src/manager/client/client-manager-impl.cpp

   1 /* Copyright (c) 2014-2020 Samsung Electronics Co., Ltd. All rights reserved
   2  *
   3  *  Licensed under the Apache License, Version 2.0 (the "License");
   4  *  you may not use this file except in compliance with the License.
   5  *  You may obtain a copy of the License at
   6  *
   7  *      http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  *  Unless required by applicable law or agreed to in writing, software
  10  *  distributed under the License is distributed on an "AS IS" BASIS,
  11  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  *  See the License for the specific language governing permissions and
  13  *  limitations under the License
  14  *
  15  *
  16  * @file        client-manager-impl.cpp
  17  * @author      Bartlomiej Grzelewski (b.grzelewski@samsung.com)
  18  * @version     1.0
  19  * @brief       Manager implementation.
  20  */
  21 #include <openssl/evp.h>
  22
  23 #include <dpl/serialization.h>
  24 #include <dpl/log/log.h>
  25
  26 #include <client-manager-impl.h>
  27 #include <client-common.h>
  28 #include <exception.h>
  29 #include <message-buffer.h>
  30 #include <protocols.h>
  31 #include <key-impl.h>
  32 #include <key-aes-impl.h>
  33 #include <certificate-impl.h>
  34
  35 namespace CKM {
  36
  37 namespace {
  38 template <class...T>
  39 int deserializeResponse(const int msgId, MessageBuffer &recv, T&&...t)
  40 {
  41         int retMsgId, retCode;
  42         recv.Deserialize(retMsgId, retCode, std::forward<T>(t)...);
  43         return msgId != retMsgId ? CKM_API_ERROR_UNKNOWN : retCode;
  44 }
  45
  46 template <class T>
  47 int getCertChain(
  48         ServiceConnection &serviceConnection,
  49         LogicCommand command,
  50         Manager::Impl &impl,
  51         const CertificateShPtr &certificate,
  52         const T &untrustedVector,
  53         const T &trustedVector,
  54         bool useTrustedSystemCertificates,
  55         CertificateShPtrVector &certificateChainVector)
  56 {
  57         EXCEPTION_GUARD_START_CPPAPI
  58
  59         Manager::Impl::Request rq(impl, command, serviceConnection,
  60                         certificate->getDER(), untrustedVector, trustedVector, useTrustedSystemCertificates);
  61         if (!rq)
  62                 return rq.err();
  63
  64         RawBufferVector rawBufferVector;
  65         int retCode = rq.deserialize(rawBufferVector);
  66
  67         if (retCode != CKM_API_SUCCESS)
  68                 return retCode;
  69
  70         for (auto &e : rawBufferVector) {
  71                 CertificateShPtr cert(new CertificateImpl(e, DataFormat::FORM_DER));
  72
  73                 if (cert->empty())
  74                         return CKM_API_ERROR_BAD_RESPONSE;
  75
  76                 certificateChainVector.push_back(std::move(cert));
  77         }
  78
  79         return retCode;
  80
  81         EXCEPTION_GUARD_END
  82 }
  83
  84 template <class...T>
  85 int doRequest(MessageBuffer &recv, CKM::ServiceConnection &conn, T&&...t)
  86 {
  87         return conn.processRequest(SerializeMessage(std::forward<T>(t)...), recv);
  88 }
  89
  90 } // namespace
  91
  92 Manager::Impl::Impl()
  93         : m_storageConnection(SERVICE_SOCKET_CKM_STORAGE),
  94           m_ocspConnection(SERVICE_SOCKET_OCSP),
  95           m_encryptionConnection(SERVICE_SOCKET_ENCRYPTION)
  96 {
  97 }
  98
  99 template <class Cmd, class...T>
 100 Manager::Impl::Request::Request(Manager::Impl &impl, Cmd cmd, CKM::ServiceConnection &conn, T&&...t)
 101 {
 102         static_assert(sizeof cmd <= sizeof(int));
 103         const auto msgId = m_msgId = ++impl.m_counter;
 104         m_retCode = doRequest(m_recv, conn, static_cast<int>(cmd), msgId, std::forward<T>(t)...);
 105 }
 106
 107 Manager::Impl::Request::operator bool() const {
 108         return CKM_API_SUCCESS == m_retCode;
 109 }
 110
 111 int Manager::Impl::Request::err() const {
 112         assert(!*this);
 113         return m_retCode;
 114 }
 115
 116 template <class...T>
 117 int Manager::Impl::Request::deserialize(T&&...t)
 118 {
