feat: init commit,fork from google native-pkcs11
This commit is contained in:
252
native-pkcs11/src/object_store.rs
Normal file
252
native-pkcs11/src/object_store.rs
Normal file
@@ -0,0 +1,252 @@
|
||||
// Copyright 2022 Google LLC
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
use std::collections::HashMap;
|
||||
|
||||
use cached::{Cached, TimedCache};
|
||||
use native_pkcs11_core::{
|
||||
attribute::{Attribute, AttributeType, Attributes},
|
||||
Result,
|
||||
};
|
||||
use native_pkcs11_traits::{backend, KeySearchOptions};
|
||||
use pkcs11_sys::{
|
||||
CKO_CERTIFICATE,
|
||||
CKO_PRIVATE_KEY,
|
||||
CKO_PUBLIC_KEY,
|
||||
CKO_SECRET_KEY,
|
||||
CKP_BASELINE_PROVIDER,
|
||||
CK_OBJECT_HANDLE,
|
||||
};
|
||||
use tracing::{instrument, warn};
|
||||
|
||||
use crate::{object::Object, Error};
|
||||
|
||||
#[derive(Debug)]
|
||||
pub struct ObjectStore {
|
||||
objects: HashMap<CK_OBJECT_HANDLE, Object>,
|
||||
handles_by_object: HashMap<Object, CK_OBJECT_HANDLE>,
|
||||
next_object_handle: CK_OBJECT_HANDLE,
|
||||
query_cache: TimedCache<Attributes, Vec<CK_OBJECT_HANDLE>>,
|
||||
}
|
||||
|
||||
impl ObjectStore {
|
||||
#[instrument(skip(self))]
|
||||
pub fn insert(&mut self, object: Object) -> CK_OBJECT_HANDLE {
|
||||
if let Some(existing_handle) = self.handles_by_object.get(&object) {
|
||||
return *existing_handle;
|
||||
}
|
||||
let handle = self.next_object_handle + 1;
|
||||
self.next_object_handle += 1;
|
||||
self.objects.insert(handle, object.clone());
|
||||
self.handles_by_object.insert(object, handle);
|
||||
handle
|
||||
}
|
||||
|
||||
#[instrument(skip(self))]
|
||||
pub fn get(&self, handle: &CK_OBJECT_HANDLE) -> Option<&Object> {
|
||||
self.objects.get(handle)
|
||||
}
|
||||
|
||||
#[instrument(skip(self))]
|
||||
pub fn find(&mut self, template: Attributes) -> Result<Vec<CK_OBJECT_HANDLE>> {
|
||||
// Cache certificates.
|
||||
//
|
||||
// Firefox + NSS query certificates for every TLS connection in order to
|
||||
// evaluate server trust. Cache the results for 3 seconds.
|
||||
if let Some(c) = self.query_cache.cache_get(&template) {
|
||||
Ok(c.to_vec())
|
||||
} else {
|
||||
let output = self.find_impl(&template)?;
|
||||
self.query_cache.cache_set(template, output.clone());
|
||||
Ok(output)
|
||||
}
|
||||
}
|
||||
|
||||
#[instrument(skip(self))]
|
||||
fn find_impl(&mut self, template: &Attributes) -> Result<Vec<CK_OBJECT_HANDLE>> {
|
||||
self.find_with_backend(template)?;
|
||||
if template.is_empty() {
|
||||
Ok(self.find_all())
|
||||
} else {
|
||||
Ok(self.find_store(template))
|
||||
}
|
||||
}
|
||||
|
||||
#[instrument(skip(self))]
|
||||
fn find_all(&self) -> Vec<CK_OBJECT_HANDLE> {
|
||||
self.objects.keys().copied().collect()
|
||||
}
|
||||
|
||||
#[instrument(skip(self))]
|
||||
fn find_store(&self, template: &Attributes) -> Vec<CK_OBJECT_HANDLE> {
|
||||
self.objects
|
||||
.iter()
|
||||
.filter(|(_, object)| object.matches(template))
|
||||
.map(|(handle, _)| *handle)
|
||||
.collect()
|
||||
}
|
||||
|
||||
#[instrument(skip(self))]
|
||||
fn find_with_backend(&mut self, template: &Attributes) -> Result<()> {
|
||||
if template.is_empty() {
|
||||
self.find_with_backend_all_certificates()?;
|
||||
self.find_with_backend_all_public_keys()?;
|
||||
self.find_with_backend_all_private_keys()?;
|
||||
return Ok(());
|
||||
}
|
||||
|
||||
let class = match template.get(AttributeType::Class) {
|
||||
Some(Attribute::Class(class)) => class,
|
||||
None => {
|
||||
return Err(Error::Todo("no class attribute".to_string()));
|
||||
}
|
||||
class => {
|
||||
return Err(Error::Todo(format!("class {:?} not implemented", class)));
|
||||
}
|
||||
};
|
||||
match *class {
|
||||
CKO_CERTIFICATE => {
|
||||
if template.len() > 1 {
|
||||
warn!("ignoring attributes for certificate search");
|
||||
}
|
||||
self.find_with_backend_all_certificates()?;
|
||||
}
|
||||
// CKO_NSS_TRUST | CKO_NETSCAPE_BUILTIN_ROOT_LIST
|
||||
3461563219 | 3461563220 => (),
|
||||
CKO_SECRET_KEY => (),
|
||||
CKO_PUBLIC_KEY | CKO_PRIVATE_KEY => {
|
||||
let opts = if let Some(Attribute::Id(id)) = template.get(AttributeType::Id) {
|
||||
KeySearchOptions::PublicKeyHash(id.as_slice().try_into()?)
