#include <file-system.h>
#include <ckm-logic.h>
#include <key-impl.h>
+#include <key-aes-impl.h>
#include <certificate-config.h>
#include <certificate-store.h>
#include <dirent.h>
#include <algorithm>
#include <InitialValuesFile.h>
-
+#include <sw-backend/store.h>
#include <generic-backend/exception.h>
-#include <sw-backend/crypto-service.h>
namespace {
const char * const CERT_SYSTEM_DIR = "/etc/ssl/certs";
const char * const INIT_VALUES_DIR = "/opt/data/ckm/initial_values/";
-const char * const INIT_VALUES_XSD = "/opt/data/ckm/initial_values/initial_values.xsd";
+const char * const INIT_VALUES_XSD = "/usr/share/ckm/initial_values.xsd";
const char * const INIT_VALUES_FILE_SUFFIX = ".xml";
const char * const SYSTEM_DB_PASSWD = "cAtRugU7";
handle.database.deleteKey(appSmackLabel);
}
}
- } catch (const KeyProvider::Exception::PassWordError &e) {
- LogError("Incorrect Password " << e.GetMessage());
- retCode = CKM_API_ERROR_AUTHENTICATION_FAILED;
- } catch (const KeyProvider::Exception::Base &e) {
- LogError("Error in KeyProvider " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
- } catch (const CryptoLogic::Exception::Base &e) {
- LogError("CryptoLogic error: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
- } catch (const FileSystem::Exception::Base &e) {
- LogError("FileSystem error: " << e.GetMessage());
- retCode = CKM_API_ERROR_FILE_SYSTEM;
+ } catch (const Exc::Exception &e) {
+ retCode = e.error();
} catch (const CKM::Exception &e) {
LogError("CKM::Exception: " << e.GetMessage());
retCode = CKM_API_ERROR_SERVER_ERROR;
if ( !m_accessControl.isSystemService(cred) )
{
if (0 == m_userDataMap.count(cred.clientUid))
- ThrowMsg(Exception::DatabaseLocked, "database with UID: " << cred.clientUid << " locked");
+ ThrowErr(Exc::DatabaseLocked, "database with UID: ", cred.clientUid, " locked");
if (0 != incoming_label.compare(LABEL_SYSTEM_DB))
return m_userDataMap[cred.clientUid];
// system database selected, modify the label
if (CKM_API_SUCCESS != unlockSystemDB() )
- ThrowMsg(Exception::DatabaseLocked, "can not unlock system database");
+ ThrowErr(Exc::DatabaseLocked, "can not unlock system database");
return m_userDataMap[SYSTEM_DB_UID];
}
try
{
retCode = changeUserPasswordHelper(user, oldPassword, newPassword);
- } catch (const KeyProvider::Exception::PassWordError &e) {
- LogError("Incorrect Password " << e.GetMessage());
- retCode = CKM_API_ERROR_AUTHENTICATION_FAILED;
- } catch (const KeyProvider::Exception::Base &e) {
- LogError("Error in KeyProvider " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
- } catch (const FileSystem::Exception::Base &e) {
- LogError("Error in FileSystem " << e.GetMessage());
- retCode = CKM_API_ERROR_FILE_SYSTEM;
+ } catch (const Exc::Exception &e) {
+ retCode = e.error();
} catch (const CKM::Exception &e) {
LogError("CKM::Exception: " << e.GetMessage());
retCode = CKM_API_ERROR_SERVER_ERROR;
int retCode = CKM_API_SUCCESS;
try {
retCode = resetUserPasswordHelper(user, newPassword);
- } catch (const FileSystem::Exception::Base &e) {
- LogError("Error in FileSystem " << e.GetMessage());
- retCode = CKM_API_ERROR_FILE_SYSTEM;
+ } catch (const Exc::Exception &e) {
+ retCode = e.error();
} catch (const CKM::Exception &e) {
LogError("CKM::Exception: " << e.GetMessage());
retCode = CKM_API_ERROR_SERVER_ERROR;
} catch (const DB::Crypto::Exception::TransactionError &e) {
LogError("DB::Crypto transaction failed with message " << e.GetMessage());
retCode = CKM_API_ERROR_DB_ERROR;
- } catch (const FileSystem::Exception::Base &e) {
- LogError("Error in FileSystem " << e.GetMessage());
- retCode = CKM_API_ERROR_FILE_SYSTEM;
+ } catch (const Exc::Exception &e) {
+ retCode = e.error();
} catch (const CKM::Exception &e) {
LogError("CKM::Exception: " << e.GetMessage());
retCode = CKM_API_ERROR_SERVER_ERROR;
const Policy &policy) const
{