 119         assert(*this);
 120         return deserializeResponse(m_msgId, m_recv, std::forward<T>(t)...);
 121 }
 122
 123 template <class...T>
 124 int Manager::Impl::Request::maybeDeserialize(T&&...t)
 125 {
 126         return *this ? deserialize(std::forward<T>(t)...) : err();
 127 }
 128
 129 int Manager::Impl::saveBinaryData(
 130         const Alias &alias,
 131         DataType dataType,
 132         const RawBuffer &rawData,
 133         const Policy &policy)
 134 {
 135         EXCEPTION_GUARD_START_CPPAPI
 136
 137         if (alias.empty() || rawData.empty())
 138                 return CKM_API_ERROR_INPUT_PARAM;
 139
 140         AliasSupport helper(alias);
 141
 142         int opType;
 143         return Request(*this, LogicCommand::SAVE, m_storageConnection,
 144                         dataType, helper.getName(), helper.getOwner(), rawData, PolicySerializable(policy)
 145                 ).maybeDeserialize(opType);
 146
 147         EXCEPTION_GUARD_END
 148 }
 149
 150 int Manager::Impl::saveKey(const Alias &alias, const KeyShPtr &key,
 151                                                    const Policy &policy)
 152 {
 153         if (key.get() == NULL || key->empty())
 154                 return CKM_API_ERROR_INPUT_PARAM;
 155         try {
 156                 return saveBinaryData(alias, DataType(key->getType()), key->getDER(), policy);
 157         } catch (const Exc::Exception &e) {
 158                 LogError("Exception: " << e.what());
 159                 return e.error();
 160         }
 161 }
 162
 163 int Manager::Impl::saveCertificate(
 164         const Alias &alias,
 165         const CertificateShPtr &cert,
 166         const Policy &policy)
 167 {
 168         return cert.get() == NULL || cert->empty()
 169                 ? CKM_API_ERROR_INPUT_PARAM
 170                 : saveBinaryData(alias, DataType::CERTIFICATE, cert->getDER(), policy);
 171 }
 172
 173 int Manager::Impl::saveData(const Alias &alias, const RawBuffer &rawData,
 174                                                         const Policy &policy)
 175 {
 176         return saveBinaryData(alias, DataType::BINARY_DATA, rawData, policy);
 177 }
 178
 179
 180 int Manager::Impl::savePKCS12(
 181         const Alias &alias,
 182         const PKCS12ShPtr &pkcs,
 183         const Policy &keyPolicy,
 184         const Policy &certPolicy)
 185 {
 186         if (alias.empty() || pkcs.get() == NULL)
 187                 return CKM_API_ERROR_INPUT_PARAM;
 188
 189         EXCEPTION_GUARD_START_CPPAPI
 190
 191         AliasSupport helper(alias);
 192
 193         return Request(*this, LogicCommand::SAVE_PKCS12, m_storageConnection,
 194                         helper.getName(), helper.getOwner(), PKCS12Serializable(*pkcs.get()),
 195                         PolicySerializable(keyPolicy), PolicySerializable(certPolicy)
 196                 ).maybeDeserialize();
 197
 198         EXCEPTION_GUARD_END
 199 }
 200
 201 int Manager::Impl::getPKCS12(const Alias &alias, PKCS12ShPtr &pkcs)
 202 {
 203         return getPKCS12(alias, Password(), Password(), pkcs);
 204 }
 205
 206 int Manager::Impl::getPKCS12(const Alias &alias, const Password &keyPass,
 207                                                          const Password &certPass, PKCS12ShPtr &pkcs)
 208 {
 209         if (alias.empty())
 210                 return CKM_API_ERROR_INPUT_PARAM;
 211
 212         EXCEPTION_GUARD_START_CPPAPI
 213
 214         AliasSupport helper(alias);
 215
 216         int msgId = ++m_counter;
 217         MessageBuffer recv;
 218
 219         int retCode = doRequest(recv, m_storageConnection,
 220                         static_cast<int>(LogicCommand::GET_PKCS12), msgId,
 221                         helper.getName(), helper.getOwner(), keyPass, certPass);
 222
 223         if (CKM_API_SUCCESS != retCode)
 224                 return retCode;
 225
 226         int retMsgId;
 227         PKCS12Serializable gotPkcs;
 228         recv.Deserialize(retMsgId, retCode, gotPkcs);
 229
 230         if (retMsgId != msgId)
 231                 return CKM_API_ERROR_UNKNOWN;
 232
