ADD_DEFINITIONS("-DBUILD_TYPE_DEBUG")
ENDIF (CMAKE_BUILD_TYPE MATCHES "DEBUG")
-IF (PROFILE_TARGET MATCHES "WEARABLE")
- MESSAGE("PROFILE_TARGET_WEARABLE DEFINED")
- ADD_DEFINITIONS("-DPROFILE_TARGET_WEARABLE")
-ENDIF (PROFILE_TARGET MATCHES "WEARABLE")
+IF (DEFINED PASSWORD_PROTECTION_DISABLE)
+ MESSAGE("PASSWORD_PROTECTION_DISABLE ENABLED !")
+ ADD_DEFINITIONS("-DPASSWORD_PROTECTION_DISABLE")
+ENDIF (DEFINED PASSWORD_PROTECTION_DISABLE)
-IF (FORM_FACTOR MATCHES "CIRCLE")
- MESSAGE("FORM_FACTOR_CIRCLE DEFINED")
- ADD_DEFINITIONS("-DFORM_FACTOR_CIRCLE")
-ENDIF (FORM_FACTOR MATCHES "CIRCLE")
+IF (DEFINED DB_PER_ZONE_ENABLE)
+ MESSAGE("DB_PER_ZONE ENABLED !")
+ ADD_DEFINITIONS("-DDB_PER_ZONE_ENABLE")
+ENDIF (DEFINED DB_PER_ZONE_ENABLE)
IF (DEFINED SYSTEMD_ENV_FILE)
ADD_DEFINITIONS(-DSYSTEMD_ENV_FILE="${SYSTEMD_ENV_FILE}")
SET(TARGET_PASSWORD_PLUGIN "security-server-plugin")
SET(TARGET_TEST_MERGED "ckm-tests-internal")
+SET(TARGET_TEST_LCOV "ckm-tests-lcov-internal")
INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/data/scripts/230.key-manager-migrate-dkek.patch.sh
DESTINATION /etc/opt/upgrade
ADD_SUBDIRECTORY(src)
ADD_SUBDIRECTORY(build)
ADD_SUBDIRECTORY(systemd)
+
+IF (DEFINED CKM_BUILD_INTERNAL_TEST)
ADD_SUBDIRECTORY(tests)
ADD_SUBDIRECTORY(tools)
+ENDIF (DEFINED CKM_BUILD_INTERNAL_TEST)
Name: key-manager
Description: Central Key Manager Package
Version: @VERSION@
-Requires: openssl libsmack
+Requires: openssl
Libs: -L${libdir} -lkey-manager-client -lkey-manager-common -lkey-manager-control-client
Cflags: -I${includedir}/ckm
-- isolate old data
ALTER TABLE PERMISSION_TABLE RENAME TO OLD_PERMISSION_TABLE;
DROP INDEX perm_index_idx;
+DROP INDEX ckm_index_label;
-- create new structure
-- isolate old data
DROP INDEX perm_index_idx;
+DROP INDEX name_index_idx;
-- create new structure
CREATE TABLE SCHEMA_INFO(name TEXT PRIMARY KEY NOT NULL,
value TEXT);
ALTER TABLE NAME_TABLE RENAME TO NAMES;
+CREATE INDEX name_index_idx ON NAMES(idx);
-- need to create OBJECT table from scratch,
-- as SQLite does not support "ALTER COLUMN"
-- (REFERENCES NAME_TABLE --> NAMES)
#ifndef __TIZEN_CORE_KEY_MANAGER_CONTROL_DOC_H__
#define __TIZEN_CORE_KEY_MANAGER_CONTROL_DOC_H__
/**
- * @internal
* @ingroup CAPI_KEY_MANAGER_MODULE
* @defgroup CAPI_KEY_MANAGER_CONTROL_MODULE Key Manager Control
* @brief These APIs control the key manager state (Unlocked/Locked) and reflects the user's password change.
* Alias Format
* - The format of alias is "package_id name".
* - If package_id is not provided by a client, the key-manager will add the package_id of the client to the name internally.
- * - Alias should not include whitespace except the case of using as delimiter between package_id and name.
- * - If the client use "package_id name" format of alias when saving something in key-manager, the client should use package_id of the client itself.
- If the client doesn't, key-manager will return error code related to input parameter error.
+ * - The client can specify only its own package id in the alias when storing a key, certificate, or data.
* - A client should specify the package id of the owner in the alias to retrieve a a key, certificate, or data shared by other applications.
* - Aliases are returned as the format of "package_id name" from the key-manager.
*
+++ /dev/null
-/*
- * Copyright (c) 2014 Samsung Electronics Co., Ltd All Rights Reserved
- *
- * Licensed under the Apache License, Version 2.0 (the License);
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an AS IS BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef __TIZEN_CORE_KEY_MANAGER_CLIENT_DOC_H__
-#define __TIZEN_CORE_KEY_MANAGER_CLIENT_DOC_H__
-/**
- * @ingroup CAPI_KEY_MANAGER_MODULE
- * @defgroup CAPI_KEY_MANAGER_CLIENT_MODULE Key Manager Client
- * @brief It provides APIs accessing on the secure repository and additional secure cryptographic operations.
- *
- * @section CAPI_KEY_MANAGER_CLIENT_MODULE_HEADER Required Header
- * \#include <ckmc/ckmc-manager.h>
- *
- * @section CAPI_KEY_MANAGER_CLIENT_MODULE_OVERVIEW Overview
- * It provides APIs for storing, getting, and removing APIs for keys, certificates, and sensitive data on/from the Key Manager secure repository which is protected by a user’s passwords.
- * Additionally, it provides secure cryptographic operations for non-exportable keys without revealing key values to clients.
- */
-
-#endif /* __TIZEN_CORE_KEY_MANAGER_CLIENT_DOC_H__ */
+++ /dev/null
-/*
- * Copyright (c) 2014 Samsung Electronics Co., Ltd All Rights Reserved
- *
- * Licensed under the Apache License, Version 2.0 (the License);
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an AS IS BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef __TIZEN_CORE_KEY_MANAGER_CONTROL_DOC_H__
-#define __TIZEN_CORE_KEY_MANAGER_CONTROL_DOC_H__
-/**
- * @internal
- * @ingroup CAPI_KEY_MANAGER_MODULE
- * @defgroup CAPI_KEY_MANAGER_CONTROL_MODULE Key Manager Control
- * @brief These APIs control the key manager state (Unlocked/Locked) and reflects the user's password change.
- *
- * @section CAPI_KEY_MANAGER_CONTROL_MODULE_HEADER Required Header
- * \#include <ckmc/ckmc-control.h>
- *
- * @section CAPI_KEY_MANAGER_CONTROL_MODULE_OVERVIEW Overview
- * It provides APIs encrypting, decrypting, and re-encrypting a DKEK (with which a user's data file is encrypted).
- * When a user logs in for the first time, the DKEK will be generated randomly.
- */
-
-#endif /* __TIZEN_CORE_KEY_MANAGER_CONTROL_DOC_H__ */
+++ /dev/null
-/*
- * Copyright (c) 2014 Samsung Electronics Co., Ltd All Rights Reserved
- *
- * Licensed under the Apache License, Version 2.0 (the License);
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an AS IS BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef __TIZEN_CORE_KEY_MANAGER_TYPES_DOC_H__
-#define __TIZEN_CORE_KEY_MANAGER_TYPES_DOC_H__
-/**
- * @ingroup CAPI_KEY_MANAGER_MODULE
- * @defgroup CAPI_KEY_MANAGER_TYPES_MODULE Key Manager Data Types
- * @brief It defines data types used in these APIs and provides utility methods handling them.
- *
- * @section CAPI_KEY_MANAGER_TYPES_MODULE_HEADER Required Header
- * \#include <ckmc/ckmc-type.h>
- *
- * @section CAPI_KEY_MANAGER_TYPES_MODULE_OVERVIEW Overview
- * It defines data types for key, certificate,raw buffer, and linked list used in these APIs.
- * It also provides new and free methods for them.
- *
- */
-
-#endif /* __TIZEN_CORE_KEY_MANAGER_TYPES_DOC_H__ */
+++ /dev/null
-/*
- * Copyright (c) 2014 Samsung Electronics Co., Ltd All Rights Reserved
- *
- * Licensed under the Apache License, Version 2.0 (the License);
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an AS IS BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef __TIZEN_CORE_KEY_MANAGER_DOC_H__
-#define __TIZEN_CORE_KEY_MANAGER_DOC_H__
-/**
- * @ingroup CAPI_SECURITY_FRAMEWORK
- * @defgroup CAPI_KEY_MANAGER_MODULE Key Manager
- * @brief The key manager provides a secure repository protected by a user’s passwords for keys, certificates, and sensitive data of users and/or their APPs.
- * Additionally, the key manager provides secure cryptographic operations for non-exportable keys without revealing key values to clients.
- *
- * @section CAPI_KEY_MANAGER_MODULE_OVERVIEW Overview
- * <table>
- * <tr><th>API</th><th>Description</th></tr>
- * <tr>
- * <td> @ref CAPI_KEY_MANAGER_CLIENT_MODULE</td>
- * <td> Provides APIs for accessing the secure repository and additional secure cryptographic operations.</td>
- * </tr>
- * <tr>
- * <td> @ref CAPI_KEY_MANAGER_TYPES_MODULE</td>
- * <td> Defines data types used in these APIs and provides utility methods handling them.</td>
- * </tr>
- * </table>
- *
- * It provides a secure repository for keys, certificates, and sensitive data of users and/or their APPs which are protected by a user’s passwords.
- * Additionally, it provides secure cryptographic operations for non-exportable keys without revealing key values to clients.
- *
- * @image html capi_key_manager_overview_diagram.png
- *
- * The key manager provides 2 types of API.
- * - secure repository APIs : These APIs provides storing, retrieving, and removing functions for keys, certificates, and data.
- * - secure crypto APIs : These APIs provides additional cryptographic operations (create asymmetric key pair, sign/verify signature, verify certificate).
- *
- * Data Store Policy:
- * A client can specify simple access rules when storing a data in Key Manager.
- * - Exportable/Non-Exportable:
- * Only for data tagged as exportable, Key Manager returns the raw value of the data.
- * If data is tagged as non-exportable, Key Manager does not return its raw value.
- * In that case, Key Manager provides secure cryptographic operations for non-exportable keys without revealing key values to clients.
- * - Per Key Password:
- * All data in Key Manager is protected by a user’s password.
- * Besides, a client can encrypt its data using its own password additionally.
- * If a client provides a password when storing a data, the data will be encrypted with the password.
- * This password should be provided when get the data from Key Manager.
- *
- * User Login/Logout and Data Protection
- * - When a user logs in, logs out or changes his/her password, Key Manager should know about it.
- * Privileged APPs such as LockScreen APP or Setting APP can notify the key manager using these control APIs.
- * - When a user logs in, the key manager decrypts the user's DKEK (with which a user's data file is encrypted) with a user password.
- * So during the login period, any client can access its data which is protected by a user's password.
- * "user key" in API means DKEK.
- * - When a user logs out, the key manager removes the user's DKEK from memory.
- * Therefore, clients cannot access any data.
- * - When a user changes his/her password, the key manager re-encrypts the user's DKEK with the new password.
- *
- * Data Access Control
- * - By default, only the owner of a data can access to the data.
- * - If the owner grants the access to other applications, those applications can read or delete the data from key-manager DB.
- * - When an application is deleted, the data and access control information granted by the application are also removed.
- *
- * Alias Format
- * - The format of alias is "package_id name".
- * - If package_id is not provided by a client, the key-manager will add the package_id of the client to the name internally.
- * - Alias should not include whitespace except the case of using as delimiter between package_id and name.
- * - If the client use "package_id name" format of alias when saving something in key-manager, the client should use package_id of the client itself.
- If the client doesn't, key-manager will return error code related to input parameter error.
- * - A client should specify the package id of the owner in the alias to retrieve a a key, certificate, or data shared by other applications.
- * - Aliases are returned as the format of "package_id name" from the key-manager.
- *
- */
-
-#endif /* __TIZEN_CORE_KEY_MANAGER_DOC_H__ */
+++ /dev/null
-<manifest>
- <define>
- <domain name="key-manager-listener" />
- <request>
- <smack request="pkgmgr::info" type="r" />
- <smack request="pkgmgr::db" type="rlx" />
- <smack request="ail::db" type="rlx" />
- </request>
- </define>
- <request>
- <domain name="key-manager-listener" />
- </request>
-</manifest>
<domain name="key-manager"/>
<request>
<smack request="system::use_internet" type="w"/>
+ <smack request="device::app_logging" type="rw"/>
+ <smack request="device::sys_logging" type="rw"/>
+ <smack request="security-server" type="rx"/>
+ <smack request="sys-assert::core" type="rwxat"/>
+ <smack request="pkgmgr::info" type="r" />
+ <smack request="pkgmgr::db" type="rlx" />
+ <smack request="key-manager::api-control" type="w"/>
+ <smack request="ca-certificates::ssl-certs" type="rx"/>
+ <smack request="systemd" type="rx"/>
+ <smack request="connman" type="w"/>
</request>
<permit>
<smack permit="system::use_internet" type="w"/>
+ <smack permit="connman" type="w"/>
</permit>
</define>
<request>
<domain name="key-manager" />
</request>
<assign>
- <filesystem path="/etc/opt/upgrade/230.key-manager-migrate-dkek.patch.sh" label="_" exec_label="_"/>
+ <filesystem path="/etc/opt/upgrade/230.key-manager-migrate-dkek.patch.sh" label="_" exec_label="none"/>
+ <filesystem path="/opt/data/ckm" label="key-manager" type="transmutable"/>
</assign>
</manifest>
+%define ckm_build_internal_test 0
+
Name: key-manager
Summary: Central Key Manager and utilities
Version: 0.1.13
License: Apache-2.0 and BSL-1.0 and PD
Source0: %{name}-%{version}.tar.gz
Source1001: key-manager.manifest
-Source1002: key-manager-listener.manifest
-Source1003: libkey-manager-client.manifest
-Source1004: libkey-manager-common.manifest
+Source1002: libkey-manager-client.manifest
+Source1003: libkey-manager-common.manifest
BuildRequires: cmake
-BuildRequires: zip
-BuildRequires: pkgconfig(dlog)
BuildRequires: pkgconfig(openssl)
-BuildRequires: libattr-devel
-BuildRequires: pkgconfig(libsmack)
BuildRequires: pkgconfig(libsystemd-daemon)
-BuildRequires: pkgconfig(libsystemd-journal)
+BuildRequires: pkgconfig(vasum)
+BuildRequires: pkgconfig(capi-system-info)
BuildRequires: boost-devel
-BuildRequires: pkgconfig(security-server)
-BuildRequires: model-build-features
+BuildRequires: pkgconfig(glib-2.0)
+BuildRequires: pkgconfig(pkgmgr)
Requires: libkey-manager-common = %{version}-%{release}
Requires(post): /sbin/ldconfig
Requires(postun): /sbin/ldconfig
for certificate and private/public keys. It gives API for
application to sign and verify (DSA/RSA/ECDSA) signatures.
-%package -n key-manager-listener
-License: Apache-2.0
-Summary: Package with listener daemon
-Group: System/Security
-BuildRequires: pkgconfig(glib-2.0)
-BuildRequires: pkgconfig(capi-appfw-package-manager)
-Requires: libkey-manager-client = %{version}-%{release}
-
-%description -n key-manager-listener
-Listener for central key manager. This daemon is responsible for
-receive notification from dbus about uninstall application
-and pass them to key-manager daemon.
-
%package -n libkey-manager-common
License: Apache-2.0
Summary: Central Key Manager (common libraries)
Group: Development/Libraries
+BuildRequires: pkgconfig(dlog)
+BuildRequires: pkgconfig(libcrypto)
+BuildRequires: pkgconfig(libsystemd-journal)
Requires(post): /sbin/ldconfig
Requires(postun): /sbin/ldconfig
License: Apache-2.0
Summary: Central Key Manager (client)
Group: Development/Libraries
+BuildRequires: pkgconfig(capi-base-common)
+BuildRequires: pkgconfig(security-server)
Requires: key-manager = %{version}-%{release}
Requires: libkey-manager-common = %{version}-%{release}
Requires(post): /sbin/ldconfig
Summary: Central Key Manager (client-devel)
Group: Development/Libraries
BuildRequires: pkgconfig(capi-base-common)
-Requires: pkgconfig(capi-base-common)
Requires: libkey-manager-client = %{version}-%{release}
%description -n libkey-manager-client-devel
Central Key Manager package (client-devel)
+%if 0%{?ckm_build_internal_test}
%package -n key-manager-tests
License: Apache-2.0 and BSL-1.0
Summary: Internal test for key-manager
Group: Development
-Requires: boost-test
+BuildRequires: boost-test
Requires: key-manager = %{version}-%{release}
%description -n key-manager-tests
Internal test for key-manager implementation.
+%endif
%prep
%setup -q
cp -a %{SOURCE1001} .
cp -a %{SOURCE1002} .
cp -a %{SOURCE1003} .
-cp -a %{SOURCE1004} .
%build
export CFLAGS="$CFLAGS -DTIZEN_DEBUG_ENABLE"
export CXXFLAGS="$CXXFLAGS -DTIZEN_DEBUG_ENABLE"
export FFLAGS="$FFLAGS -DTIZEN_DEBUG_ENABLE"
+
export LDFLAGS+="-Wl,--rpath=%{_libdir},-Bsymbolic-functions "
+# password protection enabled
+%define ckm_password_protection_disable 0
+# zone disabled on 2.4
+%define ckm_db_per_zone_enable 0
%cmake . -DVERSION=%{version} \
-DCMAKE_BUILD_TYPE=%{?build_type:%build_type}%{!?build_type:RELEASE} \
-DCMAKE_VERBOSE_MAKEFILE=ON \
-%if "%{?tizen_profile_name}" == "wearable"
- -DPROFILE_TARGET=WEARABLE \
+%if 0%{?ckm_password_protection_disable}
+ -DPASSWORD_PROTECTION_DISABLE=1 \
%endif
-%if "%{?model_build_feature_formfactor}" == "circle"
- -DFORM_FACTOR=CIRCLE \
+%if 0%{?ckm_db_per_zone_enable}
+ -DDB_PER_ZONE_ENABLE=1 \
+%endif
+%if 0%{?ckm_build_internal_test}
+ -DCKM_BUILD_INTERNAL_TEST=1 \
%endif
-DSYSTEMD_UNIT_DIR=%{_unitdir} \
-DSYSTEMD_ENV_FILE="/etc/sysconfig/central-key-manager"
cp LICENSE.BSL-1.0 %{buildroot}/usr/share/license/%{name}.BSL-1.0
cp LICENSE %{buildroot}/usr/share/license/libkey-manager-client
cp LICENSE %{buildroot}/usr/share/license/libkey-manager-control-client
-mkdir -p %{buildroot}/etc/security/
mkdir -p %{buildroot}/usr/share/ckm/scripts
cp data/scripts/*.sql %{buildroot}/usr/share/ckm/scripts
+
+%if 0%{?ckm_build_internal_test}
mkdir -p %{buildroot}/usr/share/ckm-db-test
cp tests/testme_ver1.db %{buildroot}/usr/share/ckm-db-test/
cp tests/testme_ver2.db %{buildroot}/usr/share/ckm-db-test/
+%endif
%make_install
mkdir -p %{buildroot}%{_unitdir}/multi-user.target.wants
mkdir -p %{buildroot}%{_unitdir}/sockets.target.wants
ln -s ../central-key-manager.service %{buildroot}%{_unitdir}/multi-user.target.wants/central-key-manager.service
-ln -s ../central-key-manager-listener.service %{buildroot}%{_unitdir}/multi-user.target.wants/central-key-manager-listener.service
ln -s ../central-key-manager-api-control.socket %{buildroot}%{_unitdir}/sockets.target.wants/central-key-manager-api-control.socket
ln -s ../central-key-manager-api-storage.socket %{buildroot}%{_unitdir}/sockets.target.wants/central-key-manager-api-storage.socket
ln -s ../central-key-manager-api-ocsp.socket %{buildroot}%{_unitdir}/sockets.target.wants/central-key-manager-api-ocsp.socket
+mkdir -p %{buildroot}/opt/data/ckm
%clean
rm -rf %{buildroot}
%postun -n libkey-manager-common -p /sbin/ldconfig
-%post -n key-manager-listener
-systemctl daemon-reload
-if [ $1 = 1 ]; then
- # installation
- systemctl start central-key-manager-listener.service
-fi
-if [ $1 = 2 ]; then
- # update
- systemctl restart central-key-manager-listener.service
-fi
-
-%preun -n key-manager-listener
-if [ $1 = 0 ]; then
- # unistall
- systemctl stop central-key-manager-listener.service
-fi
-
-%postun -n key-manager-listener
-if [ $1 = 0 ]; then
- # unistall
- systemctl daemon-reload
-fi
%files -n key-manager
%manifest key-manager.manifest
+%defattr(-,system,system,-)
%{_bindir}/key-manager
%{_unitdir}/multi-user.target.wants/central-key-manager.service
%{_unitdir}/central-key-manager.service
-%{_unitdir}/central-key-manager.target
%{_unitdir}/sockets.target.wants/central-key-manager-api-control.socket
%{_unitdir}/central-key-manager-api-control.socket
%{_unitdir}/sockets.target.wants/central-key-manager-api-storage.socket
%{_unitdir}/central-key-manager-api-ocsp.socket
%{_datadir}/license/%{name}
%{_datadir}/license/%{name}.BSL-1.0
-%{_datadir}/ckm/scripts/*.sql
-%attr(444, root, root) %{_datadir}/ckm/scripts/*.sql
+%attr(444, system, system) %{_datadir}/ckm/scripts/*.sql
/etc/opt/upgrade/230.key-manager-migrate-dkek.patch.sh
-
-%files -n key-manager-listener
-%manifest key-manager-listener.manifest
-%{_bindir}/key-manager-listener
-%{_unitdir}/multi-user.target.wants/central-key-manager-listener.service
-%{_unitdir}/central-key-manager-listener.service
+%attr(700, system, system) /opt/data/ckm
%files -n libkey-manager-common
%manifest libkey-manager-common.manifest
+%defattr(-,system,system,-)
%{_libdir}/libkey-manager-common.so.*
%files -n libkey-manager-client
%manifest libkey-manager-client.manifest
+%defattr(-,system,system,-)
%{_libdir}/libkey-manager-client.so.*
%{_libdir}/libkey-manager-control-client.so.*
%{_libdir}/libsecurity-server-plugin.so*
%{_datadir}/license/libkey-manager-control-client
%files -n libkey-manager-client-devel
-%defattr(-,root,root,-)
+%defattr(-,system,system,-)
%{_libdir}/libkey-manager-client.so
%{_libdir}/libkey-manager-control-client.so
%{_libdir}/libkey-manager-common.so
%{_includedir}/ckm/ckm/ckm-password.h
%{_includedir}/ckm/ckm/ckm-pkcs12.h
%{_includedir}/ckm/ckm/ckm-raw-buffer.h
+%{_includedir}/ckm/ckm/ckm-client-info.h
%{_includedir}/ckm/ckm/ckm-type.h
%{_includedir}/ckm/ckmc/ckmc-manager.h
%{_includedir}/ckm/ckmc/ckmc-control.h
%{_includedir}/ckm/ckmc/ckmc-type.h
%{_libdir}/pkgconfig/*.pc
+%if 0%{?ckm_build_internal_test}
%files -n key-manager-tests
-%defattr(-,root,root,-)
+%defattr(-,system,system,-)
%{_bindir}/ckm-tests-internal
+%{_bindir}/ckm-tests-lcov-internal
%{_datadir}/ckm-db-test/testme_ver1.db
%{_datadir}/ckm-db-test/testme_ver2.db
%{_bindir}/ckm_so_loader
+%endif
PKG_CHECK_MODULES(KEY_MANAGER_DEP
- dlog
+ REQUIRED
openssl
- libsmack
- libcrypto
libsystemd-daemon
- capi-base-common
+ vasum
+ capi-system-info
+ glib-2.0
+ dlog
+ pkgmgr
+ )
+
+PKG_CHECK_MODULES(KEY_MANAGER_CLIENT_DEP
REQUIRED
+ capi-base-common
)
+
FIND_PACKAGE(Threads REQUIRED)
SET(KEY_MANAGER_SRC_PATH ${PROJECT_SOURCE_DIR}/src)
${KEY_MANAGER_PATH}/main/generic-socket-manager.cpp
${KEY_MANAGER_PATH}/main/socket-manager.cpp
${KEY_MANAGER_PATH}/main/key-manager-main.cpp
- ${KEY_MANAGER_PATH}/main/smack-check.cpp
${KEY_MANAGER_PATH}/service/certificate-store.cpp
${KEY_MANAGER_PATH}/service/certificate-config.cpp
${KEY_MANAGER_PATH}/service/digest.cpp
${KEY_MANAGER_PATH}/service/db-crypto.cpp
${KEY_MANAGER_PATH}/service/ocsp-service.cpp
${KEY_MANAGER_PATH}/service/ocsp-logic.cpp
+ ${KEY_MANAGER_PATH}/listener/listener-thread.cpp
${KEY_MANAGER_PATH}/dpl/core/src/assert.cpp
${KEY_MANAGER_PATH}/dpl/db/src/sql_connection.cpp
${KEY_MANAGER_PATH}/dpl/db/src/naive_synchronization_object.cpp
${KEY_MANAGER_PATH}/main
${KEY_MANAGER_PATH}/common
${KEY_MANAGER_PATH}/service
+ ${KEY_MANAGER_PATH}/listener
${KEY_MANAGER_PATH}/sqlcipher
${KEY_MANAGER_PATH}/dpl/core/include
${KEY_MANAGER_PATH}/dpl/log/include
${CMAKE_THREAD_LIBS_INIT}
${KEY_MANAGER_DEP_LIBRARIES}
${TARGET_KEY_MANAGER_COMMON}
+ ${TARGET_KEY_MANAGER_CONTROL_CLIENT}
-ldl -pie
)
SET(KEY_MANAGER_CLIENT_ASYNC_SRC_PATH ${KEY_MANAGER_PATH}/client-async)
SET(KEY_MANAGER_CLIENT_CAPI_SRC_PATH ${KEY_MANAGER_PATH}/client-capi)
+INCLUDE_DIRECTORIES(SYSTEM
+ ${KEY_MANAGER_CLIENT_DEP_INCLUDE_DIRS}
+ )
+
INCLUDE_DIRECTORIES(
${KEY_MANAGER_PATH}/client
${KEY_MANAGER_PATH}/client-async
)
TARGET_LINK_LIBRARIES(${TARGET_KEY_MANAGER_CLIENT}
- ${KEY_MANAGER_DEP_LIBRARIES}
+ ${KEY_MANAGER_CLIENT_DEP_LIBRARIES}
${TARGET_KEY_MANAGER_COMMON}
)
)
TARGET_LINK_LIBRARIES(${TARGET_KEY_MANAGER_CONTROL_CLIENT}
- ${KEY_MANAGER_DEP_LIBRARIES}
+ ${KEY_MANAGER_CLIENT_DEP_LIBRARIES}
${TARGET_KEY_MANAGER_COMMON}
)
${KEY_MANAGER_SRC_PATH}/include/ckm/ckm-password.h
${KEY_MANAGER_SRC_PATH}/include/ckm/ckm-pkcs12.h
${KEY_MANAGER_SRC_PATH}/include/ckm/ckm-raw-buffer.h
+ ${KEY_MANAGER_SRC_PATH}/include/ckm/ckm-client-info.h
${KEY_MANAGER_SRC_PATH}/include/ckm/ckm-type.h
DESTINATION /usr/include/ckm/ckm
)
+
INSTALL(FILES
${KEY_MANAGER_SRC_PATH}/include/ckmc/ckmc-manager.h
${KEY_MANAGER_SRC_PATH}/include/ckmc/ckmc-control.h
################################################################################
ADD_SUBDIRECTORY(manager)
-ADD_SUBDIRECTORY(listener)
ADD_SUBDIRECTORY(plugin)
--- /dev/null
+/*
+ * Copyright (c) 2000 - 2013 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ *
+ *
+ * @file ckm-client-info.h
+ * @author Kyungwook Tak (k.tak@samsung.com)
+ * @version 1.0
+ * @brief ClientInfo implementation.
+ */
+#pragma once
+
+#include <string>
+
+#include <sys/types.h>
+
+#include <ckm/ckm-type.h>
+
+namespace CKM {
+
+// ClientInfo consists of (zone name & uid)
+class KEY_MANAGER_API ClientInfo {
+public:
+ ClientInfo() = delete;
+
+ ClientInfo(const uid_t uid);
+
+ ClientInfo(const std::string &zone, const uid_t uid);
+
+ virtual ~ClientInfo();
+
+ uid_t getUID() const;
+
+ ClientID getClientID() const;
+
+ std::string getZone() const;
+
+private:
+ const static std::string ZONE_DEFAULT;
+ const static std::string DELIMITER;
+ std::string m_zone;
+ uid_t m_uid;
+
+};
+
+
+} // namespace CKM
#include <memory>
#include <ckm/ckm-error.h>
+#include <ckm/ckm-client-info.h>
#include <ckm/ckm-type.h>
// Central Key Manager namespace
{
public:
// decrypt user key with password
- virtual int unlockUserKey(uid_t user, const Password &password) = 0;
+ virtual int unlockUserKey(const ClientInfo &clientInfo, const Password &password) = 0;
// remove user key from memory
- virtual int lockUserKey(uid_t user) = 0;
+ virtual int lockUserKey(const ClientInfo &clientInfo) = 0;
// remove user data from Store and erase key used for encryption
- virtual int removeUserData(uid_t user) = 0;
+ virtual int removeUserData(const ClientInfo &clientInfo) = 0;
// change password for user
- virtual int changeUserPassword(uid_t user, const Password &oldPassword, const Password &newPassword) = 0;
+ virtual int changeUserPassword(const ClientInfo &clientInfo, const Password &oldPassword, const Password &newPassword) = 0;
// This is work around for security-server api - resetPassword that may be called without passing oldPassword.
// This api should not be supported on tizen 3.0
// User must be already logged in and his DKEK is already loaded into memory in plain text form.
// The service will use DKEK in plain text and encrypt it in encrypted form (using new password).
- virtual int resetUserPassword(uid_t user, const Password &newPassword) = 0;
+ virtual int resetUserPassword(const ClientInfo &clientInfo, const Password &newPassword) = 0;
// Required for tizen 2.3.
// It will remove all application data owned by application identified
// by smackLabel. This function will remove application data from unlocked
// database only. This function may be used during application uninstallation.
- virtual int removeApplicationData(const std::string &smackLabel) = 0;
+ virtual int removeApplicationData(const std::string &zone, const Label &smackLabel) = 0;
virtual int updateCCMode() = 0;
- virtual int setPermission(uid_t user,
+ virtual int setPermission(const ClientInfo &clientInfo,
const Alias &alias,
const Label &accessor,
PermissionMask permissionMask) = 0;
/*! \brief indicating that files are corrupted or access to files was denied */
#define CKM_API_ERROR_FILE_SYSTEM -20
+/*! \brief indicating that device needed to run API is not supported */
+#define CKM_API_ERROR_NOT_SUPPORTED -21
+
#define CKM_API_OCSP_STATUS_GOOD (1<<0)
#define CKM_API_OCSP_STATUS_UNSUPPORTED (1<<1)
#define CKM_API_OCSP_STATUS_UNKNOWN (1<<2)
typedef std::vector<RawBuffer> RawBufferVector;
typedef std::string Alias;
typedef std::string Label;
+typedef std::string ClientID;
typedef std::vector<Alias> AliasVector;
enum class KeyType : int {
#endif
/**
- * @internal
* @addtogroup CAPI_KEY_MANAGER_CONTROL_MODULE
* @{
*/
* A decrypted user key exists only on memory. If this API is called for the first time, a
* user key will be generated internally.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel platform
* @privilege %http://tizen.org/privilege/keymanager.admin
*
/**
* @brief Removes a decrypted user key(DKEK) from memory
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel platform
* @privilege %http://tizen.org/privilege/keymanager.admin
*
/**
* @brief Removes user data from Store and erases a user key(DKEK) used for encryption.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel platform
* @privilege %http://tizen.org/privilege/keymanager.admin
*
* The key manager decrypts a user key (DKEK) with old password and re-encrypts a user key
* with new password.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel platform
* @privilege %http://tizen.org/privilege/keymanager.admin
*
/**
* @brief Changes a password for a user without old password.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel platform
* @privilege %http://tizen.org/privilege/keymanager.admin
*
int ckmc_reset_user_password(uid_t user, const char *new_password);
/**
+ * @deprecated, see ckmc_set_permission_by_adm()
* @brief Allows another application to access client's application data
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel platform
* @privilege %http://tizen.org/privilege/keymanager.admin
*
*
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
- * @see ckmc_allow_access()
- * @see ckmc_deny_access()
- * @see ckmc_deny_access_by_adm()
+ * @see ckmc_set_permission_by_adm()
+ * @see ckmc_set_permission()
*/
int ckmc_allow_access_by_adm(uid_t user,
const char *owner,
ckmc_access_right_e granted);
/**
+ * @brief Allows another application to access client's application data
+ *
+ * @since_tizen 3.0
+ * @privlevel platform
+ * @privilege %http://tizen.org/privilege/keymanager.admin
+ *
+ * @remarks Data identified by @a alias should exist
+ * @remarks @a alias must contain owner label (<owner label><ckmc_label_name_separator><name>)
+ *
+ * @param[in] user User ID of a user whose data will be affected
+ * @param[in] alias Data alias for which access will be granted
+ * @param[in] accessor Package id of the application that will gain access rights
+ * @param[in] permissions Mask of permissions granted for @a accessor application
+ * (@a ckmc_permission_e)
+ * (previous permission mask will be replaced with the new mask value)
+ *
+ * @return @c 0 on success, otherwise a negative error value
+ *
+ * @retval #CKMC_ERROR_NONE Successful
+ * @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
+ * @retval #CKMC_ERROR_DB_LOCKED A user key is not loaded in memory (a user is not logged
+ * in)
+ * @retval #CKMC_ERROR_DB_ALIAS_UNKNOWN Alias does not exist
+ * @retval #CKMC_ERROR_PERMISSION_DENIED Failed to access key manager
+ *
+ * @pre User is already logged in and the user key is already loaded into memory in plain text form.
