Add support for password in Manager::getPCKS12 function.

In function savePKCS12 user may specify passwords to protect
data. Function getPKCS12 wasn't support passwords so it was not
possible to extract PKCS12 secured with this functionality.

Change-Id: I542873b817a2bff1064b2b56254d14fb632d8bdf

diff --git a/src/include/ckm/ckm-manager-async.h b/src/include/ckm/ckm-manager-async.h
index bd7b002..20faac2 100644 (file)
--- a/src/include/ckm/ckm-manager-async.h
+++ b/src/include/ckm/ckm-manager-async.h
@@ -111,7 +111,12 @@ public:
     void getKey(const ObserverPtr& observer, const Alias& alias, const Password& password);
     void getCertificate(const ObserverPtr& observer, const Alias& alias, const Password& password);
     void getData(const ObserverPtr& observer, const Alias& alias, const Password& password);
-    void getPKCS12(const ObserverPtr& observer, const Alias &alias);
+
+    void getPKCS12(
+        const ObserverPtr& observer,
+        const Alias &alias,
+        const Password& passwordKey = Password(),
+        const Password& passwordCert = Password());
 
     // send request for list of all keys/certificates/data that application/user may use
     void getKeyAliasVector(const ObserverPtr& observer);

diff --git a/src/include/ckm/ckm-manager.h b/src/include/ckm/ckm-manager.h
index 03b32d3..a4ad4e1 100644 (file)
--- a/src/include/ckm/ckm-manager.h
+++ b/src/include/ckm/ckm-manager.h
@@ -63,6 +63,11 @@ public:
         CertificateShPtr &certificate) = 0;
     virtual int getData(const Alias &alias, const Password &password, RawBuffer &data) = 0;
     virtual int getPKCS12(const Alias &alias, PKCS12ShPtr &pkcs) = 0;
+    virtual int getPKCS12(
+        const Alias &alias,
+        const Password &keyPass,
+        const Password &certPass,
+        PKCS12ShPtr &pkcs) = 0;
 
     // send request for list of all keys/certificates/data that application/user may use
     virtual int getKeyAliasVector(AliasVector &aliasVector) = 0;

diff --git a/src/manager/client-async/client-manager-async-impl.cpp b/src/manager/client-async/client-manager-async-impl.cpp
index 33d133f..13db701 100644 (file)
--- a/src/manager/client-async/client-manager-async-impl.cpp
+++ b/src/manager/client-async/client-manager-async-impl.cpp
@@ -162,7 +162,9 @@ void ManagerAsync::Impl::getBinaryData(const ManagerAsync::ObserverPtr& observer
 }
 
 void ManagerAsync::Impl::getPKCS12(const ManagerAsync::ObserverPtr& observer,
-                                   const Alias &alias)
+                                   const Alias &alias,
+                                   const Password &passwordKey,
+                                   const Password &passwordCert)
 {
     observerCheck(observer);
     if (alias.empty()) {
@@ -175,7 +177,9 @@ void ManagerAsync::Impl::getPKCS12(const ManagerAsync::ObserverPtr& observer,
                       static_cast<int>(LogicCommand::GET_PKCS12),
                       m_counter,
                       helper.getName(),
-                      helper.getLabel());
+                      helper.getLabel(),
+                      passwordKey,
+                      passwordCert);
     }, [&observer](int error){ observer->ReceivedError(error); } );
 }
 

diff --git a/src/manager/client-async/client-manager-async-impl.h b/src/manager/client-async/client-manager-async-impl.h
index c00a3ee..4046a1d 100644 (file)
--- a/src/manager/client-async/client-manager-async-impl.h
+++ b/src/manager/client-async/client-manager-async-impl.h
@@ -106,7 +106,9 @@ public:
 
     void getPKCS12(
             const ManagerAsync::ObserverPtr& observer,
-            const Alias &alias);
+            const Alias &alias,
+            const Password &keyPassword,
+            const Password &certPassword);
 
     void getBinaryDataAliasVector(
             const ManagerAsync::ObserverPtr& observer,