 233         pkcs = std::make_shared<PKCS12Impl>(std::move(gotPkcs));
 234
 235         return retCode;
 236
 237         EXCEPTION_GUARD_END
 238 }
 239
 240
 241 int Manager::Impl::removeAlias(const Alias &alias)
 242 {
 243         if (alias.empty())
 244                 return CKM_API_ERROR_INPUT_PARAM;
 245
 246         EXCEPTION_GUARD_START_CPPAPI
 247
 248         AliasSupport helper(alias);
 249
 250         return Request(*this, LogicCommand::REMOVE, m_storageConnection,
 251                         helper.getName(), helper.getOwner()
 252                 ).maybeDeserialize();
 253
 254         EXCEPTION_GUARD_END
 255 }
 256
 257 int Manager::Impl::getBinaryData(
 258         const Alias &alias,
 259         DataType sendDataType,
 260         const Password &password,
 261         DataType &recvDataType,
 262         RawBuffer &rawData)
 263 {
 264         if (alias.empty())
 265                 return CKM_API_ERROR_INPUT_PARAM;
 266
 267         EXCEPTION_GUARD_START_CPPAPI
 268
 269         AliasSupport helper(alias);
 270
 271         return Request(*this, LogicCommand::GET, m_storageConnection,
 272                         sendDataType, helper.getName(), helper.getOwner(), password
 273                 ).maybeDeserialize(recvDataType, rawData);
 274
 275         EXCEPTION_GUARD_END
 276 }
 277
 278 int Manager::Impl::getBinaryDataEncryptionStatus(const DataType sendDataType,
 279                                                 const Alias &alias, bool &status)
 280 {
 281         status = false;
 282         if (alias.empty())
 283                 return CKM_API_ERROR_INPUT_PARAM;
 284
 285         EXCEPTION_GUARD_START_CPPAPI
 286
 287         AliasSupport helper(alias);
 288         DataType tmpDataType;
 289
 290         int retCode = Request(*this, LogicCommand::GET_PROTECTION_STATUS, m_storageConnection,
 291                         sendDataType, helper.getName(), helper.getOwner()
 292                 ).maybeDeserialize(tmpDataType, status);
 293
 294         if (retCode != CKM_API_SUCCESS)
 295                 status = false;
 296
 297         return retCode;
 298
 299         EXCEPTION_GUARD_END
 300 }
 301
 302 int Manager::Impl::getKey(const Alias &alias, const Password &password,
 303                                                   KeyShPtr &key)
 304 {
 305         DataType recvDataType;
 306         RawBuffer rawData;
 307
 308         int retCode = getBinaryData(alias, DataType::KEY_RSA_PUBLIC, password, recvDataType, rawData);
 309
 310         if (retCode != CKM_API_SUCCESS)
 311                 return retCode;
 312
 313         KeyShPtr keyParsed = recvDataType.isSymmetricKey() ? Key::createAES(rawData) : Key::create(rawData);
 314
 315         if (!keyParsed) {
 316                 LogDebug("Key empty - failed to parse!");
 317                 return CKM_API_ERROR_BAD_RESPONSE;
 318         }
 319
 320         key = keyParsed;
 321
 322         return CKM_API_SUCCESS;
 323 }
 324
 325 int Manager::Impl::getCertificate(const Alias &alias, const Password &password,
 326                                                                   CertificateShPtr &cert)
 327 {
 328         DataType recvDataType;
 329         RawBuffer rawData;
 330
 331         int retCode = getBinaryData(alias, DataType::CERTIFICATE, password, recvDataType, rawData);
 332
 333         if (retCode != CKM_API_SUCCESS)
 334                 return retCode;
 335
 336         if (!recvDataType.isCertificate())
 337                 return CKM_API_ERROR_BAD_RESPONSE;
 338
 339         CertificateShPtr certParsed(new CertificateImpl(rawData, DataFormat::FORM_DER));
 340
 341         if (certParsed->empty())
 342                 return CKM_API_ERROR_BAD_RESPONSE;
 343
 344         cert = std::move(certParsed);
 345
 346         return CKM_API_SUCCESS;
 347 }
 348
 349 int Manager::Impl::getData(const Alias &alias, const Password &password,
 350                                                    RawBuffer &rawData)
 351 {
 352         DataType recvDataType = DataType::BINARY_DATA;
 353
 354         int retCode = getBinaryData(alias, DataType::BINARY_DATA, password, recvDataType, rawData);
 355