+ *
+ * @see ckmc_set_permission()
+ */
+int ckmc_set_permission_by_adm(uid_t user, const char *alias, const char *accessor, int mask);
+
+
+/**
+ * @deprecated, see ckmc_set_permission_by_adm()
* @brief Revokes another application's access to client's application data
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel platform
* @privilege %http://tizen.org/privilege/keymanager.admin
*
*
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
- * @see ckmc_allow_access()
- * @see ckmc_deny_access()
- * @see ckmc_allow_access_by_adm()
+ * @see ckmc_set_permission()
+ * @see ckmc_set_permission_by_adm()
*/
int ckmc_deny_access_by_adm(uid_t user, const char *owner, const char *alias, const char *accessor);
/**
* @brief Enumeration for Key Manager Errors.
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*/
typedef enum{
CKMC_ERROR_INVALID_PARAMETER = TIZEN_ERROR_INVALID_PARAMETER, /**< Invalid function parameter */
CKMC_ERROR_OUT_OF_MEMORY = TIZEN_ERROR_OUT_OF_MEMORY, /**< Out of memory */
CKMC_ERROR_PERMISSION_DENIED = TIZEN_ERROR_PERMISSION_DENIED, /**< Permission denied */
+ CKMC_ERROR_NOT_SUPPORTED = TIZEN_ERROR_NOT_SUPPORTED, /**< Device needed to run API is not supported*/
CKMC_ERROR_SOCKET = TIZEN_ERROR_KEY_MANAGER | 0x01, /**< Socket error between client and Central Key Manager */
CKMC_ERROR_BAD_REQUEST = TIZEN_ERROR_KEY_MANAGER | 0x02, /**< Invalid request from client */
*
*
* @file ckmc-manager.h
- * @version 1.0
+ * @version 1.2
* @brief Provides management functions(storing, retrieving, and removing) for keys,
* certificates and data of a user and additional crypto functions.
*/
#define __TIZEN_CORE_CKMC_MANAGER_H
#include <stddef.h>
+#include <stdbool.h>
#include <sys/types.h>
#include <tizen.h>
-#include <ckmc/ckmc-type.h>
#include <ckmc/ckmc-error.h>
-
+#include <ckmc/ckmc-type.h>
#ifdef __cplusplus
extern "C" {
#endif
/**
* @brief Stores a key inside key manager based on the provided policy.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* @param[in] key The key's binary value to be stored
* @param[in] policy The policy about how to store a key securely
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
*
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
- * @see ckmc_remove_key()
+ * @see ckmc_remove_alias()
* @see ckmc_get_key()
* @see ckmc_get_key_alias_list()
+ * @see ckmc_key_free()
* @see #ckmc_key_s
* @see #ckmc_policy_s
*/
int ckmc_save_key(const char *alias, const ckmc_key_s key, const ckmc_policy_s policy);
/**
+ * @deprecated Deprecated since 2.4. [Use ckmc_remove_alias() instead]
* @brief Removes a key from key manager.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
*
* @param[in] alias The name of a key to be removed
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @see ckmc_save_key()
* @see ckmc_get_key()
* @see ckmc_get_key_alias_list()
+ * @see ckmc_remove_alias()
*/
int ckmc_remove_key(const char *alias);
/**
* @brief Gets a key from key manager.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* @param[in] alias The name of a key to retrieve
* @param[in] password The password used in decrypting a key value \n
* If password of policy is provided in ckmc_save_key(), the same password
- * should be provided.
- * @param[out] ppkey The pointer to a newly created ckmc_key_s handle
+ * should be provided
+ * @param[out] ppkey The pointer to a newly created #ckmc_key_s handle
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @retval #CKMC_ERROR_DB_ALIAS_UNKNOWN Alias does not exist
* @retval #CKMC_ERROR_PERMISSION_DENIED Failed to access key manager
* @retval #CKMC_ERROR_AUTHENTICATION_FAILED
- * Decryption failed because password is incorrect.
+ * Decryption failed because password is incorrect
*
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
* @see ckmc_save_key()
- * @see ckmc_remove_key()
+ * @see ckmc_remove_alias()
* @see ckmc_get_key_alias_list()
+ * @see ckmc_key_free()
+ * @see #ckmc_key_s
*/
int ckmc_get_key(const char *alias, const char *password, ckmc_key_s **ppkey);
/**
* @brief Gets all the alias of keys that the client can access.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* @remarks You must destroy the newly created @a ppalias_list by calling ckmc_alias_list_all_free()
* if it is no longer needed.
*
- * @param[out] ppalias_list The pointer to a newly created ckmc_alias_list_s handle containing all
+ * @param[out] ppalias_list The pointer to a newly created #ckmc_alias_list_s handle containing all
* available alias of keys \n
- * If there is no available key alias, *ppalias_list will be null.
+ * If there is no available key alias, @a *ppalias_list will be null
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
* @see ckmc_save_key()
- * @see ckmc_remove_key()
+ * @see ckmc_remove_alias()
* @see ckmc_get_key()
+ * @see ckmc_alias_list_all_free()
+ * @see #ckmc_alias_list_s
*/
int ckmc_get_key_alias_list(ckmc_alias_list_s** ppalias_list);
/**
* @brief Stores a certificate inside key manager based on the provided policy.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* @param[in] cert The certificate's binary value to be stored
* @param[in] policy The policy about how to store a certificate securely
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
*
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
- * @see ckmc_remove_cert()
+ * @see ckmc_remove_alias()
* @see ckmc_get_cert()
* @see ckmc_get_cert_alias_list()
* @see #ckmc_cert_s
int ckmc_save_cert(const char *alias, const ckmc_cert_s cert, const ckmc_policy_s policy);
/**
+ * @deprecated Deprecated since 2.4. [Use ckmc_remove_alias() instead]
* @brief Removes a certificate from key manager.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
*
* @param[in] alias The name of a certificate to be removed
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @see ckmc_save_cert()
* @see ckmc_get_cert()
* @see ckmc_get_cert_alias_list()
+ * @see ckmc_remove_alias()
*/
int ckmc_remove_cert(const char *alias);
/**
* @brief Gets a certificate from key manager.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* @param[in] alias The name of a certificate to retrieve
* @param[in] password The password used in decrypting a certificate value \n
* If password of policy is provided in ckmc_save_cert(), the same password
- * should be provided.
- * @param[out] ppcert The pointer to a newly created ckmc_cert_s handle
+ * should be provided
+ * @param[out] ppcert The pointer to a newly created #ckmc_cert_s handle
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @retval #CKMC_ERROR_DB_ALIAS_UNKNOWN Alias does not exists
* @retval #CKMC_ERROR_PERMISSION_DENIED Failed to access key manager
* @retval #CKMC_ERROR_AUTHENTICATION_FAILED
- * Decryption failed because password is incorrect.
+ * Decryption failed because password is incorrect
*
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
* @see ckmc_save_cert()
- * @see ckmc_remove_cert()
+ * @see ckmc_remove_alias()
* @see ckmc_get_cert_alias_list()
+ * @see #ckmc_cert_s
*/
int ckmc_get_cert(const char *alias, const char *password, ckmc_cert_s **ppcert);
/**
* @brief Gets all alias of certificates which the client can access.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* @remarks You must destroy the newly created @a ppalias_list by calling ckmc_alias_list_all_free()
* if it is no longer needed.
*
- * @param[out] ppalias_list The pointer to a newly created ckmc_alias_list_s handle containing all
+ * @param[out] ppalias_list The pointer to a newly created #ckmc_alias_list_s handle containing all
* available alias of keys \n
- * If there is no available key alias, *ppalias_list will be null.
+ * If there is no available key alias, @a *ppalias_list will be null
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
* @see ckmc_save_cert()
- * @see ckmc_remove_cert()
+ * @see ckmc_remove_alias()
* @see ckmc_get_cert()
+ * @see ckmc_alias_list_all_free()
+ * @see #ckmc_alias_list_s
*/
int ckmc_get_cert_alias_list(ckmc_alias_list_s** ppalias_list);
+
+/**
+ * @brief Stores PKCS12's contents inside key manager based on the provided policies.
+ * All items from the PKCS12 will use the same alias.
+ *
+ * @since_tizen 2.4
+ * @privlevel public
+ * @privilege %http://tizen.org/privilege/keymanager
+ *
+ * @param[in] alias The name of a data to be stored
+ * @param[in] pkcs Pointer to the pkcs12 structure to be saved
+ * @param[in] key_policy The policy about how to store pkcs's private key
+ * @param[in] cert_policy The policy about how to store pkcs's certificate
+ *
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
+ *
+ * @retval #CKMC_ERROR_NONE Successful
+ * @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
+ * @retval #CKMC_ERROR_DB_LOCKED A user key is not loaded in memory (a user is not logged
+ * in)
+ * @retval #CKMC_ERROR_DB_ALIAS_EXISTS Alias already exists
+ * @retval #CKMC_ERROR_DB_ERROR Failed due to a database error
+ * @retval #CKMC_ERROR_PERMISSION_DENIED Failed to access key manager
+ *
+ * @pre User is already logged in and the user key is already loaded into memory in plain text form.
+ *
+ * @see ckmc_remove_alias()
+ * @see ckmc_get_pkcs12()
+ * @see ckmc_get_data_alias_list()
+ * @see ckmc_pkcs12_load()
+ * @see #ckmc_pkcs12_s
+ * @see #ckmc_policy_s
+ */
+int ckmc_save_pkcs12(const char *alias,
+ const ckmc_pkcs12_s *pkcs,
+ const ckmc_policy_s key_policy,
+ const ckmc_policy_s cert_policy);
+
+/**
+ * @brief Gets a pkcs12 from key manager.
+ *
+ * @since_tizen 2.4
+ * @privlevel public
+ * @privilege %http://tizen.org/privilege/keymanager
+ *
+ * @remarks A client can access only data stored by the client.
+ * @remarks You must destroy the newly created @a pkcs12 by calling ckmc_pkcs12_free() if it is no
+ * longer needed.
+ *
+ * @param[in] alias The name of a data to retrieve
+ * @param[in] key_password Password that was used to encrypt privateKey (may be NULL)
+ * @param[in] cert_password Password used to encrypt certificates (may be NULL)
+ * @param[out] pkcs12 The pointer to a newly created #ckmc_pkcs12_s handle
+ *
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
+ *
+ * @retval #CKMC_ERROR_NONE Successful
+ * @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
+ * @retval #CKMC_ERROR_DB_LOCKED A user key is not loaded in memory (a user is not logged
+ * in)
+ * @retval #CKMC_ERROR_DB_ERROR Failed due to a database error
+ * @retval #CKMC_ERROR_DB_ALIAS_UNKNOWN Alias does not exist
+ * @retval #CKMC_ERROR_PERMISSION_DENIED Failed to access key manager
+ * @retval #CKMC_ERROR_AUTHENTICATION_FAILED
+ * keyPassword or certPassword does not match with password
+ * used to encrypt data
+ *
+ * @pre User is already logged in and the user key is already loaded into memory in plain text form.
+ *
+ * @see ckmc_save_pkcs12()
+ * @see ckmc_remove_alias()
+ * @see ckmc_pkcs12_free()
+ * @see #ckmc_pkcs12_s
+ */
+int ckmc_get_pkcs12(const char *alias, const char *key_password, const char *cert_password, ckmc_pkcs12_s **pkcs12);
+
/**
* @brief Stores a data inside key manager based on the provided policy.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* @param[in] data The binary value to be stored
* @param[in] policy The policy about how to store a data securely
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
*
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
- * @see ckmc_remove_data()
+ * @see ckmc_remove_alias()
* @see ckmc_get_data()
* @see ckmc_get_data_alias_list()
* @see #ckmc_raw_buffer_s
int ckmc_save_data(const char *alias, ckmc_raw_buffer_s data, const ckmc_policy_s policy);
/**
+ * @deprecated Deprecated since 2.4. [Use ckmc_remove_alias() instead]
* @brief Removes a data from key manager.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
*
* @param[in] alias The name of a data to be removed
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @see ckmc_save_data()
* @see ckmc_get_data()
* @see ckmc_get_data_alias_list()
+ * @see ckmc_remove_alias()
*/
int ckmc_remove_data(const char *alias);
/**
* @brief Gets a data from key manager.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* @param[in] alias The name of a data to retrieve
* @param[in] password The password used in decrypting a data value \n
* If password of policy is provided in ckmc_save_data(), the same password
- * should be provided.
- * @param[out] ppdata The pointer to a newly created ckmc_raw_buffer_s handle
+ * should be provided
+ * @param[out] ppdata The pointer to a newly created #ckmc_raw_buffer_s handle
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
* @see ckmc_save_data()
- * @see ckmc_remove_data()
+ * @see ckmc_remove_alias()
* @see ckmc_get_data_alias_list()
+ * @see ckmc_buffer_free()
+ * @see #ckmc_raw_buffer_s
*/
int ckmc_get_data(const char *alias, const char *password, ckmc_raw_buffer_s **ppdata);
/**
* @brief Gets all alias of data which the client can access.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* @remarks You must destroy the newly created @a ppalias_list by calling ckmc_alias_list_all_free()
* if it is no longer needed.
*
- * @param[out] ppalias_list The pointer to a newly created ckmc_alias_list_s handle containing all
+ * @param[out] ppalias_list The pointer to a newly created #ckmc_alias_list_s handle containing all
* available alias of keys \n
- * If there is no available key alias, *ppalias_list will be null.
+ * If there is no available key alias, @a *ppalias_list will be null
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
* @see ckmc_save_data()
- * @see ckmc_remove_data()
+ * @see ckmc_remove_alias()
* @see ckmc_get_data()
+ * @see ckmc_alias_list_all_free()
+ * @see #ckmc_alias_list_s
*/
int ckmc_get_data_alias_list(ckmc_alias_list_s** ppalias_list);
* @brief Creates RSA private/public key pair and stores them inside key manager based on each
* policy.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* in policy.
*
* @param[in] size The size of key strength to be created \n
- * @c 1024, @c 2048, and @c 4096 are supported.
+ * @c 1024, @c 2048, and @c 4096 are supported
* @param[in] private_key_alias The name of private key to be stored
* @param[in] public_key_alias The name of public key to be stored
* @param[in] policy_private_key The policy about how to store a private key securely
* @param[in] policy_public_key The policy about how to store a public key securely
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @see ckmc_create_key_pair_ecdsa()
* @see ckmc_create_signature()
* @see ckmc_verify_signature()
+ * @see #ckmc_policy_s
*/
int ckmc_create_key_pair_rsa(const size_t size,
const char *private_key_alias,
* @brief Creates DSA private/public key pair and stores them inside key manager based on each
* policy.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* in policy.
*
* @param[in] size The size of key strength to be created \n
- * @c 1024, @c 2048, @c 3072 and @c 4096 are supported.
+ * @c 1024, @c 2048, @c 3072 and @c 4096 are supported
* @param[in] private_key_alias The name of private key to be stored
* @param[in] public_key_alias The name of public key to be stored
* @param[in] policy_private_key The policy about how to store a private key securely
* @param[in] policy_public_key The policy about how to store a public key securely
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @see ckmc_create_key_pair_ecdsa()
* @see ckmc_create_signature()
* @see ckmc_verify_signature()
+ * @see #ckmc_policy_s
*/
int ckmc_create_key_pair_dsa(const size_t size,
const char *private_key_alias,
* @brief Creates ECDSA private/public key pair and stores them inside key manager based on each
* policy.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* @param[in] policy_private_key The policy about how to store a private key securely
* @param[in] policy_public_key The policy about how to store a public key securely
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @see ckmc_create_signature()
* @see ckmc_verify_signature()
* @see #ckmc_ec_type_e
+ * @see #ckmc_policy_s
*/
int ckmc_create_key_pair_ecdsa(const ckmc_ec_type_e type,
const char *private_key_alias,
/**
* @brief Creates a signature on a given message using a private key and returns the signature.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* @param[in] message The message that is signed with a private key
* @param[in] hash The hash algorithm used in creating signature
* @param[in] padding The RSA padding algorithm used in creating signature \n
- * It is used only when the signature algorithm is RSA.
+ * It is used only when the signature algorithm is RSA
* @param[out] ppsignature The pointer to a newly created signature \n
- * If an error occurs, @a *ppsignature will be null.
+ * If an error occurs, @a *ppsignature will be null
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @retval #CKMC_ERROR_DB_ALIAS_UNKNOWN Alias does not exist
* @retval #CKMC_ERROR_PERMISSION_DENIED Failed to access key manager
* @retval #CKMC_ERROR_AUTHENTICATION_FAILED
- * Decryption failed because password is incorrect.
+ * Decryption failed because password is incorrect
*
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
* @see ckmc_create_key_pair_ecdsa()
* @see ckmc_verify_signature()
* @see ckmc_buffer_free()
+ * @see #ckmc_raw_buffer_s
* @see #ckmc_hash_algo_e
* @see #ckmc_rsa_padding_algo_e
*/
* @brief Verifies a given signature on a given message using a public key and returns the signature
* status.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* @param[in] signature The signature that is verified with public key
* @param[in] hash The hash algorithm used in verifying signature
* @param[in] padding The RSA padding algorithm used in verifying signature \n
- * It is used only when the signature algorithm is RSA.
+ * It is used only when the signature algorithm is RSA
*
- * @return @c 0 on success and the signature is valid,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success and the signature is valid, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_VERIFICATION_FAILED The signature is invalid
* @retval #CKMC_ERROR_DB_ALIAS_UNKNOWN Alias does not exist
* @retval #CKMC_ERROR_PERMISSION_DENIED Failed to access key manager
* @retval #CKMC_ERROR_AUTHENTICATION_FAILED
- * Decryption failed because password is incorrect.
+ * Decryption failed because password is incorrect
*
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
* @see ckmc_create_key_pair_rsa()
+ * @see ckmc_create_key_pair_dsa()
* @see ckmc_create_key_pair_ecdsa()
- * @see ckmc_verify_signature()
+ * @see #ckmc_raw_buffer_s
* @see #ckmc_hash_algo_e
* @see #ckmc_rsa_padding_algo_e
*/
/**
* @brief Verifies a certificate chain and returns that chain.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* @remarks You must destroy the newly created @a ppcert_chain_list by calling
* ckmc_cert_list_all_free() if it is no longer needed.
*
- * @param[in] cert The certificate to be verified
- * @param[in] untrustedcerts The untrusted CA certificates to be used in verifying a certificate
+ * @param[in] cert The certificate to be verified
+ * @param[in] untrustedcerts The untrusted CA certificates to be used in verifying a certificate
* chain
* @param[out] ppcert_chain_list The pointer to a newly created certificate chain's handle \n
- * If an error occurs, @a *ppcert_chain_list will be null.
+ * If an error occurs, @a *ppcert_chain_list will be null
*
- * @return @c 0 on success and the signature is valid,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success and the signature is valid, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_VERIFICATION_FAILED The certificate chain is not valid
* @retval #CKMC_ERROR_INVALID_FORMAT The format of certificate is not valid
* @retval #CKMC_ERROR_PERMISSION_DENIED Failed to access key manager
* @retval #CKMC_ERROR_AUTHENTICATION_FAILED
- * Decryption failed because password is incorrect.
+ * Decryption failed because password is incorrect
*
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
* @see ckmc_get_cert_chain_with_alias())
* @see ckmc_cert_list_all_free()
+ * @see #ckmc_cert_list_s
*/
int ckmc_get_cert_chain(const ckmc_cert_s *cert,
const ckmc_cert_list_s *untrustedcerts,
ckmc_cert_list_s **ppcert_chain_list);
/**
+ * @deprecated Deprecated since 2.4. [Use ckmc_get_cert_chain() instead]
* @brief Verifies a certificate chain using an alias list of untrusted certificates and return that
* chain.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
* storage.
* @remarks You must destroy the newly created @a ppcert_chain_list by calling
* ckmc_cert_list_all_free() if it is no longer needed.
+ * @remarks @a untrustedcerts shouldn't be protected with optional password.
*
- * @param[in] cert The certificate to be verified
- * @param[in] untrustedcerts The alias list of untrusted CA certificates stored in key manager
+ * @param[in] cert The certificate to be verified
+ * @param[in] untrustedcerts The alias list of untrusted CA certificates stored in key manager
* to be used in verifying a certificate chain
* @param[out] ppcert_chain_list The pointer to a newly created certificate chain's handle \n
- * If an error occurs, @a *ppcert_chain_list will be null.
+ * If an error occurs, @a *ppcert_chain_list will be null
*
- * @return @c 0 on success and the signature is valid,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success and the signature is valid, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_VERIFICATION_FAILED The certificate chain is not valid
* @retval #CKMC_ERROR_PERMISSION_DENIED Failed to access key manager
* @retval #CKMC_ERROR_AUTHENTICATION_FAILED
* Some certificates were encrypted with password and could not
- * be used.
+ * be used
*
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
* @see ckmc_get_cert_chain()
* @see ckmc_cert_list_all_free()
+ * @see #ckmc_cert_s
+ * @see #ckmc_alias_list_s
+ * @see #ckmc_cert_list_s
*/
int ckmc_get_cert_chain_with_alias(const ckmc_cert_s *cert,
const ckmc_alias_list_s *untrustedcerts,
ckmc_cert_list_s **ppcert_chain_list);
+/**
+ * @brief Verifies a certificate chain and returns that chain using user entered trusted and
+ * untrusted CA certificates.
+ *
+ * @since_tizen 2.4
+ * @privlevel public
+ * @privilege %http://tizen.org/privilege/keymanager
+ *
+ * @remarks If the trusted root certificates are provided as a user input, these certificates do not
+ * need to exist in the system's certificate storage.
+ * @remarks You must destroy the newly created @a ppcert_chain_list by calling
+ * ckmc_cert_list_all_free() if it is no longer needed.
+ *
+ * @param[in] cert The certificate to be verified
+ * @param[in] untrustedcerts The untrusted CA certificates to be used in verifying a
+ * certificate chain
+ * @param[in] trustedcerts The trusted CA certificates to be used in verifying a
+ * certificate chain
+ * @param[in] use_trustedsystemcerts The flag indicating the use of the trusted root certificates
+ * in the system's certificate storage
+ * @param[out] ppcert_chain_list The pointer to a newly created certificate chain's handle \n
+ * If an error occurs, @a *ppcert_chain_list will be null
+ *
+ * @return #CKMC_ERROR_NONE on success and the signature is valid, otherwise a negative error value
+ *
+ * @retval #CKMC_ERROR_NONE Successful
+ * @retval #CKMC_ERROR_VERIFICATION_FAILED The certificate chain is not valid
+ * @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
+ * @retval #CKMC_ERROR_DB_LOCKED A user key is not loaded in memory (a user is not logged
+ * in)
+ * @retval #CKMC_ERROR_DB_ERROR Failed due to the error with unknown reason
+ * @retval #CKMC_ERROR_INVALID_FORMAT The format of certificate is not valid
+ * @retval #CKMC_ERROR_PERMISSION_DENIED Failed to access key manager
+ *
+ * @pre User is already logged in and the user key is already loaded into memory in plain text form.
+ *
+ * @see ckmc_cert_list_all_free()
+ * @see #ckmc_cert_s
+ * @see #ckmc_cert_list_s
+ */
+int ckmc_get_cert_chain_with_trustedcert(const ckmc_cert_s *cert,
+ const ckmc_cert_list_s *untrustedcerts,
+ const ckmc_cert_list_s *trustedcerts,
+ const bool use_trustedsystemcerts,
+ ckmc_cert_list_s **ppcert_chain_list);
+
+/**
+ * @brief Perform OCSP which checks certificate is whether revoked or not.
+ *
+ * @since_tizen 2.4
+ * @privlevel public
+ * @privilege %http://tizen.org/privilege/keymanager
+ *
+ * @param[in] pcert_chain_list Valid certificate chain to perform OCSP check
+ * @param[out] ocsp_status The pointer to status result of OCSP check
+ *
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
+ *
+ * @retval #CKMC_ERROR_NONE Successful
+ * @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
+ * @retval #CKMC_ERROR_PERMISSION_DENIED Failed to access key manager
+ * @retval #CKMC_ERROR_NOT_SUPPORTED Device needed to run API is not supported
+ *
+ * @pre User is already logged in and the user key is already loaded into memory in plain text form.
+ * @pre @a pcert_chain_list is created with ckmc_get_certificate_chain() or
+ * ckmc_get_certificate_chain_with_alias().
+ *
+ * @see ckmc_get_cert_chain()
+ * @see ckmc_get_cert_chain_with_alias()
+ * @see ckmc_get_cert_chain_with_trustedcert()
+ * @see ckmc_cert_list_all_free()
+ * @see #ckmc_cert_list_s
+ * @see #ckmc_ocsp_status_e
+ */
+int ckmc_ocsp_check(const ckmc_cert_list_s *pcert_chain_list, ckmc_ocsp_status_e *ocsp_status);
/**
- * @brief Allows another application to access client's application data
+ * @deprecated Deprecated since 2.4. [Use ckmc_set_permission() instead]
+ * @brief Allows another application to access client's application data.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
- * @remarks Data identified by @a alias should exist
+ * @remarks Data identified by @a alias should exist.
*
* @param[in] alias Data alias for which access will be granted
* @param[in] accessor Package id of the application that will gain access rights
* @param[in] granted Rights granted for @a accessor application
*
- * @return @c 0 on success, otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
* @see ckmc_deny_access()
+ * @see ckmc_set_permission()
+ * @see #ckmc_access_right_e
*/
int ckmc_allow_access(const char *alias, const char *accessor, ckmc_access_right_e granted);
+/**
+ * @brief Allows another application to access client's application data.
+ *
+ * @since_tizen 2.4
+ * @privlevel public
+ * @privilege %http://tizen.org/privilege/keymanager
+ *
+ * @remarks Data identified by @a alias should exist.
+ *
+ * @param[in] alias Data alias for which access will be granted
+ * @param[in] accessor Package id of the application that will gain access rights
+ * @param[in] permissions Mask of #ckmc_permission_e granted for @a accessor application \n
+ * Previous permission mask will be replaced with the new mask value
+ *
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
+ *
+ * @retval #CKMC_ERROR_NONE Successful
+ * @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
+ * @retval #CKMC_ERROR_DB_LOCKED A user key is not loaded in memory (a user is not logged
+ * in)
+ * @retval #CKMC_ERROR_DB_ERROR Failed due to the error with unknown reason
+ * @retval #CKMC_ERROR_DB_ALIAS_UNKNOWN Alias does not exist
+ * @retval #CKMC_ERROR_PERMISSION_DENIED Failed to access key manager
+ *
+ * @pre User is already logged in and the user key is already loaded into memory in plain text form.
+ *
+ * @see #ckmc_permission_e
+ */
+int ckmc_set_permission(const char *alias, const char *accessor, int permissions);
/**
- * @brief Revokes another application's access to client's application data
+ * @deprecated Deprecated since 2.4. [Use ckmc_set_permission() instead]
+ * @brief Revokes another application's access to client's application data.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
* @privlevel public
* @privilege %http://tizen.org/privilege/keymanager
*
- * @remarks Data identified by @a alias should exist
- * @remarks Only access previously granted with ckmc_allow_access can be revoked.
+ * @remarks Data identified by @a alias should exist.
+ * @remarks Only access previously granted with ckmc_allow_access() can be revoked.
*
* @param[in] alias Data alias for which access will be revoked
* @param[in] accessor Package id of the application that will lose access rights
*
- * @return @c 0 on success, otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid or the @a accessor doesn't
* @pre User is already logged in and the user key is already loaded into memory in plain text form.
*
* @see ckmc_allow_access()
+ * @see ckmc_set_permission()
*/
int ckmc_deny_access(const char *alias, const char *accessor);
+/**
+ * @brief Removes a an entry (no matter of type) from the key manager.
+ *
+ * @since_tizen 2.4
+ * @privlevel public
+ * @privilege %http://tizen.org/privilege/keymanager
+ *
+ * @remarks To remove item, client must have remove permission to the specified item.
+ * @remarks The item owner can remove by default.
+ *
+ * @param[in] alias Item alias to be removed
+ *
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
+ *
+ * @retval #CKMC_ERROR_NONE Successful
+ * @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
+ * @retval #CKMC_ERROR_DB_LOCKED A user key is not loaded in memory (a user is not logged
+ * in)
+ * @retval #CKMC_ERROR_DB_ERROR Failed due to a database error
+ * @retval #CKMC_ERROR_DB_ALIAS_UNKNOWN Alias does not exist
+ * @retval #CKMC_ERROR_PERMISSION_DENIED Failed to access key manager
+ *
+ * @pre User is already logged in and the user key is already loaded into memory in plain text form.
+ *
+ * @see ckmc_save_key()
+ * @see ckmc_save_cert()
+ * @see ckmc_save_data()
+ * @see ckmc_save_pkcs12()
+ * @see ckmc_create_key_pair_rsa()
+ * @see ckmc_create_key_pair_dsa()
+ * @see ckmc_create_key_pair_ecdsa()
+ */
+int ckmc_remove_alias(const char *alias);
+
#ifdef __cplusplus
}
#endif
*
*
* @file ckmc-type.h
- * @version 1.0
+ * @version 1.2
* @brief Definitions of struct for the Key Manager's CAPI and their utility functions.
*/
#define __TIZEN_CORE_CKMC_TYPE_H
#include <stddef.h>
-#include <ckmc/ckmc-error.h>
+#include <stdbool.h>
#define KEY_MANAGER_CAPI __attribute__((visibility("default")))
*/
/**
- * alias can be provided as an alias alone, or together with label - in this
- * case, separator " " (space bar) is used to separate label and alias.
+ * @brief Sperator between alias and label.
+ * @since_tizen 2.3
+ * @remarks Alias can be provided as an alias alone, or together with label - in this
+ * case, separator " " (space bar) is used to separate label and alias.
* @see key-manager_doc.h
*/
KEY_MANAGER_CAPI extern char const * const ckmc_label_name_separator;
/**
* @brief Enumeration for key types of key manager.
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*/
typedef enum __ckmc_key_type {
- CKMC_KEY_NONE = 0, /**< key type not specified */
+ CKMC_KEY_NONE = 0, /**< Key type not specified */
CKMC_KEY_RSA_PUBLIC, /**< RSA public key */
CKMC_KEY_RSA_PRIVATE, /**< RSA private key */
CKMC_KEY_ECDSA_PUBLIC, /**< ECDSA public key */
/**
* @brief Enumeration for data format.
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*/
typedef enum __ckmc_data_format {
CKMC_FORM_DER_BASE64 = 0, /**< DER format base64 encoded data */
/**
* @brief Enumeration for elliptic curve.
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*/
typedef enum __ckmc_ec_type {
CKMC_EC_PRIME192V1 = 0, /**< Elliptic curve domain "secp192r1" listed in "SEC 2" recommended
/**
* @brief Enumeration for hash algorithm.
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*/
typedef enum __ckmc_hash_algo {
CKMC_HASH_NONE = 0, /**< No Hash Algorithm */
/**
* @brief Enumeration for RSA padding algorithm.