DB::Row row(name, label, static_cast<int>(policy.extractable), dataType, data, static_cast<int>(data.size()));
- row.backendId = m_decider.chooseCryptoBackend(dataType, policy);
+ row.backendId = m_decider.chooseCryptoBackend(dataType, policy.extractable);
// do not encrypt data with password during cc_mode on
if(m_accessControl.isCCMode()) {
// verify the data integrity
if (dataType.isKey())
{
- KeyShPtr output_key = CKM::Key::create(input_data);
+ KeyShPtr output_key;
+ if(dataType.isSKey())
+ output_key = CKM::Key::createAES(input_data);
+ else
+ output_key = CKM::Key::create(input_data);
if(output_key.get() == NULL)
{
LogError("provided binary data is not valid key data");
{
retCode = saveDataHelper(cred, name, label, dataType, binaryData, policy);
}
- } catch (const KeyProvider::Exception::Base &e) {
- LogError("KeyProvider failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
- } catch (const CryptoLogic::Exception::Base &e) {
- LogError("CryptoLogic failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
} catch (const DB::Crypto::Exception::InternalError &e) {
LogError("DB::Crypto failed with message: " << e.GetMessage());
retCode = CKM_API_ERROR_DB_ERROR;
} catch (const DB::Crypto::Exception::TransactionError &e) {
LogError("DB::Crypto transaction failed with message " << e.GetMessage());
retCode = CKM_API_ERROR_DB_ERROR;
- } catch (const FileSystem::Exception::Base &e) {
- LogError("Error in FileSystem " << e.GetMessage());
- retCode = CKM_API_ERROR_FILE_SYSTEM;
- } catch (const CKMLogic::Exception::DatabaseLocked &e) {
- LogError("Error " << e.GetMessage());
- retCode = CKM_API_ERROR_DB_LOCKED;
+ } catch (const Exc::Exception &e) {
+ retCode = e.error();
} catch (const CKM::Exception &e) {
LogError("CKM::Exception: " << e.GetMessage());
retCode = CKM_API_ERROR_SERVER_ERROR;
int retCode = CKM_API_ERROR_UNKNOWN;
try {
retCode = saveDataHelper(cred, name, label, pkcs, keyPolicy, certPolicy);
- } catch (const KeyProvider::Exception::Base &e) {
- LogError("KeyProvider failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
- } catch (const CryptoLogic::Exception::Base &e) {
- LogError("CryptoLogic failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
+ } catch (const Exc::Exception &e) {
+ retCode = e.error();
} catch (const DB::Crypto::Exception::InternalError &e) {
LogError("DB::Crypto failed with message: " << e.GetMessage());
retCode = CKM_API_ERROR_DB_ERROR;
{
retCode = removeDataHelper(cred, name, label);
}
- catch (const CKMLogic::Exception::DatabaseLocked &e)
+ catch (const Exc::Exception &e)
{
- LogError("Error " << e.GetMessage());
- retCode = CKM_API_ERROR_DB_LOCKED;
+ retCode = e.error();
}
catch (const CKM::Exception &)
{
try {
retCode = readDataHelper(true, cred, dataType, name, label, password, row);
- } catch (const KeyProvider::Exception::Base &e) {
- LogError("KeyProvider failed with error: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
- } catch (const CryptoLogic::Exception::DecryptDBRowError &e) {
- LogError("CryptoLogic failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_AUTHENTICATION_FAILED;
- } catch (const CryptoLogic::Exception::Base &e) {
- LogError("CryptoLogic failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
} catch (const DB::Crypto::Exception::Base &e) {
LogError("DB::Crypto failed with message: " << e.GetMessage());
retCode = CKM_API_ERROR_DB_ERROR;
- } catch (const CKMLogic::Exception::DatabaseLocked &e) {
- LogError("Error " << e.GetMessage());
- retCode = CKM_API_ERROR_DB_LOCKED;
+ } catch (const Exc::Exception &e) {
+ retCode = e.error();
} catch (const CKM::Exception &e) {
LogError("CKM::Exception: " << e.GetMessage());
retCode = CKM_API_ERROR_SERVER_ERROR;
// prepare response
if(retCode == CKM_API_SUCCESS)
output = PKCS12Serializable(privKey, cert, caChain);
-
- } catch (const KeyProvider::Exception::Base &e) {