 356         if (retCode != CKM_API_SUCCESS)
 357                 return retCode;
 358
 359         return recvDataType.isBinaryData() ? CKM_API_SUCCESS : CKM_API_ERROR_BAD_RESPONSE;
 360 }
 361
 362 int Manager::Impl::getAliasInfoVectorHelper(DataType dataType, AliasInfoVector &aliasInfoVector)
 363 {
 364         DataType tmpDataType;
 365         AliasInfoSerializableVector aisv(aliasInfoVector);
 366         return Request(*this,
 367                        LogicCommand::GET_LIST,
 368                        m_storageConnection,
 369                        dataType).maybeDeserialize(tmpDataType, aisv);
 370 }
 371
 372 int Manager::Impl::getAliasVectorHelper(DataType dataType, AliasVector &aliasVector)
 373 {
 374         EXCEPTION_GUARD_START_CPPAPI
 375         AliasInfoVector aliasInfoVector;
 376         int retCode = getAliasInfoVectorHelper(dataType, aliasInfoVector);
 377
 378         if (retCode != CKM_API_SUCCESS)
 379                 return retCode;
 380
 381         for (const auto &it : aliasInfoVector)
 382                 aliasVector.push_back(it.alias);
 383
 384         return CKM_API_SUCCESS;
 385         EXCEPTION_GUARD_END
 386 }
 387
 388 int Manager::Impl::getKeyAliasVector(AliasVector &aliasVector)
 389 {
 390         // in fact datatype has no meaning here - if not certificate or binary data
 391         // then manager decides to list all between DB_KEY_FIRST and DB_KEY_LAST
 392         return getAliasVectorHelper(DataType::DB_KEY_LAST, aliasVector);
 393 }
 394
 395 int Manager::Impl::getCertificateAliasVector(AliasVector &aliasVector)
 396 {
 397         return getAliasVectorHelper(DataType::CERTIFICATE, aliasVector);
 398 }
 399
 400 int Manager::Impl::getDataAliasVector(AliasVector &aliasVector)
 401 {
 402         return getAliasVectorHelper(DataType::BINARY_DATA, aliasVector);
 403 }
 404
 405 int Manager::Impl::getKeyAliasInfoVector(AliasInfoVector &aliasInfoVector)
 406 {
 407         return getAliasInfoVectorHelper(DataType::DB_KEY_LAST, aliasInfoVector);
 408 }
 409
 410 int Manager::Impl::getKeyEncryptionStatus(const Alias &alias, bool &status)
 411 {
 412         return getBinaryDataEncryptionStatus(DataType::DB_KEY_LAST, alias, status);
 413 }
 414
 415 int Manager::Impl::getCertificateAliasInfoVector(AliasInfoVector &aliasInfoVector)
 416 {
 417         return getAliasInfoVectorHelper(DataType::CERTIFICATE, aliasInfoVector);
 418 }
 419
 420 int Manager::Impl::getCertificateEncryptionStatus(const Alias &alias, bool &status)
 421 {
 422         return getBinaryDataEncryptionStatus(DataType::CERTIFICATE, alias, status);
 423 }
 424
 425 int Manager::Impl::getDataAliasInfoVector(AliasInfoVector &aliasInfoVector)
 426 {
 427         return getAliasInfoVectorHelper(DataType::BINARY_DATA, aliasInfoVector);
 428 }
 429
 430 int Manager::Impl::getDataEncryptionStatus(const Alias &alias, bool &status)
 431 {
 432         return getBinaryDataEncryptionStatus(DataType::BINARY_DATA, alias, status);
 433 }
 434
 435 int Manager::Impl::createKeyPairRSA(
 436         const int size,
 437         const Alias &privateKeyAlias,
 438         const Alias &publicKeyAlias,
 439         const Policy &policyPrivateKey,
 440         const Policy &policyPublicKey)
 441 {
 442         return this->createKeyPair(CKM::KeyType::KEY_RSA_PUBLIC, size, privateKeyAlias,
 443                                                            publicKeyAlias, policyPrivateKey, policyPublicKey);
 444 }
 445
 446 int Manager::Impl::createKeyPairDSA(
 447         const int size,
 448         const Alias &privateKeyAlias,
 449         const Alias &publicKeyAlias,
 450         const Policy &policyPrivateKey,
 451         const Policy &policyPublicKey)
 452 {
 453         return this->createKeyPair(CKM::KeyType::KEY_DSA_PUBLIC, size, privateKeyAlias,
 454                                                            publicKeyAlias, policyPrivateKey, policyPublicKey);
 455 }
 456
 457 int Manager::Impl::createKeyPairECDSA(
 458         ElipticCurve type,
 459         const Alias &privateKeyAlias,
 460         const Alias &publicKeyAlias,
 461         const Policy &policyPrivateKey,