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*/
typedef enum __ckmc_rsa_padding_algo {
CKMC_NONE_PADDING = 0, /**< No Padding */
} ckmc_rsa_padding_algo_e;
/**
+ * @deprecated Deprecated since 2.4. [Use ckmc_permission_e() instead]
* @brief Enumeration for database access rights.
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*/
typedef enum __ckmc_access_right{
- CKMC_AR_READ = 0, /**< access right for read*/
- CKMC_AR_READ_REMOVE /**< access right for read and remove*/
+ CKMC_AR_READ = 0, /**< Access right for read*/
+ CKMC_AR_READ_REMOVE /**< Access right for read and remove*/
} ckmc_access_right_e;
/**
+ * @brief Enumeration for permissions to access/modify alias.
+ * @since_tizen 2.4
+ */
+typedef enum __ckmc_permission{
+ CKMC_PERMISSION_NONE = 0x00, /**< Clear permissions */
+ CKMC_PERMISSION_READ = 0x01, /**< Eead allowed */
+ CKMC_PERMISSION_REMOVE = 0x02 /**< Remove allowed */
+} ckmc_permission_e;
+
+/**
* @brief the structure for binary buffer used in key manager CAPI.
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*/
typedef struct __ckmc_raw_buff {
unsigned char* data; /**< Byte array containing binary data */
/**
* @brief The structure for a policy for storing key/certificate/binary data.
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*/
typedef struct __ckmc_policy {
char* password; /**< Byte array used to encrypt data inside CKM. If it is not null, the data
/**
* @brief The structure for key used in key manager CAPI.
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*/
typedef struct __ckmc_key {
unsigned char* raw_key; /**< Byte array of key. raw_key may be encrypted with password */
/**
* @brief The structure for certificate used in key manager CAPI.
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*/
typedef struct __ckmc_cert {
unsigned char* raw_cert; /**< Byte array of certificate */
/**
* @brief The structure for linked list of alias.
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*/
typedef struct __ckmc_alias_list {
char *alias; /**< The name of key, certificate or data stored in key manager */
} ckmc_alias_list_s;
/**
- * @brief The structure for linked list of ckmc_cert_s
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @brief The structure for linked list of #ckmc_cert_s.
+ * @since_tizen 2.3
*/
typedef struct __ckmc_cert_list {
- ckmc_cert_s *cert; /**< The pointer of ckmc_cert_s */
- struct __ckmc_cert_list *next; /**< The pointer pointing to the next ckmc_cert_list_s */
+ ckmc_cert_s *cert; /**< The pointer of #ckmc_cert_s */
+ struct __ckmc_cert_list *next; /**< The pointer pointing to the next #ckmc_cert_list_s */
} ckmc_cert_list_s;
+/**
+ * @brief Enumeration for OCSP status.
+ * @since_tizen 2.4
+ */
+typedef enum __ckmc_ocsp_status {
+ CKMC_OCSP_STATUS_GOOD = 0, /**< OCSP status is good */
+ CKMC_OCSP_STATUS_REVOKED, /**< The certificate is revoked */
+ CKMC_OCSP_STATUS_UNKNOWN, /**< Unknown error */
+ CKMC_OCSP_ERROR_UNSUPPORTED, /**< The certificate does not provide OCSP extension */
+ CKMC_OCSP_ERROR_INVALID_URL, /**< The invalid URL in certificate OCSP extension */
+ CKMC_OCSP_ERROR_INVALID_RESPONSE, /**< The invalid response from OCSP server */
+ CKMC_OCSP_ERROR_REMOTE, /**< OCSP remote server error */
+ CKMC_OCSP_ERROR_NET, /**< Network connection error */
+ CKMC_OCSP_ERROR_INTERNAL /**< OpenSSL API error */
+} ckmc_ocsp_status_e;
/**
- * @internal
- * @brief Creates a new @a ckmc_key_s handle and returns it.
+ * @brief The structure for PKCS12 used in key manager CAPI.
+ * @since_tizen 2.4
+ */
+typedef struct __ckmc_pkcs12 {
+ ckmc_key_s *priv_key; /**< The private key, may be null */
+ ckmc_cert_s *cert; /**< The certificate, may be null */
+ ckmc_cert_list_s *ca_chain; /**< The chain certificate list, may be null */
+} ckmc_pkcs12_s;
+
+
+/**
+ * @brief Creates a new #ckmc_key_s handle and returns it.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.4
*
- * @remarks You must destroy the newly created @a ckmc_key_s by calling ckmc_key_free() if it is no
- * longer needed.
+ * @remarks You must destroy the newly created @a ppkey by calling ckmc_key_free()
+ * if it is no longer needed.
*
- * @param[in] raw_key The byte array of key \n
- * @a raw_key may be encrypted with password.
+ * @param[in] raw_key The byte array of key @a raw_key may be encrypted with password
* @param[in] key_size The byte size of @a raw_key
* @param[in] key_type The @a raw_key's type
* @param[in] password The byte array used to decrypt @a raw_key inside key manager \n
- * If @a raw_key is not encrypted, @a password can be null.
- * @param[out] ppkey The pointer to a newly created @a ckmc_key_s handle
+ * If @a raw_key is not encrypted, @a password can be null
+ * @param[out] ppkey The pointer to a newly created #ckmc_key_s handle
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
+ * @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @retval #CKMC_ERROR_OUT_OF_MEMORY Not enough memory
*
int ckmc_key_new(unsigned char *raw_key,
size_t key_size,
ckmc_key_type_e key_type,
- char *password, ckmc_key_s **ppkey);
+ char *password,
+ ckmc_key_s **ppkey);
/**
- * @brief Destroys the @a ckmc_key_s handle and releases all its resources.
+ * @brief Destroys the #ckmc_key_s handle and releases all its resources.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*
- * @param[in] key The @a ckmc_key_s handle to destroy
+ * @param[in] key The #ckmc_key_s handle to destroy
*
*/
void ckmc_key_free(ckmc_key_s *key);
/**
- * @internal
- * @brief Creates a new @a ckmc_raw_buffer_s handle and returns it.
+ * @brief Creates a new #ckmc_raw_buffer_s handle and returns it.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.4
*
- * @remarks You must destroy the newly created @a ckmc_raw_buffer_s by calling ckmc_buffer_free() if
- * it is no longer needed.
+ * @remarks You must destroy the newly created @a ppbuffer by calling ckmc_buffer_free()
+ * if it is no longer needed.
*
* @param[in] data The byte array of buffer
* @param[in] size The byte size of buffer
- * @param[out] ppbuffer The pointer to a newly created @a ckmc_buffer_s handle
+ * @param[out] ppbuffer The pointer to a newly created #ckmc_buffer_s handle
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
+ * @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @retval #CKMC_ERROR_OUT_OF_MEMORY Not enough memory
*
* @see ckmc_buffer_free()
* @see #ckmc_raw_buffer_s
*/
-int ckmc_buffer_new(unsigned char *data, size_t size,ckmc_raw_buffer_s **ppbuffer);
+int ckmc_buffer_new(unsigned char *data, size_t size, ckmc_raw_buffer_s **ppbuffer);
/**
- * @brief Destroys the @a ckmc_raw_buffer_s handle and releases all its resources.
+ * @brief Destroys the #ckmc_raw_buffer_s handle and releases all its resources.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*
- * @param[in] buffer The @a ckmc_raw_buffer_s handle to destroy
+ * @param[in] buffer The #ckmc_raw_buffer_s structure to destroy
*
*/
void ckmc_buffer_free(ckmc_raw_buffer_s *buffer);
/**
- * @internal
- * @brief Creates a new @a ckmc_cert_s handle and returns it.
+ * @brief Creates a new #ckmc_cert_s handle and returns it.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.4
*
- * @remarks You must destroy the newly created @a ckmc_cert_s by calling ckmc_cert_free() if it is
- * no longer needed.
+ * @remarks You must destroy the newly created @a ppcert by calling ckmc_cert_free()
+ * if it is no longer needed.
*
* @param[in] raw_cert The byte array of certificate
* @param[in] cert_size The byte size of raw_cert
* @param[in] data_format The encoding format of raw_cert
- * @param[out] ppcert The pointer to a newly created @a ckmc_cert_s handle
+ * @param[out] ppcert The pointer to a newly created #ckmc_cert_s handle
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
+ * @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @retval #CKMC_ERROR_OUT_OF_MEMORY Not enough memory
*
* @see ckmc_cert_free()
* @see ckmc_load_cert_from_file()
- * @see ckmc_load_from_pkcs12_file()
+ * @see #ckmc_data_format_e
* @see #ckmc_cert_s
*/
int ckmc_cert_new(unsigned char *raw_cert,
ckmc_cert_s **ppcert);
/**
- * @brief Destroys the @a ckmc_cert handle and releases all its resources.
+ * @brief Destroys the #ckmc_cert handle and releases all its resources.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*
- * @param[in] cert The @a ckmc_cert_s handle to destroy
+ * @param[in] cert The #ckmc_cert_s handle to destroy
*
* @see ckmc_load_cert_from_file()
* @see ckmc_load_from_pkcs12_file()
+ * @see #ckmc_cert_s
*/
void ckmc_cert_free(ckmc_cert_s *cert);
/**
- * @brief Creates a new @a ckmc_cert_s handle from a given file and returns it.
+ * @brief Creates a new #ckmc_cert_s handle from a given file and returns it.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*
- * @remarks You must destroy the newly created @a ckmc_cert_s by calling ckmc_cert_free() if it is
- * no longer needed.
+ * @remarks You must destroy the newly created @a cert by calling ckmc_cert_free()
+ * if it is no longer needed.
*
* @param[in] file_path The path of certificate file to be loaded \n
- * The only DER or PEM encoded certificate file is supported.
- * @param[out] cert The pointer of newly created @a ckmc_cert_s handle
+ * The only DER or PEM encoded certificate file is supported
+ * @param[out] cert The pointer of newly created #ckmc_cert_s handle
*
- * @return #CKMC_ERROR_NONE on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_OUT_OF_MEMORY Not enough memory space
* @retval #CKMC_ERROR_FILE_ACCESS_DENIED Provided file does not exist or cannot be accessed
*
* @see ckmc_cert_free()
- * @see ckmc_load_from_pkcs12_file()
* @see #ckmc_cert_s
*/
int ckmc_load_cert_from_file(const char *file_path, ckmc_cert_s **cert);
/**
- * @brief Creates a new @a ckmc_key_s(private key), @a ckmc_cert_s(certificate), and
- * @a ckmc_cert_list_s(CA certificates) handle from a given PKCS#12 file and returns them.
+ * @brief Creates a new #ckmc_pkcs12_s handle and returns it.
+ *
+ * @since_tizen 2.4
+ *
+ * @remarks You must destroy the newly created @a pkcs12_bundle by calling ckmc_pkcs12_free()
+ * if it is no longer needed.
+ * @remarks On success, @a private_key, @a cert and @a ca_cert_list ownership is transferred
+ * into newly returned #ckmc_pkcs12_s.
+ *
+ * @param[in] private_key #ckmc_key_s handle to the private key (optional)
+ * @param[in] cert #ckmc_cert_s handle to the certificate (optional)
+ * @param[in] ca_cert_list #ckmc_cert_list_s list of chain certificate handles (optional)
+ * @param[out] pkcs12_bundle The pointer to a newly created #ckmc_pkcs12_s handle
+ *
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
+ *
+ * @retval #CKMC_ERROR_NONE Successful
+ * @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid or @a private_key, @a cert
+ * and @a ca_cert_list all are null
+ * @retval #CKMC_ERROR_OUT_OF_MEMORY Not enough memory
+ *
+ * @see ckmc_pkcs12_free()
+ * @see ckmc_load_from_pkcs12_file()
+ * @see ckmc_pkcs12_load()
+ * @see #ckmc_key_s
+ * @see #ckmc_cert_s
+ * @see #ckmc_cert_list_s
+ * @see #ckmc_pkcs12_s
+ */
+int ckmc_pkcs12_new(ckmc_key_s *private_key,
+ ckmc_cert_s *cert,
+ ckmc_cert_list_s *ca_cert_list,
+ ckmc_pkcs12_s **pkcs12_bundle);
+
+/**
+ * @deprecated Deprecated since 2.4. [Use ckmc_pkcs12_load() instead]
+ * @brief Creates a new @a private_key, @a cert and @a ca_cert_list handle from a given
+ * PKCS12 file and returns them.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*
- * @remarks You must destroy the newly created @a ckmc_key_s, @a ckmc_cert_s, and
- * @a ckmc_cert_list_s by calling ckmc_key_free(), ckmc_cert_free(), and
+ * @remarks You must destroy the newly created @a private_key, @a cert and
+ * @a ca_cert_list by calling ckmc_key_free(), ckmc_cert_free() and
* ckmc_cert_list_all_free() if they are no longer needed.
*
* @param[in] file_path The path of PKCS12 file to be loaded
* @param[in] passphrase The passphrase used to decrypt the PCKS12 file \n
- * If PKCS12 file is not encrypted, passphrase can be null.
- * @param[out] private_key The pointer of newly created @a ckmc_key_s handle for a private key
- * @param[out] cert The pointer of newly created @a ckmc_cert_s handle for a certificate \n
- * It is null if the PKCS12 file does not contain a certificate.
- * @param[out] ca_cert_list The pointer of newly created @a ckmc_cert_list_s handle for CA
+ * If PKCS12 file is not encrypted, passphrase can be null
+ * @param[out] private_key The pointer of newly created #ckmc_key_s handle for a private key
+ * @param[out] cert The pointer of newly created #ckmc_cert_s handle for a certificate \n
+ * It is null if the PKCS12 file does not contain a certificate
+ * @param[out] ca_cert_list The pointer of newly created #ckmc_cert_list_s handle for CA
* certificates \n
- * It is null if the PKCS12 file does not contain CA certificates.
+ * It is null if the PKCS12 file does not contain CA certificates
*
- * @return #CKMC_ERROR_NONE on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
* @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_OUT_OF_MEMORY Not enough memory space
* @retval #CKMC_ERROR_INVALID_FORMAT Invalid PKCS12 file format
* @retval #CKMC_ERROR_FILE_ACCESS_DENIED Provided file does not exist or cannot be accessed
*
+ * @see ckmc_pkcs12_new()
+ * @see ckmc_pkcs12_load()
* @see ckmc_key_free()
* @see ckmc_cert_free()
* @see ckmc_cert_list_all_free()
*/
int ckmc_load_from_pkcs12_file(const char *file_path,
const char *passphrase,
- ckmc_key_s **private_key, ckmc_cert_s **cert,
+ ckmc_key_s **private_key,
+ ckmc_cert_s **cert,
ckmc_cert_list_s **ca_cert_list);
/**
- * @internal
- * @brief Creates a new @a ckmc_alias_list_s handle and returns it.
- * The alias pointer in the returned @a ckmc_alias_list_s handle points to the provided
+ * @brief Creates a new #ckmc_pkcs12_s handle from a given PKCS#12 file and returns it.
+ *
+ * @since_tizen 2.4
+ *
+ * @remarks You must destroy the newly created @a pkcs12_bundle by calling ckmc_pkcs12_free() if
+ * they are no longer needed.
+ *
+ * @param[in] file_path The path of PKCS12 file to be loaded
+ * @param[in] passphrase The passphrase used to decrypt the PCKS12 file \n
+ * If PKCS12 file is not encrypted, passphrase can be null
+ * @param[out] pkcs12_bundle The pointer of newly created #ckmc_cert_list_s handle for CA
+ * certificates \n
+ * It is null if the PKCS12 file does not contain CA certificates
+ *
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
+ *
+ * @retval #CKMC_ERROR_NONE Successful
+ * @retval #CKMC_ERROR_OUT_OF_MEMORY Not enough memory space
+ * @retval #CKMC_ERROR_INVALID_FORMAT Invalid PKCS12 file format
+ * @retval #CKMC_ERROR_FILE_ACCESS_DENIED Provided file does not exist or cannot be accessed
+ *
+ * @see ckmc_pkcs12_free()
+ * @see #ckmc_pkcs12_s
+ */
+int ckmc_pkcs12_load(const char *file_path,
+ const char *passphrase,
+ ckmc_pkcs12_s **pkcs12_bundle);
+
+/**
+ * @brief Destroys the #ckmc_pkcs12_s handle and releases all its resources.
+ *
+ * @since_tizen 2.4
+ *
+ * @param[in] pkcs12 The #ckmc_pkcs12_s handle to destroy
+ *
+ * @see ckmc_pkcs12_new()
+ * @see ckmc_pkcs12_load()
+ */
+void ckmc_pkcs12_free(ckmc_pkcs12_s *pkcs12);
+
+/**
+ * @brief Creates a new #ckmc_alias_list_s handle and returns it.
+ * The alias pointer in the returned #ckmc_alias_list_s handle points to the provided
* characters and next is null.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.4
*
- * @remarks You must destroy the newly created @a ckmc_alias_list_s
- * by calling ckmc_alias_list_free() or ckmc_alias_list_all_free() if it is no longer
- * needed.
+ * @remarks You must destroy the newly created @a ppalias_list by calling ckmc_alias_list_free()
+ * or ckmc_alias_list_all_free() if it is no longer needed.
*
- * @param[in] alias The first item to be set in the newly created @a ckmc_alias_list_s
- * @param[out] ppalias_list The pointer to a newly created @a ckmc_alias_list_s handle
+ * @param[in] alias The first item to be set in the newly created #ckmc_alias_list_s
+ * @param[out] ppalias_list The pointer to a newly created #ckmc_alias_list_s handle
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
+ * @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @retval #CKMC_ERROR_OUT_OF_MEMORY Not enough memory
*
int ckmc_alias_list_new(char *alias, ckmc_alias_list_s **ppalias_list);
/**
- * @internal
- * @brief Creates a new @a ckmc_alias_list_s handle, adds it to a previous @a ckmc_alias_list_s and
- * returns it. The alias pointer in the returned @a ckmc_alias_list_s handle points to the
+ * @brief Creates a new #ckmc_alias_list_s handle, adds it to a @a previous and returns it.
+ * The alias pointer in the returned #ckmc_alias_list_s handle points to the
* provided characters and next is null.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.4
*
- * @param[in] previous The last @a ckmc_alias_list_s handle to which a newly created
- * @a ckmc_alias_list_s is added
- * @param[in] alias The item to be set in the newly created @a ckmc_alias_list_s
- * @param[out] pplast The pointer to a newly created and added @a ckmc_alias_list_s handle
+ * @param[in] previous The last #ckmc_alias_list_s handle to which a newly created
+ * #ckmc_alias_list_s is added
+ * @param[in] alias The item to be set in the newly created #ckmc_alias_list_s
+ * @param[out] pplast The pointer to a newly created and added #ckmc_alias_list_s handle
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
+ * @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @retval #CKMC_ERROR_OUT_OF_MEMORY Not enough memory
*
ckmc_alias_list_s **pplast);
/**
- * @internal
- * @brief Destroys the @a ckmc_alias_list_s handle and releases resources of @a ckmc_alias_list_s
- * from the provided first handle cascadingly.
+ * @brief Destroys the #ckmc_alias_list_s handle and releases resources from the provided
+ * @a first handle cascadingly.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.4
*
- * @remarks It does not destroy an alias itself in @a ckmc_alias_list_s.
+ * @remarks It does not destroy an alias itself in #ckmc_alias_list_s.
*
- * @param[in] first The first @a ckmc_alias_list_s handle to destroy
+ * @param[in] first The first #ckmc_alias_list_s handle to destroy
*
* @see ckmc_alias_list_all_free()
* @see #ckmc_alias_list_s
void ckmc_alias_list_free(ckmc_alias_list_s *first);
/**
- * @brief Destroys the @a ckmc_alias_list_s handle and releases all its resources from the provided
- * first handle cascadingly.
+ * @brief Destroys the #ckmc_alias_list_s handle and releases all its resources from the provided
+ * @a first handle cascadingly.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.4
*
- * @remarks It also destroys the alias in @a ckmc_alias_list_s.
+ * @remarks It also destroys the alias in #ckmc_alias_list_s.
*
- * @param[in] first The first @a ckmc_alias_list_s handle to destroy
+ * @param[in] first The first #ckmc_alias_list_s handle to destroy
*
+ * @see ckmc_alias_list_free()
* @see #ckmc_alias_list_s
*/
void ckmc_alias_list_all_free(ckmc_alias_list_s *first);
/**
- * @internal
- * @brief Creates a new @a ckmc_cert_list_s handle and returns it.
- * The cert pointer in the returned @a ckmc_cert_list_s handle points to the provided
- * @a ckmc_cert_s and next is null.
+ * @brief Creates a new #ckmc_cert_list_s handle and returns it.
+ * The cert pointer in the returned #ckmc_cert_list_s handle points to the provided
+ * #ckmc_cert_s and next is null.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.4
*
- * @remarks You must destroy the newly created @a ckmc_cert_list_s by calling ckmc_cert_list_free()
+ * @remarks You must destroy the newly created @a ppalias_list by calling ckmc_cert_list_free()
* or ckmc_cert_list_all_free() if it is no longer needed.
*
- * @param[in] cert The first item to be set in the newly created @a ckmc_cert_list_s
- * @param[out] ppalias_list The pointer to a newly created @a ckmc_alias_list_s handle
+ * @param[in] cert The first item to be set in the newly created #ckmc_cert_list_s
+ * @param[out] ppalias_list The pointer to a newly created #ckmc_alias_list_s handle
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
+ * @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @retval #CKMC_ERROR_OUT_OF_MEMORY Not enough memory
*
int ckmc_cert_list_new(ckmc_cert_s *cert, ckmc_cert_list_s **ppalias_list);
/**
- * @internal
- * @brief Creates a new @a ckmc_cert_list_s handle, adds it to a previous @a ckmc_cert_list_s and
- * returns it. The cert pointer in the returned @a ckmc_alias_list_s handle points to the
- * provided @a ckmc_cert_s and next is null.
+ * @brief Creates a new #ckmc_cert_list_s handle, adds it to a previous #ckmc_cert_list_s and
+ * returns it. The cert pointer in the returned #ckmc_alias_list_s handle points to the
+ * provided #ckmc_cert_s and next is null.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.4
*
- * @param[in] previous The last @a ckmc_cert_list_s handle to which a newly created
- * @a ckmc_cert_list_s is added
- * @param[in] cert The item to be set in the newly created @a ckmc_cert_list_s
- * @param[out] pplast The pointer to a newly created and added @a ckmc_alias_list_s handle
+ * @param[in] previous The last #ckmc_cert_list_s handle to which a newly created
+ * #ckmc_cert_list_s is added
+ * @param[in] cert The item to be set in the newly created #ckmc_cert_list_s
+ * @param[out] pplast The pointer to a newly created and added #ckmc_alias_list_s handle
*
- * @return @c 0 on success,
- * otherwise a negative error value
+ * @return #CKMC_ERROR_NONE on success, otherwise a negative error value
*
+ * @retval #CKMC_ERROR_NONE Successful
* @retval #CKMC_ERROR_INVALID_PARAMETER Input parameter is invalid
* @retval #CKMC_ERROR_OUT_OF_MEMORY Not enough memory
*
int ckmc_cert_list_add(ckmc_cert_list_s *previous, ckmc_cert_s *cert, ckmc_cert_list_s **pplast);
/**
- * @internal
- * @brief Destroys the @a ckmc_cert_list_s handle and releases resources of @a ckmc_cert_list_s
- * from the provided first handle cascadingly.
+ * @brief Destroys the #ckmc_cert_list_s handle and releases resources from the provided
+ * @a first handle cascadingly.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.4
*
- * @remarks It does not destroy @a ckmc_cert_s itself in @a ckmc_cert_list_s.
+ * @remarks It does not destroy #ckmc_cert_s itself in #ckmc_cert_list_s.
*
- * @param[in] first The first @a ckmc_cert_list_s handle to destroy
+ * @param[in] first The first #ckmc_cert_list_s handle to destroy
*
* @see ckmc_cert_list_all_free()
* @see #ckmc_cert_list_s
void ckmc_cert_list_free(ckmc_cert_list_s *first);
/**
- * @brief Destroys the @a ckmc_cert_list_s handle and releases all its resources from the provided
- * first handle cascadingly.
+ * @brief Destroys the #ckmc_cert_list_s handle and releases all its resources from the provided
+ * @a first handle cascadingly.
*
- * @since_tizen @if MOBILE 2.3 @elseif WEARABLE 2.3.1 @endif
+ * @since_tizen 2.3
*
- * @remarks It also destroys @a ckmc_cert_s in ckmc_cert_list_s.
+ * @remarks It also destroys #ckmc_cert_s in #ckmc_cert_list_s.
*
- * @param[in] first The first @a ckmc_cert_list_s handle to destroy
+ * @param[in] first The first #ckmc_cert_list_s handle to destroy
*
+ * @see ckmc_cert_list_free()
* @see #ckmc_cert_list_s
*/
void ckmc_cert_list_all_free(ckmc_cert_list_s *first);
+++ /dev/null
-PKG_CHECK_MODULES(LISTENER_DEP
- REQUIRED
- dlog
- glib-2.0
- capi-appfw-package-manager
- libsystemd-daemon
- )
-
-SET(LISTENER_SOURCES ${PROJECT_SOURCE_DIR}/src/listener/listener-daemon.cpp)
-
-# fPIE flag is added for ASLR
-SET_SOURCE_FILES_PROPERTIES(
- ${LISTENER_SOURCES}
- PROPERTIES
- COMPILE_FLAGS "-D_GNU_SOURCE -fvisibility=hidden -fPIE")
-
-INCLUDE_DIRECTORIES(
- ${PROJECT_SOURCE_DIR}/src/include
- ${LISTENER_DEP_INCLUDE_DIRS}
- )
-
-ADD_EXECUTABLE(${TARGET_LISTENER} ${LISTENER_SOURCES})
-
-# pie flag is added for ASLR
-TARGET_LINK_LIBRARIES(
- ${TARGET_LISTENER}
- ${LISTENER_DEP_LIBRARIES}
- ${TARGET_KEY_MANAGER_CLIENT}
- ${TARGET_KEY_MANAGER_CONTROL_CLIENT}
- -pie
- )
-
-INSTALL(TARGETS ${TARGET_LISTENER} DESTINATION bin)
+++ /dev/null
-/*
- * Copyright (c) 2000 - 2014 Samsung Electronics Co., Ltd All Rights Reserved
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License
- */
-/*
- * @file listener-daemon.cpp
- * @author Bartlomiej Grzelewski (b.grzelewski@samsung.com)
- * @version 1.0
- * @brief Listener daemon handle some events for key-manager
- */
-#include <fcntl.h>
-#include <unistd.h>
-
-#include <glib.h>
-#include <package_manager.h>
-#include <ckm/ckm-control.h>
-#include <ckm/ckm-type.h>
-#include <dlog.h>
-
-#define CKM_LISTENER_TAG "CKM_LISTENER"
-
-namespace {
-const char* const CKM_LOCK = "/var/run/key-manager.pid";
-};
-
-bool isCkmRunning()
-{
- int lock = TEMP_FAILURE_RETRY(open(CKM_LOCK, O_RDWR));
- if (lock == -1)
- return false;
-
- int ret = lockf(lock, F_TEST, 0);
- close(lock);
-
- // if lock test fails because of an error assume ckm is running
- return (0 != ret);
-}
-
-void packageUninstalledEventCallback(
- const char *type,
- const char *package,
- package_manager_event_type_e eventType,
- package_manager_event_state_e eventState,
- int progress,
- package_manager_error_e error,
- void *userData)
-{
- (void) type;
- (void) progress;
- (void) error;
- (void) userData;
-
- if (eventType != PACKAGE_MANAGER_EVENT_TYPE_UNINSTALL ||
- eventState != PACKAGE_MANAGER_EVENT_STATE_STARTED ||
- package == NULL) {
- SLOG(LOG_DEBUG, CKM_LISTENER_TAG, "PackageUninstalled Callback error of Invalid Param");
- }
- else {
- SLOG(LOG_DEBUG, CKM_LISTENER_TAG, "PackageUninstalled Callback. Uninstalation of: %s", package);
- auto control = CKM::Control::create();
- int ret = 0;
- if ( CKM_API_SUCCESS != (ret = control->removeApplicationData(std::string(package))) ) {
- SLOG(LOG_ERROR, CKM_LISTENER_TAG, "CKM::Control::removeApplicationData error. ret : %d\n", ret);
- }
- else {
- SLOG(LOG_DEBUG, CKM_LISTENER_TAG,
- "CKM::Control::removeApplicationData success. Uninstallation package : %s\n", package);
- }
- }
-}
-
-int main(void)
-{
- SLOG(LOG_DEBUG, CKM_LISTENER_TAG, "%s", "Start!");
-
- // Let's start to listen
- GMainLoop *main_loop = g_main_loop_new(NULL, FALSE);
-
- package_manager_h manager;
-
- while (true) {
- if (PACKAGE_MANAGER_ERROR_NONE != package_manager_create(&manager)) {
- SLOG(LOG_ERROR, CKM_LISTENER_TAG, "%s", "Error in create package_manager");
-
- sleep(5);
- continue;
- }
-
- if (PACKAGE_MANAGER_ERROR_NONE != package_manager_set_event_cb(manager, packageUninstalledEventCallback, NULL)) {
- SLOG(LOG_ERROR, CKM_LISTENER_TAG, "%s", "Error in package_manager_set_event_cb");
- package_manager_destroy(manager);
-
- sleep(5);
- continue;
- }
-
- break;
- }
-
- g_main_loop_run(main_loop);
-
- package_manager_destroy(manager);
-
- return 0;
-}
-
PKG_CHECK_MODULES(COMMON_DEP
REQUIRED
dlog
- openssl
- libsmack
libcrypto
libsystemd-journal
)
${COMMON_PATH}/common/certificate-impl.cpp
${COMMON_PATH}/common/key-impl.cpp
${COMMON_PATH}/common/pkcs12-impl.cpp
+ ${COMMON_PATH}/common/client-info-impl.cpp
${COMMON_PATH}/common/log-setup.cpp
${COMMON_PATH}/dpl/log/src/abstract_log_provider.cpp
${COMMON_PATH}/dpl/log/src/dlog_log_provider.cpp
${COMMON_PATH}/dpl/core/src/errno_string.cpp
)
-INCLUDE_DIRECTORIES(SYSTEM
- ${COMMON_DEP_INCLUDE_DIRS}
- )
-
INCLUDE_DIRECTORIES(
+ SYSTEM
+ ${COMMON_DEP_INCLUDE_DIRS}
${COMMON_PATH}/common
${COMMON_PATH}/dpl/core/include
${COMMON_PATH}/dpl/log/include
- ${COMMON_PATH}/dpl/db/include
- ${COMMON_PATH}/sqlcipher
- ${COMMON_PATH}/service
)
ADD_LIBRARY(${TARGET_KEY_MANAGER_COMMON} SHARED ${COMMON_SOURCES})
${COMMON_DEP_LIBRARIES}
)
-##########################################################################
-
INSTALL(TARGETS ${TARGET_KEY_MANAGER_COMMON} DESTINATION ${LIB_INSTALL_DIR})
-
-
* limitations under the License
*
*
- * @file ckmc-control.h
+ * @file ckmc-control.cpp
* @author Yuseok Jeon(yuseok.jeon@samsung.com)
* @version 1.0
* @brief provides conversion methods to C from C++ for key-manager control functions.
return CKM::Password(str);
}
-int _ckmc_set_permission_by_adm(uid_t user, const char *alias, const char *accessor, int permissions)
-{
- if (!alias || !accessor)
- return CKMC_ERROR_INVALID_PARAMETER;
-
- auto control = CKM::Control::create();
- return to_ckmc_error(control->setPermission(user, alias, accessor, permissions));
-}
-
KEY_MANAGER_CAPI
int ckmc_unlock_user_key(uid_t user, const char *password)
{
auto control = CKM::Control::create();
- int ret = control->unlockUserKey(user, _toPasswordStr(password));
+ int ret = control->unlockUserKey(
+ CKM::ClientInfo(user),
+ _toPasswordStr(password));
return to_ckmc_error(ret);
}
int ckmc_lock_user_key(uid_t user)
{
auto control = CKM::Control::create();
- int ret = control->lockUserKey(user);
+ int ret = control->lockUserKey(CKM::ClientInfo(user));
return to_ckmc_error(ret);
}
int ckmc_remove_user_data(uid_t user)
{
auto control = CKM::Control::create();
- int ret = control->removeUserData(user);
+ int ret = control->removeUserData(CKM::ClientInfo(user));
return to_ckmc_error(ret);
}
int ckmc_change_user_password(uid_t user, const char *oldPassword, const char *newPassword)
{
auto control = CKM::Control::create();
- int ret = control->changeUserPassword(user,
- _toPasswordStr(oldPassword),
- _toPasswordStr(newPassword));
+ int ret = control->changeUserPassword(
+ CKM::ClientInfo(user),
+ _toPasswordStr(oldPassword),
+ _toPasswordStr(newPassword));
return to_ckmc_error(ret);
}
int ckmc_reset_user_password(uid_t user, const char *newPassword)
{
auto control = CKM::Control::create();
- int ret = control->resetUserPassword(user, _toPasswordStr(newPassword));
+ int ret = control->resetUserPassword(
+ CKM::ClientInfo(user),
+ _toPasswordStr(newPassword));
return to_ckmc_error(ret);
}
return ec;
// if label given twice, service will return an error
- return _ckmc_set_permission_by_adm(user, CKM::AliasSupport::merge(CKM::Label(owner), CKM::Name(alias)).c_str(), accessor, permissionMask);
+ return ckmc_set_permission_by_adm(user, CKM::AliasSupport::merge(CKM::Label(owner), CKM::Name(alias)).c_str(), accessor, permissionMask);
+}
+
+KEY_MANAGER_CAPI
+int ckmc_set_permission_by_adm(uid_t user, const char *alias, const char *accessor, int permissions)
+{
+ if (!alias || !accessor)
+ return CKMC_ERROR_INVALID_PARAMETER;
+
+ auto control = CKM::Control::create();
+ return to_ckmc_error(control->setPermission(
+ CKM::ClientInfo(user),
+ alias,
+ accessor,
+ permissions));
}
KEY_MANAGER_CAPI
// if label given twice, service will return an error
auto control = CKM::Control::create();
return to_ckmc_error(control->setPermission(
- user,
- CKM::AliasSupport::merge(CKM::Label(owner), CKM::Name(alias)).c_str(),
- accessor,
- CKM::Permission::NONE));
+ CKM::ClientInfo(user),
+ CKM::AliasSupport::merge(CKM::Label(owner),
+ CKM::Name(alias)).c_str(),
+ accessor,
+ CKM::Permission::NONE));
}
* limitations under the License
*
*
- * @file ckmc-control.h
+ * @file ckmc-manager.cpp
* @author Yuseok Jeon(yuseok.jeon@samsung.com)
* @version 1.0
- * @brief provides conversion methods to C from C++ for key-manager control functions.
