src/manager/client/client-manager-impl.cpp

   1 /* Copyright (c) 2014-2020 Samsung Electronics Co., Ltd. All rights reserved
   2  *
   3  *  Licensed under the Apache License, Version 2.0 (the "License");
   4  *  you may not use this file except in compliance with the License.
   5  *  You may obtain a copy of the License at
   6  *
   7  *      http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  *  Unless required by applicable law or agreed to in writing, software
  10  *  distributed under the License is distributed on an "AS IS" BASIS,
  11  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  *  See the License for the specific language governing permissions and
  13  *  limitations under the License
  14  *
  15  *
  16  * @file        client-manager-impl.cpp
  17  * @author      Bartlomiej Grzelewski (b.grzelewski@samsung.com)
  18  * @version     1.0
  19  * @brief       Manager implementation.
  20  */
  21 #include <openssl/evp.h>
  22
  23 #include <dpl/serialization.h>
  24 #include <dpl/log/log.h>
  25
  26 #include <client-manager-impl.h>
  27 #include <client-common.h>
  28 #include <exception.h>
  29 #include <message-buffer.h>
  30 #include <protocols.h>
  31 #include <key-impl.h>
  32 #include <key-aes-impl.h>
  33 #include <certificate-impl.h>
  34
  35 namespace CKM {
  36
  37 namespace {
  38 template <class...T>
  39 int deserializeResponse(const int msgId, MessageBuffer &recv, T&&...t)
  40 {
  41         int retMsgId, retCode;
  42         recv.Deserialize(retMsgId, retCode, std::forward<T>(t)...);
  43         return msgId != retMsgId ? CKM_API_ERROR_UNKNOWN : retCode;
  44 }
  45
  46 template <class T>
  47 int getCertChain(
  48         ServiceConnection &serviceConnection,
  49         LogicCommand command,
  50         Manager::Impl &impl,
  51         const CertificateShPtr &certificate,
  52         const T &untrustedVector,
  53         const T &trustedVector,
  54         bool useTrustedSystemCertificates,
  55         CertificateShPtrVector &certificateChainVector)
  56 {
  57         EXCEPTION_GUARD_START_CPPAPI
  58
  59         Manager::Impl::Request rq(impl, command, serviceConnection,
  60                         certificate->getDER(), untrustedVector, trustedVector, useTrustedSystemCertificates);
  61         if (!rq)
  62                 return rq.err();
  63
  64         RawBufferVector rawBufferVector;
  65         int retCode = rq.deserialize(rawBufferVector);
  66
  67         if (retCode != CKM_API_SUCCESS)
  68                 return retCode;
  69
  70         for (auto &e : rawBufferVector) {
  71                 CertificateShPtr cert(new CertificateImpl(e, DataFormat::FORM_DER));
  72
  73                 if (cert->empty())
  74                         return CKM_API_ERROR_BAD_RESPONSE;
  75
  76                 certificateChainVector.push_back(std::move(cert));
  77         }
  78
  79         return retCode;
  80
  81         EXCEPTION_GUARD_END
  82 }
  83
  84 template <class...T>
  85 int doRequest(MessageBuffer &recv, CKM::ServiceConnection &conn, T&&...t)
  86 {
  87         return conn.processRequest(SerializeMessage(std::forward<T>(t)...), recv);
  88 }
  89
  90 } // namespace
  91
  92 Manager::Impl::Impl()
  93         : m_storageConnection(SERVICE_SOCKET_CKM_STORAGE),
  94           m_ocspConnection(SERVICE_SOCKET_OCSP),
  95           m_encryptionConnection(SERVICE_SOCKET_ENCRYPTION)
  96 {
  97 }
  98
  99 template <class Cmd, class...T>
 100 Manager::Impl::Request::Request(Manager::Impl &impl, Cmd cmd, CKM::ServiceConnection &conn, T&&...t)
 101 {
 102         static_assert(sizeof cmd <= sizeof(int));
 103         const auto msgId = m_msgId = ++impl.m_counter;
 104         m_retCode = doRequest(m_recv, conn, static_cast<int>(cmd), msgId, std::forward<T>(t)...);
 105 }
 106
 107 Manager::Impl::Request::operator bool() const {
 108         return CKM_API_SUCCESS == m_retCode;
 109 }
 110
 111 int Manager::Impl::Request::err() const {
 112         assert(!*this);
 113         return m_retCode;
 114 }
 115
 116 template <class...T>