 462         const Policy &policyPublicKey)
 463 {
 464         return this->createKeyPair(CKM::KeyType::KEY_ECDSA_PUBLIC,
 465                                                            static_cast<int>(type), privateKeyAlias, publicKeyAlias,
 466                                                            policyPrivateKey, policyPublicKey);
 467 }
 468
 469 int Manager::Impl::createKeyAES(
 470         const int size,
 471         const Alias &keyAlias,
 472         const Policy &policyKey)
 473 {
 474         EXCEPTION_GUARD_START_CPPAPI
 475
 476         AliasSupport aliasHelper(keyAlias);
 477
 478         return Request(*this, LogicCommand::CREATE_KEY_AES, m_storageConnection,
 479                         static_cast<int>(size), PolicySerializable(policyKey),
 480                         aliasHelper.getName(), aliasHelper.getOwner()
 481                 ).maybeDeserialize();
 482
 483         EXCEPTION_GUARD_END
 484 }
 485
 486
 487 int Manager::Impl::createKeyPair(
 488         const KeyType key_type,
 489         const int     additional_param,
 490         const Alias  &privateKeyAlias,
 491         const Alias  &publicKeyAlias,
 492         const Policy &policyPrivateKey,
 493         const Policy &policyPublicKey)
 494 {
 495         // input type check
 496         CryptoAlgorithm keyGenAlgorithm;
 497
 498         switch (key_type) {
 499         case KeyType::KEY_RSA_PUBLIC:
 500         case KeyType::KEY_RSA_PRIVATE:
 501                 keyGenAlgorithm.setParam(ParamName::ALGO_TYPE, AlgoType::RSA_GEN);
 502                 keyGenAlgorithm.setParam(ParamName::GEN_KEY_LEN, additional_param);
 503                 break;
 504
 505         case KeyType::KEY_DSA_PUBLIC:
 506         case KeyType::KEY_DSA_PRIVATE:
 507                 keyGenAlgorithm.setParam(ParamName::ALGO_TYPE, AlgoType::DSA_GEN);
 508                 keyGenAlgorithm.setParam(ParamName::GEN_KEY_LEN, additional_param);
 509                 break;
 510
 511         case KeyType::KEY_ECDSA_PUBLIC:
 512         case KeyType::KEY_ECDSA_PRIVATE:
 513                 keyGenAlgorithm.setParam(ParamName::ALGO_TYPE, AlgoType::ECDSA_GEN);
 514                 keyGenAlgorithm.setParam(ParamName::GEN_EC, additional_param);
 515                 break;
 516
 517         default:
 518                 return CKM_API_ERROR_INPUT_PARAM;
 519         }
 520
 521         EXCEPTION_GUARD_START_CPPAPI
 522
 523         AliasSupport privateHelper(privateKeyAlias);
 524         AliasSupport publicHelper(publicKeyAlias);
 525
 526         return Request(*this, LogicCommand::CREATE_KEY_PAIR, m_storageConnection,
 527                         CryptoAlgorithmSerializable(keyGenAlgorithm),
 528                         PolicySerializable(policyPrivateKey),
 529                         PolicySerializable(policyPublicKey),
 530                         privateHelper.getName(), privateHelper.getOwner(),
 531                         publicHelper.getName(), publicHelper.getOwner()
 532                 ).maybeDeserialize();
 533
 534         EXCEPTION_GUARD_END
 535 }
 536
 537 int Manager::Impl::getCertificateChain(
 538         const CertificateShPtr &certificate,
 539         const CertificateShPtrVector &untrustedCertificates,
 540         const CertificateShPtrVector &trustedCertificates,
 541         bool useTrustedSystemCertificates,
 542         CertificateShPtrVector &certificateChainVector)
 543 {
 544         RawBufferVector untrustedVector;
 545         RawBufferVector trustedVector;
 546
 547         if (!certificate || certificate->empty())
 548                 return CKM_API_ERROR_INPUT_PARAM;
 549
 550         for (auto &e : untrustedCertificates) {
 551                 if (!e || e->empty())
 552                         return CKM_API_ERROR_INPUT_PARAM;
 553                 untrustedVector.push_back(e->getDER());
 554         }
 555
 556         for (auto &e : trustedCertificates) {
 557                 if (!e || e->empty())
 558                         return CKM_API_ERROR_INPUT_PARAM;
 559                 trustedVector.push_back(e->getDER());
 560         }
 561
 562         return getCertChain(m_storageConnection, LogicCommand::GET_CHAIN_CERT, *this,