+ * @brief provides conversion methods to C from C++ for key-manager storage functions.
*/
#include <ckm/ckm-type.h>
#include <ckmc/ckmc-error.h>
#include <ckmc-type-converter.h>
#include <client-common.h>
-#include <iostream>
#include <string.h>
namespace
return start;
}
-int _ckmc_remove_alias(const char *alias)
-{
- if(!alias)
- return CKMC_ERROR_INVALID_PARAMETER;
-
- CKM::ManagerShPtr mgr = CKM::Manager::create();
- int ret = mgr->removeAlias(alias);
- return to_ckmc_error(ret);
-}
-
-int _ckmc_set_permission(const char *alias, const char *accessor, int permissions)
-{
- if (!alias || !accessor)
- return CKMC_ERROR_INVALID_PARAMETER;
-
- CKM::ManagerShPtr mgr = CKM::Manager::create();
- return to_ckmc_error(mgr->setPermission(alias, accessor, permissions));
-}
-
}
KEY_MANAGER_CAPI
int ckmc_remove_key(const char *alias)
{
- return _ckmc_remove_alias(alias);
+ return ckmc_remove_alias(alias);
}
KEY_MANAGER_CAPI
KEY_MANAGER_CAPI
int ckmc_remove_cert(const char *alias)
{
- return _ckmc_remove_alias(alias);
+ return ckmc_remove_alias(alias);
}
KEY_MANAGER_CAPI
}
KEY_MANAGER_CAPI
+int ckmc_save_pkcs12(const char *alias, const ckmc_pkcs12_s *ppkcs, const ckmc_policy_s key_policy, const ckmc_policy_s cert_policy)
+{
+ CKM::KeyShPtr private_key;
+ CKM::CertificateShPtr cert;
+ CKM::CertificateShPtrVector ca_cert_list;
+
+ if(alias==NULL || ppkcs==NULL) {
+ return CKMC_ERROR_INVALID_PARAMETER;
+ }
+ CKM::Alias ckmAlias(alias);
+ private_key = _toCkmKey(ppkcs->priv_key);
+ cert = _toCkmCertificate(ppkcs->cert);
+ ca_cert_list = _toCkmCertificateVector(ppkcs->ca_chain);
+
+ CKM::Policy keyPolicy(_tostring(key_policy.password), key_policy.extractable);
+ CKM::Policy certPolicy(_tostring(cert_policy.password), cert_policy.extractable);
+
+ CKM::PKCS12ShPtr pkcs12(new CKM::PKCS12Impl(private_key, cert, ca_cert_list));
+
+ CKM::ManagerShPtr mgr = CKM::Manager::create();
+ int ret = mgr->savePKCS12(ckmAlias, pkcs12, keyPolicy, certPolicy);
+
+ return to_ckmc_error(ret);
+}
+
+KEY_MANAGER_CAPI
+int ckmc_get_pkcs12(const char *alias, const char *key_password, const char *cert_password, ckmc_pkcs12_s **pkcs12)
+{
+ int ret;
+ CKM::PKCS12ShPtr pkcs;
+ CKM::Password keyPass, certPass;
+ ckmc_key_s *private_key = NULL;
+ ckmc_cert_s *cert = NULL;
+ ckmc_cert_list_s *ca_cert_list = 0;
+
+ if(!alias || !pkcs12) {
+ return CKMC_ERROR_INVALID_PARAMETER;
+ }
+
+ if (key_password)
+ keyPass = key_password;
+
+ if (cert_password)
+ certPass = cert_password;
+
+ auto mgr = CKM::Manager::create();
+
+ if((ret = mgr->getPKCS12(alias, keyPass, certPass, pkcs)) != CKM_API_SUCCESS) {
+ return to_ckmc_error(ret);
+ }
+
+ if(!pkcs)
+ return CKMC_ERROR_BAD_RESPONSE;
+
+ auto pkcsKey = pkcs->getKey();
+ if(pkcsKey)
+ {
+ CKM::RawBuffer buffer = pkcsKey->getDER();
+ ckmc_key_type_e keyType = static_cast<ckmc_key_type_e>(pkcsKey->getType());
+ ret = ckmc_key_new(buffer.data(), buffer.size(), keyType, NULL, &private_key);
+ if(ret != CKMC_ERROR_NONE)
+ return ret;
+ }
+
+ auto pkcsCert = pkcs->getCertificate();
+ if(pkcsCert)
+ {
+ CKM::RawBuffer buffer = pkcsCert->getDER();
+ ret = ckmc_cert_new(buffer.data(), buffer.size(), CKMC_FORM_DER, &cert);
+ if(ret != CKMC_ERROR_NONE) {
+ ckmc_key_free(private_key);
+ return ret;
+ }
+ }
+
+ ca_cert_list = _toNewCkmCertList(pkcs->getCaCertificateShPtrVector());
+
+ ret = ckmc_pkcs12_new(private_key, cert, ca_cert_list, pkcs12);
+ if(ret != CKMC_ERROR_NONE)
+ {
+ ckmc_key_free(private_key);
+ ckmc_cert_free(cert);
+ ckmc_cert_list_free(ca_cert_list);
+ }
+ return ret;
+}
+
+
+KEY_MANAGER_CAPI
int ckmc_save_data(const char *alias, ckmc_raw_buffer_s data, const ckmc_policy_s policy)
{
if(alias == NULL) {
KEY_MANAGER_CAPI
int ckmc_remove_data(const char *alias)
{
- return _ckmc_remove_alias(alias);
+ return ckmc_remove_alias(alias);
}
KEY_MANAGER_CAPI
}
KEY_MANAGER_CAPI
+int ckmc_get_cert_chain_with_trustedcert(const ckmc_cert_s* cert,
+ const ckmc_cert_list_s* untrustedcerts,
+ const ckmc_cert_list_s* trustedcerts,
+ const bool sys_certs,
+ ckmc_cert_list_s** ppcert_chain_list)
+{
+ int ret;
+ CKM::ManagerShPtr mgr = CKM::Manager::create();
+ CKM::CertificateShPtrVector ckm_cert_chain;
+
+ if(cert == NULL || cert->raw_cert == NULL || cert->cert_size <= 0 || ppcert_chain_list == NULL) {
+ return CKMC_ERROR_INVALID_PARAMETER;
+ }
+ CKM::CertificateShPtr ckm_cert = _toCkmCertificate(cert);
+
+ if(ckm_cert.get() == NULL) {
+ return CKMC_ERROR_INVALID_PARAMETER;
+ }
+
+ CKM::CertificateShPtrVector ckm_untrusted = _toCkmCertificateVector(untrustedcerts);
+ CKM::CertificateShPtrVector ckm_trusted = _toCkmCertificateVector(trustedcerts);
+
+ ret = mgr->getCertificateChain(ckm_cert, ckm_untrusted, ckm_trusted, sys_certs, ckm_cert_chain);
+ if( ret != CKM_API_SUCCESS) {
+ return to_ckmc_error(ret);
+ }
+
+ *ppcert_chain_list = _toNewCkmCertList(ckm_cert_chain);
+
+ return CKMC_ERROR_NONE;
+}
+
+KEY_MANAGER_CAPI
+int ckmc_ocsp_check(const ckmc_cert_list_s *pcert_chain_list, ckmc_ocsp_status_e *ocsp_status)
+{
+ if (pcert_chain_list == NULL
+ || pcert_chain_list->cert == NULL
+ || pcert_chain_list->cert->raw_cert == NULL
+ || pcert_chain_list->cert->cert_size <= 0
+ || ocsp_status == NULL) {
+ return CKMC_ERROR_INVALID_PARAMETER;
+ }
+
+ int ret = CKMC_ERROR_UNKNOWN;
+ int tmpOcspStatus = -1;
+ CKM::ManagerShPtr mgr = CKM::Manager::create();
+ CKM::CertificateShPtrVector ckmCertChain = _toCkmCertificateVector(pcert_chain_list);
+
+ if (ckmCertChain.size() < 2) {
+ return CKMC_ERROR_INVALID_PARAMETER;
+ }
+
+ ret = mgr->ocspCheck(ckmCertChain, tmpOcspStatus);
+ *ocsp_status = to_ckmc_ocsp_status(tmpOcspStatus);
+ return to_ckmc_error(ret);
+}
+
+KEY_MANAGER_CAPI
int ckmc_allow_access(const char *alias, const char *accessor, ckmc_access_right_e granted)
{
int ec, permissionMask;
if(ec != CKMC_ERROR_NONE)
return ec;
- return _ckmc_set_permission(alias, accessor, permissionMask);
+ return ckmc_set_permission(alias, accessor, permissionMask);
+}
+
+KEY_MANAGER_CAPI
+int ckmc_set_permission(const char *alias, const char *accessor, int permissions)
+{
+ if (!alias || !accessor)
+ return CKMC_ERROR_INVALID_PARAMETER;
+
+ CKM::ManagerShPtr mgr = CKM::Manager::create();
+ return to_ckmc_error(mgr->setPermission(alias, accessor, permissions));
}
KEY_MANAGER_CAPI
CKM::ManagerShPtr mgr = CKM::Manager::create();
return to_ckmc_error(mgr->setPermission(alias, accessor, CKM::Permission::NONE));
}
+
+KEY_MANAGER_CAPI
+int ckmc_remove_alias(const char *alias)
+{
+ if(!alias)
+ return CKMC_ERROR_INVALID_PARAMETER;
+
+ CKM::ManagerShPtr mgr = CKM::Manager::create();
+ int ret = mgr->removeAlias(alias);
+ return to_ckmc_error(ret);
+}
#include <ckmc/ckmc-type.h>
#include <ckmc-type-converter.h>
-typedef enum __ckmc_permission{
- CKMC_PERMISSION_NONE = 0x00, /**< clear permissions */
- CKMC_PERMISSION_READ = 0x01, /**< read allowed */
- CKMC_PERMISSION_REMOVE = 0x02 /**< remove allowed */
-} ckmc_permission_e;
-
int to_ckm_error(int ckmc_error) {
switch(ckmc_error) {
case CKMC_ERROR_NONE: return CKM_API_SUCCESS;
case CKMC_ERROR_FILE_ACCESS_DENIED: return CKM_API_ERROR_FILE_ACCESS_DENIED;
case CKMC_ERROR_NOT_EXPORTABLE: return CKM_API_ERROR_NOT_EXPORTABLE;
case CKMC_ERROR_FILE_SYSTEM: return CKM_API_ERROR_FILE_SYSTEM;
+ case CKMC_ERROR_NOT_SUPPORTED: return CKM_API_ERROR_NOT_SUPPORTED;
case CKMC_ERROR_UNKNOWN: return CKM_API_ERROR_UNKNOWN;
}
- return CKMC_ERROR_UNKNOWN;
+ return CKM_API_ERROR_UNKNOWN;
}
int to_ckmc_error(int ckm_error) {
case CKM_API_ERROR_FILE_ACCESS_DENIED: return CKMC_ERROR_FILE_ACCESS_DENIED;
case CKM_API_ERROR_NOT_EXPORTABLE: return CKMC_ERROR_NOT_EXPORTABLE;
case CKM_API_ERROR_FILE_SYSTEM: return CKMC_ERROR_FILE_SYSTEM;
+ case CKM_API_ERROR_NOT_SUPPORTED: return CKMC_ERROR_NOT_SUPPORTED;
case CKM_API_ERROR_UNKNOWN: return CKMC_ERROR_UNKNOWN;
}
return CKMC_ERROR_UNKNOWN;
}
+ckmc_ocsp_status_e to_ckmc_ocsp_status(int ckm_ocsp_status) {
+ switch(ckm_ocsp_status) {
+ case CKM_API_OCSP_STATUS_GOOD: return CKMC_OCSP_STATUS_GOOD;
+ case CKM_API_OCSP_STATUS_UNSUPPORTED: return CKMC_OCSP_ERROR_UNSUPPORTED;
+ case CKM_API_OCSP_STATUS_REVOKED: return CKMC_OCSP_STATUS_REVOKED;
+ case CKM_API_OCSP_STATUS_NET_ERROR: return CKMC_OCSP_ERROR_NET;
+ case CKM_API_OCSP_STATUS_INVALID_URL: return CKMC_OCSP_ERROR_INVALID_URL;
+ case CKM_API_OCSP_STATUS_INVALID_RESPONSE: return CKMC_OCSP_ERROR_INVALID_RESPONSE;
+ case CKM_API_OCSP_STATUS_REMOTE_ERROR: return CKMC_OCSP_ERROR_REMOTE;
+ case CKM_API_OCSP_STATUS_INTERNAL_ERROR: return CKMC_OCSP_ERROR_INTERNAL;
+ default: return CKMC_OCSP_STATUS_UNKNOWN;
+ }
+}
+
int access_to_permission_mask(ckmc_access_right_e ar, int & permissionMask)
{
switch(ar)
int to_ckmc_error(int ckm_error);
int to_ckm_error(int ckmc_error);
+ckmc_ocsp_status_e to_ckmc_ocsp_status(int ckm_ocsp_status);
int access_to_permission_mask(ckmc_access_right_e ar, int & permissionMask);
#ifdef __cplusplus
}
KEY_MANAGER_CAPI
+int ckmc_pkcs12_new(ckmc_key_s *private_key, ckmc_cert_s *cert,
+ ckmc_cert_list_s *ca_cert_list, ckmc_pkcs12_s **pkcs12_bundle)
+{
+ ckmc_pkcs12_s *pkcs12;
+
+ if(!pkcs12_bundle ||
+ (private_key==NULL && cert==NULL && (ca_cert_list==NULL || ca_cert_list->cert==NULL))) {
+ return CKMC_ERROR_INVALID_PARAMETER;
+ }
+
+ pkcs12 = static_cast<ckmc_pkcs12_s*>(malloc(sizeof(ckmc_pkcs12_s)));
+ if(pkcs12 == NULL) {
+ return CKMC_ERROR_OUT_OF_MEMORY;
+ }
+ // ownership is transferred into pkcs12 - mentioned in the docs
+ pkcs12->priv_key = private_key;
+ pkcs12->cert = cert;
+ pkcs12->ca_chain = ca_cert_list;
+
+ *pkcs12_bundle = pkcs12;
+ return CKMC_ERROR_NONE;
+}
+
+KEY_MANAGER_CAPI
int ckmc_load_from_pkcs12_file(const char *file_path, const char *passphrase, ckmc_key_s **private_key, ckmc_cert_s **ckmcert, ckmc_cert_list_s **ca_cert_list)
{
class Pkcs12Converter {
}
KEY_MANAGER_CAPI
+int ckmc_pkcs12_load(const char *file_path, const char *passphrase, ckmc_pkcs12_s **pkcs12_bundle)
+{
+ int ec;
+ ckmc_key_s *private_key = 0;
+ ckmc_cert_s *cert = 0;
+ ckmc_cert_list_s *ca_cert_list = 0;
+
+ if(!file_path || !pkcs12_bundle)
+ return CKMC_ERROR_INVALID_PARAMETER;
+
+ ec = ckmc_load_from_pkcs12_file(file_path, passphrase, &private_key, &cert, &ca_cert_list);
+ if(ec != CKMC_ERROR_NONE)
+ return ec;
+
+ ec = ckmc_pkcs12_new(private_key, cert, ca_cert_list, pkcs12_bundle);
+ if(ec != CKMC_ERROR_NONE)
+ {
+ ckmc_key_free(private_key);
+ ckmc_cert_free(cert);
+ ckmc_cert_list_free(ca_cert_list);
+ return ec;
+ }
+
+ return CKMC_ERROR_NONE;
+}
+
+KEY_MANAGER_CAPI
+void ckmc_pkcs12_free(ckmc_pkcs12_s *pkcs12)
+{
+ if(pkcs12 == NULL)
+ return;
+
+ ckmc_key_free(pkcs12->priv_key);
+ ckmc_cert_free(pkcs12->cert);
+ ckmc_cert_list_all_free(pkcs12->ca_chain);
+ free(pkcs12);
+}
+
+KEY_MANAGER_CAPI
int ckmc_alias_list_new(char *alias, ckmc_alias_list_s **ppalias_list)
{
ckmc_alias_list_s *previous = NULL;
* See the License for the specific language governing permissions and
* limitations under the License
*
- * @file client-common.cpp
+ * @file client-control.cpp
* @author Bartlomiej Grzelewski (b.grzelewski@samsung.com)
* @version 1.0
- * @brief This file is implementation of client-common functions.
+ * @brief This file is implementation of client-control functions.
*/
#include <dpl/log/log.h>
ControlImpl& operator=(const ControlImpl &) = delete;
ControlImpl& operator=(ControlImpl &&) = delete;
- virtual int unlockUserKey(uid_t user, const Password &password) {
+ virtual int unlockUserKey(const ClientInfo &clientInfo, const Password &password) {
return try_catch([&] {
- if((int)user < 0) {
+ if((int)clientInfo.getUID() < 0) {
return CKM_API_ERROR_INPUT_PARAM;
}
MessageBuffer recv;
auto send = MessageBuffer::Serialize(static_cast<int>(ControlCommand::UNLOCK_USER_KEY),
- user,
+ clientInfo.getClientID(),
password);
int retCode = m_controlConnection.processRequest(send.Pop(), recv);
});
}
- virtual int lockUserKey(uid_t user) {
+ virtual int lockUserKey(const ClientInfo &clientInfo) {
return try_catch([&] {
- if((int)user < 0) {
+ if((int)clientInfo.getUID() < 0) {
return CKM_API_ERROR_INPUT_PARAM;
}
MessageBuffer recv;
- auto send = MessageBuffer::Serialize(static_cast<int>(ControlCommand::LOCK_USER_KEY), user);
+ auto send = MessageBuffer::Serialize(static_cast<int>(ControlCommand::LOCK_USER_KEY),
+ clientInfo.getClientID());
int retCode = m_controlConnection.processRequest(send.Pop(), recv);
if (CKM_API_SUCCESS != retCode)
return retCode;
});
}
-
- virtual int removeUserData(uid_t user) {
+ virtual int removeUserData(const ClientInfo &clientInfo) {
return try_catch([&] {
- if((int)user < 0) {
+ if((int)clientInfo.getUID() < 0) {
return CKM_API_ERROR_INPUT_PARAM;
}
MessageBuffer recv;
- auto send = MessageBuffer::Serialize(static_cast<int>(ControlCommand::REMOVE_USER_DATA), user);
+ auto send = MessageBuffer::Serialize(static_cast<int>(ControlCommand::REMOVE_USER_DATA),
+ clientInfo.getClientID());
int retCode = m_controlConnection.processRequest(send.Pop(), recv);
if (CKM_API_SUCCESS != retCode)
return retCode;
});
}
-
- virtual int changeUserPassword(uid_t user, const Password &oldPassword, const Password &newPassword) {
+ virtual int changeUserPassword(const ClientInfo &clientInfo, const Password &oldPassword, const Password &newPassword) {
return try_catch([&] {
- if((int)user < 0) {
+ if((int)clientInfo.getUID() < 0) {
return CKM_API_ERROR_INPUT_PARAM;
}
MessageBuffer recv;
auto send = MessageBuffer::Serialize(
static_cast<int>(ControlCommand::CHANGE_USER_PASSWORD),
- user,
+ clientInfo.getClientID(),
oldPassword,
newPassword);
});
}
- virtual int resetUserPassword(uid_t user, const Password &newPassword) {
+ virtual int resetUserPassword(const ClientInfo &clientInfo, const Password &newPassword) {
return try_catch([&] {
- if((int)user < 0) {
+ if((int)clientInfo.getUID() < 0) {
return CKM_API_ERROR_INPUT_PARAM;
}
MessageBuffer recv;
auto send = MessageBuffer::Serialize(
static_cast<int>(ControlCommand::RESET_USER_PASSWORD),
- user,
+ clientInfo.getClientID(),
newPassword);
int retCode = m_controlConnection.processRequest(send.Pop(), recv);
});
}
- virtual int removeApplicationData(const Label &smackLabel) {
+ virtual int removeApplicationData(const std::string &zone, const Label &smackLabel) {
return try_catch([&] {
if (smackLabel.empty()) {
return CKM_API_ERROR_INPUT_PARAM;
}
MessageBuffer recv;
- auto send = MessageBuffer::Serialize(static_cast<int>(ControlCommand::REMOVE_APP_DATA), smackLabel);
+ auto send = MessageBuffer::Serialize(static_cast<int>(ControlCommand::REMOVE_APP_DATA),
+ zone,
+ smackLabel);
int retCode = m_controlConnection.processRequest(send.Pop(), recv);
if (CKM_API_SUCCESS != retCode)
});
}
- virtual int setPermission(uid_t user,
+ virtual int setPermission(const ClientInfo &clientInfo,
const Alias &alias,
const Label &accessor,
PermissionMask permissionMask)
MessageBuffer recv;
AliasSupport helper(alias);
auto send = MessageBuffer::Serialize(static_cast<int>(ControlCommand::SET_PERMISSION),
- static_cast<int>(user),
+ clientInfo.getClientID(),
helper.getName(),
helper.getLabel(),
accessor,
namespace CKM {
-namespace {
template <class T>
-int getCertChain(
+int ManagerImpl::getCertChain(
ServiceConnection & serviceConnection,
LogicCommand command,
int counter,
int retCommand;
int retCounter;
+ bool retCCModeState;
RawBufferVector rawBufferVector;
- recv.Deserialize(retCommand, retCounter, retCode, rawBufferVector);
+ recv.Deserialize(retCommand, retCounter, retCode, rawBufferVector, retCCModeState);
+
+ LogDebug("CCModeState[" << (retCCModeState ? "TRUE" : "FALSE") << "]");
if ((counter != retCounter) || (static_cast<int>(command) != retCommand)) {
return CKM_API_ERROR_UNKNOWN;
certificateChainVector.push_back(cert);
}
+ if (retCCModeState) {
+ int ocspStatus;
+ retCode = ocspCheck(certificateChainVector, ocspStatus);
+
+ if ((retCode == CKM_API_SUCCESS) && (ocspStatus != CKM_API_OCSP_STATUS_GOOD)) {
+ retCode = CKM_API_ERROR_VERIFICATION_FAILED;
+ }
+ }
+
return retCode;
});
}
-} // namespace anonymous
-
ManagerImpl::ManagerImpl()
: m_counter(0), m_storageConnection(SERVICE_SOCKET_CKM_STORAGE), m_ocspConnection(SERVICE_SOCKET_OCSP)
{
bool useTrustedSystemCertificates,
CertificateShPtrVector &certificateChainVector);
+
int createSignature(
const Alias &privateKeyAlias,
const Password &password, // password for private_key
const Policy &policyPrivateKey,
const Policy &policyPublicKey);
+ template <class T>
+ int getCertChain(
+ ServiceConnection & serviceConnection,
+ LogicCommand command,
+ int counter,
+ const CertificateShPtr &certificate,
+ const T &untrustedVector,
+ const T &trustedVector,
+ bool useTrustedSystemCertificates,
+ CertificateShPtrVector &certificateChainVector);
+
int m_counter;
CKM::ServiceConnection m_storageConnection;
CKM::ServiceConnection m_ocspConnection;
--- /dev/null
+/*
+ * Copyright (c) 2000 - 2013 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ *
+ *
+ * @file client-info-impl.cpp
+ * @author Kyungwook Tak (k.tak@samsung.com)
+ * @version 1.0
+ * @brief ClientInfo implementation.
+ */
+
+#include <ckm/ckm-client-info.h>
+
+namespace CKM {
+ const std::string ClientInfo::ZONE_DEFAULT = "host";
+ const std::string ClientInfo::DELIMITER = "-";
+
+
+uid_t ClientInfo::getUID() const
+{
+ return m_uid;
+}
+
+ClientInfo::~ClientInfo()
+{
+}
+
+ClientInfo::ClientInfo(const std::string &zone, const uid_t uid)
+ : m_zone(zone), m_uid(uid)
+{
+}
+
+ClientInfo::ClientInfo(const uid_t uid)
+ : m_zone(ZONE_DEFAULT), m_uid(uid)
+{
+}
+
+ClientID ClientInfo::getClientID() const
+{
+#ifdef DB_PER_ZONE_ENABLE
+ return ClientID(m_zone
+ + DELIMITER
+ + std::to_string(m_uid));
+#else
+ return ClientID(std::to_string(m_uid));
+#endif
+}
+
+std::string ClientInfo::getZone() const
+{
+ return m_zone;
+}
+
+} // namespace CKM
m_type = second.m_type;
}
-KeyImpl &KeyImpl::operator=(const KeyImpl &second)
-{
- if (&second != this) {
- m_pkey = second.getEvpShPtr();
- m_type = second.getType();
- }
+KeyImpl &KeyImpl::operator=(const KeyImpl &second) {
+ if (this == &second)
+ return *this;
+
+ m_pkey = second.m_pkey;
+ m_type = second.m_type;
return *this;
}
KeyImpl();
KeyImpl(const KeyImpl &second);
KeyImpl &operator=(const KeyImpl &second);
-
KeyImpl(const RawBuffer& buffer, const Password &password = Password());
KeyImpl(EvpShPtr pkey, KeyType type);
char const * const SERVICE_SOCKET_OCSP = "/tmp/.central-key-manager-api-ocsp.sock";
char const * const LABEL_NAME_SEPARATOR = " ";
-PolicySerializable::PolicySerializable()
-{}
-
-
+PolicySerializable::PolicySerializable() {}
+PolicySerializable::~PolicySerializable() {}
PolicySerializable::PolicySerializable(const Policy &policy)
: Policy(policy)
{}
-PolicySerializable::PolicySerializable(IStream &stream) {
- Deserialization::Deserialize(stream, password);
- Deserialization::Deserialize(stream, extractable);
-}
-
void PolicySerializable::Serialize(IStream &stream) const {
Serialization::Serialize(stream, password);
Serialization::Serialize(stream, extractable);
}
+void PolicySerializable::Deserialize(IStream &stream) {
+ Deserialization::Deserialize(stream, password);
+ Deserialization::Deserialize(stream, extractable);
+}
+
PKCS12Serializable::PKCS12Serializable() {}
+PKCS12Serializable::~PKCS12Serializable() {}
PKCS12Serializable::PKCS12Serializable(const PKCS12 &pkcs)
: PKCS12Impl(pkcs)
{}
-PKCS12Serializable::PKCS12Serializable(IStream &stream)
-{
- // key
- size_t numKeys;
- Deserialization::Deserialize(stream, numKeys);
- if(numKeys > 0) {
- int keyType;
- RawBuffer keyData;
- Deserialization::Deserialize(stream, keyType);
- Deserialization::Deserialize(stream, keyData);
- m_pkey = CKM::Key::create(keyData);
- }
-
- // cert
- size_t numCerts;
- Deserialization::Deserialize(stream, numCerts);
- if(numCerts > 0) {
- RawBuffer certData;
- Deserialization::Deserialize(stream, certData);
- m_cert = CKM::Certificate::create(certData, DataFormat::FORM_DER);
- }
-
- // CA chain
- size_t num_CA;
- Deserialization::Deserialize(stream, num_CA);
- for(size_t i=0; i<num_CA; i++)
- {
- RawBuffer CAcertData;
- Deserialization::Deserialize(stream, CAcertData);
- m_ca.push_back(CKM::Certificate::create(CAcertData, DataFormat::FORM_DER));
- }
-}
PKCS12Serializable::PKCS12Serializable(const KeyShPtr &privKey, const CertificateShPtr &cert, const CertificateShPtrVector &chainCerts)
{
m_pkey = privKey;
Serialization::Serialize(stream, getCaCertificateShPtrVector().size());
for(auto it : getCaCertificateShPtrVector())
Serialization::Serialize(stream, it->getDER());
-};
+}
+
+void PKCS12Serializable::Deserialize(IStream &stream)
+{
+ // key
+ size_t numKeys;
+ Deserialization::Deserialize(stream, numKeys);
+ if(numKeys > 0) {
+ int keyType;
+ RawBuffer keyData;
+ Deserialization::Deserialize(stream, keyType);
+ Deserialization::Deserialize(stream, keyData);
+ m_pkey = CKM::Key::create(keyData);
+ }
+
+ // cert
+ size_t numCerts;
+ Deserialization::Deserialize(stream, numCerts);
+ if(numCerts > 0) {
+ RawBuffer certData;
+ Deserialization::Deserialize(stream, certData);
+ m_cert = CKM::Certificate::create(certData, DataFormat::FORM_DER);
+ }
+
+ // CA chain
+ size_t num_CA;
+ Deserialization::Deserialize(stream, num_CA);
+ for(size_t i=0; i<num_CA; i++)
+ {
+ RawBuffer CAcertData;
+ Deserialization::Deserialize(stream, CAcertData);
+ m_ca.push_back(CKM::Certificate::create(CAcertData, DataFormat::FORM_DER));
+ }
+}
} // namespace CKM
struct COMMON_API PolicySerializable : public Policy, ISerializable {
PolicySerializable();
+ ~PolicySerializable();
explicit PolicySerializable(const Policy &);
- explicit PolicySerializable(IStream &);
void Serialize(IStream &) const;
+ void Deserialize(IStream &);
};
struct COMMON_API PKCS12Serializable : public PKCS12Impl, ISerializable {
PKCS12Serializable();
+ ~PKCS12Serializable();
explicit PKCS12Serializable(const PKCS12 &);
- explicit PKCS12Serializable(IStream &);
PKCS12Serializable(
const KeyShPtr &privKey,
const CertificateShPtr &cert,
const CertificateShPtrVector &chainCerts);
void Serialize(IStream &) const;
+ void Deserialize(IStream &);
};
} // namespace CKM
/* ISerializable(){};
* ISerializable(IStream&){}; */
virtual void Serialize(IStream &) const = 0;
+ virtual void Deserialize(IStream &) = 0;
virtual ~ISerializable(){}
};
template <typename T>
static void Deserialize(IStream& stream, T& object)
{
- object = T(stream);
+ object.Deserialize(stream);
}
template <typename T>
static void Deserialize(IStream& stream, T*& object)
{
- object = new T(stream);
+ object->Deserialize(stream);
}
// char
#include <stddef.h>
#include <dpl/exception.h>
#include <dpl/log/log.h>
+#include <cstdio>
namespace CKM {
Exception* Exception::m_lastException = NULL;
void LogUnhandledException(const std::string &str)
{
+ // Logging to console
+ printf("%s\n", str.c_str());
+
// Logging to dlog
LogPedantic(str);
}
int line,
const char *function)
{
+ // Logging to console
+ std::ostringstream msg;
+ msg << "\033[1;5;31m\n=== [" << filename << ":" << line << "] " <<
+ function << " ===\033[m";
+ msg << str;
+ printf("%s\n", msg.str().c_str());
+
// Logging to dlog
CKM::Log::LogSystemSingleton::Instance().Log(CKM::Log::AbstractLogProvider::LogLevel::Error,
str.c_str(),
}
const unsigned char *value = reinterpret_cast<const unsigned char*>(
sqlcipher3_column_blob(m_stmt, column));
+ if (!value) {
+ return boost::optional<RawBuffer>();
+ }
int length = sqlcipher3_column_bytes(m_stmt, column);
LogPedantic("Got blob of length: " << length);
- if (!value)
- return boost::optional<RawBuffer>();
-
RawBuffer temp(value, value + length);
return boost::optional<RawBuffer>(temp);
}
const char * const DLOG = "DLOG";
const char * const JOURNALD = "JOURNALD";
-const char * DEFAULT_PROVIDER = "DLOG";
-const char * DEFAULT_LEVEL = "1";
-
+const char * const NO_ENV_SET = "NO_ENV_VARIABLE";
} // namespace anonymous
LogSystem::LogSystem() : m_providerCtor({
{ JOURNALD, []{ return static_cast<AbstractLogProvider*>(new JournalLogProvider()); } }
})
{
- const char *env_level = getenv(CKM_LOG_LEVEL);
- if (!env_level)
- env_level = DEFAULT_LEVEL;
-
- SetLogLevel(env_level);
+ const char* logLevel = getenv(CKM_LOG_LEVEL);
+ if(logLevel == NULL)
+ logLevel = NO_ENV_SET; // To solve a prevent issue
+ SetLogLevel(logLevel);
AbstractLogProvider* prv = NULL;
+ const char* logProvider = getenv(CKM_LOG_PROVIDER);
+ if(logProvider == NULL)
+ logProvider = NO_ENV_SET; // To solve a prevent issue
try {
- const char *env_provider = getenv(CKM_LOG_PROVIDER);
- if (!env_provider)
- env_provider = DEFAULT_PROVIDER;
-
- prv = m_providerCtor.at(env_provider)();
+ prv = m_providerCtor.at(logProvider)();
} catch(const std::exception&) {
prv = m_providerCtor[DLOG]();
}
--- /dev/null
+/*
+ * Copyright (c) 2000 - 2014 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+/*
+ * @file listener-daemon.cpp
+ * @author Bartlomiej Grzelewski (b.grzelewski@samsung.com)
+ * @version 1.0
+ * @brief Listener daemon handle some events for key-manager.