 117 int Manager::Impl::Request::deserialize(T&&...t)
 118 {
 119         assert(*this);
 120         return deserializeResponse(m_msgId, m_recv, std::forward<T>(t)...);
 121 }
 122
 123 template <class...T>
 124 int Manager::Impl::Request::maybeDeserialize(T&&...t)
 125 {
 126         return *this ? deserialize(std::forward<T>(t)...) : err();
 127 }
 128
 129 int Manager::Impl::saveBinaryData(
 130         const Alias &alias,
 131         DataType dataType,
 132         const RawBuffer &rawData,
 133         const Policy &policy)
 134 {
 135         EXCEPTION_GUARD_START_CPPAPI
 136
 137         if (alias.empty() || rawData.empty())
 138                 return CKM_API_ERROR_INPUT_PARAM;
 139
 140         AliasSupport helper(alias);
 141
 142         int opType;
 143         return Request(*this, LogicCommand::SAVE, m_storageConnection,
 144                         dataType, helper.getName(), helper.getOwner(), rawData, PolicySerializable(policy)
 145                 ).maybeDeserialize(opType);
 146
 147         EXCEPTION_GUARD_END
 148 }
 149
 150 int Manager::Impl::saveKey(const Alias &alias, const KeyShPtr &key,
 151                                                    const Policy &policy)
 152 {
 153         if (key.get() == NULL || key->empty())
 154                 return CKM_API_ERROR_INPUT_PARAM;
 155         try {
 156                 return saveBinaryData(alias, DataType(key->getType()), key->getDER(), policy);
 157         } catch (const Exc::Exception &e) {
 158                 LogError("Exception: " << e.what());
 159                 return e.error();
 160         }
 161 }
 162
 163 int Manager::Impl::saveCertificate(
 164         const Alias &alias,
 165         const CertificateShPtr &cert,
 166         const Policy &policy)
 167 {
 168         return cert.get() == NULL || cert->empty()
 169                 ? CKM_API_ERROR_INPUT_PARAM
 170                 : saveBinaryData(alias, DataType::CERTIFICATE, cert->getDER(), policy);
 171 }
 172
 173 int Manager::Impl::saveData(const Alias &alias, const RawBuffer &rawData,
 174                                                         const Policy &policy)
 175 {
 176         return saveBinaryData(alias, DataType::BINARY_DATA, rawData, policy);
 177 }
 178
 179
 180 int Manager::Impl::savePKCS12(
 181         const Alias &alias,
 182         const PKCS12ShPtr &pkcs,
 183         const Policy &keyPolicy,
 184         const Policy &certPolicy)
 185 {
 186         if (alias.empty() || pkcs.get() == NULL)
 187                 return CKM_API_ERROR_INPUT_PARAM;
 188
 189         EXCEPTION_GUARD_START_CPPAPI
 190
 191         AliasSupport helper(alias);
 192
 193         return Request(*this, LogicCommand::SAVE_PKCS12, m_storageConnection,
 194                         helper.getName(), helper.getOwner(), PKCS12Serializable(*pkcs.get()),
 195                         PolicySerializable(keyPolicy), PolicySerializable(certPolicy)
 196                 ).maybeDeserialize();
 197
 198         EXCEPTION_GUARD_END
 199 }
 200
 201 int Manager::Impl::getPKCS12(const Alias &alias, PKCS12ShPtr &pkcs)
 202 {
 203         return getPKCS12(alias, Password(), Password(), pkcs);
 204 }
 205
 206 int Manager::Impl::getPKCS12(const Alias &alias, const Password &keyPass,
 207                                                          const Password &certPass, PKCS12ShPtr &pkcs)
 208 {
 209         if (alias.empty())
 210                 return CKM_API_ERROR_INPUT_PARAM;
 211
 212         EXCEPTION_GUARD_START_CPPAPI
 213
 214         AliasSupport helper(alias);
 215
 216         int msgId = ++m_counter;
 217         MessageBuffer recv;
 218
 219         int retCode = doRequest(recv, m_storageConnection,
 220                         static_cast<int>(LogicCommand::GET_PKCS12), msgId,
 221                         helper.getName(), helper.getOwner(), keyPass, certPass);
 222
 223         if (CKM_API_SUCCESS != retCode)
 224                 return retCode;
 225
 226         int retMsgId;
 227         PKCS12Serializable gotPkcs;
 228         recv.Deserialize(retMsgId, retCode, gotPkcs);
