summaryrefslogtreecommitdiff
path: root/ssh-pkcs11.c
diff options
context:
space:
mode:
Diffstat (limited to 'ssh-pkcs11.c')
-rw-r--r--ssh-pkcs11.c41
1 files changed, 26 insertions, 15 deletions
diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c
index d1f750db0..aaf712d9a 100644
--- a/ssh-pkcs11.c
+++ b/ssh-pkcs11.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssh-pkcs11.c,v 1.22 2016/02/12 00:20:30 djm Exp $ */ 1/* $OpenBSD: ssh-pkcs11.c,v 1.23 2016/10/28 03:33:52 djm Exp $ */
2/* 2/*
3 * Copyright (c) 2010 Markus Friedl. All rights reserved. 3 * Copyright (c) 2010 Markus Friedl. All rights reserved.
4 * 4 *
@@ -577,7 +577,8 @@ pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp)
577 577
578 *keyp = NULL; 578 *keyp = NULL;
579 if (pkcs11_provider_lookup(provider_id) != NULL) { 579 if (pkcs11_provider_lookup(provider_id) != NULL) {
580 error("provider already registered: %s", provider_id); 580 debug("%s: provider already registered: %s",
581 __func__, provider_id);
581 goto fail; 582 goto fail;
582 } 583 }
583 /* open shared pkcs11-libarary */ 584 /* open shared pkcs11-libarary */
@@ -594,23 +595,27 @@ pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp)
594 p->handle = handle; 595 p->handle = handle;
595 /* setup the pkcs11 callbacks */ 596 /* setup the pkcs11 callbacks */
596 if ((rv = (*getfunctionlist)(&f)) != CKR_OK) { 597 if ((rv = (*getfunctionlist)(&f)) != CKR_OK) {
597 error("C_GetFunctionList failed: %lu", rv); 598 error("C_GetFunctionList for provider %s failed: %lu",
599 provider_id, rv);
598 goto fail; 600 goto fail;
599 } 601 }
600 p->function_list = f; 602 p->function_list = f;
601 if ((rv = f->C_Initialize(NULL)) != CKR_OK) { 603 if ((rv = f->C_Initialize(NULL)) != CKR_OK) {
602 error("C_Initialize failed: %lu", rv); 604 error("C_Initialize for provider %s failed: %lu",
605 provider_id, rv);
603 goto fail; 606 goto fail;
604 } 607 }
605 need_finalize = 1; 608 need_finalize = 1;
606 if ((rv = f->C_GetInfo(&p->info)) != CKR_OK) { 609 if ((rv = f->C_GetInfo(&p->info)) != CKR_OK) {
607 error("C_GetInfo failed: %lu", rv); 610 error("C_GetInfo for provider %s failed: %lu",
611 provider_id, rv);
608 goto fail; 612 goto fail;
609 } 613 }
610 rmspace(p->info.manufacturerID, sizeof(p->info.manufacturerID)); 614 rmspace(p->info.manufacturerID, sizeof(p->info.manufacturerID));
611 rmspace(p->info.libraryDescription, sizeof(p->info.libraryDescription)); 615 rmspace(p->info.libraryDescription, sizeof(p->info.libraryDescription));
612 debug("manufacturerID <%s> cryptokiVersion %d.%d" 616 debug("provider %s: manufacturerID <%s> cryptokiVersion %d.%d"
613 " libraryDescription <%s> libraryVersion %d.%d", 617 " libraryDescription <%s> libraryVersion %d.%d",
618 provider_id,
614 p->info.manufacturerID, 619 p->info.manufacturerID,
615 p->info.cryptokiVersion.major, 620 p->info.cryptokiVersion.major,
616 p->info.cryptokiVersion.minor, 621 p->info.cryptokiVersion.minor,
@@ -622,13 +627,15 @@ pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp)
622 goto fail; 627 goto fail;
623 } 628 }
624 if (p->nslots == 0) { 629 if (p->nslots == 0) {
625 error("no slots"); 630 debug("%s: provider %s returned no slots", __func__,
631 provider_id);
626 goto fail; 632 goto fail;
627 } 633 }