+ */
+
+#include <fcntl.h>
+#include <unistd.h>
+
+#include <thread>
+#include <glib.h>
+#include <ckm/ckm-control.h>
+#include <ckm/ckm-type.h>
+#include <dlog.h>
+#include <listener-thread.h>
+
+
+#include <map>
+#include <utility>
+#include <string>
+#include <package-manager-zone.h>
+
+#define CKM_LISTENER_TAG "CKM_LISTENER"
+
+#define LISTENER_SLOGD(format, arg...) SLOG(LOG_DEBUG, CKM_LISTENER_TAG, format, ##arg)
+#define LISTENER_SLOGE(format, arg...) SLOG(LOG_ERROR, CKM_LISTENER_TAG, format, ##arg)
+
+namespace { // anonymous namespace
+const char *const ZONE_DEFAULT = "host";
+typedef std::pair<std::string, CKM::Label> PkgmgrEvent;
+typedef std::map<const int, PkgmgrEvent> EventMap;
+
+int _pkgmgr_event_callback(
+ int req_id,
+ const char *pkg_type,
+ const char *pkgid,
+ const char *key,
+ const char *val,
+ const void *pmsg,
+ void *data,
+ const char *zone)
+{
+ (void) pmsg;
+ EventMap *eventMap = static_cast<EventMap *>(data);
+
+ LISTENER_SLOGD(
+ "req_id(%d), pkg_type(%s), pkgid(%s), key(%s), val(%s)",
+ req_id, pkg_type, pkgid, key, val);
+
+ // uninstall package start event
+ if (strncmp(key, "start", strlen(key)) == 0
+ && strncmp(val, "uninstall", strlen(val)) == 0) {
+ if (zone) {
+ eventMap->insert(
+ std::pair<const int, PkgmgrEvent>(
+ req_id,
+ PkgmgrEvent(std::string(zone), CKM::Label(pkgid))
+ )
+ );
+ }
+ else {
+ eventMap->insert(
+ std::pair<const int, PkgmgrEvent>(
+ req_id,
+ PkgmgrEvent(std::string(ZONE_DEFAULT), CKM::Label(pkgid))
+ )
+ );
+ }
+ return 0;
+ }
+ // uninstall package success event
+ else if (strncmp(key, "end", strlen(key)) == 0
+ && strncmp(val, "ok", strlen(val)) == 0) {
+ EventMap::iterator it;
+ it = eventMap->find(req_id);
+
+ if (it == eventMap->end()) {
+ LISTENER_SLOGE("cannot find req_id(%d) in eventMap. Maybe not in case of uninstallation.", req_id);
+ }
+ else {
+ LISTENER_SLOGD("Uninstallation success. pkgid(%s)", pkgid);
+
+ auto control = CKM::Control::create();
+ int ret = control->removeApplicationData(std::get<0>(it->second), std::get<1>(it->second));
+ if (ret != CKM_API_SUCCESS) {
+ LISTENER_SLOGE("removeApplicationData error. ret(%d)", ret);
+ }
+ eventMap->erase(it);
+ }
+ }
+
+ // zone can be "personal", "knox" or "host".
+ LISTENER_SLOGD("zone_name is (%s)", zone);
+
+ return 0;
+}
+
+int listener_main(GMainLoop *main_loop) {
+ LISTENER_SLOGD("Start!");
+
+ EventMap eventMap;
+ int req_id = 0;
+ pkgmgr_client *client = pkgmgr_client_new(PC_LISTENING);
+ if (client == NULL) {
+ LISTENER_SLOGE("Error in pkgmgr client creation");
+ return -1;
+ }
+
+ req_id = pkgmgr_client_listen_status_with_zone(client, _pkgmgr_event_callback, &eventMap);
+ if (req_id < 0) {
+ LISTENER_SLOGE("Error in pkgmgr callback registeration req_id(%d)", req_id);
+ pkgmgr_client_free(client);
+ return -1;
+ }
+
+ LISTENER_SLOGD("Ready to listen!");
+ g_main_loop_run(main_loop);
+ SLOG(LOG_ERROR, CKM_LISTENER_TAG, "%s", "Listener main loop ended.");
+ return 0;
+}
+
+} // namespace anonymous
+
+namespace CKM {
+
+ListenerThread::ListenerThread()
+{
+ main_loop = g_main_loop_new(NULL, FALSE);
+}
+
+void ListenerThread::start()
+{
+ SLOG(LOG_INFO, CKM_LISTENER_TAG, "%s", "Listener will start!");
+ std::thread thread(listener_main, main_loop);
+ thread.detach();
+}
+
+ListenerThread::~ListenerThread()
+{
+}
+
+
+} // namespace CKM
/*
- * ckm-manager
- *
- * Copyright (c) 2000 - 2013 Samsung Electronics Co., Ltd All Rights Reserved
- *
- * Contact: Bumjin Im <bj.im@samsung.com>
+ * Copyright (c) 2014 Samsung Electronics Co.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License
+ *
+ *
+ * @file listener-thread.h
+ * @author Dongseon Lee(ds72.lee@samsung.com)
+ * @version 1.0
+ * @brief Listener thread header file.
*/
+#pragma once
+
+#include <glib.h>
-#ifndef _SMACK_CHECK_H_
-#define _SMACK_CHECK_H_
namespace CKM {
-/*
- * A very simple runtime check for SMACK on the platform
- * Returns 1 if SMACK is present, 0 otherwise
- */
+class ListenerThread
+{
+public:
+ ListenerThread();
+ ListenerThread(const ListenerThread &) = delete;
+ ListenerThread(ListenerThread &&) = delete;
+ ListenerThread& operator=(const ListenerThread &) = delete;
+ ListenerThread& operator=(ListenerThread &&) = delete;
+ virtual ~ListenerThread();
-int smack_runtime_check(void);
+ virtual void start();
-/*
- * A very simple runtime check for SMACK on the platform
- * Returns 1 if SMACK is present, 0 otherwise. If SMACK_ENABLED is not defined
- * It returns 0.
- */
-int smack_check(void);
+private:
+ GMainLoop *main_loop;
+};
} // namespace CKM
-
-#endif // _SMACK_CHECK_H_
typedef int InterfaceID;
struct Credentials {
- uid_t uid;
+ ClientID clientID;
Label smackLabel;
};
#include <key-provider.h>
#include <CryptoService.h>
#include <file-system.h>
+#include <listener-thread.h>
#define REGISTER_SOCKET_SERVICE(manager, service) \
registerSocketService<service>(manager, #service)
CKM::CryptoService::initialize();
{
- LogInfo("Start!");
+ LogInfo("Register socket services!");
CKM::SocketManager manager;
REGISTER_SOCKET_SERVICE(manager, CKM::CKMService);
REGISTER_SOCKET_SERVICE(manager, CKM::OCSPService);
+ // Start listener thread for listening app unstall events and vconf key change event
+ LogInfo("Start app event listening!");
+ CKM::ListenerThread listener;
+ listener.start();
+
+ LogInfo("Start socket services!");
manager.MainLoop();
}
// Manager has been destroyed and we may close external libraries.
+++ /dev/null
-#include <smack-check.h>
-
-#include <stdlib.h>
-#include <sys/smack.h>
-
-#include <dpl/log/log.h>
-
-namespace CKM {
-
-int smack_runtime_check(void)
-{
- static int smack_present = -1;
- if (-1 == smack_present) {
- if (NULL == smack_smackfs_path()) {
- LogDebug("no smack found on device");
- smack_present = 0;
- } else {
- LogDebug("found smack on device");
- smack_present = 1;
- }
- }
- return smack_present;
-}
-
-int smack_check(void)
-{
-#ifndef SMACK_ENABLED
- return 0;
-#else
- return smack_runtime_check();
-#endif
-}
-
-} // namespace CKM
#include <sys/signalfd.h>
#include <sys/types.h>
#include <sys/socket.h>
-#include <sys/smack.h>
#include <sys/un.h>
#include <sys/stat.h>
#include <unistd.h>
-#include <fcntl.h>
#include <signal.h>
#include <errno.h>
#include <time.h>
#include <dpl/log/log.h>
#include <dpl/assert.h>
-#include <smack-check.h>
+#include <ckm/ckm-client-info.h>
#include <socket-manager.h>
namespace {
-
const time_t SOCKET_TIMEOUT = 1000;
-int getCredentialsFromSocket(int sock, CKM::Credentials &cred) {
- CKM::Credentials credentials;
+int getCredentialsFromSocket(int sock, CKM::Credentials &cred, vsm_context_h &vsmCtx)
+{
std::vector<char> result(1);
socklen_t length = 1;
ucred peerCred;
result.push_back('\0');
cred.smackLabel = result.data();
- cred.uid = peerCred.uid;
+ if (!vsmCtx) {
+ CKM::ClientInfo clientInfo(peerCred.uid);
+ cred.clientID = clientInfo.getClientID();
+ LogError("vsmCtx == NULL. ClientID[" << cred.clientID << "]");
+ } else {
+ vsm_zone_h _vsm_zone = vsm_lookup_zone_by_pid(vsmCtx, peerCred.pid);
+ if (!_vsm_zone) {
+ if (0 > vsm_cleanup_context(vsmCtx)) {
+ LogError("Failed to vsm_cleanup_context.");
+ } else if (!(vsmCtx = vsm_create_context())) {
+ LogError("Failed to vsm_create_context.");
+ return -1;
+ }
+ LogDebug("Recreate vsm context Success. vsm_lookup_zone_by_pid:[" << peerCred.pid << "] returned NULL");
+ _vsm_zone = vsm_lookup_zone_by_pid(vsmCtx, peerCred.pid);
+
+ if (!_vsm_zone) {
+ LogError("Failed. vsm_zone lookedup by pid:[" << peerCred.pid << "]");
+ vsm_cleanup_context(vsmCtx);
+ vsmCtx = NULL;
+ return -1;
+ }
+ LogDebug("Success. vsm_lookup_zone_by_pid:[" << peerCred.pid << "]");
+ }
+
+ // construct clientInfo with default zone
+ CKM::ClientInfo clientInfo(peerCred.uid);
+
+ if (!vsm_is_host_zone(_vsm_zone))
+ clientInfo = CKM::ClientInfo(std::string(vsm_get_zone_name(_vsm_zone)), peerCred.uid);
+
+ cred.clientID = clientInfo.getClientID();
+ LogDebug("sock[" << sock << "] clientID[" << cred.clientID << "]");
+ }
return 0;
}
-
} // namespace anonymous
namespace CKM {
SocketManager::SocketManager()
: m_maxDesc(0)
, m_counter(0)
+ , m_vsmCtx(NULL)
{
FD_ZERO(&m_readSet);
FD_ZERO(&m_writeSet);
desc2.service = signalService;
LogInfo("SignalService mounted on " << filefd << " descriptor");
}
+ m_vsmCtx = vsm_create_context();
+ // TODO: handle error
}
SocketManager::~SocketManager() {
}
Credentials peerCred;
- if (0 > getCredentialsFromSocket(client, peerCred)) {
+ if (0 > getCredentialsFromSocket(client, peerCred, m_vsmCtx)) {
LogDebug("Error in getCredentialsFromSocket. Socket closed.");
TEMP_FAILURE_RETRY(close(client));
return;
ThrowMsg(Exception::InitFailed, "Error in sd_listend_fds");
}
- for(fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START+n; ++fd) {
- if (0 < sd_is_socket_unix(fd, SOCK_STREAM, 1,
- desc.serviceHandlerPath.c_str(), 0))
- {
+ for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START+n; ++fd) {
+ if (0 < sd_is_socket_unix(fd, SOCK_STREAM, 1, desc.serviceHandlerPath.c_str(), 0)) {
LogInfo("Useable socket " << desc.serviceHandlerPath <<
" was passed by SystemD under descriptor " << fd);
+ if (m_vsmCtx) {
+ int ret = vsm_declare_link(m_vsmCtx, desc.serviceHandlerPath.c_str(), desc.serviceHandlerPath.c_str());
+ if (ret)
+ LogError("Failed to socket declare link: " << desc.serviceHandlerPath.c_str());
+ }
return fd;
}
}
- LogError("No useable sockets were passed by systemd.");
- return -1;
-}
-
-int SocketManager::CreateDomainSocketHelp(
- const GenericSocketService::ServiceDescription &desc)
-{
- int sockfd;
-
- if (-1 == (sockfd = socket(AF_UNIX, SOCK_STREAM, 0))) {
- int err = errno;
- LogError("Error in socket: " << GetErrnoString(err));
- ThrowMsg(Exception::InitFailed, "Error in socket: " << GetErrnoString(err));
- }
- if (smack_check()) {
- LogInfo("Set up smack label: " << desc.smackLabel);
-
- if (0 != smack_fsetlabel(sockfd, desc.smackLabel.c_str(), SMACK_LABEL_IPIN)) {
- LogError("Error in smack_fsetlabel");
- ThrowMsg(Exception::InitFailed, "Error in smack_fsetlabel");
- }
- } else {
- LogInfo("No smack on platform. Socket won't be securied with smack label!");
- }
-
- int flags;
- if (-1 == (flags = fcntl(sockfd, F_GETFL, 0)))
- flags = 0;
-
- if (-1 == fcntl(sockfd, F_SETFL, flags | O_NONBLOCK)) {
- int err = errno;
- close(sockfd);
- LogError("Error in fcntl: " << GetErrnoString(err));
- ThrowMsg(Exception::InitFailed, "Error in fcntl: " << GetErrnoString(err));
- }
-
- sockaddr_un serverAddress;
- memset(&serverAddress, 0, sizeof(serverAddress));
- serverAddress.sun_family = AF_UNIX;
- strcpy(serverAddress.sun_path, desc.serviceHandlerPath.c_str());
- unlink(serverAddress.sun_path);
-
- mode_t originalUmask;
- originalUmask = umask(0);
-
- if (-1 == bind(sockfd, (struct sockaddr*)&serverAddress, sizeof(serverAddress))) {
- int err = errno;
- close(sockfd);
- LogError("Error in bind: " << GetErrnoString(err));
- ThrowMsg(Exception::InitFailed, "Error in bind: " << GetErrnoString(err));
- }
-
- umask(originalUmask);
-
- if (-1 == listen(sockfd, 5)) {
- int err = errno;
- close(sockfd);
- LogError("Error in listen: " << GetErrnoString(err));
- ThrowMsg(Exception::InitFailed, "Error in listen: " << GetErrnoString(err));
- }
-
- return sockfd;
+ ThrowMsg(Exception::GetSystemdSocketFailed, "No useable sockets were passed by systemd.");
}
void SocketManager::CreateDomainSocket(
const GenericSocketService::ServiceDescription &desc)
{
int sockfd = GetSocketFromSystemD(desc);
- if (-1 == sockfd)
- sockfd = CreateDomainSocketHelp(desc);
auto &description = CreateDefaultReadSocketDescription(sockfd, false);
" Handler: " << desc.serviceHandlerPath.c_str());
}
-void SocketManager::RegisterSocketService(GenericSocketService *service) {
+void SocketManager::RegisterSocketService(
+ GenericSocketService *service)
+{
service->SetSocketManager(this);
auto serviceVector = service->GetServiceDescription();
Try {
#include <mutex>
#include <thread>
-#include <dpl/exception.h>
+#include <vasum.h>
+#include <dpl/exception.h>
#include <generic-socket-manager.h>
namespace CKM {
public:
DECLARE_EXCEPTION_TYPE(CKM::Exception, Base)
DECLARE_EXCEPTION_TYPE(Base, InitFailed)
+ DECLARE_EXCEPTION_TYPE(Base, GetSystemdSocketFailed)
};
SocketManager();
virtual ~SocketManager();
void CreateDomainSocket(
GenericSocketService *service,
const GenericSocketService::ServiceDescription &desc);
- int CreateDomainSocketHelp(
- const GenericSocketService::ServiceDescription &desc);
int GetSocketFromSystemD(
const GenericSocketService::ServiceDescription &desc);
int m_notifyMe[2];
int m_counter;
std::priority_queue<Timeout> m_timeoutQueue;
+ vsm_context_h m_vsmCtx;
};
} // namespace CKM
#define OPENSSL_SUCCESS 1 // DO NOTCHANGE THIS VALUE
#define OPENSSL_FAIL 0 // DO NOTCHANGE THIS VALUE
+#define RAND_READ_BYTES 32
+
namespace CKM {
CryptoService::CryptoService(){
-int CryptoService::initialize() {
- int hw_rand_ret = 0;
- int u_rand_ret = 0;
-
+void CryptoService::initialize() {
// try to initialize using ERR_load_crypto_strings and OpenSSL_add_all_algorithms
ERR_load_crypto_strings();
OpenSSL_add_all_algorithms();
// initialize entropy
std::ifstream ifile(DEV_HW_RANDOM_FILE);
- if(ifile.is_open()) {
- u_rand_ret= RAND_load_file(DEV_HW_RANDOM_FILE, 32);
- }
- if(u_rand_ret != 32 ){
- LogError("Error in HW_RAND file load");
- hw_rand_ret = RAND_load_file(DEV_URANDOM_FILE, 32);
- if(hw_rand_ret != 32) {
- LogError("Error in U_RAND_file_load");
- ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in U_RAND_file_load");
- }
- }
-
- return CKM_CRYPTO_INIT_SUCCESS;
+ if (ifile.is_open()
+ && (RAND_READ_BYTES == RAND_load_file(DEV_HW_RANDOM_FILE, RAND_READ_BYTES)))
+ LogDebug("Success to read from [" << DEV_HW_RANDOM_FILE << "]");
+ else if (RAND_READ_BYTES == RAND_load_file(DEV_URANDOM_FILE, RAND_READ_BYTES))
+ LogDebug("Success to read from [" << DEV_URANDOM_FILE << "]");
+ else
+ ThrowMsg(CryptoService::Exception::Crypto_internal,
+ "Error in U_RAND_file_load");
}
const EVP_MD *CryptoService::getMdAlgo(const HashAlgorithm hashAlgo) {
int CryptoService::createKeyPairDSA(const int size, // size in bits [1024, 2048, 3072, 4096]
- KeyImpl &createdPrivateKey, // returned value
- KeyImpl &createdPublicKey) // returned value
+ KeyImpl &createdPrivateKey, // returned value
+ KeyImpl &createdPublicKey) // returned value
{
- EVP_PKEY_CTX *pctx = NULL;
- EVP_PKEY_CTX *kctx = NULL;
- EVP_PKEY *pkey = NULL;
- EVP_PKEY *pparam = NULL;
-
- // check the parameters of functions
- if(size != 1024 && size !=2048 && size !=3072 && size != 4096) {
- LogError("Error in DSA input size");
- ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in DSA input size");
- }
-
- // check the parameters of functions
- if(&createdPrivateKey == NULL) {
- LogError("Error in createdPrivateKey value");
- ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in createdPrivateKey value");
- }
-
- // check the parameters of functions
- if(&createdPublicKey == NULL) {
- LogError("Error in createdPrivateKey value");
- ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in createdPublicKey value");
- }
-
- Try {
- /* Create the context for generating the parameters */
- if(!(pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_DSA, NULL))) {
- LogError("Error in EVP_PKEY_CTX_new_id function");
- ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_new_id function");
- }
-
- if(EVP_SUCCESS != EVP_PKEY_paramgen_init(pctx)) {
- LogError("Error in EVP_PKEY_paramgen_init function");
- ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_paramgen_init function");
- }
-
- if(EVP_SUCCESS != EVP_PKEY_CTX_set_dsa_paramgen_bits(pctx, size)) {
- LogError("Error in EVP_PKEY_CTX_set_dsa_paramgen_bits(" << size << ") function");
- ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_set_dsa_paramgen_bits(" << size << ") function");
- }
-
- /* Generate parameters */
- if(EVP_SUCCESS != EVP_PKEY_paramgen(pctx, &pparam)) {
- LogError("Error in EVP_PKEY_paramgen function");
- ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_paramgen function");
- }
-
- // Start to generate key
- if(!(kctx = EVP_PKEY_CTX_new(pparam, NULL))) {
- LogError("Error in EVP_PKEY_CTX_new function");
- ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_new function");
- }
-
- if(EVP_SUCCESS != EVP_PKEY_keygen_init(kctx)) {
- LogError("Error in EVP_PKEY_keygen_init function");
- ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_keygen_init function");
- }
-
- /* Generate the key */
- if(EVP_SUCCESS != EVP_PKEY_keygen(kctx, &pkey)) {
- LogError("Error in EVP_PKEY_keygen function");
- ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_keygen function");
- }
- }
- Catch(CryptoService::Exception::opensslError)
- {
- if(pkey) {
- EVP_PKEY_free(pkey);
- }
-
- if(pparam) {
- EVP_PKEY_free(pparam);
- }
-
- if(pctx) {
- EVP_PKEY_CTX_free(pctx);
- }
-
- if(kctx) {
- EVP_PKEY_CTX_free(kctx);
- }
-
- ReThrowMsg(CryptoService::Exception::opensslError,"Error in openssl function !!");
- }
-
- KeyImpl::EvpShPtr ptr(pkey, EVP_PKEY_free); // shared ptr will free pkey
-
- createdPrivateKey = KeyImpl(ptr, KeyType::KEY_DSA_PRIVATE);
- createdPublicKey = KeyImpl(ptr, KeyType::KEY_DSA_PUBLIC);
-
- if(pparam) {
- EVP_PKEY_free(pparam);
- }
-
- if(pctx) {
- EVP_PKEY_CTX_free(pctx);
- }
-
- if(kctx) {
- EVP_PKEY_CTX_free(kctx);
- }
-
- return CKM_CRYPTO_CREATEKEY_SUCCESS;
+ EVP_PKEY_CTX *pctx = NULL;
+ EVP_PKEY_CTX *kctx = NULL;
+ EVP_PKEY *pkey = NULL;
+ EVP_PKEY *pparam = NULL;
+
+ // check the parameters of functions
+ if(size != 1024 && size !=2048 && size !=3072 && size != 4096) {
+ LogError("Error in DSA input size");
+ ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in DSA input size");
+ }
+
+ // check the parameters of functions
+ if(&createdPrivateKey == NULL) {
+ LogError("Error in createdPrivateKey value");
+ ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in createdPrivateKey value");
+ }
+
+ // check the parameters of functions
+ if(&createdPublicKey == NULL) {
+ LogError("Error in createdPrivateKey value");
+ ThrowMsg(CryptoService::Exception::Crypto_internal, "Error in createdPublicKey value");
+ }
+
+ Try {
+ /* Create the context for generating the parameters */
+ if(!(pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_DSA, NULL))) {
+ LogError("Error in EVP_PKEY_CTX_new_id function");
+ ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_new_id function");
+ }
+
+ if(EVP_SUCCESS != EVP_PKEY_paramgen_init(pctx)) {
+ LogError("Error in EVP_PKEY_paramgen_init function");
+ ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_paramgen_init function");
+ }
+
+ if(EVP_SUCCESS != EVP_PKEY_CTX_set_dsa_paramgen_bits(pctx, size)) {
+ LogError("Error in EVP_PKEY_CTX_set_dsa_paramgen_bits(" << size << ") function");
+ ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_set_dsa_paramgen_bits(" << size << ") function");
+ }
+
+ /* Generate parameters */
+ if(EVP_SUCCESS != EVP_PKEY_paramgen(pctx, &pparam)) {
+ LogError("Error in EVP_PKEY_paramgen function");
+ ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_paramgen function");
+ }
+
+ // Start to generate key
+ if(!(kctx = EVP_PKEY_CTX_new(pparam, NULL))) {
+ LogError("Error in EVP_PKEY_CTX_new function");
+ ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_CTX_new function");
+ }
+
+ if(EVP_SUCCESS != EVP_PKEY_keygen_init(kctx)) {
+ LogError("Error in EVP_PKEY_keygen_init function");
+ ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_keygen_init function");
+ }
+
+ /* Generate the key */
+ if(EVP_SUCCESS != EVP_PKEY_keygen(kctx, &pkey)) {
+ LogError("Error in EVP_PKEY_keygen function");
+ ThrowMsg(CryptoService::Exception::opensslError, "Error in EVP_PKEY_keygen function");
+ }
+ }
+ Catch(CryptoService::Exception::opensslError)
+ {
+ if(pkey) {
+ EVP_PKEY_free(pkey);
+ }
+
+ if(pparam) {
+ EVP_PKEY_free(pparam);
+ }
+
+ if(pctx) {
+ EVP_PKEY_CTX_free(pctx);
+ }
+
+ if(kctx) {
+ EVP_PKEY_CTX_free(kctx);
+ }
+
+ ReThrowMsg(CryptoService::Exception::opensslError,"Error in openssl function !!");
+ }
+
+ KeyImpl::EvpShPtr ptr(pkey, EVP_PKEY_free); // shared ptr will free pkey
+
+ createdPrivateKey = KeyImpl(ptr, KeyType::KEY_DSA_PRIVATE);
+ createdPublicKey = KeyImpl(ptr, KeyType::KEY_DSA_PUBLIC);
+
+ if(pparam) {
+ EVP_PKEY_free(pparam);
+ }
+
+ if(pctx) {
+ EVP_PKEY_CTX_free(pctx);
+ }
+
+ if(kctx) {
+ EVP_PKEY_CTX_free(kctx);
+ }
+
+ return CKM_CRYPTO_CREATEKEY_SUCCESS;
}
#define EVP_SUCCESS 1 // DO NOTCHANGE THIS VALUE
#define EVP_FAIL 0 // DO NOTCHANGE THIS VALUE
-#define CKM_CRYPTO_INIT_SUCCESS 1
#define CKM_CRYPTO_CREATEKEY_SUCCESS 2
#define CKM_VERIFY_CHAIN_SUCCESS 5
#define NOT_DEFINED -1
// And system certificates are loaded in the memory during initialization.
// FIPS_MODE - ON, OFF(Default)
// antropy source - /dev/random,/dev/urandom(Default)
- static int initialize();
+ static void initialize();
static int createKeyPairRSA(const int size, // size in bits [1024, 2048, 4096]
KeyImpl &createdPrivateKey, // returned value ==> Key &createdPrivateKey,
void AccessControl::updateCCMode() {
int fipsModeStatus = 0;
int rc = 0;
- bool newMode;
-
- newMode = false;
+ bool newMode = false;
if (newMode == m_ccMode)
return;
fipsModeStatus = FIPS_mode();
- if(m_ccMode) {
- if(fipsModeStatus == 0) { // If FIPS mode off
+ if (m_ccMode) {
+ if (fipsModeStatus == 0) { // If FIPS mode off
rc = FIPS_mode_set(1); // Change FIPS_mode from off to on
- if(rc == 0) {
+ if (rc == 0) {
LogError("Error in FIPS_mode_set function");
}
}
} else {
- if(fipsModeStatus == 1) { // If FIPS mode on
+ if (fipsModeStatus == 1) { // If FIPS mode on
rc = FIPS_mode_set(0); // Change FIPS_mode from on to off
- if(rc == 0) {
+ if (rc == 0) {
LogError("Error in FIPS_mode_set function");
}
}
switch (result) {
case 0:
+ ret = X509_STORE_CTX_get_error(csc.get());
+ LogError("verify error[" << ret << "]: " << X509_verify_cert_error_string(ret));
return CKM_API_ERROR_VERIFICATION_FAILED;
case 1:
return CKM_API_SUCCESS;
CKMLogic::~CKMLogic(){}
-void CKMLogic::loadDKEKFile(uid_t user, const Password &password, bool apiReq) {
- auto &handle = m_userDataMap[user];
+void CKMLogic::loadDKEKFile(
+ const ClientID &clientID,
+ const Password &password,
+ bool apiReq)
+{
+ auto &handle = m_userDataMap[clientID];
- FileSystem fs(user);
+ FileSystem fs(clientID);
auto wrappedDKEKMain = fs.getDKEK();
auto wrappedDKEKBackup = fs.getDKEKBackup();
+#ifdef PASSWORD_PROTECTION_DISABLE
+ if (wrappedDKEKMain.empty()) {
+ wrappedDKEKMain = KeyProvider::generateDomainKEK(clientID, Password(""));
+ fs.saveDKEK(wrappedDKEKMain);
+ }
+
+ try{
+ chooseDKEKFile(handle, Password(""), wrappedDKEKMain, wrappedDKEKBackup);
+ } catch (const KeyProvider::Exception::Base &e) {
+ chooseDKEKFile(handle, password, wrappedDKEKMain, wrappedDKEKBackup);
+ fs.saveDKEK(handle.keyProvider.getWrappedDomainKEK(Password("")));
+ handle.isMainDKEK = true;
+ LogInfo("Password Protected DB was migrated to Password Protection Disabled DB.");
+ }
+#else
if (wrappedDKEKMain.empty()) {
- wrappedDKEKMain = KeyProvider::generateDomainKEK(std::to_string(user), password);
+ wrappedDKEKMain = KeyProvider::generateDomainKEK(clientID, password);
fs.saveDKEK(wrappedDKEKMain);
}
chooseDKEKFile(handle, password, wrappedDKEKMain, wrappedDKEKBackup);
+#endif
if (!password.empty() || apiReq) {
handle.isDKEKConfirmed = true;
}
}
-void CKMLogic::saveDKEKFile(uid_t user, const Password &password) {
- auto &handle = m_userDataMap[user];
+void CKMLogic::saveDKEKFile(const ClientID &clientID, const Password &password) {
+ auto &handle = m_userDataMap[clientID];
- FileSystem fs(user);
+ FileSystem fs(clientID);
if (handle.isMainDKEK)
fs.createDKEKBackup();
handle.isDKEKConfirmed = false;
}
-RawBuffer CKMLogic::unlockUserKey(uid_t user, const Password &password, bool apiRequest) {
+RawBuffer CKMLogic::unlockUserKey(
+ const ClientID &clientID,
+ const Password &password,
+ bool apiRequest)
+{
int retCode = CKM_API_SUCCESS;
try {
- if (0 == m_userDataMap.count(user) || !(m_userDataMap[user].keyProvider.isInitialized())) {
- auto &handle = m_userDataMap[user];
- FileSystem fs(user);
+ if (0 == m_userDataMap.count(clientID) || !(m_userDataMap[clientID].keyProvider.isInitialized())) {
+ auto &handle = m_userDataMap[clientID];
+ FileSystem fs(clientID);
- loadDKEKFile(user, password, apiRequest);
+ loadDKEKFile(clientID, password, apiRequest);
auto wrappedDatabaseDEK = fs.getDBDEK();
if (wrappedDatabaseDEK.empty()) {
- wrappedDatabaseDEK = handle.keyProvider.generateDEK(std::to_string(user));
+ wrappedDatabaseDEK = handle.keyProvider.generateDEK(clientID);
fs.saveDBDEK(wrappedDatabaseDEK);
}
// remove data of removed apps during locked state
AppLabelVector removedApps = fs.clearRemovedsApps();
for(auto& appSmackLabel : removedApps) {
+ handle.crypto.removeKey(appSmackLabel);
handle.database.deleteKey(appSmackLabel);
}
- } else if (apiRequest == true && m_userDataMap[user].isDKEKConfirmed == false) {
+ } else if (apiRequest == true && m_userDataMap[clientID].isDKEKConfirmed == false) {
// now we will try to choose the DKEK key and remove old one
- loadDKEKFile(user, password, apiRequest);
+ loadDKEKFile(clientID, password, apiRequest);
}
} catch (const KeyProvider::Exception::PassWordError &e) {
LogError("Incorrect Password " << e.GetMessage());
if(retCode != CKM_API_SUCCESS) {
// When not successful, UserData in m_userDataMap should be erased.
