src/manager/client/client-manager-impl.cpp

   1 /* Copyright (c) 2014-2020 Samsung Electronics Co., Ltd. All rights reserved
   2  *
   3  *  Licensed under the Apache License, Version 2.0 (the "License");
   4  *  you may not use this file except in compliance with the License.
   5  *  You may obtain a copy of the License at
   6  *
   7  *      http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  *  Unless required by applicable law or agreed to in writing, software
  10  *  distributed under the License is distributed on an "AS IS" BASIS,
  11  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  *  See the License for the specific language governing permissions and
  13  *  limitations under the License
  14  *
  15  *
  16  * @file        client-manager-impl.cpp
  17  * @author      Bartlomiej Grzelewski (b.grzelewski@samsung.com)
  18  * @version     1.0
  19  * @brief       Manager implementation.
  20  */
  21 #include <openssl/evp.h>
  22
  23 #include <dpl/serialization.h>
  24 #include <dpl/log/log.h>
  25
  26 #include <client-manager-impl.h>
  27 #include <client-common.h>
  28 #include <exception.h>
  29 #include <message-buffer.h>
  30 #include <protocols.h>
  31 #include <key-impl.h>
  32 #include <key-aes-impl.h>
  33 #include <certificate-impl.h>
  34
  35 namespace CKM {
  36
  37 namespace {
  38 template <class...T>
  39 int deserializeResponse(const int msgId, MessageBuffer &recv, T&&...t)
  40 {
  41         int retMsgId, retCode;
  42         recv.Deserialize(retMsgId, retCode, std::forward<T>(t)...);
  43         return msgId != retMsgId ? CKM_API_ERROR_UNKNOWN : retCode;
  44 }
  45
  46 template <class T>
  47 int getCertChain(
  48         ServiceConnection &serviceConnection,
  49         LogicCommand command,
  50         Manager::Impl &impl,
  51         const CertificateShPtr &certificate,
  52         const T &untrustedVector,
  53         const T &trustedVector,
  54         bool useTrustedSystemCertificates,
  55         CertificateShPtrVector &certificateChainVector)
  56 {
  57         EXCEPTION_GUARD_START_CPPAPI
  58
  59         Manager::Impl::Request rq(impl, command, serviceConnection,
  60                         certificate->getDER(), untrustedVector, trustedVector, useTrustedSystemCertificates);
  61         if (!rq)
  62                 return rq.err();
  63
  64         RawBufferVector rawBufferVector;
  65         int retCode = rq.deserialize(rawBufferVector);
  66
  67         if (retCode != CKM_API_SUCCESS)
  68                 return retCode;
  69
  70         for (auto &e : rawBufferVector) {
  71                 CertificateShPtr cert(new CertificateImpl(e, DataFormat::FORM_DER));
  72
  73                 if (cert->empty())
  74                         return CKM_API_ERROR_BAD_RESPONSE;
  75
  76                 certificateChainVector.push_back(std::move(cert));
  77         }
  78
  79         return retCode;
  80
  81         EXCEPTION_GUARD_END
  82 }
  83
  84 template <class...T>
  85 int doRequest(MessageBuffer &recv, CKM::ServiceConnection &conn, T&&...t)
  86 {
  87         return conn.processRequest(SerializeMessage(std::forward<T>(t)...), recv);
  88 }
  89
  90 } // namespace
  91
  92 Manager::Impl::Impl()
  93         : m_storageConnection(SERVICE_SOCKET_CKM_STORAGE),
  94           m_ocspConnection(SERVICE_SOCKET_OCSP),
  95           m_encryptionConnection(SERVICE_SOCKET_ENCRYPTION)
  96 {
  97 }
  98
  99 template <class Cmd, class...T>
 100 Manager::Impl::Request::Request(Manager::Impl &impl, Cmd cmd, CKM::ServiceConnection &conn, T&&...t)
 101 {
 102         static_assert(sizeof cmd <= sizeof(int));
 103         const auto msgId = m_msgId = ++impl.m_counter;
 104         m_retCode = doRequest(m_recv, conn, static_cast<int>(cmd), msgId, std::forward<T>(t)...);
 105 }
 106
 107 Manager::Impl::Request::operator bool() const {
 108         return CKM_API_SUCCESS == m_retCode;
 109 }
 110
 111 int Manager::Impl::Request::err() const {
 112         assert(!*this);
 113         return m_retCode;
 114 }
 115