 563                             certificate, untrustedVector, trustedVector,
 564                             useTrustedSystemCertificates, certificateChainVector);
 565 }
 566
 567 int Manager::Impl::getCertificateChain(
 568         const CertificateShPtr &certificate,
 569         const AliasVector &untrustedCertificates,
 570         const AliasVector &trustedCertificates,
 571         bool useTrustedSystemCertificates,
 572         CertificateShPtrVector &certificateChainVector)
 573 {
 574         OwnerNameVector untrustedVector;
 575         OwnerNameVector trustedVector;
 576
 577         if (!certificate || certificate->empty())
 578                 return CKM_API_ERROR_INPUT_PARAM;
 579
 580         for (auto &e : untrustedCertificates) {
 581                 AliasSupport helper(e);
 582                 untrustedVector.push_back(std::make_pair(helper.getOwner(), helper.getName()));
 583         }
 584
 585         for (auto &e : trustedCertificates) {
 586                 AliasSupport helper(e);
 587                 trustedVector.push_back(std::make_pair(helper.getOwner(), helper.getName()));
 588         }
 589
 590         return getCertChain(m_storageConnection, LogicCommand::GET_CHAIN_ALIAS, *this,
 591                             certificate, untrustedVector, trustedVector,
 592                             useTrustedSystemCertificates, certificateChainVector);
 593 }
 594
 595 int Manager::Impl::createSignature(
 596         const Alias &privateKeyAlias,
 597         const Password &password,           // password for private_key
 598         const RawBuffer &message,
 599         const CryptoAlgorithm &cAlgorithm,
 600         RawBuffer &signature)
 601 {
 602         EXCEPTION_GUARD_START_CPPAPI
 603
 604         AliasSupport helper(privateKeyAlias);
 605
 606         return Request(*this, LogicCommand::CREATE_SIGNATURE, m_storageConnection,
 607                         helper.getName(), helper.getOwner(), password, message,
 608                         CryptoAlgorithmSerializable(cAlgorithm)
 609                 ).maybeDeserialize(signature);
 610
 611         EXCEPTION_GUARD_END
 612 }
 613
 614 int Manager::Impl::verifySignature(
 615         const Alias &publicKeyOrCertAlias,
 616         const Password &password,           // password for public_key (optional)
 617         const RawBuffer &message,
 618         const RawBuffer &signature,
 619         const CryptoAlgorithm &cAlg)
 620 {
 621         EXCEPTION_GUARD_START_CPPAPI
 622
 623         AliasSupport helper(publicKeyOrCertAlias);
 624
 625         return Request(*this, LogicCommand::VERIFY_SIGNATURE, m_storageConnection,
 626                         helper.getName(), helper.getOwner(), password, message, signature,
 627                         CryptoAlgorithmSerializable(cAlg)
 628                 ).maybeDeserialize();
 629
 630         EXCEPTION_GUARD_END
 631 }
 632
 633 int Manager::Impl::ocspCheck(const CertificateShPtrVector &certChain,
 634                                                          int &ocspStatus)
 635 {
 636         EXCEPTION_GUARD_START_CPPAPI
 637
 638         int msgId = ++m_counter;
 639         MessageBuffer recv;
 640
 641         RawBufferVector rawCertChain;
 642
 643         for (auto &e : certChain) {
 644                 if (!e || e->empty()) {
 645                         LogError("Empty certificate");
 646                         return CKM_API_ERROR_INPUT_PARAM;
 647                 }
 648
 649                 rawCertChain.push_back(e->getDER());
 650         }
 651
 652         int retCode = doRequest(recv, m_ocspConnection, msgId, rawCertChain);
 653
 654         if (CKM_API_SUCCESS != retCode)
 655                 return retCode;
 656
 657         return deserializeResponse(msgId, recv, ocspStatus);
 658
 659         EXCEPTION_GUARD_END
 660 }
 661
 662 int Manager::Impl::setPermission(const Alias &alias,
 663                                                                  const ClientId &accessor,
 664                                                                  PermissionMask permissionMask)
 665 {