 229
 230         if (retMsgId != msgId)
 231                 return CKM_API_ERROR_UNKNOWN;
 232
 233         pkcs = std::make_shared<PKCS12Impl>(std::move(gotPkcs));
 234
 235         return retCode;
 236
 237         EXCEPTION_GUARD_END
 238 }
 239
 240
 241 int Manager::Impl::removeAlias(const Alias &alias)
 242 {
 243         if (alias.empty())
 244                 return CKM_API_ERROR_INPUT_PARAM;
 245
 246         EXCEPTION_GUARD_START_CPPAPI
 247
 248         AliasSupport helper(alias);
 249
 250         return Request(*this, LogicCommand::REMOVE, m_storageConnection,
 251                         helper.getName(), helper.getOwner()
 252                 ).maybeDeserialize();
 253
 254         EXCEPTION_GUARD_END
 255 }
 256
 257 int Manager::Impl::getBinaryData(
 258         const Alias &alias,
 259         DataType sendDataType,
 260         const Password &password,
 261         DataType &recvDataType,
 262         RawBuffer &rawData)
 263 {
 264         if (alias.empty())
 265                 return CKM_API_ERROR_INPUT_PARAM;
 266
 267         EXCEPTION_GUARD_START_CPPAPI
 268
 269         AliasSupport helper(alias);
 270
 271         return Request(*this, LogicCommand::GET, m_storageConnection,
 272                         sendDataType, helper.getName(), helper.getOwner(), password
 273                 ).maybeDeserialize(recvDataType, rawData);
 274
 275         EXCEPTION_GUARD_END
 276 }
 277
 278 int Manager::Impl::getBinaryDataEncryptionStatus(const DataType sendDataType,
 279                                                 const Alias &alias, bool &status)
 280 {
 281         status = false;
 282         if (alias.empty())
 283                 return CKM_API_ERROR_INPUT_PARAM;
 284
 285         EXCEPTION_GUARD_START_CPPAPI
 286
 287         AliasSupport helper(alias);
 288         DataType tmpDataType;
 289
 290         int retCode = Request(*this, LogicCommand::GET_PROTECTION_STATUS, m_storageConnection,
 291                         sendDataType, helper.getName(), helper.getOwner()
 292                 ).maybeDeserialize(tmpDataType, status);
 293
 294         if (retCode != CKM_API_SUCCESS)
 295                 status = false;
 296
 297         return retCode;
 298
 299         EXCEPTION_GUARD_END
 300 }
 301
 302 int Manager::Impl::getKey(const Alias &alias, const Password &password,
 303                                                   KeyShPtr &key)
 304 {
 305         DataType recvDataType;
 306         RawBuffer rawData;
 307
 308         int retCode = getBinaryData(alias, DataType::KEY_RSA_PUBLIC, password, recvDataType, rawData);
 309
 310         if (retCode != CKM_API_SUCCESS)
 311                 return retCode;
 312
 313         KeyShPtr keyParsed = recvDataType.isSymmetricKey() ? Key::createAES(rawData) : Key::create(rawData);
 314
 315         if (!keyParsed) {
 316                 LogDebug("Key empty - failed to parse!");
 317                 return CKM_API_ERROR_BAD_RESPONSE;
 318         }
 319
 320         key = keyParsed;
 321
 322         return CKM_API_SUCCESS;
 323 }
 324
 325 int Manager::Impl::getCertificate(const Alias &alias, const Password &password,
 326                                                                   CertificateShPtr &cert)
 327 {
 328         DataType recvDataType;
 329         RawBuffer rawData;
 330
 331         int retCode = getBinaryData(alias, DataType::CERTIFICATE, password, recvDataType, rawData);
 332
 333         if (retCode != CKM_API_SUCCESS)
 334                 return retCode;
 335
 336         if (!recvDataType.isCertificate())
 337                 return CKM_API_ERROR_BAD_RESPONSE;
 338
 339         CertificateShPtr certParsed(new CertificateImpl(rawData, DataFormat::FORM_DER));
 340
 341         if (certParsed->empty())
 342                 return CKM_API_ERROR_BAD_RESPONSE;
 343
 344         cert = std::move(certParsed);
 345
 346         return CKM_API_SUCCESS;
 347 }
 348
 349 int Manager::Impl::getData(const Alias &alias, const Password &password,
 350                                                    RawBuffer &rawData)