// Because other operations make decision based on the existence of UserData in m_userDataMap.
- m_userDataMap.erase(user);
+ m_userDataMap.erase(clientID);
}
return MessageBuffer::Serialize(retCode).Pop();
return MessageBuffer::Serialize(CKM_API_SUCCESS).Pop();
}
-RawBuffer CKMLogic::lockUserKey(uid_t user) {
+RawBuffer CKMLogic::lockUserKey(const ClientID &clientID) {
int retCode = CKM_API_SUCCESS;
// TODO try catch for all errors that should be supported by error code
- m_userDataMap.erase(user);
+
+#ifdef PASSWORD_PROTECTION_DISABLE
+ (void) clientID;
+#else
+ m_userDataMap.erase(clientID);
+#endif
return MessageBuffer::Serialize(retCode).Pop();
}
-RawBuffer CKMLogic::removeUserData(uid_t user) {
+RawBuffer CKMLogic::removeUserData(const ClientID &clientID) {
int retCode = CKM_API_SUCCESS;
// TODO try catch for all errors that should be supported by error code
- m_userDataMap.erase(user);
- FileSystem fs(user);
+ m_userDataMap.erase(clientID);
+
+ FileSystem fs(clientID);
fs.removeUserData();
return MessageBuffer::Serialize(retCode).Pop();
}
RawBuffer CKMLogic::changeUserPassword(
- uid_t user,
+ const ClientID &clientID,
const Password &oldPassword,
const Password &newPassword)
{
int retCode = CKM_API_SUCCESS;
+
+#ifdef PASSWORD_PROTECTION_DISABLE
+ (void) clientID;
+ (void) oldPassword;
+ (void) newPassword;
+#else
try {
- loadDKEKFile(user, oldPassword, true);
- saveDKEKFile(user, newPassword);
+ loadDKEKFile(clientID, oldPassword, true);
+ saveDKEKFile(clientID, newPassword);
} catch (const KeyProvider::Exception::PassWordError &e) {
LogError("Incorrect Password " << e.GetMessage());
retCode = CKM_API_ERROR_AUTHENTICATION_FAILED;
LogError("CKM::Exception: " << e.GetMessage());
retCode = CKM_API_ERROR_SERVER_ERROR;
}
+#endif
return MessageBuffer::Serialize(retCode).Pop();
}
RawBuffer CKMLogic::resetUserPassword(
- uid_t user,
+ const ClientID &clientID,
const Password &newPassword)
{
int retCode = CKM_API_SUCCESS;
-
+#ifdef PASSWORD_PROTECTION_DISABLE
+ (void) clientID;
+ (void) newPassword;
+#else
try {
- if (0 == m_userDataMap.count(user)) {
+ if (0 == m_userDataMap.count(clientID)) {
// Check if key exists. If exists we must return error
- FileSystem fs(user);
+ FileSystem fs(clientID);
auto wrappedDKEKMain = fs.getDKEK();
if (!wrappedDKEKMain.empty())
retCode = CKM_API_ERROR_BAD_REQUEST;
} else {
- saveDKEKFile(user, newPassword);
+ saveDKEKFile(clientID, newPassword);
}
} catch (const FileSystem::Exception::Base &e) {
LogError("Error in FileSystem " << e.GetMessage());
LogError("CKM::Exception: " << e.GetMessage());
retCode = CKM_API_ERROR_SERVER_ERROR;
}
+#endif
return MessageBuffer::Serialize(retCode).Pop();
}
-RawBuffer CKMLogic::removeApplicationData(const Label &smackLabel) {
+RawBuffer CKMLogic::removeApplicationData(const std::string &zone, const Label &smackLabel) {
int retCode = CKM_API_SUCCESS;
try {
-
if (smackLabel.empty()) {
retCode = CKM_API_ERROR_INPUT_PARAM;
} else {
- UidVector uids = FileSystem::getUIDsFromDBFile();
- for (auto userId : uids) {
- if (0 == m_userDataMap.count(userId)) {
- FileSystem fs(userId);
+ ClientIDVector clientIDVec = FileSystem::getClientIDsFromDBFile(zone);
+ for (auto clientID : clientIDVec) {
+ if (0 == m_userDataMap.count(clientID)) {
+ FileSystem fs(clientID);
fs.addRemovedApp(smackLabel);
} else {
- auto &handle = m_userDataMap[userId];
+ auto &handle = m_userDataMap[clientID];
+ handle.crypto.removeKey(smackLabel);
handle.database.deleteKey(smackLabel);
}
}
}
-
} catch (const DB::Crypto::Exception::InternalError &e) {
LogError("DB::Crypto couldn't remove data: " << e.GetMessage());
retCode = CKM_API_ERROR_DB_ERROR;
LogWarning("Invalid parameter passed to key-manager");
return CKM_API_ERROR_INPUT_PARAM;
}
-
// check if allowed to save using ownerLabel
int access_ec = m_accessControl.canSave(ownerLabel, cred.smackLabel);
if(access_ec != CKM_API_SUCCESS)
const PolicySerializable &policy)
{
int retCode;
- if (0 == m_userDataMap.count(cred.uid))
+ if (0 == m_userDataMap.count(cred.clientID))
retCode = CKM_API_ERROR_DB_LOCKED;
else
{
const PolicySerializable &certPolicy)
{
int retCode;
- if (0 == m_userDataMap.count(cred.uid))
+ if (0 == m_userDataMap.count(cred.clientID))
retCode = CKM_API_ERROR_DB_LOCKED;
else
{
const Name &name,
const Label &ownerLabel)
{
- if (0 == m_userDataMap.count(cred.uid))
+ if (0 == m_userDataMap.count(cred.clientID))
return CKM_API_ERROR_DB_LOCKED;
if (!isNameValid(name) || !isLabelValid(ownerLabel)) {
return CKM_API_ERROR_INPUT_PARAM;
}
- auto &database = m_userDataMap[cred.uid].database;
+ auto &database = m_userDataMap[cred.clientID].database;
DB::Crypto::Transaction transaction(&database);
// read and check permissions
{
// read all key types
row_optional = database.getRow(name,
- ownerLabel,
- DataType::DB_KEY_FIRST,
- DataType::DB_KEY_LAST);
+ ownerLabel,
+ DataType::DB_KEY_FIRST,
+ DataType::DB_KEY_LAST);
} else {
// read anything else
row_optional = database.getRow(name,
- ownerLabel,
- dataType);
+ ownerLabel,
+ dataType);
}
if(!row_optional) {
return CKM_API_SUCCESS;
}
-
int CKMLogic::readMultiRow(const Name &name,
const Label &ownerLabel,
DataType dataType,
{
// read all key types
database.getRows(name,
- ownerLabel,
- DataType::DB_KEY_FIRST,
- DataType::DB_KEY_LAST,
- output);
+ ownerLabel,
+ DataType::DB_KEY_FIRST,
+ DataType::DB_KEY_LAST,
+ output);
}
else if (dataType.isChainCert())
{
// read all key types
database.getRows(name,
- ownerLabel,
- DataType::DB_CHAIN_FIRST,
- DataType::DB_CHAIN_LAST,
- output);
+ ownerLabel,
+ DataType::DB_CHAIN_FIRST,
+ DataType::DB_CHAIN_LAST,
+ output);
}
else
{
// read anything else
database.getRows(name,
- ownerLabel,
- dataType,
- output);
+ ownerLabel,
+ dataType,
+ output);
}
if(!output.size()) {
- LogError("No row for given name, label and type");
+ /*
+ * readMultiRow is only used to get row which cannot exist
+ * So, it shouldn't print error log
+ */
+ LogDebug("No row for given name, label and type");
return CKM_API_ERROR_DB_ALIAS_UNKNOWN;
}
const Password &password,
DB::RowVector &rows)
{
- if (0 == m_userDataMap.count(cred.uid))
+ if (0 == m_userDataMap.count(cred.clientID))
return CKM_API_ERROR_DB_LOCKED;
// use client label if not explicitly provided
if (!isNameValid(name) || !isLabelValid(ownerLabel))
return CKM_API_ERROR_INPUT_PARAM;
- auto &handler = m_userDataMap[cred.uid];
+ auto &handler = m_userDataMap[cred.clientID];
// read rows
DB::Crypto::Transaction transaction(&handler.database);
const Password &password,
DB::Row &row)
{
- if (0 == m_userDataMap.count(cred.uid))
+ if (0 == m_userDataMap.count(cred.clientID))
return CKM_API_ERROR_DB_LOCKED;
// use client label if not explicitly provided
if (!isNameValid(name) || !isLabelValid(ownerLabel))
return CKM_API_ERROR_INPUT_PARAM;
- auto &handler = m_userDataMap[cred.uid];
+ auto &handler = m_userDataMap[cred.clientID];
// read row
DB::Crypto::Transaction transaction(&handler.database);
int retCode = CKM_API_SUCCESS;
LabelNameVector labelNameVector;
- if (0 < m_userDataMap.count(cred.uid)) {
- auto &database = m_userDataMap[cred.uid].database;
+ if (0 < m_userDataMap.count(cred.clientID)) {
+ auto &database = m_userDataMap[cred.clientID].database;
Try {
if (dataType.isKey()) {
const RawBuffer &data,
const PolicySerializable &policy)
{
- auto &handler = m_userDataMap[cred.uid];
+ auto &handler = m_userDataMap[cred.clientID];
// use client label if not explicitly provided
const Label &ownerLabel = label.empty() ? cred.smackLabel : label;
const PolicySerializable &keyPolicy,
const PolicySerializable &certPolicy)
{
- auto &handler = m_userDataMap[cred.uid];
+ auto &handler = m_userDataMap[cred.clientID];
// use client label if not explicitly provided
const Label &ownerLabel = label.empty() ? cred.smackLabel : label;
const PolicySerializable &policyPrivate,
const PolicySerializable &policyPublic)
{
- if (0 == m_userDataMap.count(cred.uid))
+ if (0 == m_userDataMap.count(cred.clientID))
return CKM_API_ERROR_DB_LOCKED;
KeyImpl prv, pub;
return CKM_API_ERROR_SERVER_ERROR; // TODO error code
}
- auto &database = m_userDataMap[cred.uid].database;
+ auto &database = m_userDataMap[cred.clientID].database;
DB::Crypto::Transaction transaction(&database);
retCode = saveDataHelper(cred,
auto response = MessageBuffer::Serialize(static_cast<int>(LogicCommand::GET_CHAIN_CERT),
commandId,
retCode,
- chainRawVector);
+ chainRawVector,
+ m_accessControl.isCCMode());
return response.Pop();
}
auto response = MessageBuffer::Serialize(static_cast<int>(LogicCommand::GET_CHAIN_ALIAS),
commandId,
retCode,
- chainRawVector);
+ chainRawVector,
+ m_accessControl.isCCMode());
return response.Pop();
}
try {
do {
CryptoService cs;
+ DB::RowVector rowVec;
DB::Row row;
KeyImpl key;
// try certificate first - looking for a public key.
// in case of PKCS, pub key from certificate will be found first
// rather than private key from the same PKCS.
- retCode = readDataHelper(false, cred, DataType::CERTIFICATE, publicKeyOrCertName, ownerLabel, password, row);
- if (retCode == CKM_API_SUCCESS) {
- CertificateImpl cert(row.data, DataFormat::FORM_DER);
+ retCode = readDataHelper(
+ false,
+ cred,
+ DataType::CERTIFICATE,
+ publicKeyOrCertName,
+ ownerLabel,
+ password,
+ rowVec);
+
+ // output cannot be more than 1
+ if (rowVec.size() > 1) {
+ ThrowMsg(CKM::Exception,
+ "More than one certificate mapped to a label[" << ownerLabel << "]");
+ }
+ else if (retCode == CKM_API_SUCCESS && rowVec.size() == 1) {
+ CertificateImpl cert(rowVec[0].data, DataFormat::FORM_DER);
key = cert.getKeyImpl();
- } else if (retCode == CKM_API_ERROR_DB_ALIAS_UNKNOWN) {
- retCode = readDataHelper(false, cred, DataType::DB_KEY_FIRST, publicKeyOrCertName, ownerLabel, password, row);
+ }
+ else if (retCode == CKM_API_ERROR_DB_ALIAS_UNKNOWN && rowVec.size() == 0) {
+ retCode = readDataHelper(
+ false,
+ cred,
+ DataType::DB_KEY_FIRST,
+ publicKeyOrCertName,
+ ownerLabel,
+ password,
+ row);
+
if (retCode != CKM_API_SUCCESS)
break;
key = KeyImpl(row.data);
- } else {
+ }
+ else {
break;
}
int access_ec = m_accessControl.canModify(ownerLabel, cred.smackLabel);
if(access_ec != CKM_API_SUCCESS)
return access_ec;
-
- if (0 == m_userDataMap.count(cred.uid))
+ if (0 == m_userDataMap.count(cred.clientID))
return CKM_API_ERROR_DB_LOCKED;
- auto &database = m_userDataMap[cred.uid].database;
+ auto &database = m_userDataMap[cred.clientID].database;
DB::Crypto::Transaction transaction(&database);
if( !database.isNameLabelPresent(name, ownerLabel) )
CKMLogic& operator=(CKMLogic &&) = delete;
virtual ~CKMLogic();
- RawBuffer unlockUserKey(uid_t user, const Password &password, bool apiRequest = true);
+ RawBuffer unlockUserKey(const ClientID &clientID, const Password &password, bool apiRequest = true);
- RawBuffer lockUserKey(uid_t user);
+ RawBuffer lockUserKey(const ClientID &clientID);
- RawBuffer removeUserData(uid_t user);
+ RawBuffer removeUserData(const ClientID &clientID);
RawBuffer changeUserPassword(
- uid_t user,
+ const ClientID &clientID,
const Password &oldPassword,
const Password &newPassword);
RawBuffer resetUserPassword(
- uid_t user,
+ const ClientID &clientID,
const Password &newPassword);
RawBuffer removeApplicationData(
+ const std::string &zone,
const Label &smackLabel);
RawBuffer saveData(
private:
void loadDKEKFile(
- uid_t user,
+ const ClientID &clientID,
const Password &password,
bool apiReq);
const RawBuffer &second);
void saveDKEKFile(
- uid_t user,
+ const ClientID &clientID,
const Password &password);
int verifyBinaryData(
const PermissionMask permissionMask);
- std::map<uid_t, UserData> m_userDataMap;
+ std::map<ClientID, UserData> m_userDataMap;
AccessControl m_accessControl;
//FileLock m_lock;
};
RawBuffer CKMService::processControl(MessageBuffer &buffer) {
int command = 0;
- uid_t user = 0;
+ ClientID clientID;
ControlCommand cc;
Password newPass, oldPass;
Label smackLabel;
switch(cc) {
case ControlCommand::UNLOCK_USER_KEY:
- buffer.Deserialize(user, newPass);
- return m_logic->unlockUserKey(user, newPass);
+ buffer.Deserialize(clientID, newPass);
+ return m_logic->unlockUserKey(clientID, newPass);
case ControlCommand::LOCK_USER_KEY:
- buffer.Deserialize(user);
- return m_logic->lockUserKey(user);
+ buffer.Deserialize(clientID);
+ return m_logic->lockUserKey(clientID);
case ControlCommand::REMOVE_USER_DATA:
- buffer.Deserialize(user);
- return m_logic->removeUserData(user);
+ buffer.Deserialize(clientID);
+ return m_logic->removeUserData(clientID);
case ControlCommand::CHANGE_USER_PASSWORD:
- buffer.Deserialize(user, oldPass, newPass);
- return m_logic->changeUserPassword(user, oldPass, newPass);
+ buffer.Deserialize(clientID, oldPass, newPass);
+ return m_logic->changeUserPassword(clientID, oldPass, newPass);
case ControlCommand::RESET_USER_PASSWORD:
- buffer.Deserialize(user, newPass);
- return m_logic->resetUserPassword(user, newPass);
+ buffer.Deserialize(clientID, newPass);
+ return m_logic->resetUserPassword(clientID, newPass);
case ControlCommand::REMOVE_APP_DATA:
- buffer.Deserialize(smackLabel);
- return m_logic->removeApplicationData(smackLabel);
- case ControlCommand::UPDATE_CC_MODE:
- return m_logic->updateCCMode();
+ {
+ std::string zone;
+ buffer.Deserialize(zone, smackLabel);
+ return m_logic->removeApplicationData(zone, smackLabel);
+ }
case ControlCommand::SET_PERMISSION:
{
Name name;
Label accessorLabel;
PermissionMask permissionMask = 0;
- buffer.Deserialize(user, name, label, accessorLabel, permissionMask);
- Credentials cred = { user, label };
+ buffer.Deserialize(clientID, name, label, accessorLabel, permissionMask);
+ Credentials cred = { clientID, label };
return m_logic->setPermission(
cred,
command,
accessorLabel,
permissionMask);
}
+ case ControlCommand::UPDATE_CC_MODE:
+ return m_logic->updateCCMode();
default:
Throw(Exception::BrokenProtocol);
}
int tmpDataType = 0;
Name name;
Label label, accessorLabel;
- std::string user;
buffer.Deserialize(command);
buffer.Deserialize(msgID);
// So, to unlock user data when lock type is None, key-manager always try to unlock user data with null password.
// Even if the result is fail, it will be ignored.
Password nullPassword("");
- m_logic->unlockUserKey(cred.uid, nullPassword, false);
+ m_logic->unlockUserKey(cred.clientID, nullPassword, false);
LogDebug("Process storage. Command: " << command);
m_keyMap[smackLabel] = applicationKey;
}
+void CryptoLogic::removeKey(const Label &smackLabel)
+{
+ m_keyMap.erase(smackLabel);
+}
+
RawBuffer CryptoLogic::encryptDataAesCbc(
const RawBuffer &data,
const RawBuffer &key,
bool haveKey(const Label &smackLabel);
void pushKey(const Label &smackLabel,
const RawBuffer &applicationKey);
+ void removeKey(const Label &smackLabel);
private:
static const int ENCR_BASE64 = 1 << 0;
" VALUES(?101, ?103);";
const char *DB_CMD_SCHEMA_GET =
- "SELECT * FROM SCHEMA_INFO WHERE name=?101;";
+ "SELECT * FROM SCHEMA_INFO WHERE name IS ?101;";
const char *DB_SCHEMA_VERSION_FIELD = "schema_version";
" VALUES(?101, ?102);";
const char *DB_CMD_NAME_COUNT_ROWS =
- "SELECT COUNT(idx) FROM NAMES WHERE name=?101 AND label=?102;";
+ "SELECT COUNT(idx) FROM NAMES WHERE name IS ?101 AND label IS ?102;";
const char *DB_CMD_NAME_DELETE =
- "DELETE FROM NAMES WHERE name=?101 AND label=?102;";
+ "DELETE FROM NAMES WHERE name IS ?101 AND label IS ?102;";
const char *DB_CMD_NAME_DELETE_BY_LABEL =
- "DELETE FROM NAMES WHERE label=?102;";
+ "DELETE FROM NAMES WHERE label IS ?102;";
const char *DB_CMD_OBJECT_INSERT =
" iv, dataSize, data, tag, idx) "
" VALUES(?001, ?002, ?003, ?004, ?005, "
" ?006, ?007, ?008,"
- " (SELECT idx FROM NAMES WHERE name=?101 and label=?102)"
+ " (SELECT idx FROM NAMES WHERE name IS ?101 and label IS ?102)"
" );";
const char *DB_CMD_OBJECT_SELECT_BY_NAME_AND_LABEL =
"SELECT * FROM [join_name_object_tables] "
" WHERE (dataType BETWEEN ?001 AND ?002) "
- " AND name=?101 and label=?102;";
+ " AND name IS ?101 and label IS ?102;";
const char *DB_CMD_KEY_INSERT =
"INSERT INTO KEYS(label, key) VALUES (?, ?);";
const char *DB_CMD_KEY_SELECT =
- "SELECT key FROM KEYS WHERE label=?;";
+ "SELECT key FROM KEYS WHERE label IS ?;";
const char *DB_CMD_KEY_DELETE =
- "DELETE FROM KEYS WHERE label=?";
+ "DELETE FROM KEYS WHERE label IS ?;";
const char *DB_CMD_PERMISSION_SET = // SQLite does not support updating views
"REPLACE INTO PERMISSIONS(permissionLabel, permissionMask, idx) "
- " VALUES (?104, ?105, (SELECT idx FROM NAMES WHERE name=?101 and label=?102));";
+ " VALUES (?104, ?105, (SELECT idx FROM NAMES WHERE name IS ?101 and label IS ?102));";
const char *DB_CMD_PERMISSION_SELECT =
"SELECT permissionMask FROM [join_name_permission_tables] "
- " WHERE permissionLabel=?104 "
- " AND name=?101 and label=?102;";
+ " WHERE permissionLabel IS ?104 "
+ " AND name IS ?101 AND label IS ?102;";
const char *DB_CMD_PERMISSION_DELETE = // SQLite does not support updating views
- "DELETE FROM PERMISSIONS WHERE permissionLabel=?104 AND "
- " idx=(SELECT idx FROM NAMES WHERE name=?101 and label=?102);";
+ "DELETE FROM PERMISSIONS WHERE permissionLabel IS ?104 AND "
+ " idx IS (SELECT idx FROM NAMES WHERE name IS ?101 AND label IS ?102);";
/*
*/
const char *DB_CMD_NAME_SELECT_BY_TYPE_AND_PERMISSION =
"SELECT label, name FROM [join_all_tables] "
- " WHERE dataType>=?001 AND dataType<=?002 "
- " AND permissionLabel=?104 AND permissionMask&?004!=0 GROUP BY idx;";
+ " WHERE (dataType BETWEEN ?001 AND ?002) "
+ " AND permissionLabel IS ?104 AND permissionMask&?004 IS NOT 0 GROUP BY idx;";
}
namespace CKM {
bool Crypto::getDBVersion(int & schemaVersion)
{
SchemaInfo SchemaInfo(this);
- if(SchemaInfo.getVersionInfo(schemaVersion)) {
+
+ /*
+ * SCHEMA_INFO (o)
+ * SCHEMA_INFO exists from schema version 3
+ */
+ if (m_connection->CheckTableExist("SCHEMA_INFO")
+ && SchemaInfo.getVersionInfo(schemaVersion)) {
LogDebug("Current DB version: " << schemaVersion);
return true;
}
- else
- {
- LogDebug("No DB version known or DB not present");
- // special case: old CKM_TABLE exists
- if(m_connection->CheckTableExist("CKM_TABLE")) {
- schemaVersion = DB_VERSION_1;
- return true;
- }
+ /*
+ * SCHEMA_INFO (x) / CKM_TABLE (o)
+ * CKM_TABLE exists only in schema version 1
+ * -> schema version 1
+ */
+ if (m_connection->CheckTableExist("CKM_TABLE")) {
+ schemaVersion = DB_VERSION_1;
+ return true;
+ }
- // special case: new scheme exists, but no SCHEMA_INFO table present
- else if(m_connection->CheckTableExist("NAME_TABLE")) {
- schemaVersion = DB_VERSION_2;
- return true;
- }
+ /*
+ * SCHEMA_INFO (x) / CKM_TABLE (x) / NAME_TABLE (o)
+ * NAME_TABLE exists only in schema version 2
+ * -> schema version 2
+ */
+ if (m_connection->CheckTableExist("NAME_TABLE")) {
+ schemaVersion = DB_VERSION_2;
+ return true;
}
+
// not recognized - proceed with an empty DBs
return false;
}
m_initialized = false;
m_finalized = false;
-
m_ctx = EVP_MD_CTX_create();
- if (!m_ctx) {
- ThrowMsg(Exception::InternalError,
- "Failed to memory allocation on EVP_MD_CTX");
+ if (m_ctx == nullptr) {
}
ret = EVP_DigestInit_ex(m_ctx, m_md, NULL);
#include "file-lock.h"
+#include <dpl/errno_string.h>
+
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
FileLock::FileLock(const char* const file)
{
- char errbuf[512] = {0, };
-
// Open lock file
m_lockFd = TEMP_FAILURE_RETRY(creat(file, 0644));
if (m_lockFd == -1) {
- throw io_exception("Cannot open lock file. Errno: ", strerror_r(errno, errbuf, sizeof(errbuf)));
+ throw io_exception("Cannot open lock file. Errno: ", GetErrnoString(errno));
}
if (-1 == lockf(m_lockFd, F_TLOCK, 0)) {
if (errno == EACCES || errno == EAGAIN)
throw io_exception("Can't acquire lock. Another instance must be running.");
else
- throw io_exception("Can't acquire lock. Errno: ", strerror_r(errno, errbuf, sizeof(errbuf)));
+ throw io_exception("Can't acquire lock. Errno: ", GetErrnoString(errno));
}
std::string pid = std::to_string(getpid());
ssize_t written = TEMP_FAILURE_RETRY(write(m_lockFd, pid.c_str(), pid.size()));
if (-1 == written || static_cast<ssize_t>(pid.size()) > written)
- throw io_exception("Can't write file lock. Errno: ", strerror_r(errno, errbuf, sizeof(errbuf)));
+ throw io_exception("Can't write file lock. Errno: ", GetErrnoString(errno));
int ret = fsync(m_lockFd);
if (-1 == ret)
- throw io_exception("Fsync failed. Errno: ", strerror_r(errno, errbuf, sizeof(errbuf)));
+ throw io_exception("Fsync failed. Errno: ", GetErrnoString(errno));
}
FileLock::~FileLock()
const std::string CKM_DB_KEY_PREFIX = "db-key-";
const std::string CKM_DB_PREFIX = "db-";
const std::string CKM_REMOVED_APP_PREFIX = "removed-app-";
-const std::string CKM_LOCK_FILE = "/var/run/key-manager.pid";
+const std::string CKM_LOCK_FILE = "/run/key-manager.pid";
} // namespace anonymous
namespace CKM {
-FileSystem::FileSystem(uid_t uid)
- : m_uid(uid)
+FileSystem::FileSystem(const ClientID &clientID)
+ : m_clientID(clientID)
{}
std::string FileSystem::getDBPath() const
{
std::stringstream ss;
- ss << CKM_DATA_PATH << CKM_DB_PREFIX << m_uid;
+ ss << CKM_DATA_PATH << CKM_DB_PREFIX << m_clientID;
return ss.str();
}
std::string FileSystem::getDKEKPath() const {
std::stringstream ss;
- ss << CKM_DATA_PATH << CKM_KEY_PREFIX << m_uid;
+ ss << CKM_DATA_PATH << CKM_KEY_PREFIX << m_clientID;
return ss.str();
}
std::string FileSystem::getDKEKBackupPath() const {
std::stringstream ss;
- ss << CKM_DATA_PATH << CKM_KEY_BACKUP_PREFIX << m_uid;
+ ss << CKM_DATA_PATH << CKM_KEY_BACKUP_PREFIX << m_clientID;
return ss.str();
}
std::string FileSystem::getDBDEKPath() const {
std::stringstream ss;
- ss << CKM_DATA_PATH << CKM_DB_KEY_PREFIX << m_uid;
+ ss << CKM_DATA_PATH << CKM_DB_KEY_PREFIX << m_clientID;
return ss.str();
}
std::string FileSystem::getRemovedAppsPath() const {
std::stringstream ss;
- ss << CKM_DATA_PATH << CKM_REMOVED_APP_PREFIX << m_uid;
+ ss << CKM_DATA_PATH << CKM_REMOVED_APP_PREFIX << m_clientID;
return ss.str();
}
return 0;
}
-UidVector FileSystem::getUIDsFromDBFile() {
- UidVector uids;
+ClientIDVector FileSystem::getClientIDsFromDBFile(const std::string zone) {
+ ClientIDVector clientIDVec;
std::unique_ptr<DIR, std::function<int(DIR*)>>
dirp(::opendir(CKM_DATA_PATH.c_str()), ::closedir);
if (!dirp.get()) {
int err = errno;
LogError("Error in opendir. Data directory could not be read. Error: " << GetErrnoString(err));
- return UidVector();
+ return ClientIDVector();
}
size_t len = offsetof(struct dirent, d_name) + pathconf(CKM_DATA_PATH.c_str(), _PC_NAME_MAX) + 1;
if (!pEntry.get()) {
LogError("Memory allocation failed.");
- return UidVector();
+ return ClientIDVector();
}
struct dirent* pDirEntry = NULL;
while ( (!readdir_r(dirp.get(), pEntry.get(), &pDirEntry)) && pDirEntry ) {
- // Ignore files with diffrent prefix
if (strncmp(pDirEntry->d_name, CKM_KEY_PREFIX.c_str(), CKM_KEY_PREFIX.size())) {
+ LogDebug("Not DomainKEK file.");
continue;
}
-
- // We find database. Let's extract user id.
+#ifdef DB_PER_ZONE_ENABLE
+ if (strlen(pDirEntry->d_name + CKM_KEY_PREFIX.size()) <= zone.size()) {
+ LogError("Should not happen. "
+ "Key file[" << pDirEntry->d_name << "] clientID(zone + uid) length should be longer than zone name size");
+ continue;
+ }
+ if (strncmp(pDirEntry->d_name + CKM_KEY_PREFIX.size(), zone.c_str(), zone.size())) {
+ LogDebug("Another zone's DomainKEK file.");
+ continue;
+ }
+#else
+ (void) zone;
+#endif
try {
- uids.push_back(static_cast<uid_t>(std::stoi((pDirEntry->d_name)+CKM_KEY_PREFIX.size())));
+ clientIDVec.push_back(pDirEntry->d_name + CKM_KEY_PREFIX.size());
} catch (const std::invalid_argument) {
LogError("Error in extracting uid from db file. Error=std::invalid_argument."