- LogError("KeyProvider failed with error: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
- } catch (const CryptoLogic::Exception::DecryptDBRowError &e) {
- LogError("CryptoLogic failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_AUTHENTICATION_FAILED;
- } catch (const CryptoLogic::Exception::Base &e) {
- LogError("CryptoLogic failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
} catch (const DB::Crypto::Exception::Base &e) {
LogError("DB::Crypto failed with message: " << e.GetMessage());
retCode = CKM_API_ERROR_DB_ERROR;
- } catch (const CKMLogic::Exception::DatabaseLocked &e) {
- LogError("Error " << e.GetMessage());
- retCode = CKM_API_ERROR_DB_LOCKED;
+ } catch (const Exc::Exception &e) {
+ retCode = e.error();
} catch (const CKM::Exception &e) {
LogError("CKM::Exception: " << e.GetMessage());
retCode = CKM_API_ERROR_SERVER_ERROR;
}
+int CKMLogic::createKeyAESHelper(
+ const Credentials &cred,
+ const int size,
+ const Name &name,
+ const Label &label,
+ const PolicySerializable &policy)
+{
+ CryptoAlgorithm keyGenAlgorithm;
+ keyGenAlgorithm.setParam(ParamName::GEN_KEY_LEN, size);
+ Token key = m_decider.getStore(DataType::KEY_AES, policy.extractable).generateSKey(keyGenAlgorithm);
+
+ return saveDataHelper(cred,
+ name,
+ label,
+ DataType::KEY_AES,
+ key.data,
+ policy);
+}
+
+
int CKMLogic::createKeyPairHelper(
const Credentials &cred,
- const KeyType key_type,
- const int additional_param,
+ const CryptoAlgorithmSerializable & keyGenParams,
const Name &namePrivate,
const Label &labelPrivate,
const Name &namePublic,
auto &handlerPriv = selectDatabase(cred, labelPrivate);
auto &handlerPub = selectDatabase(cred, labelPublic);
+ AlgoType keyType = AlgoType::RSA_GEN;
+ if(!keyGenParams.getParam(ParamName::ALGO_TYPE, keyType))
+ ThrowErr(Exc::InputParam, "Error, parameter ALGO_TYPE not found.");
+ DataType dt(keyType);
+ if(!dt.isKey())
+ ThrowErr(Exc::InputParam, "Error, parameter ALGO_TYPE with wrong value.");
- int retCode;
- KeyImpl prv, pub;
- switch(key_type)
- {
- case KeyType::KEY_RSA_PUBLIC:
- case KeyType::KEY_RSA_PRIVATE:
- retCode = Crypto::SW::CryptoService::createKeyPairRSA(additional_param, prv, pub);
- break;
-
- case KeyType::KEY_DSA_PUBLIC:
- case KeyType::KEY_DSA_PRIVATE:
- retCode = Crypto::SW::CryptoService::createKeyPairDSA(additional_param, prv, pub);
- break;
-
- case KeyType::KEY_ECDSA_PUBLIC:
- case KeyType::KEY_ECDSA_PRIVATE:
- retCode = Crypto::SW::CryptoService::createKeyPairECDSA(static_cast<ElipticCurve>(additional_param), prv, pub);
- break;
-
- default:
- return CKM_API_ERROR_INPUT_PARAM;
- }
-
- if (CKM_CRYPTO_CREATEKEY_SUCCESS != retCode)
- {
- LogDebug("CryptoService error with code: " << retCode);
- return CKM_API_ERROR_SERVER_ERROR; // TODO error code
- }
+ bool exportable = policyPrivate.extractable || policyPublic.extractable;
+ TokenPair keys = m_decider.getStore(dt, exportable).generateAKey(keyGenParams);
DB::Crypto::Transaction transactionPriv(&handlerPriv.database);
// in case the same database is used for private and public - the second
// transaction will not be executed
DB::Crypto::Transaction transactionPub(&handlerPub.database);
- retCode = saveDataHelper(cred,
+ int retCode = saveDataHelper(cred,
namePrivate,
labelPrivate,
- DataType(prv.getType()),
- prv.getDER(),
+ keys.first.dataType,
+ keys.first.data,
policyPrivate);
if (CKM_API_SUCCESS != retCode)
return retCode;
retCode = saveDataHelper(cred,
namePublic,
labelPublic,
- DataType(pub.getType()),
- pub.getDER(),
+ keys.second.dataType,
+ keys.second.data,
policyPublic);
if (CKM_API_SUCCESS != retCode)
return retCode;
transactionPub.commit();
transactionPriv.commit();
-
- return retCode;
+ return CKM_API_SUCCESS;
}
RawBuffer CKMLogic::createKeyPair(
const Credentials &cred,
- LogicCommand protocol_cmd,
int commandId,
- const int additional_param,