 351 {
 352         DataType recvDataType = DataType::BINARY_DATA;
 353
 354         int retCode = getBinaryData(alias, DataType::BINARY_DATA, password, recvDataType, rawData);
 355
 356         if (retCode != CKM_API_SUCCESS)
 357                 return retCode;
 358
 359         return recvDataType.isBinaryData() ? CKM_API_SUCCESS : CKM_API_ERROR_BAD_RESPONSE;
 360 }
 361
 362 int Manager::Impl::getBinaryDataAliasVectorHelper(DataType dataType,
 363                 OwnerNameVector &ownerNameVector)
 364 {
 365         DataType tmpDataType;
 366         return Request(*this, LogicCommand::GET_LIST, m_storageConnection,
 367                         dataType
 368                 ).maybeDeserialize(tmpDataType, ownerNameVector);
 369 }
 370
 371 int Manager::Impl::getBinaryDataAliasVector(DataType dataType,
 372                 AliasVector &aliasVector)
 373 {
 374         EXCEPTION_GUARD_START_CPPAPI
 375         OwnerNameVector ownerNameVector;
 376         int retCode = getBinaryDataAliasVectorHelper(dataType, ownerNameVector);
 377
 378         if (retCode != CKM_API_SUCCESS)
 379                 return retCode;
 380
 381         for (const auto &it : ownerNameVector)
 382                 aliasVector.push_back(AliasSupport::merge(it.first, it.second));
 383
 384         return CKM_API_SUCCESS;
 385         EXCEPTION_GUARD_END
 386 }
 387
 388 int Manager::Impl::getBinaryDataAliasInfoVector(DataType dataType,
 389                 AliasInfoVector &aliasInfoVector)
 390 {
 391         EXCEPTION_GUARD_START_CPPAPI
 392         OwnerNameVector ownerNameVector;
 393         OwnerNameEncryptionStatusVector ownerNameEncryptionStatusVector;
 394         int retCode = getBinaryDataAliasVectorHelper(dataType, ownerNameVector);
 395
 396         if (retCode != CKM_API_SUCCESS)
 397                 return retCode;
 398
 399         for (const auto &it : ownerNameVector)
 400         {
 401                 Alias alias = AliasSupport::merge(std::get<0>(it), std::get<1>(it));
 402                 bool status;
 403                 retCode = getBinaryDataEncryptionStatus(dataType, alias, status);
 404
 405                 if (retCode != CKM_API_SUCCESS)
 406                         return retCode;
 407
 408                 // TODO get the actual backend
 409                 aliasInfoVector.push_back(std::make_pair(alias, AliasInfo({status, BackendId::SW})));
 410         }
 411         return CKM_API_SUCCESS;
 412         EXCEPTION_GUARD_END
 413 }
 414
 415 int Manager::Impl::getKeyAliasVector(AliasVector &aliasVector)
 416 {
 417         // in fact datatype has no meaning here - if not certificate or binary data
 418         // then manager decides to list all between DB_KEY_FIRST and DB_KEY_LAST
 419         return getBinaryDataAliasVector(DataType::DB_KEY_LAST, aliasVector);
 420 }
 421
 422 int Manager::Impl::getCertificateAliasVector(AliasVector &aliasVector)
 423 {
 424         return getBinaryDataAliasVector(DataType::CERTIFICATE, aliasVector);
 425 }
 426
 427 int Manager::Impl::getDataAliasVector(AliasVector &aliasVector)
 428 {
 429         return getBinaryDataAliasVector(DataType::BINARY_DATA, aliasVector);
 430 }
 431
 432 int Manager::Impl::getKeyAliasInfoVector(AliasInfoVector &aliasInfoVector)
 433 {
 434         return getBinaryDataAliasInfoVector(DataType::DB_KEY_LAST, aliasInfoVector);
 435 }
 436
 437 int Manager::Impl::getKeyEncryptionStatus(const Alias &alias, bool &status)
 438 {
 439         return getBinaryDataEncryptionStatus(DataType::DB_KEY_LAST, alias, status);
 440 }
 441
 442 int Manager::Impl::getCertificateAliasInfoVector(AliasInfoVector &aliasInfoVector)
 443 {
 444         return getBinaryDataAliasInfoVector(DataType::CERTIFICATE, aliasInfoVector);
 445 }
 446
 447 int Manager::Impl::getCertificateEncryptionStatus(const Alias &alias, bool &status)
 448 {
 449         return getBinaryDataEncryptionStatus(DataType::CERTIFICATE, alias, status);
 450 }
 451
 452 int Manager::Impl::getDataAliasInfoVector(AliasInfoVector &aliasInfoVector)
 453 {
 454         return getBinaryDataAliasInfoVector(DataType::BINARY_DATA, aliasInfoVector);