"This will be ignored.File=" << pDirEntry->d_name << "");
"This will be ignored. File="<< pDirEntry->d_name << "");
}
}
-
- return uids;
+ return clientIDVec;
}
int FileSystem::removeUserData() const {
- int err, retCode = 0;
- if (unlink(getDBPath().c_str())) {
- retCode = -1;
- err = errno;
- LogError("Error in unlink user database: " << getDBPath()
- << "Errno: " << errno << " " << GetErrnoString(err));
- }
+ if (removeFile(getDBPath())
+ || removeFile(getDKEKPath())
+ || removeFile(getDKEKBackupPath())
+ || removeFile(getDBDEKPath())
+ || removeFile(getRemovedAppsPath())) {
- if (unlink(getDKEKPath().c_str())) {
- retCode = -1;
- err = errno;
- LogError("Error in unlink user DKEK: " << getDKEKPath()
- << "Errno: " << errno << " " << GetErrnoString(err));
+ return -1;
}
- if (unlink(getDKEKBackupPath().c_str())) {
- retCode = -1;
- err = errno;
- LogDebug("Unlink user backup DKEK failed (file probably does not exists): " << getDKEKBackupPath()
- << "Errno: " << errno << " " << GetErrnoString(err));
- }
+ return 0;
+}
- if (unlink(getDBDEKPath().c_str())) {
- retCode = -1;
- err = errno;
- LogError("Error in unlink user DBDEK: " << getDBDEKPath()
- << "Errno: " << errno << " " << GetErrnoString(err));
- }
+int FileSystem::removeFile(const std::string &path) const
+{
+ if (access(path.c_str(), F_OK) == 0
+ && unlink(path.c_str()) != 0) {
- if (unlink(getRemovedAppsPath().c_str())) {
- retCode = -1;
- err = errno;
- LogError("Error in unlink user's Removed Apps File: " << getRemovedAppsPath()
- << "Errno: " << errno << " " << GetErrnoString(err));
+ int err = errno;
+
+ LogError("Unlink Path[" << path
+ << "] Errno[" << errno
+ << "] ErrnoString[" << GetErrnoString(err) << "]");
+
+ return -1;
}
- return retCode;
+ return 0;
}
FileLock FileSystem::lock()
*/
#pragma once
-#include <ckm/ckm-type.h>
#include <string>
+#include <ckm/ckm-type.h>
#include <file-lock.h>
namespace CKM {
typedef std::vector<std::string> AppLabelVector;
-typedef std::vector<uid_t> UidVector;
+typedef std::vector<ClientID> ClientIDVector;
class FileSystem {
public:
DECLARE_EXCEPTION_TYPE(Base, RenameFailed)
};
- FileSystem(uid_t uid);
+ FileSystem(const ClientID &clientID);
std::string getDBPath() const;
AppLabelVector clearRemovedsApps() const;
static int init();
- static UidVector getUIDsFromDBFile();
+ static ClientIDVector getClientIDsFromDBFile(std::string zone);
static FileLock lock();
virtual ~FileSystem(){}
void saveFile(const std::string &path, const RawBuffer &buffer) const;
std::string getRemovedAppsPath() const;
void moveFile(const std::string &from, const std::string &to) const;
+ int removeFile(const std::string &path) const;
- uid_t m_uid;
+ ClientID m_clientID;
};
} // namespace CKM
return CKM::RawBuffer();
}
+int cleanMemory(void *targetPtr, size_t targetSize)
+{
+ char *ptr = reinterpret_cast<char *>(targetPtr);
+
+ // overwrite ptr
+ for (size_t size = 0; size < targetSize; ++size)
+ ptr[size] = 0;
+
+ // verification
+ for (size_t size = 0; size < targetSize; ++size) {
+ if (0 != ptr[size]) {
+ return -1; // fail
+ }
+ }
+ return 0; // success
+}
+
} // anonymous namespace
using namespace CKM;
memset(wrappedKeyAndInfo, 0, sizeof(WrappedKeyAndInfo));
}
+WrappedKeyAndInfoContainer::WrappedKeyAndInfoContainer(const WrappedKeyAndInfoContainer &second)
+{
+ wrappedKeyAndInfo = new WrappedKeyAndInfo;
+ memcpy(wrappedKeyAndInfo, second.wrappedKeyAndInfo, sizeof(WrappedKeyAndInfo));
+}
+
+WrappedKeyAndInfoContainer &WrappedKeyAndInfoContainer::operator=(const WrappedKeyAndInfoContainer &second)
+{
+ if (this == &second)
+ return *this;
+
+ if (wrappedKeyAndInfo)
+ delete wrappedKeyAndInfo;
+
+ wrappedKeyAndInfo = new WrappedKeyAndInfo;
+ memcpy(wrappedKeyAndInfo, second.wrappedKeyAndInfo, sizeof(WrappedKeyAndInfo));
+ return *this;
+}
+
WrappedKeyAndInfoContainer::WrappedKeyAndInfoContainer(const unsigned char *data)
{
wrappedKeyAndInfo = new WrappedKeyAndInfo;
memset(keyAndInfo, 0, sizeof(KeyAndInfo));
}
+KeyAndInfoContainer::KeyAndInfoContainer(const KeyAndInfoContainer &second)
+{
+ keyAndInfo = new KeyAndInfo;
+ memcpy(keyAndInfo, second.keyAndInfo, sizeof(KeyAndInfo));
+}
+
+KeyAndInfoContainer &KeyAndInfoContainer::operator=(const KeyAndInfoContainer &second)
+{
+ if (this == &second)
+ return *this;
+
+ if (keyAndInfo) {
+ if (cleanMemory(keyAndInfo, sizeof(KeyAndInfo))) {
+ delete keyAndInfo;
+ ThrowMsg(Exception::Base,
+ "KeyAndInfo in KeyAndInfoContainer was not destroyed!");
+ }
+ delete keyAndInfo;
+ }
+
+ keyAndInfo = new KeyAndInfo;
+ memcpy(keyAndInfo, second.keyAndInfo, sizeof(KeyAndInfo));
+ return *this;
+}
+
KeyAndInfoContainer::KeyAndInfoContainer(const unsigned char *data)
{
keyAndInfo = new KeyAndInfo;
KeyAndInfoContainer::~KeyAndInfoContainer()
{
- // overwrite key
- char *ptr = reinterpret_cast<char*>(keyAndInfo);
- for (size_t size = 0; size < sizeof(KeyAndInfo); ++size)
- ptr[size] = 0;
- // verification
- for (size_t size = 0; size < sizeof(KeyAndInfo); ++size) {
- if (0 != ptr[size]) {
- delete keyAndInfo;
- ThrowMsg(Exception::Base, "KeyAndInfo in KeyAndInfoContainer "
- "was not destroyed!");
- }
+ if (cleanMemory(keyAndInfo, sizeof(KeyAndInfo))) {
+ // destroy verification failed.
+ delete keyAndInfo;
+ ThrowMsg(Exception::Base,
+ "KeyAndInfo in KeyAndInfoContainer was not destroyed!");
}
+
delete keyAndInfo;
}
, m_isInitialized(true)
{
if (domainKEKInWrapForm.size() != sizeof(WrappedKeyAndInfo)) {
- LogError("input size:" << domainKEKInWrapForm.size()
- << " Expected: " << sizeof(WrappedKeyAndInfo));
- ThrowMsg(Exception::InputParamError, "buffer doesn't have proper size to store WrappedKeyAndInfo in KeyProvider Constructor");
+ ThrowMsg(Exception::InputParamError,
+ "domainKEKInWrapForm "
+ "input size:" << domainKEKInWrapForm.size() <<
+ " Expected:" << sizeof(WrappedKeyAndInfo));
}
- WrappedKeyAndInfoContainer wkmcDKEK = WrappedKeyAndInfoContainer(domainKEKInWrapForm.data());
+ WrappedKeyAndInfoContainer wkmcDKEK(domainKEKInWrapForm.data());
char *concat_user_pass = NULL;
uint8_t PKEK1[MAX_KEY_SIZE];
concat_user_pass = concat_password_user(
wkmcDKEK.getWrappedKeyAndInfo().keyInfo.label,
- password.c_str());
+ getConvertedStr(password));
if (!PKCS5_PBKDF2_HMAC_SHA1(
concat_user_pass,
wkmcDKEK.getWrappedKeyAndInfo().keyInfo.iv,
m_kmcDKEK->getKeyAndInfo().key))) {
- ThrowMsg(Exception::PassWordError, "VerifyDomainKEK failed in KeyProvider Constructor");
+ ThrowMsg(Exception::PassWordError,
+ "VerifyDomainKEK failed in KeyProvider Constructor");
}
m_kmcDKEK->setKeyInfo(&(wkmcDKEK.getWrappedKeyAndInfo().keyInfo));
ThrowMsg(Exception::InitFailed, "Object not initialized!");
}
- return RawBuffer(m_kmcDKEK->getKeyAndInfo().key, (m_kmcDKEK->getKeyAndInfo().key) + m_kmcDKEK->getKeyAndInfo().keyInfo.keyLength);
+ return RawBuffer(m_kmcDKEK->getKeyAndInfo().key,
+ (m_kmcDKEK->getKeyAndInfo().key)
+ + m_kmcDKEK->getKeyAndInfo().keyInfo.keyLength);
}
RawBuffer KeyProvider::getWrappedDomainKEK(const Password &password)
ThrowMsg(Exception::InitFailed, "Object not initialized!");
}
- WrappedKeyAndInfoContainer wkmcDKEK = WrappedKeyAndInfoContainer();
+ WrappedKeyAndInfoContainer wkmcDKEK;
char *concat_user_pass = NULL;
uint8_t PKEK1[MAX_KEY_SIZE];
concat_user_pass = concat_password_user(
m_kmcDKEK->getKeyAndInfo().keyInfo.label,
- password.c_str());
+ getConvertedStr(password));
if (!PKCS5_PBKDF2_HMAC_SHA1(
concat_user_pass,
}
if (DEKInWrapForm.size() != sizeof(WrappedKeyAndInfo)){
- LogError("input size:" << DEKInWrapForm.size()
- << " Expected: " << sizeof(WrappedKeyAndInfo));
ThrowMsg(Exception::InputParamError,
- "buffer doesn't have proper size to store "
- "WrappedKeyAndInfo in KeyProvider::getPureDEK");
+ "DEKInWrapForm "
+ "input size:" << DEKInWrapForm.size() <<
+ " Expected:" << sizeof(WrappedKeyAndInfo));
}
- KeyAndInfoContainer kmcDEK = KeyAndInfoContainer();
- WrappedKeyAndInfoContainer wkmcDEK = WrappedKeyAndInfoContainer(DEKInWrapForm.data());
+ KeyAndInfoContainer kmcDEK;
+ WrappedKeyAndInfoContainer wkmcDEK(DEKInWrapForm.data());
uint8_t PKEK2[MAX_KEY_SIZE];
int keyLength;
LogDebug("getPureDEK SUCCESS");
return RawBuffer(
kmcDEK.getKeyAndInfo().key,
- (kmcDEK.getKeyAndInfo().key) + kmcDEK.getKeyAndInfo().keyInfo.keyLength);
+ (kmcDEK.getKeyAndInfo().key)
+ + kmcDEK.getKeyAndInfo().keyInfo.keyLength);
}
RawBuffer KeyProvider::generateDEK(const std::string &smackLabel)
"Object not initialized!");
}
- WrappedKeyAndInfoContainer wkmcDEK = WrappedKeyAndInfoContainer();
+ WrappedKeyAndInfoContainer wkmcDEK;
std::string resized_smackLabel;
if (smackLabel.length() < APP_LABEL_SIZE)
const Password &newPass)
{
if (domainKEKInWrapForm.size() != sizeof(WrappedKeyAndInfo)) {
- LogError("input size:" << domainKEKInWrapForm.size()
- << " Expected: " << sizeof(WrappedKeyAndInfo));
ThrowMsg(Exception::InputParamError,
- "buffer doesn't have proper size to store "
- "WrappedKeyAndInfo in KeyProvider::reencrypt");
+ "domainKEKInWrapForm "
+ "input size:" << domainKEKInWrapForm.size() <<
+ " Expected:" << sizeof(WrappedKeyAndInfo));
}
- WrappedKeyAndInfoContainer wkmcOldDKEK = WrappedKeyAndInfoContainer(domainKEKInWrapForm.data());
- WrappedKeyAndInfoContainer wkmcNewDKEK = WrappedKeyAndInfoContainer();
- KeyAndInfoContainer kmcDKEK = KeyAndInfoContainer();
+ WrappedKeyAndInfoContainer wkmcOldDKEK(domainKEKInWrapForm.data());
+ WrappedKeyAndInfoContainer wkmcNewDKEK;
+ KeyAndInfoContainer kmcDKEK;
char *concat_user_pass = NULL;
uint8_t PKEK1[MAX_KEY_SIZE];
concat_user_pass = concat_password_user(
wkmcOldDKEK.getWrappedKeyAndInfo().keyInfo.label,
- oldPass.c_str());
+ getConvertedStr(oldPass));
if (!PKCS5_PBKDF2_HMAC_SHA1(
concat_user_pass,
concat_user_pass = concat_password_user(
kmcDKEK.getKeyAndInfo().keyInfo.label,
- newPass.c_str());
+ getConvertedStr(newPass));
if (!PKCS5_PBKDF2_HMAC_SHA1(
concat_user_pass,
const std::string &user,
const Password &userPassword)
{
- WrappedKeyAndInfoContainer wkmcDKEK = WrappedKeyAndInfoContainer();
+ WrappedKeyAndInfoContainer wkmcDKEK;
uint8_t key[MAX_KEY_SIZE], PKEK1[MAX_KEY_SIZE];
if (!RAND_bytes(wkmcDKEK.getWrappedKeyAndInfo().keyInfo.salt, MAX_SALT_SIZE) ||
int wrappedKeyLength;
char *concat_user_pass = NULL;
- concat_user_pass = concat_password_user(user.c_str(), userPassword.c_str());
+ concat_user_pass = concat_password_user(user.c_str(), getConvertedStr(userPassword));
if (!PKCS5_PBKDF2_HMAC_SHA1(
concat_user_pass,
strlen(concat_user_pass),
LogDebug("KeyProvider Destructor");
}
-int KeyProvider::encryptAes256Gcm(const unsigned char *plaintext, int plaintext_len, const unsigned char *key, const unsigned char *iv, unsigned char *ciphertext, unsigned char *tag)
+int KeyProvider::encryptAes256Gcm(const unsigned char *plaintext,
+ int plaintext_len,
+ const unsigned char *key,
+ const unsigned char *iv,
+ unsigned char *ciphertext,
+ unsigned char *tag)
{
EVP_CIPHER_CTX *ctx;
return ciphertext_len;
}
-int KeyProvider::decryptAes256Gcm(const unsigned char *ciphertext, int ciphertext_len, unsigned char *tag, const unsigned char *key, const unsigned char *iv, unsigned char *plaintext)
+int KeyProvider::decryptAes256Gcm(const unsigned char *ciphertext,
+ int ciphertext_len,
+ unsigned char *tag,
+ const unsigned char *key,
+ const unsigned char *iv,
+ unsigned char *plaintext)
{
EVP_CIPHER_CTX *ctx;
memset(concat_user_pass, '\0', concat_user_pass_len);
memcpy(concat_user_pass, password, strlen(password));
- memcpy(&(concat_user_pass[strlen(password)]), user, strlen(user));
+ memcpy(&(concat_user_pass[strlen(password)]), resized_user, strlen(resized_user));
concat_user_pass[strlen(resized_user) + strlen(password)] = '\0';
delete[] resized_user;
return concat_user_pass;
}
+
+const char* KeyProvider::getConvertedStr(const Password &password)
+{
+ return password.c_str();
+}
class WrappedKeyAndInfoContainer{
public:
WrappedKeyAndInfoContainer();
+
+ WrappedKeyAndInfoContainer(const WrappedKeyAndInfoContainer &);
+ WrappedKeyAndInfoContainer &operator=(const WrappedKeyAndInfoContainer &);
+
WrappedKeyAndInfoContainer(const unsigned char*);
WrappedKeyAndInfo& getWrappedKeyAndInfo();
void setKeyInfoKeyLength(const unsigned int);
DECLARE_EXCEPTION_TYPE(CKM::Exception, Base)
};
KeyAndInfoContainer();
+
+ KeyAndInfoContainer(const KeyAndInfoContainer &);
+ KeyAndInfoContainer &operator=(const KeyAndInfoContainer &);
+
KeyAndInfoContainer(const unsigned char*);
KeyAndInfo& getKeyAndInfo();
void setKeyInfoKeyLength(const unsigned int);
static int closeLibrary();
virtual ~KeyProvider();
+
private:
// KeyAndInfoContainer class
std::shared_ptr<KeyAndInfoContainer> m_kmcDKEK;
const char *user,
const char *password);
+ static const char* getConvertedStr(const Password &password);
};
} // namespace CKM
#include <ocsp-logic.h>
#include <ocsp.h>
+#include <system_info.h>
+
+#define FEATURE_WIFI "tizen.org/feature/network.internet"
+#define FEATURE_TELEPHONY "tizen.org/feature/network.telephony"
+#define FEATURE_TETHERING_BT "tizen.org/feature/network.tethering.bluetooth"
+#define FEATURE_ETHERNET "tizen.org/feature/network.ethernet"
+
namespace CKM {
+namespace {
+
+bool isFeatureOn(const char *feature)
+{
+ bool value = false;
+
+ if (SYSTEM_INFO_ERROR_NONE != system_info_get_platform_bool(feature, &value)) {
+ // system info capi error.
+ return false;
+ }
+
+ return value;
+}
+
+} // namespace anonymous
+
+
+OCSPLogic::OCSPLogic()
+ : m_isNetAvailable(false)
+{
+ setNetAvailable();
+}
+
+void OCSPLogic::setNetAvailable()
+{
+ if (isFeatureOn(FEATURE_WIFI)
+ || isFeatureOn(FEATURE_TELEPHONY)
+ || isFeatureOn(FEATURE_TETHERING_BT)
+ || isFeatureOn(FEATURE_ETHERNET)) {
+ m_isNetAvailable = true;
+ }
+ else {
+ m_isNetAvailable = false;
+ }
+}
+
RawBuffer OCSPLogic::ocspCheck(int commandId, const RawBufferVector &rawChain) {
CertificateImplVector certChain;
OCSPModule ocsp;
int retCode = CKM_API_SUCCESS;
int ocspStatus = CKM_API_OCSP_STATUS_INTERNAL_ERROR;
- for (auto &e: rawChain) {
- certChain.push_back(CertificateImpl(e, DataFormat::FORM_DER));
- if (certChain.rbegin()->empty()) {
- LogDebug("Error in parsing certificates!");
- retCode = CKM_API_ERROR_INPUT_PARAM;
- break;
- }
+
+ if (!m_isNetAvailable) {
+ // try again for in case of system-info error
+ setNetAvailable();
+ }
+
+ if (!m_isNetAvailable) {
+ retCode = CKM_API_ERROR_NOT_SUPPORTED;
}
+ else {
+ for (auto &e: rawChain) {
+ certChain.push_back(CertificateImpl(e, DataFormat::FORM_DER));
+ if (certChain.rbegin()->empty()) {
+ LogDebug("Error in parsing certificates!");
+ retCode = CKM_API_ERROR_INPUT_PARAM;
+ break;
+ }
+ }
- if (retCode == CKM_API_SUCCESS)
- ocspStatus = ocsp.verify(certChain);
+ if (certChain.size() < 2)
+ retCode = CKM_API_ERROR_INPUT_PARAM;
+ else if (retCode == CKM_API_SUCCESS)
+ ocspStatus = ocsp.verify(certChain);
+ }
return MessageBuffer::Serialize(commandId, retCode, ocspStatus).Pop();
}
class OCSPLogic {
public:
- OCSPLogic(){}
+ OCSPLogic();
OCSPLogic(const OCSPLogic &) = delete;
OCSPLogic(OCSPLogic &&) = delete;
OCSPLogic& operator=(const OCSPLogic &) = delete;
RawBuffer ocspCheck(int commandId, const RawBufferVector &rawChain);
virtual ~OCSPLogic(){}
+private:
+ void setNetAvailable();
+
+ bool m_isNetAvailable;
};
// create trusted store
X509_STACK_PTR trustedCerts = create_x509_stack();
- // skip first 2 certificates
- for (auto it=certificateChain.cbegin()+2; it != certificateChain.cend(); it++)
- {
- if (it->empty()) {
+ for (unsigned int i=1; i < certificateChain.size(); i++) { // except leaf certificate
+ if (certificateChain[i].empty()) {
LogError("Error. Broken certificate chain.");
return CKM_API_OCSP_STATUS_INTERNAL_ERROR;
}
- sk_X509_push(trustedCerts.get(), it->getX509());
+ sk_X509_push(trustedCerts.get(), certificateChain[i].getX509());
+ // these trusted certs will be changed while verifying ocsp status.
}
for (unsigned int i=0; i < certificateChain.size() -1; i++) {// except root certificate
}
if (BIO_do_connect(cbio) <= 0) {
- LogDebug("Error in BIO_do_connect.");
+ LogError("Error in BIO_do_connect.");
ERR_print_errors(bioLogger.get());
/* report error */
req = OCSP_REQUEST_new();
if(req == NULL) {
- LogDebug("Error in OCPS_REQUEST_new");
+ LogError("Error in OCPS_REQUEST_new");
return CKM_API_OCSP_STATUS_INTERNAL_ERROR;
}
certid = OCSP_cert_to_id(NULL, cert, issuer);
if(certid == NULL) {
- LogDebug("Error in OCSP_cert_to_id");
+ LogError("Error in OCSP_cert_to_id");
return CKM_API_OCSP_STATUS_INTERNAL_ERROR;
}
if(OCSP_request_add0_id(req, certid) == NULL) {
- LogDebug("Error in OCSP_request_add0_id");
+ LogError("Error in OCSP_request_add0_id");
return CKM_API_OCSP_STATUS_INTERNAL_ERROR;
}
OCSP_REQUEST_free(req);
OCSP_RESPONSE_free(resp);
- LogDebug("Error in OCSP_response_get1_basic");
+ LogError("Error in OCSP_response_get1_basic");
return CKM_API_OCSP_STATUS_INVALID_RESPONSE;
}
OCSP_RESPONSE_free(resp);
OCSP_BASICRESP_free(bs);
X509_STORE_free(trustedStore);
- LogDebug("Error in OCSP_check_nonce");
+ LogError("Error in OCSP_check_nonce");
return CKM_API_OCSP_STATUS_INVALID_RESPONSE;
}
}
OCSP_BASICRESP_free(bs);
X509_STORE_free(trustedStore);
- LogDebug("Error in OCSP_resp_find_status");
+ LogError("Error in OCSP_resp_find_status");
return CKM_API_OCSP_STATUS_INVALID_RESPONSE;
}
OCSP_BASICRESP_free(bs);
X509_STORE_free(trustedStore);
- LogDebug("Error in OCSP_check_validity");
+ LogError("Error in OCSP_check_validity");
return CKM_API_OCSP_STATUS_INVALID_RESPONSE;
}
c_ctx->derive_key = 1;
if(for_ctx == 2)
- if((rc = sqlcipher_cipher_ctx_copy(ctx->read_ctx, c_ctx)) != SQLCIPHER_OK)
+ if((rc = sqlcipher_cipher_ctx_copy(ctx->read_ctx, c_ctx)) != SQLCIPHER_OK)
return rc;
return SQLCIPHER_OK;
int sqlcipher_page_cipher(codec_ctx *ctx, int for_ctx, Pgno pgno, int mode, int page_sz, unsigned char *in, unsigned char *out) {
cipher_ctx *c_ctx = for_ctx ? ctx->write_ctx : ctx->read_ctx;
unsigned char *iv_in, *iv_out, *hmac_in, *hmac_out, *out_start;
- int tmp_csz, csz, size;
+ int tmp_csz, csz, size, rc;
/* calculate some required positions into various buffers */
size = page_sz - c_ctx->reserve_sz; /* adjust size to useable size and memset reserve at end of page */
}
}
- EVP_CipherInit(&c_ctx->ectx, c_ctx->evp_cipher, NULL, NULL, mode);
+ rc = EVP_CipherInit(&c_ctx->ectx, c_ctx->evp_cipher, NULL, NULL, mode);
EVP_CIPHER_CTX_set_padding(&c_ctx->ectx, 0);
- EVP_CipherInit(&c_ctx->ectx, NULL, c_ctx->key, iv_out, mode);
- EVP_CipherUpdate(&c_ctx->ectx, out, &tmp_csz, in, size);
+ rc = EVP_CipherInit(&c_ctx->ectx, NULL, c_ctx->key, iv_out, mode);
+ rc = EVP_CipherUpdate(&c_ctx->ectx, out, &tmp_csz, in, size);
csz = tmp_csz;
out += tmp_csz;
- EVP_CipherFinal(&c_ctx->ectx, out, &tmp_csz);
+ rc = EVP_CipherFinal(&c_ctx->ectx, out, &tmp_csz);
+ // patch to fix unchecked return value warning from prevent
+ (void) rc;
csz += tmp_csz;
EVP_CIPHER_CTX_cleanup(&c_ctx->ectx);
assert(size == csz);
sqlcipher3_int64 priorLimit;
sqlcipher3_int64 excess;
#ifndef SQLCIPHER_OMIT_AUTOINIT
- sqlcipher3_initialize();
+ // patch to fix unchecked return value warning from prevent
+ // sqlcipher3_initialize();
+ int rc = sqlcipher3_initialize();
+ (void) rc;
#endif
sqlcipher3_mutex_enter(mem0.mutex);
priorLimit = mem0.alarmThreshold;
#ifdef HAVE_UTIME
utime(zLockFile, NULL);
#else
- utimes(zLockFile, NULL);
+ // patch to fix unchecked return value warning from prevent
+ // 0 on success, -1 on error. But it doesn't affect on any feature on program.
+ int rcTimeUpdate = utimes(zLockFile, NULL);
+ (void) rcTimeUpdate;
#endif
return SQLCIPHER_OK;
}
** Close a file. Make sure the lock has been released before closing.
*/
static int dotlockClose(sqlcipher3_file *id) {
- int rc;
+ int rc = SQLCIPHER_INTERNAL;
if( id ){
unixFile *pFile = (unixFile*)id;
dotlockUnlock(id, NO_LOCK);
sqlcipher3_free(pFile->lockingContext);
+
+ // patch to fix dereference pointer without null checking
+ rc = closeUnixFile(id);
}
- rc = closeUnixFile(id);
+ // rc = closeUnixFile(id);
return rc;
}
/****************** End of the dot-file lock implementation *******************
void *pMem;
if( pShmNode->h>=0 ){
pMem = mmap(0, szRegion,
- pShmNode->isReadonly ? PROT_READ : PROT_READ|PROT_WRITE,
- MAP_SHARED, pShmNode->h, ((off_t)(pShmNode->nRegion))*szRegion
- );
+ pShmNode->isReadonly ? PROT_READ : PROT_READ|PROT_WRITE,
+ MAP_SHARED, pShmNode->h, ((off_t)(pShmNode->nRegion))*szRegion);
if( pMem==MAP_FAILED ){
rc = unixLogError(SQLCIPHER_IOERR_SHMMAP, "mmap", pShmNode->zFilename);
goto shmpage_out;
const char *zErr;
UNUSED_PARAMETER(NotUsed);
unixEnterMutex();
- zErr = dlerror();
+ /*
+ * Tizen patch. disable dlerror because of prevent defect.
+ * zErr = dlerror();
+ * fix error code for dlerror case.
+ */
+ zErr = "[Tizen] dlfcn function error occured";
if( zErr ){
sqlcipher3_snprintf(nBuf, zBufOut, "%s", zErr);
}
*/
if( pSavepoint ){
u32 ii; /* Loop counter */
- i64 offset = ((i64)(pSavepoint->iSubRec))*(4+pPager->pageSize);
+ i64 offset = pSavepoint->iSubRec*((i64)(4+pPager->pageSize));
if( pagerUseWal(pPager) ){
rc = sqlcipher3WalSavepointUndo(pPager->pWal, pSavepoint->aWalData);
** write the journal record into the file. */
if( rc==SQLCIPHER_OK ){
void *pData = pPg->pData;
- i64 offset = ((i64)(pPager->nSubRec))*(4+pPager->pageSize);
+ i64 offset = pPager->nSubRec*((i64)(4+pPager->pageSize));
char *pData2;
CODEC2(pPager, pData, pPg->pgno, 7, return SQLCIPHER_NOMEM, pData2);
return 3;
}
case 4: { /* 4-byte signed integer */
- pMem->u.i = (((signed char)buf[0])<<24) | (buf[1]<<16) | (buf[2]<<8) | buf[3];
+ pMem->u.i = (i64)(buf[0]<<24) | (buf[1]<<16) | (buf[2]<<8) | buf[3];
pMem->flags = MEM_Int;
return 4;
}
pMem->flags = MEM_Null;
pMem->z = 0;
}else{
- sqlcipher3VdbeMemGrow(pMem, nByte, 0);
+ // patch to fix unchecked return value warning from prevent
+ int rc = sqlcipher3VdbeMemGrow(pMem, nByte, 0);
+ (void) rc;
+
pMem->flags = MEM_Agg;
pMem->u.pDef = p->pFunc;
if( pMem->z ){
const char *zId; /* The function name. */
FuncDef *pDef; /* Information about the function */
u8 enc = ENC(pParse->db); /* The database encoding */
+ int rc; // patch to fix unchecked return value warning from prevent
testcase( pExpr->op==TK_CONST_FUNC );
assert( !ExprHasProperty(pExpr, EP_xIsSelect) );
pNC->hasAgg = 1;
}
if( is_agg ) pNC->allowAgg = 0;
- sqlcipher3WalkExprList(pWalker, pList);
+ // patch to fix unchecked return value warning from prevent
+ rc = sqlcipher3WalkExprList(pWalker, pList);
+ (void) rc;
if( is_agg ) pNC->allowAgg = 1;
/* FIX ME: Compute pExpr->affinity based on the expected return
** type of the function
DbFixer sFix;
Token *pName = 0;
int iDb;
+ int rc; // patch to fix unchecked return value warning from prevent
sqlcipher3 *db = pParse->db;
if( pParse->nVar>0 ){
sqlcipher3SelectDelete(db, pSelect);
return;
}
- sqlcipher3TwoPartName(pParse, pName1, pName2, &pName);
+ rc = sqlcipher3TwoPartName(pParse, pName1, pName2, &pName);
+ // patch to fix unchecked return value warning from prevent
+ (void) rc;
+
iDb = sqlcipher3SchemaToIndex(db, p->pSchema);
if( sqlcipher3FixInit(&sFix, pParse, iDb, "view", pName)
&& sqlcipher3FixSelect(&sFix, pSelect)
NameContext sNameContext; /* Context used to resolve WHERE clause */
WhereInfo *pWInfo; /* Context used by sqlcipher3WhereXXX() */
int iFkIfZero = 0; /* Address of OP_FkIfZero */
+ int rc; // patch to fix unchecked return value warning from prevent
Vdbe *v = sqlcipher3GetVdbe(pParse);
assert( !pIdx || pIdx->pTable==pTab );
memset(&sNameContext, 0, sizeof(NameContext));
sNameContext.pSrcList = pSrc;
sNameContext.pParse = pParse;
- sqlcipher3ResolveExprNames(&sNameContext, pWhere);
+ rc = sqlcipher3ResolveExprNames(&sNameContext, pWhere);
+ // patch to fix unchecked return value warning from prevent
+ (void) rc;
/* Create VDBE to loop through the entries in pSrc that match the WHERE
** clause. If the constraint is not deferred, throw an exception for
#if defined(SQLCIPHER_HAS_CODEC) || defined(SQLCIPHER_ENABLE_CEROD)
if( sqlcipher3StrICmp(zLeft, "activate_extensions")==0 ){
#ifdef SQLCIPHER_HAS_CODEC
- if( sqlcipher3StrNICmp(zRight, "see-", 4)==0 ){
+ if( zRight && sqlcipher3StrNICmp(zRight, "see-", 4)==0 ){
sqlcipher3_activate_see(&zRight[4]);
}
#endif
#ifdef SQLCIPHER_ENABLE_CEROD
- if( sqlcipher3StrNICmp(zRight, "cerod-", 6)==0 ){
+ if( zRight && sqlcipher3StrNICmp(zRight, "cerod-", 6)==0 ){
sqlcipher3_activate_cerod(&zRight[6]);
}
#endif
*/
int rc;
sqlcipher3_stmt *pStmt;
- TESTONLY(int rcp); /* Return code from sqlcipher3_prepare() */
+ int rcp; /* Return code from sqlcipher3_prepare() */
assert( db->init.busy );
db->init.iDb = iDb;
db->init.newTnum = sqlcipher3Atoi(argv[1]);
db->init.orphanTrigger = 0;
- TESTONLY(rcp = ) sqlcipher3_prepare(db, argv[2], -1, &pStmt, 0);
+ rcp = sqlcipher3_prepare(db, argv[2], -1, &pStmt, 0);
rc = db->errCode;
assert( (rc&0xFF)==(rcp&0xFF) );
+ (void) rcp;
+
db->init.iDb = 0;
if( SQLCIPHER_OK!=rc ){
if( db->init.orphanTrigger ){
/* Authorize the subquery */
pParse->zAuthContext = pSubitem->zName;
- sqlcipher3AuthCheck(pParse, SQLCIPHER_SELECT, 0, 0, 0);
+
+ // patch for unchecked return value warning from prevent
+ // sqlcipher3AuthCheck(pParse, SQLCIPHER_SELECT, 0, 0, 0);
+ int authResult = sqlcipher3AuthCheck(pParse, SQLCIPHER_SELECT, 0, 0, 0);
+ (void) authResult;
+
pParse->zAuthContext = zSavedAuthContext;
/* If the sub-query is a compound SELECT statement, then (by restrictions
** The second call, to obtain permission to create the table, is made now.
*/
if( pTable->azModuleArg ){
- sqlcipher3AuthCheck(pParse, SQLCIPHER_CREATE_VTABLE, pTable->zName,
+ int rc = sqlcipher3AuthCheck(pParse, SQLCIPHER_CREATE_VTABLE, pTable->zName,
pTable->azModuleArg[0], pParse->db->aDb[iDb].zName);
+ // patch to fix unchecked return value warning from prevent
+ (void) rc;
}
#endif
}
testcase( pTerm->eOperator==WO_IN );
testcase( pTerm->eOperator==WO_ISNULL );
if( pTerm->eOperator & (WO_IN|WO_ISNULL) ) continue;
+
+ // patch to fix dead code warning from prevent
+ // TERM_VNULL is always 0 if SQLCIPHER_ENABLE_STAT3 feature is not defined.