+ const CryptoAlgorithmSerializable & keyGenParams,
const Name &namePrivate,
const Label &labelPrivate,
const Name &namePublic,
{
int retCode = CKM_API_SUCCESS;
- KeyType key_type = KeyType::KEY_NONE;
- switch(protocol_cmd)
- {
- case LogicCommand::CREATE_KEY_PAIR_RSA:
- key_type = KeyType::KEY_RSA_PUBLIC;
- break;
- case LogicCommand::CREATE_KEY_PAIR_DSA:
- key_type = KeyType::KEY_DSA_PUBLIC;
- break;
- case LogicCommand::CREATE_KEY_PAIR_ECDSA:
- key_type = KeyType::KEY_ECDSA_PUBLIC;
- break;
- default:
- break;
- }
-
try {
retCode = createKeyPairHelper(
cred,
- key_type,
- additional_param,
+ keyGenParams,
namePrivate,
labelPrivate,
namePublic,
labelPublic,
policyPrivate,
policyPublic);
+ } catch(const Exc::Exception &e) {
+ retCode = e.error();
} catch (DB::Crypto::Exception::TransactionError &e) {
LogDebug("DB::Crypto error: transaction error: " << e.GetMessage());
retCode = CKM_API_ERROR_DB_ERROR;
- } catch (CKM::CryptoLogic::Exception::Base &e) {
- LogDebug("CryptoLogic error: " << e.GetMessage());
+ } catch (DB::Crypto::Exception::InternalError &e) {
+ LogDebug("DB::Crypto internal error: " << e.GetMessage());
+ retCode = CKM_API_ERROR_DB_ERROR;
+ } catch (const CKM::Exception &e) {
+ LogError("CKM::Exception: " << e.GetMessage());
retCode = CKM_API_ERROR_SERVER_ERROR;
+ }
+
+ return MessageBuffer::Serialize(static_cast<int>(LogicCommand::CREATE_KEY_PAIR),
+ commandId, retCode).Pop();
+}
+
+RawBuffer CKMLogic::createKeyAES(
+ const Credentials &cred,
+ int commandId,
+ const int size,
+ const Name &name,
+ const Label &label,
+ const PolicySerializable &policy)
+{
+ int retCode = CKM_API_SUCCESS;
+
+ try {
+ retCode = createKeyAESHelper(cred, size, name, label, policy);
+ } catch (const Exc::Exception &e) {
+ retCode = e.error();
+ } catch (std::invalid_argument &e) {
+ LogDebug("invalid argument error: " << e.what());
+ retCode = CKM_API_ERROR_INPUT_PARAM;
+ } catch (DB::Crypto::Exception::TransactionError &e) {
+ LogDebug("DB::Crypto error: transaction error: " << e.GetMessage());
+ retCode = CKM_API_ERROR_DB_ERROR;
} catch (DB::Crypto::Exception::InternalError &e) {
LogDebug("DB::Crypto internal error: " << e.GetMessage());
retCode = CKM_API_ERROR_DB_ERROR;
- } catch (const CKMLogic::Exception::DatabaseLocked &e) {
- LogError("Error " << e.GetMessage());
- retCode = CKM_API_ERROR_DB_LOCKED;
} catch (const CKM::Exception &e) {
LogError("CKM::Exception: " << e.GetMessage());
retCode = CKM_API_ERROR_SERVER_ERROR;
}
- return MessageBuffer::Serialize(static_cast<int>(protocol_cmd), commandId, retCode).Pop();
+ return MessageBuffer::Serialize(static_cast<int>(LogicCommand::CREATE_KEY_AES),
+ commandId, retCode).Pop();
}
int CKMLogic::readCertificateHelper(
trustedCertificates,
useTrustedSystemCertificates,
chainRawVector);
- } catch (const CryptoLogic::Exception::Base &e) {
- LogError("CryptoLogic failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
+ } catch (const Exc::Exception &e) {
+ retCode = e.error();
} catch (const DB::Crypto::Exception::Base &e) {
LogError("DB::Crypto failed with message: " << e.GetMessage());
retCode = CKM_API_ERROR_DB_ERROR;
trustedCertificates,
useTrustedSystemCertificates,
chainRawVector);
- } catch (const CryptoLogic::Exception::DecryptDBRowError &e) {
- LogError("CryptoLogic failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_AUTHENTICATION_FAILED;
- } catch (const CryptoLogic::Exception::Base &e) {
- LogError("CryptoLogic failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
} catch (const DB::Crypto::Exception::Base &e) {
LogError("DB::Crypto failed with message: " << e.GetMessage());
retCode = CKM_API_ERROR_DB_ERROR;
- } catch (const CKMLogic::Exception::DatabaseLocked &e) {
- LogError("Error " << e.GetMessage());
- retCode = CKM_API_ERROR_DB_LOCKED;
+ } catch (const Exc::Exception &e) {
+ retCode = e.error();
} catch (const std::exception& e) {