 455 }
 456
 457 int Manager::Impl::getDataEncryptionStatus(const Alias &alias, bool &status)
 458 {
 459         return getBinaryDataEncryptionStatus(DataType::BINARY_DATA, alias, status);
 460 }
 461
 462 int Manager::Impl::createKeyPairRSA(
 463         const int size,
 464         const Alias &privateKeyAlias,
 465         const Alias &publicKeyAlias,
 466         const Policy &policyPrivateKey,
 467         const Policy &policyPublicKey)
 468 {
 469         return this->createKeyPair(CKM::KeyType::KEY_RSA_PUBLIC, size, privateKeyAlias,
 470                                                            publicKeyAlias, policyPrivateKey, policyPublicKey);
 471 }
 472
 473 int Manager::Impl::createKeyPairDSA(
 474         const int size,
 475         const Alias &privateKeyAlias,
 476         const Alias &publicKeyAlias,
 477         const Policy &policyPrivateKey,
 478         const Policy &policyPublicKey)
 479 {
 480         return this->createKeyPair(CKM::KeyType::KEY_DSA_PUBLIC, size, privateKeyAlias,
 481                                                            publicKeyAlias, policyPrivateKey, policyPublicKey);
 482 }
 483
 484 int Manager::Impl::createKeyPairECDSA(
 485         ElipticCurve type,
 486         const Alias &privateKeyAlias,
 487         const Alias &publicKeyAlias,
 488         const Policy &policyPrivateKey,
 489         const Policy &policyPublicKey)
 490 {
 491         return this->createKeyPair(CKM::KeyType::KEY_ECDSA_PUBLIC,
 492                                                            static_cast<int>(type), privateKeyAlias, publicKeyAlias,
 493                                                            policyPrivateKey, policyPublicKey);
 494 }
 495
 496 int Manager::Impl::createKeyAES(
 497         const int size,
 498         const Alias &keyAlias,
 499         const Policy &policyKey)
 500 {
 501         EXCEPTION_GUARD_START_CPPAPI
 502
 503         AliasSupport aliasHelper(keyAlias);
 504
 505         return Request(*this, LogicCommand::CREATE_KEY_AES, m_storageConnection,
 506                         static_cast<int>(size), PolicySerializable(policyKey),
 507                         aliasHelper.getName(), aliasHelper.getOwner()
 508                 ).maybeDeserialize();
 509
 510         EXCEPTION_GUARD_END
 511 }
 512
 513
 514 int Manager::Impl::createKeyPair(
 515         const KeyType key_type,
 516         const int     additional_param,
 517         const Alias  &privateKeyAlias,
 518         const Alias  &publicKeyAlias,
 519         const Policy &policyPrivateKey,
 520         const Policy &policyPublicKey)
 521 {
 522         // input type check
 523         CryptoAlgorithm keyGenAlgorithm;
 524
 525         switch (key_type) {
 526         case KeyType::KEY_RSA_PUBLIC:
 527         case KeyType::KEY_RSA_PRIVATE:
 528                 keyGenAlgorithm.setParam(ParamName::ALGO_TYPE, AlgoType::RSA_GEN);
 529                 keyGenAlgorithm.setParam(ParamName::GEN_KEY_LEN, additional_param);
 530                 break;
 531
 532         case KeyType::KEY_DSA_PUBLIC:
 533         case KeyType::KEY_DSA_PRIVATE:
 534                 keyGenAlgorithm.setParam(ParamName::ALGO_TYPE, AlgoType::DSA_GEN);
 535                 keyGenAlgorithm.setParam(ParamName::GEN_KEY_LEN, additional_param);
 536                 break;
 537
 538         case KeyType::KEY_ECDSA_PUBLIC:
 539         case KeyType::KEY_ECDSA_PRIVATE:
 540                 keyGenAlgorithm.setParam(ParamName::ALGO_TYPE, AlgoType::ECDSA_GEN);
 541                 keyGenAlgorithm.setParam(ParamName::GEN_EC, additional_param);
 542                 break;
 543
 544         default:
 545                 return CKM_API_ERROR_INPUT_PARAM;
 546         }
 547
 548         EXCEPTION_GUARD_START_CPPAPI
 549
 550         AliasSupport privateHelper(privateKeyAlias);
 551         AliasSupport publicHelper(publicKeyAlias);
 552
 553         return Request(*this, LogicCommand::CREATE_KEY_PAIR, m_storageConnection,
 554                         CryptoAlgorithmSerializable(keyGenAlgorithm),