 116 template <class...T>
 117 int Manager::Impl::Request::deserialize(T&&...t)
 118 {
 119         assert(*this);
 120         return deserializeResponse(m_msgId, m_recv, std::forward<T>(t)...);
 121 }
 122
 123 template <class...T>
 124 int Manager::Impl::Request::maybeDeserialize(T&&...t)
 125 {
 126         return *this ? deserialize(std::forward<T>(t)...) : err();
 127 }
 128
 129 int Manager::Impl::saveBinaryData(
 130         const Alias &alias,
 131         DataType dataType,
 132         const RawBuffer &rawData,
 133         const Policy &policy)
 134 {
 135         EXCEPTION_GUARD_START_CPPAPI
 136
 137         if (alias.empty() || rawData.empty())
 138                 return CKM_API_ERROR_INPUT_PARAM;
 139
 140         AliasSupport helper(alias);
 141
 142         int opType;
 143         return Request(*this, LogicCommand::SAVE, m_storageConnection,
 144                         dataType, helper.getName(), helper.getOwner(), rawData, PolicySerializable(policy)
 145                 ).maybeDeserialize(opType);
 146
 147         EXCEPTION_GUARD_END
 148 }
 149
 150 int Manager::Impl::saveKey(const Alias &alias, const KeyShPtr &key,
 151                                                    const Policy &policy)
 152 {
 153         if (key.get() == NULL || key->empty())
 154                 return CKM_API_ERROR_INPUT_PARAM;
 155         try {
 156                 return saveBinaryData(alias, DataType(key->getType()), key->getDER(), policy);
 157         } catch (const Exc::Exception &e) {
 158                 LogError("Exception: " << e.what());
 159                 return e.error();
 160         }
 161 }
 162
 163 int Manager::Impl::saveCertificate(
 164         const Alias &alias,
 165         const CertificateShPtr &cert,
 166         const Policy &policy)
 167 {
 168         return cert.get() == NULL || cert->empty()
 169                 ? CKM_API_ERROR_INPUT_PARAM
 170                 : saveBinaryData(alias, DataType::CERTIFICATE, cert->getDER(), policy);
 171 }
 172
 173 int Manager::Impl::saveData(const Alias &alias, const RawBuffer &rawData,
 174                                                         const Policy &policy)
 175 {
 176         return saveBinaryData(alias, DataType::BINARY_DATA, rawData, policy);
 177 }
 178
 179
 180 int Manager::Impl::savePKCS12(
 181         const Alias &alias,
 182         const PKCS12ShPtr &pkcs,
 183         const Policy &keyPolicy,
 184         const Policy &certPolicy)
 185 {
 186         if (alias.empty() || pkcs.get() == NULL)
 187                 return CKM_API_ERROR_INPUT_PARAM;
 188
 189         EXCEPTION_GUARD_START_CPPAPI
 190
 191         AliasSupport helper(alias);
 192
 193         return Request(*this, LogicCommand::SAVE_PKCS12, m_storageConnection,
 194                         helper.getName(), helper.getOwner(), PKCS12Serializable(*pkcs.get()),
 195                         PolicySerializable(keyPolicy), PolicySerializable(certPolicy)
 196                 ).maybeDeserialize();
 197
 198         EXCEPTION_GUARD_END
 199 }
 200
 201 int Manager::Impl::getPKCS12(const Alias &alias, PKCS12ShPtr &pkcs)
 202 {
 203         return getPKCS12(alias, Password(), Password(), pkcs);
 204 }
 205
 206 int Manager::Impl::getPKCS12(const Alias &alias, const Password &keyPass,
 207                                                          const Password &certPass, PKCS12ShPtr &pkcs)
 208 {
 209         if (alias.empty())
 210                 return CKM_API_ERROR_INPUT_PARAM;
 211
 212         EXCEPTION_GUARD_START_CPPAPI
 213
 214         AliasSupport helper(alias);
 215
 216         int msgId = ++m_counter;
 217         MessageBuffer recv;
 218
 219         int retCode = doRequest(recv, m_storageConnection,
 220                         static_cast<int>(LogicCommand::GET_PKCS12), msgId,
 221                         helper.getName(), helper.getOwner(), keyPass, certPass);
 222
 223         if (CKM_API_SUCCESS != retCode)
 224                 return retCode;
 225
 226         int retMsgId;
 227         PKCS12Serializable gotPkcs;
 228         recv.Deserialize(retMsgId, retCode, gotPkcs);
