; PKCS11_CHECK_INIT_PRIVKEY(key); @@ -254,11 +254,11 @@ _gnutls_pkcs11_privkey_sign_hash(gnutls_pkcs11_privkey_t key, retry_login: if (key->reauth || req_login) { if (req_login) - login_flags |= SESSION_FORCE_LOGIN; + login_flags = SESSION_LOGIN|SESSION_FORCE_LOGIN; ret = pkcs11_login(&key->sinfo, &key->pin, - key->uinfo, login_flags, 1-req_login); + key->uinfo, login_flags); if (ret < 0) { gnutls_assert(); _gnutls_debug_log("PKCS #11 login failed, trying operation anyway\n"); @@ -486,7 +486,7 @@ _gnutls_pkcs11_privkey_decrypt_data(gnutls_pkcs11_privkey_t key, struct ck_mechanism mech; unsigned long siglen; unsigned req_login = 0; - unsigned login_flags = SESSION_LOGIN; + unsigned login_flags = SESSION_LOGIN|SESSION_CONTEXT_SPECIFIC; PKCS11_CHECK_INIT_PRIVKEY(key); @@ -509,11 +509,11 @@ _gnutls_pkcs11_privkey_decrypt_data(gnutls_pkcs11_privkey_t key, retry_login: if (key->reauth || req_login) { if (req_login) - login_flags |= SESSION_FORCE_LOGIN; + login_flags = SESSION_LOGIN|SESSION_FORCE_LOGIN; ret = pkcs11_login(&key->sinfo, &key->pin, - key->uinfo, login_flags, 1-req_login); + key->uinfo, login_flags); if (ret < 0) { gnutls_assert(); _gnutls_debug_log("PKCS #11 login failed, trying operation anyway\n"); -- cgit v1.2.1