 555                         PolicySerializable(policyPrivateKey),
 556                         PolicySerializable(policyPublicKey),
 557                         privateHelper.getName(), privateHelper.getOwner(),
 558                         publicHelper.getName(), publicHelper.getOwner()
 559                 ).maybeDeserialize();
 560
 561         EXCEPTION_GUARD_END
 562 }
 563
 564 int Manager::Impl::getCertificateChain(
 565         const CertificateShPtr &certificate,
 566         const CertificateShPtrVector &untrustedCertificates,
 567         const CertificateShPtrVector &trustedCertificates,
 568         bool useTrustedSystemCertificates,
 569         CertificateShPtrVector &certificateChainVector)
 570 {
 571         RawBufferVector untrustedVector;
 572         RawBufferVector trustedVector;
 573
 574         if (!certificate || certificate->empty())
 575                 return CKM_API_ERROR_INPUT_PARAM;
 576
 577         for (auto &e : untrustedCertificates) {
 578                 if (!e || e->empty())
 579                         return CKM_API_ERROR_INPUT_PARAM;
 580                 untrustedVector.push_back(e->getDER());
 581         }
 582
 583         for (auto &e : trustedCertificates) {
 584                 if (!e || e->empty())
 585                         return CKM_API_ERROR_INPUT_PARAM;
 586                 trustedVector.push_back(e->getDER());
 587         }
 588
 589         return getCertChain(m_storageConnection, LogicCommand::GET_CHAIN_CERT, *this,
 590                             certificate, untrustedVector, trustedVector,
 591                             useTrustedSystemCertificates, certificateChainVector);
 592 }
 593
 594 int Manager::Impl::getCertificateChain(
 595         const CertificateShPtr &certificate,
 596         const AliasVector &untrustedCertificates,
 597         const AliasVector &trustedCertificates,
 598         bool useTrustedSystemCertificates,
 599         CertificateShPtrVector &certificateChainVector)
 600 {
 601         OwnerNameVector untrustedVector;
 602         OwnerNameVector trustedVector;
 603
 604         if (!certificate || certificate->empty())
 605                 return CKM_API_ERROR_INPUT_PARAM;
 606
 607         for (auto &e : untrustedCertificates) {
 608                 AliasSupport helper(e);
 609                 untrustedVector.push_back(std::make_pair(helper.getOwner(), helper.getName()));
 610         }
 611
 612         for (auto &e : trustedCertificates) {
 613                 AliasSupport helper(e);
 614                 trustedVector.push_back(std::make_pair(helper.getOwner(), helper.getName()));
 615         }
 616
 617         return getCertChain(m_storageConnection, LogicCommand::GET_CHAIN_ALIAS, *this,
 618                             certificate, untrustedVector, trustedVector,
 619                             useTrustedSystemCertificates, certificateChainVector);
 620 }
 621
 622 int Manager::Impl::createSignature(
 623         const Alias &privateKeyAlias,
 624         const Password &password,           // password for private_key
 625         const RawBuffer &message,
 626         const CryptoAlgorithm &cAlgorithm,
 627         RawBuffer &signature)
 628 {
 629         EXCEPTION_GUARD_START_CPPAPI
 630
 631         AliasSupport helper(privateKeyAlias);
 632
 633         return Request(*this, LogicCommand::CREATE_SIGNATURE, m_storageConnection,
 634                         helper.getName(), helper.getOwner(), password, message,
 635                         CryptoAlgorithmSerializable(cAlgorithm)
 636                 ).maybeDeserialize(signature);
 637
 638         EXCEPTION_GUARD_END
 639 }
 640
 641 int Manager::Impl::verifySignature(
 642         const Alias &publicKeyOrCertAlias,
 643         const Password &password,           // password for public_key (optional)
 644         const RawBuffer &message,
 645         const RawBuffer &signature,
 646         const CryptoAlgorithm &cAlg)
 647 {
 648         EXCEPTION_GUARD_START_CPPAPI
 649
 650         AliasSupport helper(publicKeyOrCertAlias);
 651