 229
 230         if (retMsgId != msgId)
 231                 return CKM_API_ERROR_UNKNOWN;
 232
 233         pkcs = std::make_shared<PKCS12Impl>(std::move(gotPkcs));
 234
 235         return retCode;
 236
 237         EXCEPTION_GUARD_END
 238 }
 239
 240
 241 int Manager::Impl::removeAlias(const Alias &alias)
 242 {
 243         if (alias.empty())
 244                 return CKM_API_ERROR_INPUT_PARAM;
 245
 246         EXCEPTION_GUARD_START_CPPAPI
 247
 248         AliasSupport helper(alias);
 249
 250         return Request(*this, LogicCommand::REMOVE, m_storageConnection,
 251                         helper.getName(), helper.getOwner()
 252                 ).maybeDeserialize();
 253
 254         EXCEPTION_GUARD_END
 255 }
 256
 257 int Manager::Impl::getBinaryData(
 258         const Alias &alias,
 259         DataType sendDataType,
 260         const Password &password,
 261         DataType &recvDataType,
 262         RawBuffer &rawData)
 263 {
 264         if (alias.empty())
 265                 return CKM_API_ERROR_INPUT_PARAM;
 266
 267         EXCEPTION_GUARD_START_CPPAPI
 268
 269         AliasSupport helper(alias);
 270
 271         return Request(*this, LogicCommand::GET, m_storageConnection,
 272                         sendDataType, helper.getName(), helper.getOwner(), password
 273                 ).maybeDeserialize(recvDataType, rawData);
 274
 275         EXCEPTION_GUARD_END
 276 }
 277
 278 int Manager::Impl::getBinaryDataEncryptionStatus(const DataType sendDataType,
 279                                                 const Alias &alias, bool &status)
 280 {
 281         status = false;
 282         if (alias.empty())
 283                 return CKM_API_ERROR_INPUT_PARAM;
 284
 285         EXCEPTION_GUARD_START_CPPAPI
 286
 287         AliasSupport helper(alias);
 288         DataType tmpDataType;
 289
 290         int retCode = Request(*this, LogicCommand::GET_PROTECTION_STATUS, m_storageConnection,
 291                         sendDataType, helper.getName(), helper.getOwner()
 292                 ).maybeDeserialize(tmpDataType, status);
 293
 294         if (retCode != CKM_API_SUCCESS)
 295                 status = false;
 296
 297         return retCode;
 298
 299         EXCEPTION_GUARD_END
 300 }
 301
 302 int Manager::Impl::getKey(const Alias &alias, const Password &password,
 303                                                   KeyShPtr &key)
 304 {
 305         DataType recvDataType;
 306         RawBuffer rawData;
 307
 308         int retCode = getBinaryData(alias, DataType::KEY_RSA_PUBLIC, password, recvDataType, rawData);
 309
 310         if (retCode != CKM_API_SUCCESS)
 311                 return retCode;
 312
 313         KeyShPtr keyParsed = recvDataType.isSKey() ? Key::createAES(rawData) : Key::create(rawData);
 314
 315         if (!keyParsed) {
 316                 LogDebug("Key empty - failed to parse!");
 317                 return CKM_API_ERROR_BAD_RESPONSE;
 318         }
 319
 320         key = keyParsed;
 321
 322         return CKM_API_SUCCESS;
 323 }
 324
 325 int Manager::Impl::getCertificate(const Alias &alias, const Password &password,
 326                                                                   CertificateShPtr &cert)
 327 {
 328         DataType recvDataType;
 329         RawBuffer rawData;
 330
 331         int retCode = getBinaryData(alias, DataType::CERTIFICATE, password, recvDataType, rawData);
 332
 333         if (retCode != CKM_API_SUCCESS)
 334                 return retCode;
 335
 336         if (!recvDataType.isCertificate())
 337                 return CKM_API_ERROR_BAD_RESPONSE;
 338
 339         CertificateShPtr certParsed(new CertificateImpl(rawData, DataFormat::FORM_DER));
 340
 341         if (certParsed->empty())
 342                 return CKM_API_ERROR_BAD_RESPONSE;
 343
 344         cert = std::move(certParsed);
 345
 346         return CKM_API_SUCCESS;
 347 }
 348
 349 int Manager::Impl::getData(const Alias &alias, const Password &password,
 350                                                    RawBuffer &rawData)