LogError("STD exception " << e.what());
retCode = CKM_API_ERROR_SERVER_ERROR;
DB::Row row;
RawBuffer signature;
CryptoAlgorithm cryptoAlg;
- cryptoAlg.addParam(ParamName::SV_HASH_ALGO, hash);
- cryptoAlg.addParam(ParamName::SV_RSA_PADDING, padding);
+ cryptoAlg.setParam(ParamName::SV_HASH_ALGO, hash);
+ cryptoAlg.setParam(ParamName::SV_RSA_PADDING, padding);
int retCode = CKM_API_SUCCESS;
if(retCode == CKM_API_SUCCESS) {
signature = m_decider.getStore(row).getKey(row)->sign(cryptoAlg, message);
}
- } catch (const KeyProvider::Exception::Base &e) {
- LogError("KeyProvider failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
- } catch (const CryptoLogic::Exception::DecryptDBRowError &e) {
- LogError("CryptoLogic failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_AUTHENTICATION_FAILED;
- } catch (const CryptoLogic::Exception::Base &e) {
- LogError("CryptoLogic failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
} catch (const DB::Crypto::Exception::Base &e) {
LogError("DB::Crypto failed with message: " << e.GetMessage());
retCode = CKM_API_ERROR_DB_ERROR;
- } catch (const CKMLogic::Exception::DatabaseLocked &e) {
- LogError("Error " << e.GetMessage());
- retCode = CKM_API_ERROR_DB_LOCKED;
- } catch (const CKM::Crypto::Exception::InputParam &e) {
- LogError("CKM::Crypto failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_INPUT_PARAM;
- } catch (const CKM::Crypto::Exception::Base &e) {
- LogError("CKM::Crypto failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
+ } catch (const Exc::Exception &e) {
+ retCode = e.error();
} catch (const CKM::Exception &e) {
LogError("Unknown CKM::Exception: " << e.GetMessage());
retCode = CKM_API_ERROR_SERVER_ERROR;
try {
DB::Row row;
- KeyImpl key;
CryptoAlgorithm params;
- params.addParam(ParamName::SV_HASH_ALGO, hash);
- params.addParam(ParamName::SV_RSA_PADDING, padding);
+ params.setParam(ParamName::SV_HASH_ALGO, hash);
+ params.setParam(ParamName::SV_RSA_PADDING, padding);
// try certificate first - looking for a public key.
// in case of PKCS, pub key from certificate will be found first
if (retCode == CKM_API_SUCCESS) {
retCode = m_decider.getStore(row).getKey(row)->verify(params, message, signature);
}
- } catch (const Crypto::SW::CryptoService::Exception::Crypto_internal &e) {
- LogError("KeyProvider failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
- } catch (const Crypto::SW::CryptoService::Exception::opensslError &e) {
- LogError("KeyProvider failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
- } catch (const KeyProvider::Exception::Base &e) {
- LogError("KeyProvider failed with error: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
- } catch (const CryptoLogic::Exception::DecryptDBRowError &e) {
- LogError("CryptoLogic failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_AUTHENTICATION_FAILED;
- } catch (const CryptoLogic::Exception::Base &e) {
- LogError("CryptoLogic failed with message: " << e.GetMessage());
- retCode = CKM_API_ERROR_SERVER_ERROR;
+ } catch (const Exc::Exception &e) {
+ retCode = e.error();
} catch (const DB::Crypto::Exception::Base &e) {
LogError("DB::Crypto failed with message: " << e.GetMessage());
retCode = CKM_API_ERROR_DB_ERROR;
- } catch (const CKMLogic::Exception::DatabaseLocked &e) {
- LogError("Error " << e.GetMessage());
- retCode = CKM_API_ERROR_DB_LOCKED;
} catch (const CKM::Exception &e) {
LogError("Unknown CKM::Exception: " << e.GetMessage());
retCode = CKM_API_ERROR_SERVER_ERROR;
int retCode;
Try {
retCode = setPermissionHelper(cred, name, label, accessorLabel, permissionMask);
- } catch (const CKMLogic::Exception::DatabaseLocked &e) {
- LogError("Error " << e.GetMessage());
- retCode = CKM_API_ERROR_DB_LOCKED;
+ } catch (const Exc::Exception &e) {
+ retCode = e.error();
} Catch (CKM::Exception) {
LogError("Error in set row!");
retCode = CKM_API_ERROR_DB_ERROR;