 652         return Request(*this, LogicCommand::VERIFY_SIGNATURE, m_storageConnection,
 653                         helper.getName(), helper.getOwner(), password, message, signature,
 654                         CryptoAlgorithmSerializable(cAlg)
 655                 ).maybeDeserialize();
 656
 657         EXCEPTION_GUARD_END
 658 }
 659
 660 int Manager::Impl::ocspCheck(const CertificateShPtrVector &certChain,
 661                                                          int &ocspStatus)
 662 {
 663         EXCEPTION_GUARD_START_CPPAPI
 664
 665         int msgId = ++m_counter;
 666         MessageBuffer recv;
 667
 668         RawBufferVector rawCertChain;
 669
 670         for (auto &e : certChain) {
 671                 if (!e || e->empty()) {
 672                         LogError("Empty certificate");
 673                         return CKM_API_ERROR_INPUT_PARAM;
 674                 }
 675
 676                 rawCertChain.push_back(e->getDER());
 677         }
 678
 679         int retCode = doRequest(recv, m_ocspConnection, msgId, rawCertChain);
 680
 681         if (CKM_API_SUCCESS != retCode)
 682                 return retCode;
 683
 684         return deserializeResponse(msgId, recv, ocspStatus);
 685
 686         EXCEPTION_GUARD_END
 687 }
 688
 689 int Manager::Impl::setPermission(const Alias &alias,
 690                                                                  const ClientId &accessor,
 691                                                                  PermissionMask permissionMask)
 692 {
 693         EXCEPTION_GUARD_START_CPPAPI
 694
 695         AliasSupport helper(alias);
 696
 697         return Request(*this, LogicCommand::SET_PERMISSION, m_storageConnection,
 698                         helper.getName(), helper.getOwner(), accessor, permissionMask
 699                 ).maybeDeserialize();
 700
 701         EXCEPTION_GUARD_END
 702 }
 703
 704 int Manager::Impl::crypt(EncryptionCommand command,
 705                                                  const CryptoAlgorithm &algo,
 706                                                  const Alias &keyAlias,
 707                                                  const Password &password,
 708                                                  const RawBuffer &input,
 709                                                  RawBuffer &output)
 710 {
 711         EXCEPTION_GUARD_START_CPPAPI
 712
 713         AliasSupport helper(keyAlias);
 714         CryptoAlgorithmSerializable cas(algo);
 715
 716         return Request(*this, command, m_encryptionConnection,
 717                         cas, helper.getName(), helper.getOwner(), password, input
 718                 ).maybeDeserialize(output);
 719
 720         EXCEPTION_GUARD_END
 721 }
 722
 723 int Manager::Impl::encrypt(const CryptoAlgorithm &algo,
 724                                                    const Alias &keyAlias,
 725                                                    const Password &password,
 726                                                    const RawBuffer &plain,
 727                                                    RawBuffer &encrypted)
 728 {
 729         return crypt(EncryptionCommand::ENCRYPT, algo, keyAlias, password, plain,
 730                                  encrypted);
 731 }
 732
 733 int Manager::Impl::decrypt(const CryptoAlgorithm &algo,
 734                                                    const Alias &keyAlias,
 735                                                    const Password &password,
 736                                                    const RawBuffer &encrypted,
 737                                                    RawBuffer &decrypted)
 738 {
 739         return crypt(EncryptionCommand::DECRYPT, algo, keyAlias, password, encrypted,
 740                                  decrypted);
 741 }
 742
 743 int Manager::Impl::deriveKey(const CryptoAlgorithm &algo,
 744                                                          const Alias &secretAlias,
 745                                                          const Password &secretPassword,