 351 {
 352         DataType recvDataType = DataType::BINARY_DATA;
 353
 354         int retCode = getBinaryData(alias, DataType::BINARY_DATA, password, recvDataType, rawData);
 355
 356         if (retCode != CKM_API_SUCCESS)
 357                 return retCode;
 358
 359         return recvDataType.isBinaryData() ? CKM_API_SUCCESS : CKM_API_ERROR_BAD_RESPONSE;
 360 }
 361
 362 int Manager::Impl::getBinaryDataAliasVectorHelper(DataType dataType,
 363                 OwnerNameVector &ownerNameVector)
 364 {
 365         DataType tmpDataType;
 366         return Request(*this, LogicCommand::GET_LIST, m_storageConnection,
 367                         dataType
 368                 ).maybeDeserialize(tmpDataType, ownerNameVector);
 369 }
 370
 371 int Manager::Impl::getBinaryDataAliasVector(DataType dataType,
 372                 AliasVector &aliasVector)
 373 {
 374         EXCEPTION_GUARD_START_CPPAPI
 375         OwnerNameVector ownerNameVector;
 376         int retCode = getBinaryDataAliasVectorHelper(dataType, ownerNameVector);
 377
 378         if (retCode != CKM_API_SUCCESS)
 379                 return retCode;
 380
 381         for (const auto &it : ownerNameVector)
 382                 aliasVector.push_back(AliasSupport::merge(it.first, it.second));
 383
 384         return CKM_API_SUCCESS;
 385         EXCEPTION_GUARD_END
 386 }
 387
 388 int Manager::Impl::getBinaryDataAliasPwdVector(DataType dataType,
 389                 AliasPwdVector &aliasPwdVector)
 390 {
 391         EXCEPTION_GUARD_START_CPPAPI
 392         OwnerNameVector ownerNameVector;
 393         OwnerNameEncryptionStatusVector ownerNameEncryptionStatusVector;
 394         int retCode = getBinaryDataAliasVectorHelper(dataType, ownerNameVector);
 395
 396         if (retCode != CKM_API_SUCCESS)
 397                 return retCode;
 398
 399         for (const auto &it : ownerNameVector)
 400         {
 401                 Alias alias = AliasSupport::merge(std::get<0>(it), std::get<1>(it));
 402                 bool status;
 403                 retCode = getBinaryDataEncryptionStatus(dataType, alias, status);
 404
 405                 if (retCode != CKM_API_SUCCESS)
 406                         return retCode;
 407
 408                 aliasPwdVector.push_back(std::make_pair(alias, status));
 409         }
 410         return CKM_API_SUCCESS;
 411         EXCEPTION_GUARD_END
 412 }
 413
 414 int Manager::Impl::getKeyAliasVector(AliasVector &aliasVector)
 415 {
 416         // in fact datatype has no meaning here - if not certificate or binary data
 417         // then manager decides to list all between DB_KEY_FIRST and DB_KEY_LAST
 418         return getBinaryDataAliasVector(DataType::DB_KEY_LAST, aliasVector);
 419 }
 420
 421 int Manager::Impl::getCertificateAliasVector(AliasVector &aliasVector)
 422 {
 423         return getBinaryDataAliasVector(DataType::CERTIFICATE, aliasVector);
 424 }
 425
 426 int Manager::Impl::getDataAliasVector(AliasVector &aliasVector)
 427 {
 428         return getBinaryDataAliasVector(DataType::BINARY_DATA, aliasVector);
 429 }
 430
 431 int Manager::Impl::getKeyAliasPwdVector(AliasPwdVector &aliasPwdVector)
 432 {
 433         return getBinaryDataAliasPwdVector(DataType::DB_KEY_LAST, aliasPwdVector);
 434 }
 435
 436 int Manager::Impl::getKeyEncryptionStatus(const Alias &alias, bool &status)
 437 {
 438         return getBinaryDataEncryptionStatus(DataType::DB_KEY_LAST, alias, status);
 439 }
 440
 441 int Manager::Impl::getCertificateAliasPwdVector(AliasPwdVector &aliasPwdVector)
 442 {
 443         return getBinaryDataAliasPwdVector(DataType::CERTIFICATE, aliasPwdVector);
 444 }
 445
 446 int Manager::Impl::getCertificateEncryptionStatus(const Alias &alias, bool &status)
 447 {
 448         return getBinaryDataEncryptionStatus(DataType::CERTIFICATE, alias, status);
 449 }
 450
 451 int Manager::Impl::getDataAliasPwdVector(AliasPwdVector &aliasPwdVector)
 452 {
 453         return getBinaryDataAliasPwdVector(DataType::BINARY_DATA, aliasPwdVector);
 454 }
 455