 666         EXCEPTION_GUARD_START_CPPAPI
 667
 668         AliasSupport helper(alias);
 669
 670         return Request(*this, LogicCommand::SET_PERMISSION, m_storageConnection,
 671                         helper.getName(), helper.getOwner(), accessor, permissionMask
 672                 ).maybeDeserialize();
 673
 674         EXCEPTION_GUARD_END
 675 }
 676
 677 int Manager::Impl::crypt(EncryptionCommand command,
 678                                                  const CryptoAlgorithm &algo,
 679                                                  const Alias &keyAlias,
 680                                                  const Password &password,
 681                                                  const RawBuffer &input,
 682                                                  RawBuffer &output)
 683 {
 684         EXCEPTION_GUARD_START_CPPAPI
 685
 686         AliasSupport helper(keyAlias);
 687         CryptoAlgorithmSerializable cas(algo);
 688
 689         return Request(*this, command, m_encryptionConnection,
 690                         cas, helper.getName(), helper.getOwner(), password, input
 691                 ).maybeDeserialize(output);
 692
 693         EXCEPTION_GUARD_END
 694 }
 695
 696 int Manager::Impl::encrypt(const CryptoAlgorithm &algo,
 697                                                    const Alias &keyAlias,
 698                                                    const Password &password,
 699                                                    const RawBuffer &plain,
 700                                                    RawBuffer &encrypted)
 701 {
 702         return crypt(EncryptionCommand::ENCRYPT, algo, keyAlias, password, plain,
 703                                  encrypted);
 704 }
 705
 706 int Manager::Impl::decrypt(const CryptoAlgorithm &algo,
 707                                                    const Alias &keyAlias,
 708                                                    const Password &password,
 709                                                    const RawBuffer &encrypted,
 710                                                    RawBuffer &decrypted)
 711 {
 712         return crypt(EncryptionCommand::DECRYPT, algo, keyAlias, password, encrypted,
 713                                  decrypted);
 714 }
 715
 716 int Manager::Impl::deriveKey(const CryptoAlgorithm &algo,
 717                                                          const Alias &secretAlias,
 718                                                          const Password &secretPassword,
 719                                                          const Alias &newKeyAlias,
 720                                                          const Policy &newKeyPolicy)
 721 {
 722         EXCEPTION_GUARD_START_CPPAPI
 723
 724         AliasSupport secret(secretAlias);
 725         AliasSupport newKey(newKeyAlias);
 726         CryptoAlgorithmSerializable cas(algo);
 727
 728         return Request(*this, LogicCommand::DERIVE, m_storageConnection,
 729                         cas, secret.getName(), secret.getOwner(), secretPassword,
 730                         newKey.getName(), newKey.getOwner(), PolicySerializable(newKeyPolicy)
 731                 ).maybeDeserialize();
 732
 733         EXCEPTION_GUARD_END
 734 }
 735
 736 int Manager::Impl::importWrappedKey(const CryptoAlgorithm &params,
 737                                                                         const Alias &wrappingKeyAlias,
 738                                                                         const Password &wrappingKeyPassword,
 739                                                                         const Alias &alias,
 740                                                                         const RawBuffer &wrappedKey,
 741                                                                         const KeyType keyType,
 742                                                                         const Policy &policy)
 743 {
 744         EXCEPTION_GUARD_START_CPPAPI
 745
 746         AliasSupport wrapping_helper(wrappingKeyAlias);
 747         AliasSupport helper(alias);
 748