628 p->slotlist = xcalloc(p->nslots, sizeof(CK_SLOT_ID)); 634 p->slotlist = xcalloc(p->nslots, sizeof(CK_SLOT_ID));
629 if ((rv = f->C_GetSlotList(CK_TRUE, p->slotlist, &p->nslots)) 635 if ((rv = f->C_GetSlotList(CK_TRUE, p->slotlist, &p->nslots))
630 != CKR_OK) { 636 != CKR_OK) {
631 error("C_GetSlotList failed: %lu", rv); 637 error("C_GetSlotList for provider %s failed: %lu",
638 provider_id, rv);
632 goto fail; 639 goto fail;
633 } 640 }
634 p->slotinfo = xcalloc(p->nslots, sizeof(struct pkcs11_slotinfo)); 641 p->slotinfo = xcalloc(p->nslots, sizeof(struct pkcs11_slotinfo));
@@ -638,20 +645,23 @@ pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp)
638 token = &p->slotinfo[i].token; 645 token = &p->slotinfo[i].token;
639 if ((rv = f->C_GetTokenInfo(p->slotlist[i], token)) 646 if ((rv = f->C_GetTokenInfo(p->slotlist[i], token))
640 != CKR_OK) { 647 != CKR_OK) {
641 error("C_GetTokenInfo failed: %lu", rv); 648 error("C_GetTokenInfo for provider %s slot %lu "
649 "failed: %lu", provider_id, (unsigned long)i, rv);
642 continue; 650 continue;
643 } 651 }
644 if ((token->flags & CKF_TOKEN_INITIALIZED) == 0) { 652 if ((token->flags & CKF_TOKEN_INITIALIZED) == 0) {
645 debug2("%s: ignoring uninitialised token in slot %lu", 653 debug2("%s: ignoring uninitialised token in "
646 __func__, (unsigned long)i); 654 "provider %s slot %lu", __func__,
655 provider_id, (unsigned long)i);
647 continue; 656 continue;
648 } 657 }
649 rmspace(token->label, sizeof(token->label)); 658 rmspace(token->label, sizeof(token->label));
650 rmspace(token->manufacturerID, sizeof(token->manufacturerID)); 659 rmspace(token->manufacturerID, sizeof(token->manufacturerID));
651 rmspace(token->model, sizeof(token->model)); 660 rmspace(token->model, sizeof(token->model));
652 rmspace(token->serialNumber, sizeof(token->serialNumber)); 661 rmspace(token->serialNumber, sizeof(token->serialNumber));
653 debug("label <%s> manufacturerID <%s> model <%s> serial <%s>" 662 debug("provider %s slot %lu: label <%s> manufacturerID <%s> "
654 " flags 0x%lx", 663 "model <%s> serial <%s> flags 0x%lx",
664 provider_id, (unsigned long)i,
655 token->label, token->manufacturerID, token->model, 665 token->label, token->manufacturerID, token->model,
656 token->serialNumber, token->flags); 666 token->serialNumber, token->flags);
657 /* open session, login with pin and retrieve public keys */ 667 /* open session, login with pin and retrieve public keys */
@@ -663,11 +673,12 @@ pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp)
663 p->refcount++; /* add to provider list */ 673 p->refcount++; /* add to provider list */
664 return (nkeys); 674 return (nkeys);
665 } 675 }
666 error("no keys"); 676 debug("%s: provider %s returned no keys", __func__, provider_id);
667 /* don't add the provider, since it does not have any keys */ 677 /* don't add the provider, since it does not have any keys */
668fail: 678fail:
669 if (need_finalize && (rv = f->C_Finalize(NULL)) != CKR_OK) 679 if (need_finalize && (rv = f->C_Finalize(NULL)) != CKR_OK)
670 error("C_Finalize failed: %lu", rv); 680 error("C_Finalize for provider %s failed: %lu",
681 provider_id, rv);
671 if (p) { 682 if (p) {
672 free(p->slotlist); 683 free(p->slotlist);
673 free(p->slotinfo); 684 free(p->slotinfo);