diff --git a/src/manager/client-async/client-manager-async.cpp b/src/manager/client-async/client-manager-async.cpp
index 21111cb..6bbabfb 100644 (file)
--- a/src/manager/client-async/client-manager-async.cpp
+++ b/src/manager/client-async/client-manager-async.cpp
@@ -114,9 +114,11 @@ void ManagerAsync::getData(const ObserverPtr& observer,
 }
 
 void ManagerAsync::getPKCS12(const ObserverPtr& observer,
-                             const Alias &alias)
+                             const Alias &alias,
+                             const Password &keyPassword,
+                             const Password &certPassword)
 {
-    m_impl->getPKCS12(observer, alias);
+    m_impl->getPKCS12(observer, alias, keyPassword, certPassword);
 }
 
 void ManagerAsync::getKeyAliasVector(const ObserverPtr& observer)

diff --git a/src/manager/client/client-manager-impl.cpp b/src/manager/client/client-manager-impl.cpp
index 96afe34..b27e180 100644 (file)
--- a/src/manager/client/client-manager-impl.cpp
+++ b/src/manager/client/client-manager-impl.cpp
@@ -197,6 +197,11 @@ int ManagerImpl::savePKCS12(
 
 int ManagerImpl::getPKCS12(const Alias &alias, PKCS12ShPtr &pkcs)
 {
+    return getPKCS12(alias, Password(), Password(), pkcs);
+}
+
+int ManagerImpl::getPKCS12(const Alias &alias, const Password &keyPass, const Password &certPass, PKCS12ShPtr &pkcs)
+{
     if (alias.empty())
         return CKM_API_ERROR_INPUT_PARAM;
 
@@ -208,7 +213,9 @@ int ManagerImpl::getPKCS12(const Alias &alias, PKCS12ShPtr &pkcs)
         auto send = MessageBuffer::Serialize(static_cast<int>(LogicCommand::GET_PKCS12),
                                              my_counter,
                                              helper.getName(),
-                                             helper.getLabel());
+                                             helper.getLabel(),
+                                             keyPass,
+                                             certPass);
 
         int retCode = m_storageConnection.processRequest(send.Pop(), recv);
         if (CKM_API_SUCCESS != retCode)

diff --git a/src/manager/client/client-manager-impl.h b/src/manager/client/client-manager-impl.h
index 4a66887..8111150 100644 (file)
--- a/src/manager/client/client-manager-impl.h
+++ b/src/manager/client/client-manager-impl.h
@@ -51,7 +51,7 @@ public:
         const Policy &keyPolicy,
         const Policy &certPolicy);
     int getPKCS12(const Alias &alias, PKCS12ShPtr &pkcs);
-
+    int getPKCS12(const Alias &alias, const Password &keyPass, const Password &certPass, PKCS12ShPtr &pkcs);
 
     int removeAlias(const Alias &alias);
 

diff --git a/src/manager/service/ckm-logic.cpp b/src/manager/service/ckm-logic.cpp
index 35808bf..b324a20 100644 (file)
--- a/src/manager/service/ckm-logic.cpp
+++ b/src/manager/service/ckm-logic.cpp
@@ -809,6 +809,8 @@ int CKMLogic::getPKCS12Helper(
     const Credentials &cred,
     const Name &name,
     const Label &label,
+    const Password &keyPassword,
+    const Password &certPassword,
     KeyShPtr & privKey,
     CertificateShPtr & cert,
     CertificateShPtrVector & caChain)
@@ -817,21 +819,21 @@ int CKMLogic::getPKCS12Helper(
 
     // read private key (mandatory)
     DB::Row privKeyRow;
-    retCode = readDataHelper(true, cred, DataType::DB_KEY_FIRST, name, label, CKM::Password(), privKeyRow);
+    retCode = readDataHelper(true, cred, DataType::DB_KEY_FIRST, name, label, keyPassword, privKeyRow);
     if(retCode != CKM_API_SUCCESS)
         return retCode;
     privKey = CKM::Key::create(privKeyRow.data);
 