 749         return Request(*this,
 750                 LogicCommand::IMPORT_WRAPPED_KEY,
 751                 m_storageConnection,
 752                 CryptoAlgorithmSerializable(params),
 753                 wrapping_helper.getName(),
 754                 wrapping_helper.getOwner(),
 755                 wrappingKeyPassword,
 756                 helper.getName(),
 757                 helper.getOwner(),
 758                 wrappedKey,
 759                 DataType(keyType),
 760                 PolicySerializable(policy)
 761         ).maybeDeserialize();
 762
 763         EXCEPTION_GUARD_END
 764 }
 765
 766 int Manager::Impl::exportWrappedKey(const CryptoAlgorithm &params,
 767                                                                         const Alias &wrappingKeyAlias,
 768                                                                         const Password &wrappingKeyPassword,
 769                                                                         const Alias &alias,
 770                                                                         const Password &password,
 771                                                                         KeyType &keyType,
 772                                                                         RawBuffer &wrappedKey)
 773 {
 774         EXCEPTION_GUARD_START_CPPAPI
 775
 776         AliasSupport wrapping_helper(wrappingKeyAlias);
 777         AliasSupport helper(alias);
 778         DataType dataTypeKey;
 779
 780         int retCode = Request(*this,
 781                 LogicCommand::EXPORT_WRAPPED_KEY,
 782                 m_storageConnection,
 783                 CryptoAlgorithmSerializable(params),
 784                 wrapping_helper.getName(),
 785                 wrapping_helper.getOwner(),
 786                 wrappingKeyPassword,
 787                 helper.getName(),
 788                 helper.getOwner(),
 789                 password
 790         ).maybeDeserialize(dataTypeKey, wrappedKey);
 791
 792         if (retCode != CKM_API_SUCCESS)
 793                 return retCode;
 794
 795         if (dataTypeKey.isSymmetricKey()) {
 796                 keyType = KeyType::KEY_AES;
 797         } else if (dataTypeKey.isKeyPrivate()) {
 798                 keyType = KeyType::KEY_RSA_PRIVATE;
 799         } else {
 800                 return CKM_API_ERROR_INVALID_FORMAT;
 801         }
 802
 803         return retCode;
 804
 805         EXCEPTION_GUARD_END
 806 }
 807
 808 int Manager::Impl::initializeCipher(
 809         const CryptoAlgorithm &params,
 810         const Alias &keyAlias,
 811         const Password &keyPassword,
 812         bool encrypt,
 813         int &requestId)
 814 {
 815         EXCEPTION_GUARD_START_CPPAPI
 816
 817         AliasSupport helper(keyAlias);
 818
 819         return Request(*this,
 820                 EncryptionCommand::INITIALIZE_CIPHER,
 821                 m_encryptionConnection,
 822                 requestId,
 823                 CryptoAlgorithmSerializable(params),
 824                 helper.getName(),
 825                 helper.getOwner(),
 826                 keyPassword,
 827                 encrypt
 828         ).maybeDeserialize(requestId);
 829
 830         EXCEPTION_GUARD_END
 831 }
 832
 833 int Manager::Impl::updateCipher(int requestId, const RawBuffer &in, RawBuffer &out)
 834 {
 835         EXCEPTION_GUARD_START_CPPAPI
 836
 837         return Request(*this,
 838                 EncryptionCommand::UPDATE_CIPHER,
 839                 m_encryptionConnection,
 840                 requestId,
 841                 in
 842         ).maybeDeserialize(out);
 843
 844         EXCEPTION_GUARD_END
 845 }
 846
 847 int Manager::Impl::finalizeCipher(int requestId, const RawBuffer &in, RawBuffer &out)
 848 {
 849         EXCEPTION_GUARD_START_CPPAPI
 850
 851         return Request(*this,
 852                 EncryptionCommand::FINALIZE_CIPHER,
 853                 m_encryptionConnection,
 854                 requestId,
 855                 in
 856         ).maybeDeserialize(out);
 857
 858         EXCEPTION_GUARD_END
 859 }
 860
 861 } // namespace CKM