 456 int Manager::Impl::getDataEncryptionStatus(const Alias &alias, bool &status)
 457 {
 458         return getBinaryDataEncryptionStatus(DataType::BINARY_DATA, alias, status);
 459 }
 460
 461 int Manager::Impl::createKeyPairRSA(
 462         const int size,
 463         const Alias &privateKeyAlias,
 464         const Alias &publicKeyAlias,
 465         const Policy &policyPrivateKey,
 466         const Policy &policyPublicKey)
 467 {
 468         return this->createKeyPair(CKM::KeyType::KEY_RSA_PUBLIC, size, privateKeyAlias,
 469                                                            publicKeyAlias, policyPrivateKey, policyPublicKey);
 470 }
 471
 472 int Manager::Impl::createKeyPairDSA(
 473         const int size,
 474         const Alias &privateKeyAlias,
 475         const Alias &publicKeyAlias,
 476         const Policy &policyPrivateKey,
 477         const Policy &policyPublicKey)
 478 {
 479         return this->createKeyPair(CKM::KeyType::KEY_DSA_PUBLIC, size, privateKeyAlias,
 480                                                            publicKeyAlias, policyPrivateKey, policyPublicKey);
 481 }
 482
 483 int Manager::Impl::createKeyPairECDSA(
 484         ElipticCurve type,
 485         const Alias &privateKeyAlias,
 486         const Alias &publicKeyAlias,
 487         const Policy &policyPrivateKey,
 488         const Policy &policyPublicKey)
 489 {
 490         return this->createKeyPair(CKM::KeyType::KEY_ECDSA_PUBLIC,
 491                                                            static_cast<int>(type), privateKeyAlias, publicKeyAlias,
 492                                                            policyPrivateKey, policyPublicKey);
 493 }
 494
 495 int Manager::Impl::createKeyAES(
 496         const int size,
 497         const Alias &keyAlias,
 498         const Policy &policyKey)
 499 {
 500         EXCEPTION_GUARD_START_CPPAPI
 501
 502         AliasSupport aliasHelper(keyAlias);
 503
 504         return Request(*this, LogicCommand::CREATE_KEY_AES, m_storageConnection,
 505                         static_cast<int>(size), PolicySerializable(policyKey),
 506                         aliasHelper.getName(), aliasHelper.getOwner()
 507                 ).maybeDeserialize();
 508
 509         EXCEPTION_GUARD_END
 510 }
 511
 512
 513 int Manager::Impl::createKeyPair(
 514         const KeyType key_type,
 515         const int     additional_param,
 516         const Alias  &privateKeyAlias,
 517         const Alias  &publicKeyAlias,
 518         const Policy &policyPrivateKey,
 519         const Policy &policyPublicKey)
 520 {
 521         // input type check
 522         CryptoAlgorithm keyGenAlgorithm;
 523
 524         switch (key_type) {
 525         case KeyType::KEY_RSA_PUBLIC:
 526         case KeyType::KEY_RSA_PRIVATE:
 527                 keyGenAlgorithm.setParam(ParamName::ALGO_TYPE, AlgoType::RSA_GEN);
 528                 keyGenAlgorithm.setParam(ParamName::GEN_KEY_LEN, additional_param);
 529                 break;
 530
 531         case KeyType::KEY_DSA_PUBLIC:
 532         case KeyType::KEY_DSA_PRIVATE:
 533                 keyGenAlgorithm.setParam(ParamName::ALGO_TYPE, AlgoType::DSA_GEN);
 534                 keyGenAlgorithm.setParam(ParamName::GEN_KEY_LEN, additional_param);
 535                 break;
 536
 537         case KeyType::KEY_ECDSA_PUBLIC:
 538         case KeyType::KEY_ECDSA_PRIVATE:
 539                 keyGenAlgorithm.setParam(ParamName::ALGO_TYPE, AlgoType::ECDSA_GEN);
 540                 keyGenAlgorithm.setParam(ParamName::GEN_EC, additional_param);
 541                 break;
 542
 543         default:
 544                 return CKM_API_ERROR_INPUT_PARAM;
 545         }
 546
 547         EXCEPTION_GUARD_START_CPPAPI
 548
 549         AliasSupport privateHelper(privateKeyAlias);
 550         AliasSupport publicHelper(publicKeyAlias);
 551
 552         return Request(*this, LogicCommand::CREATE_KEY_PAIR, m_storageConnection,
 553                         CryptoAlgorithmSerializable(keyGenAlgorithm),
 554                         PolicySerializable(policyPrivateKey),