|
||||
} else if let Some(Attribute::Label(label)) = template.get(AttributeType::Label) {
|
||||
KeySearchOptions::Label(label.into())
|
||||
} else {
|
||||
match *class {
|
||||
CKO_PRIVATE_KEY => self.find_with_backend_all_private_keys()?,
|
||||
CKO_PUBLIC_KEY => self.find_with_backend_all_public_keys()?,
|
||||
_ => unreachable!(),
|
||||
}
|
||||
return Ok(());
|
||||
};
|
||||
match *class {
|
||||
CKO_PRIVATE_KEY => backend().find_private_key(opts)?.map(|key| {
|
||||
self.insert(Object::PrivateKey(key));
|
||||
}),
|
||||
CKO_PUBLIC_KEY => backend().find_public_key(opts)?.map(|key| {
|
||||
self.insert(Object::PublicKey(key.into()));
|
||||
}),
|
||||
_ => unreachable!(),
|
||||
};
|
||||
}
|
||||
_ => {
|
||||
return Err(Error::AttributeTypeInvalid(*class));
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn find_with_backend_all_certificates(&mut self) -> Result<()> {
|
||||
for cert in backend().find_all_certificates()? {
|
||||
let private_key = backend().find_private_key(KeySearchOptions::PublicKeyHash(
|
||||
cert.public_key().public_key_hash().as_slice().try_into()?,
|
||||
))?;
|
||||
// Check if certificate has an associated PrivateKey.
|
||||
match private_key {
|
||||
Some(key) => key,
|
||||
None => continue,
|
||||
};
|
||||
self.insert(Object::Certificate(cert.into()));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn find_with_backend_all_public_keys(&mut self) -> Result<()> {
|
||||
for private_key in backend().find_all_private_keys()? {
|
||||
self.insert(Object::PrivateKey(private_key));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn find_with_backend_all_private_keys(&mut self) -> Result<()> {
|
||||
for private_key in backend().find_all_private_keys()? {
|
||||
self.insert(Object::PrivateKey(private_key));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
impl Default for ObjectStore {
|
||||
fn default() -> Self {
|
||||
Self {
|
||||
objects: HashMap::from([(1, Object::Profile(CKP_BASELINE_PROVIDER))]),
|
||||
handles_by_object: HashMap::from([(Object::Profile(CKP_BASELINE_PROVIDER), 1)]),
|
||||
next_object_handle: 2,
|
||||
query_cache: TimedCache::with_lifespan(10),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use std::vec;
|
||||
|
||||
use native_pkcs11_traits::{backend, random_label, KeyAlgorithm};
|
||||
use pkcs11_sys::CKO_PRIVATE_KEY;
|
||||
use serial_test::serial;
|
||||
|
||||
use super::*;
|
||||
use crate::tests::test_init;
|
||||
|
||||
#[test]
|
||||
#[serial]
|
||||
fn test_object_store() {
|
||||
test_init();
|
||||
|
||||
let label = &format!("objectstore test {}", random_label());
|
||||
|
||||
let key = backend()
|
||||
.generate_key(native_pkcs11_traits::KeyAlgorithm::Rsa, Some(label))
|
||||
.unwrap();
|
||||
|
||||
let mut store = ObjectStore::default();
|
||||
|
||||
let template = Attributes::from(vec![
|
||||
Attribute::Class(CKO_PRIVATE_KEY),
|
||||
Attribute::Label(label.into()),
|
||||
]);
|
||||
let private_key_handle = store.find(template.clone()).unwrap()[0];
|
||||
// find again
|
||||
assert_eq!(store.find(template).unwrap()[0], private_key_handle);
|
||||
|
||||
key.find_public_key(backend()).unwrap().unwrap().delete();
|
||||
key.delete();
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial]
|
||||
fn key_alg() -> Result<()> {
|
||||
test_init();
|
||||
let ec = backend().generate_key(KeyAlgorithm::Ecc, Some(&random_label()))?;
|
||||
let rsa = backend().generate_key(KeyAlgorithm::Rsa, Some(&random_label()))?;
|
||||
|
||||
assert_eq!(ec.algorithm(), KeyAlgorithm::Ecc);
|
||||
assert_eq!(rsa.algorithm(), KeyAlgorithm::Rsa);
|
||||
|
||||
for key in [ec, rsa] {
|
||||
key.find_public_key(backend()).unwrap().unwrap().delete();
|
||||
key.delete();
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user