     // read certificate (mandatory)
     DB::Row certRow;
-    retCode = readDataHelper(true, cred, DataType::CERTIFICATE, name, label, CKM::Password(), certRow);
+    retCode = readDataHelper(true, cred, DataType::CERTIFICATE, name, label, certPassword, certRow);
     if(retCode != CKM_API_SUCCESS)
         return retCode;
     cert = CKM::Certificate::create(certRow.data, DataFormat::FORM_DER);
 
     // read CA cert chain (optional)
     DB::RowVector rawCaChain;
-    retCode = readDataHelper(true, cred, DataType::DB_CHAIN_FIRST, name, label, CKM::Password(), rawCaChain);
+    retCode = readDataHelper(true, cred, DataType::DB_CHAIN_FIRST, name, label, certPassword, rawCaChain);
     if(retCode != CKM_API_SUCCESS &&
        retCode != CKM_API_ERROR_DB_ALIAS_UNKNOWN)
         return retCode;
@@ -849,7 +851,9 @@ RawBuffer CKMLogic::getPKCS12(
         const Credentials &cred,
         int commandId,
         const Name &name,
-        const Label &label)
+        const Label &label,
+        const Password &keyPassword,
+        const Password &certPassword)
 {
     int retCode;
     PKCS12Serializable output;
@@ -858,7 +862,7 @@ RawBuffer CKMLogic::getPKCS12(
         KeyShPtr privKey;
         CertificateShPtr cert;
         CertificateShPtrVector caChain;
-        retCode = getPKCS12Helper(cred, name, label, privKey, cert, caChain);
+        retCode = getPKCS12Helper(cred, name, label, keyPassword, certPassword, privKey, cert, caChain);
 
         // prepare response
         if(retCode == CKM_API_SUCCESS)
@@ -1267,7 +1271,9 @@ RawBuffer CKMLogic::getCertificateChain(
                                             trustedCertificates,
                                             useTrustedSystemCertificates,
                                             chainRawVector);
-
+    } catch (const CryptoLogic::Exception::DecryptDBRowError &e) {
+        LogError("CryptoLogic failed with message: " << e.GetMessage());
+        retCode = CKM_API_ERROR_AUTHENTICATION_FAILED;
     } catch (const CryptoLogic::Exception::Base &e) {
         LogError("CryptoLogic failed with message: " << e.GetMessage());
         retCode = CKM_API_ERROR_SERVER_ERROR;

diff --git a/src/manager/service/ckm-logic.h b/src/manager/service/ckm-logic.h
index 92025ad..912f44c 100644 (file)
--- a/src/manager/service/ckm-logic.h
+++ b/src/manager/service/ckm-logic.h
@@ -113,7 +113,9 @@ public:
         const Credentials &cred,
         int commandId,
         const Name &name,
-        const Label &label);
+        const Label &label,
+        const Password &keyPassword,
+        const Password &certPassword);
 
     RawBuffer getDataList(
         const Credentials &cred,
@@ -235,6 +237,8 @@ private:
         const Credentials &cred,
         const Name &name,
         const Label &label,
+        const Password &keyPassword,
+        const Password &certPassword,
         KeyShPtr & privKey,
         CertificateShPtr & cert,
         CertificateShPtrVector & caChain);

diff --git a/src/manager/service/ckm-service.cpp b/src/manager/service/ckm-service.cpp
index 9617b79..79c08d7 100644 (file)
--- a/src/manager/service/ckm-service.cpp
+++ b/src/manager/service/ckm-service.cpp
@@ -241,12 +241,19 @@ RawBuffer CKMService::processStorage(Credentials &cred, MessageBuffer &buffer)
         }
         case LogicCommand::GET_PKCS12:
         {
-            buffer.Deserialize(name, label);
+            Password passKey;
+            Password passCert;
+            buffer.Deserialize(name,
+                               label,
+                               passKey,
+                               passCert);
             return m_logic->getPKCS12(
                 cred,
                 msgID,
                 name,
-                label);
+                label,
+                passKey,
+                passCert);
         }
         case LogicCommand::GET_LIST:
         {