 555                         PolicySerializable(policyPublicKey),
 556                         privateHelper.getName(), privateHelper.getOwner(),
 557                         publicHelper.getName(), publicHelper.getOwner()
 558                 ).maybeDeserialize();
 559
 560         EXCEPTION_GUARD_END
 561 }
 562
 563 int Manager::Impl::getCertificateChain(
 564         const CertificateShPtr &certificate,
 565         const CertificateShPtrVector &untrustedCertificates,
 566         const CertificateShPtrVector &trustedCertificates,
 567         bool useTrustedSystemCertificates,
 568         CertificateShPtrVector &certificateChainVector)
 569 {
 570         RawBufferVector untrustedVector;
 571         RawBufferVector trustedVector;
 572
 573         if (!certificate || certificate->empty())
 574                 return CKM_API_ERROR_INPUT_PARAM;
 575
 576         for (auto &e : untrustedCertificates) {
 577                 if (!e || e->empty())
 578                         return CKM_API_ERROR_INPUT_PARAM;
 579                 untrustedVector.push_back(e->getDER());
 580         }
 581
 582         for (auto &e : trustedCertificates) {
 583                 if (!e || e->empty())
 584                         return CKM_API_ERROR_INPUT_PARAM;
 585                 trustedVector.push_back(e->getDER());
 586         }
 587
 588         return getCertChain(m_storageConnection, LogicCommand::GET_CHAIN_CERT, *this,
 589                             certificate, untrustedVector, trustedVector,
 590                             useTrustedSystemCertificates, certificateChainVector);
 591 }
 592
 593 int Manager::Impl::getCertificateChain(
 594         const CertificateShPtr &certificate,
 595         const AliasVector &untrustedCertificates,
 596         const AliasVector &trustedCertificates,
 597         bool useTrustedSystemCertificates,
 598         CertificateShPtrVector &certificateChainVector)
 599 {
 600         OwnerNameVector untrustedVector;
 601         OwnerNameVector trustedVector;
 602
 603         if (!certificate || certificate->empty())
 604                 return CKM_API_ERROR_INPUT_PARAM;
 605
 606         for (auto &e : untrustedCertificates) {
 607                 AliasSupport helper(e);
 608                 untrustedVector.push_back(std::make_pair(helper.getOwner(), helper.getName()));
 609         }
 610
 611         for (auto &e : trustedCertificates) {
 612                 AliasSupport helper(e);
 613                 trustedVector.push_back(std::make_pair(helper.getOwner(), helper.getName()));
 614         }
 615
 616         return getCertChain(m_storageConnection, LogicCommand::GET_CHAIN_ALIAS, *this,
 617                             certificate, untrustedVector, trustedVector,
 618                             useTrustedSystemCertificates, certificateChainVector);
 619 }
 620
 621 int Manager::Impl::createSignature(
 622         const Alias &privateKeyAlias,
 623         const Password &password,           // password for private_key
 624         const RawBuffer &message,
 625         const CryptoAlgorithm &cAlgorithm,
 626         RawBuffer &signature)
 627 {
 628         EXCEPTION_GUARD_START_CPPAPI
 629
 630         AliasSupport helper(privateKeyAlias);
 631
 632         return Request(*this, LogicCommand::CREATE_SIGNATURE, m_storageConnection,
 633                         helper.getName(), helper.getOwner(), password, message,
 634                         CryptoAlgorithmSerializable(cAlgorithm)
 635                 ).maybeDeserialize(signature);
 636
 637         EXCEPTION_GUARD_END
 638 }
 639
 640 int Manager::Impl::verifySignature(
 641         const Alias &publicKeyOrCertAlias,
 642         const Password &password,           // password for public_key (optional)
 643         const RawBuffer &message,
 644         const RawBuffer &signature,
 645         const CryptoAlgorithm &cAlg)
 646 {
 647         EXCEPTION_GUARD_START_CPPAPI
 648
 649         AliasSupport helper(publicKeyOrCertAlias);
 650