+#ifdef SQLCIPHER_ENABLE_STAT3
if( pTerm->wtFlags & TERM_VNULL ) continue;
+#endif
nTerm++;
}
testcase( pTerm->eOperator==WO_IN );
testcase( pTerm->eOperator==WO_ISNULL );
if( pTerm->eOperator & (WO_IN|WO_ISNULL) ) continue;
+
+ // patch to fix dead code warning from prevent
+ // TERM_VNULL is always 0 if SQLCIPHER_ENABLE_STAT3 feature is not defined.
+#ifdef SQLCIPHER_ENABLE_STAT3
if( pTerm->wtFlags & TERM_VNULL ) continue;
+#endif
pIdxCons[j].iColumn = pTerm->u.leftColumn;
pIdxCons[j].iTermOffset = i;
pIdxCons[j].op = (u8)pTerm->eOperator;
*/
#include <security-server-plugin-api.h>
+#include <ckm/ckm-client-info.h>
#include <ckm/ckm-control.h>
#include <ckm/ckm-type.h>
class KEY_MANAGER_API Plugin : public PasswordPlugin {
public:
- Plugin();
- virtual int changeUserPassword(uid_t user, const std::string &oldPass, const std::string &newPass);
- virtual int login(uid_t user, const std::string &password);
- virtual int logout(uid_t user);
- virtual int resetUserPassword(uid_t user, const std::string &newPass);
- virtual int removeUserData(uid_t user);
- virtual ~Plugin(){}
+ Plugin() {}
+ virtual int changeUserPassword(const std::string &zone, uid_t user, const std::string &oldPass, const std::string &newPass);
+ virtual int login(const std::string &zone, uid_t user, const std::string &password);
+ virtual int logout(const std::string &zone, uid_t user);
+ virtual int resetUserPassword(const std::string &zone, uid_t user, const std::string &newPass);
+ virtual int removeUserData(const std::string &zone, uid_t user);
+ virtual ~Plugin() {}
private:
- CKM::ControlShPtr m_control;
+ CKM::ClientInfo getClientInfo(const std::string &zone, uid_t user);
};
-Plugin::Plugin() {
- m_control = CKM::Control::create();
+CKM::ClientInfo Plugin::getClientInfo(const std::string &zone, uid_t user)
+{
+ return CKM::ClientInfo(zone, user);
}
-int Plugin::changeUserPassword(uid_t user, const std::string &oldPass, const std::string &newPass) {
+int Plugin::changeUserPassword(
+ const std::string &zone,
+ uid_t user,
+ const std::string &oldPass,
+ const std::string &newPass)
+{
+ auto control = CKM::Control::create();
+ if (!control)
+ return SECURITY_SERVER_PLUGIN_FAIL;
+
CKM::Password oldPwd(oldPass.begin(), oldPass.end());
CKM::Password newPwd(newPass.begin(), newPass.end());
-
- if (!m_control)
- return SECURITY_SERVER_PLUGIN_FAIL;
+ CKM::ClientInfo clientInfo = getClientInfo(zone, user);
// CKM does not allow to change user password if database does
// not exists. We must create database before change password.
- if (CKM_API_SUCCESS != m_control->unlockUserKey(user, oldPwd))
+ if (CKM_API_SUCCESS != control->unlockUserKey(clientInfo, oldPwd))
return SECURITY_SERVER_PLUGIN_FAIL;
-
- if (CKM_API_SUCCESS != m_control->changeUserPassword(user, oldPwd, newPwd))
+ if (CKM_API_SUCCESS != control->changeUserPassword(clientInfo, oldPwd, newPwd))
return SECURITY_SERVER_PLUGIN_FAIL;
return SECURITY_SERVER_PLUGIN_SUCCESS;
}
-int Plugin::login(uid_t user, const std::string &password) {
- CKM::Password pwd(password.begin(), password.end());
-
- if (!m_control)
+int Plugin::login(
+ const std::string &zone,
+ uid_t user,
+ const std::string &password)
+{
+ auto control = CKM::Control::create();
+ if (!control)
return SECURITY_SERVER_PLUGIN_FAIL;
- if (CKM_API_SUCCESS != m_control->unlockUserKey(user, pwd))
+ CKM::Password pwd(password.begin(), password.end());
+
+ if (CKM_API_SUCCESS != control->unlockUserKey(getClientInfo(zone, user), pwd))
return SECURITY_SERVER_PLUGIN_FAIL;
return SECURITY_SERVER_PLUGIN_SUCCESS;
}
-int Plugin::logout(uid_t user) {
- if (!m_control)
+int Plugin::logout(const std::string &zone, uid_t user)
+{
+ auto control = CKM::Control::create();
+ if (!control)
return SECURITY_SERVER_PLUGIN_FAIL;
- if (CKM_API_SUCCESS != m_control->lockUserKey(user))
+ if (CKM_API_SUCCESS != control->lockUserKey(getClientInfo(zone, user)))
return SECURITY_SERVER_PLUGIN_FAIL;
return SECURITY_SERVER_PLUGIN_SUCCESS;
}
-int Plugin::resetUserPassword(uid_t user, const std::string &newPass) {
- CKM::Password pwd(newPass.begin(), newPass.end());
-
- if (!m_control)
+int Plugin::resetUserPassword(
+ const std::string &zone,
+ uid_t user,
+ const std::string &newPass)
+{
+ auto control = CKM::Control::create();
+ if (!control)
return SECURITY_SERVER_PLUGIN_FAIL;
- if (CKM_API_SUCCESS != m_control->resetUserPassword(user, pwd))
+ CKM::Password pwd(newPass.begin(), newPass.end());
+
+ if (CKM_API_SUCCESS != control->resetUserPassword(getClientInfo(zone, user), pwd))
return SECURITY_SERVER_PLUGIN_FAIL;
return SECURITY_SERVER_PLUGIN_SUCCESS;
}
-int Plugin::removeUserData(uid_t user) {
- if (!m_control)
+int Plugin::removeUserData(const std::string &zone, uid_t user)
+{
+ auto control = CKM::Control::create();
+ if (!control)
return SECURITY_SERVER_PLUGIN_FAIL;
- if (CKM_API_SUCCESS != m_control->removeUserData(user))
+ if (CKM_API_SUCCESS != control->removeUserData(getClientInfo(zone, user)))
return SECURITY_SERVER_PLUGIN_FAIL;
return SECURITY_SERVER_PLUGIN_SUCCESS;
void destroy(SecurityServer::PasswordPlugin *obj) {
delete obj;
}
-
-
INSTALL(FILES
${CMAKE_SOURCE_DIR}/systemd/central-key-manager.service
- ${CMAKE_SOURCE_DIR}/systemd/central-key-manager.target
- ${CMAKE_SOURCE_DIR}/systemd/central-key-manager-listener.service
${CMAKE_SOURCE_DIR}/systemd/central-key-manager-api-control.socket
${CMAKE_SOURCE_DIR}/systemd/central-key-manager-api-storage.socket
${CMAKE_SOURCE_DIR}/systemd/central-key-manager-api-ocsp.socket
+[Unit]
+Description=key manager socket for control API
+Before=central-key-manager.service
+
[Socket]
+SocketUser=system
+SocketGroup=system
ListenStream=/tmp/.central-key-manager-api-control.sock
+Service=central-key-manager.service
SocketMode=0777
SmackLabelIPIn=key-manager::api-control
SmackLabelIPOut=@
-Service=central-key-manager.service
-
-[Unit]
-Wants=central-key-manager.target
-Before=central-key-manager.target
-
[Install]
WantedBy=sockets.target
+[Unit]
+Description=key manager socket for ocsp API
+Before=central-key-manager.service
+
[Socket]
+SocketUser=system
+SocketGroup=system
ListenStream=/tmp/.central-key-manager-api-ocsp.sock
+Service=central-key-manager.service
SocketMode=0777
SmackLabelIPIn=key-manager::api-ocsp
SmackLabelIPOut=@
-Service=central-key-manager.service
-
-[Unit]
-Wants=central-key-manager.target
-Before=central-key-manager.target
-
[Install]
WantedBy=sockets.target
+[Unit]
+Description=key manager socket for storage API
+Before=central-key-manager.service
+
[Socket]
+SocketUser=system
+SocketGroup=system
ListenStream=/tmp/.central-key-manager-api-storage.sock
+Service=central-key-manager.service
SocketMode=0777
SmackLabelIPIn=key-manager::api-storage
SmackLabelIPOut=@
-Service=central-key-manager.service
-
-[Unit]
-Wants=central-key-manager.target
-Before=central-key-manager.target
-
[Install]
WantedBy=sockets.target
+++ /dev/null
-[Unit]
-Description=Start the Central Key Manager Listener
-Requires=dbus.service
-After=central-key-manager.service
-
-[Service]
-Type=simple
-ExecStart=/usr/bin/key-manager-listener
-
-[Install]
-WantedBy=multi-user.target
[Unit]
Description=Start the Central Key Manager
-DefaultDependencies=no
+Requires=central-key-manager-api-storage.socket central-key-manager-api-control.socket central-key-manager-api-ocsp.socket
[Service]
+User=system
+Group=system
+SmackProcessLabel=key-manager
Type=notify
ExecStart=/usr/bin/key-manager
Sockets=central-key-manager-api-storage.socket
+++ /dev/null
-[Unit]
-Description=Central Key Manager sockets
-DefaultDependencies=true
-
${KEY_MANAGER_PATH}/service
${KEY_MANAGER_PATH}/common/
${KEY_MANAGER_PATH}/client-async/
+ ${KEY_MANAGER_PATH}/client-capi/
${KEY_MANAGER_SRC_PATH}/include
${KEY_MANAGER_TEST_MERGED_SRC}/
)
)
INSTALL(TARGETS ${TARGET_TEST_MERGED} DESTINATION bin)
+
+################################################################################
+PKG_CHECK_MODULES(KEY_MANAGER_TEST_LCOV_DEP
+ REQUIRED
+ openssl
+ )
+
+
+SET(KEY_MANAGER_TEST_LCOV_SRC ${PROJECT_SOURCE_DIR}/tests)
+
+SET(TEST_LCOV_SOURCES
+ ${KEY_MANAGER_TEST_LCOV_SRC}/main_lcov.cpp
+ ${KEY_MANAGER_TEST_LCOV_SRC}/test_common.cpp
+ ${KEY_MANAGER_TEST_LCOV_SRC}/colour_log_formatter.cpp
+ ${KEY_MANAGER_TEST_LCOV_SRC}/test_lcov_certificate-impl.cpp
+ ${KEY_MANAGER_TEST_LCOV_SRC}/test_lcov_ckmc-type-converter.cpp
+ ${KEY_MANAGER_TEST_LCOV_SRC}/test_lcov_client-error.cpp
+ ${KEY_MANAGER_TEST_LCOV_SRC}/test_lcov_key-impl.cpp
+ ${KEY_MANAGER_PATH}/client/client-error.cpp
+ ${KEY_MANAGER_PATH}/client-capi/ckmc-type-converter.cpp
+ ${KEY_MANAGER_PATH}/dpl/core/src/assert.cpp
+ ${KEY_MANAGER_PATH}/dpl/core/src/colors.cpp
+ )
+
+ADD_EXECUTABLE(${TARGET_TEST_LCOV} ${TEST_LCOV_SOURCES})
+
+TARGET_LINK_LIBRARIES(${TARGET_TEST_LCOV}
+ ${TARGET_KEY_MANAGER_COMMON}
+ ${CMAKE_THREAD_LIBS_INIT}
+ ${KEY_MANAGER_TEST_LCOV_DEP_LIBRARIES}
+ boost_unit_test_framework
+ -ldl
+ )
+
+INSTALL(TARGETS ${TARGET_TEST_LCOV} DESTINATION bin)
--- /dev/null
+/*
+ * Copyright (c) 2000 - 2015 Samsung Electronics Co., Ltd All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+/*
+ * @file main.cpp
+ * @author Krzysztof Jackiewicz (k.jackiewicz@samsung.com)
+ * @version 1.0
+ */
+
+#define BOOST_TEST_MODULE CKM_TEST_LCOV_INTERNAL
+#define BOOST_TEST_MAIN
+
+
+#include <iostream>
+#include <key-provider.h>
+#include <boost/test/unit_test.hpp>
+#include <boost/test/unit_test_log.hpp>
+#include <boost/test/results_reporter.hpp>
+#include <colour_log_formatter.h>
+#include <dpl/log/log.h>
+
+struct TestConfig {
+ TestConfig() {
+ boost::unit_test::unit_test_log.set_threshold_level( boost::unit_test::log_test_units);
+ boost::unit_test::results_reporter::set_level(boost::unit_test::SHORT_REPORT);
+ boost::unit_test::unit_test_log.set_formatter(new CKM::colour_log_formatter);
+ }
+ ~TestConfig(){
+ }
+};
+
+bool isLibInitialized = false;
+
+struct KeyProviderLib {
+ KeyProviderLib() {
+ }
+ ~KeyProviderLib() {
+ }
+};
+
+struct LogSetup {
+ LogSetup() {
+ CKM::Singleton<CKM::Log::LogSystem>::Instance().SetTag("CKM_INTERNAL_TESTS");
+ }
+ ~LogSetup() {}
+};
+
+BOOST_GLOBAL_FIXTURE(KeyProviderLib)
+BOOST_GLOBAL_FIXTURE(TestConfig)
+BOOST_GLOBAL_FIXTURE(LogSetup)
+
return randVal;
}
+
} // namespace anonymous
BOOST_FIXTURE_TEST_SUITE(DBCRYPTO_TEST, DBFixture)
--- /dev/null
+#include <boost/test/unit_test.hpp>
+#include <test_common.h>
+
+#include <certificate-impl.h>
+#include <base64.h>
+#include <openssl/x509.h>
+
+#include <string>
+
+
+using namespace CKM;
+
+BOOST_AUTO_TEST_SUITE(CKM_CERTIFICATE_IMPL_TEST)
+
+
+BOOST_AUTO_TEST_CASE(CKM_CERTIFICATE_IMPL_TESTS) {
+ std::string certStr =
+ "MIIDOzCCAiOgAwIBAgIBADANBgkqhkiG9w0BAQUFADBYMRowGAYDVQQKDBFUaXpl\n"
+ "biBBc3NvY2lhdGlvbjEaMBgGA1UECwwRVGl6ZW4gQXNzb2NpYXRpb24xHjAcBgNV\n"
+ "BAMMFVRpemVuIERldmVsb3BlcnMgUm9vdDAeFw0xMjAxMDEwMDAwMDBaFw0zMjAx\n"
+ "MDEwMDAwMDBaMFgxGjAYBgNVBAoMEVRpemVuIEFzc29jaWF0aW9uMRowGAYDVQQL\n"
+ "DBFUaXplbiBBc3NvY2lhdGlvbjEeMBwGA1UEAwwVVGl6ZW4gRGV2ZWxvcGVycyBS\n"
+ "b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp2rCwXTYh28vcagX\n"
+ "WLIeVtEvXA5EeTR9UnL4Dzyd7hIq8rkxLbIMMOcCrXMTc7bEH2twFaTuXxyKXMW/\n"
+ "2c+id3m3Z1B5caCqwSPr72oKPSI4jSkvrAC5W7EHx16M818aG4tQkXIUBhDrtSmH\n"
+ "6dFOdt8zGq2fanj1sETfUmXAeLGE7OQYcEb2SoWGXR75Ytfp1LAw/L3luuG/kbzB\n"
+ "crZt1Cv05jfCP575eope6p5p80Gl0tieXyPYhSLVTLwhEdWx18CMaC7IXQo2Bm+J\n"
+ "djDH0Ruh/vTRnjFtmVB+nBOZNVzMHNOPUVFKSgysX/+PlM4jBTvbaTnPCZUkC/O7\n"
+ "5tYIpwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBw\n"
+ "95ibcuAiKpAEqBMyTZtOf0okhSi9NYfs/AFIPLH5REnhtQkPmKsvDp21OSdzrFEL\n"
+ "42rV94K98QChD9tGO6Mwp1ZHM3No7/PLC3EelOwmn4dr3KPGdjvQNSwKRblGh0Hj\n"
+ "n4fI+studFLLv6ldCLIpA/Ssgf9GuUbcjTC8OWBYPVUQ6YoXAcuHbfhr6a2IXRTj\n"
+ "lJUCt3qWyciP2H/R+oNBSjtlq13ZT+D9AQMmIG/5w1tK0HzDRhORfWlKCo5JKn0A\n"
+ "iQq2fwtoB0JQEHRKCKZYWghG41HuKc82xLf6H7x24XWOAlXb0SpvVENT1i89XNrj\n"
+ "XS4modIY545rYjI1amfL\n";
+
+ CertificateImpl cert(RawBuffer(certStr.begin(),certStr.end()), DataFormat::FORM_DER_BASE64);
+ X509* certX509 = cert.getX509();
+
+ CertificateImpl cert2(certX509, true);
+
+ CertificateImpl cert3(cert);
+ CertificateImpl cert4(CertificateImpl(cert));
+
+ CertificateImpl cert5 = cert;
+ CertificateImpl cert6 = CertificateImpl(cert);
+
+ KeyImpl::EvpShPtr certEvpShPtr = cert.getEvpShPtr();
+
+ KeyImpl keyImpl = cert.getKeyImpl();
+
+ std::string issuer = cert.getOneLine(CertificateFieldId::ISSUER);
+ std::string subject = cert.getOneLine(CertificateFieldId::SUBJECT);
+
+ std::string issuerCommonNameField = cert.getField(CertificateFieldId::ISSUER, NID_commonName);
+
+ std::string commonName = cert.getCommonName(CertificateFieldId::SUBJECT);
+ std::string country = cert.getCountryName(CertificateFieldId::SUBJECT);
+ std::string state = cert.getStateOrProvinceName(CertificateFieldId::SUBJECT);
+ std::string locality = cert.getLocalityName(CertificateFieldId::SUBJECT);
+ std::string organization = cert.getOrganizationName(CertificateFieldId::SUBJECT);
+ std::string ouName = cert.getOrganizationalUnitName(CertificateFieldId::SUBJECT);
+ std::string email = cert.getEmailAddres(CertificateFieldId::SUBJECT);
+ std::string ocspUrl = cert.getOCSPURL();
+}
+
+BOOST_AUTO_TEST_CASE(CKM_BASE64_TESTS) {
+ std::string origStr = "test data";
+ RawBuffer origBuffer(origStr.begin(), origStr.end());
+
+ Base64Encoder encoder;
+ encoder.reset();
+ encoder.append(origBuffer);
+ encoder.finalize();
+ RawBuffer base64 = encoder.get();
+
+ Base64Decoder decoder;
+ decoder.reset();
+ decoder.append(base64);
+ decoder.finalize();
+ RawBuffer decoded = decoder.get();
+
+ std::string decodedStr = std::string(decoded.begin(), decoded.end());
+
+ BOOST_REQUIRE_MESSAGE(origStr.compare(decodedStr) == 0, "Base64 encoding/decoding returned a wrong value");
+}
+
+
+BOOST_AUTO_TEST_SUITE_END()
--- /dev/null
+#include <boost/test/unit_test.hpp>
+#include <test_common.h>
+
+#include <ckmc/ckmc-type.h>
+#include <ckmc-type-converter.h>
+
+
+#include <string>
+
+
+using namespace CKM;
+
+BOOST_AUTO_TEST_SUITE(CKMC_TYPE_CONVERTER_TEST)
+
+
+BOOST_AUTO_TEST_CASE(CKMC_TYPE_CONVERTER_to_ckm_error) {
+ int ckm_error = -1;
+
+ ckm_error = to_ckm_error(CKMC_ERROR_NONE);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_SUCCESS, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_SOCKET);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_SOCKET, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_BAD_REQUEST);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_BAD_REQUEST, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_BAD_RESPONSE);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_BAD_RESPONSE, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_SEND_FAILED);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_SEND_FAILED, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_RECV_FAILED);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_RECV_FAILED, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_AUTHENTICATION_FAILED);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_AUTHENTICATION_FAILED, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_INVALID_PARAMETER);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_INPUT_PARAM, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_BUFFER_TOO_SMALL);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_BUFFER_TOO_SMALL, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_OUT_OF_MEMORY);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_OUT_OF_MEMORY, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_PERMISSION_DENIED);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_ACCESS_DENIED, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_SERVER_ERROR);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_SERVER_ERROR, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_DB_LOCKED);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_DB_LOCKED, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_DB_ERROR);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_DB_ERROR, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_DB_ALIAS_EXISTS);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_DB_ALIAS_EXISTS, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_DB_ALIAS_UNKNOWN);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_DB_ALIAS_UNKNOWN, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_VERIFICATION_FAILED);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_VERIFICATION_FAILED, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_INVALID_FORMAT);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_INVALID_FORMAT, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_FILE_ACCESS_DENIED);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_FILE_ACCESS_DENIED, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_NOT_EXPORTABLE);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_NOT_EXPORTABLE, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_FILE_SYSTEM);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_FILE_SYSTEM, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_NOT_SUPPORTED);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_NOT_SUPPORTED, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(CKMC_ERROR_UNKNOWN);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_UNKNOWN, "invalid ckm error returned");
+
+ ckm_error = to_ckm_error(-99999);
+ BOOST_REQUIRE_MESSAGE( ckm_error == CKM_API_ERROR_UNKNOWN, "invalid ckm error returned");
+}
+
+
+BOOST_AUTO_TEST_CASE(CKMC_TYPE_CONVERTER_to_ckmc_error) {
+ int ckmc_error = -1;
+
+ ckmc_error = to_ckmc_error(CKM_API_SUCCESS);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_NONE, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_SOCKET);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_SOCKET, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_BAD_REQUEST);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_BAD_REQUEST, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_BAD_RESPONSE);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_BAD_RESPONSE, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_SEND_FAILED);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_SEND_FAILED, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_RECV_FAILED);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_RECV_FAILED, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_AUTHENTICATION_FAILED);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_AUTHENTICATION_FAILED, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_INPUT_PARAM);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_INVALID_PARAMETER, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_BUFFER_TOO_SMALL);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_BUFFER_TOO_SMALL, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_OUT_OF_MEMORY);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_OUT_OF_MEMORY, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_ACCESS_DENIED);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_PERMISSION_DENIED, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_SERVER_ERROR);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_SERVER_ERROR, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_DB_LOCKED);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_DB_LOCKED, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_DB_ERROR);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_DB_ERROR, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_DB_ALIAS_EXISTS);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_DB_ALIAS_EXISTS, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_DB_ALIAS_UNKNOWN);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_DB_ALIAS_UNKNOWN, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_VERIFICATION_FAILED);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_VERIFICATION_FAILED, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_INVALID_FORMAT);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_INVALID_FORMAT, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_FILE_ACCESS_DENIED);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_FILE_ACCESS_DENIED, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_NOT_EXPORTABLE);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_NOT_EXPORTABLE, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_FILE_SYSTEM);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_FILE_SYSTEM, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_NOT_SUPPORTED);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_NOT_SUPPORTED, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(CKM_API_ERROR_UNKNOWN);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_UNKNOWN, "invalid ckmc error returned");
+
+ ckmc_error = to_ckmc_error(-9999);
+ BOOST_REQUIRE_MESSAGE( ckmc_error == CKMC_ERROR_UNKNOWN, "invalid ckmc error returned");
+}
+
+BOOST_AUTO_TEST_CASE(CKMC_TYPE_CONVERTER_to_ckmc_ocsp_status) {
+ int ckmc_ocsp= -1;
+
+ ckmc_ocsp = to_ckmc_ocsp_status(CKM_API_OCSP_STATUS_GOOD);
+ BOOST_REQUIRE_MESSAGE( ckmc_ocsp == CKMC_OCSP_STATUS_GOOD, "invalid ckmc ocsp status returned");
+
+ ckmc_ocsp = to_ckmc_ocsp_status(CKM_API_OCSP_STATUS_UNSUPPORTED);
+ BOOST_REQUIRE_MESSAGE( ckmc_ocsp == CKMC_OCSP_ERROR_UNSUPPORTED, "invalid ckmc ocsp status returned");
+
+ ckmc_ocsp = to_ckmc_ocsp_status(CKM_API_OCSP_STATUS_REVOKED);
+ BOOST_REQUIRE_MESSAGE( ckmc_ocsp == CKMC_OCSP_STATUS_REVOKED, "invalid ckmc ocsp status returned");
+
+ ckmc_ocsp = to_ckmc_ocsp_status(CKM_API_OCSP_STATUS_NET_ERROR);
+ BOOST_REQUIRE_MESSAGE( ckmc_ocsp == CKMC_OCSP_ERROR_NET, "invalid ckmc ocsp status returned");
+
+ ckmc_ocsp = to_ckmc_ocsp_status(CKM_API_OCSP_STATUS_INVALID_URL);
+ BOOST_REQUIRE_MESSAGE( ckmc_ocsp == CKMC_OCSP_ERROR_INVALID_URL, "invalid ckmc ocsp status returned");
+
+ ckmc_ocsp = to_ckmc_ocsp_status(CKM_API_OCSP_STATUS_INVALID_RESPONSE);
+ BOOST_REQUIRE_MESSAGE( ckmc_ocsp == CKMC_OCSP_ERROR_INVALID_RESPONSE, "invalid ckmc ocsp status returned");
+
+ ckmc_ocsp = to_ckmc_ocsp_status(CKM_API_OCSP_STATUS_REMOTE_ERROR);
+ BOOST_REQUIRE_MESSAGE( ckmc_ocsp == CKMC_OCSP_ERROR_REMOTE, "invalid ckmc ocsp status returned");
+
+ ckmc_ocsp = to_ckmc_ocsp_status(CKM_API_OCSP_STATUS_INTERNAL_ERROR);
+ BOOST_REQUIRE_MESSAGE( ckmc_ocsp == CKMC_OCSP_ERROR_INTERNAL, "invalid ckmc ocsp status returned");
+
+ ckmc_ocsp = to_ckmc_ocsp_status(-9999);
+ BOOST_REQUIRE_MESSAGE( ckmc_ocsp == CKMC_OCSP_STATUS_UNKNOWN, "invalid ckmc ocsp status returned");
+}
+
+
+BOOST_AUTO_TEST_CASE(CKMC_TYPE_CONVERTER_to_permission_mask) {
+ int ret = -1;
+ int permissionMask = -1;
+
+ ret = access_to_permission_mask(CKMC_AR_READ, permissionMask);
+ BOOST_REQUIRE_MESSAGE( ret == CKMC_ERROR_NONE , "error returned");
+ BOOST_REQUIRE_MESSAGE( permissionMask == CKMC_PERMISSION_READ, "invalid permission mask returned");
+
+ ret = access_to_permission_mask(CKMC_AR_READ_REMOVE, permissionMask);
+ BOOST_REQUIRE_MESSAGE( ret == CKMC_ERROR_NONE , "error returned");
+ BOOST_REQUIRE_MESSAGE( permissionMask == (CKMC_PERMISSION_READ | CKMC_PERMISSION_REMOVE),
+ "invalid permission mask returned");
+}
+
+BOOST_AUTO_TEST_SUITE_END()
--- /dev/null
+#include <boost/test/unit_test.hpp>
+#include <test_common.h>
+
+#include <ckm/ckm-type.h>
+#include <ckm/ckm-error.h>
+
+#include <string>
+
+
+using namespace CKM;
+
+BOOST_AUTO_TEST_SUITE(CKM_ERROR_TEST)
+
+
+BOOST_AUTO_TEST_CASE(CKM_ERROR_ErrorToString) {
+ std::string errString;
+
+ errString = std::string(ErrorToString(CKM_API_SUCCESS));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_SUCCESS") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_SOCKET));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_SOCKET") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_BAD_REQUEST));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_BAD_REQUEST") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_BAD_RESPONSE));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_BAD_RESPONSE") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_SEND_FAILED));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_SEND_FAILED") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_RECV_FAILED));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_RECV_FAILED") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_AUTHENTICATION_FAILED));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_AUTHENTICATION_FAILED") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_INPUT_PARAM));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_INPUT_PARAM") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_BUFFER_TOO_SMALL));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_BUFFER_TOO_SMALL") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_OUT_OF_MEMORY));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_OUT_OF_MEMORY") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_ACCESS_DENIED));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_ACCESS_DENIED") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_SERVER_ERROR));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_SERVER_ERROR") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_DB_LOCKED));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_DB_LOCKED") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_DB_ERROR));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_DB_ERROR") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_DB_ALIAS_EXISTS));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_DB_ALIAS_EXISTS") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_DB_ALIAS_UNKNOWN));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_DB_ALIAS_UNKNOWN") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_VERIFICATION_FAILED));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_VERIFICATION_FAILED") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_INVALID_FORMAT));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_INVALID_FORMAT") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_FILE_ACCESS_DENIED));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_FILE_ACCESS_DENIED") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_NOT_EXPORTABLE));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_NOT_EXPORTABLE") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_FILE_SYSTEM));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_FILE_SYSTEM") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(CKM_API_ERROR_UNKNOWN));
+ BOOST_REQUIRE_MESSAGE(errString.compare("CKM_API_ERROR_UNKNOWN") == 0, "Invalid Error String");
+
+ errString = std::string(ErrorToString(-99999));
+ BOOST_REQUIRE_MESSAGE(errString.compare("Error not defined") == 0, "Invalid Error String");
+}
+
+
+BOOST_AUTO_TEST_SUITE_END()
--- /dev/null
+#include <boost/test/unit_test.hpp>
+#include <test_common.h>
+
+#include <key-impl.h>
+#include <ckm/ckm-type.h>
+
+#include <string>
+
+
+using namespace CKM;
+
+BOOST_AUTO_TEST_SUITE(CKM_KEY_IMPL_TEST)
+
+
+BOOST_AUTO_TEST_CASE(CKM_KEY_IMPL_TESTS) {
+
+ std::string keyPem = "-----BEGIN PUBLIC KEY-----\n"
+ "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2b1bXDa+S8/MGWnMkru4\n"
+ "T4tUddtZNi0NVjQn9RFH1NMa220GsRhRO56F77FlSVFKfSfVZKIiWg6C+DVCkcLf\n"
+ "zXJ/Z0pvwOQYBAqVMFjV6efQGN0JzJ1Unu7pPRiZl7RKGEI+cyzzrcDyrLLrQ2W7\n"
+ "0ZySkNEOv6Frx9JgC5NExuYY4lk2fQQa38JXiZkfyzif2em0px7mXbyf5LjccsKq\n"
+ "v1e+XLtMsL0ZefRcqsP++NzQAI8fKX7WBT+qK0HJDLiHrKOTWYzx6CwJ66LD/vvf\n"
+ "j55xtsKDLVDbsotvf8/m6VLMab+vqKk11TP4tq6yo0mwyTADvgl1zowQEO9I1W6o\n"
+ "zQIDAQAB\n"
+ "-----END PUBLIC KEY-----";
+
+ CKM::RawBuffer buffer(keyPem.begin(), keyPem.end());
+ KeyImpl key(buffer, CKM::Password());
+
+ KeyImpl key2(key);
+ KeyImpl key3 = key2;
+
+ KeyImpl::EvpShPtr keyEvpShPtr = key3.getEvpShPtr();
+ ElipticCurve curve = key.getCurve();
+ int size = key.getSize();
+
+ BOOST_REQUIRE_MESSAGE(keyEvpShPtr != NULL, "Null Key Pointer");
+ BOOST_REQUIRE_MESSAGE(curve == ElipticCurve::prime192v1, "Invalid Curve");
+ BOOST_REQUIRE_MESSAGE(size >= 0, "Invalid Key Size");
+}
+
+
+BOOST_AUTO_TEST_SUITE_END()
string so_path(argv[3]);
string symbol(argv[4]);
+ /*
+ * perform sanity check of user input string
+ * which will be used for dlopen
+ */
+ if (so_path.compare(so_path.size() - 3, 3, ".so")
+ && so_path.compare(so_path.size() - 5, 3, ".so")
+ && so_path.compare(so_path.size() - 9, 3, ".so")) {
+ cerr << "[" << so_path << "] doesn't has .so postfix." << endl;
+ return -1;
+ }
+ if (access(so_path.c_str(), R_OK)) {
+ cerr << "cannot read [" << so_path << "]" << endl;
+ return -1;
+ }
+
cout << "dlopen[us];dlsym[us]" << endl;
for (int cnt = 0 ; cnt < repeats; cnt++)
{
/*
- * It has to be a different process each time. Glibc somehow caches the library information
- * and consecutive calls are faster
+ * It has to be a different process each time. Glibc somehow caches the library information
+ * and consecutive calls are faster
*/
pid_t pid = fork();
if (pid < 0) {
projects / framework / security / key-manager.git / commitdiff