 746                                                          const Alias &newKeyAlias,
 747                                                          const Policy &newKeyPolicy)
 748 {
 749         EXCEPTION_GUARD_START_CPPAPI
 750
 751         AliasSupport secret(secretAlias);
 752         AliasSupport newKey(newKeyAlias);
 753         CryptoAlgorithmSerializable cas(algo);
 754
 755         return Request(*this, LogicCommand::DERIVE, m_storageConnection,
 756                         cas, secret.getName(), secret.getOwner(), secretPassword,
 757                         newKey.getName(), newKey.getOwner(), PolicySerializable(newKeyPolicy)
 758                 ).maybeDeserialize();
 759
 760         EXCEPTION_GUARD_END
 761 }
 762
 763 int Manager::Impl::importWrappedKey(const CryptoAlgorithm &params,
 764                                                                         const Alias &wrappingKeyAlias,
 765                                                                         const Password &wrappingKeyPassword,
 766                                                                         const Alias &alias,
 767                                                                         const RawBuffer &wrappedKey,
 768                                                                         const KeyType keyType,
 769                                                                         const Policy &policy)
 770 {
 771         EXCEPTION_GUARD_START_CPPAPI
 772
 773         AliasSupport wrapping_helper(wrappingKeyAlias);
 774         AliasSupport helper(alias);
 775
 776         return Request(*this,
 777                 LogicCommand::IMPORT_WRAPPED_KEY,
 778                 m_storageConnection,
 779                 CryptoAlgorithmSerializable(params),
 780                 wrapping_helper.getName(),
 781                 wrapping_helper.getOwner(),
 782                 wrappingKeyPassword,
 783                 helper.getName(),
 784                 helper.getOwner(),
 785                 wrappedKey,
 786                 DataType(keyType),
 787                 PolicySerializable(policy)
 788         ).maybeDeserialize();
 789
 790         EXCEPTION_GUARD_END
 791 }
 792
 793 int Manager::Impl::exportWrappedKey(const CryptoAlgorithm &params,
 794                                                                         const Alias &wrappingKeyAlias,
 795                                                                         const Password &wrappingKeyPassword,
 796                                                                         const Alias &alias,
 797                                                                         const Password &password,
 798                                                                         KeyType &keyType,
 799                                                                         RawBuffer &wrappedKey)
 800 {
 801         EXCEPTION_GUARD_START_CPPAPI
 802
 803         AliasSupport wrapping_helper(wrappingKeyAlias);
 804         AliasSupport helper(alias);
 805         DataType dataTypeKey;
 806
 807         int retCode = Request(*this,
 808                 LogicCommand::EXPORT_WRAPPED_KEY,
 809                 m_storageConnection,
 810                 CryptoAlgorithmSerializable(params),
 811                 wrapping_helper.getName(),
 812                 wrapping_helper.getOwner(),
 813                 wrappingKeyPassword,
 814                 helper.getName(),
 815                 helper.getOwner(),
 816                 password
 817         ).maybeDeserialize(dataTypeKey, wrappedKey);
 818
 819         if (retCode != CKM_API_SUCCESS)
 820                 return retCode;
 821
 822         if (dataTypeKey.isSymmetricKey()) {
 823                 keyType = KeyType::KEY_AES;
 824         } else if (dataTypeKey.isKeyPrivate()) {
 825                 keyType = KeyType::KEY_RSA_PRIVATE;
 826         } else {
 827                 return CKM_API_ERROR_INVALID_FORMAT;
 828         }
 829
 830         return retCode;
 831
 832         EXCEPTION_GUARD_END
 833 }
 834
 835 } // namespace CKM