 651         return Request(*this, LogicCommand::VERIFY_SIGNATURE, m_storageConnection,
 652                         helper.getName(), helper.getOwner(), password, message, signature,
 653                         CryptoAlgorithmSerializable(cAlg)
 654                 ).maybeDeserialize();
 655
 656         EXCEPTION_GUARD_END
 657 }
 658
 659 int Manager::Impl::ocspCheck(const CertificateShPtrVector &certChain,
 660                                                          int &ocspStatus)
 661 {
 662         EXCEPTION_GUARD_START_CPPAPI
 663
 664         int msgId = ++m_counter;
 665         MessageBuffer recv;
 666
 667         RawBufferVector rawCertChain;
 668
 669         for (auto &e : certChain) {
 670                 if (!e || e->empty()) {
 671                         LogError("Empty certificate");
 672                         return CKM_API_ERROR_INPUT_PARAM;
 673                 }
 674
 675                 rawCertChain.push_back(e->getDER());
 676         }
 677
 678         int retCode = doRequest(recv, m_ocspConnection, msgId, rawCertChain);
 679
 680         if (CKM_API_SUCCESS != retCode)
 681                 return retCode;
 682
 683         return deserializeResponse(msgId, recv, ocspStatus);
 684
 685         EXCEPTION_GUARD_END
 686 }
 687
 688 int Manager::Impl::setPermission(const Alias &alias,
 689                                                                  const ClientId &accessor,
 690                                                                  PermissionMask permissionMask)
 691 {
 692         EXCEPTION_GUARD_START_CPPAPI
 693
 694         AliasSupport helper(alias);
 695
 696         return Request(*this, LogicCommand::SET_PERMISSION, m_storageConnection,
 697                         helper.getName(), helper.getOwner(), accessor, permissionMask
 698                 ).maybeDeserialize();
 699
 700         EXCEPTION_GUARD_END
 701 }
 702
 703 int Manager::Impl::crypt(EncryptionCommand command,
 704                                                  const CryptoAlgorithm &algo,
 705                                                  const Alias &keyAlias,
 706                                                  const Password &password,
 707                                                  const RawBuffer &input,
 708                                                  RawBuffer &output)
 709 {
 710         EXCEPTION_GUARD_START_CPPAPI
 711
 712         AliasSupport helper(keyAlias);
 713         CryptoAlgorithmSerializable cas(algo);
 714
 715         return Request(*this, command, m_encryptionConnection,
 716                         cas, helper.getName(), helper.getOwner(), password, input
 717                 ).maybeDeserialize(output);
 718
 719         EXCEPTION_GUARD_END
 720 }
 721
 722 int Manager::Impl::encrypt(const CryptoAlgorithm &algo,
 723                                                    const Alias &keyAlias,
 724                                                    const Password &password,
 725                                                    const RawBuffer &plain,
 726                                                    RawBuffer &encrypted)
 727 {
 728         return crypt(EncryptionCommand::ENCRYPT, algo, keyAlias, password, plain,
 729                                  encrypted);
 730 }
 731
 732 int Manager::Impl::decrypt(const CryptoAlgorithm &algo,
 733                                                    const Alias &keyAlias,
 734                                                    const Password &password,
 735                                                    const RawBuffer &encrypted,
 736                                                    RawBuffer &decrypted)
 737 {
 738         return crypt(EncryptionCommand::DECRYPT, algo, keyAlias, password, encrypted,
 739                                  decrypted);
 740 }
 741
 742 int Manager::Impl::deriveKey(const CryptoAlgorithm &algo,
 743                                                          const Alias &secretAlias,
 744                                                          const Password &secretPassword,
 745                                                          const Alias &newKeyAlias,
 746                                                          const Policy &newKeyPolicy)
 747 {
 748         EXCEPTION_GUARD_START_CPPAPI
 749
 750         AliasSupport secret(secretAlias);
 751         AliasSupport newKey(newKeyAlias);
 752         CryptoAlgorithmSerializable cas(algo);
 753
 754         return Request(*this, LogicCommand::DERIVE, m_storageConnection,
 755                         cas, secret.getName(), secret.getOwner(), secretPassword,
 756                         newKey.getName(), newKey.getOwner(), PolicySerializable(newKeyPolicy)
 757                 ).maybeDeserialize();
 758
 759         EXCEPTION_GUARD_END
 760 }
 761
 762 int Manager::Impl::importWrappedKey(const CryptoAlgorithm &params,
 763                                                                         const Alias &wrappingKeyAlias,
 764                                                                         const Password &wrappingKeyPassword,
 765                                                                         const Alias &alias,
 766                                                                         const RawBuffer &wrappedKey,
 767                                                                         const KeyType keyType,
 768                                                                         const Policy &policy)
 769 {
 770         EXCEPTION_GUARD_START_CPPAPI
 771
 772         AliasSupport wrapping_helper(wrappingKeyAlias);
 773         AliasSupport helper(alias);
 774
 775         return Request(*this,
 776                 LogicCommand::IMPORT_WRAPPED_KEY,
 777                 m_storageConnection,
 778                 CryptoAlgorithmSerializable(params),
 779                 wrapping_helper.getName(),
 780                 wrapping_helper.getOwner(),
 781                 wrappingKeyPassword,
 782                 helper.getName(),
 783                 helper.getOwner(),
 784                 wrappedKey,
 785                 DataType(keyType),
 786                 PolicySerializable(policy)
 787         ).maybeDeserialize();
 788
 789         EXCEPTION_GUARD_END
 790 }
 791
 792 int Manager::Impl::exportWrappedKey(const CryptoAlgorithm &params,
 793                                                                         const Alias &wrappingKeyAlias,
 794                                                                         const Password &wrappingKeyPassword,
 795                                                                         const Alias &alias,
 796                                                                         const Password &password,
 797                                                                         KeyType &keyType,
 798                                                                         RawBuffer &wrappedKey)
 799 {
 800         EXCEPTION_GUARD_START_CPPAPI
 801
 802         AliasSupport wrapping_helper(wrappingKeyAlias);
 803         AliasSupport helper(alias);
 804         DataType dataTypeKey;
 805
 806         int retCode = Request(*this,
 807                 LogicCommand::EXPORT_WRAPPED_KEY,
 808                 m_storageConnection,
 809                 CryptoAlgorithmSerializable(params),
 810                 wrapping_helper.getName(),
 811                 wrapping_helper.getOwner(),
 812                 wrappingKeyPassword,
 813                 helper.getName(),
 814                 helper.getOwner(),
 815                 password
 816         ).maybeDeserialize(dataTypeKey, wrappedKey);
 817
 818         if (retCode != CKM_API_SUCCESS)
 819                 return retCode;
 820
 821         if (dataTypeKey.isSKey()) {
 822                 keyType = KeyType::KEY_AES;
 823         } else if (dataTypeKey.isKeyPrivate()) {
 824                 keyType = KeyType::KEY_RSA_PRIVATE;
 825         } else {
 826                 return CKM_API_ERROR_INVALID_FORMAT;
 827         }
 828
 829         return retCode;
 830
 831         EXCEPTION_GUARD_END
 832 }
 833
 834 } // namespace CKM